From 6b6a326fa44d9b8e801efbf2295ed4df49511d2f Mon Sep 17 00:00:00 2001 From: hfiref0x Date: Tue, 4 Feb 2020 10:11:14 +0700 Subject: [PATCH] Update Sync with Zekamashi --- Bin/kdu.exe | Bin 225280 -> 225280 bytes KDU.sha256 | 10 +- Source/Hamakaze/ntdll/ntos.h | 23 ++++- Source/Hamakaze/sup.cpp | 190 ++++++++++++++++++++++------------- Source/Hamakaze/sup.h | 4 +- Source/Hamakaze/victim.cpp | 3 + 6 files changed, 152 insertions(+), 78 deletions(-) diff --git a/Bin/kdu.exe b/Bin/kdu.exe index ec3670f4009e7122694c486ed7185b9ef7b7a315..526a97edc8b34f1e851262269a8793a82470a57a 100644 GIT binary patch delta 24096 zcmeHvd017|_xITcE~0R`pj6XBnqVjE$Rogk#P7X{Bx z{5)7TzrZ?+!d%{1Y$-TQPhP@2j6KHjLm!`r~4kaK6Z?hIQt%46DT$mjWl}ON=e!wJt}qd^!n&NqWaV z&Tm_cjUXiYO$!K4^xI|vZ#fuFadoELV#9)Y47}O6=qVE{g`tA5pg3cI$*gzQi-N`B zj@62|X^4X;f<%w%NTeT0>Zw73kX!s#6X_%*ohkNb#MU$-i#^Ty$s{=fNuoKIieQp{ zDoR76SiWt8@+jG7+M7*c%~=Q&rNhX{M$IXWQhv;*Ht}N9`JyJ?<9p6#LezdTlF?jR z5lqI+`e@RMgnh|OlG+imI~l|uJwa)ubC%UD1tBk&Vx-F4;(1Y4;~H3zDy_yP=~SPg z0m0Btg|;Ouh&OQcZZuJgACk^@*f;O_#VjTyMxogNs@oPhuZd!%%rzCVeIDe-;? zgxY>ZBLG%o#0<)QmiMS?x`qRuN(6sV9=KX>b(;N0TOhA^~;avluk zFRG$Q7R`EpD)EC`R_j3vbmlOZ0@bLoh^jRrl@6(D8-R&X8odzd z>l+=Vv$GoG(J7Yn5E_~pj?jysY?hLm+4$`P%0NH$9z^f*`As`BbHR5_TQatjUvyvD z>_oUINQZK+*_cW!qG9(E`)*3x>I(VdW?Py#AU1CC8qpTQ+Qufc?nxLoHIHupegx!( z-9N=Ipe%9`LKf2q3~?u87ncUSKujEXB#Gv`nt$2+EG$9wA%P;-A5tW`tp(FP4v0-A zy-ovFI&U=&Q8=ry7w_&ZIb5Cud7bp5)wqqH^?u7?G=F zTC3N(bUFXiC)vFpg!R*Y2?mE$ZKCPm%E$Qjk2~BAwX(MwA50{hCW=Eodk`Y&6-63$ zI(CncO*0u$`?aWYC5j5c`EB2ct$H9_pUYz85+{`>Nav7~MTaajyH6(Yd46%xw;2|vvZ2{UzrtXQ9meAlv&;c{+F*m_iXW6V4xy2NkapCk(o(4VHtsWLzWy~s$byw zEygxmJf6z-NLl!HqinHC!K}u?+{Zs?tuybue6y zr>f=s8z`Osr@V+dtwsH;L{WM3`33*sO~zAWDLp$-;jG3U1w8{CMYf&~Z0XJV@fj`W zW=$MJqtsY+6YGy;!C+c{4deCsC95^8*kqm`5M0zq6omM&Blo^RYlL zw52TPAzB(yXITW9wbW$Jnv(NWoK*(HPO9M%zrpZS{&6e6&cP^w<&3v7<6KPU#DHK+ zo|0qD3`~{SA{~Awn&Se3_ky89HKhdW`Hfbo#*!Ma-PE*6N?NPYi>CxNZ}mYJl$Ca< zA|(-)Ys+UfsK@!5k5nt~Q_>Xvd60))HnGR}fuQEhmtP1P;_C_lGMY{q75}Wv{kJTN zX!TWyw(-Q)@nKX9C<#{}84V@#SWzmiGnD9hPZb55(ypcNxud?1Ra4g}iwIuU+TZU} z^iQ0W7!V$t^Vn`S);Hq~MAq)ZI@m1{%R&veZ{u&5NeL=>NSoH(TK=tMG!tMo-Wkb+ zu+tc%d-Q^kz5fa-gHq_eQL-^^Auz<#j=GZ!Oyn!u1h9|z4{ZWM^GM)&0Ygy?y@=7- z&9M8Jbsjkkdzc)o$R5qy9tiB9g3wLSTKC}%oL>c=j8R&;1-m>Yu)tZwQ;44^+ zFRWJT{MyFKMz)f&$SX*1dxvF(xhviPdQ`uU5-mK3&3!wSRywA1C+%u8oGENUM`aqN zGf*ue)fA|P71vZL%JT!#AwNRpLV{RC#i6CJ`Njo=o3I`r`yiUM{*47;l1Xw53`Vj< zDXTo}w27u+LMkZOYJ8LoCm;peu^x2~hsjMaS-Tu#A9iV$PIROpIIlZ)e=S4H*=p*0 zY{m(QZ{Vc(E6z$y8&gfcM|5oikQP_Q21m*&B7(NOkY{p$}~8EDlJRDD}qh(WgS)Bn@}AJUnZ)#$$R~ zGaAQ5y=R|Ed(%6JtXYf6oYUQ!;S$%i(;Sj+ zwN4OBxdA~}ejp^A+3|ZJArmr?#3c1XcC(S4$=%Yq;VW%D<9DckdkU@F4T;xL=qrQ{ zV%ryrX!Exk{Rfi)Y%52T7&RTv^jDGoZ2n=WAB*Mrp}n%6qrg~_biZi$ zy@o3^oUUPi4FffNj#5*)Y7M_vFfTE{e%O%VBVvb}q+6z(Td5`~dP_%|OZvETRH&ch z!yY91WyYXAI4mXV{4yggi}}p3sMt!hA(p5`L(zpMW%v(=h9&AGHC6velX+N-#Tmoe zB#ntNj>>h^c;^odu z!aWCHM03=PHM6LvVHGa zz3n234EU!wrx4bP;{<6fjdbc6i+~WdmesfteP8RO49YNy`Qy0Ng?y^ZY6XkWLUx9? z>@bHr*jx}gcMe$36;5J2vcvS&q_u+RrTyqLEyU=c*I zMV_QCEl@(VbanG6&bcC1#05ms<_19=mM!ywfNauJmNsRfwHk{DP$6JUI{$vwQ#)wy z87~OMhB&x+)rdojN-0<>bIMZ3m74NW0-Q~G83De-{u!8I4=@-_d6}4Hj{%SJGI4}E zlHmO;ih@%3Mn$`GA0uvryRI2K6#Qy>rayCU}KFVlh zGWV~u8prgfu1Pef1f(WNqk|Hp+1N{diyb>|3{P6pB+K;vtwCtHus_i?v5V_W(kXO_ zVZjcnc<#mee%Od0wy8XLl;pt0C=MKXZ;1ghdu`E}iDvx^I8>O-tx#&qa4gmsiPLE7 zO2c+*xr!+ZK`IH*nHWVl17K8R(^2@n{g@E5;6X-6v=bAGGn}F$&~+INqLFV*W?M~3 zr_7Cco?7rjq^UJ1Du%f7THT(%kS5W*CV(o0x;iIFZ@8nrzNqgw-lJ>az-}nwze}wf zNp9exCsew(8YmWOXDFo(J7UqRg&zBAp)Vj)E&t*CtFB>Ahj4&5nU^b>T8jAfuE{Q! z;ImRT{dX#DW69_JyES8t_-ozL#N!G4c()N=x6o_k9AK)aC!z@=le3r7emza1+_YASL58u>1j%D&& z-G_*$`taBuuAvvb$PxKNS*o&*prV7zl%=ZBY83jQ@o)uDM?;Br(S;Nr$`|%nApX*u z>tl9_7vgzIOkeTuc&?9qi@nVk#(pB=7NB|0_Fj2NWs;TzxT8Q;qfI=u$&!Gj%Ahv# zw4UKj?V&*xOUCe}_VdLkuo|cG9X;y^mn^XRxx zTo=FY^v|Qkb9LU4t7qh|qVEi=pE^pVnKU>J(?j6DM z_|D#wm_K*xlOUEH=HvTx_L%4v9;jrV@yg?