From d67d6ed81efc8a37bbc49c503adcadcc0af470f6 Mon Sep 17 00:00:00 2001 From: Andrei-Claudiu Mihai Date: Thu, 23 May 2024 08:40:12 +0300 Subject: [PATCH 1/4] lab11: ex1: Add solutions for exercise 1 Signed-off-by: Andrei-Claudiu Mihai --- .../buffer-overflow/1-data-buffer/data_buffer | Bin 0 -> 8192 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100755 laborator/content/buffer-overflow/1-data-buffer/data_buffer diff --git a/laborator/content/buffer-overflow/1-data-buffer/data_buffer b/laborator/content/buffer-overflow/1-data-buffer/data_buffer new file mode 100755 index 0000000000000000000000000000000000000000..b14f5fbd91fd389919431a63a789f916f32c8ba6 GIT binary patch literal 8192 zcmeHMU2Igx6`s4hCY#1A3vmMk(yWV}LJJq$kl-dE-34PH1;>DaQVN${@7*7miiBxSBHC3BDRP6(4Q-xMh(pFAPAyh;nN&8%yfNByd5#_fku>HQ7JLcLD zDOH~;d91VNoH^f|nK^gn-ZSGzR;=kX3`6MR6MjK0S`7pjgSX$REQ>`%+$iRXX3-=j zp^CP}dw>B&(0~*`9mx;sf!?z>5G36UokSa|C4mWnwxoOEkW|OIu(H=r5u*NQfgmY` zMi~(MrQHYC0DA*$q!H*O+VvQS&!BHo2kJ@M)_u-NM$uVxe;`PbbMe^M!4CDBasz76 zy;u*scYGhBjzs^Q-@;rru`rihkjoY-yUcRYY*RM2rF~`BM*ONcaV{)u+W=zhXn%Im zxql?Pet6=!neo-B*T3`9Cx6^{nOMe%K4h#SA_7s$&wcZqAx`80iUP6mECH^zx2oXt)qqFt%t5}x%W1gQR* zK=1|t!{i7`133n{p?V=W@-o1Chrf245C^N5YPH(_A*XJn6P49t!L7rhc4q+ST5}M; zbX#ktw+zMeX8^A?(`$yd^QWaw?->s1{E*Z+iqv5?U}^p5_5**fp1s)Jvwma_^u5E+ z&lX~^8aY?1bq`jD&VsGmbYf`7zCf^hPmS@9+nsqN?y3S@WWU?w9h% zX?l?zVm`Ar9ynLM(2!wm?R526_~h_`j|YGM6`DU79y}_aqpQpI3y6H>Q{RDCUwQX- z%^iFpjB$>AA!1TX0qymBAp)KLSD`KnE<(Z1Q2qT=ZgK*<#5Zoe=c{c^UuL@=P!brqs3ETc zaaEte7`B0nSSYyP7Yo%t?vI7Sj|F0(hH70`D3T2|#X@sCLi0O9Eo(!Om7#{%a3~x* z9;%O>2nAz*3SnQ-|54C~@TJE^mlI_o0uvFKh`>YyCL%Bqfr$wGzek`OIeG-dGYF|3 zbn4MS5Qh-agmchL)*<^xo+;03JWqw8GiO7ZBtE)QD;~jlleyr0wBvd76!b5EuLJQs z#a!x(AQtA30?93Nsu>{Wg;PP(K}XS^@)2;J#hBOe3{8$Stau3ZNGFRN=SA?{&>{ZU zh39A8XcEr+w}9>d>AJfAu_P*~lwFEs%Xf=Nb4%N|aJpT-{O-uyjfqOZsYI5TcbY8= z7FDFyy1TXAY*{={)yh;@rJD?{5IjOLjJkv%$PnrZu@sWq!XWxLAR3c#CvK^cnDKI6 zbj3ETjkKAqi_DfbVeIh{E1eiq@i)x~Px1$wgE!+j`b;s^i1I;h2KnU?