chntpw_0.99.6.110511/0000755000175000017500000000000011562552542012070 5ustar jfsjfschntpw_0.99.6.110511/HISTORY.txt0000600000175000017500000003430211562562244013764 0ustar jfsjfs The Offline NT Password Editor (c) 1997-2011 Petter Nordahl-Hagen See README for general info, copyright & credits. See INSTALL for compile/installation instructions. Revision history (tools only, see website for info on bootdisk revisions) * v 0.99.6 110511 regedit library (chntpw and reged uses it): - Hive expansion! Library now does hive file expansion by default! (but you can turn it off, safe mode). If expansion occured, you will get a warning when saving the hive. - There were a lot of goofs by me in the add/delete key and value handling, which made windows complain and lose data. Hope I managed to fix them. - Also, found out more about how Windows does things, for example: - Empty name (default) value, flag field is 0 (not 1 as usual) - Values with data size 0 to 4 the value data itself is stored in the data pointer field, typical for DWORD (this I knew a long time ago), sign bit of data size field is then set. BUT.. - In a lot of cases in SAM, for null name values, size is 0 with sign set. In that case, the data dword is stored in the TYPE field, and the rest is unused. This saves a few bytes of course.. but why? The rest of the stuff registry is used for is often seriously bloated anyway. Did the guys at MS who actually wrote the SAM stuff back in the NT3 days actually do it because they cared? or just because they found something new and exiting they smoked? :) - Large values (seems to be from around 16k) are split internally in several parts. Sounds smart. But it goes via 2 (two) separate data structures that has to be allocated. For regular small values the data pointer simply points to the data itself. For this split large value it points to a "db" struct. This contais a count of how many parts there are. And then the list of pointers to the data parts? Nope. It points to another area where the list of pointers are stored. Pseudo: vk.ofs_data -> db.list -> list[n] -> raw data block n The last raw data block always allocates the whole hbin (usually 16k) it is in, even if all of it is not needed. Of course only the correct amount of data is copied out based on the value length. On new Vista64 bit SP2, this happens at least 2 times in SOFTWARE\Microsoft tree. reged: - On popular demand: .reg file import!! (-I) - Will read files from regedit.exe in most cases (UTF-16) but can miss on some international characters. Also reads "latin" (8 bit) files. - Only one .reg and hive at a time supported. - Did quite a lot of testing by importing for example the SOFTWARE\Classes tree with regedit.exe and importing it again into the DEFAULT hive with my tool, then ask windows to "Load hive" (in regedit.exe). If it does not complain in the event log, it is good. (Also, seems like windows has gotten better at not bluescreening on a corrupt registry hive, did not get a single one when doing this with pretty messed up hives in win7 and Vista) - Be aware that .reg import is currently very slow, since I messed up the design for the string reading badly, and also the add routines is not exactly optimized. Consider it a proof of concept! Example: Import of SOFTWARE\Microsoft tree (exported by regedit.exe) into the small DEFAULT hive took more than 10 minutes on a pretty fast machine. Especially hex data is slow (one byte at a time.. lazy me..) - WARNING: .reg file import does not do much sanity checking of the input .reg file. It will either crash during import or mess up the registry if the .reg file is bad. - WARNING2: Limitation: Be careful when importing keys that has large number of subkeys (like several 1000) since it does not split up into indirect indexes (lh) yet, and windows may not like it. - -N and -E options for safe mode edit (no alloc and no expand hive) - Importing (-I) and then into edit (-e) before save possible, by specifying both options. - -I and -C (-IC) will import and auto-save, use this in scripts. chntpw: - This version has no significant changes in the password (reset) handling part of the tools. TODO list: - Windows like API. Faster .reg import. Fix bugs! Maybe not in that order :) * v 0.99.6 100627 chntpw: - Syskey not visible in menu anymore, but is still selectable as # 2 This because too many people just went ahead without understanding its purpose, and the emailed me when things went as expected, that is it went *boom* - Interactive menu adapts to show most relevant selections based on what is loaded reged: - Patches from Frediano Ziglio adding or fixing: buffer overflow in export_subkey printing keyname some quoting error (name and string values must be quoted) missing support for wide character encoding in keys and value names regedit library (chntpw and reged uses it): - New function from Aleksander Wojdyga: dpi, to decode product IDs Can be used on for example \Microsoft\Windows NT\CurrentVersion\DigitalProductId to find the systems product ID in cleartext. Now as command in registry editor, but may be moved to chnpw menu later. * v 0.99.6 080526 reged: - NEW TOOL: It's actually just the interactive registry edit (still also available in chntpw) plus the registry export to .reg-file from command line. This tool contains no password functions, thus no crypto. chntpw: - Interactive reg ed moved out of chntpw, into edlib.c - 64 bit compatible patch by Mike Doty, via Alon Bar-Lev http://bugs.gentoo.org/show_bug.cgi?id=185411 - Some minor tweaks and fixes ntreg library: - Type QWORD (XP/Vista and newer) now recognized - Most functions accepting a path now also have a parameter specifying if the search should be exact or on first match basis, thus this libary version breaks build with older programs. - Fixed bug which skipped first indirect index table when deleting keys, usually leading to endless loop when recursive deleting. - Export to .reg file by Leo von Klenze, expanded a bit by me. - 64 bit compatible patch by Mike Doty, via Alon Bar-Lev http://bugs.gentoo.org/show_bug.cgi?id=185411 - A few other small fixes and tweaks. * v 0.99.5 070923 - User edit is now menu-driven, better visuals / tables / listings. - Group memberships are listen on the user - User promotion (put into admin group) is now public, with it's own menu selection in the user menu. Still considered EXPERIMENTAL! - Some other verbosity/visual changes - Changed the verbosity (-v) option to be more useful for debug or advanced information * v 0.99.4 070406 (decade) - 10 year anniversary! - Changed to GPL license - Support for Windows Vista was already there, but only blanking password works. - Some small insignificant changes, mainly to output or text. * v 0.99.3 041205 - Fixed bug in loadhive(), caused a crash when last page pointer was out of range, which seems to happen a lot on some installations. Guess it is correct to just assume it is end of file. Thanks to Michael Rothstein for supplying a hive with this. * v 0.99.3 040818 chntpw: - Lot of nasty bugs fixed in REG_SZ and REG_MULTI_SZ input, often trashed the heap, leading to later crashes. - New regedit command "hex" to see value in hexdump regardles of type. - Some other minor fixes on hive load. ntreg: Major bugfixes in key add/delete, and support for more of the registry: - Now full support of key add/del on NT351 ('li' index) as a