+-s>hAo{KJB}8 zfGV9QXLJWvSSzD#P`kOF7K;q9^+__6a zJC?({CwK)mBOPDJEgtmiHr6d@Hys1s4g%bA=`2Y+J0XFE@uLZmgKyi3Le67mSm2LB z=N`%ITcP_2A_SaF)W?u_47;|trJn!AE=OqxY9+seh6FEQhmq3{lYe28(LiJYFU!1 z1R7#WPKUhq=HgQ9GQOirtE#GEhQQ_V&5m~Fclvn^cw!3!o5xZGGo4XkkqmySgflw8 zR@h|2Ox>Sd(HJ?E)_aC5-4P@(<>^iXC`gFlMZjU*MxK(`%BB4#t2J|;X`((A44Tr5 zFHc++blL`rN*U@4Pyvas_(F#5g43CfmX_lXIA(ds2lQ|1wH{IM5H4gkun6eDT7&9p zErA&4qYwIbXYh>rd$oPLGmWiycT--xv(=b}5S*M4;@vwbyt%)x8jj%&2Xx6=LB}%e zxh4~aTAuDb3ZhJ7O2djvtM*W&u5 zw}LDl-=mH>_5qeZaB2o4!d_5mRakM9&KA}U%ZthXG`f<$xuH%+OirMg9~;mDm&msV zv~cikKm(38o&nrrU^CW@M+}T%Hhj*&5KPbffqr6P1V1*=$MNe3loks_4Bfjt7}!a? z6vjIY8p@n_&Y(U$8etHa^4v|*ID1QDmA4$mc&n-+&%%BLbvj(RfixS<(Ixq#Mc`4i4?$ zhhT+n_8q27qqsbMI#|Qr8?J_&Ptdp!jE3L`+>8r(UPJlogWC^j2|-S!eTB{lhBo;; zT@!Gz4@!MAB6BKzD|FB5n1Bi);t9Atf?#tp&i{N|*YlaEEj*BbE8VVS>T~oL5gU`| zb*hfn4EAu`XAlL$3Un)exZ{xBEnW{t|7LijS5v`R9J~~l$4R}Rplu|9Ump_9atc}u zUC+eI5Po>rR`K^IJY#qZ)`82zcd*I4&xm6CcRNxG8fS1rauf^T3CS@{2iM}5pV|&xh`o~rL%Ba@jZ*924Xn*l=8y-B` zlof}RVMpLDh0$VUHina>EZk+#2*&zwj3)AEOx9YmrSU#(XyR&1o^$~|ml4T|XrjXs zQ!R;PDFT*Y1GXIN6R&^8&}|dy@-IWbbb%o>BN;jZ9z{9|u>1)Z=sygNdd1L6-Xp~r zkq=FH^k(B1WQ9gOtVoo6Et1pzaDs}0&DRNOYcWBGw`Tm#7hWE|u~HqX@fsPxfkrnR z3>^;4#-Y3<#k0{4)R^=y2k{#z^Tqr3_@pr*%&kBklg7l7>jlrpcCulg^6&`(Ss9ow zmYE~rr{aL1n?a!q2$`b1CVkB$x-#nL{0MZLy`8B%M9mp8Jms=`Cg7)Ad`taP#{ z23?H(i!*|v*3D}q==4%)F58= zJn-{n4RUugtk`q;fzO9H`GcoH_HLvp&*;s4)<&|=dGgu_`z#p3*h?)~vG!di-Ynp* z>yBcvy}Zt&RigqXz+)?<8UD{gh9Ptnt%%8y+0qoH`(+pR`_gN|ZW1XWmQ`S%HnD#B2!jSs~8V&6v2n%(+ATdcyvd3t^m8b6BI$F7@uOwqfetUh> zQ46o5&9E0ivDOiOXr>;asR&udz#&+QtvM%B$ZUd%U9DKS<1ByrIicJW#+BI29`us{`vwkG7SGQMzl}v3NAb=uHTNH)cGuo%h=q&c^fXjcq!tz5+XWy3e43 z2fkmGz)A#OZfoR*O@e^jt4aL)#+I%heurGJ0)0WfltSlj-8;PT*RiZ2ANuvjuID$x zlsT3hG}RH7bW{1muLGUqwxMrIwDDusMe%lx3pw_>+n;jF=Dv8@3Hzp(_+T@i_svK+a;Lu; z6WD$=6-qZ?2i1Ul5^bOcV#-;jsRK2H58cw5jo|NX>67&nYKB!6PZKQX5z9mm=*u92 z1NSFc>Us>D{b*-u6|b%Jt%6!9RwezL5LvoWw4|R-$#Me600c{rDr=Un$dVM9t18p0 zvgeyfFG(O_PT(U7)i*f?Kna!#4AZ^0a1Q!*Jo&*|1`;OBdqqpSAp>CtRDo)HqI z@9kkwxkHvj6M12y{Y2WqkR8ffA2UlCspok zYAY1epuh?l3lUs;?7Kev#op1zO-NsBYsx7O$cwb>Mt#vQAM+VMg!zqo8KaCRY97mL zq<~W4*+|!wANpa0;S5#-+@~rVES=4R_JuZI2AS1(|Ay}9C6$>jM=}TEX}AK5H~g-i=H#7dx;VPI zH4eRietoE1+hnv>MSj20t%54+6 z-ZJENKp9a4-G^A+FCr?VZvs8`VpV9Y=oV*$Vp9B(%j@>Ha@e1XHroUB?{ayI1ASfh zVBt`%R^blh(;{LvZsgeqe8fL1`IiUWT3x+L{fo%6U=UdiupHD1uy_s@SK;=WEWYYNEyppkOBe#@pM3Yi#3V#rMKeH~4*Bpw}Z}}K*!F1Ear%1Yq zcPRDfAwdG?@v&tsybwAm*;?c1@=P~Njd-Mbk%@<>r1~-S+GUTZc)I?4QRxl)Ngu(+ zMBVU$xn+Gs@!SDke7Ku^D#~aW7(J5PRs<}m5QPUBs3A0K|?BJQC=k3MG+ z1;NKYWNbSxtQyF+7c@9Nkg>4^BYwOnvei87)HJW(7ol)@@mKPa$hDbC14N2HZ^}cX z=w0}}Q|rXy@`ACa8!`v4g=n0nXscUq@>yqkHQ2Ee9k2hC?>iIdKl@Es$vJAZ?81jJ z=#v|JD{<~njzX3bH!u$MN!<2qYu1W)I2$O|?BK)Bw(WH`T|HTPSdP|Gb1B!aaKzEd z@77M2^xq*~F?tWtFgoQGqt1%aWxNzdr|>_|#x)4T9l50U;*r&X;=`GIT(z%QJ(Is* z9mKZqZ>j_F<=4sT4s1BLR(Eu1IaAHq(Q+1_0OaV6yvI2=W5)%^4=*B7VuqXaem*LY zs~f_np7Sv_`7bd(1#8ds*Rl2mw=T}L6>EwMCSBLvStLF0c*P?ts zor}fEO*zh4`e&o2xLkM}*Cct6TXnz9EO>ft1ryJHQLyZK7GpyS8vl`Q%LW(Z+>B>z zXu*+M7sk5qi?@b~f6F}N&)?Yq-t_h|)|P*B+t*<*oOfFU%@^cx|-2s$^AKyOVVp>7ok^YrfnENQ=B)i>*N z!Q)AB7c0V=Y_){q_hI;3?H@MB7mcQe{_J%=?O_Xi$MEsPPmTQOg_1f9 zc=-_n176OW0Wa(Jf*p^0G4V+rzyD;V-KacTiTSrH+-+m5#t^>sX(^k;)1SR>Z!