*)aYcnk;Z> z;;s|p8voK)opkG;ZZs}xS-3FWxU_Z4mit;3rsp(*H!8K!hZ8T|eD1>g6oS<)jk@Dd zx|;aFs9lAI>rvTN5V;Q)y&8<KV^obN>H#P@^q{YTwEe0iqTh5i2$3eWLsU(67{h91=b z*k6FmlfSmV2Av0ft^Wl&5Bpj_1KrkJ6aBvneV<1sP8at75tR1F^!U_z@Y?-opy$W8 zX#;e<9t^C9+o0?D(cS`GuQ$G#mqX|Knm!Gzk1fz6SbyAk(=fg)^uvfZciJ>xNcZ(^TT|83cKE~#5cph{mJ?AesDhY ztMi#D+M(-LYZ&;Y(6xV#k9T*c-1oyYejR&DPT9c+!|WAFyJV-cWydaAPTuOx6$^G5 z*N4fXmCh9t@tl=(ilwp@uj~@N#e84RcI>3Nq^*6?^+8rDTgY1RQYqeV*#)Q6FH)s= z-nNpJe7+w|JemchGX^^T^P#>ZB4-zb64Asd6|KBoF2~chNc20ll`59g8iC@^TebxGA<)ta3f9 z>R2zVm1`bY7F%OI(Al|RMUT}JTefBey~-=u-f~680s5}?yUeuhSbe>glc^MTnu%TR z{cSYrxvsT2b--l=RHwY^9fKKrr3-AiXl3GsWX>LcOMK1E@K`^iV`K<~mCRWsJ6G(D zBbeyg$@W@(S@=x#S()!)Oo?(?T_g*6$!u9YYnQuG6lS?U@5B?}PD$~MmhhU&WjE`V`zL% zCPE@iY==CSIO^;~C5E#S@8={h-$H-wRvIa(ie6&xCJ? z&sX>r;?DjsL(j(Is?EpX%M)^bwK_Y zc`^Ml2Rh>VQ(2F~5!(e~ra~NZqf@}`fXr+NqV&g{eG`Zo6>;eyn~W06vK_>{ zoH*uEyCLwqtovm>X(xzzJZ0ushaf~Cd;5hd9s)7bBJK!qMVwy7N2!96dZ?N-O z5XW4E|JNLG>%gQh&g(}Yj*mFztd~B+AKPl2%vBIrmAS%zqR00>WQ}8vG6T48ON9E- zbNU1-`)9xWwwHioEOns|mP;VYEmTm5o2NwiOB<;UKjgYR4O~Pk;M&IAOv^OC44gNk z)3&B@xYvP;UB@4DIo*cl5RMPt3|-sq8;6?*+}7*(yMG*R05}~p!WlD`&Es%~fWr_+ xi|&`)8`qxzcM%Tfp#E+UeX||+IG=?shj46J?P;j}q4^lxU$F=h+6bE#{{uwP`T_s| literal 0 HcmV?d00001 From 6f1040b5a21ddef3b84ca5cd689da03f47df1a9a Mon Sep 17 00:00:00 2001 From: Andrei-Claudiu Mihai Date: Thu, 23 May 2024 09:08:17 +0300 Subject: [PATCH 2/4] lab11: ex2-3-4: Add solutions for exercises 2-3-4 - Changed the limit from cmp ecx,64 to cmp, 80 so the local variable bytes and other stack date that come after the buffer to be displayed - Used mov byte [ebx+64], 0xEF ... mov byte [ebx+67], 0xDE to write each byte of the value 0xDEADBEEF at the address of the local variable Signed-off-by: Andrei-Claudiu Mihai --- .../2-3-4-stack-buffer/stack_buffer | Bin 0 -> 8156 bytes .../2-3-4-stack-buffer/stack_buffer.asm | 8 +++++++- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100755 laborator/content/buffer-overflow/2-3-4-stack-buffer/stack_buffer diff --git a/laborator/content/buffer-overflow/2-3-4-stack-buffer/stack_buffer b/laborator/content/buffer-overflow/2-3-4-stack-buffer/stack_buffer