From ac141132c8a3f93cfd0f17c64f08970feb3cf975 Mon Sep 17 00:00:00 2001 From: Mike Cohen Date: Mon, 27 Jul 2020 10:34:20 +1000 Subject: [PATCH] Port CI testing from Appveyor to GitHub Actions. (#1) (#512) --- .appveyor_cache_clear | 1 - .gitattributes | 18 + .github/workflows/go.yml | 41 +- .github/workflows/windows.yml | 118 +++ README.md | 26 +- api/builder.go | 69 +- appveyor.yml | 63 -- .../Server/Utils/CreateCollector.yaml | 2 +- .../Windows/EventLogs/Cleared.yaml | 40 +- .../definitions/Windows/EventLogs/DHCP.yaml | 13 +- .../EventLogs/ServiceCreationComspec.yaml | 30 +- artifacts/definitions/Windows/Search/VSS.yaml | 83 +- artifacts/testdata/windows/autoexec.out.yaml | 18 +- artifacts/testdata/windows/evtx.in.yaml | 8 +- artifacts/testdata/windows/evtx.out.yaml | 36 - artifacts/testdata/windows/file.in.yaml | 2 +- artifacts/testdata/windows/file.out.yaml | 7 +- ...config.yaml => github_actions.config.yaml} | 3 +- artifacts/testdata/windows/ntfs.in.yaml | 4 +- artifacts/testdata/windows/ntfs.out.yaml | 20 +- artifacts/testdata/windows/registry.out.yaml | 7 +- artifacts/testdata/windows/startup.in.yaml | 4 +- artifacts/testdata/windows/startup.out.yaml | 7 +- artifacts/testdata/windows/test.config.yaml | 4 +- artifacts/testdata/windows/token.in.yaml | 2 +- artifacts/testdata/windows/token.out.yaml | 4 +- artifacts/testdata/windows/users.in.yaml | 2 +- artifacts/testdata/windows/users.out.yaml | 14 +- artifacts/testdata/windows/vss.in.yaml | 13 + artifacts/testdata/windows/vss.out.yaml | 50 +- artifacts/testdata/windows/wmi.out.yaml | 3 +- bin/binary_test.go | 6 +- bin/golden.go | 41 +- bin/repack.go | 2 +- config/migration.go | 6 + config/proto/config.pb.go | 720 +++++++++--------- config/proto/config.proto | 6 + file_store/directory/queue.go | 2 +- file_store/memory/queue.go | 2 +- file_store/mysql/queue.go | 2 +- flows/artifacts.go | 6 +- go.mod | 4 +- go.sum | 4 + json/wrappers.go | 3 + magefile.go | 25 +- reporting/container.go | 35 +- reporting/gui.go | 4 +- result_sets/result_sets.go | 7 +- services/server_artifacts.go | 3 +- services/server_monitoring.go | 3 +- uploads/client_uploader.go | 2 +- uploads/file_based.go | 2 +- utils/json.go | 24 +- vql/common/yara.go | 2 +- vql/json.go | 8 +- vql/tools/collector.go | 1 + vql/windows/authenticode/doc.go | 1 + vql/windows/dns/doc.go | 1 + vql/windows/process/dump.go | 4 - vql/windows/process/handles.go | 4 + 60 files changed, 935 insertions(+), 707 deletions(-) delete mode 100644 .appveyor_cache_clear create mode 100644 .gitattributes create mode 100644 .github/workflows/windows.yml delete mode 100644 appveyor.yml rename artifacts/testdata/windows/{appveyor.config.yaml => github_actions.config.yaml} (98%) create mode 100644 vql/windows/authenticode/doc.go create mode 100644 vql/windows/dns/doc.go diff --git a/.appveyor_cache_clear b/.appveyor_cache_clear deleted file mode 100644 index bf0d87ab1b2..00000000000 --- a/.appveyor_cache_clear +++ /dev/null @@ -1 +0,0 @@ -4 \ No newline at end of file diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 00000000000..ed7634a941f --- /dev/null +++ b/.gitattributes @@ -0,0 +1,18 @@ +* text=auto + +*.go text eol=lf +*.yaml text eol=lf +*.yml text eol=lf +*.c text eol=lf +*.h text eol=lf +*.md text eol=lf +*.golden text eol=lf +*.txt text eol=lf +*.html text eol=lf +*.js text eol=lf +*.css text eol=lf + +*.db binary +*.json binary +*.csv binary +*.zip binary diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 4a902b9c725..c52df070e64 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -1,18 +1,16 @@ -name: Go -on: [push] -jobs: +# Only trigger when a PR is committed. +name: Linux Build All Arches +on: + push: + branches: + - main +jobs: build: name: Build runs-on: ubuntu-latest steps: - - name: Set up Go 1.14 - uses: actions/setup-go@v1 - with: - go-version: 1.14 - id: go - - name: Check out code into the Go module directory uses: actions/checkout@v1 @@ -26,6 +24,13 @@ jobs: with: node-version: 12 + - name: Cache node-modules + uses: actions/cache@v2 + with: + path: | + **/node_modules + key: ${{ runner.os }}-${{ hashFiles('**/package-lock.json') }} + - name: npm install gui run: | cd gui/static/ @@ -33,27 +38,19 @@ jobs: node node_modules/gulp/bin/gulp.js compile cd ../../ - - name: Build + - name: Build All Architectures + # Uncomment the architectures you want here. NOTE: DarwinBase + # does not include yara or modules with C compilers needed. run: | mkdir ./output/ export PATH=$PATH:~/go/bin/ go run make.go -v Linux - - - name: Test - run: | - go test ./... - ./output/velociraptor*linux* golden ./artifacts/testdata./server./testcases/ --env srcDir=./ - - - name: Build All Architectures - run: | - export PATH=$PATH:~/go/bin/ go run make.go -v Windows - go run make.go -v Windowsx86 + echo skipping go run make.go -v Windowsx86 go run make.go -v DarwinBase - zip Binaries.zip output/* - name: StoreBinaries uses: actions/upload-artifact@v1 with: name: Binaries.zip - path: Binaries.zip + path: output diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml new file mode 100644 index 00000000000..fb0fe5fb096 --- /dev/null +++ b/.github/workflows/windows.yml @@ -0,0 +1,118 @@ +name: Windows Test +on: [push, pull_request] +jobs: + build: + name: Windows Test + runs-on: windows-latest + steps: + - name: Set up Go 1.14 + uses: actions/setup-go@v2 + with: + go-version: 1.14 + id: go + + - name: setup env + run: | + echo "::set-env name=GOPATH::$(dirname $GITHUB_WORKSPACE)" + echo "::add-path::$(dirname $GITHUB_WORKSPACE)/bin" + shell: bash + + - name: Check out code into the Go module directory + uses: actions/checkout@v2 + + - name: Configure test environment + shell: cmd + if: always() + run: | + echo %PATH% + echo %GOPATH% + mklink c:\Users\link c:\Windows + mkdir "C:\Program Files\Velociraptor" + mkdir c:\tmp + echo Hello > C:\hello.txt + echo HelloADS > C:\hello.txt:myads + fsutil file setshortname C:\hello.txt hi.txt + sc.exe create TestingDetection1 binPath="%COMSPEC% /Q /c echo 'COMSPEC testing 1" + echo "VSStest" > c:\Users\test.txt + echo "VSStest2" > c:\Users\test2.txt + regedit /S artifacts/testdata/windows/init.reg + + - name: Build + if: always() + env: + CC: x86_64-w64-mingw32-gcc + shell: bash + run: | + mkdir gui/static/dist/ + echo > gui/static/dist/third-party.bundle.js + echo > gui/static/dist/grr-ui.bundle.js + go run make.go -v WindowsTest + + - name: Prepare second stage + if: always() + shell: cmd + # We have to wait a short time between the service creation + # event to be flushed to disk. Hopefully building the test + # binary takes long enough. + + # Creating a second service - in the end we have + # TestingDetection2 in current logs, TestingDetection1 in + # previously cleared logs (but in VSS). + run: | + vssadmin create shadow /for=c: + echo "VSStest2 with more data" > c:\Users\test2.txt + echo Clearing the event logs + wevtutil.exe cl System + + echo Create second service. + sc.exe create TestingDetection2 binPath="%COMSPEC% /Q /c echo 'COMSPEC testing 2" + + - name: Test + shell: bash + if: always() + env: + # Disable CGO for building tests - it takes too long and it is + # not needed (mainly disables Yara building again). + CGO_ENABLED: "0" + + run: | + go test -v ./... + + - name: Test Golden Generic + shell: cmd + if: always() + # We depend on the second service logs to be flushed to disk - + # hopefulling the unit tests take long enough for this to + # happen. + + # Create a second VSS right before testing - in most cases the + # second VSS is identical to C: and VSS artifacts should + # **always** prefer to emit C: based locations over VSS paths. + run: | + vssadmin create shadow /for=c: + + echo Running OS generic tests. + output\velociraptor.exe -v golden D:\a\velociraptor\velociraptor\artifacts\testdata\server\testcases\ --env srcDir=d:\a\velociraptor\velociraptor\ --config D:\a\velociraptor\velociraptor\artifacts\testdata\windows\github_actions.config.yaml + + - name: Test Golden Windows + shell: cmd + if: always() + run: | + echo Running windows specific tests. + output\velociraptor.exe -v golden D:\a\velociraptor\velociraptor\artifacts\testdata\windows\ --env srcDir=d:\a\velociraptor\velociraptor\ --config D:\a\velociraptor\velociraptor\artifacts\testdata\windows\github_actions.config.yaml + + - name: Upload Build Artifacts + if: always() + shell: bash + run: | + mkdir -p artifact_output/windows/ + cp artifacts/testdata/windows/*.out* artifact_output/windows/ + + mkdir -p artifact_output/server/ + cp artifacts/testdata/server/testcases/*.out* artifact_output/server/ + + - uses: actions/upload-artifact@master + if: always() + with: + name: artifact + path: artifact_output diff --git a/README.md b/README.md index e10722938dd..6d868950cc9 100644 --- a/README.md +++ b/README.md @@ -125,15 +125,23 @@ We have a pretty frequent release schedule but if you see a new feature submitted that you are really interested in, we would love to have more testing prior to the official release. -We have a CI pipeline at https://www.velocidex.com/ci managed by -AppVeyor. The pipeline produces a complete windows binary -built at each commit poiint - simply click on the `artifacts` tab, -scroll down and download `velociraptor.exe` - -Additionally we build all binaries using Github actions. Simply click -the [actions tab](https://github.com/Velocidex/velociraptor/actions) -on Github and download the `Binaries.zip` file. This will contain -binaries for Windows, MacOS and Linux. +We have a CI pipeline managed by GitHub actions. You can see the +pipeline by clicking the actions tab on our GitHub project. There are +two workflows: + +1. Windows Test: this workflow build a minimal version of the + Velociraptor binary (without the GUI) and runs all the tests on + it. We also test various windows support functions in this + pipeline. This pipeline builds on every push in each PR. + +2. Linux Build All Arches: This pipeline builds complete binaries for + many supported architectures. It only runs when the PR is merged + into the master branch. + +If you fork the project on GitHub, the pipelines will run on your own +fork as well. If you need to prepare a PR for a new feature or modify +an existing feature you can use this to build your own binaries for +testing on all architectures. ## Getting help diff --git a/api/builder.go b/api/builder.go index 95b191a2366..47e24dc771e 100644 --- a/api/builder.go +++ b/api/builder.go @@ -122,6 +122,12 @@ func startSharedSelfSignedFrontend( return err } + // Combine both frontend and GUI on HTTP server. + if config_obj.GUI.UsePlainHttp && config_obj.Frontend.UsePlainHttp { + return StartFrontendPlainHttp( + ctx, wg, config_obj, server_obj, mux) + } + return StartFrontendHttps(ctx, wg, config_obj, server_obj, router) } @@ -144,7 +150,11 @@ func startSelfSignedFrontend( } // Start the GUI separately on a different port. - err = StartSelfSignedGUI(ctx, wg, config_obj, router) + if config_obj.GUI.UsePlainHttp { + err = StartHTTPGUI(ctx, wg, config_obj, router) + } else { + err = StartSelfSignedGUI(ctx, wg, config_obj, router) + } if err != nil { return err } @@ -394,6 +404,63 @@ func StartFrontendWithAutocert( return nil } +func StartHTTPGUI( + ctx context.Context, + wg *sync.WaitGroup, + config_obj *config_proto.Config, mux http.Handler) error { + logger := logging.Manager.GetLogger(config_obj, &logging.GUIComponent) + + listenAddr := fmt.Sprintf("%s:%d", + config_obj.GUI.BindAddress, + config_obj.GUI.BindPort) + + server := &http.Server{ + Addr: listenAddr, + Handler: mux, + ErrorLog: logging.NewPlainLogger(config_obj, &logging.FrontendComponent), + + // https://blog.cloudflare.com/the-complete-guide-to-golang-net-http-timeouts/ + ReadTimeout: 500 * time.Second, + WriteTimeout: 900 * time.Second, + IdleTimeout: 15 * time.Second, + } + + logger.WithFields( + logrus.Fields{ + "listenAddr": listenAddr, + }).Info("GUI is ready to handle HTTP requests") + + wg.Add(1) + go func() { + defer wg.Done() + + err := server.ListenAndServe() + if err != nil && err != http.ErrServerClosed { + logger.Error("GUI Server error", err) + } + }() + + wg.Add(1) + go func() { + defer wg.Done() + <-ctx.Done() + + logger.Info("Stopping GUI Server") + timeout_ctx, cancel := context.WithTimeout( + context.Background(), 10*time.Second) + defer cancel() + + server.SetKeepAlivesEnabled(false) + err := server.Shutdown(timeout_ctx) + if err != nil { + logger.Error("GUI shutdown error ", err) + } + logger.Info("Shutdown GUI") + }() + + return nil +} + func StartSelfSignedGUI( ctx context.Context, wg *sync.WaitGroup, diff --git a/appveyor.yml b/appveyor.yml deleted file mode 100644 index 44b9e2f5a93..00000000000 --- a/appveyor.yml +++ /dev/null @@ -1,63 +0,0 @@ -version: 1.0.{build} -clone_depth: 1 -clone_folder: c:\velociraptor -stack: Go 1.12 - -environment: - GOPATH: c:\gopath - PATH: C:\msys64\mingw64\bin;%GOPATH%\bin;%PATH% - VELOCIRAPTOR_CONFIG: artifacts\testdata\windows\appveyor.config.yaml - GOPROXY: https://proxy.golang.org - GOCACHE: C:\Users\appveyor\AppData\Local\go-build - -cache: - - '%LocalAppData%\go-build -> .appveyor_cache_clear' - - '%GOPATH%/pkg -> .appveyor_cache_clear' - - 'gui/static/node_modules -> .appveyor_cache_clear' - - 'gui/static/dist -> .appveyor_cache_clear' - -install: -- cmd: | - echo %PATH% - echo %GOPATH% - mklink c:\Users\link c:\Windows - mkdir "C:\Program Files\Velociraptor" - mkdir c:\tmp - echo Hello > C:\hello.txt - echo HelloADS > C:\hello.txt:myads - fsutil file setshortname C:\hello.txt hi.txt - sc.exe create TestingDetection1 binPath="%COMSPEC% /Q /c echo 'COMSPEC testing 1" - echo "VSStest" > c:\Users\test.txt - echo "VSStest2" > c:\Users\test2.txt - -- go version -- go env -- set GO111MODULE=on -- go mod download -- go mod verify -- ps: Install-Product node 11.14 x64 -- npm root -g - -build_script: -- set GO111MODULE=on -- cmd: | - regedit /S artifacts/testdata/windows/init.reg - go get github.com/magefile/mage/mage - go run make.go -v appveyor - vssadmin create shadow /for=c: - echo "VSStest2" >> c:\Users\test2.txt - wevtutil.exe cl System - sc.exe create TestingDetection2 binPath="%COMSPEC% /Q /c echo 'COMSPEC testing 2" - vssadmin create shadow /for=c: - -test_script: -- set GO111MODULE=on -- cmd: go test -v ./... -- cmd: c:\velociraptor\output\velociraptor.exe golden -v --config c:\velociraptor\artifacts\testdata\windows\appveyor.config.yaml c:\velociraptor\artifacts\testdata\server\testcases\ --env srcDir=c:\velociraptor -- cmd: c:\velociraptor\output\velociraptor.exe golden -v --config c:\velociraptor\artifacts\testdata\windows\appveyor.config.yaml c:\velociraptor\artifacts\testdata\windows\ --env srcDir=c:\velociraptor - -on_finish: - - ps: Get-ChildItem artifacts/testdata/windows/*.out.yaml | % { Push-AppveyorArtifact $_.FullName -FileName $_.Name } - - ps: Get-ChildItem artifacts/testdata/server/testcases/*.out.yaml | % { Push-AppveyorArtifact $_.FullName -FileName $_.Name } - - ps: Get-ChildItem output/velociraptor.exe | % { Push-AppveyorArtifact $_.FullName -FileName $_.Name } -# - ps: Get-ChildItem output/velociraptor-linux.elf | % { Push-AppveyorArtifact $_.FullName -FileName "velociraptor-linux.elf" } diff --git a/artifacts/definitions/Server/Utils/CreateCollector.yaml b/artifacts/definitions/Server/Utils/CreateCollector.yaml index 222e03a4785..718599e2900 100644 --- a/artifacts/definitions/Server/Utils/CreateCollector.yaml +++ b/artifacts/definitions/Server/Utils/CreateCollector.yaml @@ -279,7 +279,7 @@ sources: accessor='data', filename=serialize(format='json', item=autoexec)), Destination ], length=1000000) - WHERE log(message=Stderr) + WHERE log(message="Creating config on " + Config) AND log(message=Stderr) // Only actually run stuff if everything looks right. SELECT * FROM if(condition=autoexec AND target_binary AND me[0].Exe, diff --git a/artifacts/definitions/Windows/EventLogs/Cleared.yaml b/artifacts/definitions/Windows/EventLogs/Cleared.yaml index 606f8ba1be2..c8f5e2d39f9 100644 --- a/artifacts/definitions/Windows/EventLogs/Cleared.yaml +++ b/artifacts/definitions/Windows/EventLogs/Cleared.yaml @@ -1,10 +1,10 @@ name: Windows.EventLogs.Cleared description: | - Extract Event Logs related to EventLog clearing + Extract Event Logs related to EventLog clearing - Security Log - EventID 1102 - System Log - EventID 104 - + reference: - https://attack.mitre.org/versions/v6/techniques/T1070/ @@ -27,15 +27,15 @@ parameters: - name: DateBefore type: timestamp description: "search for events before this date. YYYY-MM-DDTmm:hh:ssZ" - + sources: - queries: # Date bounds for time box - - LET DateAfterTime <= if(condition=DateAfter, + - LET DateAfterTime <= if(condition=DateAfter, then=timestamp(epoch=DateAfter), else=timestamp(epoch="1600-01-01")) - - LET DateBeforeTime <= if(condition=DateBefore, + - LET DateBeforeTime <= if(condition=DateBefore, then=timestamp(epoch=DateBefore), else=timestamp(epoch="2200-01-01")) - + # Extract all target paths from specified globs - LET evtxglobs <= SELECT expand(path=Glob) as EvtxGlob FROM parse_csv(filename=EvtxLookupTable, accessor='data') @@ -45,11 +45,11 @@ sources: query={ SELECT * FROM if(condition=SearchVSS, then= { - SELECT * + SELECT * FROM Artifact.Windows.Search.VSS(SearchFilesGlob=EvtxGlob) }, else= { - SELECT * + SELECT *, "" AS Source FROM glob(globs=EvtxGlob) }) }) @@ -59,42 +59,42 @@ sources: FROM foreach( row=files, query={ - SELECT + SELECT timestamp(epoch=int(int=System.TimeCreated.SystemTime)) AS EventTime, - System.Computer as Computer, + System.Computer as Computer, System.EventID.Value as EventID, System.EventRecordID as EventRecordID, if(condition= System.EventID.Value = 1102, then= System.Channel, else= UserData.LogFileCleared.Channel) as Channel, - if(condition= System.EventID.Value = 1102, + if(condition= System.EventID.Value = 1102, then= UserData.LogFileCleared.SubjectDomainName + '\\' + UserData.LogFileCleared.SubjectUserName, else= UserData.LogFileCleared.SubjectDomainName + '\\' + UserData.LogFileCleared.SubjectUserName) as UserName, - if(condition= System.EventID.Value = 1102, + if(condition= System.EventID.Value = 1102, then= UserData.LogFileCleared.SubjectUserSid, - else= System.Security.UserID) as SecurityID, + else= System.Security.UserID) as SecurityID, Message, if(condition=Source, then=Source, else=FullPath) as Source, format(format="%v-%v-%v",args=[System.EventID.Value,System.EventRecordID, timestamp(epoch=int(int=System.TimeCreated.SystemTime))]) as _Group FROM parse_evtx(filename=FullPath) - WHERE + WHERE EventTime < DateBeforeTime AND EventTime > DateAfterTime AND - ( EventID = 1102 AND Channel = 'Security' ) OR + ( EventID = 1102 AND Channel = 'Security' ) OR ( EventID = 104 AND Message =~ 'Log clear' ) }) - ORDER BY Source - + ORDER BY Source DESC + # Group results for deduplication - LET grouped = SELECT * FROM hits GROUP BY _Group - + # Output results - - SELECT + - SELECT EventTime, Computer, EventID, @@ -104,4 +104,4 @@ sources: SecurityID, Message, Source - FROM grouped \ No newline at end of file + FROM grouped diff --git a/artifacts/definitions/Windows/EventLogs/DHCP.yaml b/artifacts/definitions/Windows/EventLogs/DHCP.yaml index 9ea08a8026c..df50b377c8c 100644 --- a/artifacts/definitions/Windows/EventLogs/DHCP.yaml +++ b/artifacts/definitions/Windows/EventLogs/DHCP.yaml @@ -26,6 +26,7 @@ description: | parameters: - name: eventDirGlob default: C:\Windows\system32\winevt\logs\ + - name: adminLog default: Microsoft-Windows-Dhcp-Client%4Admin.evtx @@ -37,12 +38,11 @@ parameters: sources: - name: RejectedDHCP - queries: - - | + query: | LET files = SELECT * FROM glob( globs=eventDirGlob + adminLog, accessor=accessor) - - | + SELECT Time AS _Time, timestamp(epoch=Time) As Timestamp, Computer, MAC, ClientIP, DHCPServer, Type FROM foreach( @@ -59,12 +59,7 @@ sources: }) - name: AssignedDHCP - queries: - - | - LET files = SELECT * FROM glob( - globs=eventDirGlob + operationalLog, - accessor=accessor) - - | + query: | SELECT Time AS _Time, timestamp(epoch=Time) As Timestamp, Computer, MAC, ClientIP, DHCPServer, Type FROM foreach( diff --git a/artifacts/definitions/Windows/EventLogs/ServiceCreationComspec.yaml b/artifacts/definitions/Windows/EventLogs/ServiceCreationComspec.yaml index 2fbae0d560b..578e55d0543 100644 --- a/artifacts/definitions/Windows/EventLogs/ServiceCreationComspec.yaml +++ b/artifacts/definitions/Windows/EventLogs/ServiceCreationComspec.yaml @@ -2,12 +2,12 @@ name: Windows.EventLogs.ServiceCreationComspec description: | This Detection hts on the string "COMSPEC" (nocase) in Windows Service - Creation events. That is: EventID 7045 from the System event log. + Creation events. That is: EventID 7045 from the System event log. - This detects many hack tools that leverage SCM based lateral movement + This detects many hack tools that leverage SCM based lateral movement including smbexec. - - SearchVSS allows querying VSS instances of EventLog Path with event + + SearchVSS allows querying VSS instances of EventLog Path with event deduplication. author: Matt Green - @mgreen27 @@ -18,22 +18,22 @@ parameters: - name: SearchVSS description: "Add VSS into query." type: bool - + sources: - name: ServiceCreation queries: # Extract all target paths from glob - - LET files = SELECT * - FROM if(condition=SearchVSS, + - LET files = SELECT * + FROM if(condition=SearchVSS, then= { - SELECT * + SELECT * FROM Artifact.Windows.Search.VSS(SearchFilesGlob=EventLog) }, else= { SELECT * FROM glob(globs=EventLog,accessor='ntfs') }) - + # Parse all target files, order by source and add dedupe string - LET hits = SELECT * FROM foreach( @@ -54,18 +54,18 @@ sources: System.Task as Task, if(condition=Source, then=Source, else=FullPath) as Source FROM parse_evtx(filename=FullPath, accessor='ntfs') - WHERE System.EventID.Value = 7045 and + WHERE System.EventID.Value = 7045 and EventData.ImagePath =~ "(?i)COMSPEC" }) - ORDER BY Source - + ORDER BY Source DESC + # Group results for deduplication - LET grouped = SELECT * FROM hits - GROUP BY EventRecordID + GROUP BY EventRecordID # Output results - - SELECT + - SELECT EventTime, EventID, Computer, @@ -77,4 +77,4 @@ sources: StartType, EventRecordID, Source - FROM grouped \ No newline at end of file + FROM grouped diff --git a/artifacts/definitions/Windows/Search/VSS.yaml b/artifacts/definitions/Windows/Search/VSS.yaml index 36f7cb8eedc..97e78bd5c3b 100644 --- a/artifacts/definitions/Windows/Search/VSS.yaml +++ b/artifacts/definitions/Windows/Search/VSS.yaml @@ -19,43 +19,46 @@ parameters: description: Use a glob to define the files that will be searched. sources: - - queries: - # First we extract path from SearchFilesGlob - - LET Path <= - if(condition=SearchFilesGlob=~"^\\\\\\\\.:\\\\", - then=split(string=split(string=DeviceID,sep='\\\\\\\\.:\\\\'), - sep='\\\\')[0], - else=if(condition=SearchFilesGlob=~"^.:", - then=split(string=SearchFilesGlob,sep=".:")[1], - else=SearchFilesGlob)) - - # Build a SearchGlob for all logical disks and VSS - - LET globs = SELECT * FullPath + Path as SearchGlob - FROM glob(globs='/*', accessor='ntfs') - ORDER BY FullPath - - # Glob for results - add hash for deduplication and Source for priority - - LET results = SELECT * - FROM foreach( - row=globs, - query={ - SELECT - *, - if(condition= - FullPath=~'^\\\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy', - then=split(string=FullPath, sep='\\\\')[5], - else=if(condition= FullPath=~'.:\\\\', - then=FullPath)) as Source, - hash(path=FullPath,accessor='ntfs').SHA1 as SHA1 - FROM glob(globs=SearchGlob, accessor='ntfs') - WHERE NOT IsDIr - } - ) - ORDER BY Source - - # Dedup and show results - - SELECT *, - if(condition= count(items=SHA1)>1, - then=true, else=false) AS Deduped - FROM results - GROUP BY SHA1 + - query: | + -- Given a path in either device notation or drive notation, + -- break it into a drive and path + LET extract_path(FullPath) = parse_string_with_regex(string=FullPath, + regex="^(?P\\\\\\\\.\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy[^\\\\]+\\\\|\\\\\\\\.\\\\.:\\\\|.:\\\\)(?P.+)$") + + LET extract_vss(FullPath) = parse_string_with_regex(string=FullPath, + regex="^(?P(\\\\\\\\.\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy[^\\\\]+\\\\|\\\\\\\\.\\\\.:\\\\))") + + -- Build a SearchGlob for all logical disks and VSS + LET globs = SELECT + FullPath + '/' + extract_path(FullPath=SearchFilesGlob).Path as SearchGlob + FROM glob(globs='/*', accessor='ntfs') + ORDER BY FullPath DESC + + -- Glob for all files in SearchGlob and calculate their hash. + LET globvss(SearchGlob) = SELECT *, + extract_path(FullPath=FullPath).Path AS Path, + basename(path=extract_vss(FullPath=FullPath).Device) AS Source, + hash(path=FullPath,accessor='ntfs').SHA1 as SHA1 + FROM glob(globs=SearchGlob, accessor='ntfs') + WHERE NOT IsDIr + + -- For each full glob (including VSS device) extract all files + -- and hashes. + LET results = SELECT * FROM foreach(row=globs, + query={ + -- Prepend VSS with _ to make them sort last. + SELECT *, if(condition=Source =~ '^HarddiskVolumeShadowCopy', + then='_' + Source, + else=Source) AS Source + FROM globvss(SearchGlob=SearchGlob) + }) + + -- We want to see natural drives after VSS because group by + -- shows the last in the group. VSS Sources look like + -- HarddiskVolumeShadowCopy1 and disk sources look like C: + ORDER BY Source DESC + + -- Dedup and show results + SELECT *, count() > 1 AS Deduped, SHA1 + Path AS Key + FROM results + GROUP BY Key diff --git a/artifacts/testdata/windows/autoexec.out.yaml b/artifacts/testdata/windows/autoexec.out.yaml index 530093d2f15..6226674d46c 100644 --- a/artifacts/testdata/windows/autoexec.out.yaml +++ b/artifacts/testdata/windows/autoexec.out.yaml @@ -10,7 +10,7 @@ SELECT inventory_add(tool='Autorun_amd64', url='https://storage.googleapis.com/g } ]SELECT * FROM Artifact.Windows.Sysinternals.Autoruns( AutorunArgs='-nobanner -accepteula -a b -c *', ToolInfo=inventory_get(tool='Autorun_amd64')) WHERE Company =~ 'Microsoft'[ { - "Time": "2/22/2014 12:17 PM", + "Time": "5/22/1991 7:17 AM", "Entry Location": "HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute", "Entry": "autocheck autochk /q /v *", "Enabled": "enabled", @@ -19,22 +19,8 @@ SELECT inventory_add(tool='Autorun_amd64', url='https://storage.googleapis.com/g "Description": "Auto Check Utility", "Company": "Microsoft Corporation", "Image Path": "c:\\windows\\system32\\autochk.exe", - "Version": "6.3.9600.17031", + "Version": "10.0.17763.1", "Launch String": "autocheck autochk /q /v *", "_Source": "Windows.Sysinternals.Autoruns" - }, - { - "Time": "10/29/2014 1:28 AM", - "Entry Location": "HKLM\\System\\CurrentControlSet\\Control\\ServiceControlManagerExtension", - "Entry": "%systemroot%\\system32\\scext.dll", - "Enabled": "enabled", - "Category": "Boot Execute", - "Profile": "System-wide", - "Description": "Service Control Manager Extension DLL for non-minwin", - "Company": "Microsoft Corporation", - "Image Path": "c:\\windows\\system32\\scext.dll", - "Version": "6.3.9600.17415", - "Launch String": "%systemroot%\\system32\\scext.dll", - "_Source": "Windows.Sysinternals.Autoruns" } ] \ No newline at end of file diff --git a/artifacts/testdata/windows/evtx.in.yaml b/artifacts/testdata/windows/evtx.in.yaml index 36705064cf0..4117200755f 100644 --- a/artifacts/testdata/windows/evtx.in.yaml +++ b/artifacts/testdata/windows/evtx.in.yaml @@ -4,15 +4,9 @@ Queries: - SELECT UserData FROM parse_evtx(filename=srcDir + '/artifacts/testdata/files/Security_1_record.evtx') WHERE System.EventId.Value = 1102 - SELECT UserData FROM parse_evtx(filename=srcDir + '/artifacts/testdata/files/Security_1_record.evtx') WHERE System.EventId.Value != 1102 - + # Kerbroasting VQL test - SELECT * FROM Artifact.Windows.EventLogs.Kerbroasting(eventLog=srcDir + '/artifacts/testdata/files/EID4769_Kerbroasting.evtx') # PowershellScriptblock VQL test - SELECT * FROM Artifact.Windows.EventLogs.PowershellScriptblock(eventLog=srcDir + "/artifacts/testdata/files/EID4104_PowershellScriptblock.evtx", LogLevel="All") - - # ADD COMSPEC VSS test - - SELECT EventID,ServiceName,Source FROM Artifact.Windows.EventLogs.ServiceCreationComspec(EventLog="C:\\Windows\\system32\\winevt\\logs\\System.evtx", SearchVSS="True") - - # Clear event logs - - SELECT EventID, Channel, Message=~ 'Clear',Source FROM Artifact.Windows.EventLogs.Cleared(SearchVSS="True") diff --git a/artifacts/testdata/windows/evtx.out.yaml b/artifacts/testdata/windows/evtx.out.yaml index 43008b287c0..18f47df4cff 100644 --- a/artifacts/testdata/windows/evtx.out.yaml +++ b/artifacts/testdata/windows/evtx.out.yaml @@ -107,40 +107,4 @@ SELECT * FROM parse_evtx(filename=srcDir + '/artifacts/testdata/files/Security_1 "Task": 2, "_Source": "Windows.EventLogs.PowershellScriptblock/PowershellScriptBlock" } -]SELECT EventID,ServiceName,Source FROM Artifact.Windows.EventLogs.ServiceCreationComspec(EventLog="C:\\Windows\\system32\\winevt\\logs\\System.evtx", SearchVSS="True")[ - { - "EventID": 7045, - "ServiceName": "TestingDetection1", - "Source": "HarddiskVolumeShadowCopy1" - }, - { - "EventID": 7045, - "ServiceName": "TestingDetection2", - "Source": "\\\\.\\C:\\Windows\\System32\\winevt\\Logs\\System.evtx" - } -]SELECT EventID, Channel, Message=~ 'Clear',Source FROM Artifact.Windows.EventLogs.Cleared(SearchVSS="True")[ - { - "EventID": 104, - "Channel": "System", - "Message =~ 'Clear'": true, - "Source": "HarddiskVolumeShadowCopy1" - }, - { - "EventID": 104, - "Channel": "AppVeyor", - "Message =~ 'Clear'": true, - "Source": "HarddiskVolumeShadowCopy1" - }, - { - "EventID": 104, - "Channel": "System", - "Message =~ 'Clear'": true, - "Source": "\\\\.\\C:\\Windows\\System32\\winevt\\Logs\\System.evtx" - }, - { - "EventID": 1102, - "Channel": "Security", - "Message =~ 'Clear'": true, - "Source": "\\\\.\\C:\\Windows\\System32\\winevt\\Logs\\Security.evtx" - } ] \ No newline at end of file diff --git a/artifacts/testdata/windows/file.in.yaml b/artifacts/testdata/windows/file.in.yaml index f5b8131c417..8799310eecc 100644 --- a/artifacts/testdata/windows/file.in.yaml +++ b/artifacts/testdata/windows/file.in.yaml @@ -4,7 +4,7 @@ Queries: - SELECT FullPath FROM glob(globs="\\*", accessor="file") WHERE Name =~ "C" - SELECT FullPath FROM glob(globs="c:\\*", accessor="file") - WHERE Name =~ "pagefile.sys" + WHERE Name =~ "Windows" # Read symlinks - These tests are slow and symlinks is not usually used. # - SELECT FullPath FROM glob(globs="c:\\Users\\*\\notepad.exe", accessor="file_links") diff --git a/artifacts/testdata/windows/file.out.yaml b/artifacts/testdata/windows/file.out.yaml index a4f06fc1da4..8f594dceda0 100644 --- a/artifacts/testdata/windows/file.out.yaml +++ b/artifacts/testdata/windows/file.out.yaml @@ -6,8 +6,11 @@ SELECT FullPath FROM glob(globs="/*", accessor="file") WHERE Name =~ "C"[ { "FullPath": "C:" } -]SELECT FullPath FROM glob(globs="c:\\*", accessor="file") WHERE Name =~ "pagefile.sys"[ +]SELECT FullPath FROM glob(globs="c:\\*", accessor="file") WHERE Name =~ "Windows"[ { - "FullPath": "C:\\pagefile.sys" + "FullPath": "C:\\Windows" + }, + { + "FullPath": "C:\\WindowsAzure" } ] \ No newline at end of file diff --git a/artifacts/testdata/windows/appveyor.config.yaml b/artifacts/testdata/windows/github_actions.config.yaml similarity index 98% rename from artifacts/testdata/windows/appveyor.config.yaml rename to artifacts/testdata/windows/github_actions.config.yaml index 74730031979..8b209c73257 100644 --- a/artifacts/testdata/windows/appveyor.config.yaml +++ b/artifacts/testdata/windows/github_actions.config.yaml @@ -140,5 +140,4 @@ Frontend: Datastore: implementation: FileBaseDataStore - filestore_directory: C:\Velociraptor\artifacts/testdata/server - location: C:\Velociraptor\artifacts/testdata/server + filestore_directory: d:\a\velociraptor\velociraptor\artifacts\testdata\server diff --git a/artifacts/testdata/windows/ntfs.in.yaml b/artifacts/testdata/windows/ntfs.in.yaml index 767d32de10b..8f8b6414bfb 100644 --- a/artifacts/testdata/windows/ntfs.in.yaml +++ b/artifacts/testdata/windows/ntfs.in.yaml @@ -2,7 +2,7 @@ Queries: - SELECT FullPath FROM glob(globs="/*", accessor="ntfs") - SELECT FullPath FROM glob(globs="\\*", accessor="ntfs") - SELECT FullPath FROM glob(globs="\\\\.\\c:\\*", accessor="ntfs") - WHERE Name = "pagefile.sys" + WHERE Name = "Windows" - SELECT FullPath FROM glob(globs="\\\\.\\c:\\Windows\\*", accessor="ntfs") WHERE Name = "notepad.exe" - SELECT FullPath FROM glob(globs="c:/Windows/*", accessor="ntfs") @@ -19,7 +19,7 @@ Queries: - SELECT FullPath FROM glob(globs="/*", accessor="lazy_ntfs") - SELECT FullPath FROM glob(globs="\\*", accessor="lazy_ntfs") - SELECT FullPath FROM glob(globs="\\\\.\\c:\\*", accessor="lazy_ntfs") - WHERE Name = "pagefile.sys" + WHERE Name = "Windows" - SELECT FullPath FROM glob(globs="\\\\.\\c:\\Windows\\*", accessor="lazy_ntfs") WHERE Name = "notepad.exe" - SELECT FullPath FROM glob(globs="c:/Windows/*", accessor="lazy_ntfs") diff --git a/artifacts/testdata/windows/ntfs.out.yaml b/artifacts/testdata/windows/ntfs.out.yaml index 9f5fac5baa5..b5551aa6883 100644 --- a/artifacts/testdata/windows/ntfs.out.yaml +++ b/artifacts/testdata/windows/ntfs.out.yaml @@ -2,6 +2,9 @@ SELECT FullPath FROM glob(globs="/*", accessor="ntfs")[ { "FullPath": "\\\\.\\C:" }, + { + "FullPath": "\\\\.\\D:" + }, { "FullPath": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1" }, @@ -12,15 +15,18 @@ SELECT FullPath FROM glob(globs="/*", accessor="ntfs")[ { "FullPath": "\\\\.\\C:" }, + { + "FullPath": "\\\\.\\D:" + }, { "FullPath": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1" }, { "FullPath": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy2" } -]SELECT FullPath FROM glob(globs="\\\\.\\c:\\*", accessor="ntfs") WHERE Name = "pagefile.sys"[ +]SELECT FullPath FROM glob(globs="\\\\.\\c:\\*", accessor="ntfs") WHERE Name = "Windows"[ { - "FullPath": "\\\\.\\c:\\pagefile.sys" + "FullPath": "\\\\.\\c:\\Windows" } ]SELECT FullPath FROM glob(globs="\\\\.\\c:\\Windows\\*", accessor="ntfs") WHERE Name = "notepad.exe"[ { @@ -55,6 +61,9 @@ SELECT FullPath FROM glob(globs="/*", accessor="ntfs")[ { "FullPath": "\\\\.\\C:" }, + { + "FullPath": "\\\\.\\D:" + }, { "FullPath": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1" }, @@ -65,15 +74,18 @@ SELECT FullPath FROM glob(globs="/*", accessor="ntfs")[ { "FullPath": "\\\\.\\C:" }, + { + "FullPath": "\\\\.\\D:" + }, { "FullPath": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1" }, { "FullPath": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy2" } -]SELECT FullPath FROM glob(globs="\\\\.\\c:\\*", accessor="lazy_ntfs") WHERE Name = "pagefile.sys"[ +]SELECT FullPath FROM glob(globs="\\\\.