bi-effect this also adds support for NT4/win2k edits in keys with indirect index (when it contains ~>500 subkeys) since the index tables then switches from 'lf' (semi-hashed) to 'li' (unhashed table). - WinXP and newer uses 'lh' (true hash) always, even when going via indirect tables ('ri'). I wasn't aware of this, so reading or traversing that in earlier versions usually crashed. - Critical bugs fixed in the allocation of space in the hive, older versions may in several occations corrupt the hive. - Fixed some hive load bugs, deallocate properly on close etc. * v 0.99.2 040105 - Added RecoveryConsole parameter change - Try to guess type of hive loaded (sam, system, security etc), this is used by the user edit, syskey edit, RecoveryConsole edit to look up into the right hive. - Do not confirm save if the change-tracking option is set (-L) (assume wrapper does it..) - Hid the hash-stuff during password reset. I got all kinds of confusing questions about it (most often: can I find the original pw? Answer: NO if win2k or higher) Option -v turns this on again for debugging. - Also reduced some other debug output, -t and/or -v turns on again most of it. - Fixed some bugs: - check of return value from open() - corrected prototype defs for some calls into OpenSSL, this fixes some compilation errors people have reported. Thanks to Alexander Poquet for that. - Probably _added_ more bugs :-} but they are yet unknown :) * v 0.99.1 030126 - Fixed bug in ntreg, seems some files has garbage instead of zero pages at end. Now stops enumerating on first non 'hbin' page. Thanks to Jim Andersen for giving me a hive file that showed this. - Reports strongly indicates that blanking a password (* at the prompt) works more often than changing passwords. Changed some wording regarding this. * v 0.99.0 030112 - There is now full registry edit support with expansion of value size and add / delete of keys and values! See regedit.txt for more info on registry editing See source for details on data block allocation etc in registry. - Changed interactive mode (-i) a bit, now features menues. - Syskeystatus/change not shown unless selected from menu. - New option: -N to set it in old-edit mode, ie only exact overwrites. This is for safety in testing etc. * v 0.98.6 021213 - Added parsing of users F and SAMs F value, which stores account type bits and lockout information. Ability to reset it if locked. - As usual, see source (especially sam.h for details) on this. * v 0.98.5 021208 - Added ability to enter RID (in hex) instead of username by starting the entry with 0x. Works interactive and on commandline. This will enable edit of users that has names which actually use unicode, like some russian and asian systems. - Only entering * for password will blank password by setting hash lengths to zero. Seems to be working ok in 2k and XP. This may also clear up an earlier failed change. One bug/drawback: Seems to leak about 30-50 bytes in the V struct. - Fixed bug in handling of blank LANMAN-pass. * v 0.98.4 011022 - Fixed input buffer overflow that made it impossible to enter usernames at 16 chars (the \n would flow over into the password prompt thus not changing it) - New option -L that will write the names of changed hives to /tmp/changed. Mainly for use in my bootfloppy scripts. * v 0.98.3 010808 - Blank password detection rewritten. The NT or LANMAN hash seems to actually be missing from the sam entry if password is blank. This will now be detected, and if only LANMAN is present, it will be convertet to NT password. - Some minor changes in text & prompts. * v 0.98.2 010107 - Changed to use OpenSSL for MD4 & DES encryption instead of the old libraries. Only change of build process from source is to point the Makefile to wherever your OpenSSL libraries & includes are. - Minor changes in wording of Syskey warnings. - No functional changes. - Known bugs: Hive statistics often wrong (but the numbers are not used later, so it's not critical) * v 0.98.1 000607 - Discovered that when a key has lots of subkeys (typically about 300 or more?) its hashtable is split and accessed through an indirect ('ri') table, almost as some filesystems do with datablock lists on large files. This caused an error "Not 'nk' node" and sometimes a crash in earlier versions. In SAM this happens in \SAM\Domains\Account\Users when the number of users are large (which often is the case on domain controllers). See source code for technical details on this. (WinReg.txt not updated) * v 0.98 000401 - Disabling syskey on Win2000 corrupts the SAM somehow, makes it unable to reenable + leaves it in a partial mode 1 syskey. Also corrupts the Domain Trust password, making it impossible to join og leave a domain. Delete HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC (the trust key, may need to change ACLs to get to it) to leave the domain and make it possible to rejoin. - Added support for changing passwords without disabling or changing syskey, simply by inserting old type password hash into the sam. It gets converted to syskey-hash on next boot. Why I didn't discover this before is beyond me. - A few smaller bugfixes. * v 0.98 000215 - Can now write, too, but only existing values, & same datalength. - Internals rewritten, registry manipulation functions now in separate "library". - Added ability to check for and disable syskey. (see syskey.txt & sourcecode for details) - "Command line"-type registry-editor improved a bit. - Possible to load and edit several hives at once - Several minor changes. - Since a lot has been rewritten, there's probably more bugs. * v 0.90 990307 Major updates: - Full registry parse/read/viever. Can follow the tree like a filesystem. No write-support yet. - 3.51 & 4.0 support. Seems to be working on NT5 betas, too. - 100% sure to find usernames/passwords. - Support for localized admin-names (will automatically find it) - Several minor bugs from earlier versions fixed. - Sorry, but still no syskey support. (but since full registry read capabilities exsist, it's now easier to make it) * PRE-1 970611 - Got reports on "Netlogon service not started" (and then it was impossible to logon) if attempt to change blank password into something else. This was because if the password is set blank (from NT), the NT-logon hash (md4) is not stored in SAM at all (the LANmanager hash seems to be there..) However, chntpw didn't know about this, and happily(?) wrote away and corrupted the SAM file, causing Netlogon to fail. This version will flag accounts with blank passwords, and refuse to change it. - The -i (interactive) option now loops. Will ask for a new name repeatedly, until '!' is entered. This enables you to change multiple passwords in one run. - No support for syskey, yet. * PRE-1 970528: - First public release chntpw_0.99.6.110511/syskey.txt0000644000175000017500000001243111562562244014161 0ustar jfsjfsThe Offline NT Password Editor (c) 1997-2002 Petter Nordahl-Hagen Update: 08 dec 2002 What happens when syskey is installed, and how to get rid of it --------------------------------------------------------------- Background: ----------- Syskey was added to NT with Service Pack 3 as a way to prevent easy access to the actual password hashes in the SAM (Security Accounts Manager) The original methods of making and storing the hashes makes it rather easy to bruteforce or dictionary-attack it to find the plaintext