new file mode 100755 index 0000000000000000000000000000000000000000..dd36196880c83f6d8e8d1600152b743ea12c32ff GIT binary patch literal 8156 zcmeHMe~gsH8J=%yC~1sZ0~|eyB`MmZ|1?orF*z)x7_7A|W&1ocJI8ki zCicJnadUZh=9%}IcV^yi=KJ26d%AsfhhZ2(Cy($7qDa~2UyQu=cBNS?LgIQcUo?n% zF%?zRE#3tVB!mVOAL=MxNH=izZl9lWGcbiZR7*i71lm#_he65|)&-Tm<|ZL(e&q90 z?nk4g5cW&G2U#ujwa`&UfhpAMF{Hpxp>IkX>M2^+^^ud=qI3d@Q!cR4RK8J5xqGP+30ae{5J(?(>0N zY4GEhW-AS}mSXYjY0xVTw3?#s>?w(9J;foNJuERtksM+JrpEJ6?E7>1%!RJ*^`mov zcMtz^ju3<8$VZh**I@bd8D#4=9Y4J7S)ada^yjef>HazO!^t7_H*|5Vs4Cn_*1X<^ z?wk4J)W6OSF`wBR_kC18SDRvOIe@1p*9BGaGZKO5& z_DE~XDfh7Qwli{h9jtgRccKkI~=#r&1X#*PwXU$dSvQ zJ)b!ZjTJTT@;Tqeic`Np%8PH3Q$B9MJ6oq?zSO6h5T9MAv9Tyd>4#=4>{N08RUEqFd0v-7sgJ%F}ud++spNi zIxH@667BVSBLqzQ^HCQ;E&~3JK+PjJO>=zx;^EsLyt}FXt8CW|X#+Dha3B~R3DiW7 z2mI0B1hDUD{}AL;*wW*o$;mY7fk_WcdSKE6lOCA#z@!KM-#yTU7(E2x8H7>;Ir)sw zk3)!P!#QXc>k$1Tj+Ey$o~MGqjL8rNiN9a2>mWQ&F;=<- z!o(O+AY5h4G!w$OZ#v{Q$RV_6`5wpt*sA)=5LIba!x6< z#JtZ8FTA%TQR7pMOU>}&yHu?VT~&BUXW{q_S3j-$K^}lemyFdtgi^JILG}j_Dsi^# z*>0(!nXzJ4bVfI<2{oCG_nP4*VeImdEUg&R@i)T=PWAd5{5RvlcuXMIL^#IlO35b6s^tl~g}DQ9Co+b)+pi?=xZ4x9=Ud=P^2+7y#<+oSC9n933$eZXc7`}KL0>1| zLAuf>KB>^dFID~Pfj_xnPP=d&FyCKnL;Vuu@}!R35VJ%Fa=x#S0oRHwa=!D3$sa(@ z_ZzVR|ME<#6Z`)u01xL}&<5UEZzJcKT;q3uc^=pJkH9>RYkVHKq<1Fz`v>rkU6?$b z*dI2J*!-Lxk9z)YeGqy*AHE&yfc5h?@ci!v*7Kph8JPEd%Eolj1<>(j(-mHy!ipdcW0Kk9r|6EkDMRo z^E2pq&r3b|O;B(@a=yIpTLye(KC=WbAoZIy2>v6$+CIlu3w*NrKA6F;T~EO&I{1K? zJtAQj?A~1|bxl$&BTT5JU_VW9uIaVx}(3E5v6t+?KpsHwD9qXfO+O77^Hp{}W#tkJQ zthOzk(KRbu$7|%xDXMS{Y_+ebT3FGxURcXluWgC0w$^rZY-sPcx}zR!`Y z^`bC~16d~)NA46>KSB1WeBTP9P6GgK(59rwa_~qIJColbL+NtVlOeJ7K zBh^$bOVvV`(LpSm?m_2yhn6ukJ|`0{5hnIV7V8~#cD&S!Cb3*EHc}P#mEvf71*db# zyw=6y@q)cWBm8T^)@8X@G{7_A>)=ZzegXLk!nRlc>j7YlsuOigb0Lg2$dmt*fg*&m zPAYQ2w*wWL$2ey%c=eiuT=Uvc{tPiM?J@p2Shc4j9>pWK6T&EkJjO*Q!P|y1BOw%} zJw_dyAdIHSTY&f10uwk;4&QngkKe^MOh83# zimAuF*L`2&Q}E2b&qkKh;ZK7gLjf;`40{Ga7$wGNrI#d&=fLO+woc=gg3*kfDGlW_|i ztD;sYko5RIL0R({ugnDRZplzTdQObL*gyN_cfJKY*JG15*y0j|_QC{6ug1A;fr;Gmu2pAFw literal 0 HcmV?d00001 diff --git