\\c:\\*", accessor="lazy_ntfs") WHERE Name = "Windows"[ { - "FullPath": "\\\\.\\c:\\pagefile.sys" + "FullPath": "\\\\.\\c:\\Windows" } ]SELECT FullPath FROM glob(globs="\\\\.\\c:\\Windows\\*", accessor="lazy_ntfs") WHERE Name = "notepad.exe"[ { diff --git a/artifacts/testdata/windows/registry.out.yaml b/artifacts/testdata/windows/registry.out.yaml index 45fc9f2b565..f7d34639849 100644 --- a/artifacts/testdata/windows/registry.out.yaml +++ b/artifacts/testdata/windows/registry.out.yaml @@ -77,9 +77,6 @@ SELECT FullPath FROM glob(globs="/*", accessor="reg")[ ]SELECT FullPath FROM glob( globs="HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*", accessor="reg")[ { "FullPath": "\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\"c:\\windows\\system32\\msht.exe\"" - }, - { - "FullPath": "\\HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AppVeyor.BuildAgent" } ]SELECT FullPath FROM stat( filename="HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\"c:\\windows\\system32\\msht.exe\"", accessor="reg")[ { @@ -99,11 +96,11 @@ SELECT FullPath FROM glob(globs="/*", accessor="reg")[ } ]SELECT User, ProgramName FROM Artifact.Windows.Registry.Sysinternals.Eulacheck()[ { - "User": "appveyor", + "User": "runneradmin", "ProgramName": "AutoRuns" }, { - "User": "appveyor", + "User": "runneradmin", "ProgramName": "PsExec" } ]SELECT FullPath FROM glob(globs='HKEY_LOCAL_MACHINE\\SYSTEM\\*ControlSet*\\services\\PortProxy\\**', accessor='reg') WHERE Type ORDER BY FullPath[ diff --git a/artifacts/testdata/windows/startup.in.yaml b/artifacts/testdata/windows/startup.in.yaml index 64ed26c593f..e5f3fdbd428 100644 --- a/artifacts/testdata/windows/startup.in.yaml +++ b/artifacts/testdata/windows/startup.in.yaml @@ -1,2 +1,4 @@ Queries: - - SELECT * FROM Artifact.Windows.Sys.StartupItems() WHERE Name = 'AppVeyor.BuildAgent' ORDER BY Name + - SELECT Name, Command, Enabled, _Source + FROM Artifact.Windows.Sys.StartupItems() + WHERE Name =~ 'msht' ORDER BY Name diff --git a/artifacts/testdata/windows/startup.out.yaml b/artifacts/testdata/windows/startup.out.yaml index cab0b04ec86..30839ed16f9 100644 --- a/artifacts/testdata/windows/startup.out.yaml +++ b/artifacts/testdata/windows/startup.out.yaml @@ -1,8 +1,7 @@ -SELECT * FROM Artifact.Windows.Sys.StartupItems() WHERE Name = 'AppVeyor.BuildAgent' ORDER BY Name[ +SELECT Name, Command, Enabled, _Source FROM Artifact.Windows.Sys.StartupItems() WHERE Name =~ 'msht' ORDER BY Name[ { - "Name": "AppVeyor.BuildAgent", - "FullPath": "\\HKEY_USERS\\S-1-5-21-2195900957-2730782454-3917332813-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AppVeyor.BuildAgent", - "Command": "powershell -File \"C:\\Program Files\\AppVeyor\\BuildAgent\\update-appveyor-agent.ps1\"", + "Name": "c:\\windows\\system32\\msht.exe", + "Command": "Hello", "Enabled": "disabled", "_Source": "Windows.Sys.StartupItems" } diff --git a/artifacts/testdata/windows/test.config.yaml b/artifacts/testdata/windows/test.config.yaml index 910c74dcbee..8b2b406c4c1 100644 --- a/artifacts/testdata/windows/test.config.yaml +++ b/artifacts/testdata/windows/test.config.yaml @@ -140,5 +140,5 @@ Frontend: Datastore: implementation: FileBaseDataStore - filestore_directory: ./artifacts/testdata/server - location: ./artifacts/testdata/server + filestore_directory: d:/a/velociraptor/velociraptor/artifacts/testdata/server + location: d:/a/velociraptor/velociraptor/artifacts/testdata/server diff --git a/artifacts/testdata/windows/token.in.yaml b/artifacts/testdata/windows/token.in.yaml index 4c84127fbd6..08dfbfdd48b 100644 --- a/artifacts/testdata/windows/token.in.yaml +++ b/artifacts/testdata/windows/token.in.yaml @@ -1,2 +1,2 @@ Queries: - - SELECT token(pid=getpid()).Username As Username from scope() + - SELECT token(pid=getpid()).Username =~ "runneradmin" As Username from scope() diff --git a/artifacts/testdata/windows/token.out.yaml b/artifacts/testdata/windows/token.out.yaml index 4e7802b2d67..c74f00d5f5e 100644 --- a/artifacts/testdata/windows/token.out.yaml +++ b/artifacts/testdata/windows/token.out.yaml @@ -1,5 +1,5 @@ -SELECT token(pid=getpid()).Username As Username from scope()[ +SELECT token(pid=getpid()).Username =~ "runneradmin" As Username from scope()[ { - "Username": "APPVYR-WIN\\appveyor" + "Username": true } ] \ No newline at end of file diff --git a/artifacts/testdata/windows/users.in.yaml b/artifacts/testdata/windows/users.in.yaml index ab3e15a1111..b1efcfe061a 100644 --- a/artifacts/testdata/windows/users.in.yaml +++ b/artifacts/testdata/windows/users.in.yaml @@ -1,5 +1,5 @@ Queries: # Only show a few accounts. Omit the UUID in case the system changes. - Select Name, Uid, Gid, Directory, Type from Artifact.Windows.Sys.Users() - WHERE Name in ("appveyor", "Administrator") + WHERE Name in ("Guest", "runneradmin") ORDER BY Name diff --git a/artifacts/testdata/windows/users.out.yaml b/artifacts/testdata/windows/users.out.yaml index d6d68e692ae..56c80313715 100644 --- a/artifacts/testdata/windows/users.out.yaml +++ b/artifacts/testdata/windows/users.out.yaml @@ -1,16 +1,16 @@ -Select Name, Uid, Gid, Directory, Type from Artifact.Windows.Sys.Users() WHERE Name in ("appveyor", "Administrator") ORDER BY Name[ +Select Name, Uid, Gid, Directory, Type from Artifact.Windows.Sys.Users() WHERE Name in ("Guest", "runneradmin") ORDER BY Name[ { - "Name": "Administrator", - "Uid": 500, + "Name": "Guest", + "Uid": 501, "Gid": 513, - "Directory": "C:\\Users\\Administrator", + "Directory": null, "Type": "local" }, { - "Name": "appveyor", - "Uid": 1001, + "Name": "runneradmin", + "Uid": 500, "Gid": 513, - "Directory": "C:\\Users\\appveyor", + "Directory": "C:\\Users\\runneradmin", "Type": "local" } ] \ No newline at end of file diff --git a/artifacts/testdata/windows/vss.in.yaml b/artifacts/testdata/windows/vss.in.yaml index be1514eb948..6104a933763 100644 --- a/artifacts/testdata/windows/vss.in.yaml +++ b/artifacts/testdata/windows/vss.in.yaml @@ -1,5 +1,18 @@ Queries: # Test for deduplication - SELECT FullPath, SHA1, Source, Deduped FROM Artifact.Windows.Search.VSS(SearchFilesGlob='c:\\Users\\test.txt') + # Test for multiple hits - SELECT FullPath, SHA1, Source, Deduped FROM Artifact.Windows.Search.VSS(SearchFilesGlob='c:\\Users\\test2.txt') + + # Test evtx VSS support. + + # Find COMSPEC service VSS test - should show two services created, + # even though the logs were cleared. + - SELECT EventID,ServiceName,Source FROM Artifact.Windows.EventLogs.ServiceCreationComspec( + EventLog="C:\\Windows\\system32\\winevt\\logs\\System.evtx", + SearchVSS="True") + + # Find cleared event logs - should show 2 times. + - SELECT EventID, Channel, Message=~ 'Clear',Source FROM Artifact.Windows.EventLogs.Cleared( + SearchVSS="True") diff --git a/artifacts/testdata/windows/vss.out.yaml b/artifacts/testdata/windows/vss.out.yaml index 22d14d4dd1f..8b0911559d4 100644 --- a/artifacts/testdata/windows/vss.out.yaml +++ b/artifacts/testdata/windows/vss.out.yaml @@ -2,20 +2,62 @@ SELECT FullPath, SHA1, Source, Deduped FROM Artifact.Windows.Search.VSS(SearchFi { "FullPath": "\\\\.\\C:\\Users\\test.txt", "SHA1": "a21a26a9716d20649484110d939d90864fba9948", - "Source": "\\\\.\\C:\\Users\\test.txt", + "Source": "C:", "Deduped": true } ]SELECT FullPath, SHA1, Source, Deduped FROM Artifact.Windows.Search.VSS(SearchFilesGlob='c:\\Users\\test2.txt')[ { "FullPath": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Users\\test2.txt", "SHA1": "1896ab50888c9c3d4150f5044b2568cea317a8e8", - "Source": "HarddiskVolumeShadowCopy1", + "Source": "_HarddiskVolumeShadowCopy1", "Deduped": false }, { "FullPath": "\\\\.\\C:\\Users\\test2.txt", - "SHA1": "845cf532fdf2ccc54fa6a26fad40b2ef3e537f74", - "Source": "\\\\.\\C:\\Users\\test2.txt", + "SHA1": "de23e5237d8b6c785cf2cbde1924e081aa66b674", + "Source": "C:", "Deduped": true } +]SELECT EventID,ServiceName,Source FROM Artifact.Windows.EventLogs.ServiceCreationComspec( EventLog="C:\\Windows\\system32\\winevt\\logs\\System.evtx", SearchVSS="True")[ + { + "EventID": 7045, + "ServiceName": "TestingDetection1", + "Source": "_HarddiskVolumeShadowCopy1" + }, + { + "EventID": 7045, + "ServiceName": "TestingDetection2", + "Source": "C:" + } +]SELECT EventID, Channel, Message=~ 'Clear',Source FROM Artifact.Windows.EventLogs.Cleared( SearchVSS="True")[ + { + "EventID": 104, + "Channel": "System", + "Message =~ 'Clear'": true, + "Source": "_HarddiskVolumeShadowCopy1" + }, + { + "EventID": 104, + "Channel": "Application", + "Message =~ 'Clear'": true, + "Source": "_HarddiskVolumeShadowCopy1" + }, + { + "EventID": 104, + "Channel": "Setup", + "Message =~ 'Clear'": true, + "Source": "_HarddiskVolumeShadowCopy1" + }, + { + "EventID": 104, + "Channel": "System", + "Message =~ 'Clear'": true, + "Source": "C:" + }, + { + "EventID": 1102, + "Channel": "Security", + "Message =~ 'Clear'": true, + "Source": "C:" + } ] \ No newline at end of file diff --git a/artifacts/testdata/windows/wmi.out.yaml b/artifacts/testdata/windows/wmi.out.yaml index 3f39da10c22..0ab2cf694e7 100644 --- a/artifacts/testdata/windows/wmi.out.yaml +++ b/artifacts/testdata/windows/wmi.out.yaml @@ -1,8 +1,7 @@ SELECT DNSServerSearchOrder from wmi( query='select DNSServerSearchOrder FROM win32_networkadapterconfiguration') WHERE DNSServerSearchOrder[ { "DNSServerSearchOrder": [ - "8.8.8.8", - "8.8.4.4" + "168.63.129.16" ] } ] \ No newline at end of file diff --git a/bin/binary_test.go b/bin/binary_test.go index 1498139c21d..ba083fc456c 100644 --- a/bin/binary_test.go +++ b/bin/binary_test.go @@ -86,13 +86,13 @@ func (self *MainTestSuite) TestAutoexec() { // Repack the config in the binary. cmd := exec.Command(self.binary, "config", "repack", config_file.Name(), exe.Name()) - out, err := cmd.Output() + out, err := cmd.CombinedOutput() require.NoError(self.T(), err) // Run the repacked binary with no args - it should run the // `artifacts list` command. cmd = exec.Command(exe.Name()) - out, err = cmd.Output() + out, err = cmd.CombinedOutput() require.NoError(self.T(), err) // The output should contain MySpecialArtifact as well as the @@ -182,7 +182,7 @@ func (self *MainTestSuite) TestGenerateConfigWithMerge() { // Repack the config in the binary. cmd = exec.Command(self.binary, "config", "repack", config_file.Name(), exe.Name()) - out, err = cmd.Output() + out, err = cmd.CombinedOutput() require.NoError(self.T(), err) // Run the repacked binary with invalid environ - config diff --git a/bin/golden.go b/bin/golden.go index 0df4ff00925..e219a67da8b 100644 --- a/bin/golden.go +++ b/bin/golden.go @@ -25,6 +25,7 @@ import ( "os" "path/filepath" "strings" + "time" "github.com/Velocidex/ordereddict" "github.com/Velocidex/yaml/v2" @@ -35,6 +36,7 @@ import ( config_proto "www.velocidex.com/golang/velociraptor/config/proto" "www.velocidex.com/golang/velociraptor/constants" flows_proto "www.velocidex.com/golang/velociraptor/flows/proto" + logging "www.velocidex.com/golang/velociraptor/logging" "www.velocidex.com/golang/velociraptor/reporting" "www.velocidex.com/golang/velociraptor/services" vql_subsystem "www.velocidex.com/golang/velociraptor/vql" @@ -83,11 +85,10 @@ func vqlCollectorArgsFromFixture( return vql_collector_args } -func runTest(fixture *testFixture) (string, error) { - config_obj, err := DefaultConfigLoader.LoadAndValidate() - kingpin.FatalIfError(err, "Unable to load config file") +func runTest(fixture *testFixture, + config_obj *config_proto.Config) (string, error) { - err = services.StartJournalService(config_obj) + err := services.StartJournalService(config_obj) kingpin.FatalIfError(err, "Unable to start services") // Create an output container. @@ -138,8 +139,12 @@ func runTest(fixture *testFixture) (string, error) { return "", err } + ctx, cancel := context.WithTimeout( + context.Background(), 60*time.Second) + defer cancel() + result_chan := vfilter.GetResponseChannel( - vql, context.Background(), scope, + vql, ctx, scope, vql_subsystem.MarshalJsonIndent(scope), 1000, 1000) for { @@ -155,15 +160,21 @@ func runTest(fixture *testFixture) (string, error) { } func doGolden() { + config_obj, err := DefaultConfigLoader.LoadAndValidate() + kingpin.FatalIfError(err, "Can not load configuration.") + + logger := logging.GetLogger(config_obj, &logging.ToolComponent) + logger.Info("Starting golden file test.") + globs, err := filepath.Glob(fmt.Sprintf( "%s*.in.yaml", *golden_command_prefix)) kingpin.FatalIfError(err, "Glob") - logger := log.New(os.Stderr, "golden: ", 0) - failures := []string{} for _, filename := range globs { + logger := log.New(os.Stderr, "golden: ", 0) + logger.Printf("Openning %v", filename) data, err := ioutil.ReadFile(filename) kingpin.FatalIfError(err, "Reading file") @@ -172,7 +183,7 @@ func doGolden() { err = yaml.Unmarshal(data, &fixture) kingpin.FatalIfError(err, "Unmarshal input file") - result, err := runTest(&fixture) + result, err := runTest(&fixture, config_obj) kingpin.FatalIfError(err, "Running test") outfile := strings.Replace(filename, ".in.", ".out.", -1) @@ -184,22 +195,22 @@ func doGolden() { string(old_data), result, false) fmt.Printf("Failed %v:\n", filename) fmt.Println(dmp.DiffPrettyText(diffs)) + failures = append(failures, filename) } } else { fmt.Printf("New file for %v:\n", filename) fmt.Println(result) + failures = append(failures, filename) } - if *testonly { - continue + if !*testonly { + err = ioutil.WriteFile( + outfile, + []byte(result), 0666) + kingpin.FatalIfError(err, "Unable to write golden file") } - - err = ioutil.WriteFile( - outfile, - []byte(result), 0666) - kingpin.FatalIfError(err, "Unable to write golden file") } if len(failures) > 0 { diff --git a/bin/repack.go b/bin/repack.go index 97f74c75931..eb04e8255c5 100644 --- a/bin/repack.go +++ b/bin/repack.go @@ -55,7 +55,7 @@ var ( "output", "The filename to write the repacked binary."). Required().String() - embedded_re = regexp.MustCompile(`#{3}\n`) + embedded_re = regexp.MustCompile(`#{3}\r?\n`) ) // Validate any embedded artifacts to make sure they compile properly. diff --git a/config/migration.go b/config/migration.go index d074aee10a3..4f213ff9dbe 100644 --- a/config/migration.go +++ b/config/migration.go @@ -104,7 +104,13 @@ func migrate_0_4_6(config_obj *config_proto.Config) { } config_obj.GUI.Authenticator = auther + } + if config_obj.Datastore != nil { + if config_obj.Datastore.Implementation == "FileBaseDataStore" && + config_obj.Datastore.Location == "" { + config_obj.Datastore.Location = config_obj.Datastore.FilestoreDirectory + } } } diff --git a/config/proto/config.pb.go b/config/proto/config.pb.go index 18f296aa6a5..dc202814d2b 100644 --- a/config/proto/config.pb.go +++ b/config/proto/config.pb.go @@ -834,8 +834,11 @@ func (m *Authenticator) GetSamlUserAttribute() string { } type GUIConfig struct { - BindAddress string `protobuf:"bytes,1,opt,name=bind_address,json=bindAddress,proto3" json:"bind_address,omitempty"` - BindPort uint32 `protobuf:"varint,2,opt,name=bind_port,json=bindPort,proto3" json:"bind_port,omitempty"` + BindAddress string `protobuf:"bytes,1,opt,name=bind_address,json=bindAddress,proto3" json:"bind_address,omitempty"` + BindPort uint32 `protobuf:"varint,2,opt,name=bind_port,json=bindPort,proto3" json:"bind_port,omitempty"` + // Allows the GUI to start with no encryption - **WARNING** This + // only makes sense if you have TLS proxy in front. + UsePlainHttp bool `protobuf:"varint,20,opt,name=use_plain_http,json=usePlainHttp,proto3" json:"use_plain_http,omitempty"` GwCertificate string `protobuf:"bytes,10,opt,name=gw_certificate,json=gwCertificate,proto3" json:"gw_certificate,omitempty"` GwPrivateKey string `protobuf:"bytes,11,opt,name=gw_private_key,json=gwPrivateKey,proto3" json:"gw_private_key,omitempty"` InternalCidr []string `protobuf:"bytes,3,rep,name=internal_cidr,json=internalCidr,proto3" json:"internal_cidr,omitempty"` @@ -906,6 +909,13 @@ func (m *GUIConfig) GetBindPort() uint32 { return 0 } +func (m *GUIConfig) GetUsePlainHttp() bool { + if m != nil { + return m.UsePlainHttp + } + return false +} + func (m *GUIConfig) GetGwCertificate() string { if m != nil { return m.GwCertificate @@ -2166,362 +2176,362 @@ func init() { } var fileDescriptor_3eaf2c85e69e9ea4 = []byte{ - // 5699 bytes of a gzipped FileDescriptorProto + // 5704 bytes of a gzipped FileDescriptorProto 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xec, 0x7b, 0xcb, 0x6f, 0x5c, 0xc9, 0x75, 0x37, 0x5a, 0xa2, 0x24, 0xb2, 0x9a, 0xcf, 0xa2, 0x1e, 0x3d, 0x0f, 0xcd, 0x94, 0x7b, 0x66, 0x3c, 0x94, 0x47, 0xbe, 0xa2, 0xa8, 0x91, 0x3c, 0x0f, 0xdb, 0xa3, 0x26, 0xa9, 0x91, 0x68, 0x4b, 0x32, 0xe7, 0x92, 0x92, 0x8c, 0xf9, 0x6c, 0xf7, 0x54, 0xdf, 0x5b, 0xdd, 0x5d, 0xd6, 0xed, 0x5b, 0x77, 0x6e, 0xd5, 0x65, 0xb3, 0xe7, 0x33, 0xfc, 0x7d, 0xd9, 0x24, 0xb1, 0x37, 0x81, 0x81, 0x20, - 0x4e, 0x62, 0xe4, 0x1d, 0xef, 0xe2, 0x45, 0x80, 0x64, 0xe5, 0x2c, 0x02, 0x24, 0x4b, 0x2f, 0xb2, - 0xca, 0x1f, 0x90, 0x2c, 0x12, 0x24, 0x9b, 0x6c, 0x12, 0x18, 0x41, 0x80, 0x04, 0xe7, 0x54, 0xd5, - 0xbd, 0xb7, 0x49, 0x8e, 0x0d, 0x03, 0x76, 0x90, 0x45, 0x16, 0x12, 0xbb, 0xab, 0x4e, 0x9d, 0x53, - 0x8f, 0xf3, 0xf8, 0x9d, 0x53, 0xd5, 0x64, 0x3e, 0x52, 0x69, 0x5f, 0x0e, 0x82, 0x2c, 0x57, 0x46, - 0xd1, 0x33, 0xf8, 0xe7, 0xd9, 0xf3, 0xf8, 0xe7, 0x9a, 0x16, 0x23, 0x9e, 0x1a, 0x19, 0xd9, 0xce, - 0x67, 0x2f, 0xf1, 0xc8, 0x48, 0x95, 0xea, 0x6b, 0xb6, 0xf7, 0xe0, 0xc3, 0xc4, 0x75, 0xbc, 0xc0, - 0x73, 