From 6a28dbfcb126601cf2f378600bcd94196710a621 Mon Sep 17 00:00:00 2001 From: firmianay Date: Sat, 9 Dec 2017 10:35:26 +0800 Subject: [PATCH] add 6.1.8 --- README.md | 1 + SUMMARY.md | 1 + doc/5.3_angr.md | 37 +++++++++++++++++++- doc/6.1.5_pwn_grehackctf2017_beerfighter.md | 3 ++ doc/6.1.7_pwn_0ctf2015_freenote.md | 15 ++++++++ doc/6.1.8_pwn_dctf2017_flex.md | 22 ++++++++++++ doc/6_writeup.md | 1 + src/writeup/6.1.8_pwn_dctf2017_flex/flex | Bin 0 -> 27176 bytes 8 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 doc/6.1.8_pwn_dctf2017_flex.md create mode 100755 src/writeup/6.1.8_pwn_dctf2017_flex/flex diff --git a/README.md b/README.md index 697d580..7f800dc 100644 --- a/README.md +++ b/README.md @@ -79,6 +79,7 @@ - [6.1.5 pwn GreHackCTF2017 beerfighter](doc/6.1.5_pwn_grehackctf2017_beerfighter.md) - [6.1.6 pwn DefconCTF2015 fuckup](doc/6.1.6_pwn_defconctf2015_fuckup.md) - [6.1.7 pwn 0CTF2015 freenote](doc/6.1.7_pwn_0ctf2015_freenote.md) + - [6.1.8 pwn DCTF2017 Flex](doc/6.1.8_pwn_dctf2017_flex.md) - re - [6.2.1 re XHPCTF2017 dont_panic](doc/6.2.1_re_xhpctf2017_dont_panic.md) - [6.2.2 re ECTF2016 tayy](doc/6.2.2_re_ectf2016_tayy.md) diff --git a/SUMMARY.md b/SUMMARY.md index 5fa9247..e31f314 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -78,6 +78,7 @@ GitHub 地址：https://github.com/firmianay/CTF-All-In-One * [6.1.5 pwn GreHackCTF2017 beerfighter](doc/6.1.5_pwn_grehackctf2017_beerfighter.md) * [6.1.6 pwn DefconCTF2015 fuckup](doc/6.1.6_pwn_defconctf2015_fuckup.md) * [6.1.7 pwn 0CTF2015 freenote](doc/6.1.7_pwn_0ctf2015_freenote.md) + * [6.1.8 pwn DCTF2017 Flex](doc/6.1.8_pwn_dctf2017_flex.md) * re * [6.2.1 re XHPCTF2017 dont_panic](doc/6.2.1_re_xhpctf2017_dont_panic.md) * [6.2.2 re ECTF2016 tayy](doc/6.2.2_re_ectf2016_tayy.md) diff --git a/doc/5.3_angr.md b/doc/5.3_angr.md index b4a9859..1e63306 100644 --- a/doc/5.3_angr.md +++ b/doc/5.3_angr.md @@ -2,7 +2,8 @@ - [安装](#安装) - [使用 angr](#使用-angr) - - [基础功能](#基础功能) + - [入门](#入门) + - [加载二进制文件](#加载二进制文件) - [angr 在 CTF 中的运用](#angr-在-ctf-中的运用) - [参考资料](#参考资料) @@ -199,6 +200,40 @@ WARNING | 2017-12-08 11:09:28,629 | cle.loader | The main binary is a position-i >>> plt.savefig('temp.png') # 保存 ``` +#### 加载二进制文件 +angr 的二进制加载模块称为 CLE。主类为 `cle.loader.Loader`，它导入所有的对象文件并导出一个进程内存的抽象。类 `cle.backends` 是加载器的后端，根据二进制文件类型区分为 `cle.backends.elf`、`cle.backends.pe`、`cle.backends.macho` 等。 + +加载对象文件和细分类型如下： +```python +>>> proj.loader.all_objects # 所有对象文件 +[, , , , , ] +``` +- `proj.loader.main_object`：主对象文件 +- `proj.loader.shared_objects`：共享对象文件 +- `proj.loader.extern_object`：外部对象文件 +- `proj.loader.all_elf_object`：所有 elf 对象文件 +- `proj.loader.kernel_object`：内核对象文件 + +通过对这些对象文件进行操作，可以解析出相关信息： +```python +>>> obj = proj.loader.main_object +>>> hex(obj.entry) # 入口地址 +'0x4013b0' +>>> hex(obj.min_addr), hex(obj.max_addr) # 起始地址和结束地址 +('0x400000', '0x60721f') +>>> obj.segments # segments +, ]> +>>> obj.sections # sections +, <.interp | offset 0x238, vaddr 0x400238, size 0x1c>, <.note.ABI-tag | offset 0x254, vaddr 0x400254, size 0x20>,...etc +``` +根据需要解析我们需要的信息： +```python +>>> obj.find_segment_containing(obj.entry) # 包含给定地址的 segments + +>>> obj.find_section_containing(obj.entry) # 包含给定地址的 sections +<.text | offset 0x12f0, vaddr 0x4012f0, size 0x33c9> +``` + ## angr 在 CTF 中的运用 #### re DefcampCTF2015 entry_language diff --git a/doc/6.1.5_pwn_grehackctf2017_beerfighter.md b/doc/6.1.5_pwn_grehackctf2017_beerfighter.md index 639446f..598b9bc 100644 --- a/doc/6.1.5_pwn_grehackctf2017_beerfighter.md +++ b/doc/6.1.5_pwn_grehackctf2017_beerfighter.md @@ -10,6 +10,9 @@ ``` $ file game game: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=1f9b11cb913afcbbbf9cb615709b3c62b2fdb5a2, stripped +$ checksec -f game +RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE +Partial RELRO No canary found NX enabled No PIE No RPATH No RUNPATH No 0 0 game ``` 64 位，静态链接，stripped。 