a/laborator/content/buffer-overflow/2-3-4-stack-buffer/stack_buffer.asm b/laborator/content/buffer-overflow/2-3-4-stack-buffer/stack_buffer.asm index ce109d6d..963271bf 100644 --- a/laborator/content/buffer-overflow/2-3-4-stack-buffer/stack_buffer.asm +++ b/laborator/content/buffer-overflow/2-3-4-stack-buffer/stack_buffer.asm @@ -47,6 +47,12 @@ fill_byte: cmp ecx, 64 jl fill_byte + mov byte [ebx+64], 0xEF ; the least significant byte + mov byte [ebx+65], 0xBE ; the next byte + mov byte [ebx+66], 0xAD ; the next byte + mov byte [ebx+67], 0xDE ; the most significant byte + + ; Print data in buffer. push buffer_intro_message call printf @@ -67,7 +73,7 @@ print_byte: pop ecx ; restore ecx inc ecx - cmp ecx, 64 + cmp ecx, 80 ; change the limit from 64 to 80 to read beyond the buffer jl print_byte ; Print new line. C equivalent instruction is puts(""). From 6fbfa40397f54515e94d1c9120a64e12355ea182 Mon Sep 17 00:00:00 2001 From: Andrei-Claudiu Mihai Date: Thu, 23 May 2024 09:23:18 +0300 Subject: [PATCH 3/4] lab11: ex5-6: Add solution for exercises 5-6 - Created a payload to exploit the buffer overflow vulnerability Signed-off-by: Andrei-Claudiu Mihai --- .../buffer-overflow/5-6-read-stdin/payload | 1 + .../buffer-overflow/5-6-read-stdin/read_stdin | Bin 0 -> 8256 bytes 2 files changed, 1 insertion(+) create mode 100644 laborator/content/buffer-overflow/5-6-read-stdin/payload create mode 100755 laborator/content/buffer-overflow/5-6-read-stdin/read_stdin diff --git a/laborator/content/buffer-overflow/5-6-read-stdin/payload b/laborator/content/buffer-overflow/5-6-read-stdin/payload new file mode 100644 index 00000000..378f94e2 --- /dev/null +++ b/laborator/content/buffer-overflow/5-6-read-stdin/payload @@ -0,0 +1 @@ +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFLOW diff --git a/laborator/content/buffer-overflow/5-6-read-stdin/read_stdin b/laborator/content/buffer-overflow/5-6-read-stdin/read_stdin new file mode 100755 index 0000000000000000000000000000000000000000..098ab656b3e27b5b0f1f8c7f83c020b158eac6d6 GIT binary patch literal 8256 zcmeHMZERcB89t6(Fkp-m!U(jC8=A0mP~)V97FcN9e3Y`Zq-|1&pxoN=b?o7f%)TxO zLR&i1(o!