0x23, 0xfb, 0x3c, 0x32, 0xbe, 0xcb, 0x7f, 0xb7, 0xfd, 0xed, 0x7f, 0x39, 0x45, 0xce, 0x3d, - 0x16, 0xb9, 0x96, 0x2a, 0xa5, 0x01, 0x99, 0x49, 0xf9, 0x48, 0xb4, 0x1a, 0xac, 0xb1, 0x36, 0xb7, - 0xf9, 0xec, 0xdf, 0xfd, 0xc7, 0xdf, 0xff, 0x75, 0xe3, 0x3c, 0xa5, 0xfb, 0x43, 0xc1, 0xa2, 0x44, - 0x8a, 0xd4, 0xbc, 0xaa, 0x19, 0x10, 0x04, 0x21, 0xd2, 0xd1, 0x87, 0xa4, 0x19, 0x0b, 0x1d, 0xe5, - 0x32, 0x03, 0xd9, 0xad, 0x53, 0x38, 0xec, 0x2a, 0x0e, 0xfb, 0x24, 0x7d, 0x79, 0x6a, 0x58, 0xa2, - 0xd2, 0x01, 0xab, 0x11, 0x33, 0x6d, 0x72, 0x99, 0x0e, 0xc2, 0x3a, 0x03, 0xca, 0xc9, 0xb9, 0x03, - 0x3b, 0x95, 0xd6, 0x69, 0xe4, 0x75, 0x17, 0x79, 0x75, 0xe8, 0x3b, 0x53, 0xbc, 0x1c, 0x8d, 0x63, - 0xc1, 0x0a, 0x0d, 0xff, 0x73, 0xe6, 0x77, 0xc4, 0xf7, 0x43, 0xab, 0x8e, 0x86, 0x02, 0xe6, 0xeb, - 0xf9, 0xd2, 0x77, 0xc8, 0xd9, 0x48, 0x8d, 0x46, 0xd2, 0xb4, 0x66, 0x50, 0xc2, 0xab, 0x28, 0xe1, - 0x13, 0xf4, 0xc5, 0x29, 0x09, 0x03, 0x69, 0x98, 0x25, 0x73, 0x42, 0x82, 0xd0, 0x0d, 0xa3, 0x1d, - 0x42, 0x7a, 0x85, 0x4c, 0xe2, 0xae, 0x91, 0x23, 0xd1, 0x3a, 0x83, 0x4c, 0xda, 0xc8, 0xe4, 0x79, - 0xfa, 0xec, 0x93, 0xa1, 0x48, 0x99, 0x29, 0x39, 0xb1, 0x31, 0xd7, 0x0c, 0xa8, 0x4d, 0x10, 0xce, - 0xe1, 0xa8, 0x7d, 0x39, 0x12, 0xed, 0x7f, 0x38, 0x4d, 0xe6, 0x9e, 0xe4, 0xd2, 0x88, 0x1e, 0x8f, - 0x9e, 0xd2, 0x90, 0x34, 0xb3, 0x5c, 0x1e, 0x70, 0x23, 0xba, 0x4f, 0xc5, 0xa4, 0x75, 0x0e, 0x39, - 0x5e, 0x47, 0x8e, 0xaf, 0xd1, 0x2b, 0x53, 0xd3, 0x72, 0x74, 0xec, 0xa9, 0x98, 0x30, 0x99, 0xb2, - 0xdd, 0x3b, 0x0f, 0x98, 0x48, 0x23, 0x15, 0xe3, 0x04, 0x89, 0xeb, 0xfd, 0xa2, 0x98, 0xd0, 0x0f, - 0xc8, 0xea, 0xb0, 0x48, 0x4d, 0x37, 0xe1, 0xda, 0xe0, 0x44, 0xb5, 0xe1, 0xa3, 0xac, 0xb5, 0xc0, - 0x1a, 0x6b, 0x33, 0x9b, 0xeb, 0xc8, 0xfb, 0x53, 0x74, 0x0d, 0x78, 0x03, 0x05, 0x03, 0x5a, 0x56, - 0x92, 0x31, 0x33, 0x94, 0xda, 0xaf, 0x20, 0xe7, 0x69, 0x10, 0xae, 0x00, 0xc1, 0x7d, 0xae, 0xcd, - 0xbe, 0xa7, 0xa1, 0xff, 0xd8, 0x20, 0xcf, 0x20, 0x77, 0x2d, 0xf2, 0x03, 0x91, 0xc3, 0x1f, 0xc9, - 0x93, 0x6e, 0x5a, 0x8c, 0x7a, 0x22, 0x6f, 0x2d, 0xa2, 0xa0, 0x3f, 0x69, 0xa0, 0xa4, 0xef, 0x37, - 0xe8, 0x1f, 0x36, 0x4a, 0x59, 0x91, 0x00, 0xfd, 0x93, 0x11, 0xac, 0xc3, 0x0e, 0x62, 0x76, 0x10, - 0x1b, 0x0b, 0xa6, 0xf9, 0x98, 0xf5, 0x73, 0x35, 0xc2, 0x3d, 0xb4, 0x9c, 0x03, 0xb6, 0x85, 0x33, - 0xd1, 0x2c, 0x17, 0xfd, 0x42, 0x0b, 0x66, 0x14, 0x8b, 0x54, 0x9a, 0x8a, 0xc8, 0xc0, 0x47, 0x4b, - 0xa4, 0xd9, 0x58, 0x9a, 0x21, 0x53, 0x49, 0x2c, 0xf2, 0x69, 0xae, 0x9a, 0x71, 0xcd, 0x32, 0x9e, - 0x1b, 0xa6, 0xfa, 0x8e, 0x18, 0xb7, 0x2f, 0x57, 0x86, 0xa3, 0x1e, 0xa2, 0x15, 0x44, 0x2a, 0x09, - 0xc2, 0x8b, 0x30, 0xbf, 0x3d, 0x24, 0xd9, 0x43, 0x16, 0x0f, 0x91, 0x03, 0x7d, 0x93, 0x2c, 0x88, - 0x03, 0x91, 0x9a, 0xee, 0x87, 0x85, 0xc8, 0xa5, 0xd0, 0x68, 0x1e, 0xcd, 0x8d, 0xf3, 0xd6, 0x80, - 0x82, 0xc7, 0xef, 0xdd, 0xbf, 0x03, 0xdd, 0xfb, 0xbc, 0x97, 0x88, 0x70, 0x1e, 0x49, 0xdf, 0xb3, - 0x94, 0xed, 0x7f, 0x3a, 0x45, 0x2e, 0x3e, 0x91, 0x69, 0xac, 0xc6, 0x7a, 0x27, 0xd5, 0x86, 0x27, - 0x89, 0xc8, 0xb7, 0xd0, 0xa6, 0xe9, 0x03, 0x32, 0x0f, 0xd3, 0x91, 0x91, 0xe8, 0xd6, 0x6c, 0xee, - 0x53, 0xb8, 0x63, 0x2f, 0xd3, 0x36, 0xec, 0x17, 0xb4, 0xc3, 0xb4, 0xfd, 0x66, 0xc8, 0xc8, 0xae, - 0x3e, 0x17, 0xdc, 0x88, 0x20, 0x6c, 0xba, 0xb6, 0x87, 0x60, 0x8a, 0x7f, 0xd0, 0x20, 0xf3, 0xd2, - 0x8a, 0xe8, 0x66, 0xdc, 0x0c, 0x9d, 0x31, 0x7e, 0x13, 0xf9, 0x1d, 0xd2, 0x83, 0x27, 0x43, 0x91, - 0x0b, 0xa6, 0x87, 0xaa, 0x48, 0x62, 0x64, 0xd8, 0x93, 0x29, 0xcf, 0x27, 0xac, 0x27, 0x98, 0x1b, - 0x26, 0xe2, 0x77, 0x18, 0x48, 0x75, 0x5f, 0x51, 0xff, 0x79, 0x1a, 0xb3, 0x48, 0x65, 0x52, 0xe8, - 0xfa, 0x18, 0xa3, 0xac, 0x8a, 0x24, 0x2a, 0xb2, 0x7b, 0x08, 0x64, 0x6e, 0x98, 0xae, 0xcf, 0x36, - 0x08, 0x9b, 0xae, 0x79, 0x97, 0x9b, 0x21, 0xfd, 0x2a, 0x59, 0xf5, 0x4b, 0xae, 0xbb, 0x8d, 0xd3, - 0xd3, 0x6e, 0x63, 0xbb, 0xe6, 0x24, 0xfa, 0x2a, 0x47, 0x7e, 0x63, 0xbb, 0x87, 0x15, 0x5f, 0xea, - 0x3e, 0xd5, 0x88, 0xdb, 0xdf, 0x3e, 0x45, 0x2e, 0x6c, 0xf3, 0x7c, 0x2c, 0xd3, 0xff, 0xdd, 0xeb, - 0xf6, 0xbf, 0xcd, 0x90, 0xe5, 0x50, 0xa6, 0x83, 0xcd, 0xa2, 0xdf, 0x2f, 0xf7, 0xe1, 0x05, 0x32, - 0xdb, 0x97, 0x89, 0xc0, 0x3d, 0xb0, 0xbb, 0x7e, 0xaa, 0xd5, 0x08, 0xcb, 0x36, 0xfa, 0x35, 0xd2, - 0x1c, 0x89, 0x91, 0xca, 0x27, 0x5d, 0x2d, 0x3f, 0xb2, 0xdb, 0x34, 0xb3, 0xf9, 0x39, 0x5c, 0xd6, - 0x67, 0xe8, 0xcd, 0x7b, 0x6a, 0xcc, 0x46, 0x3c, 0x9d, 0xb0, 0xde, 0xc4, 0xc0, 0x24, 0x15, 0xd3, - 0x46, 0xe5, 0xb0, 0x08, 0x9c, 0x07, 0xfa, 0xe2, 0x1e, 0x8a, 0x83, 0x26, 0xcb, 0x28, 0x08, 0x89, - 0xfd, 0xb0, 0x27, 0x3f, 0x12, 0x34, 0x25, 0x73, 0xb1, 0xd4, 0x4f, 0x2d, 0xf7, 0x53, 0xc8, 0xfd, - 0x3d, 0xe4, 0xfe, 0x45, 0xba, 0xf3, 0x33, 0x70, 0x57, 0x29, 0x03, 0x36, 0x6c, 0x6d, 0x9d, 0x8d, - 0x04, 0x4f, 0x59, 0xaa, 0xec, 0x77, 0x58, 0xc7, 0x95, 0x20, 0x9c, 0x85, 0x2f, 0x28, 0xef, 0x90, - 0x2c, 0xfa, 0xb5, 0x75, 0x13, 0x99, 0x16, 0x87, 0xce, 0xe9, 0x97, 0x42, 0x1f, 0xba, 0x53, 0x07, - 0xaa, 0x4a, 0xe4, 0x09, 0xab, 0x59, 0x93, 0x7d, 0x26, 0x46, 0x99, 0x99, 0x80, 0x97, 0x8a, 0x15, - 0x4b, 0x95, 0x61, 0xe0, 0x8c, 0xb8, 0x17, 0xba, 0xe0, 0x05, 0xdd, 0x07, 0x39, 0xf4, 0x1b, 0x64, - 0xb9, 0x94, 0xec, 0x94, 0xd7, 0xc5, 0x8a, 0x5f, 0x80, 0xec, 0x25, 0x2f, 0xca, 0xb9, 0x1a, 0xfa, - 0x11, 0x29, 0x9b, 0xba, 0x31, 0x5a, 0x44, 0xeb, 0xec, 0x2f, 0x4a, 0x78, 0xb9, 0xc3, 0xd6, 0xf4, - 0xda, 0xdf, 0xa5, 0x64, 0xde, 0x7a, 0x6c, 0xa7, 0x74, 0xbf, 0xd4, 0x20, 0x67, 0x13, 0xde, 0x13, - 0x89, 0x6e, 0x9d, 0x65, 0xa7, 0xd7, 0xe6, 0x36, 0x25, 0x4e, 0x22, 0xa2, 0xbc, 0xc3, 0x12, 0xa9, - 0xd1, 0x31, 0xdb, 0xfe, 0x7a, 0xe4, 0x1c, 0x72, 0x1d, 0xb0, 0x7d, 0xd0, 0x7c, 0x9e, 0x24, 0xd6, - 0xf4, 0x13, 0x11, 0x19, 0x11, 0xb3, 0x41, 0xae, 0x8a, 0x4c, 0xc3, 0xa8, 0xc8, 0x05, 0x06, 0xa3, - 0xc0, 0xb4, 0x0c, 0xcf, 0x07, 0xc2, 0x00, 0x85, 0x4c, 0x31, 0xa2, 0xe9, 0x20, 0x74, 0x82, 0x29, - 0x27, 0x4d, 0x17, 0xa7, 0x8a, 0x3c, 0xd1, 0xad, 0x59, 0x9c, 0xc7, 0x6d, 0x9c, 0xc7, 0x5b, 0xf4, - 0x8d, 0x6a, 0x1e, 0x2e, 0x40, 0x3c, 0x0a, 0xef, 0x4f, 0x4d, 0x66, 0x2c, 0x93, 0x84, 0x19, 0x6b, - 0x8d, 0x55, 0xec, 0x09, 0x42, 0x62, 0xe9, 0x1f, 0xe5, 0x89, 0xa6, 0xdf, 0x6a, 0x90, 0xc5, 0x88, - 0x77, 0x6b, 0xe1, 0xad, 0xd5, 0xc4, 0x3d, 0xef, 0xa1, 0x98, 0xaf, 0xd0, 0xf7, 0xc1, 0xe0, 0xb7, - 0x3a, 0xaf, 0xea, 0xa9, 0x10, 0x88, 0xf1, 0xdb, 0xce, 0x79, 0xf7, 0xce, 0x83, 0x80, 0xed, 0x1f, - 0x93, 0x5a, 0x68, 0xc3, 0xc0, 0x2e, 0xdc, 0xdc, 0xb4, 0x1c, 0xa4, 0x22, 0xb6, 0xf1, 0x0e, 0x3d, - 0xc3, 0x56, 0x27, 0x08, 0x17, 0x22, 0xbe, 0x55, 0x31, 0xa5, 0x3f, 0x6c, 0x90, 0x33, 0xa9, 0x4a, - 0x23, 0xd1, 0x9a, 0xc7, 0x29, 0xfc, 0xb1, 0x0d, 0xc4, 0xbf, 0xd3, 0xa0, 0xbf, 0xdd, 0xe8, 0x30, - 0x3d, 0xe4, 0xb9, 0x88, 0x19, 0x12, 0x1c, 0x5b, 0x65, 0x96, 0x0b, 0x2d, 0x52, 0x63, 0x27, 0xe2, - 0x44, 0x62, 0x47, 0x2e, 0xbe, 0x0e, 0xcb, 0xf6, 0x7b, 0x3e, 0x1e, 0xca, 0x68, 0xe8, 0x15, 0xc2, - 0x0d, 0xb2, 0xf3, 0x81, 0xe8, 0xaa, 0x15, 0x93, 0x86, 0x8d, 0x60, 0xea, 0x3d, 0xc1, 0xc4, 0xa8, - 0x27, 0x62, 0xb7, 0x48, 0x53, 0xc7, 0x33, 0x16, 0xde, 0x16, 0x39, 0x7a, 0xb6, 0x20, 0xb4, 0x73, - 0xa6, 0x7d, 0xb2, 0x3c, 0xf6, 0xe8, 0xc8, 0xab, 0xef, 0x79, 0x5c, 0xc7, 0xdb, 0xb8, 0x8c, 0x9b, - 0xf4, 0x46, 0x87, 0x81, 0xdf, 0x65, 0x63, 0x74, 0xb4, 0x96, 0xa4, 0x9a, 0x19, 0xcc, 0x16, 0x19, - 0xa0, 0xd3, 0x4c, 0x98, 0x36, 0xe8, 0xc2, 0x97, 0x4a, 0xa6, 0x56, 0x53, 0x69, 0x44, 0xaa, 0x26, - 0xe7, 0x1e, 0xe6, 0x50, 0xcc, 0x5b, 0x28, 0xe6, 0x75, 0xba, 0x31, 0x25, 0x06, 0x29, 0x7e, 0xaa, - 0x94, 0xc5, 0x92, 0xa5, 0x75, 0x04, 0x92, 0xac, 0x54, 0x42, 0xbc, 0x27, 0x20, 0x28, 0xe6, 0xb3, - 0x28, 0xe6, 0x16, 0x7d, 0x7d, 0x4a, 0x8c, 0x0f, 0x75, 0x3f, 0x4d, 0x50, 0xb5, 0x47, 0xde, 0xea, - 0xff, 0x0f, 0x99, 0x1d, 0xf1, 0xc3, 0x6e, 0xa6, 0x92, 0xa4, 0xb5, 0x84, 0xce, 0xd5, 0x6b, 0xf8, - 0x0d, 0x38, 0xcc, 0x11, 0x3f, 0x94, 0xa3, 0x62, 0xe4, 0xd1, 0x16, 0x6a, 0x7b, 0xa4, 0xd2, 0x58, - 0xb3, 0x9e, 0x30, 0x63, 0x21, 0x52, 0x7f, 0xdc, 0xc0, 0x40, 0x07, 0x1b, 0xa7, 0x6f, 0xad, 0xaf, - 0x87, 0xe7, 0x46, 0xfc, 0x70, 0x57, 0x25, 0x09, 0xdd, 0x23, 0xf3, 0x9e, 0x79, 0x57, 0x9b, 0xb8, - 0xf5, 0x1c, 0x0a, 0xf0, 0x30, 0xf5, 0x15, 0xd4, 0x16, 0xc3, 0xd3, 0x98, 0xe7, 0x31, 0x8b, 0xc5, - 0x81, 0xb4, 0xc1, 0xca, 0x73, 0x76, 0x2c, 0x4f, 0xdd, 0x58, 0x0f, 0x89, 0xe3, 0xb8, 0x67, 0x62, - 0xfa, 0x7f, 0xc9, 0x8a, 0x5b, 0x6e, 0xd7, 0x07, 0xc6, 0xbc, 0xb5, 0x8c, 0xe8, 0xea, 0xb2, 0x43, - 0x57, 0x27, 0xa3, 0xa7, 0xcd, 0x6b, 0x28, 0xf8, 0x0a, 0x7d, 0x75, 0xab, 0xae, 0x42, 0x3e, 0x80, - 0xfb, 0x3d, 0x2c, 0x99, 0xc2, 0x76, 0x1d, 0x61, 0x44, 0x0f, 0xc9, 0xb2, 0xd5, 0x9c, 0x9a, 0xec, - 0x0b, 0x28, 0xfb, 0x79, 0x27, 0xfb, 0x44, 0x30, 0xf1, 0xb3, 0x8b, 0x5e, 0x8a, 0xa7, 0xf9, 0xd0, - 0xa7, 0x64, 0x31, 0xcb, 0x2d, 0xa4, 0x14, 0x87, 0x22, 0x3a, 0x10, 0xad, 0x15, 0xd6, 0x58, 0x9b, - 0xdd, 0xdc, 0x46, 0xce, 0x9f, 0xa7, 0x9f, 0xdd, 0xe9, 0x5b, 0x53, 0x92, 0xe0, 0xf6, 0xcc, 0x55, - 0xe6, 0xa8, 0x19, 0xcf, 0x7b, 0xd2, 0xe4, 0x00, 0x0b, 0xc0, 0x69, 0x30, 0x18, 0x5c, 0x58, 0xe1, - 0xa5, 0xfa, 0x07, 0xe1, 0x82, 0xa3, 0xbe, 0x83, 0xac, 0xe9, 0xfb, 0x55, 0x4e, 0x45, 0x71, 0x75, - 0x8b, 0x1e, 0xb7, 0xda, 0xd6, 0xe9, 0x74, 0xc0, 0xa7, 0x56, 0x32, 0xed, 0xab, 0x7c, 0xc4, 0x6b, - 0x20, 0xac, 0x4c, 0x09, 0x6a, 0xc9, 0x54, 0x4e, 0x96, 0x63, 0xd1, 0xe7, 0x45, 0x62, 0xba, 0xa0, - 0x1c, 0x63, 0x2e, 0x4d, 0x6b, 0x15, 0x15, 0xe3, 0x1e, 0x32, 0xdd, 0xa4, 0xb7, 0x81, 0xa9, 0xa3, - 0x01, 0x0d, 0xc4, 0x2c, 0x03, 0xdc, 0x28, 0xd0, 0xb2, 0x9e, 0xe8, 0x43, 0xd8, 0x01, 0xe0, 0x2f, - 0xd2, 0x18, 0x61, 0x3a, 0x20, 0xf7, 0xc7, 0xef, 0xdd, 0x67, 0xb9, 0xd0, 0x45, 0x02, 0xcb, 0x59, - 0x74, 0xa3, 0x1f, 0xf0, 0xc3, 0x27, 0x5c, 0x1a, 0xfa, 0xcf, 0x0d, 0xb2, 0x5a, 0x68, 0xd1, 0xd5, - 0x22, 0xe9, 0x77, 0xad, 0x33, 0xec, 0x6a, 0x9d, 0xb4, 0x5a, 0xb8, 0x85, 0x3f, 0xb4, 0x9e, 0xee, - 0xcf, 0x1a, 0xf4, 0x4f, 0x1b, 0x47, 0x77, 0xf1, 0xa8, 0xab, 0x13, 0x87, 0x19, 0x78, 0x34, 0x48, - 0x1c, 0x93, 0xbe, 0xf7, 0xab, 0x75, 0xdf, 0x7c, 0x34, 0x13, 0x79, 0xf8, 0xa5, 0xfd, 0x3b, 0x6f, - 0x39, 0xc7, 0x78, 0xf2, 0x08, 0xef, 0xf1, 0x5c, 0x57, 0x6f, 0x82, 0xc3, 0x1f, 0x8b, 0x44, 0x45, - 0x32, 0xe7, 0x99, 0x51, 0x39, 0xdb, 0xea, 0x38, 0xdf, 0x29, 0x75, 0xe5, 0x18, 0x79, 0x4f, 0x1d, - 0x80, 0x4d, 0x17, 0x5a, 0xec, 0x89, 0xa4, 0xbf, 0x87, 0xc3, 0xf7, 0x74, 0x42, 0xff, 0xb2, 0x41, - 0x68, 0x26, 0x53, 0x5c, 0xa4, 0x0d, 0x60, 0x08, 0xde, 0x9e, 0x47, 0x07, 0xf2, 0x1d, 0xbb, 0xd8, - 0x6f, 0x37, 0xe8, 0xaf, 0x34, 0x1e, 0xd6, 0xf0, 0x6b, 0x3f, 0x57, 0xa9, 0x11, 0x69, 0x3c, 0x1d, - 0x6a, 0x02, 0xb6, 0xd3, 0x87, 0xad, 0xe6, 0xb9, 0x70, 0x29, 0x73, 0x7d, 0x15, 0x7b, 0x7b, 0xf7, - 0x8f, 0x6d, 0x50, 0x4f, 0x30, 0x2b, 0xbb, 0x44, 0xa1, 0x88, 0x92, 0xd7, 0xfc, 0x79, 0xd6, 0xd7, - 0x65, 0xf3, 0xa6, 0x2b, 0xe1, 0xb2, 0x1d, 0x61, 0xbf, 0x22, 0x5a, 0x4e, 0xc9, 0x12, 0x28, 0x47, - 0x91, 0x25, 0x8a, 0xc7, 0x16, 0xfa, 0x3d, 0x83, 0x3a, 0xf2, 0x2e, 0xce, 0xfe, 0x36, 0xfd, 0xfc, - 0x03, 0xe7, 0x99, 0xa0, 0x0f, 0x62, 0xc4, 0x26, 0x22, 0xc0, 0xb1, 0xb0, 0xb3, 0xb0, 0x10, 0x9c, - 0xd9, 0xf1, 0x1a, 0xb5, 0xb1, 0x9c, 0xc1, 0xcd, 0x51, 0xef, 0x4a, 0xb8, 0x30, 0xe2, 0x87, 0x8f, - 0xb0, 0x17, 0x41, 0x5f, 0x4c, 0xe6, 0xd1, 0x51, 0x76, 0x2d, 0x88, 0x69, 0x3d, 0x8b, 0x5a, 0x7f, - 0xc9, 0x69, 0xfd, 0x51, 0x4c, 0xbc, 0xb9, 0x86, 0xb3, 0x68, 0x53, 0xe6, 0xcd, 0xd9, 0xc6, 0x44, - 0xeb, 0x6b, 0x6b, 0x60, 0x28, 0x08, 0x9b, 0xd8, 0x66, 0x07, 0xd3, 0xeb, 0xe4, 0x02, 0xac, 0xca, - 0xc1, 0xe5, 0x21, 0xcf, 0xe3, 0x6e, 0x22, 0x47, 0xd2, 0xb4, 0x2e, 0xc3, 0xda, 0x42, 0x3a, 0xe2, - 0x87, 0x0f, 0xb0, 0xef, 0x1e, 0xcf, 0xe3, 0xfb, 0xd0, 0xd3, 0xfe, 0xc1, 0x0c, 0x99, 0xeb, 0xec, - 0xee, 0x38, 0x58, 0xf4, 0x2c, 0x99, 0x1d, 0x2a, 0x6d, 0xf0, 0x38, 0x11, 0x19, 0x86, 0xe5, 0x77, - 0xfa, 0x5b, 0x0d, 0x32, 0xdf, 0x93, 0x69, 0xdc, 0xe5, 0x71, 0x9c, 0x0b, 0xad, 0x5d, 0xc2, 0x72, - 0x80, 0x53, 0xcd, 0x68, 0xda, 0xb1, 0xcd, 0x08, 0x7c, 0x64, 0x1a, 0xb3, 0x41, 0xb8, 0xbb, 0xc5, - 0x44, 0x1a, 0x67, 0x4a, 0xda, 0xd0, 0x0d, 0x2a, 0x6f, 0xd3, 0x8f, 0x42, 0x17, 0x3c, 0x49, 0x26, - 0x4c, 0xa5, 0x09, 0x26, 0x20, 0xd7, 0x37, 0x3e, 0x13, 0xac, 0x07, 0xeb, 0xc1, 0xf5, 0xab, 0x4c, - 0x99, 0xa1, 0xc8, 0xc7, 0x52, 0x0b, 0xd4, 0x58, 0x5c, 0xb8, 0x82, 0x74, 0x38, 0x13, 0x79, 0x02, - 0x70, 0x23, 0x82, 0x26, 0x69, 0x82, 0xb0, 0x09, 0x42, 0x9c, 0x4c, 0x7a, 0x93, 0xcc, 0xe1, 0xd4, - 0x32, 0x95, 0x1b, 0xc4, 0xf0, 0x0b, 0x9b, 0x2d, 0x9c, 0x17, 0xa5, 0xcb, 0xbb, 0x2a, 0x37, 0xe5, - 0xa4, 0x60, 0xb3, 0x67, 0xe1, 0x13, 0xb4, 0xd2, 0x1e, 0x41, 0x2e, 0x5d, 0x5b, 0x90, 0x71, 0xd9, - 0x47, 0x07, 0x07, 0xbe, 0x0d, 0xf1, 0xdc, 0xb6, 0x97, 0x09, 0x1f, 0x00, 0x32, 0x61, 0x2b, 0x38, - 0x2a, 0x7a, 0x2a, 0x0c, 0x5b, 0x13, 0xc1, 0x20, 0x60, 0x26, 0xca, 0xae, 0xb2, 0x22, 0x95, 0x87, - 0x57, 0x82, 0x8d, 0x19, 0xf8, 0x1b, 0x12, 0xe0, 0xba, 0x87, 0x83, 0xe9, 0x8f, 0x1a, 0x64, 0xd1, - 0x19, 0xcb, 0x60, 0x6c, 0x0d, 0xc5, 0xe2, 0xfd, 0xef, 0x5b, 0x43, 0xf9, 0xdd, 0x06, 0xfd, 0x5e, - 0xe3, 0x2e, 0x37, 0x62, 0xcc, 0x27, 0x53, 0x66, 0x6b, 0xf5, 0x8c, 0xe7, 0x80, 0xf0, 0xd0, 0xd1, - 0xa9, 0xd1, 0x48, 0xa5, 0xb6, 0xd4, 0xc5, 0x1e, 0x2a, 0x03, 0x2a, 0xc1, 0x4d, 0xcd, 0x04, 0x60, - 0x7f, 0x33, 0x11, 0x81, 0xb3, 0xea, 0x89, 0x88, 0x03, 0x20, 0x96, 0xc6, 0x23, 0x55, 0x5e, 0x98, - 0x21, 0xeb, 0x4d, 0x32, 0xae, 0xad, 0xb6, 0xca, 0xd4, 0x88, 0x3c, 0xe5, 0x09, 0x1b, 0x78, 0xd1, - 0x90, 0xbb, 0x05, 0x6c, 0xdb, 0x29, 0xf1, 0xda, 0xdd, 0x70, 0x77, 0xab, 0x7b, 0xf7, 0xc9, 0x95, - 0x70, 0xde, 0xce, 0xfe, 0xee, 0x18, 0x0c, 0xa7, 0xfd, 0xa3, 0x19, 0xb2, 0xd4, 0xc9, 0xe4, 0x14, - 0x98, 0xe6, 0xc7, 0x40, 0x66, 0x63, 0x1a, 0xb2, 0x58, 0x90, 0x39, 0xb5, 0xba, 0x42, 0x5b, 0x0b, - 0x3e, 0x10, 0xb9, 0xec, 0x4f, 0x58, 0x67, 0x77, 0xc7, 0x83, 0x58, 0xa9, 0x52, 0x7d, 0x0c, 0x3c, - 0x7e, 0xb7, 0x41, 0x9a, 0xd6, 0x0b, 0xa0, 0x1c, 0x97, 0xdc, 0x56, 0xba, 0xe7, 0x5d, 0x44, 0x5d, - 0x04, 0x6e, 0x4f, 0x4f, 0x24, 0x2a, 0x1d, 0xe8, 0xd2, 0x59, 0xb8, 0x70, 0xc1, 0xee, 0x8a, 0x54, - 0xe4, 0x1c, 0x80, 0x79, 0xe9, 0x50, 0x5f, 0x3d, 0xa8, 0xbb, 0x44, 0x0b, 0x03, 0x19, 0xcf, 0x64, - 0xd7, 0x41, 0x43, 0x9f, 0x10, 0x07, 0x21, 0xb1, 0x2d, 0x30, 0x41, 0xfa, 0x55, 0x42, 0xdd, 0xc4, - 0xea, 0x05, 0x33, 0xab, 0x4a, 0x65, 0x54, 0xde, 0xad, 0xd5, 0xc8, 0x8c, 0x62, 0x03, 0xe5, 0xa1, - 0xb2, 0xf7, 0x6d, 0xb8, 0xaa, 0x20, 0x5c, 0xb6, 0xdf, 0x76, 0xab, 0xa2, 0x59, 0x4a, 0x2e, 0xe0, - 0x14, 0xca, 0xbd, 0xe9, 0xda, 0xda, 0x9f, 0x53, 0xa2, 0x72, 0x8b, 0xef, 0xfb, 0x54, 0xdc, 0x02, - 0x36, 0xe0, 0xcc, 0x33, 0x59, 0xda, 0x5f, 0xe9, 0x3b, 0xf9, 0x01, 0x97, 0x09, 0xef, 0x25, 0x22, - 0x08, 0x57, 0x79, 0x26, 0xb7, 0x4a, 0xbe, 0x7b, 0xc8, 0x96, 0xbe, 0xe3, 0xaa, 0xad, 0x36, 0x2f, - 0x7c, 0x0d, 0xd9, 0xbf, 0x42, 0x5f, 0xc2, 0x13, 0x44, 0x05, 0x44, 0x9f, 0x5e, 0x46, 0x5f, 0x3c, - 0x37, 0x17, 0x81, 0x6d, 0xf9, 0xf5, 0xea, 0x89, 0xb1, 0x01, 0x33, 0xbd, 0xe3, 0x7e, 0xb8, 0x7d, - 0x8d, 0x9c, 0xbb, 0xfb, 0x68, 0xe7, 0xbe, 0x4c, 0x9f, 0x52, 0x4a, 0x66, 0x8c, 0x38, 0x34, 0x56, - 0x77, 0x42, 0xfc, 0x4c, 0x97, 0xc9, 0xe9, 0x22, 0x4f, 0xec, 0x69, 0x87, 0xf0, 0xb1, 0xfd, 0x9d, - 0x33, 0x64, 0xa1, 0x53, 0x98, 0xa1, 0x48, 0x0d, 0x9c, 0xb2, 0xca, 0x71, 0xdc, 0x24, 0x13, 0xe5, - 0xb8, 0x49, 0x26, 0xe8, 0x97, 0xc9, 0x92, 0x02, 0x8d, 0x77, 0x47, 0xd7, 0x95, 0xb1, 0x5b, 0x50, - 0x89, 0x2b, 0x76, 0x00, 0x69, 0x1a, 0xf0, 0xe7, 0x60, 0x27, 0x48, 0x8c, 0x36, 0xe2, 0xf8, 0x22, - 0xc4, 0x48, 0xd4, 0x38, 0x08, 0x17, 0xb0, 0xcf, 0xea, 0xfb, 0x4e, 0x4c, 0x3f, 0x20, 0xab, 0x53, - 0x9c, 0xb5, 0x88, 0x72, 0x61, 0x5c, 0x26, 0xfb, 0xb3, 0x73, 0x5f, 0xa9, 0x71, 0xdf, 0x43, 0x56, - 0xf4, 0x22, 0x39, 0x6b, 0x44, 0xca, 0x53, 0x63, 0xab, 0xae, 0xa1, 0xfb, 0x46, 0xb7, 0xc9, 0xb2, - 0xe6, 0xa3, 0x64, 0xca, 0xce, 0x6c, 0x26, 0xf5, 0x0c, 0x8a, 0x5d, 0xa5, 0x2b, 0x7b, 0x9d, 0x07, - 0xf7, 0xa7, 0xa2, 0x6b, 0xb8, 0x04, 0x43, 0xea, 0x86, 0xb4, 0xe5, 0xb8, 0xd4, 0x95, 0x75, 0xe1, - 0x04, 0x2e, 0xb5, 0xaa, 0x6e, 0x10, 0x2e, 0xc2, 0x90, 0x9a, 0x52, 0x76, 0xc9, 0x05, 0x64, 0x22, - 0xe3, 0xac, 0x3b, 0x12, 0x86, 0xc7, 0xdc, 0x70, 0x48, 0x62, 0xb1, 0xc4, 0x5a, 0xab, 0x9a, 0x21, - 0x27, 0x19, 0xc3, 0xaa, 0xcd, 0x04, 0xbc, 0xf8, 0x81, 0x8c, 0x45, 0xce, 0xfc, 0x10, 0x48, 0x69, - 0x83, 0x90, 0x02, 0xab, 0x9d, 0x38, 0x7b, 0xe0, 0x5a, 0x1f, 0xe5, 0x09, 0x7d, 0x8b, 0x2c, 0xa0, - 0x80, 0x5c, 0x29, 0x83, 0x8c, 0x97, 0x90, 0xf1, 0x45, 0x64, 0xbc, 0x4c, 0x17, 0x91, 0x31, 0x74, - 0x5a, 0x16, 0x4d, 0x20, 0x0e, 0x95, 0x32, 0x30, 0x36, 0x23, 0xab, 0x38, 0xb6, 0xd0, 0x22, 0xef, - 0x72, 0x63, 0x72, 0xd9, 0x2b, 0x8c, 0x40, 0x04, 0x5f, 0x4b, 0xaf, 0x91, 0x43, 0xd9, 0x0b, 0xd6, - 0x6e, 0xb8, 0x44, 0xdf, 0x7e, 0xc0, 0x93, 0xc2, 0x6a, 0x38, 0x70, 0x70, 0xd3, 0xef, 0xbb, 0x63, - 0x0b, 0xc2, 0x15, 0x60, 0xfe, 0x48, 0x8b, 0xbc, 0xe3, 0x07, 0xb7, 0x7f, 0x30, 0x4f, 0xe6, 0xee, - 0x3e, 0xf2, 0x31, 0xf4, 0x37, 0x4f, 0x8e, 0x93, 0x05, 0x4a, 0x56, 0x74, 0x74, 0x34, 0x4e, 0xde, - 0x7d, 0xb4, 0xf3, 0x3f, 0x3c, 0x4c, 0xfe, 0x55, 0x83, 0x2c, 0x0e, 0xc6, 0x53, 0x8a, 0x67, 0x93, - 0xc5, 0xef, 0xd9, 0x10, 0xf6, 0xeb, 0x0d, 0xfa, 0x1d, 0xac, 0xa5, 0xe3, 0x52, 0x0e, 0x33, 0xa5, - 0x85, 0x66, 0x9c, 0xdd, 0xdb, 0xdf, 0xdf, 0xb5, 0x71, 0xa6, 0xcf, 0x6d, 0xe1, 0x12, 0xbc, 0x92, - 0x87, 0x05, 0xcc, 0x2e, 0x78, 0xdf, 0x81, 0x61, 0x74, 0x85, 0x35, 0xe7, 0xcd, 0x81, 0xa2, 0xee, - 0x35, 0xc1, 0x99, 0x7b, 0x27, 0xe6, 0x83, 0x47, 0xad, 0xe4, 0x5e, 0x67, 0x6d, 0x39, 0x87, 0x0b, - 0x83, 0x71, 0x5d, 0xf3, 0x9f, 0xe2, 0x22, 0xea, 0x7a, 0x6f, 0x4b, 0x21, 0x77, 0x70, 0x0d, 0xef, - 0xd0, 0xcf, 0xc1, 0x0a, 0xea, 0x22, 0x8f, 0x00, 0x57, 0x9f, 0x89, 0x4e, 0x17, 0x47, 0x98, 0x4d, - 0x49, 0x82, 0x70, 0x7e, 0x30, 0xae, 0x59, 0xc8, 0x77, 0x1b, 0x64, 0xc1, 0x87, 0xd8, 0x6e, 0x24, - 0xe3, 0xbc, 0x75, 0x1a, 0xcb, 0x3b, 0x39, 0x0a, 0x4b, 0xe8, 0xd7, 0xb7, 0x76, 0xb6, 0x43, 0xe6, - 0x34, 0x44, 0x60, 0xe1, 0xa8, 0x8c, 0xc8, 0xa9, 0x30, 0x63, 0x95, 0x3f, 0xd5, 0x0e, 