passwords. (mostly caused by a somewhat flawed implementation & use of the cryptoalgorithms involved, but that's discussed elsewhere) Enabling syskey is optional, the administrator must run syskey.exe and answer some dialog-boxes to turn it on. On Windows 2000 it's not optional anymore, it's enabled by default at installation time. When syskey is active, the hashes are encrypted/obfuscated yet another time before being stored in the SAM registry. However, they're stored in the old form in memory after boot (pwdump2 demonstrates this), since the old form is needed for NTLM authentication on the network etc. The key that obfuscates the hashes, or rather it looks like something that decrypts the key, can be stored on floppy, generated from a passphrase to be entered at boot, or stored (obfuscated again) in the registry. There's no official supported method to switch off syskey once activated, except restoring the registry from a rescuefloppy made before activation of syskey. So.. what's this got to do with my utility? ------------------------------------------- My utility doesn't try to crack passwords, it puts new hashes into the SAM, thus changing a users password. And it does this offline. Syskey was a showstopper for this. As far as I can see, there's 2 ways to solve this: 1) Find the key in registry, get user to enter it, or get hold of floppy then use the syskey on the new password too. However, it's not documented and I haven't found any reverse engineering of it anyplace. 2) Try to turn it off. This has one drawback, and one good side: Bad: all passwords must be reset, since the old hashes will be invalid. VeryBAD: SWITHCHING OFF IN WINDOWS 2000 AND XP NOT PERFECT, WILL CAUSE TROUBLE, but you can access the computer afterwards. Domain relationships & syskey may be impossible to change after this, requiring a reinstall (or possibly only an upgrade) Good: There's no need for the key (which may be lost). 3) (NEW 2000-04-01, no, not a joke) Insert old styles password-hashes into the SAM, will be converted to syskey-hashes on next boot. This is how syskey is enabled on NT4, the hashes won't be touched until the first reboot after turning on syskey. I've found out how to do #2 and #3. What happens when syskey is turned on, and how to turn it off again: -------------------------------------------------------------------- - 1 - Serveral new keys are added to HKLM\System\CurrentControlSet\Control\Lsa, it seems that most of the keys/values is used for the obfuscation of the key they change when syskey is updated. However the value named 'SecureBoot' holds the mode of syskey: 1 - Key in registry 2 - Enter passphrase 3 - Key on floppy But removing this key (or setting it to 0) isn't enough to disable syskey. There's more.. - 2 - HKLM\SAM\Domains\Account\F is a binary structure usually containing the computer SID and some other stuff related to that. When syskey is installed it's expanded (about twice the size), with something I guess is the key heavily encrypted + some flags and other values. One of these other flag/values also contains the same mode as SecureBoot above. So.. resetting this mode flag and SecureBoot to 0 is all that's needed to switch off syskey in NT4 (up to SP6 at time of writing). Changing only one of them results in a warning about inconsistencies between the SAM and system settings on completed boot, and syskey is re-invoked. - 3 - On Windows 2000 there's yet another place info about syskey is stored: HKLM\security\Policy\PolSecretEncryptionKey\ which also is a binary structure, but also there the mode is stored. Reset this to 0, and syskey is gone on win2k. (if there's a mismatch between the three, it silently resets them to the most likely value on boot) - 4 - Then there's the password hashes. The usual (old) hashlength is 16 bytes, but all hashes are expanded to 20 bytes with syskey, the first 4 bytes looks like some kind of counter. (maybe history-counter?). Strangely, they're not updated at once when syskey is turned on, update of the hashes happens during next reboot after syskey has been turned on. And when the key is later updated, the hashes are also updated? NO!! Strangely it SEEMS like the password hashes REMAINS THE SAME! (however, the binaries in the 3 keys noted above changes..) I'll try to dig more into this. Help wanted :) When syskey has been switched off, all passwords must be reset. My utility will write and adjust hash-lengths of the users (usually administrator) that you reset the password for. NT itself will fix the rest of the hashes when you set new passwords from NT. And yes, it's possible to re-enable syskey after turning it off. (not on win2k, yet!) So, anybody reverse engineered the whole syskeystuff? (yes, I know something's on it's way..) chntpw_0.99.6.110511/chntpw-before.c0000600000175000017500000014347011562552542015000 0ustar jfsjfs/* * chntpw.c - Offline Password Edit Utility for NT 3.51 4.0 5.0 5.1 6.0 SAM database. * * This program uses the "ntreg" library to load and access the registry, it's purpose * is to reset password based information. * There is also a simple commandline based registry editor included. * * 2008-mar: 64 bit compatible patch set by NN * 2007-sep: Group handling extended, promotion now public * 2007-sep: User edit menu, some changes to user info edit * 2007-apr-may: Get and display users group memberships * 2007-apr: GNU license. Some bugfixes. Cleaned up some output. * 2004-aug: More stuff in regedit. Stringinput bugfixes. * 2004-jan: Changed some of the verbose/debug stuff * 2003-jan: Changed to use more of struct based V + some small stuff * 2003-jan: Support in ntreg for adding keys etc. Editor updated. * 2002-dec: New option: Specify user using RID * 2002-dec: New option: blank the pass (zero hash lengths). * 2001-jul: extra blank password logic (when NT or LANMAN hash missing) * 2001-jan: patched & changed to use OpenSSL. Thanks to Denis Ducamp * 2000-jun: changing passwords regardless of syskey. * 2000-jun: syskey disable works on NT4. Not properly on NT5. * 2000-jan: Attempt to detect and disable syskey * 1999-feb: Now able to browse registry hives. (write support to come) * See HISTORY.txt for more detailed info on history. * ***** * * Copyright (c) 1997-2007 Petter Nordahl-Hagen. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; version 2 of the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * See file GPL.txt for the full license. * ***** * * Information and ideas taken from pwdump by Jeremy Allison. * * More info from NTCrack by Jonathan Wilkins. * */ #include #include #include #include #include #include #include #include #include #include #include #include #define uchar u_char #define MD4Init MD4_Init #define MD4Update MD4_Update #define MD4Final MD4_Final #include "ntreg.h" #include "sam.h" const char chntpw_version[] = "chntpw version 0.99.6 080320 (sixtyfour), (c) Petter N Hagen"; extern char *val_types[REG_MAX+1]; /* Global verbosity */ int gverbose = 0; #define MAX_HIVES 10 /* Array of loaded hives */ struct hive *hive[MAX_HIVES+1]; int no_hives = 0; /* Icky icky... globals used to refer to hives, will be * set when loading, so that hives can be loaded in any order */ int H_SAM = -1; int H_SYS = -1; int H_SEC = -1; int H_SOF = -1; int syskeyreset = 0; int dirty = 0; int max_sam_lock = 0; /* * of user with RID 500, because silly MS decided * to localize the bloody