-eL z?;7FCA3yW-ygVG|nSIpg{c|4}a=!WxD&qKX9`fASa61&BeQ-D*_}qz7}gWa9IYE52o3%xT35)~d_yk<=fKmGDNkETBr&Uut+&jmFre zI~op^SMO*z^sM@Aaxi1f9Vh&geq7;j#*B<5$0 zUP!AAK3(XlAFfJ9sFEN^5>-jODhY<9rz#0kC6SOssuDj{5(7yGRbo&jCP)HQ$@ASx zUQ-|m9iWP8RZ%)bL8|0}Dwzj~w<@VnBvLlo1VR^8xJwl-QiZnimpbMuKI|R3QR zY;UD*6I4_7NYz=D3{oY|khE7N-Bn34BokFhJ5`bj$;iS0J9dbPx4RZv8Zc)jmc1iC zv1gl@zr4O7OJi&v9ZV@yB^`u@lBYGx?Ge^JL5A$4)HBsQ_26(lI&*hj~@> zmpd9*sDAb!GW4_}3OY&Yfd_Dfd zbh*|I{WV4&)RcY4@@1Vns}wK)ET3>^W$2*g%~%raDF4xn^BS@a+$$Z&a+3d*zCRGB24VZ}etw8>4ZPIvZaH@^%$JQ6Z$`)&zN~fIgAq*VE7@9lMy5Q9GAw|DMmx`DMd}ELYFJ%gDe-X- zJ`bHJSNgK|n77==k981lgv)dN*gFm_(v+RGA$Cd`mwrQ-V_{MY*2NwpaY-AtQapU9 zFrY0vpc9WClCKA|No-uVy)`~5V2gI`1o{>9JLneZ9_R^(4Q7HpXaeX>P&Vje z&|1(ppxvNDpdUd$gZ=>B1-$?@g7@JDY61FY22yni6uub<_Jl|?<(Tf^jqgV51`Z!-pRiorNh`xo7#us~?St9pMwbRiJ>y>!T)4<850fl=^o6LFL5uR936M1OrHAmP;2 z1e=n{Cc}(MqzJ606d&M7iDlT*ZnB})=&#tS)q4QpOD^A}WO4LvtYM^M3CeK_RDy`n zvXF($oxLVP5vXsg;K-lv8b%%k9fIDKyM|=1Fh!oMf2tIABxH(CCB-#R<4FG!!pC5z z{cKfF-&V!js9+6pcecgnoyG@imCRfZK{Jp=$s0zp;J_e7GesAyVDd@i4C`ZI)j6=8 zTDtae^5c=rzh|AQ(%xPz>?ve?4Rjhr{7ob=E?G`_B>#?#|3Elm8p1GnezM`BSKSJE z>?ju9>rF)`#rV2{&NmTfJPzj{4f`JQpIse3+3=)&En@E({`kA*4qWibOEbM;PTw19 zc$LkPe;vi#LQQID63S(1=Zv+i&E&}jAGn9qC0%vR5RGGFSDir2k0u9QE4k%p);7xl z;qoVc+$(>4vHgi<;2(EvUjZ~Mh=qqESEWdCuum^OJCh#HB8a}`}E10q{TFPr` zjqzmePAwi(mC>?$1A_Nbj+T|o#%Q6V2qnEYvZVZ}vsWJJK6P%N1T4FDXR{X_qKIj4 zMYd>~D~hzIqBatNQ$>|!*RB>-!GM06Qhw+58-Qikj(BhRXH0~y(Z)o1ZE`i@igfAn z^c2>#$2=uXiY}Y5Hu+@v)3HZUfWU06Agk1z?v&q4K7u?>m0hdZ95_TNRL$o0Q{~bW z=HGg9t)pjA7m_E|a)6#rPB9soAH) z%WEzgyHMb9(4q2EPuh=_2aaJ)8}44JjDo+G$uq~W!0!2KupA||EYXwpOe_Le4Ust1t{KxIZwgD21DlQx-$tq-fXH$CbFp z&*$Ru=XKdJjYULB5aDA~=(x;?+hf$3}loT5eP@Gzc^DXJKugSc|SaO2D`=7=r8rjoV|7py`cbYS6bSWrZ#L13YoP zlm|-snkL=%HxMeR1ElIaMDjG4-0R}_h(}O^p)FYFmDeJMXP|c!teoqF{!31pQ<;M(=u2m z@n`44H5qIxV{a5D%wg-9=T-cj0lq(WM+vRQ6a&5Ana!9y2+b&LFpq7v$yyUnZ6^pz zG<;jbsTwA0*jK}D8gAE6NsM2I<5W9mHQc4)0}UNDeeeFN-WpY&C48hQyrH2aH)!~shQ%75 z>nkex3pX{vBMlw37HFYixP~zrQlaT5MQeen8qU#BjTM9rTG&lPI}IQ7Q7dNYlch30 zYJ%@HT&dxE8cxx0l!m=EY^h;)&G56{s=eD9p4PBf!>=`5s^Oe0jhU?BAPr+Q4ARh9 zLpu%cYSZbuhE*CmX$7ipfs>;IT%`zt^8y_7>xG2FRk@sdgEx<03}{|KM`QH{4hp<LbGGm6GiGOupD}Tg@65@*bL4FeMGx8RF3z?kUHO^2=-$xva^zSFIep^S zq%gRdn8H|Up}DzOz>KNm)SYH>XF+%qMAd&&9_A@-3w9D3?XpW}Mti}S)TWf^)j;?Iq4?TyL;65zEj3LGWE5ulEw$yv*p= zfjIdksTt+USG~m7`co1b;PJx+q3;Mmn1$C3!uLQ+UkNiiQLqaY2Q{>1f^7>ysL!eb zA4esPgf7x0$t%3Y&hklbG3aHMHRA>05hx$=k7T`%_!-+NZ}t&6Alg^-0gUk#Ujvl; zilblFphLPKM1s2K%AtPZgoyg=0(Zd60nNr6??Ir8!B#MY+X;qHhxB?K`a8nAppo(s zKhejfUfgdN+&R!k@?$@->r3(H1%j{%G*XTY5Sw(W*S-MJZzM)W^rO_f=RftfD?*oo zDAuV+{-}jG7IpZuh1l<<<;f=m;W{W^PVg5!M%G*QhRd=L)Lpae(%4RD9PTVMRy#Pg zUT+_C(oP9NNxh!h1Htw2PtKzH)q?P=yx(6O_%hc|FA2hCkXoOY;%4vc90& zvuA>^;W-uJaiBQ+W!b_EOn4jgtNdAEAWuTGr_*P;owYF4NWgIs6*En2?uLDE$i7bJEDlmv;bnlBAy!aiJO2Stm5A2RA!6)c6?djcgHYc zKj=RSd}>U`YQfi|PL2^;>G?u~|# zbkG&(q|5!=ioFKp$53CXKOL|onwFwPUy&W4Z4$D`UjOI~#@>B?857)Jk$ni+o@H`K zGqL&qddUClA^)$3Ec}1-kdriz_y3)TTzIIXc&_2@F5)W3sIwhZ|1e0y`EAwknlAqX z%BOmZ9lJdXR@Ih<{158?#hhHyOq6-5P5YH5(LM_watbNVg3!n)2;YHs1g3yak{p=o zE(rI*6J|CS1V{W~_&netPyqNcV2HOM1cMI;e(8^+KllwmYipzjFSG%I=7A@C3R(dE zSsR=K-)bues}Mj72(Inmh=3>bZZ8P?!21HxN(xVimJ`lHPG}!22zB5I$ATP#kpb{? zkSq9gKs1%$37!zmB?N&d^av#$=P*w&yFqb?*aLhoLJ)?6&jvWO0!@xWVI_~nbh zEnp|SScQX+1YQ9pf+zd{PiD#B7Xat?5rk>r345E+jNnbc&Iy9B9DF3urY{Ny-WDjr z$=*ji@X!FX9QZPz=RmYjD9+(~z^sS2?Tf$$;7yPT{4L2r7{-@^Jioow6;w``s z`0HdS9C%RUi-F1T;V(f>I3Gkhgc~(JA9zjUuLGZg$mTO({wP7P4HJb+z=t4`dyd9E zz~mJ42O`pehd>l@7T9r&TC-r_G>s?B*LcDN987$XmfVLo#-sbdPXjIoksZQq8ov|h zH32OOod94b(4{OWMS|%|0r087bWk>wvVqQNxFQ4Z3ycIU1s?;91uX|Z2$%#~1%3%| z3yAD&1(s`kC2-*+bpS2`o&b@~NnqApEpQ*$aACm>Z5L== z0Gy}sgw1nRxhJp;M14#cu~6kBftwep{8nJk#pr)hiUU)*1TBG#2|IkO^1;9-pJ16q z&C-|Q8+Q=Z<`$5x5QHhvw*^MaC>(TRfX_hG9fa#wp#qR^0KUE&T?74Tz|Lz_K5`A_ zf0NHuqprYjK$LhZaQ0eNo&j|FLM^p3Fk~HO1Pp}(8-A(sj=+bYL}c~|_}O~3Yt{f` zzd~B*#{r`@U`B!O2CM*C!m$3I2Q%txbsXFR?#Ne_b^`UA)dD#KSAK(Oh748#ZMUc+ zoUqYW3|Pn=f&D>S!4CrZZNnf19{}tQqLz*Uj?(xPpq!-zRsm0HJfZh?H9-(?35W(M z;Smr`ttz1H4(xcH&;`J9&@E(k7PxdL_7CucKZB@6F9AD$tMb!;`5-D#)^}j;Xo35{ zX1mmgcEHu3NMwM^H{l#882ou)Y=LSh5jYn_hO&V_fEGb#AMhb)EBHsi{O_@-ksaWH z-D=;T1U4!