--)3i+jiS8E~Vo+%ns#rIrOGn$OKROUUwjm8hk;3RS5DY5T#e1G}?n!P8 zNbo-=dVSvKyw7>h$35rX_niE&ySK;V@d%x2gjWz9Ec^Vck&j-hEUSefE)gxFSu}}@ zP(<76ad038Do}hVqj(|x!2P>@e#(`=6xvWM1(^`2OF0dPlqD<+DSO}wAp+0({FFgd zdJw{PX|F+64|_dqlo?8)sjr>zN=fETX)H9(y zlulnxYZn311+0yW(7C`tpZ{W12r zFH|a(JyZ6QnIsC!$NdjXi^{D&uq(}e{IZQoGrgy%zV{aBm1ee*qV2si60@}wAN_k% z60_A*1Mwk=*?P(#J}5DJoty-gsr6qE?SH#`_Jh9utuxC}vU|D@U7IK$dbd*Pn<)1& z+p_({)YRiXf8WfD@bK}0Wlht`N%c4R(VVIZ+(wohNul|6{@6`N*doTebYTCx<#Y8Z zmR8P`kB3f8@Bd`t=(lM8XnNxCjZ_>g>#rp9*!i0Me>nEf>pf@weBL%*A!pBP_SMo? zs82b2O*)&fZ=|1>Nf~dqP*;=`&p(sF2wq*nGS8{$iCv#-5AJrn|D+yXa#FhYmCtpY z=)Um#S7!f|YC+YRlA2D`Yzkj*O$77 zmKD+x7>wSz>BwVmr}|lTt70GMzR;H%V1Z8-_)k?$@8rOJ+qcd99LC+#&tbon&jk)- znp!4)6T-M=p8j8@GEojdUGeI%*_u6{*v+jKH4o);zJZF}bhDJ7{+68b2@j_0_Sw=q z<>P?|9x`{R`Eb_hD%nOS+u*|Fd&7gZ?^)`-GXkCOhn;9{C-N!ek0TGEN-y$pIR6E5 zuGh23`QBmjJi1kQ9`k#a27JDK+%G7@ViQMEU%#geVER9gy|ELy2>N@1fqSmF%=V3n zb=Thc?Y5>HSg#+l8ujERfqplHyW}nOVFz*%4f^-gM1z4RywPB2uP+*`FE7~~G}6JQ zXt1R#cym`UvMFe62-ZiZgQ4iF!9esx&>#I{5c`?_4?{kNFWoP?Tuh5Ius8#YGq5-V zi!-n|1B)~8b!XrZV(4**I$Pk}00#k_gK?-3hjGrih8WTLQsf9jcLpILz0kPki8IXOXrGK!8YQhWYQ`aIKHKG z!*>|M!Rg{1!f1}P-QUtYv_gnov4W8<8j;cF$lCiazf^4K?7YKh8Hks1cF9;1zBL?K zxvC^l>knGjh9j$2s8Shis)&yBiO3aCW4G=C@*qUc+FaRppgA=>WJmFwXe?NBCctzdBFoBCo&Me9=tBZGtM zV1r(RBP^fbS5Lf8AzR(js5=gY)hz6rv#WXHdQ^5bqg;;)bCs%fsxXHvgkDEpd8>ff z-&t2)x$@L{RQyXMpX*d%u5z_s6y|EjS;1LDUb&lun4H7hRapLWn9o-2Gv;1_3m&AC z&hzxjoulq-SnicO1^aHVZlAkE?N8=jxm&Q`ob~N>PC0tLd!1d#)3)M&gPGiq%)D|J z3SnS>D$FCh5ImVG%(uaO@-DbtVSThZ8yGd9zgSoZ&qRV?F{WkmAw(ma6b9O zhZVlBgtM?~uva*v9WLAmJnq74fH@xe@rY|g4{|+U9?Vx3nD0bn*keI4hMey|Vh`q* zXGopc{&N64ek*?s@{Go_w#KJm=LuWmH-LG%*7$8;9%{iFC^+dn ze~(bl-)*mjU5|%v&l`aC^Y`HS-vq43L;GF8ybn}9YQ+{{zMqLbSP#R%hhXPUt3!Vt z0sa8%mpiMjCMb>o>-A!Y1~I|z>>-7`@|NFrF&ag@y*8j`E+8^!HRrOzY zVFPvk0o>&Dx3;E1{2SPPKR4^*vp*sA%7Di9gjfmOhxYlc;`puupEos)XFY|$&jM@z?C%<2es9@c9lw@C1-oeD zixVCa39DcYr;D~#Fzu{4l*#9;BCZG%d2=|EkH<1*!p;|pW~?