admin-username!! AAAGHH! */ char admuser[129]="Administrator"; /* ============================================================== */ /* Crypto-stuff & support for what we'll do in the V-value */ /* Zero out string for lanman passwd, then uppercase * the supplied password and put it in here */ void make_lanmpw(char *p, char *lm, int len) { int i; for (i=0; i < 15; i++) lm[i] = 0; for (i=0; i < len; i++) lm[i] = toupper(p[i]); } /* * Convert a 7 byte array into an 8 byte des key with odd parity. */ void str_to_key(unsigned char *str,unsigned char *key) { int i; key[0] = str[0]>>1; key[1] = ((str[0]&0x01)<<6) | (str[1]>>2); key[2] = ((str[1]&0x03)<<5) | (str[2]>>3); key[3] = ((str[2]&0x07)<<4) | (str[3]>>4); key[4] = ((str[3]&0x0F)<<3) | (str[4]>>5); key[5] = ((str[4]&0x1F)<<2) | (str[5]>>6); key[6] = ((str[5]&0x3F)<<1) | (str[6]>>7); key[7] = str[6]&0x7F; for (i=0;i<8;i++) { key[i] = (key[i]<<1); } DES_set_odd_parity((des_cblock *)key); } /* * Function to convert the RID to the first decrypt key. */ void sid_to_key1(uint32_t sid,unsigned char deskey[8]) { unsigned char s[7]; s[0] = (unsigned char)(sid & 0xFF); s[1] = (unsigned char)((sid>>8) & 0xFF); s[2] = (unsigned char)((sid>>16) & 0xFF); s[3] = (unsigned char)((sid>>24) & 0xFF); s[4] = s[0]; s[5] = s[1]; s[6] = s[2]; str_to_key(s,deskey); } /* * Function to convert the RID to the second decrypt key. */ void sid_to_key2(uint32_t sid,unsigned char deskey[8]) { unsigned char s[7]; s[0] = (unsigned char)((sid>>24) & 0xFF); s[1] = (unsigned char)(sid & 0xFF); s[2] = (unsigned char)((sid>>8) & 0xFF); s[3] = (unsigned char)((sid>>16) & 0xFF); s[4] = s[0]; s[5] = s[1]; s[6] = s[2]; str_to_key(s,deskey); } /* DES encrypt, for LANMAN */ void E1(uchar *k, uchar *d, uchar *out) { des_key_schedule ks; des_cblock deskey; str_to_key(k,(uchar *)deskey); #ifdef __FreeBSD__ des_set_key(&deskey,ks); #else /* __FreeBsd__ */ des_set_key((des_cblock *)deskey,ks); #endif /* __FreeBsd__ */ des_ecb_encrypt((des_cblock *)d,(des_cblock *)out, ks, DES_ENCRYPT); } /* Check if hive is SAM, and if it is, extract some * global policy information from it, like lockout counts etc */ void check_get_samdata(void) { struct accountdb_F *f; struct keyval *v; if (H_SAM >= 0) { /* Get users F value */ v = get_val2buf(hive[H_SAM], NULL, 0, ACCOUNTDB_F_PATH, REG_BINARY, TPF_VK); if (!v) { printf("Login counts data not found in SAM\n"); return; } printf("\n* SAM policy limits:\n"); f = (struct accountdb_F *)&v->data; max_sam_lock = f->locklimit; printf("Failed logins before lockout is: %d\n",max_sam_lock); printf("Minimum password length : %d\n",f->minpwlen); printf("Password history count : %d\n",f->minpwlen); } } /* Try to decode and possibly change account lockout etc * This is \SAM\Domains\Account\Users\\F * It's size seems to always be 0x50. * Params: RID - user ID, mode - 0 silent, 1 silent, 2 edit. * Returns: ACB bits with high bit set if lockout count is >0 */ short handle_F(int rid, int mode) { struct user_F *f; char s[200]; struct keyval *v; unsigned short acb; int b; if (H_SAM < 0) return(0); /* Get users F value */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\%08X\\F",rid); v = get_val2buf(hive[H_SAM], NULL, 0, s, REG_BINARY, TPF_VK_EXACT); if (!v) { printf("Cannot find value <%s>\n",s); return(0); } if (v->len < 0x48) { printf("handle_F: F value is 0x%x bytes, need >= 0x48, unable to check account flags!\n",v->len); FREE(v); return(0); } f = (struct user_F *)&v->data; acb = f->ACB_bits; if (mode == 1) { printf("Account bits: 0x%04x =\n",acb); for (b=0; b < 15; b++) { printf("[%s] %-15.15s | ", (acb & (1<failedcnt,max_sam_lock); printf("Total login count: %u\n",f->logins); } if (mode == 2) { acb |= ACB_PWNOEXP; acb &= ~ACB_DISABLED; acb &= ~ACB_AUTOLOCK; f->ACB_bits = acb; f->failedcnt = 0; put_buf2val(hive[H_SAM], v, 0, s, REG_BINARY,TPF_VK_EXACT); printf("Unlocked!\n"); } return (acb | ( (f->failedcnt > 0 && f->failedcnt >= max_sam_lock)<<15 ) | (acb & ACB_AUTOLOCK)<<15 | (acb & ACB_DISABLED)<<15); } /* List users membership or check if admin (is in admin group) * rid - users rid * check - if 1 just check if admin, do not list * returns true if user is admin */ int list_user_groups(int rid, int check) { char s[200]; char g[200]; char groupname[128]; int nk = 0; struct keyval *m = NULL, *c = NULL; struct group_C *cd; unsigned int *grps; int count = 0, isadmin = 0; int i, size, grp, grpnamoffs, grpnamlen; if (!rid || (H_SAM < 0)) return(0); /* Get member list for user. Go for the first full SID, it's usually local computer I hope */ snprintf(s,180,"\\SAM\\Domains\\Builtin\\Aliases\\Members\\S-1-5-21-\\%08X",rid); /* Now, the TYPE field is the number of groups the user is member of */ /* Don't we just love the inconsistent use of fields!! */ nk = trav_path(hive[H_SAM], 0, s, 0); if (!nk) { /* This probably means user is not in any group. Seems to be the case for a couple of XPs built in support / guest users. So just return */ if (gverbose) printf("list_user_groups(): Cannot find RID under computer SID <%s>\n",s); return(0); } nk += 4; count = get_val_type(hive[H_SAM],nk,"@",TPF_VK_EXACT); if (count == -1) { printf("list_user_groups(): Cannot find value <%s\\@>\n",s); return(0); } if (!check) printf("User is member of %d groups:\n",count); /* This is the data size */ size = get_val_len(hive[H_SAM],nk,"@",TPF_VK_EXACT); /* It should be 4 bytes for each group */ if (gverbose) printf("Data size %d bytes.\n",size); if (size != count * 4) { printf("list_user_groups(): DEBUG: Size is not 4 * count! May not matter anyway. Continuing..\n"); } m = get_val2buf(hive[H_SAM], NULL, nk, "@", 0, TPF_VK_EXACT); if (!m) { printf("list_user_groups(): Could not get value data! Giving up.\n"); return(0); } grps = (unsigned int *)&m->data; for (i = 0; i < count; i++) { grp = grps[i]; if (!check) printf("%08x ",grp); if (grp == 0x220) isadmin = 1; if (!check) { snprintf(g,180,"\\SAM\\Domains\\Builtin\\Aliases\\%08X\\C",grp); c = get_val2buf(hive[H_SAM], NULL, 0, g, 0, TPF_VK_EXACT); if (c) { cd = (struct group_C *)&c->data; grpnamoffs = cd->grpname_ofs + 0x34; grpnamlen = cd->grpname_len; cheap_uni2ascii((char *)cd + grpnamoffs, groupname, grpnamlen); printf("= %s (which has %d members)\n",groupname,cd->grp_members); } else { printf("Group info for %x not found!\n",grp); } } } return(isadmin); } /* Promote user into administrators group (group ID 0x220) * And remove from all others... * rid - users rid * no returns yet * THIS IS VERY HACKISH YET */ void promote_user(int rid) { char s[200]; char g[200]; int nk = 0; struct keyval *m = NULL, *c = NULL; struct keyval admember = { 4, 0x220 }; unsigned int *grps, *gcnts; int count = 0; int i, size, grp; if (!rid || (H_SAM < 0)) return; /* Get member list for user. Go for the first full SID, it's usually local computer I hope */ snprintf(s,180,"\\SAM\\Domains\\Builtin\\Aliases\\Members\\S-1-5-21-\\%08X",rid); /* Now, the TYPE field is the number of groups the user is member of */ /* Don't we just love the inconsistent use of fields!! */ nk = trav_path(hive[H_SAM], 0, s, 0); if (!nk) { printf("Cannot find path <%s>\n",s); return; } nk += 4; count = get_val_type(hive[H_SAM],nk,"@",TPF_VK); if (count == -1) { printf("Cannot find value <%s\\@>\n",s); return; } printf("User is member of %d groups.\n",count); /* This is the data size */ size = get_val_len(hive[H_SAM],nk,"@",TPF_VK); /* It should be 4 bytes for each group */ printf("Data size %d bytes.