}|4%_gcp=tvP%3!ba|s0?GK#w|0atknPssMD8RL#jz`dDLGr~7>F7<*hTP#iF8 zBYx4G&Ic~|Q8h$}8&jp!gt`;xKV*R0Qy~FF86*OqgO*T@PhzZq_JCgloPP?115bDX zv=jU#;PBIGUdh0(K(Lb~Yz1>m4Jdfw3^I;H0w8Wxm35xbzZxSRa@?>AX&`D+!b2b` zP#N$xh`OK-*!-NzdjePgq*iPLFy;aXb_j=FK>t&M`Ij(yL8*w?2Yd{w0{;vc`wLnI zd>rsAP(Jt#z&C%z_yC^)Tn?fxBh0%DM+NdFz6Vvz#>>?!8|?&oNME^xhp5ihWEAtDl3 z38GbxaEpN3DClej&Jc0220k5#TXp=eDP#;>1fmKMZqRtbF?RTWFwjW_R)c6sHsQOY zUqPu|u>M~Ga~0nTQ4?JU+TxR_Dae4Z29ymR?*l?NJyW^>Zv?`}8ow22(Rf0$6K(}j z=%v6bpnRkyT!f3mJ>bs+mpQ`@_~pQcSuSd+9f59*nQ$Eu?!W~g8c>9nKr}@OuQ$Or zX3!yQ;;N=~1%7E{!ZXN&-I(xoQ?(E$fp&O_Z@~o5ZrD43 zycB zNAw{EPB&mCh)zZGfVYED2+{$56{5D#2H=OGYC-?G=)_ur3()jVu#ekK!XnU6@cV#& zn(%pG76Nr(<|e4kI}e!BmkDW*6IO$$dCvn6^;31qfc}YU#xJi+p-0AO1AERcR3OoghfzDZA=2)f6vV?hHB5+GfeLNJ{ zD;2eeQXKFX5DmIIVB7I%3CP<4?I$u}4S2#J5Va6thQ6rU37N%D~?T_D)yF1fC&p-+Q5q6q~ z%VWp~0aHOH@aus1vnyc`_)1{)J4{Fhe;#NzUoD(HFc74)5O4!%8gvLtL0J@02BsQB zwF!Qg3GafILy2z7kAp~l64>@VS~9V90>^{)Kqn2j3Pg4YUq_3UK|T$brL}H0&?6h; z1#(Yd9;gcZl5EWX=Lnof!1;X`1zEsn1N(e{!9{Ys$u$NA(>V}GZ-0)+jF8^*&VnbT zx4UQH3F*};9r}dyHby#x^dLt(;YSLeB`Qq57C}f)S)@extHu*P)ObRA*&!W5dc`50 zkX~tsCrs6N!g(4`xJ=^-H+yOUdT*%KczRb57Q&GH=4de|>%c_#CZHRjLQom#Ea*Du zJJ2mqB}hoa&I>FCodjJ0?F89F{;!{@g5U#UAOpw*8U#uOrGxB2>p(j}!Bd4MLNS;{ spp&3FP~gAHEObg03!PGJUg&k_x7BTXROm9p<}dbt0FzTg#{d8T delta 23992 zcmeIae_W2|`#*l2SKTSPyNhlWl~R#HQBjDZxFUp5g#4JX8I3aAYjT-TL(y*}^nn^;opDd4#FZQL2&OR z3ckw&TeC=hk#!e$&gIR;cH+?kyoWf1<(3qSTNpF&NJl@mwq%Iobq6+y_jC?sBYC#- z*X;R{&MvJS#h-`rfyS4_gVDUq__cT=iZ61z#=`k*(|h7A_Yybv%Z&Bq4IalWXJZ6G zl3#aD3f!LHAPA{}GlC;i1Gh`yZF8b2@0L_lZYrF?z+26W9x=i8Vpl;ZEYIyLS&f2G z6l~3I+wI7kfjo#pNc7+qiHw<~9vmtNMdh!ykZU1nPr2VA_u3P5Jk{M=MAb_2w`Eh1 zw!O^LTKHH@nx#MM616z91DR1&2!VH?~e41>reKb`6O{>A~{Rs56rM zK$26kL6LUzkU30A|tK=3Ma%bfG+q zm@SQ0cy@CdMw*`dv1dQ0Y+_IF{^o%!fG;<{Y`Oms0+$yv zQ03{t(~$8eY&4j|^c;6JhpJf!x$RZ88m(JJ$8z25<|Z%mPh0wXIXtl2i^_9fq=8IJ zEEAluLS#b+Uf?pR{~cts#>s9ThDoqRcA-_9>k73*=$mcpNY83Mc%LdT&b z#z1b``)zU|8C;GO49+7kCDkS_t_*&HoFwollEM$Q+SsZdmZ0jO>p=Y*Rbtpz@@nft zVvCoj(*l+2?B)q7XE$U2`^(K5o`d|B{EgjQ#_RoGZT38+>*N!5a}1x-=Ji%rrZnd7 zAg;2(sL$92{;*Ak_h<+k9l#RIy?kDxRUN>m2MkVns~39ZY&VNkvQDBr)KfJXV+-kZ zpj;PqCUKvTPx~8L$MmezY8Ex(1O9iwWHyM85A!L{%L}@49r+(xY8SJ$b}&`?Z#$6ngP!#(P#f>v z{Fk6nEncFotMfEgag;jguO#WHIgtuS-l?{F5f4RihZRjf6a z@9p-ea>+VBII^s%C$L@ZD%wteXjw+8jV+(I12vM|u=A!iM8|pHhLq)&23}5%7 zWQ|YmfMp~Pa7M97$WN6`^4U~*zyorp0k*ABOOgkKQXFg%y9Z6D~_3oWp5e|5WfNY>QgNZTr2+uqM9h%zSeyX~__eSHn=KYpst zFjdEH?l6JTG16tQ{B^QiohYA!KaaurClwo(_CQ1F*eSz|s2kg<<#$qTo>3v+_-Ebk?A0-JmKGd2NTFz>hFFNpfm%bYj6nr#UXrxr@w( z1MpbAQnAB-=bm9fP7A2OIUXO@p;y~K)rwvO*v*eKnGkhGK4sfy6omYP_2>**Vc4s- z*j!3rN~UA-02!FYH-!bW_jq+!u+u6M1n}Eo-k$bpsx#QB_36rw$hgP-!aI3(gLO1$ zv}(*l5hySiSxM^g2NTf}oPl;ipR)br@yrRGD)Z}| z+%1l1Xj~SKL8F`wZL6^aW*Syv8N(JG>z_8Il`^k4&SSk2Tm5;ONgRSH$gjrmA*66u zk4k^)T?MimLZF;RsS-+gsk!CU@(-yn?b+`}qP_g}&K=opzO8eo$pz3(k*~EbPnK^5 zRiOCs@1XGFEu3M7w*xWG4!3MxD4Z(y$9gc%fVw1)a<@4^mW<72&uyL*_oj0m9TRUO z^V)iB&4S+cT#uxl-R6>X7mtmIa~_I?B-h&3@K+;Rvs}I^B9MK-OCti9AFqoD79B_P zClOObr_p>$WF$MuS49RhJKrA}#U}6@kpYO+OkD<=o*zL*VDky}>0>^vi@)P*=n$`s z_YNHoCWUsn`LkcqNUJgVB9t=DP{%79+#tyP4T1suc$a9_oZGu}vEFgHrQC(YW{juT;e$lCw$DJ zbWE9~uJTDxuqD^hkPVKNtRoX_wOGB9JT5^hx@0PB@l1q_ zFp>izrJk>Z&hgUE(I#o?T+E}TF^TbsF=n4o48~vQa(1Oo#k6nT?|#Ky5MRP`FO4`c0#UO!9$kkgSK>5TLH$PwgSx0Kht@EF*fd} z!h`j~6~8;m$8C2JRHn-1$UH)sk$NW5-y^NJvK6Eav?IE7rJlPYNyBV6Z^Ghfa8nm{ zAIiD&HFB)x2Cd&G&q4Gf@7irNv+%{;{Kfi-{F81kvk>mvy&e03_v`+Z#Vu707~V&$ zybQ6{)Z#f$>}DSb;ZEQ#>}Eez!BiNG(+nQ0E#TxysW>axd9+k;Jwg7CJl{0=;eK3I z1gYSd-EMA+0fP&gSTH3xR?r<|YVfqbE+v-1ISSSAloS=WE-#*M363tP7o*O=Au;UzCcD)NPX!@1FW)0320y_)Xo4|2I8Rf9vk@fF!qwQOVC4r1h4*t~ z;@y}~p6eEm`+9k9lXx^FAumi*8)_b*>S4KJ^Qtz^45ES!O&8cnG0~Ltgfi0X=8s9U zy1}sT7VM;2*9FtMN|DEgrpR+5Q{xCjbGSwipuh#bAh`m~Y?T>MCfW zF1d#B)Nm{T1budMh~99poA}M1QEsC8Ft9Q>4RzQa^2lBp;f-bo?