0x5e, 0x5c, - 0x7f, 0x73, 0x23, 0xb8, 0x7e, 0xeb, 0x0d, 0x38, 0xf9, 0x6b, 0xd7, 0x6f, 0x5d, 0x09, 0xd8, 0x13, - 0xeb, 0x55, 0xd0, 0xff, 0x1a, 0x05, 0xca, 0x32, 0xc6, 0x89, 0x7a, 0x06, 0xd7, 0xc4, 0xa1, 0xe3, - 0x24, 0x23, 0xd0, 0xd8, 0x79, 0xdf, 0xb1, 0x25, 0xe3, 0x9c, 0xfe, 0x6a, 0x83, 0xcc, 0x1e, 0x64, - 0xa9, 0x9d, 0xd4, 0x0c, 0x4e, 0x6a, 0x84, 0x93, 0x1a, 0x50, 0x71, 0x7c, 0x52, 0x07, 0x59, 0xfa, - 0x73, 0x9f, 0xcf, 0xb9, 0x83, 0x2c, 0xc5, 0xa9, 0xdc, 0x21, 0x24, 0x2b, 0x7a, 0x89, 0x8c, 0xd0, - 0xc4, 0xed, 0x1d, 0xd3, 0x27, 0x71, 0x2e, 0x8c, 0xbe, 0x80, 0xa7, 0x81, 0xbd, 0x60, 0xe3, 0xf6, - 0x30, 0xa4, 0xf6, 0x59, 0x4f, 0x38, 0x67, 0xfb, 0xc0, 0xe0, 0x23, 0xb2, 0x00, 0xc9, 0x65, 0xae, - 0x45, 0x37, 0xcb, 0xd5, 0xe1, 0x04, 0x2b, 0x69, 0xcd, 0x8d, 0x67, 0x3c, 0xb8, 0xb6, 0x7d, 0xbb, - 0xd0, 0xe5, 0xe0, 0xf5, 0x4b, 0x28, 0xe4, 0x32, 0x7d, 0x2e, 0x54, 0x05, 0xa0, 0x7a, 0x30, 0x76, - 0xc7, 0x02, 0x8c, 0xe8, 0x50, 0x0a, 0x1d, 0x84, 0xf3, 0x79, 0x6d, 0x20, 0x7d, 0x44, 0xce, 0x24, - 0x32, 0x7d, 0xaa, 0x5b, 0x73, 0xc8, 0xdc, 0xe7, 0xab, 0x2e, 0x78, 0x55, 0x91, 0xbe, 0x13, 0xc7, - 0x12, 0x1c, 0x05, 0x4f, 0x18, 0xd2, 0x5b, 0xbb, 0xb4, 0x95, 0x28, 0x57, 0x69, 0xba, 0xfb, 0x68, - 0x27, 0x08, 0x2d, 0x37, 0x7a, 0x03, 0xd4, 0x44, 0x42, 0x82, 0x89, 0xfe, 0x4a, 0xb7, 0x56, 0x8e, - 0xb2, 0x07, 0x57, 0x03, 0x47, 0x88, 0x44, 0xf0, 0x45, 0x83, 0x77, 0xe4, 0xf5, 0x10, 0x88, 0xe9, - 0x6d, 0x75, 0xf7, 0x33, 0x15, 0x1e, 0xc3, 0x69, 0x52, 0xfa, 0x3a, 0xb9, 0xe8, 0xef, 0x5a, 0xbb, - 0x5a, 0xf0, 0x3c, 0x1a, 0x76, 0xfb, 0x32, 0x31, 0x22, 0xc7, 0x44, 0x7c, 0x2e, 0x3c, 0xef, 0x7b, - 0xf7, 0xb0, 0xf3, 0x5d, 0xec, 0xa3, 0x57, 0x3e, 0x2e, 0xf6, 0x1c, 0x0f, 0x30, 0x6b, 0x1f, 0x17, - 0x60, 0x8e, 0x45, 0x91, 0xeb, 0x3f, 0x31, 0x8a, 0x9c, 0x18, 0x17, 0xda, 0x27, 0xc6, 0x85, 0x69, - 0xff, 0x1f, 0xfc, 0x04, 0xff, 0x7f, 0x82, 0xf7, 0xa6, 0x37, 0xc8, 0xc5, 0x81, 0x52, 0x83, 0x44, - 0x74, 0x4f, 0x84, 0x0c, 0xe1, 0xaa, 0xed, 0xfd, 0xd2, 0x14, 0x0c, 0x78, 0x9b, 0x3c, 0x7b, 0xd2, - 0xa0, 0x3a, 0x1a, 0x08, 0x2f, 0x1d, 0x1b, 0x68, 0x23, 0x7c, 0x7b, 0x80, 0xa0, 0x07, 0x66, 0x01, - 0xe0, 0xa5, 0xba, 0xfc, 0x71, 0x08, 0xea, 0x25, 0xb2, 0x00, 0x30, 0x7d, 0xac, 0xf2, 0xb8, 0x3b, - 0xe4, 0xda, 0xdd, 0xe4, 0x84, 0xf3, 0xbe, 0xf1, 0x1e, 0xd7, 0xc3, 0x29, 0x22, 0xcd, 0x13, 0x63, - 0x11, 0x67, 0x45, 0xb4, 0xc7, 0x13, 0xd3, 0xfe, 0xa3, 0x06, 0x99, 0xdd, 0xea, 0xb8, 0xb8, 0xf4, - 0x1b, 0x8d, 0xe9, 0x3b, 0xdd, 0x23, 0x61, 0xe9, 0x63, 0xbc, 0xdf, 0x56, 0xe7, 0x84, 0x6a, 0xb0, - 0xd4, 0xb6, 0xa8, 0x10, 0xa9, 0x3c, 0x17, 0x3a, 0x53, 0x69, 0x5c, 0xc3, 0xb3, 0x35, 0x27, 0x2e, - 0x53, 0x77, 0x4f, 0x1a, 0x4c, 0xe7, 0x07, 0x53, 0xf7, 0xc2, 0xed, 0x2e, 0xa1, 0xc7, 0x6d, 0x94, - 0x9e, 0x27, 0x67, 0x72, 0xb0, 0x4e, 0xb7, 0x35, 0xf6, 0xcb, 0x71, 0x40, 0x48, 0x3f, 0x41, 0xe6, - 0x73, 0xf1, 0x61, 0x21, 0x73, 0xd1, 0x85, 0x8d, 0xc6, 0x7d, 0x98, 0x0d, 0x9b, 0xae, 0x0d, 0x6c, - 0xa1, 0xfd, 0xe7, 0x0d, 0x32, 0xbf, 0x3d, 0x49, 0xb7, 0x1f, 0xee, 0x55, 0x57, 0x4e, 0x65, 0x9a, - 0xdb, 0xa8, 0xae, 0x9c, 0xca, 0x54, 0xf7, 0x25, 0xb2, 0x10, 0xc7, 0xa9, 0x46, 0x15, 0x42, 0x22, - 0x77, 0x02, 0xd0, 0xf8, 0xc8, 0xb5, 0x95, 0x44, 0x7e, 0xc7, 0xfd, 0x09, 0x40, 0xe3, 0xae, 0x6b, - 0xa3, 0x97, 0x09, 0x29, 0xb2, 0x18, 0xb6, 0x1c, 0xa6, 0x8d, 0x98, 0x3d, 0x9c, 0xb3, 0x2d, 0xa0, - 0xab, 0xcf, 0x93, 0xb9, 0x3e, 0xcc, 0x54, 0xa4, 0xd1, 0x04, 0xd5, 0x6d, 0x26, 0xac, 0x1a, 0xda, - 0xbf, 0xbf, 0x44, 0x16, 0xdf, 0x75, 0xd1, 0xc7, 0xcd, 0xfc, 0x25, 0xd2, 0x74, 0x2e, 0x13, 0xef, - 0xf8, 0x66, 0xcb, 0xc9, 0x3b, 0x4f, 0x8a, 0x57, 0x9a, 0xf5, 0x2c, 0x7e, 0xf5, 0x48, 0x16, 0xff, - 0xff, 0x4f, 0x46, 0x27, 0x5f, 0x45, 0x35, 0x78, 0x42, 0x1f, 0x1d, 0x45, 0x27, 0x65, 0xf4, 0xab, - 0x20, 0x8a, 0xbf, 0xfa, 0x9e, 0x8a, 0xbe, 0x52, 0x57, 0xb9, 0x06, 0xb8, 0x3c, 0x95, 0x24, 0xe8, - 0x56, 0xbf, 0xae, 0x7a, 0xfa, 0xe7, 0x83, 0x42, 0x5e, 0x26, 0x8b, 0x05, 0xb8, 0xf8, 0x84, 0xcb, - 0xb4, 0x3b, 0x34, 0x26, 0xb3, 0xd5, 0xb5, 0x70, 0xbe, 0xd0, 0x62, 0x17, 0x1a, 0xef, 0x19, 0x93, - 0xd1, 0x87, 0xa4, 0x59, 0x77, 0x52, 0x47, 0xae, 0x71, 0xbf, 0x7c, 0x73, 0xfd, 0x4d, 0x56, 0xf3, - 0x56, 0x78, 0xdb, 0x34, 0x1d, 0xdf, 0x83, 0xb0, 0xce, 0x80, 0xf6, 0xa7, 0x8d, 0x66, 0xe6, 0xe7, - 0x09, 0x19, 0xea, 0x8f, 0x23, 0x6e, 0x93, 0x59, 0x50, 0xa6, 0x2a, 0x59, 0xda, 0x7c, 0x05, 0x85, - 0xbc, 0x48, 0x2f, 0x83, 0x90, 0xed, 0x87, 0x7b, 0x53, 0xb7, 0xc1, 0x5e, 0x42, 0x10, 0x9e, 0x8b, - 0x53, 0x8d, 0x25, 0xad, 0x0f, 0x48, 0x33, 0x52, 0x69, 0x54, 0xe4, 0x39, 0x6a, 0xd3, 0x1c, 0x96, - 0xb3, 0x3e, 0x8f, 0x4c, 0xde, 0xa0, 0xb7, 0xf0, 0x3a, 0xb9, 0x2c, 0xb2, 0xbb, 0x6c, 0x79, 0x24, - 0xb4, 0xe6, 0x03, 0xe1, 0x82, 0x94, 0x8a, 0xe0, 0xe0, 0x4b, 0x1e, 0x26, 0x99, 0xc0, 0x5e, 0x54, - 0x2c, 0xe9, 0x0f, 0x4f, 0x91, 0x67, 0x62, 0xd5, 0x4d, 0x95, 0xe9, 0x46, 0x6a, 0x04, 0x51, 0x4d, - 0x77, 0xcb, 0x87, 0x3c, 0x08, 0x09, 0x67, 0x37, 0xff, 0xd3, 0x42, 0xc2, 0x1f, 0x37, 0xe8, 0xbf, - 0x36, 0xf0, 0xe1, 0x89, 0xcb, 0x83, 0xdc, 0xa5, 0x8c, 0x1f, 0xc7, 0xca, 0x71, 0xcc, 0x5e, 0xd2, - 0xa8, 0x5a, 0x32, 0xec, 0x5c, 0x8c, 0xd4, 0x16, 0xf9, 0x16, 0x5a, 0xf4, 0x0b, 0xab, 0x4d, 0xb1, - 0xe8, 0x15, 0x83, 0x81, 0x4c, 0x07, 0xb6, 0x02, 0xf2, 0x16, 0xdb, 0x13, 0xc6, 0x00, 0x68, 0x47, - 0x05, 0x44, 0x78, 0x88, 0x45, 0xdb, 0x5a, 0xd1, 0xd0, 0x0b, 0x62, 0x7d, 0x29, 0x92, 0x58, 0xb3, - 0x44, 0x3e, 0x75, 0x17, 0xeb, 0x00, 0x31, 0xeb, 0x8f, 0x7f, 0x6c, 0x05, 0x74, 0xc4, 0x27, 0xae, - 0xce, 0x0b, 0xc7, 0x55, 0x2f, 0x39, 0xc7, 0x52, 0x47, 0x89, 0x42, 0xb0, 0x2d, 0xfb, 0x75, 0x11, - 0x52, 0xb3, 0x22, 0xc5, 0x3b, 0x31, 0x11, 0x07, 0xe1, 0xc5, 0x58, 0x3d, 0x54, 0x66, 0xcb, 0x2d, - 0xb4, 0xe3, 0xd7, 0x49, 0x3f, 0x38, 0x5e, 0x72, 0x6c, 0xe2, 0x19, 0xbd, 0x81, 0x3b, 0xb6, 0x41, - 0xd7, 0x7f, 0x72, 0xc9, 0x91, 0x47, 0x91, 0xc8, 0x4c, 0xbd, 0xe4, 0x78, 0xb4, 0xc8, 0xf8, 0x3e, - 0x39, 0x17, 0x4f, 0xd2, 0x6e, 0x9c, 0x6a, 0x0c, 0xce, 0xcd, 0x8d, 0x55, 0x7f, 0x67, 0x50, 0x73, - 0x7e, 0x95, 0x31, 0x54, 0x49, 0xaa, 0x36, 0x1c, 0xcc, 0x6e, 0x28, 0x58, 0x3c, 0x49, 0x59, 0x9c, - 0xd6, 0xde, 0x34, 0x9c, 0x8d, 0x27, 0xe9, 0x76, 0xaa, 0x69, 0x4c, 0xe6, 0x11, 0x5c, 0x75, 0x87, - 0x82, 0xc7, 0x22, 0x77, 0x39, 0xa3, 0xaf, 0x95, 0xbd, 0x79, 0x0f, 0x5b, 0x59, 0x2c, 0xfa, 0xb2, - 0x56, 0x63, 0xc6, 0x11, 0xf5, 0xdc, 0x0a, 0xef, 0x72, 0xc5, 0x48, 0x01, 0xc0, 0xb7, 0xde, 0x20, - 0x6c, 0x22, 0x91, 0x1d, 0x4f, 0x7f, 0xb9, 0x41, 0x5e, 0xf2, 0xc5, 0x7b, 0x17, 0x52, 0x47, 0x2a, - 0x95, 0x46, 0xe5, 0x32, 0x1d, 0xd4, 0x74, 0x6d, 0x11, 0x71, 0xeb, 0x67, 0x50, 0xfa, 0x75, 0x7a, - 0xcd, 0xbe, 0x5a, 0x40, 0x84, 0x84, 0x4b, 0xaa, 0x69, 0x78, 0x39, 0xba, 0xd2, 0xb8, 0x20, 0xf4, - 0xc5, 0x7f, 0xeb, 0xc9, 0x1e, 0x94, 0x34, 0xd5, 0x61, 0x7d, 0x93, 0x34, 0xf3, 0x22, 0xed, 0x72, - 0x1b, 0x03, 0x5c, 0xf2, 0xf8, 0x35, 0x94, 0xf7, 0x65, 0xfa, 0x18, 0xe4, 0x61, 0x72, 0xe8, 0x2a, - 0x70, 0x75, 0x8b, 0xb7, 0xa9, 0x5b, 0x5e, 0xa4, 0x8c, 0x6b, 0xac, 0x6e, 0xbb, 0x3d, 0xae, 0x1e, - 0x0a, 0xd9, 0x3e, 0xc6, 0x59, 0x2c, 0xfb, 0x7d, 0x01, 0x96, 0x86, 0xcc, 0x82, 0x70, 0x2e, 0x2f, - 0xd2, 0x0e, 0x06, 0x18, 0x9a, 0x91, 0x65, 0x7b, 0x13, 0x20, 0x62, 0xb7, 0x11, 0x1a, 0xb1, 0xce, - 0xe9, 0xca, 0xf7, 0xdc, 0x71, 0xfd, 0xc7, 0xcc, 0x5a, 0x5b, 0xa0, 0x29, 0x35, 0x8b, 0x45, 0x96, - 0xa8, 0xc9, 0x08, 0x24, 0x94, 0xd5, 0xe9, 0xeb, 0xeb, 0xeb, 0xeb, 0xeb, 0x57, 0xc2, 0x25, 0xcf, - 0xde, 0x79, 0x73, 0xfa, 0x1a, 0xa1, 0x58, 0xf2, 0xcb, 0x94, 0x4a, 0xf0, 0xe2, 0x04, 0x35, 0x74, - 0x05, 0x64, 0x86, 0x4b, 0xd0, 0xb3, 0xab, 0x54, 0xf2, 0x80, 0x1f, 0xa2, 0xa6, 0x1d, 0x23, 0xc6, - 0x5b, 0x16, 0x7a, 0x8c, 0x18, 0x2f, 0x47, 0xb6, 0xc9, 0x52, 0xf5, 0x1e, 0x0b, 0xb4, 0x4a, 0xe3, - 0xcd, 0x69, 0x73, 0xe3, 0x39, 0xa7, 0x9e, 0xe5, 0xf3, 0x26, 0xec, 0xb4, 0x6a, 0x1a, 0x2e, 0xea, - 0xa9, 0x56, 0x80, 0x69, 0x99, 0xc8, 0xbd, 0x56, 0x38, 0x2b, 0xca, 0xc1, 0xc7, 0x5f, 0x40, 0xb1, - 0xab, 0x99, 0xc8, 0xed, 0x5a, 0xac, 0x45, 0x84, 0xe0, 0xbd, 0xaf, 0x12, 0x3a, 0x48, 0x54, 0x0f, - 0xd0, 0x75, 0x6d, 0xc0, 0x45, 0x1c, 0xb0, 0x6c, 0x7b, 0x6a, 0xd4, 0xd7, 0xc9, 0x05, 0xc7, 0xde, - 0xde, 0x83, 0x95, 0x0b, 0xbb, 0x64, 0xcb, 0xe7, 0xb6, 0x13, 0xdf, 0x55, 0xb9, 0xb5, 0xb5, 0xff, - 0xf6, 0x14, 0x59, 0xda, 0xe6, 0x86, 0xe3, 0x53, 0x05, 0x17, 0xa3, 0x3f, 0x49, 0x16, 0xe5, 0x28, - 0x4b, 0x04, 0xec, 0x3b, 0x7a, 0x0e, 0x07, 0x61, 0x8e, 0xb4, 0x42, 0x98, 0xf6, 0x0f, 0x68, 0x1c, - 0xc0, 0x28, 0xbf, 0xd3, 0x6b, 0x64, 0xb5, 0x2f, 0x13, 0x81, 0x6c, 0xbb, 0xb1, 0xcc, 0x45, 0x64, - 0x54, 0xee, 0xca, 0x8a, 0x21, 0x2d, 0xbb, 0xb6, 0x7d, 0x0f, 0x7d, 0x85, 0x2c, 0x8e, 0x26, 0xfa, - 0xc3, 0xa4, 0xc2, 0x2c, 0x16, 0x6c, 0x2c, 0x60, 0x6b, 0x09, 0x5a, 0x4a, 0xb2, 0x12, 0xb5, 0x9c, - 0xa9, 0x91, 0x95, 0xb0, 0xa5, 0x24, 0x03, 0xe0, 0xdd, 0xe3, 0xda, 0x17, 0xf0, 0x2c, 0xd9, 0xb6, - 0x6b, 0x04, 0xec, 0x65, 0xc9, 0xec, 0x59, 0xb9, 0x82, 0x55, 0x13, 0xdb, 0xec, 0xa1, 0xd2, 0x5b, - 0xe4, 0x92, 0x25, 0x39, 0x5e, 0xc1, 0x44, 0xf0, 0x12, 0x5e, 0xc0, 0xee, 0xa3, 0x75, 0xc8, 0xf6, - 0xb7, 0x4e, 0x13, 0xf2, 0x80, 0xcb, 0xc4, 0xed, 0xa9, 0x20, 0x33, 0xfd, 0x5c, 0x8d, 0x1c, 0x5a, - 0x29, 0x5f, 0x8c, 0x3c, 0x29, 0x8b, 0x9d, 0x62, 0xc4, 0x65, 0xe2, 0xad, 0xaf, 0x27, 0x6c, 0x54, - 0x81, 0x21, 0x68, 0x83, 0x10, 0x7a, 0x6a, 0x05, 0x39, 0xac, 0x8e, 0x02, 0x6c, 0xf7, 0x9b, 0x15, - 0x84, 0xc8, 0x9e, 0xbe, 0x4d, 0xce, 0xba, 0xa5, 0xd8, 0x02, 0x73, 0x99, 0x28, 0x7a, 0x58, 0xe4, - 0xc2, 0xef, 0xde, 0x83, 0xfd, 0xdd, 0x12, 0x2f, 0xb8, 0x21, 0xf4, 0x76, 0xf9, 0x9e, 0x03, 0x91, - 0xcd, 0x69, 0x74, 0xee, 0x2f, 0x22, 0x87, 0x67, 0xe8, 0x25, 0x44, 0x36, 0xc7, 0x87, 0xfb, 0xe7, - 0x1a, 0x08, 0x71, 0xee, 0xd9, 0xc4, 0xee, 0xc8, 0x19, 0x56, 0xb3, 0xc0, 0xda, 0xab, 0x51, 0xf5, - 0x52, 0xa2, 0x60, 0x45, 0x1a, 0xc3, 0x2c, 0xe6, 0xa1, 0xb1, 0x3c, 0xe7, 0x2f, 0x3a, 0x4e, 0xd3, - 0xc7, 0x5c, 0x65, 0xd7, 0xbe, 0xfd, 0x18, 0x37, 0xc0, 0xf1, 0x8e, 0x99, 0xd7, 0x86, 0xf6, 0x5f, - 0x9c, 0x26, 0x0b, 0xf7, 0x15, 0xc6, 0x5d, 0x77, 0x1c, 0x05, 0x59, 0x56, 0x85, 0xc9, 0x0a, 0x53, - 0xd3, 0x4d, 0x7b, 0x34, 0x5f, 0x40, 0x09, 0xdb, 0x74, 0x73, 0xdf, 0xdd, 0x57, 0x61, 0xe8, 0x34, - 0xaa, 0x7c, 0x2d, 0x30, 0xc0, 0x37, 0x3a, 0xfa, 0xe8, 0xb1, 0xd8, 0xee, 0x54, 0xd5, 0x28, 0xc2, - 0x25, 0x2b, 0xa3, 0x52, 0xf2, 0x8f, 0xc8, 0x73, 0x5a, 0x64, 0x1c, 0x8c, 0xb8, 0x9b, 0xa8, 0x81, - 0xee, 0xa2, 0x47, 0x50, 0xa3, 0x4c, 0xa5, 0x22, 0xb5, 0x58, 0x72, 0xb6, 0x7a, 0x8f, 0x61, 0x7d, - 0xef, 0x55, 0x26, 0x78, 0x34, 0x64, 0x25, 0x95, 0x0d, 0xa6, 0x20, 0x05, 0x96, 0xce, 0x3c, 0x3f, - 0x94, 0x19, 0x84, 0x2d, 0xff, 0xfd, 0xbe, 0x1a, 0xe8, 0x5d, 0x91, 0x6f, 0xf9, 0x61, 0xb0, 0xa3, - 0xfe, 0x79, 0xa6, 0x7d, 0x65, 0x6b, 0xcf, 0xb7, 0xdc, 0xd1, 0x7b, 0x6a, 0xcc, 0x54, 0xdf, 0x08, - 0x5c, 0x2c, 0x52, 0x5a, 0x3d, 0x73, 0x6b, 0x99, 0xf7, 0x83, 0xf7, 0xe5, 0x48, 0xd0, 0xa7, 0xe4, - 0x1c, 0x38, 0x17, 0x3e, 0xb0, 0x47, 0x3c, 0xb3, 0x19, 0x22, 0x9b, 0xfb, 0xf4, 0xb6, 0xc7, 0x00, - 0x7c, 0x80, 0x58, 0x0f, 0xe7, 0x8e, 0xef, 0xa1, 0xd6, 0xde, 0x85, 0xff, 0x7d, 0x05, 0x2c, 0x16, - 0x89, 0x00, 0xdf, 0xcf, 0xfb, 0x46, 0xb8, 0x52, 0x3c, 0x4c, 0xea, 0x4a, 0xb0, 0x31, 0x7b, 0xe3, - 0xfa, 0xcd, 0x1b, 0xb7, 0xd6, 0xd7, 0xd7, 0xc3, 0xb3, 0x23, 0x7e, 0xd8, 0x19, 0x88, 0xf6, 0x8f, - 0x1b, 0x64, 0xb9, 0x8a, 0x71, 0xee, 0x04, 0x7f, 0xef, 0xe4, 0x3c, 0xe0, 0x1b, 0x38, 0x8f, 0x03, - 0x6a, 0x8e, 0xe6, 0x01, 0xb5, 0x40, 0xfa, 0xdf, 0x54, 0xac, 0xdc, 0x3c, 0x9e, 0x26, 0x94, 0x90, - 0x78, 0x2a, 0x4d, 0xa8, 0x4d, 0x0d, 0x68, 0x6b, 0x39, 0x43, 0x7b, 0x48, 0x16, 0x3b, 0x85, 0x51, - 0x77, 0x0e, 0x45, 0xe4, 0xd6, 0x4d, 0xc9, 0x0c, 0xcf, 0x07, 0x07, 0xad, 0x06, 0x20, 0x88, 0x10, - 0x3f, 0xd3, 0x4d, 0x52, 0x56, 0x3d, 0xba, 0x88, 0x60, 0xb0, 0x82, 0xa3, 0x5b, 0xa7, 0xb0, 0x16, - 0xb3, 0xe4, 0xcb, 0x2a, 0x8e, 0x24, 0x5c, 0xf5, 0xc4, 0xdb, 0x15, 0x6d, 0xfb, 0x6f, 0x66, 0xc8, - 0xf9, 0x93, 0xe2, 0x18, 0xf8, 0x48, 0x7c, 0xf5, 0x3c, 0xe2, 0x29, 0x1f, 0x88, 0x1c, 0xf7, 0x79, - 0x36, 0x6c, 0x42, 0xdb, 0x03, 0xdb, 0x44, 0x5f, 0x25, 0x4b, 0x48, 0x12, 0x4b, 0x9d, 0x71, 0x13, - 0x0d, 0x9d, 0xfb, 0x99, 0x0d, 0x17, 0xa1, 0x79, 0xbb, 0x6c, 0x05, 0x42, 0x6d, 0xb8, 0xd1, 0xdd, - 0x48, 0x25, 0x09, 0xda, 0x84, 0x4b, 0x77, 0x17, 0xb1, 0x79, 0xcb, 0xb7, 0xd2, 0xd7, 0xc8, 0x8a, - 0x73, 0x45, 0xd5, 0xe6, 0xa0, 0xa6, 0xcd, 0x86, 0xcb, 0xb6, 0xa3, 0x52, 0x08, 0x2c, 0xee, 0x58, - 0xe2, 0x0a, 0x60, 0x9d, 0x41, 0x5a, 0x17, 0xb7, 0x2b, 0x58, 0x74, 0xa9, 0x42, 0x98, 0x67, 0x91, - 0xc2, 0xc3, 0xc3, 0x97, 0x5d, 0xb9, 0x33, 0x57, 0x03, 0x1b, 0xd0, 0xce, 0x61, 0xf7, 0x74, 0x23, - 0x84, 0x15, 0xcd, 0x53, 0x69, 0x26, 0xdd, 0x68, 0x28, 0xa2, 0xa7, 0x22, 0xc7, 0x18, 0x30, 0x1b, - 0x2e, 0xd8, 0xd6, 0x2d, 0xdb, 0x48, 0x5f, 0x24, 0xcd, 0x83, 0xbe, 0xf6, 0x68, 0x01, 0x33, 0x99, - 0xd9, 0x90, 0x1c, 0xf4, 0xb5, 0xdb, 0x5a, 0xd8, 0x53, 0xac, 0xee, 0xf8, 0x3d, 0x25, 0x76, 0x4f, - 0xa1, 0xcd, 0xef, 0xe9, 0x6b, 0x64, 0xe5, 0x18, 0x80, 0x44, 0xbc, 0x3d, 0xeb, 0x2f, 0xd9, 0x6a, - 0x3b, 0xf0, 0x69, 0x42, 0x6b, 0x30, 0xd3, 0xcb, 0x9d, 0x47, 0xea, 0x95, 0xaa, 0xc7, 0x8b, 0xbf, - 0x4c, 0x08, 0xcf, 0xa4, 0x0f, 0x7a, 0x0b, 0x48, 0x36, 0xc7, 0x33, 0xe9, 0x42, 0xde, 0xab, 0x64, - 0xc9, 0xc3, 0x41, 0x4f, 0xb3, 0x68, 0x4f, 0xc9, 0x37, 0x3b, 0xc2, 0xcb, 0x84, 0x0c, 0x8a, 0x92, - 0xcf, 0x92, 0xe5, 0x33, 0x28, 0x1c, 0x9f, 0xf6, 0xbf, 0x13, 0x72, 0xd6, 0x29, 0xd1, 0x6b, 0x64, - 0x89, 0x17, 0x46, 0x41, 0x62, 0xda, 0x8d, 0xd5, 0x88, 0xcb, 0x14, 0x51, 0x8f, 0x4d, 0xfd, 0x17, - 0x7d, 0xd7, 0x36, 0xf6, 0xd0, 0x77, 0xab, 0xc7, 0x35, 0xb3, 0x27, 0x3e, 0xae, 0x79, 0x1e, 0xcd, - 0xe8, 0x22, 0x3d, 0xff, 0xf8, 0xf8, 0xc3, 0x9a, 0xda, 0x43, 0x9a, 0x2f, 0x90, 0xb3, 0x16, 0x50, - 0xb9, 0xb7, 0xe5, 0x3e, 0x9b, 0xa8, 0xdf, 0xfd, 0x6e, 0x5e, 0x46, 0x5e, 0x97, 0xe8, 0x85, 0x2d, - 0x77, 0x01, 0x3b, 0xfd, 0x7a, 0xce, 0x71, 0xa0, 0xbb, 0xe4, 0x74, 0x67, 0x77, 0x07, 0xd5, 0xba, - 0xb9, 0xb1, 0xec, 0x2d, 0xca, 0xbf, 0x3b, 0xa8, 0x72, 0x92, 0xe9, 0xe7, 0x4b, 0x90, 0xf2, 0x61, - 0x51, 0xbf, 0xb3, 0x5b, 0xbb, 0x23, 0x09, 0x81, 0x15, 0x6d, 0x93, 0xd3, 0x77, 0x1f, 0xed, 0xa0, - 0xfe, 0x57, 0x1c, 0xcb, 0x5b, 0x98, 0x10, 0x3a, 0xe9, 0x8b, 0xe4, 0xd4, 0x56, 0x07, 0xf5, 0xbe, - 0x32, 0x63, 0x5f, 0x0f, 0x0b, 0x4f, 0x6d, 0x75, 0xe8, 0x75, 0x32, 0xeb, 0x0b, 0x2c, 0xa8, 0xf2, - 0xcd, 0x8d, 0x0b, 0x8e, 0x6c, 0xba, 0xee, 0x12, 0x96, 0x64, 0xf4, 0x73, 0x64, 0xf1, 0xce, 0xa1, - 0xc9, 0xb9, 0x6f, 0xd0, 0xad, 0x17, 0xd1, 0x4d, 0x7c, 0xcc, 0xc0, 0x23, 0xc4, 0xf4, 0x75, 0x32, - 0x57, 0xe2, 0x45, 0xb4, 0xa1, 0xe6, 0xc6, 0xc5, 0xf2, 0x65, 0xd7, 0x14, 0x8e, 0x0c, 0x2b, 0x42, - 0x3a, 0xae, 0xfd, 0x36, 0x03, 0xed, 0xa1, 0x5a, 0x72, 0xd9, 0x5e, 0xfd, 0x2e, 0x65, 0x0b, 0x85, - 0x99, 0x12, 0xad, 0x94, 0x4f, 0x1b, 0xf1, 0x95, 0x1e, 0xe4, 0x1e, 0xc8, 0xb5, 0x7c, 0xfa, 0x58, - 0x3e, 0xda, 0x73, 0x41, 0xb0, 0xf6, 0x3b, 0x90, 0x57, 0xc8, 0x0c, 0xa0, 0x30, 0xb4, 0x9c, 0xe6, - 0xc6, 0x8a, 0x93, 0x59, 0x01, 0xb3, 0x10, 0xbb, 0x69, 0x40, 0xce, 0x39, 0x80, 0x80, 0x58, 0xb9, - 0xaa, 0x45, 0x4f, 0xc1, 0x86, 0xd0, 0x13, 0xd1, 0xdb, 0xa8, 0xa2, 0x3d, 0xa5, 0x05, 0xa6, 0x02, - 0xb3, 0x55, 0x18, 0xbd, 0x93, 0xf2, 0x5e, 0x82, 0x4f, 0xbe, 0xa0, 0x17, 0xe2, 0x34, 0x0c, 0x60, - 0x16, 0x09, 0x58, 0xe5, 0x84, 0x0e, 0xfa, 0x15, 0xb2, 0x5a, 0x5a, 0x84, 0xfd, 0x8f, 0x47, 0x43, - 0x0b, 0xed, 0x6b, 0xf5, 0x9e, 0x5d, 0x6e, 0x86, 0xd5, 0x4b, 0x62, 0x3f, 0xa0, 0x5e, 0xa3, 0xd4, - 0x41, 0xb8, 0xe2, 0xdb, 0xb7, 0xe0, 0x1f, 0xb0, 0xa1, 0x29, 0x21, 0x95, 0x7b, 0xc0, 0x97, 0x41, - 0xd5, 0x63, 0x9d, 0xa3, 0xa1, 0x74, 0xf3, 0x26, 0x4a, 0xbb, 0x46, 0x3f, 0xed, 0xd0, 0xa8, 0x0b, - 0x4b, 0x59, 0xae, 0x46, 0xc2, 0x0c, 0x45, 0xa1, 0x4f, 0x0c, 0x9e, 0x61, 0x4d, 0x02, 0xfd, 0x7f, - 0xd6, 0xa3, 0x58, 0xe3, 0x71, 0x8f, 0x83, 0xbc, 0x5a, 0x1c, 0x79, 0x6d, 0x51, 0xbd, 0x62, 0xb3, - 0x2f, 0xa7, 0x20, 0x7b, 0x11, 0x71, 0x79, 0xe1, 0xef, 0x9e, 0x2d, 0xb8, 0x0e, 0xf7, 0xd6, 0x2c, - 0xf5, 0x17, 0x64, 0x98, 0xf1, 0x38, 0x9a, 0x00, 0x7d, 0x96, 0x73, 0x30, 0xbf, 0xd6, 0x20, 0xb3, - 0xb0, 0x0d, 0xe2, 0x50, 0x44, 0xf8, 0x90, 0xab, 0x52, 0xe8, 0xe9, 0x00, 0xba, 0xf9, 0x15, 0x14, - 0xff, 0x98, 0xee, 0xd7, 0x5f, 0xb2, 0x65, 0x22, 0x92, 0x7d, 0x29, 0x62, 0x94, 0xcb, 0x8b, 0x34, - 0x1a, 0xd6, 0x7f, 0x2e, 0x50, 0xd6, 0x86, 0x07, 0xf2, 0x40, 0xa4, 0xe5, 0xef, 0x0a, 0x12, 0x99, - 0xda, 0x33, 0x01, 0xcf, 0x13, 0x01, 0x78, 0x08, 0xc2, 0x72, 0x12, 0x74, 0xb7, 0x44, 0xd3, 0x78, - 0xbb, 0xff, 0xc2, 0xf4, 0x83, 0x8a, 0xfd, 0x49, 0x26, 0x6a, 0x6f, 0xa3, 0xd7, 0xf0, 0x1d, 0xec, - 0x55, 0xff, 0xd0, 0xf1, 0xaa, 0x7b, 0x7e, 0x7b, 0xc5, 0xa3, 0x6b, 0x20, 0x87, 0x90, 0xa0, 0x7a, - 0xfd, 0x42, 0x5b, 0x4c, 0xda, 0xb5, 0x6f, 0x91, 0x99, 0x7d, 0x98, 0x50, 0xeb, 0x78, 0x08, 0xed, - 0x9b, 0xaf, 0xbf, 0xbf, 0x31, 0x1e, 0x8f, 0x03, 0xfb, 0x24, 0x24, 0x16, 0x87, 0x41, 0xa4, 0x46, - 0xd7, 0x06, 0x2a, 0xe1, 0xe9, 0xe0, 0x5a, 0xfd, 0x9d, 0xc8, 0x35, 0xbb, 0x99, 0xf6, 0x67, 0x6c, - 0xbd, 0xb3, 0xf8, 0xe7, 0xc6, 0x7f, 0x05, 0x00, 0x00, 0xff, 0xff, 0x46, 0x66, 0xa9, 0x48, 0x24, - 0x37, 0x00, 0x00, + 0x4e, 0x62, 0xe4, 0x1d, 0xef, 0x92, 0x45, 0x80, 0x64, 0xe5, 0x2c, 0x02, 0x24, 0x4b, 0x2f, 0x02, + 0x04, 0xc8, 0x1f, 0x90, 0x2c, 0x12, 0x24, 0x9b, 0x6c, 0x12, 0x18, 0x41, 0x80, 0x04, 0xe7, 0x54, + 0xd5, 0xbd, 0xb7, 0x49, 0x8e, 0x0d, 0x03, 0x76, 0x90, 0x45, 0x16, 0x12, 0xbb, 0xab, 0x4e, 0x9d, + 0x53, 0x8f, 0xf3, 0xf8, 0x9d, 0x53, 0xd5, 0x64, 0x3e, 0x52, 0x69, 0x5f, 0x0e, 0x82, 0x2c, 0x57, + 0x46, 0xd1, 0x33, 0xf8, 0xe7, 0xd9, 0xf3, 0xf8, 0xe7, 0x9a, 0x16, 0x23, 0x9e, 0x1a, 0x19, 0xd9, + 0xce, 0x67, 0x2f, 0xf1, 0xc8, 0x48, 0x95, 0xea, 0x6b, 0xb6, 0xf7, 0xe0, 0xc3, 0xc4, 0x75, 0xbc, + 0xc0, 0x73, 0x23, 0xfb, 0x3c, 0x32, 0xbe, 0xcb, 0x7f, 0xb7, 0xfd, 0xed, 0x7f, 0x39, 0x45, 0xce, + 0x3d, 0x16, 0xb9, 0x96, 0x2a, 0xa5, 0x01, 0x99, 0x49, 0xf9, 0x48, 0xb4, 0x1a, 0xac, 0xb1, 0x36, + 0xb7, 0xf9, 0xec, 0xdf, 0xfd, 0xc7, 0xdf, 