diff --git a/doc/6.1.7_pwn_0ctf2015_freenote.md b/doc/6.1.7_pwn_0ctf2015_freenote.md index b0223f4..1061f9d 100644 --- a/doc/6.1.7_pwn_0ctf2015_freenote.md +++ b/doc/6.1.7_pwn_0ctf2015_freenote.md @@ -1,4 +1,19 @@ # 6.1.7 pwn 0CTF2015 freenote +- [题目解析](#题目解析) +- [参考资料](#参考资料) + [下载文件](../src/writeup/6.1.7_pwn_0ctf2015_freenote) + +## 题目解析 +``` +$ file freenote +freenote: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=dd259bb085b3a4aeb393ec5ef4f09e312555a64d, stripped +$ checksec -f freenote +RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE +Partial RELRO Canary found NX enabled No PIE No RPATH No RUNPATH Yes 0 2 freenote +``` + + +## 参考资料 diff --git a/doc/6.1.8_pwn_dctf2017_flex.md b/doc/6.1.8_pwn_dctf2017_flex.md new file mode 100644 index 0000000..14ac121 --- /dev/null +++ b/doc/6.1.8_pwn_dctf2017_flex.md @@ -0,0 +1,22 @@ +# 6.1.8 pwn DCTF2017 Flex + +- [C++ 异常机制](#c-异常机制) +- [题目解析](#题目解析) +- [参考资料](#参考资料) + + +[下载文件](../src/writeup/6.1.8_pwn_dctf2017_flex) + +## C++ 异常机制 + +## 题目解析 +``` +$ file flex +flex: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=30a1acbc98ccf9e8f4b3d1fc06b6ba6f0cbe7c9e, stripped +$ checksec -f flex +RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE +Partial RELRO Canary found NX enabled No PIE No RPATH No RUNPATH Yes 0 4 flex +``` + + +## 参考资料 diff --git a/doc/6_writeup.md b/doc/6_writeup.md index 624d182..febd9df 100644 --- a/doc/6_writeup.md +++ b/doc/6_writeup.md @@ -8,6 +8,7 @@ - [6.1.5 pwn GreHackCTF2017 beerfighter](6.1.5_pwn_grehackctf2017_beerfighter.md) - [6.1.6 pwn DefconCTF2015 fuckup](6.1.6_pwn_defconctf2015_fuckup.md) - [6.1.7 pwn 0CTF2015 freenote](6.1.7_pwn_0ctf2015_freenote.md) + - [6.1.8 pwn DCTF2017 Flex](6.1.8_pwn_dctf2017_flex.md) - re - [6.2.1 re XHPCTF2017 dont_panic](6.2.1_re_xhpctf2017_dont_panic.md) - [6.2.2 re ECTF2016 tayy](6.2.2_re_ectf2016_tayy.md) diff --git a/src/writeup/6.1.8_pwn_dctf2017_flex/flex b/src/writeup/6.1.8_pwn_dctf2017_flex/flex new file mode 100755 index 0000000000000000000000000000000000000000..cb8e158c402a7d853a2a4963554b15d2dbefba5c GIT binary patch literal 27176 zcmeHwdwf*Y_3xQU1`>!#piu!|gM#vm2_ObRnLq{(8ZbO!Q69;VOdgt7lNlbiKyZk1 zI;5snEUj%nK3mjU`L&fBQIkx-1e8iZQMAz;`JqlowBeyd<>%b*+K)45CW%7s=X3wK zAC6|$UeCSu+H0?KW}kD0jrR08W|K*ghgrEzA*}Ke8zb>gMcJ{6p@Np8L@PGsYUL_r z04Nsx*%*f)Z%NoKOiLIg>|TBB$VnjHu_s4#<#?514g)w zfRe^OgOFtD$oSNiOYKUPp@25lkZ^+NPeQ4;5PIb2`5y5?aFOV*ueihu|0NXND>oJu zu9`aK#-iMbMTI5qwG-E-Or1D&N@7K6;v_b1vQM&e7i6-YWE`!)$maz7QOJp(^yFV( z+kW61|CxUrIyYd~?$VgLU;K%9*WizA(72KmtMY^?-b6Gj{zl?&>{VN@%+GYhr+wm& zT{rK(T_E*&oCarTFI@7|+6!Iw6V8e<^={|7KIn7%pwqy5^XHyE=e?^?lG^>Vv+y5Bhg~ z&_C#dzPJznFX@Ax4*C$~3Z>GK4U4Et>{C(33wm}Ky%7A7kS`N-x&BK*r+G{g^VKh09q!yU0;d;jB=y<}I0@ zmFp}Qx~$bnAm*%fWUYd| zlB^tuE2ltE97RQ?z@1snwK>i*S7B+1U^q*1Lj+v~<)v$AB>6cxSrs&pWF;%JWKALD z7C9^2#ZF@8@DWy&l^2${@|22lM@g~CB_&7 zoovY?$v`)rk5deE>O&qj16{6R;;9BY0-+xn20A7{Kb9KkF*;RIvJG?uSU(C3^f;ZW zC}jq^tP#XsYoHG?$X6QZ#`D1z1N|ok`5FVAt^wq+-9W!o5&@qu&@VI4cNplG8|XU? z^kD{it${w=KyNV6M;Pe)4D>4u^cDmCS_A#4fiACEiQQ(PUuBT@8|YUX=&GkPO7&V+ zEU_wTRfEgoe+${DdiF-`;X;9%7J(HQy#$|e*Vxb^ynvYPZ2=skZzr5mxV?qpvk0dp z)84@FTL_OJd?&*v5l*Sy{shCv5l$)HUc>Nf38z$UuVnZL!YPH@%NRbCa7x|wY=#da zoKm(ugW+bv2N7;#__vFJQ|h)SG5i$al(OwshMypuQnfvv;l~J%C0t?nhlEqgws(CG z!sx?wPNG5k%!DMi~`7~V+uP{JD+zMF7L$@ZNL|2yH7itSG@{CUDJCA@~=PZ3V3 z*Ivo+-xE$L*Ivf(M+m1>YtLr*FA1jN(z(v1DFzLtC0nQJZ~b3^bRFv?=~IP&|_tcTJk2)aE;~l}vRa)jieI9jj`euD+s{ zOi{WFSy4}nKpTYV%0y9C?4c~lOO$vW@iWy;Uor!