^LbYY!9C`_d3?k zPQ44GcuB7*qR&9?6F=H77IQ7(mI2?HlZx76ljLeiu9d&Go6Q5cH9nB7;5*{uSO&iq zpC`6T;n}@gi^dfGM(Hv5r+{}9=W8iAxzRptqoBV8_Lb1aDo|*847}B2`69yqGQ>N1+hclM3;N{0sZh&Cz>W&q+ayLm5v z)c3Y);TfFi)58 zYzQmE)g2vxcR|Oak2Hz-mJfMC4k~HP_xWC&u&fXqsyV#Xq@C_tCDoc2QF( zK@Jqwk;2<}0jW0p!Z!>|7$cD&2$j>iEQl3yJ>gw#M`0E%aF*m|wn<~qq>53b@xW#r zOXzKT3}GrQ-m|i^Ev=p|HMT^p*(0&h^9(if0l00{ezz|BWQq#Ge zVJm8?X_g@lGb|O<*zcMw1~U|JdGiNQk`T%EfTIS4+o|n6UfpW9=gpHQ8$Sbs!Jp3S zQ&(j9J3>)ygVve+_!f`|i!bIn7M{s-wY8mq#0lHoCW3&My8mpfR1kl|K@<>5T+C}? z`v*&=!K4Lqbr9Po@NWk9W>dIvh+p{8?zBRay`|!0ce{BfQV3bP5I?1x%3B8qXz3+< z?&Yf^ZTMs|Vy5$m^lD=l7s% z1=kCF|f@ zcJq5^mn6S$Qy1c@I(4m`P|v}t&QuQ7!-j!NwAxL zQ`0o4WxNpuJq{cm&k5xyPULy%DH=Leuk425@<5tm>x+$qjd=fl}u z6ilniD|yz4y=}{)v2}9&vCwydvo-TmgA}*@s-K{P=3O409?#B}%ue6LMDMP=<*3iZ zm`A*7R9p5Y|83L`wwEiT%bmZDpuscG<`XjFaMgP^Bf)D^11|r0O%Qo%p1*ZRtT&^T z-^vK|e-U}M*U%@7@sR!b=z?|N0^6Q+I5p$Y1|E?a<{bnTyzi*b*YE|~@IFm<*%|!h z%ntrnakDIVV9&+f*F5zBIcD2W*gUZ2R&6-O_htH9wvft0d#_ofJwD zCl;-G_86C<`2Gzhc#O-Mg{F4HCdlAvn%Lkg1l{vAIttmZ5V;M0SjHp3*iT4S*R>!V z4K2_^yYV?li!SkzV>+@E{H-xlrQP8)8+454b+?<{!l>z^^TLv>{hFl6r_h6*a3{8< zaOG%!3$!Zg4CHq6e63uA7 z@UU_Tylp*-)7f!~nu1e$Jjym;Z*J+pc;W`X)&Ys~Ep(%l4B%E{*aAjUO>O2L<9wUi z(N5Bj=)k*=n=dBa<9o(+VN*+f8#jfC9>0_fp3u#KUE_t5f-P0IP~WUfToR7K{T-sz zMWm!Szc0Y&MeL_DzBvAUBygJBk{dNwlI9Lga}jA8a6UBTNpgc^joFGPxKwM*B0!3D z2(Ag`+KLOuxq>Hw4CtfP7xB8z+fSZ~N06nHgR&}bQWdVvY&RyUS|wWAK`N+-w41GM zX&x$_rGiJ^d8Z}WxDwg69XQLSf{?etYqL~|m0l5vxf%@pMn0u2H%`eGo79)gnsS_p zJ%8Y{rUaH`P3_#I*~_@P3VBA8yP=$~dP!#KC4npWcoVd%c#xDbx%OzkbY^Q4kHg8EE^N)(|}!SxItC zEtZ^9~X2+3^_Wib*b3+ z=RSHZkthkzZd)JYd}D`rHezGz z_G2(u2=q#6hf_GDIWjDvF32DU(@u&rbSmL5Z}gkwL?Ts*oE--L&o8h-=F|CXHQpwE z3GuQfPbHJG@e1Tr=vpte3Y3!#=Sc?Jao~69Jk_(E-`eQ!ypSZt28Fl8lg1G~ZBswC zfPc1Wa>VXk7z$I-2N*PrlOVip;E+f%lbx{|@LX!>w~;(IO@M5+@ZKMKjrsOxj2X@% zC^op#yNnU3{YcryAwF1!QyDR5UJLk$kY7~ICn#Whm)dGIx79=~0Jeo{cltS#y4z7h z%UyiOhyB?Oe*eQG7MH6uF*Wj8IAgFlT$-VIbOHJ63Qf8m5lT-VL1OXZU^Q>LM@|7x z8&HB9YC~5JT>VwK-CPK%>Yd1r=_jgzvb7t@1j^JxIH_1PF5taB>K@8IpwT#;D3@ys ztG-WoO=_H>>kc@N=2*QcQ3$}yK|A=`kD}QwUi(p4=ilpLr`XW&InEjLsvp$EuSh&S z)+i|30|5nDdwA%UcAgh@qZW7|s!V(IFr46%wj{DlzIn?#o}pV{%9=>wnidVqhW&iN z))4oV+c7s4`uedNiuwGlpNfOm@ebS8VHl5Yi)OF!N837!gVyr!j|0RGYx&@heZ^*L z`HLUVWNZ0%ACGi-{5=KzhTiY-*iQzsJG|hNeq#Smc+Dr7h?d%ZIxggm_oz{Z_2@AL zmHJ|~8uPH_Y%{clx`1!~v;*79zxi~4r9BkkRq?@s6+B>hm;s|FM2Owu*8+N;z+pcY z?^M`s|1^#YdZjLZ*;oOQtrum>#)IJDC$|FxTc{?Rj>jFyHmWjDO*T%G4W@S=+c1HI z1tAip8iyPUzyn?i%d{yx#D?FCl5@Gsh7+>14r+uClL5UxsiV}7Fm(PO4 z;7h#e_BE#43KPWKurhq9z~n9|*|oiAGq#BTv9A>~a_6!>J_qp$B30hw41?t=H*9z=*y_U9Zz%A^+dyCd!7`~Dtt^b$h`T1 z(WW4H13b2>2dv$k$LAgB+UhD^#_Z;#<7x-IZ2eS+h3j+Q8eVmvo6qp>cKcxYN{Vbt zm46>3FL|b?y-cwK2sP?pYEaqi?`CwR&g(NGwls8f;IO3Sn^SY_1GuntI zj9dusehFE*15@ZLF}%VgRku91D>g;9g*@R<`({RHHSB}B<3c|B&_GXTR9@zb6@YNy z0l6uw`A=SZsErtZjNd-gvV9lG)Oasg%M1b7_EB^MkJL<`7~vT2{8gvs53f*juffu9 z#97TY{?b?D*+hQwt0?yUit^yG66B3>Rd*yL?t;qyE9M;X zjGe_t1in10MRXyGs1Y7Vp)$HQq4wt?wC#UHC)vNjqKMKI{0%(96E^t!>ak)Jm8V#- zEf_6UlrHd@6|G%9MDIxdEMHL()BNinDVs*|OX95N1N>sec=jicJsc%YujH)UtLM`< z^#J*AYzH5;2pt(FaAhq8wQY~!u5InGs3absPcTP^s;IopP7#>Ls zZ}S_6+Xr`FfwbI=&JcHrt}hui z=Mp4{9Ut1(BM703lA}F|9@z|swTuT^5V`I!bl|be>kfdJRyvf%?*^`pd_%HjsWa~GVMD{x`I6cEJ1};S^POdK=Mv=`|m@-LDu9J!}D8`B0 z^~?s*{b>v-g(3x%FLoY;l%$=px>}orQ-vtyHpX2XbXlb?-(p-Nh#fiBsBRSI{*7dK(kGX>e2DSTwfA$)0yGQ)A`m`eD}R@ zYqcnh;xlh&_sg4(c_?`FB(Hh3VJdi<6}x#K$L=&2JbIkxS#22lRQxf-a$SR0!J~f= zJmH&sXtklsbnbCy4zuy1JK5|V{_CA~Y*C5v?)M^li#Pn)RqQ>Qx4GY+{l%x=4`k>0 zqWeSGYX0s0(L;Tvpsu`BET!BLw9JfuP6k*F?a~O0Lx+>lU?X9%k$%`?n}Xk|VCSC) zk57VMurj!0yR9q!dlcc;8-KN8AMrJR1+g-I;IFp$e)r>FT@fTTe=tbwZsijmtm`%% ztFplddoP0+cQ6BpX#%Dj7^!