\n",size); if (size != count * 4) { printf("DEBUG: Size is not 4 * count! May not matter anyway. Continuing..\n"); } m = get_val2buf(hive[H_SAM], NULL, nk, "@", 0, TPF_VK); if (!m) { printf("Could not get value data! Giving up.\n"); return; } printf("User was member of groups: "); grps = (unsigned int *)&m->data; for (i = 0; i < count; i++) { grp = grps[i]; printf("%08x ",grp); switch (grp) { case 0x220: printf("=Administrators, "); break; case 0x221: printf("=Users, "); break; case 0x222: printf("=Guests, "); break; default: printf(", "); break; } snprintf(g,180,"\\SAM\\Domains\\Builtin\\Aliases\\%08X\\C",grp); c = get_val2buf(hive[H_SAM], NULL, 0, g, 0, TPF_VK); if (c) { gcnts = (unsigned int *)&c->data; gcnts[0xc]--; /* Decrease members counter */ put_buf2val(hive[H_SAM], c, 0, g, 0, TPF_VK); } else { printf("Group info for %x not found!\n",grp); } } #if 1 printf("\nDeleting user memberships\n"); del_value(hive[H_SAM], nk, "@", TPF_VK); printf("Adding into only administrators:\n"); if (!add_value(hive[H_SAM], nk, "@", 1)) { /* Type is # of groups, here 1 */ printf("Failed to add @ value to key\n"); } #endif put_buf2val(hive[H_SAM], &admember, nk, "@", 0, TPF_VK); /* Now bumb up administrator groups count */ c = get_val2buf(hive[H_SAM], NULL, 0, "\\SAM\\Domains\\Builtin\\Aliases\\00000220\\C", 0, TPF_VK); if (!c) printf("Group info for 220 (adm) not found!\n"); gcnts = (unsigned int *)&c->data; gcnts[0xc]++; put_buf2val(hive[H_SAM], c, 0, "\\SAM\\Domains\\Builtin\\Aliases\\00000220\\C", 0, TPF_VK); printf("Promotion DONE!\n"); } /* Decode the V-struct, and change the password * vofs - offset into SAM buffer, start of V struct * rid - the users RID, required for the DES decrypt stage * * Some of this is ripped & modified from pwdump by Jeremy Allison * */ char *change_pw(char *buf, int rid, int vlen, int stat) { uchar x1[] = {0x4B,0x47,0x53,0x21,0x40,0x23,0x24,0x25}; char yn[4]; int pl; char *vp; static char username[128],fullname[128]; char comment[128],homedir[128],md4[32],lanman[32]; char newunipw[34], newp[20], despw[20], newlanpw[16], newlandes[20]; int username_offset,username_len; int fullname_offset,fullname_len; int comment_offset,comment_len; int homedir_offset,homedir_len; int ntpw_len,lmpw_len,ntpw_offs,lmpw_offs,i; int dontchange = 0; struct user_V *v; des_key_schedule ks1, ks2; des_cblock deskey1, deskey2; MD4_CTX context; unsigned char digest[16]; unsigned short acb; v = (struct user_V *)buf; vp = buf; username_offset = v->username_ofs; username_len = v->username_len; fullname_offset = v->fullname_ofs; fullname_len = v->fullname_len; comment_offset = v->comment_ofs; comment_len = v->comment_len; homedir_offset = v->homedir_ofs; homedir_len = v->homedir_len; lmpw_offs = v->lmpw_ofs; lmpw_len = v->lmpw_len; ntpw_offs = v->ntpw_ofs; ntpw_len = v->ntpw_len; if (!rid) { printf("No RID given. Unable to change passwords..\n"); return(0); } if (gverbose) { printf("lmpw_offs: 0x%x, lmpw_len: %d (0x%x)\n",lmpw_offs,lmpw_len,lmpw_len); printf("ntpw_offs: 0x%x, ntpw_len: %d (0x%x)\n",ntpw_offs,ntpw_len,ntpw_len); } *username = 0; *fullname = 0; *comment = 0; *homedir = 0; if(username_len <= 0 || username_len > vlen || username_offset <= 0 || username_offset >= vlen || comment_len < 0 || comment_len > vlen || fullname_len < 0 || fullname_len > vlen || homedir_offset < 0 || homedir_offset >= vlen || comment_offset < 0 || comment_offset >= vlen || lmpw_offs < 0 || lmpw_offs >= vlen) { if (stat != 1) printf("change_pw: Not a legal V struct? (negative struct lengths)\n"); return(NULL); } /* Offsets in top of struct is relative to end of pointers, adjust */ username_offset += 0xCC; fullname_offset += 0xCC; comment_offset += 0xCC; homedir_offset += 0xCC; ntpw_offs += 0xCC; lmpw_offs += 0xCC; cheap_uni2ascii(vp + username_offset,username,username_len); cheap_uni2ascii(vp + fullname_offset,fullname,fullname_len); cheap_uni2ascii(vp + comment_offset,comment,comment_len); cheap_uni2ascii(vp + homedir_offset,homedir,homedir_len); #if 0 /* Reset hash-lengths to 16 if syskey has been reset */ if (syskeyreset && ntpw_len > 16 && !stat) { ntpw_len = 16; lmpw_len = 16; ntpw_offs -= 4; (unsigned int)*(vp+0xa8) = ntpw_offs - 0xcc; *(vp + 0xa0) = 16; *(vp + 0xac) = 16; } #endif if (stat) { acb = handle_F(rid,0); printf("| %04x | %-30.30s | %-6s | %-8s |\n", rid, username, (list_user_groups(rid,1) ? "ADMIN" : "") , ( acb & 0x8000 ? "dis/lock" : (ntpw_len < 16) ? "*BLANK*" : "") ); return(username); } printf("\nRID : %04d [%04x]\n",rid,rid); printf("Username: %s\n",username); printf("fullname: %s\n",fullname); printf("comment : %s\n",comment); printf("homedir : %s\n\n",homedir); list_user_groups(rid,0); printf("\n"); acb = handle_F(rid,1); if (lmpw_len < 16 && gverbose) { printf("** LANMAN password not set. User MAY have a blank password.\n** Usually safe to continue. Normal in Vista\n"); } if (ntpw_len < 16) { printf("** No NT MD4 hash found. This user probably has a BLANK password!\n"); if (lmpw_len < 16) { printf("** No LANMAN hash found either. Sorry, cannot change. Try login with no password!\n"); dontchange = 1; } else { printf("** LANMAN password IS however set. Will now install new password as NT pass instead.\n"); printf("** NOTE: Continue at own risk!\n"); ntpw_offs = lmpw_offs; *(vp+0xa8) = ntpw_offs - 0xcc; ntpw_len = 16; lmpw_len = 0; } } if (gverbose) { hexprnt("Crypted NT pw: ",(unsigned char *)(vp+ntpw_offs),16); hexprnt("Crypted LM pw: ",(unsigned char *)(vp+lmpw_offs),16); } /* Get the two decrpt keys. */ sid_to_key1(rid,(unsigned char *)deskey1); des_set_key((des_cblock *)deskey1,ks1); sid_to_key2(rid,(unsigned char *)deskey2); des_set_key((des_cblock *)deskey2,ks2); /* Decrypt the NT md4 password hash as two 8 byte blocks. */ des_ecb_encrypt((des_cblock *)(vp+ntpw_offs ), (des_cblock *)md4, ks1, DES_DECRYPT); des_ecb_encrypt((des_cblock *)(vp+ntpw_offs + 8), (des_cblock *)&md4[8], ks2, DES_DECRYPT); /* Decrypt the lanman password hash as two 8 byte blocks. */ des_ecb_encrypt((des_cblock *)(vp+lmpw_offs), (des_cblock *)lanman, ks1, DES_DECRYPT); des_ecb_encrypt((des_cblock *)(vp+lmpw_offs + 8), (des_cblock *)&lanman[8], ks2, DES_DECRYPT); if (gverbose) { hexprnt("MD4 hash : ",(unsigned char *)md4,16); hexprnt("LANMAN hash : ",(unsigned char *)lanman,16); } printf("\n- - - - User Edit Menu:\n"); printf(" 1 - Clear (blank) user password\n" " 2 - Edit (set new) user password (careful with this on XP or Vista)\n" " 3 - Promote user (make user an administrator)\n"); printf("%s4 - Unlock and enable user account%s\n", (acb & 0x8000) ? " " : "(", (acb & 0x8000) ? " [probably locked now]" : ") [seems unlocked already]"); printf(" q - Quit editing user, back to user select\n"); pl = fmyinput("Select: [q] > ",newp,16); if ( (pl < 1) || (*newp == 'q') || (*newp == 'Q')) return(0); if (*newp == '3') { printf("NOTE: This function is still experimental, and in some cases it\n" " may result in stangeness when editing user/group in windows.\n" " Also, users (like Guest often is) may still be prevented\n" " from login via security/group policies which is not changed.\n"); fmyinput("Do you still want to promote the user? (y/n) [n] ",yn,2); if (*yn == 'y' || *yn == 'Y') { promote_user(rid); } return(username); } if (*newp == '4') { acb = handle_F(rid,2); return(username); } if (*newp == '2') { if (dontchange) { printf("Sorry, unable to edit since password seems blank already (thus no space for it)\n"); return(0); } pl = fmyinput("New Password: ",newp,16); if (pl < 1) { printf("No change.