+ShVt2wjAdJi@S3)@ ztG<|ICeyjJ87mZGW2Tj}3u7W#h-ED^QOah=P{oBzFzp4@s&9*gS*uu#4O`9!5q0cB z-kd8Ovn?~3FJxo3$dxh~e3}K(J_BP%S&B1HmyX=j-fg;b#E*0d>3#QUh0Bd z%$q5UJ%h0>yfao;#0x7|-4=g=k)z-w2{Vx~3sxpS6vNzOM(p&EIg&;z$q_U42znVW z7M)JYi)Yj9-_+^Mvj`W*vUV(v+%Bj*r8PWRt1u$Mxx8(Kqw6=Wv}3~#8qSr%@lqN$ z|LKGX6QyFsln5ura`2~eyPzz)tU@uJ&n*BZZ0IuiN*T%6A}mJ}h8iBu1KQRoez|@^3Dl;Ws6kJGtiUfW{vc){AG5&rvOXb8>qHyV zatQx7LZ1A;4-5u$omBKAL@Nq3kFnA|@R~FUx#o32{{(S0{V|4m!SSb}CdDI{|1)8v zLmp$R)8LImXEX&>`eV$$9pZ(M$Fo5%6nPH{%tS8JLlDOG<5}WOD15|8H|r#L?shfrB^Qse0sn8f8f7|Z-tSPL{V^u>VS-L- z5^~Ku0bQSB7<=&lh}uRvb;|1yM!*=RjA24w!uvbyd=}&}w&DLpXPh!*(ig||GYI=f z9%J4MU*eB-HBZJqm{hyu-HjADS-tx3rBm_CKh_Svolo&_Fto#=z<0)%>m z0ExU6N|nE~QI_C`xlTU@&(Hw5w$)ehUIdRZj!v4_RK=SDuS1iNYhI*^$K!`P!q+^; zkXomkrQoH$z~4PpynW#5IU}8O#&lm5? Date: Thu, 23 May 2024 09:39:40 +0300 Subject: [PATCH 4/4] lab11: ex7: Add solution for exercise 7 - Updated buffer read to use fgets() - Ensured buffer overflow still functions Signed-off-by: Andrei-Claudiu Mihai --- .../7-read-stdin-fgets/payload | 1 + .../7-read-stdin-fgets/read_stdin_fgets | Bin 0 -> 8312 bytes .../7-read-stdin-fgets/read_stdin_fgets.asm | 95 ++++++++++++++++++ 3 files changed, 96 insertions(+) create mode 100644 laborator/content/buffer-overflow/7-read-stdin-fgets/payload create mode 100755 laborator/content/buffer-overflow/7-read-stdin-fgets/read_stdin_fgets create mode 100644 laborator/content/buffer-overflow/7-read-stdin-fgets/read_stdin_fgets.asm diff --git a/laborator/content/buffer-overflow/7-read-stdin-fgets/payload b/laborator/content/buffer-overflow/7-read-stdin-fgets/payload new file mode 100644 index 00000000..378f94e2 --- /dev/null +++ b/laborator/content/buffer-overflow/7-read-stdin-fgets/payload @@ -0,0 +1 @@ +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFLOW diff --git a/laborator/content/buffer-overflow/7-read-stdin-fgets/read_stdin_fgets b/laborator/content/buffer-overflow/7-read-stdin-fgets/read_stdin_fgets new file mode 100755 index 0000000000000000000000000000000000000000..630ea8d035d9faae1336e1f03b9772643465e098 GIT binary patch literal 8312 zcmeHMTWnm#8J^=^hXtHvlekSnXgRKJ>QJ&-I|f1`lWbx;1meWRHejJ}yz4!CDSNSY z&n7mat|(f-M$H{M@< z^ZReT`(Ea$@tm_?o54LLsy^b-3?cSsgj;^J~V634=XWu}L z3D#4({z~Nzx>KMq;)kegasA=6^nP?5)y;54wBz zPt_yk@PvtKj+M^8Q!aOpl}4%Vz3=S!2akDu-BZuP!