$6y<#+oazpV<=WESiJ))5)- zdzly*@XIC!2Kj9x)ot z?-?_Nr#$xcjX)yt01f)!qWh+zJz#K{^^xLY{6_NykIgPmMycAS(fotQE!mHJ@8f`> zhaj_+9ikI3<_qvBiW9!zYx}jcu!OQ7L6{e=p7AO2Nn1;(suyi570gEpIt#$(A_$4e z;UQ19v%~!Cld-t0N7!qbICzZ081rM}l{SpE@8L9tX2i7y;mD&x>Q>_kVT=Ku_d!8W~= z+|8f>si$#^CK;_sLLphFNs=`QK7$)qXp$&R5(~*9O%kX{5+Hd~lbAG#1WB$YdAwJx zYZ@eP4bemmnkWaNd79*+CYcAxOifa)O5}VD34{|h;TM{4ktR%6ZX1}VIADO%#EAu` zEbp)OZIWin8KvIVBx#z&9g;URNpDS(0ZEA_>8MGvA^Es8*NGiwV((t1vChn$iJtS7 zfi7$-o1@%uVN=*tWpq>ao7k?GlF*Fhh`x&QMKc!8ZYn=CV_n$+#lw}o#ZD_LUD+i6 zsR?KkK4!F`$gZOr+SoeZv)gh1G&dijcp6zA%q}*v^43jXK~Iay;SOSl;$&O}ABt-^ zE(xJSmFL`8XZEhL(v5Xt&nrjWm?ZkYs<@k2Yc^f!XkxzXXC=kNLfstjd@Y}#dvKJW z*AT^GVqJ}uc#dt9-Bb>l*szw?!L%feOEq{$gJnvHJNuMNA^^PeH$rJ+YQZ9S2wrs9q_h5aR-^jyH z0`0Z^9UTNxu zUy3)Isr2;1gl$(gc(L8=filvY)rb+7lr}!B3N!Sx4;#iTO1D<5A3LkO){31H9WE+^ zTCa@MXculh$k~reugOredw~ zf-g&B`;{+!S)drugESV4sneCAzRavx{Fs5|D@A^6BzsS}v)9a4Jb})^?|bq5bXTf);*@Ib^jddi z=Lpz;w+%bRRw~m2Sf<#cn^G0PI)t0LF=3$WXzLrB^&rkvh!~9ypNCi^17%mlR3mQ< zlv5vu+Rg2zDBgkWO*T_e0$FFVdyG;Y$X;(Ydy0Cvy5O)>@a#8&WtDDh%X&CtEnW^| ztHqX;rMcnkkU?x!sYG{S&#{uy_wX9(Af|p*D#kFpzqLQ4wC~0yid6@dwOv^I(p}w{ zvjgL$`{UT}VubJooiLcjo4e?Q0rLYGNnVuzS4cl(n~+0+PhPWz^~l>_dbSs9#YB^j zax)&DdxK)^&6F04`m3WCNLSfN^?LMXX=!iPfw}p%#%Q&J2Sfnv?xo!5!-k8|j!NGI zc1#Q$pcoUeQQudVC9?i(l=5vN>m~a1SIm9U&njhlU)F|gR*L(gqJ_%VzAUS4hh(*) zU!U)+72B3IeXF3F`K{n%>8%9I01tc-oD%uQzPS+ue~nSIG} zO2_nP$xPgtu528@ezJ@j#)NU8DWDfYvq7(d@7ByL+1yfl3ftET)e2iy_#@&5eaUIUAY_js+ zaMs^H8h>5h=rR9J^F2g)JENTuQ}Imlo_erk}>8<2APN{U0p zRLL~6W~wP7B!o)5g)1T)v904&Q-gVqYOBHcB9*Zkf8MHAar{oADbuwA?KlmpK*pzv zU_s^XekD)@8edm2^Se8y%;TWL(5t^=%J3^tJabyH23{1R3x zpO0bj{VG(QEOVKP?!P0?>_>W%=}pu>=X~^3)8CzXqCs~}zy5jcHlpyU%kunT&bS)a z1bmV`rF0(4T6SHdrS?G6*3lilENtpjQyavGG$lO^(~*svV^2dGG2ckd46i72$FgwC zSfr2q{p;N$4=;6UL;S;tPF_G$VIqR`Bd2fv0m%{5!k@4hpkp3HI*+nK&T6_bW6@Ys zA+FbyYm8T=m;90mugtm2j$Ao+tm?|cH*1buycF^dbYU%I0F`+QepZkySS?4cHJDdX zf!huEq^hnKr;m`ln{~XZVh&ad-A1VB-OP$3kKFw(lI|n-P8)$$S8sppNB1aVIt>Mb zp{ZA;D^#^iBu?*Xf>9`pb7-!<{pI()N#7%>a~wUK7^2%PWzP><5*CK zy{b}H<&jGn^+zsc8e5XFOPL}5gg<2()bvl8eovGMunPKc<*RWlr1yhmYSN6#Y)g!!Jqu0%-Y}zb8D{?& zvUA&m*+~p7gKxp8yBJ1(QreDZ?ZoImm4V|CpZrm3nn1URG$kaPZDZA?-(<502R2K2 zGMTmRcXx^UCk#n&P67KdmAHS^2Vh2v4ROB%@PuGmRf#YGKZ~TFrsxmXern#s$FJc1 zr%cJ3!eZhsU8B2j2+GQJaIP=d%@e^FJaEdJK(E`##j}fAAd~FlOGYH!T$7e4$EPsg zfOfht06yvzo@UU1IVh7vvEF&RxwO>jId;X7Sxarx@ke`Xi_+#r)+cQ09YF|o>gAMd zN~*vQ97ZDvNC(i<2lvT*-%$%ox$E0*=wcYvv6j3 z`Qa^0$PKw)k&qi;yN&m{hQOl+=O2{395#tPr_|*j$aF0z?fWwBdSaI|O7d*hG33h@ z=n1`}egX!M!k(0@+3%vgNUIN%37*R8+3?LJ4VcQ~*k5!^;PaZ{z3brdBh^?uPdg(W zMrqklKu~PBM*|Ga1n>_~wA%0uBxJbSPy-HzAUmUT`<#)KUM!~pJx(R79T~R0@UJ{X zHugA;jN(+sfJQ09y!bT=QPN|zGHwn_vYdbg+ibE(j}~aa7ia)AHB@hEUrNh{wFJcm zSEyGT?qIUC=3NJ;HSfO8HC9N?y8#*g*Z_Z?=gE+qK#pz*ZmM+B|+O>?T}`PPNwn0;?l9X zj-rmYlC=D*I-b+9zn-ra#(&1^@)exd?iy*Yq1)e&JI^G$iHK0z%LppBOajA~; zbey4MwvMB8Owuu0#{eBY2~oe`qzmp3)GGX0$1q7tC+Rpw$6Os3>$qOWeL9}hv0lf2 zbZnKP+3TpI1f=?fQMzEJjtg~Muj5f2&*)gM;|(1j=;)+3+`F*@I`+~rRmTh+XATtA z`h~Z2!7?2;>$qRXlRDPvNR6g{_XcP^67?Rs>8Rxj!cjf{a~;>~xKzjd0T#``R9%p& zV`m*(>L}=Vr@yBEgN}!EyrAc=)YA)fd_l(y9ee8-s-v4lXP)TW$);nSj^#RT({a6y zi*=l@;}jjY==K^%pm2$bNKLL3{l?sbucvFN&AQZkrk3uNsg)|9 z%Mz3YzcEjbj4!mD2eY)CRApE`i(uKM3-Z}bcT2}oExWO%-2X}!exv2@(=lIfUL$UH z)yz5@HN5Aep?fP08}07a?Owm4*$cg@Vu-NjoF+J@?{|M0A`8s~(WXMGL zgmMPup}*MOk$R>?wh=?0*8A>6LD&Y$fYLVQr8eSP+;v?7L=JdAKx_jz7$80m2niI& zKJCU2vv5X&ZWJmj0>w!&jdh;?9Ou&xK?o|s-5cm(auiI_PJ*dxvz$hqccHThagG&TqG{{BS7%aBv)~H$BIM5)_{*f#3;bUkY~nqqKMy(fVL_w?Zohq>^GQ@gBPg( zX=aW+5`^@}R9j{{an94W{p7}kFcV&Fl<(V#eJo@l4a4fu)KO@Pxoz6j>FL~lg&^iM zsQmwBQ2g;~6%D%BnD5~%ctm>$9a5F+0w8`@q!EPs?+xN5ZAcI)pXV(I$s@g!nO3W9{(3qPWKlh zdfkfD)C#-&U)28xbBaeRQ9(;Ot(HV*OGal=$Z{8ire;By0^Svv11<%5Di=vBnS_{uL0iefS?0^RDKVb9wrE(;0bSnqQTz^ z!