\n"); return(0); } cheap_ascii2uni(newp,newunipw,pl); make_lanmpw(newp,newlanpw,pl); /* printf("Ucase Lanman: %s\n",newlanpw); */ MD4Init (&context); MD4Update (&context, newunipw, pl<<1); MD4Final (digest, &context); if (gverbose) hexprnt("\nNEW MD4 hash : ",digest,16); E1((uchar *)newlanpw, x1, (uchar *)lanman); E1((uchar *)newlanpw+7, x1, (uchar *)lanman+8); if (gverbose) hexprnt("NEW LANMAN hash : ",(unsigned char *)lanman,16); /* Encrypt the NT md4 password hash as two 8 byte blocks. */ des_ecb_encrypt((des_cblock *)digest, (des_cblock *)despw, ks1, DES_ENCRYPT); des_ecb_encrypt((des_cblock *)(digest+8), (des_cblock *)&despw[8], ks2, DES_ENCRYPT); des_ecb_encrypt((des_cblock *)lanman, (des_cblock *)newlandes, ks1, DES_ENCRYPT); des_ecb_encrypt((des_cblock *)(lanman+8), (des_cblock *)&newlandes[8], ks2, DES_ENCRYPT); if (gverbose) { hexprnt("NEW DES crypt : ",(unsigned char *)despw,16); hexprnt("NEW LANMAN crypt: ",(unsigned char *)newlandes,16); } /* Reset hash length to 16 if syskey enabled, this will cause * a conversion to syskey-hashes upon next boot */ if (syskeyreset && ntpw_len > 16) { ntpw_len = 16; lmpw_len = 16; ntpw_offs -= 4; *(vp+0xa8) = (unsigned int)(ntpw_offs - 0xcc); *(vp + 0xa0) = 16; *(vp + 0xac) = 16; } for (i = 0; i < 16; i++) { *(vp+ntpw_offs+i) = (unsigned char)despw[i]; if (lmpw_len >= 16) *(vp+lmpw_offs+i) = (unsigned char)newlandes[i]; } printf("Password changed!\n"); } /* new password */ else if (pl == 1 && *newp == '1') { /* Setting hash lengths to zero seems to make NT think it is blank * However, since we cant cut the previous hash bytes out of the V value * due to missing resize-support of values, it may leak about 40 bytes * each time we do this. */ v->ntpw_len = 0; v->lmpw_len = 0; printf("Password cleared!\n"); } #if 0 hexprnt("Pw in buffer: ",(vp+ntpw_offs),16); hexprnt("Lm in buffer: ",(vp+lmpw_offs),16); #endif dirty = 1; return(username); } /* Here we put our knowledge to use, basic routines to * decode and display registry contents almost like a filesystem */ /* display (cat) the value, * vofs = offset to 'nk' node, paths relative to this (or 0 for root) * path = path string to value * Does not handle all types yet (does a hexdump instead) * MULTI_SZ (multi unicode-string) - only displays first string, * but also does a hexdump. */ void cat_vk(struct hive *hdesc, int nkofs, char *path, int dohex) { void *data; int len,i,type; char string[SZ_MAX+1]; type = get_val_type(hdesc, nkofs, path, 0); if (type == -1) { printf("cat_vk: No such value <%s>\n",path); return; } len = get_val_len(hdesc, nkofs, path, 0); if (!len) { printf("cat_vk: Value <%s> has zero length\n",path); return; } data = (void *)get_val_data(hdesc, nkofs, path, 0, 0); if (!data) { printf("cat_vk: Value <%s> references NULL-pointer (bad boy!)\n",path); abort(); return; } printf("Value <%s> of type %s, data length %d [0x%x]\n", path, (type < REG_MAX ? val_types[type] : "(unknown)"), len, len); if (dohex) type = REG_BINARY; switch (type) { case REG_SZ: case REG_EXPAND_SZ: case REG_MULTI_SZ: cheap_uni2ascii(data,string,len); for (i = 0; i < (len>>1)-1; i++) { if (string[i] == 0) string[i] = '\n'; if (type == REG_SZ) break; } puts(string); break; case REG_DWORD: printf("0x%08x",*(unsigned short *)data); break; default: printf("Don't know how to handle type yet!\n"); case REG_BINARY: hexdump((char *)data, 0, len, 1); } putchar('\n'); } /* =================================================================== */ /* Registry editor frontend */ struct cmds { char cmd_str[12]; int cmd_num; }; #define MCMD_CD 1 #define MCMD_LS 2 #define MCMD_QUIT 3 #define MCMD_CAT 4 #define MCMD_STRUCT 5 #define MCMD_DEBUG 6 #define MCMD_HELP 7 #define MCMD_EXPORTKEY 8 #define MCMD_HIVE 9 #define MCMD_EDIT 10 #define MCMD_ALLOC 11 #define MCMD_FREE 12 #define MCMD_ADDV 13 #define MCMD_DELV 14 #define MCMD_DELVALL 15 #define MCMD_NEWKEY 16 #define MCMD_DELKEY 17 #define MCMD_CATHEX 18 #define MCMD_RDEL 19 #define MCMD_CK 20 struct cmds maincmds[] = { { "cd" , MCMD_CD } , { "ls" , MCMD_LS } , { "dir", MCMD_LS } , { "q" , MCMD_QUIT } , { "cat", MCMD_CAT } , { "type",MCMD_CAT } , { "st" , MCMD_STRUCT } , { "debug", MCMD_DEBUG } , { "hive", MCMD_HIVE } , { "ed", MCMD_EDIT } , #if ALLOC_DEBUG { "alloc", MCMD_ALLOC } , { "free", MCMD_FREE } , #endif { "nv", MCMD_ADDV } , { "dv", MCMD_DELV } , { "delallv", MCMD_DELVALL } , { "nk", MCMD_NEWKEY } , { "dk", MCMD_DELKEY } , { "hex", MCMD_CATHEX } , { "rdel", MCMD_RDEL } , { "ek", MCMD_EXPORTKEY }, { "ck", MCMD_CK } , { "?", MCMD_HELP } , { "", 0 } }; /* Edit value: Invoke whatever is needed to edit it * based on its type */ void edit_val(struct hive *h, int nkofs, char *path) { struct keyval *kv, *newkv; int type,len,n,i,in,go, newsize, d = 0, done, insert = 0; char inbuf[SZ_MAX+4]; char origstring[SZ_MAX+4]; char *newstring; char *dbuf; type = get_val_type(h, nkofs, path, TPF_VK); if (type == -1) { printf("Value <%s> not found!\n",path); return; } kv = get_val2buf(h, NULL, nkofs, path, type, TPF_VK); if (!kv) { printf("Unable to get data of value <%s>\n",path); return; } len = kv->len; printf("EDIT: <%s> of type %s with length %d [0x%x]\n", path, (type < REG_MAX ? val_types[type] : "(unknown)"), len, len); switch(type) { case REG_DWORD: printf("DWORD: Old value %d [0x%x], ", kv->data, kv->data); fmyinput("enter new value (prepend 0x if hex, empty to keep old value)\n-> ", inbuf, 12); if (*inbuf) { sscanf(inbuf,"%i",&kv->data); d = 1; } printf("DWORD: New value %d [0x%x], ", kv->data, kv->data); break; case REG_SZ: case REG_EXPAND_SZ: case REG_MULTI_SZ: newstring = NULL; dbuf = (char *)&kv->data; cheap_uni2ascii(dbuf,origstring,len); n = 0; i = 0; while (i < (len>>1)-1) { printf("[%2d]: %s\n",n,origstring+i); i += strlen(origstring+i) + 1; n++; } printf("\nNow enter new strings, one by one.\n"); printf("Enter nothing to keep old.\n"); if (type == REG_MULTI_SZ) { printf("'--n' to quit (remove rest of strings)\n"); printf("'--i' insert new string at this point\n"); printf("'--q' to quit (leaving remaining strings as is)\n"); printf("'--Q' to quit and discard all changes\n"); printf("'--e' for empty string in this position\n"); } n = 0; i = 0; in = 0; go = 0; done = 0; /* Now this one is RATHER UGLY :-} */ while (i < (len>>1)-1 || !done) { printf("[%2d]: %s\n",n, insert == 1 ? "[INSERT]" : ((i < (len>>1)-1 ) ? origstring+i : "[NEW]")); if (insert) insert++; if (!go) fmyinput("-> ",inbuf, 500); else *inbuf = 0; if (*inbuf && strcmp("--q", inbuf)) { if (!strcmp("--n", inbuf) || !strcmp("--Q", inbuf)) { /* Zap rest */ i = (len>>1) ; done = 1; } else if (strcmp("--i", inbuf)) { /* Copy out given string */ if (!strcmp("--e",inbuf)) *inbuf = '\0'; if (newstring) newstring = realloc(newstring, in+strlen(inbuf)+1); else newstring = malloc(in+strlen(inbuf)+1); strcpy(newstring+in, inbuf); in += strlen(inbuf)+1; } else { insert = 1; } } else { /* Copy out default string */ if (newstring) newstring = realloc(newstring, in+strlen(origstring+i)+1); else newstring = malloc(in + strlen(origstring+i) + 1); strcpy(newstring+in, origstring+i); in += strlen(origstring+i)+1; if (!strcmp("--q", inbuf)) { go = 1; done = 1; if (!