}?;~J9)w)!lf2L|`QV)Iax>UC| zSXzs_26lM=mA5X$cog@LOep$GFaax?EVqGVI?Z~jSMUW%^~_YGtCl^VDkl>D`pqs@6nT zX^KDTe*%HHUG~#62DvZwW}Z>KcE4(BX;KuZcp6L{<8@*qiES}^>}O0JFL~|9J${qc z7$UEF=Xd9-lVg}0Sa#3A_WnJ>&v^LRt!nNr)tiYwJKDm97ta~QtYPDT$8B|#>8jT3 zkH)ZxK<$Ar4pY=&g6wdz-eI%7n}*kHKgR*Xyp~f7t;#fe_j)(=zddeOWdmk%#&UNS zaLsswm0F`g!fSbmThc5W zsA2CmbyTu>T)_g8x@0ltF231*oc!}z?uL-MoyJxF9mb{E{W|M5u%_9MuV00j2YpU- zClj92!e*fQN^`n*^wtck;(r*?^j@+K&EK8Gr<>a1b}3sTI<7D%nBZ*C8qMl) zQ^#+ZEzjQgWvR=#o0MCavoi+2it9` zX&+=#8eLH=6df@&ERug`7bv{P#pgU?AhI76R1nP6CbvIgSbyXV{ zbsg1Rid+XqE@-={HrH){Br%plxT?Xuve|O#PAoF8>K`B@384EoBWE;AI~etk5;5=% zh^35pl!$*O;t3+&!-&m9tR>a#v@3mpZwM=^B`OQ9qFF!Mrdi9p`Mc8KNX(v)=EffmK_jm zu4+a6sc$c9sX0fv$aFF`ZBNBjg08Q$L|3$jiJCeN)PyMw;7V>WIvRg7*$x}sM$qdo zp92pw$-|KlsBdt>!%hsFr4`DM-&lsOBEy^ZQdTV!X}zhl0eZ$9L&@}7-k*<1b(`Fm zAux2}t=lO=`c$lMq&J_c90F% z|Iyh%z{9jm9ko0byFr38)%F&uvMf9k;Vg1(Tf^oC*C=>{!ofTzfh3sYwoZPHAW{-` zBTynj0S@UN%zyOSp9pD^a%iWEV=k5a!e^<>&V16m!QF@qh~ zs-AC6t|$uAS0EF79nhgjg$#MhqpHXXwU`Z zw`SQ7S-$?(K-aMTVj<2K*T-OJmND?A&-M2zL@s#!J;;^h`lIppw*CU3*KeVqA2|aL zQ!$}D!HO_hGD$+#-yg|v`1+$l7PkH{MRc`F(dZhBGD zyk?GL%d1kSvgI{=JT0$CNW()cFKS&w%ZnO(c~!FIML1htJ9}SV8!$`{)6$pMGLYa* zwSA|)yxxYh#^tpW%ZIs&<+WX3UXPqME-%h+_Mamvd8vBcw7jOs>zN$%V_05a(ek<) zVdl##6Keh!doHh!K<{OFJqBYG+m(QPd8MHxmskC6no=`VYxEk~b)vU9y7E%8(^UU2 zeN+>mh2UFzFn$6?bJZx&Y2ACPNOc;+H{w#XDjTSG8?h->69;RK+=Bf!gkKCKa@VJMg!Sgabb-VXb-Xmj8 zYm9qnJM)!{pq6{Lkp*3LGm{{UUFz#7wRg@_*bly z_S*ZW)fd$2ZC&ydZY0;b%GYJNO0)7&3%cl{rPk@n$}4i@L$9ivUBzruurjzk+6R#K zxHwY&1-J>}HuTzD)q+n5AvfODTSxU)t7wrox>2icw5jSK2?)?!B^AA_rB#tSu50kA zG4o#bsj*IjU2l4woFFeY-r;3De0g9H-!LAvP;?}!{!TsnIytUtxV{Dt1C~4zg^wPl zX`+=N#}@1$?%_Y78>tbuYcsPRSJ%QlqXZ=-Du`ggT3lU&3F+GnlbjjOA=a2Z{92CI@P)U`+;K_m2wFM(=R zbcK4M0S}!XEWYW?OkDMFRsd);)fuK79$2V*d0# zQ#=Q0=weO~Tb`3a-DJ!=m!SE8fQO-`_QNOw6noOvn%SE2w|4e%e%kYezS6M~(QNl4 z)$pCWlR&*6-@*JRp-LMP&2}t7%%2^n9Gtc8h2j?b=auU}5AZ8ed^hc+naJ$qUnje9 zD!_ij=UdDjhlO42OiZ_T##JxC)Opr-1>EJH^=AU^DYRq3zJfxBeFeSNjj!&0Om=k! zb_noApOcrnqR~B+m5vl>n%t9m(Y(5M&4I#k>M^cr4{R_G(t239(VZkMm<)Z7a}P%Z zsP7PsCMD3Z4wg*r6(Mx`B0bJMuQy9KhPsWf@oc23=xrZN(zkuH2)M`YH+5Xby1@5v zL!cl>y!Jn1zC!