_DobaNO{bzz7J=9T9SXCv4tH5N3e)1Y(p_o)9A^EP|Zyp9n$N0G@C-T>Am=>A>Zn zD)1|T7%Jf;ctQ-9PzRpS)RlPLoZP{D0=kEc&w#UI1i>*<6mo$b5X%OG?+Ba^iUm*j zK`a^yJ~9qLOb@(7fydMdTR=;|Zv*}qj~EJkJ@Cuk`0*zA*ggoL`r;x(Jh0w^|J0Ha zFf2(Beg@wWcnI_l_;O&v0E|o*QN_Q(2Y~+v*dPf)B>3yV(i8-~;P(Od4npII2hJUW z#(|#)tOe}^KVv8^%fm2Q;4K+o=qFx3Be4NEaJV2`2cHT|9)Sa`D-JW@;&fCDehKh* z5Y0U{`?z^pM?AJAV0{1im;T41Xz0aGms!C4jz z5fYTK2>26-diFCgV4TJiX6ZcPV_bp`pfE)YttUbUye}{bM0N3lZuYtSv|oCE%< z%Wc5FiMODD`y^CG6osAv%O?v$NAR^k8z>U|E#PfXGu)yQ1&`Bqq$&_-x=GI)4ke@)b=^*k&F^KN>v%t^x@ty9U_&RgL!q?f_BmcLKkE z4eJ8>sjtH(=rS623&`igF61jMV7`149ts%;fJgH+z6RK@Kr4_0+znEv02o@R@r1{9 z{vy zSqI#;5{?M+-M~LqqjBJG0Y6i;1`!TlgAPER4)l2sQv==?_}f~Iw*f2HX*R3YVgHYL zUn`si3|g;c1OpF&XvLNTuY74$OpYno>6KAV^(Y!2X|Ln_-S6;BFADaKincV!_h7 z0X_z$f)_p$gwvoL@aKRxK-7U-z^2)SxNAjXH0^(~@vZPh18L`~v$P zhVVotECkhpUj)1jBBTER+m~pDB7rZ0Lc8Hm0d57Qg5L(r*n_hlJmJi}+T7;@_k)}v z{~3sPHtatn@ERpd2C1zB;=xVj33q|0V!UJtc-_((0UW(g)0qL>sPmhFRiGT$tOIs0 z)AVD3OF?9R4ew!y;B31yu z4EQ0`czd%$$LN#2f}TlWia^fYG1S2E$2HfR4g4HL zz26D^9Ylt%18YtQf;aRD-A`&dgrjsm1Grx2Hvn&gs6qFDBfr*mSq9J&{f%ab5bv6* z65$?@J1W2%r|=M@&OLDZDa;$>JAnghG0)&rfgMj%goNM)SPV)7zXa%XMyt#jI08g= zvViL}-l8(aXEAS70Eo9w)z1^21#N~L@1TO`d987Tvq5Ai7q}ioQ?LPeT<1>$2Y#z{ zEFE~O4xtw85ISDe^gCY0;=PRd7h*e+n`|Z_kbh5#~J~j4h;MO#$YHI zm;|CJBaHhIQ7`yjzz;z*)SH3x>b2ezwz;A;IskYbL|*l}1x(0QZC*ox19d(X_y&l2 znGf8h^Sgn8zajuZgMxu}5Um5@H$gaK!)QT%4(Ro}7LVOmOYhidcaOOjtmT@>! zfW?2qAAny1{Nxcj1O7AM)W~6*c zXJin*i(f4TfX6Goa2-TbfR}us4@h0Tz%@EgNdJc!@)-%hWgv+v0LJ23Fa!J|U|)B< z?SW4MmVs#04*-u^Jn-WyWYhqoo1+n!OTr}}S|EfgTObV`!b;*HuL2G;<5yyk*8@j+ zX^qGS?gf#Zdf*~FIFdf$Jx~?&2{V0|x=1ZqU~Yq`2l!4Q;2VWnz!$ged|`p)PzGByAkK(rXI14ANEAx0$>xIPk%ARXX{F4_pC1G{zA z8v5^>CVUCrIs@Ym)_&|Y|Pr@P)4eui0 z>_OTT*|v3kCiHf{sOS!~^YJ&;uyl16s4S9&Z3%0)_U*A_DH4gi!%cSVufY zh%k7v#uMi1e8Ln=<#db$^sfVlzo0c}AF#=bT0@ zn}PR1v?lPeQ1Hyr3KO0Ik$3Z*jiH`{QGvbcOW0Ujf;`&jS{{j`;+?2)GwSQ?L(s9;A*C zFnvDO7T%%>=YU9_3oHVu{=Xhfr#G;OphS=4Z-B^9KJXHVT;?sH$D3#%bUc9)hzt?> zU=*_;_XS3PsB9$g1SlQylfbxq{NxpUFW`1i4*2qX?0=617+xeIfq#J(QAPn14ufh@ zK`oFz=WWAQB&1JvIgk_5m$^0I3F(`ZJ7Rl6`tn6Og!H+Mc*5Q~PneGGz{G;`K^s8lrPrivilegeCount = 1; + NewState->Privileges[0].Luid = LuidPrivilege; + NewState->Privileges[0].Attributes = Enable ? SE_PRIVILEGE_ENABLED : 0; + + Status = NtAdjustPrivilegesToken(TokenHandle, + FALSE, + NewState, + sizeof(Buffer), + NULL, + &Length); + + if (Status == STATUS_NOT_ALL_ASSIGNED) { + Status = STATUS_PRIVILEGE_NOT_HELD; } - NtClose(hToken); - return status; + NtClose(TokenHandle); + return Status; } /* -* supLoadDriver +* supxCreateDriverEntry * * Purpose: * -* Install driver and load it. -* -* N.B. -* SE_LOAD_DRIVER_PRIVILEGE is required to be assigned and enabled. +* Creating registry entry for driver. * */ -NTSTATUS supLoadDriver( - _In_ LPCWSTR DriverName, - _In_ LPCWSTR DriverPath, - _In_ BOOLEAN UnloadPreviousInstance +NTSTATUS supxCreateDriverEntry( + _In_opt_ LPCWSTR DriverPath, + _In_ LPCWSTR KeyName ) { NTSTATUS status = STATUS_UNSUCCESSFUL; DWORD dwData, dwResult; HKEY keyHandle = NULL; - SIZE_T keyOffset; - UNICODE_STRING driverServiceName, driverImagePath; - - WCHAR szBuffer[MAX_PATH + 1]; - - if (DriverName == NULL) - return STATUS_INVALID_PARAMETER_1; - if (DriverPath == NULL) - return STATUS_INVALID_PARAMETER_2; + UNICODE_STRING driverImagePath; RtlInitEmptyUnicodeString(&driverImagePath, NULL, 0); - if (!RtlDosPathNameToNtPathName_U(DriverPath, - &driverImagePath, - NULL, - NULL)) - { - return STATUS_INVALID_PARAMETER_2; - } - RtlSecureZeroMemory(szBuffer, sizeof(szBuffer)); - - keyOffset = RTL_NUMBER_OF(NT_REG_PREP); - - if (FAILED(StringCchPrintf(szBuffer, MAX_PATH, - DRIVER_REGKEY, - NT_REG_PREP, - DriverName))) - { - status = STATUS_INVALID_PARAMETER_1; - goto