(i < (len>>1)-1 )) { in--; /* remove last empty if in NEW-mode */ } } } if (!insert) i += strlen(origstring+i) + 1; if (insert != 1) n++; if (insert == 2) insert = 0; if (type != REG_MULTI_SZ) { i = (len<<1); done = 1; } } if (strcmp("--Q", inbuf)) { /* We didn't bail out */ if (newstring) newstring = realloc(newstring, in+1); else newstring = malloc(in+1); if (type == REG_MULTI_SZ) { in++; *(newstring+in) = '\0'; /* Must add null termination */ } ALLOC(newkv,1,(in<<1)+sizeof(int)); newkv->len = in<<1; printf("newkv->len: %d\n",newkv->len); cheap_ascii2uni(newstring, (char *)&(newkv->data), in); d = 1; FREE(kv); kv = newkv; } break; default: printf("Type not handeled (yet), invoking hex editor on data!\n"); case REG_BINARY: fmyinput("New length (ENTER to keep same): ",inbuf,90); if (*inbuf) { newsize = atoi(inbuf); ALLOC(newkv,1,newsize+sizeof(int)+4); bzero(newkv,newsize+sizeof(int)+4); memcpy(newkv, kv, (len < newsize) ? (len) : (newsize) +sizeof(int)); FREE(kv); kv = newkv; kv->len = newsize; } d = debugit((char *)&kv->data, kv->len); break; } if (d) { if (!(put_buf2val(h, kv, nkofs, path, type, TPF_VK))) { printf("Failed to set value!?\n"); } } FREE(kv); } /* look up command in array */ int parsecmd(char **s, struct cmds *cmd) { int l = 0; while ((*s)[l] && ((*s)[l] != ' ')) { l++; } while (cmd->cmd_num) { if (!strncmp(*s, cmd->cmd_str, l)) { *s += l; return(cmd->cmd_num); } cmd++; } return(0); } /* Simple interactive command-parser * Main loop for manually looking through the registry */ void mainloop(void) { struct hive *hdesc; int cdofs, newofs; struct nk_key *cdkey; char inbuf[100], *bp, *file, *prefix; char path[1000]; int l, vkofs, nh, i; int usehive = 0; struct keyval *kv; #if ALLOC_DEBUG int pagestart; int freetest; #endif hdesc = hive[usehive]; cdofs = hdesc->rootofs; printf("Simple registry editor. ? for help.\n"); while (1) { cdkey = (struct nk_key *)(hdesc->buffer + cdofs); *path = 0; get_abs_path(hdesc,cdofs+4, path, 50); #if ALLOC_DEBUG pagestart = find_page_start(hdesc,cdofs); printf("find_page_start: 0x%x\n",pagestart); freetest = find_free_blk(hdesc,pagestart,10); printf("find_free_blk: 0x%x\n",freetest); #endif if (gverbose) printf("\n[%0x] %s> ",cdofs,path); else printf("\n%s> ",path); l = fmyinput("",inbuf,90); bp = inbuf; skipspace(&bp); if (l > 0 && *bp) { switch(parsecmd(&bp,maincmds)) { case MCMD_HELP: printf("Simple registry editor:\n"); printf("hive [] - list loaded hives or switch to hive numer n\n"); printf("cd - change current key\n"); printf("ls | dir [] - show subkeys & values,\n"); printf("cat | type - show key value\n"); printf("hex - hexdump of value data\n"); printf("ck [] - Show keys class data, if it has any\n"); printf("nk - add key\n"); printf("dk - delete key (must be empty)\n"); printf("ed - Edit value\n"); printf("nv - Add value\n"); printf("dv - Delete value\n"); printf("delallv - Delete all values in current key\n"); printf("rdel - Recursively delete key & subkeys\n"); printf("ek - export key to (Windows .reg file format)\n"); printf("debug - enter buffer hexeditor\n"); printf("st [] - debug function: show struct info\n"); printf("q - quit\n"); break; case MCMD_DELKEY : bp++; skipspace(&bp); del_key(hdesc, cdofs + 4, bp); break; case MCMD_NEWKEY : bp++; skipspace(&bp); add_key(hdesc, cdofs + 4, bp); break; case MCMD_DELVALL : bp++; skipspace(&bp); del_allvalues(hdesc, cdofs + 4); break; case MCMD_DELV : bp++; skipspace(&bp); del_value(hdesc, cdofs + 4, bp, 0); break; case MCMD_ADDV : bp++; skipspace(&bp); nh = gethex(&bp); skipspace(&bp); add_value(hdesc, cdofs+4, bp, nh); break; #ifdef ALLOC_DEBUG case MCMD_FREE : bp++; skipspace(&bp); nh = gethex(&bp); free_block(hdesc, nh); break; case MCMD_ALLOC : bp++; skipspace(&bp); nh = gethex(&bp); alloc_block(hdesc, cdofs+4, nh); break; #endif case MCMD_LS : bp++; skipspace(&bp); nk_ls(hdesc, bp, cdofs+4, 0); break; case MCMD_CK : bp++; skipspace(&bp); kv = get_class(hdesc, cdofs+4, bp); if (kv) { hexdump((char *)&kv->data, 0, kv->len, 1); FREE(kv); } break; case MCMD_RDEL : bp++; skipspace(&bp); rdel_keys(hdesc, bp, cdofs+4); break; case MCMD_EDIT : bp++; skipspace(&bp); edit_val(hdesc, cdofs+4, bp); break; case MCMD_HIVE : bp++; skipspace(&bp); if (*bp) { nh = gethex(&bp); if (nh >= 0 && nh < no_hives) { usehive = nh; printf("Switching to hive #%d, named <%s>, size %d [0x%x]\n", usehive, hive[usehive]->filename, hive[usehive]->size, hive[usehive]->size); hdesc = hive[usehive]; cdofs = hdesc->rootofs; } } else { for (nh = 0; nh < no_hives; nh++) { printf("%c %c %2d %9d 0x%08x <%s>\n", (nh == usehive) ? '*' : ' ', (hive[nh]->state & HMODE_DIRTY) ? 'D' : ' ', nh, hive[nh]->size, hive[nh]->size, hive[nh]->filename); } } break; case MCMD_CD : bp++; skipspace(&bp); newofs = trav_path(hdesc, cdofs+4,bp,TPF_NK); if (newofs) cdofs = newofs; else printf("Key %s not found!\n",bp); break; case MCMD_CAT: bp++; skipspace(&bp); cat_vk(hdesc,cdofs+4,bp,0); break; case MCMD_CATHEX: bp++; skipspace(&bp); cat_vk(hdesc,cdofs+4,bp,1); break; case MCMD_EXPORTKEY : bp++; skipspace(&bp); file = bp; i = 0; while(*bp != ' ' && (*bp)) { i++; bp++; } file[i] = '\0'; bp++; skipspace(&bp); prefix = bp; i = 0; while(*bp != ' ' && (*bp)) { i++; bp++; } prefix[i] = '\0'; bp++; skipspace(&bp); export_key(hdesc, cdofs + 4, bp, file, prefix); break; case MCMD_STRUCT: bp++; skipspace(&bp); vkofs = cdofs; if (*bp) { vkofs = gethex(&bp); } parse_block(hdesc,vkofs,1); break; case MCMD_DEBUG: if (debugit(hdesc->buffer,hdesc->size)) hdesc->state |= HMODE_DIRTY; break; case MCMD_QUIT: return; break; default: printf("Unknown command: %s\n",bp); break; } } } } /* List users in SAM file * pageit - hmm.. forgot this one for this release.. */ int list_users(int pageit) { char s[200]; struct keyval *v; int nkofs /* ,vkofs */ ; int rid; int count = 0, countri = 0; struct ex_data ex; if (H_SAM < 0) return(1); nkofs = trav_path(hive[H_SAM], 0,"\\SAM\\Domains\\Account\\Users\\Names\\",0); if (!nkofs) { printf("list_users: Cannot find usernames in registry! (is this a SAM-hive?)\n"); return(1); } printf("| RID -|---------- Username ------------| Admin? |- Lock? --|\n"); while ((ex_next_n(hive[H_SAM], nkofs+4, &count, &countri, &ex) > 0)) { /* Extract the value out of the username-key, value is RID */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\Names\\%s\\@",ex.name); rid = get_dword(hive[H_SAM], 0, s, TPF_VK_EXACT); if (rid == 500) strncpy(admuser,ex.name,128); /* Copy out admin-name */ /* printf("name: %s, rid: %d (0x%0x)\n", ex.name, rid, rid); */ /* Now that we have the RID, build the path to, and get the V-value */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\%08X\\V",rid); v = get_val2buf(hive[H_SAM], NULL, 0, s, REG_BINARY, TPF_VK_EXACT); if (!v) { printf("Cannot find value <%s>\n",s); return(1); } if (v->len < 0xcc) { printf("list_users: Value <%s> is too short (only %d bytes) to be a SAM user V-struct!\n", s, v->len); } else { change_pw( (char *)&v->data , rid, v->len, 1); } FREE(v); FREE(ex.name); } return(0); } /* Find a username in the SAM registry, then get it's V-value, * and feed it to the password changer. */ void find_n_change(char *username) { char s[200]; struct vk_key *vkkey; struct keyval *v; int rid = 0; if ((H_SAM < 0) || (!username)) return; if (*username == '0' && *(username+1) == 'x') sscanf(username,"%i",&rid); if (!rid) { /* Look up username */ /* Extract the unnamed value out of the username-key, value is RID */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\Names\\%s\\@",username); rid = get_dword(hive[H_SAM],0,s, TPF_VK_EXACT); if (rid == -1) { printf("Cannot find value <%s>\n",s); return; } } /* printf("Username: %s, RID = %d (0x%0x)\n",username,rid,rid); */ /* Now that we have the RID, build the path to, and get the V-value */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\%08X\\V",rid); v = get_val2buf(hive[H_SAM], NULL, 0, s, REG_BINARY, TPF_VK_EXACT); if (!v) { printf("Cannot find value <%s>\n",s); return; } if (v->len < 0xcc) { printf("Value <%s> is too short (only %d bytes) to be a SAM user V-struct!