}MzGpxKt`Q-+=m1p$EAzikAaSUNy*0thl==_pN}?95`Yvkyjamcd zqV){5uAtWM(ee+%y2e$$XZ<;od!YXSGOlAJ5HpaU(}jNmkO&}uKzeozWU1Jp=>1r= z^_{defsNkQnO3C^v1P?00MnrPjkFHxm<0U))qy^n{o?@YuOm<5i8Yy81E@8JTIbr) z`YE+eQ7fNXerhq_KSs;H00|uQ{X1NbbR-Jj=i^GA4TOAuk`Nk5B#;jgYdH`L8;=+b z?TjH&`QY&F zcI~>g4D6BHyHrm@WRMgiNKrvjydcE{NeQwqPiIod4w2Y$>?YsEei5|&Ud88+@U+cD z9jLW|HJ)v@agH~$)pslc*L{%Fs4qx!+O(F6Aq=-gqB1akMx-E+#EGkfRz{@P-ijT& z@?Ur}&tYV0waN_9Wn;BUqin-gSh8(o%?R#5s8NMj?^M#YJZwu34J4I8eEx1Z6Pq-u4HnYol9Tx#J~PN^FE z?lJ@(1=kKm^C*(KCG49~Xk~>jM}r~td)E7JUNfjRg$35%5mmdEw={bvc0!KgTT0h% zy0svB%pxaIW?`hxDz-OnWJP~|7ZHuJmlGW{5yqC?*s_pzX!pJbO!~sYH=eQM`}fcF z6M}K)(3lViGGZI&d6xNc4i;#`85_B3b<8%<@Fge{5r5M=bPMeq@{Oy$g?uNXgq)e> zbzjDOC*p-%#E-}g+Y(RPwb+@AY`+sHE1B#+JfMn=Y?>3Q_z?J@=3{tlFmbzv;zG(h z|D4BX!o+*$V}vK;c16eS+VA@$D*6x-*VAZ5CNl9;T-cF+(jSjE=Kgi5HI_@j@ckvq(ipIKeE*=Y>{nKi{;;C z)=_-;zG@=HaSape+si)rn8+3hkS+3$Y@H(;fMgqf4NabP8xO6onn;7VhKcciEM9cO z&JeGKU7kVxju+eNfL}abmT^rF&Fy!*X!C;n;_;gJ#VZGY+V6P92wNgvfqP#u_d8y+ zg%pgJ<>>ax!hXjqLD&-cwJ_>cSHI&mEHqwsKBHjyQSkbaUss04Yu1>jSNA(!bi>#X zuWN_Y+}H1TjS7ud@vrhRj}*Lqtj95-@hX4q!Mpn%uL&XXvW$%S=e!?{7rAY$6Esz{ zwq?x`_3KX`eiChrm!-G*MY_g1A#09YLn6N#((7j$;}zXo{UTkmMbKDtWKQt)XjypA z%IihESeC{1R=;QrWJ}gn@`J`GYqVI8ccsj`%os1!Rn|*L{pu@TvgU|*J^i1SvHgyh zTthrwmc<7N5mU!RQZcf8~p z68SZ*d*6(H=a)REiFmC$HEwXf<0We}kC)|(gnR7$j+d-CBEP=7?8>|P9WQweAmSCZ zJU*h|@sj5>u^vA#m*)37Ub04u{965wBjrC5ugPqMPG-fIR(RMdtZTA}i$8wV71^_D zO=hc`+aU{b&O~fBM*nK9F*bvH)~d;@u5deKA*@1O>-b}_F(UCjD-`#i+aU`wpG6$b zG>-_mPQdyPuS?-^2&>+&U7EVgm@VfK2f5Zo4SMe2$9G&{96~c=;uHT&!x@Ae_p#6O zh=Z(yA`UgPZK=k5IFC4lt{O|zhQ~v$!p|cP@*E-ZVZhOqmtJ5T!Yazo55|wbz&ObB zr>G;AtG0-*F#J0EJmL^qZ6`M0I38zBDkbN=F67!2akwIH)bI<8L+F{v(*294uDQTC z$hsx+;qm7dPyc~@AWzS>3=Ui0ay~^JeeI+7P~U@*7!X<^C|$`02?STT%xtkXej6A! z+ZYRc?