Cleanup; + if (DriverPath) { + if (!RtlDosPathNameToNtPathName_U(DriverPath, + &driverImagePath, + NULL, + NULL)) + { + return STATUS_INVALID_PARAMETER_2; + } } if (ERROR_SUCCESS != RegCreateKeyEx(HKEY_LOCAL_MACHINE, - &szBuffer[keyOffset], + KeyName, 0, NULL, REG_OPTION_NON_VOLATILE, @@ -360,12 +350,14 @@ NTSTATUS supLoadDriver( if (dwResult != ERROR_SUCCESS) break; - dwResult = RegSetValueEx(keyHandle, - TEXT("ImagePath"), - 0, - REG_EXPAND_SZ, - (BYTE*)driverImagePath.Buffer, - (DWORD)driverImagePath.Length + sizeof(UNICODE_NULL)); + if (DriverPath) { + dwResult = RegSetValueEx(keyHandle, + TEXT("ImagePath"), + 0, + REG_EXPAND_SZ, + (BYTE*)driverImagePath.Buffer, + (DWORD)driverImagePath.Length + sizeof(UNICODE_NULL)); + } } while (FALSE); @@ -373,16 +365,74 @@ NTSTATUS supLoadDriver( if (dwResult != ERROR_SUCCESS) { status = STATUS_ACCESS_DENIED; - goto Cleanup; } + else + { + status = STATUS_SUCCESS; + } + +Cleanup: + if (DriverPath) { + if (driverImagePath.Buffer) { + RtlFreeUnicodeString(&driverImagePath); + } + } + return status; +} + +/* +* supLoadDriver +* +* Purpose: +* +* Install driver and load it. +* +* N.B. +* SE_LOAD_DRIVER_PRIVILEGE is required to be assigned and enabled. +* +*/ +NTSTATUS supLoadDriver( + _In_ LPCWSTR DriverName, + _In_ LPCWSTR DriverPath, + _In_ BOOLEAN UnloadPreviousInstance +) +{ + SIZE_T keyOffset; + NTSTATUS status = STATUS_UNSUCCESSFUL; + UNICODE_STRING driverServiceName; + + WCHAR szBuffer[MAX_PATH + 1]; + + if (DriverName == NULL) + return STATUS_INVALID_PARAMETER_1; + if (DriverPath == NULL) + return STATUS_INVALID_PARAMETER_2; + + RtlSecureZeroMemory(szBuffer, sizeof(szBuffer)); + + keyOffset = RTL_NUMBER_OF(NT_REG_PREP); + + if (FAILED(StringCchPrintf(szBuffer, MAX_PATH, + DRIVER_REGKEY, + NT_REG_PREP, + DriverName))) + { + return STATUS_INVALID_PARAMETER_1; + } + + status = supxCreateDriverEntry(DriverPath, + &szBuffer[keyOffset]); + + if (!NT_SUCCESS(status)) + return status; RtlInitUnicodeString(&driverServiceName, szBuffer); status = NtLoadDriver(&driverServiceName); if (UnloadPreviousInstance) { if ((status == STATUS_IMAGE_ALREADY_LOADED) || - (status == STATUS_OBJECT_NAME_COLLISION) || - (status == STATUS_OBJECT_NAME_EXISTS)) + (status == STATUS_OBJECT_NAME_COLLISION) || + (status == STATUS_OBJECT_NAME_EXISTS)) { status = NtUnloadDriver(&driverServiceName); if (NT_SUCCESS(status)) { @@ -395,8 +445,6 @@ NTSTATUS supLoadDriver( status = STATUS_SUCCESS; } -Cleanup: - RtlFreeUnicodeString(&driverImagePath); return status; } @@ -434,6 +482,12 @@ NTSTATUS supUnloadDriver( keyOffset = RTL_NUMBER_OF(NT_REG_PREP); + status = supxCreateDriverEntry(NULL, + &szBuffer[keyOffset]); + + if (!NT_SUCCESS(status)) + return status; + RtlInitUnicodeString(&driverServiceName, szBuffer); status = NtUnloadDriver(&driverServiceName); diff --git a/Source/Hamakaze/sup.h b/Source/Hamakaze/sup.h index 259b029..ee1f71f 100644 --- a/Source/Hamakaze/sup.h +++ b/Source/Hamakaze/sup.h @@ -34,8 +34,8 @@ BOOL FORCEINLINE supHeapFree( _In_ PVOID Memory); NTSTATUS supEnablePrivilege( - _In_ DWORD PrivilegeName, - _In_ BOOL fEnable); + _In_ DWORD Privilege, + _In_ BOOL Enable); NTSTATUS supLoadDriver( _In_ LPCWSTR DriverName, diff --git a/Source/Hamakaze/victim.cpp b/Source/Hamakaze/victim.cpp index d0811eb..853a6ce 100644 --- a/Source/Hamakaze/victim.cpp +++ b/Source/Hamakaze/victim.cpp @@ -123,6 +123,9 @@ BOOL VictimCreate( printf_s("[!] Could not force unload victim, NTSTATUS(0x%lX) abort\r\n", ntStatus); break; } + else { + printf_s("[+] Previous instance of victim driver unloaded\r\n"); + } } drvBuffer = supQueryResourceData(ResourceId, ModuleBase, &resourceSize);