0xff, 0x55, 0xe3, 0x3c, 0xa5, 0xfb, 0x43, 0xc1, 0xa2, + 0x44, 0x8a, 0xd4, 0xbc, 0xaa, 0x19, 0x10, 0x04, 0x21, 0xd2, 0xd1, 0x87, 0xa4, 0x19, 0x0b, 0x1d, + 0xe5, 0x32, 0x03, 0xd9, 0xad, 0x53, 0x38, 0xec, 0x2a, 0x0e, 0xfb, 0x24, 0x7d, 0x79, 0x6a, 0x58, + 0xa2, 0xd2, 0x01, 0xab, 0x11, 0x33, 0x6d, 0x72, 0x99, 0x0e, 0xc2, 0x3a, 0x03, 0xca, 0xc9, 0xb9, + 0x03, 0x3b, 0x95, 0xd6, 0x69, 0xe4, 0x75, 0x17, 0x79, 0x75, 0xe8, 0x3b, 0x53, 0xbc, 0x1c, 0x8d, + 0x63, 0xc1, 0x0a, 0x0d, 0xff, 0x73, 0xe6, 0x77, 0xc4, 0xf7, 0x43, 0xab, 0x8e, 0x86, 0x02, 0xe6, + 0xeb, 0xf9, 0xd2, 0x77, 0xc8, 0xd9, 0x48, 0x8d, 0x46, 0xd2, 0xb4, 0x66, 0x50, 0xc2, 0xab, 0x28, + 0xe1, 0x13, 0xf4, 0xc5, 0x29, 0x09, 0x03, 0x69, 0x98, 0x25, 0x73, 0x42, 0x82, 0xd0, 0x0d, 0xa3, + 0x1d, 0x42, 0x7a, 0x85, 0x4c, 0xe2, 0xae, 0x91, 0x23, 0xd1, 0x3a, 0x83, 0x4c, 0xda, 0xc8, 0xe4, + 0x79, 0xfa, 0xec, 0x93, 0xa1, 0x48, 0x99, 0x29, 0x39, 0xb1, 0x31, 0xd7, 0x0c, 0xa8, 0x4d, 0x10, + 0xce, 0xe1, 0xa8, 0x7d, 0x39, 0x12, 0xed, 0x7f, 0x38, 0x4d, 0xe6, 0x9e, 0xe4, 0xd2, 0x88, 0x1e, + 0x8f, 0x9e, 0xd2, 0x90, 0x34, 0xb3, 0x5c, 0x1e, 0x70, 0x23, 0xba, 0x4f, 0xc5, 0xa4, 0x75, 0x0e, + 0x39, 0x5e, 0x47, 0x8e, 0xaf, 0xd1, 0x2b, 0x53, 0xd3, 0x72, 0x74, 0xec, 0xa9, 0x98, 0x30, 0x99, + 0xb2, 0xdd, 0x3b, 0x0f, 0x98, 0x48, 0x23, 0x15, 0xe3, 0x04, 0x89, 0xeb, 0xfd, 0xa2, 0x98, 0xd0, + 0x0f, 0xc8, 0xea, 0xb0, 0x48, 0x4d, 0x37, 0xe1, 0xda, 0xe0, 0x44, 0xb5, 0xe1, 0xa3, 0xac, 0xb5, + 0xc0, 0x1a, 0x6b, 0x33, 0x9b, 0xeb, 0xc8, 0xfb, 0x53, 0x74, 0x0d, 0x78, 0x03, 0x05, 0x03, 0x5a, + 0x56, 0x92, 0x31, 0x33, 0x94, 0xda, 0xaf, 0x20, 0xe7, 0x69, 0x10, 0xae, 0x00, 0xc1, 0x7d, 0xae, + 0xcd, 0xbe, 0xa7, 0xa1, 0xff, 0xd8, 0x20, 0xcf, 0x20, 0x77, 0x2d, 0xf2, 0x03, 0x91, 0xc3, 0x1f, + 0xc9, 0x93, 0x6e, 0x5a, 0x8c, 0x7a, 0x22, 0x6f, 0x2d, 0xa2, 0xa0, 0x3f, 0x6a, 0xa0, 0xa4, 0xef, + 0x37, 0xe8, 0xef, 0x37, 0x4a, 0x59, 0x91, 0x00, 0xfd, 0x93, 0x11, 0xac, 0xc3, 0x0e, 0x62, 0x76, + 0x10, 0x1b, 0x0b, 0xa6, 0xf9, 0x98, 0xf5, 0x73, 0x35, 0xc2, 0x3d, 0xb4, 0x9c, 0x03, 0xb6, 0x85, + 0x33, 0xd1, 0x2c, 0x17, 0xfd, 0x42, 0x0b, 0x66, 0x14, 0x8b, 0x54, 0x9a, 0x8a, 0xc8, 0xc0, 0x47, + 0x4b, 0xa4, 0xd9, 0x58, 0x9a, 0x21, 0x53, 0x49, 0x2c, 0xf2, 0x69, 0xae, 0x9a, 0x71, 0xcd, 0x32, + 0x9e, 0x1b, 0xa6, 0xfa, 0x8e, 0x18, 0xb7, 0x2f, 0x57, 0x86, 0xa3, 0x1e, 0xa2, 0x15, 0x44, 0x2a, + 0x09, 0xc2, 0x8b, 0x30, 0xbf, 0x3d, 0x24, 0xd9, 0x43, 0x16, 0x0f, 0x91, 0x03, 0x7d, 0x93, 0x2c, + 0x88, 0x03, 0x91, 0x9a, 0xee, 0x87, 0x85, 0xc8, 0xa5, 0xd0, 0x68, 0x1e, 0xcd, 0x8d, 0xf3, 0xd6, + 0x80, 0x82, 0xc7, 0xef, 0xdd, 0xbf, 0x03, 0xdd, 0xfb, 0xbc, 0x97, 0x88, 0x70, 0x1e, 0x49, 0xdf, + 0xb3, 0x94, 0xed, 0x7f, 0x3a, 0x45, 0x2e, 0x3e, 0x91, 0x69, 0xac, 0xc6, 0x7a, 0x27, 0xd5, 0x86, + 0x27, 0x89, 0xc8, 0xb7, 0xd0, 0xa6, 0xe9, 0x03, 0x32, 0x0f, 0xd3, 0x91, 0x91, 0xe8, 0xd6, 0x6c, + 0xee, 0x53, 0xb8, 0x63, 0x2f, 0xd3, 0x36, 0xec, 0x17, 0xb4, 0xc3, 0xb4, 0xfd, 0x66, 0xc8, 0xc8, + 0xae, 0x3e, 0x17, 0xdc, 0x88, 0x20, 0x6c, 0xba, 0xb6, 0x87, 0x60, 0x8a, 0xbf, 0xd7, 0x20, 0xf3, + 0xd2, 0x8a, 0xe8, 0x66, 0xdc, 0x0c, 0x9d, 0x31, 0x7e, 0x13, 0xf9, 0x1d, 0xd2, 0x83, 0x27, 0x43, + 0x91, 0x0b, 0xa6, 0x87, 0xaa, 0x48, 0x62, 0x64, 0xd8, 0x93, 0x29, 0xcf, 0x27, 0xac, 0x27, 0x98, + 0x1b, 0x26, 0xe2, 0x77, 0x18, 0x48, 0x75, 0x5f, 0x51, 0xff, 0x79, 0x1a, 0xb3, 0x48, 0x65, 0x52, + 0xe8, 0xfa, 0x18, 0xa3, 0xac, 0x8a, 0x24, 0x2a, 0xb2, 0x7b, 0x08, 0x64, 0x6e, 0x98, 0xae, 0xcf, + 0x36, 0x08, 0x9b, 0xae, 0x79, 0x97, 0x9b, 0x21, 0xfd, 0x2a, 0x59, 0xf5, 0x4b, 0xae, 0xbb, 0x8d, + 0xd3, 0xd3, 0x6e, 0x63, 0xbb, 0xe6, 0x24, 0xfa, 0x2a, 0x47, 0x7e, 0x63, 0xbb, 0x87, 0x15, 0x5f, + 0xea, 0x3e, 0xd5, 0x88, 0xdb, 0xdf, 0x3e, 0x45, 0x2e, 0x6c, 0xf3, 0x7c, 0x2c, 0xd3, 0xff, 0xdd, + 0xeb, 0xf6, 0xbf, 0xcd, 0x90, 0xe5, 0x50, 0xa6, 0x83, 0xcd, 0xa2, 0xdf, 0x2f, 0xf7, 0xe1, 0x05, + 0x32, 0xdb, 0x97, 0x89, 0xc0, 0x3d, 0xb0, 0xbb, 0x7e, 0xaa, 0xd5, 0x08, 0xcb, 0x36, 0xfa, 0x35, + 0xd2, 0x1c, 0x89, 0x91, 0xca, 0x27, 0x5d, 0x2d, 0x3f, 0xb2, 0xdb, 0x34, 0xb3, 0xf9, 0x39, 0x5c, + 0xd6, 0x67, 0xe8, 0xcd, 0x7b, 0x6a, 0xcc, 0x46, 0x3c, 0x9d, 0xb0, 0xde, 0xc4, 0xc0, 0x24, 0x15, + 0xd3, 0x46, 0xe5, 0xb0, 0x08, 0x9c, 0x07, 0xfa, 0xe2, 0x1e, 0x8a, 0x83, 0x26, 0xcb, 0x28, 0x08, + 0x89, 0xfd, 0xb0, 0x27, 0x3f, 0x12, 0x34, 0x25, 0x73, 0xb1, 0xd4, 0x4f, 0x2d, 0xf7, 0x53, 0xc8, + 0xfd, 0x3d, 0xe4, 0xfe, 0x45, 0xba, 0xf3, 0x53, 0x70, 0x57, 0x29, 0x03, 0x36, 0x6c, 0x6d, 0x9d, + 0x8d, 0x04, 0x4f, 0x59, 0xaa, 0xec, 0x77, 0x58, 0xc7, 0x95, 0x20, 0x9c, 0x85, 0x2f, 0x28, 0xef, + 0x90, 0x2c, 0xfa, 0xb5, 0x75, 0x13, 0x99, 0x16, 0x87, 0xce, 0xe9, 0x97, 0x42, 0x1f, 0xba, 0x53, + 0x07, 0xaa, 0x4a, 0xe4, 0x09, 0xab, 0x59, 0x93, 0x7d, 0x26, 0x46, 0x99, 0x99, 0x80, 0x97, 0x8a, + 0x15, 0x4b, 0x95, 0x61, 0xe0, 0x8c, 0xb8, 0x17, 0xba, 0xe0, 0x05, 0xdd, 0x07, 0x39, 0xf4, 0x1b, + 0x64, 0xb9, 0x94, 0xec, 0x94, 0xd7, 0xc5, 0x8a, 0x9f, 0x83, 0xec, 0x25, 0x2f, 0xca, 0xb9, 0x1a, + 0xfa, 0x11, 0x29, 0x9b, 0xba, 0x31, 0x5a, 0x44, 0xeb, 0xec, 0xcf, 0x4b, 0x78, 0xb9, 0xc3, 0xd6, + 0xf4, 0xda, 0xdf, 0xa5, 0x64, 0xde, 0x7a, 0x6c, 0xa7, 0x74, 0xbf, 0xd0, 0x20, 0x67, 0x13, 0xde, + 0x13, 0x89, 0x6e, 0x9d, 0x65, 0xa7, 0xd7, 0xe6, 0x36, 0x25, 0x4e, 0x22, 0xa2, 0xbc, 0xc3, 0x12, + 0xa9, 0xd1, 0x31, 0xdb, 0xfe, 0x7a, 0xe4, 0x1c, 0x72, 0x1d, 0xb0, 0x7d, 0xd0, 0x7c, 0x9e, 0x24, + 0xd6, 0xf4, 0x13, 0x11, 0x19, 0x11, 0xb3, 0x41, 0xae, 0x8a, 0x4c, 0xc3, 0xa8, 0xc8, 0x05, 0x06, + 0xa3, 0xc0, 0xb4, 0x0c, 0xcf, 0x07, 0xc2, 0x00, 0x85, 0x4c, 0x31, 0xa2, 0xe9, 0x20, 0x74, 0x82, + 0x29, 0x27, 0x4d, 0x17, 0xa7, 0x8a, 0x3c, 0xd1, 0xad, 0x59, 0x9c, 0xc7, 0x6d, 0x9c, 0xc7, 0x5b, + 0xf4, 0x8d, 0x6a, 0x1e, 0x2e, 0x40, 0x3c, 0x0a, 0xef, 0x4f, 0x4d, 0x66, 0x2c, 0x93, 0x84, 0x19, + 0x6b, 0x8d, 0x55, 0xec, 0x09, 0x42, 0x62, 0xe9, 0x1f, 0xe5, 0x89, 0xa6, 0xdf, 0x6a, 0x90, 0xc5, + 0x88, 0x77, 0x6b, 0xe1, 0xad, 0xd5, 0xc4, 0x3d, 0xef, 0xa1, 0x98, 0xaf, 0xd0, 0xf7, 0xc1, 0xe0, + 0xb7, 0x3a, 0xaf, 0xea, 0xa9, 0x10, 0x88, 0xf1, 0xdb, 0xce, 0x79, 0xf7, 0xce, 0x83, 0x80, 0xed, + 0x1f, 0x93, 0x5a, 0x68, 0xc3, 0xc0, 0x2e, 0xdc, 0xdc, 0xb4, 0x1c, 0xa4, 0x22, 0xb6, 0xf1, 0x0e, + 0x3d, 0xc3, 0x56, 0x27, 0x08, 0x17, 0x22, 0xbe, 0x55, 0x31, 0xa5, 0x3f, 0x68, 0x90, 0x33, 0xa9, + 0x4a, 0x23, 0xd1, 0x9a, 0xc7, 0x29, 0xfc, 0xa1, 0x0d, 0xc4, 0xbf, 0xd5, 0xa0, 0xbf, 0xd9, 0xe8, + 0x30, 0x3d, 0xe4, 0xb9, 0x88, 0x19, 0x12, 0x1c, 0x5b, 0x65, 0x96, 0x0b, 0x2d, 0x52, 0x63, 0x27, + 0xe2, 0x44, 0x62, 0x47, 0x2e, 0xbe, 0x0e, 0xcb, 0xf6, 0x7b, 0x3e, 0x1e, 0xca, 0x68, 0xe8, 0x15, + 0xc2, 0x0d, 0xb2, 0xf3, 0x81, 0xe8, 0xaa, 0x15, 0x93, 0x86, 0x8d, 0x60, 0xea, 0x3d, 0xc1, 0xc4, + 0xa8, 0x27, 0x62, 0xb7, 0x48, 0x53, 0xc7, 0x33, 0x16, 0xde, 0x16, 0x39, 0x7a, 0xb6, 0x20, 0xb4, + 0x73, 0xa6, 0x7d, 0xb2, 0x3c, 0xf6, 0xe8, 0xc8, 0xab, 0xef, 0x79, 0x5c, 0xc7, 0xdb, 0xb8, 0x8c, + 0x9b, 0xf4, 0x46, 0x87, 0x81, 0xdf, 0x65, 0x63, 0x74, 0xb4, 0x96, 0xa4, 0x9a, 0x19, 0xcc, 0x16, + 0x19, 0xa0, 0xd3, 0x4c, 0x98, 0x36, 0xe8, 0xc2, 0x97, 0x4a, 0xa6, 0x56, 0x53, 0x69, 0x44, 0xaa, + 0x26, 0xe7, 0x1e, 0xe6, 0x50, 0xcc, 0x5b, 0x28, 0xe6, 0x75, 0xba, 0x31, 0x25, 0x06, 0x29, 0x7e, + 0xa2, 0x94, 0xc5, 0x92, 0xa5, 0x75, 0x04, 0x92, 0xac, 0x54, 0x42, 0xbc, 0x27, 0x20, 0x28, 0xe6, + 0xb3, 0x28, 0xe6, 0x16, 0x7d, 0x7d, 0x4a, 0x8c, 0x0f, 0x75, 0x3f, 0x49, 0x50, 0xb5, 0x47, 0xde, + 0xea, 0xff, 0x0f, 0x99, 0x1d, 0xf1, 0xc3, 0x6e, 0xa6, 0x92, 0xa4, 0xb5, 0x84, 0xce, 0xd5, 0x6b, + 0xf8, 0x0d, 0x38, 0xcc, 0x11, 0x3f, 0x94, 0xa3, 0x62, 0xe4, 0xd1, 0x16, 0x6a, 0x7b, 0xa4, 0xd2, + 0x58, 0xb3, 0x9e, 0x30, 0x63, 0x21, 0x52, 0x7f, 0xdc, 0xc0, 0x40, 0x07, 0x1b, 0xa7, 0x6f, 0xad, + 0xaf, 0x87, 0xe7, 0x46, 0xfc, 0x70, 0x57, 0x25, 0x09, 0xdd, 0x23, 0xf3, 0x9e, 0x79, 0x57, 0x9b, + 0xb8, 0xf5, 0x1c, 0x0a, 0xf0, 0x30, 0xf5, 0x15, 0xd4, 0x16, 0xc3, 0xd3, 0x98, 0xe7, 0x31, 0x8b, + 0xc5, 0x81, 0xb4, 0xc1, 0xca, 0x73, 0x76, 0x2c, 0x4f, 0xdd, 0x58, 0x0f, 0x89, 0xe3, 0xb8, 0x67, + 0x62, 0xfa, 0x7f, 0xc9, 0x8a, 0x5b, 0x6e, 0xd7, 0x07, 0xc6, 0xbc, 0xb5, 0x8c, 0xe8, 0xea, 0xb2, + 0x43, 0x57, 0x27, 0xa3, 0xa7, 0xcd, 0x6b, 0x28, 0xf8, 0x0a, 0x7d, 0x75, 0xab, 0xae, 0x42, 0x3e, + 0x80, 0xfb, 0x3d, 0x2c, 0x99, 0xc2, 0x76, 0x1d, 0x61, 0x44, 0x0f, 0xc9, 0xb2, 0xd5, 0x9c, 0x9a, + 0xec, 0x0b, 0x28, 0xfb, 0x79, 0x27, 0xfb, 0x44, 0x30, 0xf1, 0xd3, 0x8b, 0x5e, 0x8a, 0xa7, 0xf9, + 0xd0, 0xa7, 0x64, 0x31, 0xcb, 0x2d, 0xa4, 0x14, 0x87, 0x22, 0x3a, 0x10, 0xad, 0x15, 0xd6, 0x58, + 0x9b, 0xdd, 0xdc, 0x46, 0xce, 0x9f, 0xa7, 0x9f, 0xdd, 0xe9, 0x5b, 0x53, 0x92, 0xe0, 0xf6, 0xcc, + 0x55, 0xe6, 0xa8, 0x19, 0xcf, 0x7b, 0xd2, 0xe4, 0x00, 0x0b, 0xc0, 0x69, 0x30, 0x18, 0x5c, 0x58, + 0xe1, 0xa5, 0xfa, 0x07, 0xe1, 0x82, 0xa3, 0xbe, 0x83, 0xac, 0xe9, 0xfb, 0x55, 0x4e, 0x45, 0x71, + 0x75, 0x8b, 0x1e, 0xb7, 0xda, 0xd6, 0xe9, 0x74, 0xc0, 0xa7, 0x56, 0x32, 0xed, 0xab, 0x7c, 0xc4, + 0x6b, 0x20, 0xac, 0x4c, 0x09, 0x6a, 0xc9, 0x54, 0x4e, 0x96, 0x63, 0xd1, 0xe7, 0x45, 0x62, 0xba, + 0xa0, 0x1c, 0x63, 0x2e, 0x4d, 0x6b, 0x15, 0x15, 0xe3, 0x1e, 0x32, 0xdd, 0xa4, 0xb7, 0x81, 0xa9, + 0xa3, 0x01, 0x0d, 0xc4, 0x2c, 0x03, 0xdc, 0x28, 0xd0, 0xb2, 0x9e, 0xe8, 0x43, 0xd8, 0x01, 0xe0, + 0x2f, 0xd2, 0x18, 0x61, 0x3a, 0x20, 0xf7, 0xc7, 0xef, 0xdd, 0x67, 0xb9, 0xd0, 0x45, 0x02, 0xcb, + 0x59, 0x74, 0xa3, 0x1f, 0xf0, 0xc3, 0x27, 0x5c, 0x1a, 0xfa, 0xcf, 0x0d, 0xb2, 0x5a, 0x68, 0xd1, + 0xd5, 0x22, 0xe9, 0x77, 0xad, 0x33, 0xec, 0x6a, 0x9d, 0xb4, 0x5a, 0xb8, 0x85, 0x3f, 0xb0, 0x9e, + 0xee, 0x4f, 0x1b, 0xf4, 0x4f, 0x1a, 0x47, 0x77, 0xf1, 0xa8, 0xab, 0x13, 0x87, 0x19, 0x78, 0x34, + 0x48, 0x1c, 0x93, 0xbe, 0xf7, 0xab, 0x75, 0xdf, 0x7c, 0x34, 0x13, 0x79, 0xf8, 0xa5, 0xfd, 0x3b, + 0x6f, 0x39, 0xc7, 0x78, 0xf2, 0x08, 0xef, 0xf1, 0x5c, 0x57, 0x6f, 0x82, 0xc3, 0x1f, 0x8b, 0x44, + 0x45, 0x32, 0xe7, 0x99, 0x51, 0x39, 0xdb, 0xea, 0x38, 0xdf, 0x29, 0x75, 0xe5, 0x18, 0x79, 0x4f, + 0x1d, 0x80, 0x4d, 0x17, 0x5a, 0xec, 0x89, 0xa4, 0xbf, 0x87, 0xc3, 0xf7, 0x74, 0x42, 0xff, 0xa2, + 0x41, 0x68, 0x26, 0x53, 0x5c, 0xa4, 0x0d, 0x60, 0x08, 0xde, 0x9e, 0x47, 0x07, 0xf2, 0x1d, 0xbb, + 0xd8, 0x6f, 0x37, 0xe8, 0x2f, 0x35, 0x1e, 0xd6, 0xf0, 0x6b, 0x3f, 0x57, 0xa9, 0x11, 0x69, 0x3c, + 0x1d, 0x6a, 0x02, 0xb6, 0xd3, 0x87, 0xad, 0xe6, 0xb9, 0x70, 0x29, 0x73, 0x7d, 0x15, 0x7b, 0x7b, + 0xf7, 0x8f, 0x6d, 0x50, 0x4f, 0x30, 0x2b, 0xbb, 0x44, 0xa1, 0x88, 0x92, 0xd7, 0xfc, 0x79, 0xd6, + 0xd7, 0x65, 0xf3, 0xa6, 0x2b, 0xe1, 0xb2, 0x1d, 0x61, 0xbf, 0x22, 0x5a, 0x4e, 0xc9, 0x12, 0x28, + 0x47, 0x91, 0x25, 0x8a, 0xc7, 0x16, 0xfa, 0x3d, 0x83, 0x3a, 0xf2, 0x2e, 0xce, 0xfe, 0x36, 0xfd, + 0xfc, 0x03, 0xe7, 0x99, 0xa0, 0x0f, 0x62, 0xc4, 0x26, 0x22, 0xc0, 0xb1, 0xb0, 0xb3, 0xb0, 0x10, + 0x9c, 0xd9, 0xf1, 0x1a, 0xb5, 0xb1, 0x9c, 0xc1, 0xcd, 0x51, 0xef, 0x4a, 0xb8, 0x30, 0xe2, 0x87, + 0x8f, 0xb0, 0x17, 0x41, 0x5f, 0x4c, 0xe6, 0xd1, 0x51, 0x76, 0x2d, 0x88, 0x69, 0x3d, 0x8b, 0x5a, + 0x7f, 0xc9, 0x69, 0xfd, 0x51, 0x4c, 0xbc, 0xb9, 0x86, 0xb3, 0x68, 0x53, 0xe6, 0xcd, 0xd9, 0xc6, + 0x44, 0xeb, 0x6b, 0x6b, 0x60, 0x28, 0x08, 0x9b, 0xd8, 0x66, 0x07, 0xd3, 0xeb, 0xe4, 0x02, 0xac, + 0xca, 0xc1, 0xe5, 0x21, 0xcf, 0xe3, 0x6e, 0x22, 0x47, 0xd2, 0xb4, 0x2e, 0xc3, 0xda, 0x42, 0x3a, + 0xe2, 0x87, 0x0f, 0xb0, 0xef, 0x1e, 0xcf, 0xe3, 0xfb, 0xd0, 0xd3, 0xfe, 0xe3, 0x19, 0x32, 0xd7, + 0xd9, 0xdd, 0x71, 0xb0, 0xe8, 0x59, 0x32, 0x3b, 0x54, 0xda, 0xe0, 0x71, 0x22, 0x32, 0x0c, 0xcb, + 0xef, 0xf4, 0x37, 0x1a, 0x64, 0xbe, 0x27, 0xd3, 0xb8, 0xcb, 0xe3, 0x38, 0x17, 0x5a, 0xbb, 0x84, + 0xe5, 0x00, 0xa7, 0x9a, 0xd1, 0xb4, 0x63, 0x9b, 0x11, 0xf8, 0xc8, 0x34, 0x66, 0x83, 0x70, 0x77, + 0x8b, 0x89, 0x34, 0xce, 0x94, 0xb4, 0xa1, 0x1b, 0x54, 0xde, 0xa6, 0x1f, 0x85, 0x2e, 0x78, 0x92, + 0x4c, 0x98, 0x4a, 0x13, 0x4c, 0x40, 0xae, 0x6f, 0x7c, 0x26, 0x58, 0x0f, 0xd6, 0x83, 0xeb, 0x57, + 0x99, 0x32, 0x43, 0x91, 0x8f, 0xa5, 0x16, 0xa8, 0xb1, 0xb8, 0x70, 0x05, 0xe9, 0x70, 0x26, 0xf2, + 0x04, 0xe0, 0x46, 0x04, 0x4d, 0xd2, 0x04, 0x61, 0x13, 0x84, 0x38, 0x99, 0xf4, 0x26, 0x99, 0xc3, + 0xa9, 0x65, 0x2a, 0x37, 0x88, 0xe1, 0x17, 0x36, 0x5b, 0x38, 0x2f, 0x4a, 0x97, 0x77, 0x55, 0x6e, + 0xca, 0x49, 0xc1, 0x66, 0xcf, 0xc2, 0x27, 0x68, 0xa5, 0x3d, 0x82, 0x5c, 0xba, 0xb6, 0x20, 0xe3, + 0xb2, 0x8f, 0x0e, 0x0e, 0x7c, 0x1b, 0xe2, 0xb9, 0x6d, 0x2f, 0x13, 0x3e, 0x00, 0x64, 0xc2, 0x56, + 0x70, 0x54, 0xf4, 0x54, 0x18, 0xb6, 0x26, 0x82, 0x41, 0xc0, 0x4c, 0x94, 0x5d, 0x65, 0x45, 0x2a, + 0x0f, 0xaf, 0x04, 0x1b, 0x33, 0xf0, 0x37, 0x24, 0xc0, 0x75, 0x0f, 0x07, 0xd3, 0x1f, 0x36, 0xc8, + 0xa2, 0x33, 0x96, 0xc1, 0xd8, 0x1a, 0x8a, 0xc5, 0xfb, 0xdf, 0xb7, 0x86, 0xf2, 0xdb, 0x0d, 0xfa, + 0xbd, 0xc6, 0x5d, 0x6e, 0xc4, 0x98, 0x4f, 0xa6, 0xcc, 0xd6, 0xea, 0x19, 0xcf, 0x01, 0xe1, 0xa1, + 0xa3, 0x53, 0xa3, 0x91, 0x4a, 0x6d, 0xa9, 0x8b, 0x3d, 0x54, 0x06, 0x54, 0x82, 0x9b, 0x9a, 0x09, + 0xc0, 0xfe, 0x66, 0x22, 0x02, 0x67, 0xd5, 0x13, 0x11, 0x07, 0x40, 0x2c, 0x8d, 0x47, 0xaa, 0xbc, + 0x30, 0x43, 0xd6, 0x9b, 0x64, 0x5c, 0x5b, 0x6d, 0x95, 0xa9, 0x11, 0x79, 0xca, 0x13, 0x36, 0xf0, + 0xa2, 0x21, 0x77, 0x0b, 0xd8, 0xb6, 0x53, 0xe2, 0xb5, 0xbb, 0xe1, 0xee, 0x56, 0xf7, 0xee, 0x93, + 0x2b, 0xe1, 0xbc, 0x9d, 0xfd, 0xdd, 0x31, 0x18, 0x4e, 0xfb, 0x87, 0x33, 0x64, 0xa9, 0x93, 0xc9, + 0x29, 0x30, 0xcd, 0x8f, 0x81, 0xcc, 0xc6, 0x34, 0x64, 0xb1, 0x20, 0x73, 0x6a, 0x75, 0x85, 0xb6, + 0x16, 0x7c, 0x20, 0x72, 0xd9, 0x9f, 0xb0, 0xce, 0xee, 0x8e, 0x07, 0xb1, 0x52, 0xa5, 0xfa, 0x18, + 0x78, 0xfc, 0x6e, 0x83, 0x34, 0xad, 0x17, 0x40, 0x39, 0x2e, 0xb9, 0xad, 0x74, 0xcf, 0xbb, 0x88, + 0xba, 0x08, 0xdc, 0x9e, 0x9e, 0x48, 0x54, 0x3a, 0xd0, 0xa5, 0xb3, 0x70, 0xe1, 0x82, 0xdd, 0x15, + 0xa9, 0xc8, 0x39, 0x00, 0xf3, 0xd2, 0xa1, 0xbe, 0x7a, 0x50, 0x77, 0x89, 0x16, 0x06, 0x32, 0x9e, + 0xc9, 0xae, 0x83, 0x86, 0x3e, 0x21, 0x0e, 0x42, 0x62, 0x5b, 0x60, 0x82, 0xf4, 0xab, 0x84, 0xba, + 0x89, 0xd5, 0x0b, 0x66, 0x56, 0x95, 0xca, 0xa8, 0xbc, 0x5b, 0xab, 0x91, 0x19, 0xc5, 0x06, 0xca, + 0x43, 0x65, 0xef, 0xdb, 0x70, 0x55, 0x41, 0xb8, 0x6c, 0xbf, 0xed, 0x56, 0x45, 0xb3, 0x94, 0x5c, + 0xc0, 0x29, 0x94, 0x7b, 0xd3, 0xb5, 0xb5, 0x3f, 0xa7, 0x44, 0xe5, 0x16, 0xdf, 0xf7, 0xa9, 0xb8, + 0x05, 0x6c, 0xc0, 0x99, 0x67, 0xb2, 0xb4, 0xbf, 0xd2, 0x77, 0xf2, 0x03, 0x2e, 0x13, 0xde, 0x4b, + 0x44, 0x10, 0xae, 0xf2, 0x4c, 0x6e, 0x95, 0x7c, 0xf7, 0x90, 0x2d, 0x7d, 0xc7, 0x55, 0x5b, 0x6d, + 0x5e, 0xf8, 0x1a, 0xb2, 0x7f, 0x85, 0xbe, 0x84, 0x27, 0x88, 0x0a, 0x88, 0x3e, 0xbd, 0x8c, 0xbe, + 0x78, 0x6e, 0x2e, 0x02, 0xdb, 0xf2, 0xeb, 0xd5, 0x13, 0x63, 0x03, 0x66, 0x7a, 0xc7, 0xfd, 0x70, + 0xfb, 0x1a, 0x39, 0x77, 0xf7, 0xd1, 0xce, 0x7d, 0x99, 0x3e, 0xa5, 0x94, 0xcc, 0x18, 0x71, 0x68, + 0xac, 0xee, 0x84, 0xf8, 0x99, 0x2e, 0x93, 0xd3, 0x45, 0x9e, 0xd8, 0xd3, 0x0e, 0xe1, 0x63, 0xfb, + 0x3b, 0x67, 0xc8, 0x42, 0xa7, 0x30, 0x43, 0x91, 0x1a, 0x38, 0x65, 0x95, 0xe3, 0xb8, 0x49, 0x26, + 0xca, 0x71, 0x93, 0x4c, 0xd0, 0x2f, 0x93, 0x25, 0x05, 0x1a, 0xef, 0x8e, 0xae, 0x2b, 0x63, 0xb7, + 0xa0, 0x12, 0x57, 0xec, 0x00, 0xd2, 0x34, 0xe0, 0xcf, 0xc1, 0x4e, 0x90, 0x18, 0x6d, 0xc4, 0xf1, + 0x45, 0x88, 0x91, 0xa8, 0x71, 0x10, 0x2e, 0x60, 0x9f, 0xd5, 0xf7, 0x9d, 0x98, 0x7e, 0x40, 0x56, + 0xa7, 0x38, 0x6b, 0x11, 0xe5, 0xc2, 0xb8, 0x4c, 0xf6, 0xa7, 0xe7, 0xbe, 0x52, 0xe3, 0xbe, 0x87, + 0xac, 0xe8, 0x45, 0x72, 0xd6, 0x88, 0x94, 0xa7, 0xc6, 0x56, 0x5d, 0x43, 0xf7, 0x8d, 0x6e, 0x93, + 0x65, 0xcd, 0x47, 0xc9, 0x94, 0x9d, 0xd9, 0x4c, 0xea, 0x19, 0x14, 0xbb, 0x4a, 0x57, 0xf6, 0x3a, + 0x0f, 0xee, 0x4f, 0x45, 0xd7, 0x70, 0x09, 0x86, 0xd4, 0x0d, 0x69, 0xcb, 0x71, 0xa9, 0x2b, 0xeb, + 0xc2, 0x09, 0x5c, 0x6a, 0x55, 0xdd, 0x20, 0x5c, 0x84, 0x21, 0x35, 0xa5, 0xec, 0x92, 0x0b, 0xc8, + 0x44, 0xc6, 0x59, 0x77, 0x24, 0x0c, 0x8f, 0xb9, 0xe1, 0x90, 0xc4, 0x62, 0x89, 0xb5, 0x56, 0x35, + 0x43, 0x4e, 0x32, 0x86, 0x55, 0x9b, 0x09, 0x78, 0xf1, 0x03, 0x19, 0x8b, 0x9c, 0xf9, 0x21, 0x90, + 0xd2, 0x06, 0x21, 0x05, 0x56, 0x3b, 0x71, 0xf6, 0xc0, 0xb5, 0x3e, 0xca, 0x13, 0xfa, 0x16, 0x59, + 0x40, 0x01, 0xb9, 0x52, 0x06, 0x19, 0x2f, 0x21, 0xe3, 0x8b, 0xc8, 0x78, 0x99, 0x2e, 0x22, 0x63, + 0xe8, 0xb4, 0x2c, 0x9a, 0x40, 0x1c, 0x2a, 0x65, 0x60, 0x6c, 0x46, 0x56, 0x71, 0x6c, 0xa1, 0x45, + 0xde, 0xe5, 0xc6, 0xe4, 0xb2, 0x57, 0x18, 0x81, 0x08, 0xbe, 0x96, 0x5e, 0x23, 0x87, 0xb2, 0x17, + 0xac, 0xdd, 0x70, 0x89, 0xbe, 0xfd, 0x80, 0x27, 0x85, 0xd5, 0x70, 0xe0, 0xe0, 0xa6, 0xdf, 0x77, + 0xc7, 0x16, 0x84, 0x2b, 0xc0, 0xfc, 0x91, 0x16, 0x79, 0xc7, 0x0f, 0x6e, 0xff, 0xcd, 0x3c, 0x99, + 0xbb, 0xfb, 0xc8, 0xc7, 0xd0, 0x5f, 0x3f, 0x39, 0x4e, 0x16, 0x28, 0x59, 0xd1, 0xd1, 0xd1, 0x38, + 0x79, 0xf7, 0xd1, 0xce, 0xff, 0xf0, 0x30, 0xf9, 0x32, 0x59, 0x04, 0x70, 0x9b, 0x25, 0x5c, 0xa6, + 0xdd, 0xa1, 0x31, 0x19, 0x66, 0xbe, 0xb3, 0xe1, 0x7c, 0xa1, 0xc5, 0x2e, 0x34, 0xde, 0x33, 0x26, + 0xa3, 0x7f, 0xd9, 0x20, 0x8b, 0x83, 0xf1, 0x94, 0x7a, 0xda, 0x94, 0xf2, 0x7b, 0x36, 0xd0, 0xfd, + 0x6a, 0x83, 0x7e, 0x07, 0x2b, 0xee, 0xb8, 0xe0, 0xc3, 0x4c, 0x69, 0xa1, 0x19, 0x67, 0xf7, 0xf6, + 0xf7, 0x77, 0x6d, 0x34, 0xea, 0x73, 0x5b, 0xde, 0x04, 0xdf, 0xe5, 0xc1, 0x03, 0xb3, 0xdb, 0xb2, + 0xef, 0x20, 0x33, 0x3a, 0xcc, 0x9a, 0x8b, 0xe7, 0x40, 0x51, 0xf7, 0xad, 0xe0, 0xf2, 0xbd, 0xab, + 0xf3, 0x21, 0xa6, 0x56, 0x98, 0xaf, 0xb3, 0xb6, 0x9c, 0xc3, 0x85, 0xc1, 0xb8, 0x6e, 0x1f, 0x4f, + 0x71, 0x11, 0x75, 0xeb, 0xb0, 0x05, 0x93, 0x3b, 0xb8, 0x86, 0x77, 0xe8, 0xe7, 0x60, 0x05, 0x75, + 0x91, 0x47, 0xe0, 0xad, 0xcf, 0x57, 0xa7, 0x4b, 0x28, 0xcc, 0x26, 0x2e, 0x41, 0x38, 0x3f, 0x18, + 0xd7, 0xec, 0xe8, 0xbb, 0x0d, 0xb2, 0xe0, 0x03, 0x71, 0x37, 0x92, 0x71, 0xde, 0x3a, 0x8d, 0x45, + 0xa0, 0x1c, 0x85, 0x25, 0xf4, 0xeb, 0x5b, 0x3b, 0xdb, 0x21, 0x73, 0x7a, 0x24, 0xb0, 0xbc, 0x54, + 0xc6, 0xed, 0x54, 0x98, 0xb1, 0xca, 0x9f, 0x6a, 0x07, 0x42, 0xae, 0xbf, 0xb9, 0x11, 0x5c, 0xbf, + 0xf5, 0x06, 0xe8, 0xc7, 