_t(iRgzaQgBjLyjq|!W@$T09mKdWE_C1X3ksl=8v)YMxG-nl|juXQ30=0@+ z7uPSn$3xC5^SH&b=k8_B3yz1(aFH7&lTVjja6IH%7xC~6j+fsX*dWd;951HvA9@gRSm@YUTa?Oi)biVfe@(a!nS^aoCEKd%JT5!Sf zkmms&kBJ*L{T16Kgz(C7Uh74k5k)-Sy5x;n7aR|{_IW%kuO5DX+y%!&RzZ;;r4!aA z^cfGiTZGdT8#=Z|*>(|a-m(VmD68IWM-d9u(-`R;&&7C~CF7HAgpuXnQue-v|o!8-0yY z+M!LK1e5?aNWq>Ww%Ud@KO7u9gNfnW z{afNyx?_TmHdDtDP`dReE%8LGy9;-~wE48BtHf;{fsH)e7xT2?$ur&iF6Mow=NO3k zhAD^`fOmeU#}}*Z_k050lxn^ciCtaONpH0Fwy!BJL|}$N;2UqW&v!}k+dnAKK1c{e zi!Q<}n7F#BcdmBOcW@xH&jr$}BXtMTO+IoUHu>NW3baQge`7jnLioK($K}08Mu7!y zrXNCwy$RbYaqGs^SW7ok#@jo!22a~SL{09|VqW)QBYoch%@-yz#UO$^Ccb@xlYdO4 zVPNvU>KW!*JnvxWOP@BDbjoh#38wh4=NNfn$S};`D;Cn7-$?-kSD!)Xp7bWa!Ym7} zA$r{`ddVk8zM0%o9W$_YVBZexW<0(7umq>T*3yHs!BB;`&z_wduWN@oKj=JcpTB3J zwkfgCe$Z=FD6ii(8~J)tB5IV@`*~XH`r&*ZvN~1kGMWevJl(eqPD_}9ktT>*|4BRKG?XjtEul3q&8Xo!dQY%ffzsp;=|9+IW(lvW4Z)Iq>DaPcMXm}8u zwU*+kbKY9c?j6}{p}DWwzLz}qtlv8`?xE+XB4zG{`?$4cZ_y61Cy(hNjTCw=C4@sG zBhJ-5I20`6ME2lN_7Ud<9s~-tMhk~HEj>82Xo$0`2Zt66asJSQLzzgN2YPV$oiaR+ z*@Hu`5>_|nSRSxcRtIT854r53x%`GT zByv+dY|7MuXgq>!eaz)4;EP~1g(77srVxsKm$ZT4FQ zfwJOTteI3(>(~_sUbVq+>g!~_<2l{p6y0KV4DO#E&>HE+_aa!R!5eU6@McHq3US3D z-W}o(QP}-_ob39g`)rG+EyC9pLGQ%ayFCpNKEJrV%I}u{3Xe5_LDVJzaUE#)(@D1m zcWvt{vE#1!-uYbX9?2OewS+A{tbuWGjp(3;XMOk0Yht+`-3hjLcic?z$#NCp8d*o`x!n`_q0M>n`?L+n{hnj>q-D&6CzXAy9>g@?|^*!xwFFWx(4 z3y6ByeeZm!b}Q!`=1E^f0~d@RbRNQ$^Vw`ucd1z(zUPCU?Gsus(SXA)M*{=6ZC@QvK5pc zsVh^n_S6LXJdFpQn7!aDlr$dwFtL|Vkc_itr`hMsRp;G)NBaB)cV;YHw0KG8T|ZrV z_dSkPIl0cf{DQ)J?<*=UDJ}b1d4s?8B%UR)qtL3l- zU&z%&WfG^dSNTgs*PP7XPF_cIU7 zeB{W=D__|D{J^88WuBpRRmr3FtdGfbt*9&i{=Yu1{L6sW$6Y5M_xTDRKmOp{y8kr& z(HD2%$(T{46WS*}zu9$r>vKDof4JqF)r%J1w!OG1dB?sRB6c=!yu1GN;I^i@zy8aS zg*k5y$R9g4p=!|ox*=uc6^ZAHC(QrJB`J%SR19*yI_TcjiTfKjRZS>=S{WQGM+j6^fz^<*8Z%?bVbB; z`YoGLh)L3(KwvFhdcA>V5BN3U6M%n08E61}1F#J+t{KlC<3j8uKr7%~`ydav50Kt; zo``dD4PfPgK%fQi6Toi37vF|FF4O+^!9c(UXlsEy;6lJHfZGlS0y_XVz847W1AOo( zo|Xgr5-`~)LRQU z2C#vi5e7W*74!j{x}gs^3s*op04Jd&w*b=f(p`Yr=K_Hgx*)`nz=2}Af01HZ8*jQI zW?)o}X<$6j>Amxvh#}r7(U0EcdAymtkH=Ptjh_=c?Dn|9YoaQZnIoo;n>^}TGD0$G z_*<|Sz7ZicHvU2L>`MlipGMD|p9}JP;NM{6uVQSbzZvw8z`xzdH`{gnXFwlFa~;Be zobgA2wika7f&UjHf9}=@Po$X(flhwXv%3S3BjrXpbFpqG2D!5od?