^g*OXqbqfP=6;rnvJT2N+VNV zNTT>Q{x}UUutc-7^)H zX*E4lBg)vF+(znFg__SbkAwcC_u6~AyOVd*Ql~QXhqrdU@aS8~UZ!nO?Bg9X-N`;C z%>0KX`OdlBe4_9E`+BB+2-e|=Ls*NYOEt&S4NYUe4WM09-vN27RDy{R2bOwZsRx#NV5tYr<4k-C!g~Xy1`@(O7#9a|0e2kS zX5^i89W;&=f_J9?PTxH95dZ5+Id>BGO?j63ChiwVn*_cFItJlgiD!||K^S-j6F3y| zOwt75xoQPuHN=N<8J~t9-m{pGcW9oEaE!^liF6#ta;)bE&}V=V{mg;)XPxOF%6uI1 z6yz6>=ONmb$`b!3vn=#H&X>OG~5{4 z{J`>S#IBt?x0p?R(PGvqnzsjU4Td&sDoWJ+_2$jNQ0sb?Do>Bea~NcgV4P^o+mV=i+mzSJV5E={d&50lW=pVnQ!vybjL|A)ke-Yc_*-cN zmU(=QzEv2%s-Re5Z07)`As+D+{2Io;{mbzyUrW&M#^QxYht<-zXRT4!vVGg3{{B1L z5*zFKx7YQz)dPe!wzbvQ)ge|_*B0vU-_|DMRk*TpJU>g|`wIE$)keK}D6D$r=&W7! z8|SC8s~+b3RG70?hyiyVdE^6$5PDvD}F&8{?u2KRp!q&WY@mO6N7RAk{|bQDYtCsytP#B9^A4@?pMiOE*7$G0 zyftggXBJ+XHNFD8#T|d{1x(k0hr4MLupWN{QwM}4@`R-!&%12)k=Tv;ot{NfM9F5g7^zt8+`;OzYQ z0{lF%?eYWQ9|GoghgnvN>%>dI+8^z&Ey(}Z3Tz_JMc@Y4--@a=;xcgMTV1uBjV>v64&P5|>E9T_#1uIe<7K6FWP}+9vSn&3i&6^e{S@BdhWkvG&$cSZUo&1Q1 z=OY>0iWM`N5oD=A7MRXF>Z0EsnV7K)g-F77Kby$uF-?(=rdAZ0P@m5I;jRv=V{f}<0nMvXOjzyxd&6D3ch0xSmsKR;wb|;p z%k^+q`+i~V+Ouy*c#pNOv$Ln8*Xj-L*waC;@;!F2P?UWGJiPg~AYN>(p+U<@7PAir zqr>h??)L3-Z?*F4TbW?lv4|5vek%2bE8l|Wapphpf?LR0Ni;r<#?F66MknF9cz)&u zFUN}**$noQdVrosh^4K(oz4wLFdFD1CpBmdrBG~q$VwhUwWEcCTWk3$ZCSltJKdfa z!NN$!iA15DywXV>!&uw-ArZ{x96K1^v3r9PNw_GHEe4~-6#iq7iisdmGEzv2U~D7{ ze@Z)fWjSc)3#nXo9G2zPp{{p|Z*nZ^MQ2rkZfahl&Xk(~{@P8`UTGaoGU@#Ha zL7kF>XhwqO@l16Tyar8z*1UGaFXKE;e>`iQbb0D@rFi7-h44f~9?xKt;GIC6M@~eg zKc4yTgLok1@oYALNDOfu$Ypp4!utSuJhPoagx?rlF4HLwLwJ8+oM*W=5it?3EEiBb z0^x~{Jl;X35n+9_KemAzaS1}+4r1)hK2){|aq@VN(Y$XV&bqQ3?%^Tu>Jit0JccJA zn#Z%^0C)p5xPf&b_j?e{;~8=sJo#a8d5lwjRKer7XcD}YY?K@5kKv~f?T_Ew3uu5k zAxiV?`2N!6$$kNE8obJKbvu4t!INhQG`v;0lE0ewQU#A^*H-XeU4(ZQY5Mjf|1XN; zu=YVZe2PEj)jWAd zLdTj&(?QqoLnLS(&oU->9hwBK+w=+IET84_%wdB^tb^%BW}xXW3XE!0ikc^;~M8!=x`d>qwiK^)c%lt P9