0xb5, 0xeb, 0xb7, 0xae, 0x04, 0xec, 0x89, 0xf5, 0x3d, 0xe8, 0xa5, 0x8d, + 0x02, 0x95, 0x1a, 0xe3, 0x44, 0x3d, 0x83, 0x6b, 0xe2, 0xd0, 0x71, 0x92, 0x11, 0xe8, 0xf5, 0xbc, + 0xef, 0xd8, 0x92, 0x71, 0x4e, 0x7f, 0xb9, 0x41, 0x66, 0x0f, 0xb2, 0xd4, 0x4e, 0x6a, 0x06, 0x27, + 0x35, 0xc2, 0x49, 0x0d, 0xa8, 0x38, 0x3e, 0xa9, 0x83, 0x2c, 0xfd, 0x99, 0xcf, 0xe7, 0xdc, 0x41, + 0x96, 0xe2, 0x54, 0xee, 0x10, 0x92, 0x15, 0xbd, 0x44, 0x46, 0xe8, 0x08, 0xec, 0x4d, 0xd4, 0x27, + 0x71, 0x2e, 0x8c, 0xbe, 0x80, 0xa7, 0x81, 0xbd, 0xe0, 0x09, 0xec, 0x61, 0x48, 0xed, 0x73, 0xa3, + 0x70, 0xce, 0xf6, 0x81, 0x5b, 0x88, 0xc8, 0x02, 0xa4, 0xa0, 0x39, 0x28, 0x72, 0xae, 0x0e, 0x27, + 0x58, 0x6f, 0x6b, 0x6e, 0x3c, 0xe3, 0x21, 0xb8, 0xed, 0xdb, 0x85, 0x2e, 0x07, 0xc2, 0x5f, 0x42, + 0x21, 0x97, 0xe9, 0x73, 0xa1, 0x2a, 0x00, 0xfb, 0x83, 0x4b, 0x70, 0x2c, 0xc0, 0xd4, 0x0e, 0xa5, + 0xd0, 0x41, 0x38, 0x9f, 0xd7, 0x06, 0xd2, 0x47, 0xe4, 0x4c, 0x22, 0xd3, 0xa7, 0xba, 0x35, 0x87, + 0xcc, 0x7d, 0x56, 0xeb, 0x42, 0x5c, 0x85, 0x07, 0x3a, 0x71, 0x2c, 0xc1, 0x9d, 0xf0, 0x84, 0x21, + 0xbd, 0xb5, 0x5e, 0x5b, 0xaf, 0x72, 0xf5, 0xa8, 0xbb, 0x8f, 0x76, 0x82, 0xd0, 0x72, 0xa3, 0x37, + 0x40, 0x4d, 0x24, 0xa4, 0xa1, 0xe8, 0xd5, 0x74, 0x6b, 0xe5, 0x28, 0x7b, 0x70, 0x48, 0x70, 0x84, + 0x48, 0x04, 0x5f, 0x34, 0xf8, 0x50, 0x5e, 0x0f, 0x94, 0x98, 0x04, 0x57, 0x37, 0x44, 0x53, 0x41, + 0x34, 0x9c, 0x26, 0xa5, 0xaf, 0x93, 0x8b, 0xfe, 0x46, 0xb6, 0xab, 0x05, 0xcf, 0xa3, 0x61, 0xb7, + 0x2f, 0x13, 0x23, 0x72, 0x4c, 0xd7, 0xe7, 0xc2, 0xf3, 0xbe, 0x77, 0x0f, 0x3b, 0xdf, 0xc5, 0x3e, + 0x7a, 0xe5, 0xe3, 0x22, 0xd4, 0xf1, 0x30, 0xb4, 0xf6, 0x71, 0x61, 0xe8, 0x58, 0xac, 0xb9, 0xfe, + 0x63, 0x63, 0xcd, 0x89, 0xd1, 0xa3, 0x7d, 0x62, 0xf4, 0x98, 0x8e, 0x12, 0xc1, 0x8f, 0x89, 0x12, + 0x27, 0xf8, 0x78, 0x7a, 0x83, 0x5c, 0x1c, 0x28, 0x35, 0x48, 0x44, 0xf7, 0x44, 0x60, 0x11, 0xae, + 0xda, 0xde, 0x2f, 0x4d, 0x81, 0x85, 0xb7, 0xc9, 0xb3, 0x27, 0x0d, 0xaa, 0x63, 0x86, 0xf0, 0xd2, + 0xb1, 0x81, 0x16, 0x07, 0xb4, 0x07, 0x08, 0x8d, 0x60, 0x16, 0x00, 0x71, 0xaa, 0x2b, 0x22, 0x87, + 0xb3, 0x5e, 0x22, 0x0b, 0x00, 0xe6, 0xc7, 0x2a, 0x8f, 0xbb, 0x43, 0xae, 0xdd, 0x7d, 0x4f, 0x38, + 0xef, 0x1b, 0xef, 0x71, 0x3d, 0x9c, 0x22, 0xd2, 0x3c, 0x31, 0x16, 0x97, 0x56, 0x44, 0x7b, 0x3c, + 0x31, 0xed, 0x3f, 0x68, 0x90, 0xd9, 0xad, 0x8e, 0x8b, 0x5e, 0xbf, 0xd6, 0x98, 0xbe, 0xf9, 0x3d, + 0x12, 0xbc, 0x3e, 0xc6, 0xfb, 0x6d, 0x75, 0x4e, 0xa8, 0x19, 0x4b, 0x6d, 0x4b, 0x0f, 0x91, 0xca, + 0x73, 0xa1, 0x33, 0x95, 0xc6, 0x35, 0xd4, 0x5b, 0x73, 0xe2, 0x32, 0x75, 0xb7, 0xa9, 0xc1, 0x74, + 0x16, 0x31, 0x75, 0x7b, 0xdc, 0xee, 0x12, 0x7a, 0xdc, 0x46, 0xe9, 0x79, 0x72, 0x26, 0x07, 0xeb, + 0x74, 0x5b, 0x63, 0xbf, 0x1c, 0x87, 0x8d, 0xf4, 0x13, 0x64, 0x3e, 0x17, 0x1f, 0x16, 0x32, 0x17, + 0x5d, 0xd8, 0x68, 0xdc, 0x87, 0xd9, 0xb0, 0xe9, 0xda, 0xc0, 0x16, 0xda, 0x7f, 0xd6, 0x20, 0xf3, + 0xdb, 0x93, 0x74, 0xfb, 0xe1, 0x5e, 0x75, 0x31, 0x55, 0x26, 0xc3, 0x8d, 0xea, 0x62, 0xaa, 0x4c, + 0x88, 0x5f, 0x22, 0x0b, 0x71, 0x9c, 0x6a, 0x54, 0x21, 0x24, 0x72, 0x27, 0x00, 0x8d, 0x8f, 0x5c, + 0x5b, 0x49, 0xe4, 0x77, 0xdc, 0x9f, 0x00, 0x34, 0xee, 0xba, 0x36, 0x7a, 0x99, 0x90, 0x22, 0x8b, + 0x61, 0xcb, 0x61, 0xda, 0x88, 0xec, 0xc3, 0x39, 0xdb, 0x02, 0xba, 0xfa, 0x3c, 0x99, 0xeb, 0xc3, + 0x4c, 0x45, 0x1a, 0x4d, 0x50, 0xdd, 0x66, 0xc2, 0xaa, 0xa1, 0xfd, 0xbb, 0x4b, 0x64, 0xf1, 0x5d, + 0x17, 0x7d, 0xdc, 0xcc, 0x5f, 0x22, 0x4d, 0xe7, 0x32, 0xf1, 0x26, 0x70, 0xb6, 0x9c, 0xbc, 0xf3, + 0xa4, 0x78, 0xf1, 0x59, 0xcf, 0xf5, 0x57, 0x8f, 0xe4, 0xfa, 0xff, 0xff, 0x64, 0x0c, 0xf3, 0x55, + 0x54, 0x83, 0x27, 0xf4, 0xd1, 0x51, 0x0c, 0x53, 0x46, 0xbf, 0x0a, 0xc8, 0xf8, 0x0b, 0xf2, 0xa9, + 0xe8, 0x2b, 0x75, 0x95, 0x91, 0x80, 0xcb, 0x53, 0x49, 0x82, 0x6e, 0xf5, 0xeb, 0xaa, 0xa7, 0x7f, + 0x5e, 0x58, 0xa5, 0x75, 0x02, 0x56, 0x79, 0x48, 0x9a, 0x75, 0x27, 0x75, 0xe4, 0xb2, 0xf7, 0xcb, + 0x37, 0xd7, 0xdf, 0x64, 0x35, 0x6f, 0x85, 0x77, 0x52, 0xd3, 0xf1, 0x3d, 0x08, 0xeb, 0x0c, 0x68, + 0x7f, 0xda, 0x68, 0x66, 0x7e, 0x96, 0x90, 0xa1, 0xfe, 0x84, 0xe2, 0x36, 0x99, 0x05, 0x65, 0xaa, + 0x52, 0xaa, 0xcd, 0x57, 0x50, 0xc8, 0x8b, 0xf4, 0x32, 0x08, 0xd9, 0x7e, 0xb8, 0x37, 0x75, 0x67, + 0xec, 0x25, 0x04, 0xe1, 0xb9, 0x38, 0xd5, 0x58, 0xf8, 0xfa, 0x80, 0x34, 0x23, 0x95, 0x46, 0x45, + 0x9e, 0xa3, 0x36, 0xcd, 0x61, 0xd1, 0xeb, 0xf3, 0xc8, 0xe4, 0x0d, 0x7a, 0x0b, 0x2f, 0x9d, 0xcb, + 0x52, 0xbc, 0xcb, 0xa9, 0x47, 0x42, 0x6b, 0x3e, 0x10, 0x2e, 0x48, 0xa9, 0x08, 0x0e, 0xbe, 0xe4, + 0x61, 0x92, 0x09, 0xec, 0x45, 0xc5, 0x92, 0xfe, 0xe0, 0x14, 0x79, 0x26, 0x56, 0xdd, 0x54, 0x99, + 0x6e, 0xa4, 0x46, 0x10, 0xd5, 0x74, 0xb7, 0x7c, 0xee, 0x83, 0x90, 0x70, 0x76, 0xf3, 0x3f, 0x2d, + 0x24, 0xfc, 0x51, 0x83, 0xfe, 0x6b, 0x03, 0x9f, 0xa7, 0xb8, 0x6c, 0xc9, 0x5d, 0xdd, 0xf8, 0x71, + 0xac, 0x1c, 0xc7, 0xec, 0x55, 0x8e, 0xaa, 0xa5, 0xcc, 0xce, 0xc5, 0x48, 0x6d, 0xf1, 0x71, 0xa1, + 0x45, 0xbf, 0xb0, 0xda, 0x14, 0x8b, 0x5e, 0x31, 0x18, 0xc8, 0x74, 0x60, 0xeb, 0x24, 0x6f, 0xb1, + 0x3d, 0x61, 0x0c, 0x40, 0x7b, 0x54, 0x40, 0x84, 0x87, 0x58, 0xda, 0xad, 0x95, 0x16, 0xbd, 0x20, + 0xd6, 0x97, 0x22, 0x89, 0x35, 0x4b, 0xe4, 0x53, 0x77, 0xfd, 0x0e, 0x10, 0xb3, 0xfe, 0x44, 0xc8, + 0xd6, 0x49, 0x47, 0x7c, 0xe2, 0xaa, 0xc1, 0x70, 0x5c, 0xf5, 0xc2, 0x74, 0x2c, 0x75, 0x94, 0x28, + 0x84, 0xe4, 0xb2, 0x5f, 0x17, 0x21, 0x35, 0x2b, 0x52, 0xbc, 0x39, 0x13, 0x71, 0x10, 0x5e, 0x8c, + 0xd5, 0x43, 0x65, 0xb6, 0xdc, 0x42, 0x3b, 0x7e, 0x9d, 0xf4, 0x83, 0xe3, 0x85, 0xc9, 0x26, 0x9e, + 0xd1, 0x1b, 0xb8, 0x63, 0x1b, 0x74, 0xfd, 0xc7, 0x17, 0x26, 0x79, 0x14, 0x89, 0xcc, 0xd4, 0x0b, + 0x93, 0x47, 0x4b, 0x91, 0xef, 0x93, 0x73, 0xf1, 0x24, 0xed, 0xc6, 0xa9, 0xc6, 0xe0, 0xdc, 0xdc, + 0x58, 0xf5, 0x37, 0x0b, 0x35, 0xe7, 0x57, 0x19, 0x43, 0x95, 0xca, 0x6a, 0xc3, 0xc1, 0xec, 0x86, + 0x82, 0xc5, 0x93, 0x94, 0xc5, 0x69, 0xed, 0xe5, 0xc3, 0xd9, 0x78, 0x92, 0x6e, 0xa7, 0x9a, 0xc6, + 0x64, 0x1e, 0xc1, 0x55, 0x77, 0x28, 0x78, 0x2c, 0x72, 0x97, 0x59, 0xfa, 0x8a, 0xda, 0x9b, 0xf7, + 0xb0, 0x95, 0xc5, 0xa2, 0x2f, 0x6b, 0x95, 0x68, 0x1c, 0x51, 0xcf, 0xc0, 0xf0, 0xc6, 0x57, 0x8c, + 0x14, 0x00, 0x7c, 0xeb, 0x0d, 0xc2, 0x26, 0x12, 0xd9, 0xf1, 0xf4, 0x17, 0x1b, 0xe4, 0x25, 0x5f, + 0xe2, 0x77, 0x21, 0x75, 0xa4, 0x52, 0x69, 0x54, 0x2e, 0xd3, 0x41, 0x4d, 0xd7, 0x16, 0x11, 0xb7, + 0x7e, 0x06, 0xa5, 0x5f, 0xa7, 0xd7, 0xec, 0xdb, 0x06, 0x44, 0x48, 0xb8, 0xa4, 0x9a, 0x86, 0x97, + 0xa3, 0x2b, 0x8d, 0x0b, 0x42, 0x7f, 0x45, 0x60, 0x3d, 0xd9, 0x83, 0x92, 0xa6, 0x3a, 0xac, 0x6f, + 0x92, 0x66, 0x5e, 0xa4, 0x5d, 0x6e, 0x63, 0x80, 0x4b, 0x31, 0xbf, 0x86, 0xf2, 0xbe, 0x4c, 0x1f, + 0x83, 0x3c, 0x4c, 0x21, 0x5d, 0x9d, 0xae, 0x6e, 0xf1, 0x36, 0xc1, 0xcb, 0x8b, 0x94, 0x71, 0x8d, + 0x35, 0x70, 0xb7, 0xc7, 0xd5, 0x73, 0x22, 0xdb, 0xc7, 0x38, 0x8b, 0x65, 0xbf, 0x2f, 0xc0, 0xd2, + 0x90, 0x59, 0x10, 0xce, 0xe5, 0x45, 0xda, 0xc1, 0x00, 0x43, 0x33, 0xb2, 0x6c, 0xef, 0x0b, 0x44, + 0xec, 0x36, 0x42, 0x23, 0xd6, 0x39, 0x5d, 0xf9, 0x9e, 0x3b, 0xae, 0xff, 0x98, 0x59, 0x6b, 0x0b, + 0x34, 0xa5, 0x66, 0xb1, 0xc8, 0x12, 0x35, 0x19, 0x81, 0x84, 0xb2, 0x86, 0x7d, 0x7d, 0x7d, 0x7d, + 0x7d, 0xfd, 0x4a, 0xb8, 0xe4, 0xd9, 0x3b, 0x6f, 0x4e, 0x5f, 0x23, 0x14, 0x0b, 0x83, 0x99, 0x52, + 0x09, 0x5e, 0xaf, 0xa0, 0x86, 0xae, 0x80, 0xcc, 0x70, 0x09, 0x7a, 0x76, 0x95, 0x4a, 0x1e, 0xf0, + 0x43, 0xd4, 0xb4, 0x63, 0xc4, 0x78, 0x17, 0x43, 0x8f, 0x11, 0xe3, 0x15, 0xca, 0x36, 0x59, 0xaa, + 0x5e, 0x6d, 0x81, 0x56, 0x69, 0xcc, 0x32, 0x9b, 0x1b, 0xcf, 0x39, 0xf5, 0x2c, 0x1f, 0x41, 0x61, + 0xa7, 0x55, 0xd3, 0x70, 0x51, 0x4f, 0xb5, 0x02, 0x4c, 0xcb, 0x44, 0xee, 0xb5, 0xc2, 0x59, 0x51, + 0x0e, 0x3e, 0xfe, 0x02, 0x8a, 0x5d, 0xcd, 0x44, 0x6e, 0xd7, 0x62, 0x2d, 0x22, 0x04, 0xef, 0x7d, + 0x95, 0xd0, 0x41, 0xa2, 0x7a, 0x80, 0xae, 0x6b, 0x03, 0x2e, 0xe2, 0x80, 0x65, 0xdb, 0x53, 0xa3, + 0xbe, 0x4e, 0x2e, 0x38, 0xf6, 0xf6, 0xb6, 0xac, 0x5c, 0xd8, 0x25, 0x5b, 0x64, 0xb7, 0x9d, 0xf8, + 0xfa, 0xca, 0xad, 0xad, 0xfd, 0xb7, 0xa7, 0xc8, 0xd2, 0x36, 0x37, 0x1c, 0x1f, 0x34, 0xb8, 0x18, + 0xfd, 0x49, 0xb2, 0x28, 0x47, 0x59, 0x22, 0x60, 0xdf, 0xd1, 0x73, 0x38, 0x08, 0x73, 0xa4, 0x15, + 0xc2, 0xb4, 0x7f, 0x66, 0xe3, 0x00, 0x46, 0xf9, 0x9d, 0x5e, 0x23, 0xab, 0x7d, 0x99, 0x08, 0x64, + 0xdb, 0x8d, 0x65, 0x2e, 0x22, 0xa3, 0x72, 0x57, 0x7c, 0x0c, 0x69, 0xd9, 0xb5, 0xed, 0x7b, 0xe8, + 0x2b, 0x64, 0x71, 0x34, 0xd1, 0x1f, 0x26, 0x15, 0x66, 0xb1, 0x60, 0x63, 0x01, 0x5b, 0x4b, 0xd0, + 0x52, 0x92, 0x95, 0xa8, 0xe5, 0x4c, 0x8d, 0xac, 0x84, 0x2d, 0x25, 0x19, 0x00, 0xef, 0x1e, 0xd7, + 0xbe, 0xcc, 0x67, 0xc9, 0xb6, 0x5d, 0x23, 0x60, 0x2f, 0x4b, 0x66, 0xcf, 0xca, 0x95, 0xb5, 0x9a, + 0xd8, 0x66, 0x0f, 0x95, 0xde, 0x22, 0x97, 0x2c, 0xc9, 0xf1, 0x3a, 0x27, 0x82, 0x97, 0xf0, 0x02, + 0x76, 0x1f, 0xad, 0x56, 0xb6, 0xbf, 0x75, 0x9a, 0x90, 0x07, 0x5c, 0x26, 0x6e, 0x4f, 0x05, 0x99, + 0xe9, 0xe7, 0x6a, 0xe4, 0xd0, 0x4a, 0xf9, 0xae, 0xe4, 0x49, 0x59, 0x12, 0x15, 0x23, 0x2e, 0x13, + 0x6f, 0x7d, 0x3d, 0x61, 0xa3, 0x0a, 0x0c, 0x41, 0x1b, 0x84, 0xd0, 0x53, 0x2b, 0xdb, 0x61, 0x0d, + 0x15, 0x60, 0xbb, 0xdf, 0xac, 0x20, 0x44, 0xf6, 0xf4, 0x6d, 0x72, 0xd6, 0x2d, 0xc5, 0x96, 0xa1, + 0xcb, 0x44, 0xd1, 0xc3, 0x22, 0x17, 0x7e, 0xf7, 0x1e, 0xec, 0xef, 0x96, 0x78, 0xc1, 0x0d, 0xa1, + 0xb7, 0xcb, 0x57, 0x1f, 0x88, 0x6c, 0x4e, 0xa3, 0x73, 0x7f, 0x11, 0x39, 0x3c, 0x43, 0x2f, 0x21, + 0xb2, 0x39, 0x3e, 0xdc, 0x3f, 0xea, 0x40, 0x88, 0x73, 0xcf, 0x26, 0x76, 0x47, 0xce, 0xb0, 0x9a, + 0x05, 0x56, 0x68, 0x8d, 0xaa, 0x17, 0x1c, 0x05, 0x2b, 0xd2, 0x18, 0x66, 0x31, 0x0f, 0x8d, 0xe5, + 0x39, 0x7f, 0xd1, 0x71, 0x9a, 0x3e, 0xe6, 0x2a, 0xbb, 0xf6, 0xed, 0xc7, 0xb8, 0x01, 0x8e, 0x77, + 0xcc, 0xbc, 0x36, 0xb4, 0xff, 0xfc, 0x34, 0x59, 0xb8, 0xaf, 0x30, 0xee, 0xba, 0xe3, 0x28, 0xc8, + 0xb2, 0x2a, 0x4c, 0x56, 0x98, 0x9a, 0x6e, 0xda, 0xa3, 0xf9, 0x02, 0x4a, 0xd8, 0xa6, 0x9b, 0xfb, + 0xee, 0x56, 0x0b, 0x43, 0xa7, 0x51, 0xe5, 0x9b, 0x82, 0x01, 0xbe, 0xe4, 0xd1, 0x47, 0x8f, 0xc5, + 0x76, 0xa7, 0xaa, 0x46, 0x11, 0x2e, 0x59, 0x19, 0x95, 0x92, 0x7f, 0x44, 0x9e, 0xd3, 0x22, 0xe3, + 0x60, 0xc4, 0xdd, 0x44, 0x0d, 0x74, 0x17, 0x3d, 0x82, 0x1a, 0x65, 0x2a, 0x15, 0xa9, 0xc5, 0x92, + 0xb3, 0xd5, 0xab, 0x0d, 0xeb, 0x7b, 0xaf, 0x32, 0xc1, 0xa3, 0x21, 0x2b, 0xa9, 0x6c, 0x30, 0x05, + 0x29, 0xb0, 0x74, 0xe6, 0xf9, 0xa1, 0xcc, 0x20, 0x6c, 0xf9, 0xef, 0xf7, 0xd5, 0x40, 0xef, 0x8a, + 0x7c, 0xcb, 0x0f, 0x83, 0x1d, 0xf5, 0x8f, 0x38, 0xed, 0x5b, 0x5c, 0x7b, 0xbe, 0xe5, 0x8e, 0xde, + 0x53, 0x63, 0xa6, 0xfa, 0x46, 0xe0, 0x62, 0x91, 0xd2, 0xea, 0x99, 0x5b, 0xcb, 0xbc, 0x1f, 0xbc, + 0x2f, 0x47, 0x82, 0x3e, 0x25, 0xe7, 0xc0, 0xb9, 0xf0, 0x81, 0x3d, 0xe2, 0x99, 0xcd, 0x10, 0xd9, + 0xdc, 0xa7, 0xb7, 0x3d, 0x06, 0xe0, 0x03, 0xc4, 0x7a, 0x38, 0x77, 0x7c, 0x35, 0xb5, 0xf6, 0x2e, + 0xfc, 0xef, 0x2b, 0x60, 0xb1, 0x48, 0x04, 0xf8, 0x7e, 0xde, 0x37, 0xc2, 0x15, 0xec, 0x61, 0x52, + 0x57, 0x82, 0x8d, 0xd9, 0x1b, 0xd7, 0x6f, 0xde, 0xb8, 0xb5, 0xbe, 0xbe, 0x1e, 0x9e, 0x1d, 0xf1, + 0xc3, 0xce, 0x40, 0xb4, 0x7f, 0xd4, 0x20, 0xcb, 0x55, 0x8c, 0x73, 0x27, 0xf8, 0x3b, 0x27, 0xe7, + 0x01, 0xdf, 0xc0, 0x79, 0x1c, 0x50, 0x73, 0x34, 0x0f, 0xa8, 0x05, 0xd2, 0xff, 0xa6, 0x92, 0xe6, + 0xe6, 0xf1, 0x34, 0xa1, 0x84, 0xc4, 0x53, 0x69, 0x42, 0x6d, 0x6a, 0x40, 0x5b, 0xcb, 0x19, 0xda, + 0x43, 0xb2, 0xd8, 0x29, 0x8c, 0xba, 0x73, 0x28, 0x22, 0xb7, 0x6e, 0x4a, 0x66, 0x78, 0x3e, 0x38, + 0x68, 0x35, 0x00, 0x41, 0x84, 0xf8, 0x99, 0x6e, 0x92, 0xb2, 0xea, 0xd1, 0x45, 0x04, 0x83, 0x15, + 0x1c, 0xdd, 0x3a, 0x85, 0xb5, 0x98, 0x25, 0x5f, 0x56, 0x71, 0x24, 0xe1, 0xaa, 0x27, 0xde, 0xae, + 0x68, 0xdb, 0x7f, 0x3d, 0x43, 0xce, 0x9f, 0x14, 0xc7, 0xc0, 0x47, 0xe2, 0xdb, 0xe8, 0x11, 0x4f, + 0xf9, 0x40, 0xe4, 0xb8, 0xcf, 0xb3, 0x61, 0x13, 0xda, 0x1e, 0xd8, 0x26, 0xfa, 0x2a, 0x59, 0x42, + 0x92, 0x58, 0xea, 0x8c, 0x9b, 0x68, 0xe8, 0xdc, 0xcf, 0x6c, 0xb8, 0x08, 0xcd, 0xdb, 0x65, 0x2b, + 0x10, 0x6a, 0xc3, 0x8d, 0xee, 0x46, 0x2a, 0x49, 0xd0, 0x26, 0x5c, 0xba, 0xbb, 0x88, 0xcd, 0x5b, + 0xbe, 0x95, 0xbe, 0x46, 0x56, 0x9c, 0x2b, 0xaa, 0x36, 0x07, 0x35, 0x6d, 0x36, 0x5c, 0xb6, 0x1d, + 0x95, 0x42, 0x60, 0x71, 0xc7, 0x12, 0x57, 0x00, 0xeb, 0x0c, 0xd2, 0xba, 0xb8, 0x5d, 0xc1, 0xa2, + 0x4b, 0x15, 0xc2, 0x3c, 0x8b, 0x14, 0x1e, 0x1e, 0xbe, 0xec, 0xca, 0x9d, 0xb9, 0x1a, 0xd8, 0x80, + 0x76, 0x0e, 0xbb, 0xa7, 0x1b, 0x21, 0xac, 0x68, 0x9e, 0x4a, 0x33, 0xe9, 0x46, 0x43, 0x11, 0x3d, + 0x15, 0x39, 0xc6, 0x80, 0xd9, 0x70, 0xc1, 0xb6, 0x6e, 0xd9, 0x46, 0xfa, 0x22, 0x69, 0x1e, 0xf4, + 0xb5, 0x47, 0x0b, 0x98, 0xc9, 0xcc, 0x86, 0xe4, 0xa0, 0xaf, 0xdd, 0xd6, 0xc2, 0x9e, 0x62, 0x75, + 0xc7, 0xef, 0x29, 0xb1, 0x7b, 0x0a, 0x6d, 0x7e, 0x4f, 0x5f, 0x23, 0x2b, 0xc7, 0x00, 0x24, 0xe2, + 0xed, 0x59, 0x7f, 0x15, 0x57, 0xdb, 0x81, 0x4f, 0x13, 0x5a, 0x83, 0x99, 0x5e, 0xee, 0x3c, 0x52, + 0xaf, 0x54, 0x3d, 0x5e, 0xfc, 0x65, 0x42, 0x78, 0x26, 0x7d, 0xd0, 0x5b, 0x40, 0xb2, 0x39, 0x9e, + 0x49, 0x17, 0xf2, 0x5e, 0x25, 0x4b, 0x1e, 0x0e, 0x7a, 0x9a, 0x45, 0x7b, 0x4a, 0xbe, 0xd9, 0x11, + 0x5e, 0x26, 0x64, 0x50, 0x94, 0x7c, 0x96, 0x2c, 0x9f, 0x41, 0xe1, 0xf8, 0xb4, 0xff, 0x9d, 0x90, + 0xb3, 0x4e, 0x89, 0x5e, 0x23, 0x4b, 0xbc, 0x30, 0x0a, 0x12, 0xd3, 0x6e, 0xac, 0x46, 0x5c, 0xa6, + 0x88, 0x7a, 0x6c, 0xea, 0xbf, 0xe8, 0xbb, 0xb6, 0xb1, 0x87, 0xbe, 0x5b, 0x3d, 0xc1, 0x99, 0x3d, + 0xf1, 0x09, 0xce, 0xf3, 0x68, 0x46, 0x17, 0xe9, 0xf9, 0xc7, 0xc7, 0x9f, 0xdf, 0xd4, 0x9e, 0xdb, + 0x7c, 0x81, 0x9c, 0xb5, 0x80, 0xca, 0xbd, 0x40, 0xf7, 0xd9, 0x44, 0xfd, 0x86, 0x78, 0xf3, 0x32, + 0xf2, 0xba, 0x44, 0x2f, 0x6c, 0xb9, 0x6b, 0xda, 0xe9, 0x37, 0x76, 0x8e, 0x03, 0xdd, 0x25, 0xa7, + 0x3b, 0xbb, 0x3b, 0xa8, 0xd6, 0xcd, 0x8d, 0x65, 0x6f, 0x51, 0xfe, 0x75, 0x42, 0x95, 0x93, 0x4c, + 0x3f, 0x72, 0x82, 0x94, 0x0f, 0x8b, 0xfa, 0x9d, 0xdd, 0xda, 0x4d, 0x4a, 0x08, 0xac, 0x68, 0x9b, + 0x9c, 0xbe, 0xfb, 0x68, 0x07, 0xf5, 0xbf, 0xe2, 0x58, 0xde, 0xd5, 0x84, 0xd0, 0x49, 0x5f, 0x24, + 0xa7, 0xb6, 0x3a, 0xa8, 0xf7, 0x95, 0x19, 0xfb, 0x7a, 0x58, 0x78, 0x6a, 0xab, 0x43, 0xaf, 0x93, + 0x59, 0x5f, 0x60, 0x41, 0x95, 0x6f, 0x6e, 0x5c, 0x70, 0x64, 0xd3, 0x75, 0x97, 0xb0, 0x24, 0xa3, + 0x9f, 0x23, 0x8b, 0x77, 0x0e, 0x4d, 0xce, 0x7d, 0x83, 0x6e, 0xbd, 0x88, 0x6e, 0xe2, 0x63, 0x06, + 0x1e, 0x21, 0xa6, 0xaf, 0x93, 0xb9, 0x12, 0x2f, 0xa2, 0x0d, 0x35, 0x37, 0x2e, 0x96, 0xef, 0xbf, + 0xa6, 0x70, 0x64, 0x58, 0x11, 0xd2, 0x71, 0xed, 0x17, 0x1c, 0x68, 0x0f, 0xd5, 0x92, 0xcb, 0xf6, + 0xea, 0xd7, 0x2b, 0x5b, 0x28, 0xcc, 0x94, 0x68, 0xa5, 0x7c, 0x00, 0x89, 0x6f, 0xf9, 0x20, 0xf7, + 0x40, 0xae, 0xe5, 0x03, 0xc9, 0xf2, 0x69, 0x9f, 0x0b, 0x82, 0xb5, 0x5f, 0x8b, 0xbc, 0x42, 0x66, + 0x00, 0x85, 0xa1, 0xe5, 0x34, 0x37, 0x56, 0x9c, 0xcc, 0x0a, 0x98, 0x85, 0xd8, 0x4d, 0x03, 0x72, + 0xce, 0x01, 0x04, 0xc4, 0xca, 0x55, 0x2d, 0x7a, 0x0a, 0x36, 0x84, 0x9e, 0x88, 0xde, 0x46, 0x15, + 0xed, 0x29, 0x2d, 0xec, 0x85, 0x53, 0x15, 0x46, 0xef, 0xa4, 0xbc, 0x97, 0xe0, 0xc3, 0x30, 0xe8, + 0x85, 0x38, 0x0d, 0x03, 0x98, 0x45, 0x02, 0x56, 0x39, 0xa1, 0x83, 0x7e, 0x85, 0xac, 0x96, 0x16, + 0x61, 0xff, 0xe3, 0xd1, 0xd0, 0x42, 0xfb, 0x5a, 0xbd, 0x67, 0x97, 0x9b, 0x61, 0xf5, 0xde, 0xd8, + 0x0f, 0xa8, 0xd7, 0x28, 0x75, 0x10, 0xae, 0xf8, 0xf6, 0x2d, 0xf8, 0x07, 0x6c, 0x68, 0x4a, 0x48, + 0xe5, 0x1e, 0xf0, 0xfd, 0x50, 0xf5, 0xa4, 0xe7, 0x68, 0x28, 0xdd, 0xbc, 0x89, 0xd2, 0xae, 0xd1, + 0x4f, 0x3b, 0x34, 0xea, 0xc2, 0x52, 0x96, 0xab, 0x91, 0x30, 0x43, 0x51, 0xe8, 0x13, 0x83, 0x67, + 0x58, 0x93, 0x40, 0xff, 0x9f, 0xf5, 0x28, 0xd6, 0x78, 0xdc, 0x13, 0x22, 0xaf, 0x16, 0x47, 0xde, + 0x64, 0x54, 0x6f, 0xdd, 0xec, 0xfb, 0x2a, 0xc8, 0x5e, 0x44, 0x5c, 0x3e, 0x0b, 0x70, 0x8f, 0x1b, + 0x5c, 0x87, 0x7b, 0x91, 0x96, 0xfa, 0x0b, 0x32, 0xcc, 0x78, 0x1c, 0x4d, 0x80, 0x3e, 0xcb, 0x39, + 0x98, 0x5f, 0x69, 0x90, 0x59, 0xd8, 0x06, 0x71, 0x28, 0x22, 0x7c, 0xee, 0x55, 0x29, 0xf4, 0x74, + 0x00, 0xdd, 0xfc, 0x0a, 0x8a, 0x7f, 0x4c, 0xf7, 0xeb, 0xef, 0xdd, 0x32, 0x11, 0xc9, 0xbe, 0x14, + 0x31, 0xca, 0xe5, 0x45, 0x1a, 0x0d, 0xeb, 0x3f, 0x2a, 0x28, 0x6b, 0xc3, 0x03, 0x79, 0x20, 0xd2, + 0xf2, 0xd7, 0x07, 0x89, 0x4c, 0xed, 0x99, 0x80, 0xe7, 0x89, 0x00, 0x3c, 0x04, 0x61, 0x39, 0x09, + 0xba, 0x5b, 0xa2, 0x69, 0x7c, 0x03, 0xf0, 0xc2, 0xf4, 0xb3, 0x8b, 0xfd, 0x49, 0x26, 0x6a, 0x2f, + 0xa8, 0xd7, 0xf0, 0xb5, 0xec, 0x55, 0xff, 0x1c, 0xf2, 0xaa, 0x7b, 0xa4, 0x7b, 0xc5, 0xa3, 0x6b, + 0x20, 0x87, 0x90, 0xa0, 0x7a, 0xfd, 0x42, 0x5b, 0x4c, 0xda, 0xb5, 0x2f, 0x96, 0x99, 0x7d, 0xbe, + 0x50, 0xeb, 0x78, 0x08, 0xed, 0x9b, 0xaf, 0xbf, 0xbf, 0x31, 0x1e, 0x8f, 0x03, 0xfb, 0x70, 0x24, + 0x16, 0x87, 0x41, 0xa4, 0x46, 0xd7, 0x06, 0x2a, 0xe1, 0xe9, 0xe0, 0x5a, 0xfd, 0x35, 0xc9, 0x35, + 0xbb, 0x99, 0xf6, 0xc7, 0x6e, 0xbd, 0xb3, 0xf8, 0xe7, 0xc6, 0x7f, 0x05, 0x00, 0x00, 0xff, 0xff, + 0x19, 0x5e, 0x5a, 0x04, 0x4a, 0x37, 0x00, 0x00, } diff --git a/config/proto/config.proto b/config/proto/config.proto index 57bd09eb5b2..02c53997583 100644 --- a/config/proto/config.proto +++ b/config/proto/config.proto @@ -278,6 +278,12 @@ message GUIConfig { description: "Port to bind to." }]; + // Allows the GUI to start with no encryption - **WARNING** This + // only makes sense if you have TLS proxy in front. In fact the + // GUI **will not work** without a TLS proxy because the csrf + // cookie is set to secure only. + bool use_plain_http = 20; + string gw_certificate = 10 [(sem_type) = { description: "The GUI exposes a HTTP interface to the gRPC end point." "This is the certificate and private key that will be used to " diff --git a/file_store/directory/queue.go b/file_store/directory/queue.go index 3d3f7da12dc..170c86d30d1 100644 --- a/file_store/directory/queue.go +++ b/file_store/directory/queue.go @@ -46,7 +46,7 @@ func (self *DirectoryQueueManager) PushEventRows( row.Set("_ts", int(self.Clock.Now().Unix())) } - serialized, err := utils.DictsToJson(dict_rows) + serialized, err := utils.DictsToJson(dict_rows, nil) if err != nil { return err } diff --git a/file_store/memory/queue.go b/file_store/memory/queue.go index 03858c49721..009e36a7194 100644 --- a/file_store/memory/queue.go +++ b/file_store/memory/queue.go @@ -121,7 +121,7 @@ func (self *MemoryQueueManager) PushEventRows( } defer fd.Close() - serialized, err := utils.DictsToJson(dict_rows) + serialized, err := utils.DictsToJson(dict_rows, nil) if err != nil { return err } diff --git a/file_store/mysql/queue.go b/file_store/mysql/queue.go index 320472d0db3..acb4dee19d8 100644 --- a/file_store/mysql/queue.go +++ b/file_store/mysql/queue.go @@ -226,7 +226,7 @@ func (self *MysqlQueueManager) PushEventRows( return err } - serialized, err := utils.DictsToJson(dict_rows) + serialized, err := utils.DictsToJson(dict_rows, nil) if err != nil { return nil } diff --git a/flows/artifacts.go b/flows/artifacts.go index 5e2ec5b4be7..081b3413eb2 100644 --- a/flows/artifacts.go +++ b/flows/artifacts.go @@ -132,7 +132,7 @@ func flushContextLogs( // Append logs to messages from previous packets. rs_writer, err := result_sets.NewResultSetWriter( - config_obj, flow_path_manager, false /* truncate */) + config_obj, flow_path_manager, nil, false /* truncate */) if err != nil { return err } @@ -161,7 +161,7 @@ func flushContextUploadedFiles( collection_context.SessionId).UploadMetadata() rs_writer, err := result_sets.NewResultSetWriter( - config_obj, flow_path_manager, false /* truncate */) + config_obj, flow_path_manager, nil, false /* truncate */) if err != nil { return err } @@ -261,7 +261,7 @@ func ArtifactCollectorProcessOneMessage( response.Query.Name) rs_writer, err := result_sets.NewResultSetWriter( - config_obj, path_manager, false /* truncate */) + config_obj, path_manager, nil, false /* truncate */) if err != nil { fmt.Printf("Error: %v\n", err) return err diff --git a/go.mod b/go.mod index cba76259b8f..62cff3942f1 100644 --- a/go.mod +++ b/go.mod @@ -113,12 +113,12 @@ require ( howett.net/plist v0.0.0-20181124034731-591f970eefbb www.velocidex.com/golang/evtx v0.0.2-0.20200610130036-cc23ac7defb8 www.velocidex.com/golang/go-ese v0.0.0-20200111070159-4b7484475321 - www.velocidex.com/golang/go-ntfs v0.0.0-20200706125523-d4a342d6d0fb + www.velocidex.com/golang/go-ntfs v0.0.0-20200726152114-40b3dfbc3d5c www.velocidex.com/golang/go-pe v0.1.1-0.20191103232346-ac12e8190bb6 www.velocidex.com/golang/go-prefetch v0.0.0-20200722101157-37e4751dd5ca www.velocidex.com/golang/oleparse v0.0.0-20190327031422-34195d413196 www.velocidex.com/golang/regparser v0.0.0-20190625082115-b02dc43c2500 - www.velocidex.com/golang/vfilter v0.0.0-20200724144634-a3d13a0c4357 + www.velocidex.com/golang/vfilter v0.0.0-20200726131813-04a09f274e56 www.velocidex.com/golang/vtypes v0.0.0-20180924145839-b0d509f8925b ) diff --git a/go.sum b/go.sum index 0ffba662cb5..f426e873f9c 100644 --- a/go.sum +++ b/go.sum @@ -578,6 +578,8 @@ www.velocidex.com/golang/go-ese v0.0.0-20200111070159-4b7484475321 h1:0FELGb4G9d www.velocidex.com/golang/go-ese v0.0.0-20200111070159-4b7484475321/go.mod h1:d3PHzQhyhe+AO9RYBnDKZ40As15T+38zr++Dnv4ufuc= www.velocidex.com/golang/go-ntfs v0.0.0-20200706125523-d4a342d6d0fb h1:ToBfTPwXt5mPRJW0Xi3YYaMKvcGxHd8uYguCNf1xDlY= www.velocidex.com/golang/go-ntfs v0.0.0-20200706125523-d4a342d6d0fb/go.mod h1:1sqoU8u2Jchwiqsbz4yMSq061wEAOcyXhTCfm6Gz3Lk= +www.velocidex.com/golang/go-ntfs v0.0.0-20200726152114-40b3dfbc3d5c h1:9RIW0bahL8NMs3DYJ00DVpMHVkzQNdLAC9rgn6tZR5U= +www.velocidex.com/golang/go-ntfs v0.0.0-20200726152114-40b3dfbc3d5c/go.mod h1:1sqoU8u2Jchwiqsbz4yMSq061wEAOcyXhTCfm6Gz3Lk= www.velocidex.com/golang/go-pe v0.1.1-0.20191103232346-ac12e8190bb6 h1:t+4cuel1gs9H854UvXSVwL/Ph7wAhGUq8xNEiEuG7x4= www.velocidex.com/golang/go-pe v0.1.1-0.20191103232346-ac12e8190bb6/go.mod h1:vpdQNvh2GfQT5NNhtpyGirOSYGTy2IJheePUBpP/zHs= www.velocidex.com/golang/go-prefetch v0.0.0-20200722101157-37e4751dd5ca h1:wQlRPcnpblrt/xc5rSe6a0K/Rh7yDEfwD0/qMrnOTrI= @@ -592,5 +594,7 @@ www.velocidex.com/golang/vfilter v0.0.0-20200723160455-c481438c81fd h1:Hlf4kKRH5 www.velocidex.com/golang/vfilter v0.0.0-20200723160455-c481438c81fd/go.mod h1:mABF6rGkfq9qwvo2SppBxYonhnd8OPSA6rxzzl75A4Y= www.velocidex.com/golang/vfilter v0.0.0-20200724144634-a3d13a0c4357 h1:59puivp9xI+1suxePMMD5rc4Wp+y7055QfzYyexAEiE= www.velocidex.com/golang/vfilter v0.0.0-20200724144634-a3d13a0c4357/go.mod h1:mABF6rGkfq9qwvo2SppBxYonhnd8OPSA6rxzzl75A4Y= +www.velocidex.com/golang/vfilter v0.0.0-20200726131813-04a09f274e56 h1:q9SqOM9bdniaST9F9HuiPN9SEAboZ8U74pCOKuq0d9s= +www.velocidex.com/golang/vfilter v0.0.0-20200726131813-04a09f274e56/go.mod h1:mABF6rGkfq9qwvo2SppBxYonhnd8OPSA6rxzzl75A4Y= www.velocidex.com/golang/vtypes v0.0.0-20180924145839-b0d509f8925b h1:z5v5o1dhtzaxvlWm6qSTYZ4OTr56Ol2JpM1Y5Wu9zQE= www.velocidex.com/golang/vtypes v0.0.0-20180924145839-b0d509f8925b/go.mod h1:tXxIx8UJuI81Hoxcv0DTq2a1Pi1H6l1uCf4dhqUSUkw= diff --git a/json/wrappers.go b/json/wrappers.go index 74ddc38dd4b..7dabd3b12b9 100644 --- a/json/wrappers.go +++ b/json/wrappers.go @@ -8,6 +8,9 @@ import ( ) func MarshalWithOptions(v interface{}, opts *json.EncOpts) ([]byte, error) { + if opts == nil { + return json.Marshal(v) + } return json.MarshalWithOptions(v, opts) } diff --git a/magefile.go b/magefile.go index ec3e32d0929..03b9826cec3 100644 --- a/magefile.go +++ b/magefile.go @@ -157,7 +157,7 @@ func (self Builder) Run() error { func Auto() error { return Builder{goos: runtime.GOOS, filename: "velociraptor", - extra_tags: " release ", + extra_tags: " release yara ", arch: runtime.GOARCH}.Run() } @@ -205,14 +205,14 @@ func Release() error { func Linux() error { return Builder{ - extra_tags: " release ", + extra_tags: " release yara ", goos: "linux", arch: "amd64"}.Run() } func Aix() error { return Builder{ - extra_tags: " release ", + extra_tags: " release yara ", goos: "aix", disable_cgo: true, arch: "ppc64", @@ -221,7 +221,7 @@ func Aix() error { func Arm() error { return Builder{ - extra_tags: " release ", + extra_tags: " release yara ", goos: "linux", disable_cgo: true, arch: "arm", @@ -240,7 +240,7 @@ func Dev() error { // does not include tsan. func Windows() error { return Builder{ - extra_tags: " release ", + extra_tags: " release yara ", goos: "windows", arch: "amd64"}.Run() } @@ -248,21 +248,30 @@ func Windows() error { func WindowsDev() error { return Builder{ goos: "windows", - extra_tags: " release ", + extra_tags: " release yara ", filename: "velociraptor.exe", arch: "amd64"}.Run() } +func WindowsTest() error { + return Builder{ + goos: "windows", + disable_cgo: false, + extra_tags: " release yara ", + filename: "velociraptor.exe", + arch: "amd64"}.Run() +} + func Windowsx86() error { return Builder{ - extra_tags: " release ", + extra_tags: " release yara ", goos: "windows", arch: "386"}.Run() } func Darwin() error { return Builder{goos: "darwin", - extra_tags: " release ", + extra_tags: " release yara ", arch: "amd64"}.Run() } diff --git a/reporting/container.go b/reporting/container.go index 406f39a8f41..0d1c89bf7e0 100644 --- a/reporting/container.go +++ b/reporting/container.go @@ -10,6 +10,7 @@ import ( "io/ioutil" "os" "path" + "runtime/debug" "strings" "sync" @@ -35,6 +36,10 @@ type Container struct { Password string delegate_zip *zip.Writer + + current_writers int + backtraces []string + close_backtrace []string } func (self *Container) writeToContainer( @@ -130,9 +135,18 @@ func (self *Container) StoreArtifact( func (self *Container) getZipFileWriter(name string) (io.Writer, func(), error) { self.Lock() + self.current_writers++ + self.backtraces = append(self.backtraces, string(debug.Stack())) + + cancel := func() { + self.current_writers-- + self.close_backtrace = append(self.close_backtrace, string(debug.Stack())) + self.Unlock() + } + if self.Password == "" { fd, err := self.zip.Create(string(name)) - return fd, self.Unlock, err + return fd, cancel, err } // Zip file encryption is not great because it only encrypts @@ -149,7 +163,8 @@ func (self *Container) getZipFileWriter(name string) (io.Writer, func(), error) } w, err := self.delegate_zip.Create(string(name)) - return w, self.Unlock, err + + return w, cancel, err } func (self *Container) DumpRowsIntoContainer( @@ -353,7 +368,7 @@ func (self *Container) maybeCollectSparseFile( return nil, err } - serialized, err := utils.DictsToJson(index) + serialized, err := utils.DictsToJson(index, nil) if err != nil { closer() return &api.UploadResponse{ @@ -373,8 +388,21 @@ func (self *Container) maybeCollectSparseFile( } func (self *Container) Close() error { + if self.current_writers != 0 { + for _, i := range self.backtraces { + fmt.Println(i) + } + + for _, i := range self.close_backtrace { + fmt.Println(i) + } + + panic("Closing with pending writers") + } + if self.delegate_zip != nil { self.delegate_zip.Close() + self.delegate_zip = nil } // Remove all the tempfiles we still hold open @@ -383,6 +411,7 @@ func (self *Container) Close() error { } self.zip.Close() + self.zip = nil return self.fd.Close() } diff --git a/reporting/gui.go b/reporting/gui.go index cc070bb0982..4010a053a82 100644 --- a/reporting/gui.go +++ b/reporting/gui.go @@ -350,9 +350,11 @@ func (self *GuiTemplateEngine) Query(queries ...string) interface{} { written := false // Replace the previously calculated json file. + opts := vql_subsystem.EncOptsFromScope(self.Scope) path_manager := self.path_manager.NewQueryStorage() + rs_writer, err := result_sets.NewResultSetWriter( - self.config_obj, path_manager, true /* truncate */) + self.config_obj, path_manager, opts, true /* truncate */) if err != nil { self.Error("Error: %v\n", err) return "" diff --git a/result_sets/result_sets.go b/result_sets/result_sets.go index 3d804e0437c..8dcbbe57069 100644 --- a/result_sets/result_sets.go +++ b/result_sets/result_sets.go @@ -19,6 +19,7 @@ import ( "errors" "fmt" + "github.com/Velocidex/json" "github.com/Velocidex/ordereddict" "www.velocidex.com/golang/velociraptor/artifacts" config_proto "www.velocidex.com/golang/velociraptor/config/proto" @@ -41,6 +42,7 @@ func GetArtifactMode(config_obj *config_proto.Config, artifact_name string) (int type ResultSetWriter struct { rows []*ordereddict.Dict + opts *json.EncOpts fd api.FileWriter } @@ -52,7 +54,7 @@ func (self *ResultSetWriter) Write(row *ordereddict.Dict) { } func (self *ResultSetWriter) Flush() { - serialized, err := utils.DictsToJson(self.rows) + serialized, err := utils.DictsToJson(self.rows, self.opts) if err == nil { self.fd.Write(serialized) @@ -68,6 +70,7 @@ func (self *ResultSetWriter) Close() { func NewResultSetWriter( config_obj *config_proto.Config, path_manager api.PathManager, + opts *json.EncOpts, truncate bool) (*ResultSetWriter, error) { file_store_factory := file_store.GetFileStore(config_obj) log_path, err := path_manager.GetPathForWriting() @@ -84,5 +87,5 @@ func NewResultSetWriter( fd.Truncate() } - return &ResultSetWriter{fd: fd}, nil + return &ResultSetWriter{fd: fd, opts: opts}, nil } diff --git a/services/server_artifacts.go b/services/server_artifacts.go index 016215a3eee..106a2d320ce 100644 --- a/services/server_artifacts.go +++ b/services/server_artifacts.go @@ -305,10 +305,11 @@ func (self *ServerArtifactsRunner) runQuery( name := artifacts.DeobfuscateString( self.config_obj, query.Name) + opts := vql_subsystem.EncOptsFromScope(scope) path_manager := result_sets.NewArtifactPathManager( self.config_obj, "", task.SessionId, name) rs_writer, err = result_sets.NewResultSetWriter( - self.config_obj, path_manager, false /* truncate */) + self.config_obj, path_manager, opts, false /* truncate */) defer rs_writer.Close() // Update the artifacts with results in the diff --git a/services/server_monitoring.go b/services/server_monitoring.go index 66e96c5e631..fe1d8789e95 100644 --- a/services/server_monitoring.go +++ b/services/server_monitoring.go @@ -185,8 +185,9 @@ func (self *EventTable) RunQuery( config_obj, "", "", artifact_name) // Append events to previous ones. + opts := vql_subsystem.EncOptsFromScope(scope) rs_writer, err := result_sets.NewResultSetWriter( - config_obj, path_manager, false /* truncate */) + config_obj, path_manager, opts, false /* truncate */) if err != nil { logger.Error("NewResultSetWriter", err) return diff --git a/uploads/client_uploader.go b/uploads/client_uploader.go index b12fb29d420..91e553c3b8e 100644 --- a/uploads/client_uploader.go +++ b/uploads/client_uploader.go @@ -252,7 +252,7 @@ func (self *VelociraptorUploader) maybeUploadSparse( // We did a sparse file, upload the index as well. if is_sparse { - serialized, err := utils.DictsToJson(index) + serialized, err := utils.DictsToJson(index, nil) if err != nil { return nil, err } diff --git a/uploads/file_based.go b/uploads/file_based.go index c3b8a9a07ca..c24039c31bd 100644 --- a/uploads/file_based.go +++ b/uploads/file_based.go @@ -202,7 +202,7 @@ func (self *FileBasedUploader) maybeCollectSparseFile( } defer writer.Close() - serialized, err := utils.DictsToJson(index) + serialized, err := utils.DictsToJson(index, nil) if err != nil { return &api.UploadResponse{ Error: err.Error(), diff --git a/utils/json.go b/utils/json.go index 493991c6005..02d470b04da 100644 --- a/utils/json.go +++ b/utils/json.go @@ -4,9 +4,9 @@ import ( "bufio" "bytes" "context" - "encoding/json" "io" + "github.com/Velocidex/json" "github.com/Velocidex/ordereddict" errors "github.com/pkg/errors" vjson "www.velocidex.com/golang/velociraptor/json" @@ -57,10 +57,10 @@ func ParseJsonToDicts(serialized []byte) ([]*ordereddict.Dict, error) { return result, nil } -func DictsToJson(rows []*ordereddict.Dict) ([]byte, error) { +func DictsToJson(rows []*ordereddict.Dict, opts *json.EncOpts) ([]byte, error) { out := bytes.Buffer{} for _, row := range rows { - serialized, err := vjson.Marshal(row) + serialized, err := vjson.MarshalWithOptions(row, opts) if err != nil { return nil, err } @@ -72,24 +72,6 @@ func DictsToJson(rows []*ordereddict.Dict) ([]byte, error) { return out.Bytes(), nil } -// Convert old json format to jsonl. -func JsonToJsonl(rows []byte) ([]byte, error) { - if len(rows) == 0 { - return rows, nil - } - - // I am tempted to store the json directly in the database - // avoiding the roundtrip but this means that it might be - // possible to inject invalid json to the database. For now we - // take the performance hit and then think of something - // better. - dict_rows, err := ParseJsonToDicts(rows) - if err != nil { - return nil, err - } - return DictsToJson(dict_rows) -} - func ReadJsonFromFile(ctx context.Context, fd io.Reader) chan *ordereddict.Dict { output_chan := make(chan *ordereddict.Dict) diff --git a/vql/common/yara.go b/vql/common/yara.go index 72a4c6d7223..abb8d38e18c 100644 --- a/vql/common/yara.go +++ b/vql/common/yara.go @@ -1,4 +1,4 @@ -// +build cgo +// +build cgo,yara /* Velociraptor - Hunting Evil diff --git a/vql/json.go b/vql/json.go index bb9e8a60337..9906d7016ed 100644 --- a/vql/json.go +++ b/vql/json.go @@ -11,12 +11,17 @@ import ( ) func EncOptsFromScope(scope *vfilter.Scope) *json.EncOpts { + // Default timezone is UTC location := time.UTC + // If the scope contains a TZ variable, then we will use that + // instead. location_name, pres := scope.Resolve("TZ") if pres { location_str, ok := location_name.(string) if ok { + // If we can not find the time zone just + // ignore it. l, err := time.LoadLocation(location_str) if err == nil { location = l @@ -74,8 +79,9 @@ func MarshalJsonIndent(scope *vfilter.Scope) vfilter.RowEncoder { } func MarshalJsonl(scope *vfilter.Scope) vfilter.RowEncoder { + options := EncOptsFromScope(scope) + return func(rows []vfilter.Row) ([]byte, error) { - options := EncOptsFromScope(scope) out := bytes.Buffer{} for _, row := range rows { serialized, err := json.MarshalWithOptions( diff --git a/vql/tools/collector.go b/vql/tools/collector.go index e55753a062f..414c5e8fbab 100644 --- a/vql/tools/collector.go +++ b/vql/tools/collector.go @@ -106,6 +106,7 @@ func (self CollectPlugin) Call( scope.Log("Will create container at %s", arg.Output) + // On exit we create a report. defer func() { container.Close() diff --git a/vql/windows/authenticode/doc.go b/vql/windows/authenticode/doc.go new file mode 100644 index 00000000000..4fc3b534e90 --- /dev/null +++ b/vql/windows/authenticode/doc.go @@ -0,0 +1 @@ +package authenticode diff --git a/vql/windows/dns/doc.go b/vql/windows/dns/doc.go new file mode 100644 index 00000000000..1ffe03d57b3 --- /dev/null +++ b/vql/windows/dns/doc.go @@ -0,0 +1 @@ +package dns diff --git a/vql/windows/process/dump.go b/vql/windows/process/dump.go index 24aedf8bd3e..9cc3f62a3d5 100644 --- a/vql/windows/process/dump.go +++ b/vql/windows/process/dump.go @@ -40,10 +40,6 @@ import ( "www.velocidex.com/golang/vfilter" ) -type ProcDumpArgs struct { - Pid int64 `vfilter:"required,field=pid,doc=The PID to dump out."` -} - type ProcDumpPlugin struct{} func (self ProcDumpPlugin) Call( diff --git a/vql/windows/process/handles.go b/vql/windows/process/handles.go index b8916199090..99f560c758e 100644 --- a/vql/windows/process/handles.go +++ b/vql/windows/process/handles.go @@ -22,6 +22,10 @@ import ( "www.velocidex.com/golang/vfilter" ) +type ProcDumpArgs struct { + Pid int64 `vfilter:"required,field=pid,doc=The PID to dump out."` +} + type ThreadHandleInfo struct { ThreadId uint64 ProcessId uint64