#{2ABXCRh*)ao z&Vo#Kra*2Ra*2MEMVE_MU?L&n(_y+lBc08_zzF*3ln6c#Jg(&Pj{Sjv12FR41vcG= zdAZ&X$@~HKKY`o{Eor6 zTOh}Nzd_DpI(Lcq6TtU@pJt3t#7q_(;-`cDDb~;ltOS@V6cb1kywJb9H_v__g2{h4AxrehmDM z#M-8(u=V~U=IQe~0sKkt_uYRw_-)`H3bB7cw_gPQuTd*P^3?p4&fg0DFw~H9Lyi5P z9ZCXh{NSI#)4i?``=z@60r1sM)Q%ATY@Oc;ei``VB8~P(M@suKpx@sW2(%(j!STPZ z&(8$#r{cAzUxe6S!|YR@rGrmzfpr=A^Qt4ZMtUsfV@!;V!v(o}&IAHGL*o1bi*p)u z9|gY~wa-a*X2r%oY@QW6>{k)?SZj6Utk^MIEoyAig9Fsq6wkoz0r(17uy#ja4`ZGBXBVS z7b9>n0v982F#;DOa4`ZGBXBVS7bEchQv@<%ZEQG60?M(`S9LnV;ai-n)BOUE5wK>k zjkV~`FCE9zYz)fZ*p$DoE`LK4TZZfyAz=54Y}TUv4>~0OtM3D)gl{+72;i4y`7vyO zjWxt}sM2EQINislgZ9ekpu5*}4C6q#R6q%^Rl<+#YzE~X!WPkx`=)faoeudMqfyZ| zhD-X6D2_|Nvl&;x@8k1B_K$noY&>IxJnk_vT>61+8HTqGvMD#D< z^#V>6aE^d?3798f_&CGy+XNxX&h1x*3tS+M-)+9dIwo_KyTs+T-jp~cF=^sdH^Y)Q zBu`CDnvytWET>y1B_&Tynwm6CQ4%W(aKFmsSfwQ5C#jv~WlCa6smqy&Uw)qG!jH#r zEWgB^xXN9KpWrXdRT2p+a8wj1iMi`aD%KTq=ql$N-07;I-^pfT0?7ie+*#xx1<@)i za#5GKQK(p-njp(HvBvhvCu#m=mPTo{oUtmAjK`HymE!F&Af zH#3&yC@*)c<2Gdb-W({RV@Gje4)jW0)FCL${HlryB{8S8xY$|3_ChZ(=DmqiJ)qJc z*LjNB1}ymRPssYii1?6oP~!B1v9#u;{t~kd82x(=3@BC(^iOO}h8!b-8TDOe8{@l# z{wRh8Kf?8=fQ7BjQrW+(i`xZ(_;koRDeDoZD)?7Dcukc0vToA-F*;OHh^Vg8*rmR# zUvoes5vech@Gwz`W!;4cJHq3)092}ZQeW1&R#8aFJ{{73DJS7F@Ti7LT-MPs!qG}n z#zF3opVEJ#(Qz;SD5g?h*6kfaFdIBNWdBlMj^70y>CYk|9P&I670q#Z-XMKC_l4_k z0F7cI!llUbW{o&e$@3vZ*bzSe>p(T??-X@-r_gT*3wXS+BjM&S{W4Jx%fyLW`YY6Q z|0Pb(yBhnK|2|Bm&|h`4l;lwME2+N;)0fu?$J4lk2%{8dvDOhZeuqEmU(TN*>a$|! zQkC*V%2CBCpaf5%VbquZo{Ic;R_GqI@d%IqOJVvu=h>L}&UsvGluR6s_K4prpd0(A z+k$kwOA7?WveLuwH+9VBm-68*79rgo5LWc3_1Bc9`EodA2m;W9>H~l6Ej=uVr^plV= z>MPmVq^2m@>{IFDK>w6_5`GI#h`uA6%Q`p^7)S7F)mx$gWwIsXmo4=e?IEqFjfi*W*DmcALDKdfB*mh literal 0 HcmV?d00001