\n", s, vkkey->len_data); } else { change_pw( (char *)&v->data , rid, v->len, 0); if (dirty) { if (!(put_buf2val(hive[H_SAM], v, 0, s, REG_BINARY, TPF_VK_EXACT))) { printf("Failed to write updated <%s> to registry! Password change not completed!\n",s); } } } FREE(v); } /* Check for presence of syskey and possibly disable it if * user wants it. * This is tricky, and extremely undocumented! * See docs for more info on what's going on when syskey is installed */ #undef LSADATA void handle_syskey(void) { /* This is \SAM\Domains\Account\F */ struct samkeyf { char unknown[0x50]; /* 0x0000 - Unknown. May be machine SID */ char unknown2[0x14]; char syskeymode; /* 0x0064 - Type/mode of syskey in use */ char syskeyflags1[0xb]; /* 0x0065 - More flags/settings */ char syskeyobf[0x30]; /* 0x0070 - This may very well be the obfuscated syskey */ }; /* There may be more, usually 8 null-bytes? */ /* Security\Policy\SecretEncryptionKey\@, only on NT5 */ /* Probably contains some keyinfo for syskey. Second DWORD seems to be syskeymode */ struct secpoldata { int unknown1; /* Some kind of flag? usually 1 */ int syskeymode; /* Is this what we're looking for? */ int unknown2; /* Usually 0? */ char keydata[0x40]; /* Some kind of scrambled keydata? */ }; #ifdef LSADATA /* SYSTEM\CurrentControlSet\Control\Lsa\Data, only on NT5?? */ /* Probably contains some keyinfo for syskey. Byte 0x34 seems to be mode */ struct lsadata { char keydata[0x34]; /* Key information */ int syskeymode; /* Is this what we're looking for? */ }; #endif /* void *fdata; */ struct samkeyf *ff = NULL; struct secpoldata *sf = NULL; /* struct lsadata *ld = NULL; */ int /* len, */ i,secboot, samfmode, secmode /* , ldmode */ ; struct keyval *samf, *secpol /* , *lsad */ ; char *syskeytypes[4] = { "off", "key-in-registry", "enter-passphrase", "key-on-floppy" }; char yn[5]; printf("\n---------------------> SYSKEY CHECK <-----------------------\n"); if (H_SAM < 0) { printf("ERROR: SAM hive not loaded!\n"); return; } samf = get_val2buf(hive[H_SAM], NULL, 0, "\\SAM\\Domains\\Account\\F", REG_BINARY, TPF_VK_EXACT); if (samf && samf->len > 0x70 ) { ff = (struct samkeyf *)&samf->data; samfmode = ff->syskeymode; } else { samfmode = -1; } secboot = -1; if (H_SYS >= 0) { secboot = get_dword(hive[H_SYS], 0, "\\ControlSet001\\Control\\Lsa\\SecureBoot", TPF_VK_EXACT); } secmode = -1; if (H_SEC >=0) { secpol = get_val2buf(hive[H_SEC], NULL, 0, "\\Policy\\PolSecretEncryptionKey\\@", REG_NONE, TPF_VK_EXACT); if (secpol) { /* Will not be found in NT 4, take care of that */ sf = (struct secpoldata *)&secpol->data; secmode = sf->syskeymode; } } #ifdef LSADATA lsad = get_val2buf(hive[H_SYS], NULL, 0, "\\ControlSet001\\Control\\Lsa\\Data\\Pattern", REG_BINARY, TPF_VK_EXACT); if (lsad && lsad->len >= 0x38) { ld = (struct lsadata *)&lsad->data; ldmode = ld->syskeymode; } else { ldmode = -1; } #endif printf("SYSTEM SecureBoot : %d -> %s\n", secboot, (secboot < 0 || secboot > 3) ? "Not Set (not installed, good!)" : syskeytypes[secboot]); printf("SAM Account\\F : %d -> %s\n", samfmode, (samfmode < 0 || samfmode > 3) ? "Not Set" : syskeytypes[samfmode]); printf("SECURITY PolSecretEncryptionKey: %d -> %s\n", secmode, (secmode < 0 || secmode > 3) ? "Not Set (OK if this is NT4)" : syskeytypes[secmode]); #ifdef LSADATA printf("SYSTEM LsaData : %d -> %s\n\n", ldmode, (ldmode < 0 || ldmode > 3) ? "Not Set (strange?)" : syskeytypes[ldmode]); #endif if (secboot != samfmode && secboot != -1) { printf("WARNING: Mismatch in syskey settings in SAM and SYSTEM!\n"); printf("WARNING: It may be dangerous to continue (however, resetting syskey\n"); printf(" may very well fix the problem)\n"); } if (secboot > 0 || samfmode > 0) { printf("\n***************** SYSKEY IS ENABLED! **************\n"); printf("This installation very likely has the syskey passwordhash-obfuscator installed\n"); printf("It's currently in mode = %d, %s-mode\n",secboot, (secboot < 0 || secboot > 3) ? "Unknown" : syskeytypes[secboot]); if (no_hives < 2) { printf("\nSYSTEM (and possibly SECURITY) hives not loaded, unable to disable syskey!\n"); printf("Please start the program with at least SAM & SYSTEM-hive filenames as arguments!\n\n"); return; } printf("SYSKEY is on! However, DO NOT DISABLE IT UNLESS YOU HAVE TO!\n"); printf("This program can change passwords even if syskey is on, however\n"); printf("if you have lost the key-floppy or passphrase you can turn it off,\n"); printf("but please read the docs first!!!\n"); printf("\n** IF YOU DON'T KNOW WHAT SYSKEY IS YOU DO NOT NEED TO SWITCH IT OFF!**\n"); printf("NOTE: On WINDOWS 2000 it will not be possible\n"); printf("to turn it on again! (and other problems may also show..)\n\n"); printf("NOTE: Disabling syskey will invalidate ALL\n"); printf("passwords, requiring them to be reset. You should at least reset the\n"); printf("administrator password using this program, then the rest ought to be\n"); printf("done from NT.\n"); fmyinput("\nDo you really wish to disable SYSKEY? (y/n) [n] ",yn,2); if (*yn == 'y') { /* Reset SAM syskey infostruct, fill with zeroes */ if (ff) { ff->syskeymode = 0; for (i = 0; i < 0x3b; i++) { ff->syskeyflags1[i] = 0; } put_buf2val(hive[H_SAM], samf, 0, "\\SAM\\Domains\\Account\\F", REG_BINARY, TPF_VK_EXACT); } /* Reset SECURITY infostruct (if any) */ if (sf) { memset(sf, 0, secpol->len); sf->syskeymode = 0; put_buf2val(hive[H_SEC], secpol, 0, "\\Policy\\PolSecretEncryptionKey\\@", REG_BINARY, TPF_VK_EXACT); } #if LSADATA if (ld) { ld->syskeymode = 0; put_buf2val(hive[H_SYS], lsad, 0, "\\ControlSet001\\Control\\Lsa\\Data\\Pattern", REG_BINARY, TPF_VK_EXACT); } #endif /* And SYSTEM SecureBoot parameter */ put_dword(hive[H_SYS], 0, "\\ControlSet001\\Control\\Lsa\\SecureBoot", TPF_VK_EXACT, 0); dirty = 1; syskeyreset = 1; printf("Updating passwordhash-lengths..\n"); list_users(1); printf("* SYSKEY RESET!\nNow please set new administrator password!\n"); } else { syskeyreset = 1; } } else { printf("Syskey not installed!\n"); return; } } /* Interactive user edit */ void useredit(void) { char iwho[100]; int il; printf("\n\n===== chntpw Edit User Info & Passwords ====\n\n"); if (H_SAM < 0) { printf("ERROR: SAM registry file (which contains user data) is not loaded!\n\n"); return; } list_users(1); while (1) { printf("\nSelect: ! - quit, . - list users, 0x - User with RID (hex)\n"); printf("or simply enter the username to change: [%s] ",admuser); il = fmyinput("",iwho,32); if (il == 1 && *iwho == '.') { printf("\n"); list_users(1); continue; } if (il == 1 && *iwho == '!') return; if (il == 0) strcpy(iwho,admuser); find_n_change(iwho); } } void recoveryconsole() { int cmd = 0; int sec = 0; static char *scpath = "\\Microsoft\\Windows NT\\CurrentVersion\\Setup\\RecoveryConsole\\SetCommand"; static char *slpath = "\\Microsoft\\Windows NT\\CurrentVersion\\Setup\\RecoveryConsole\\SecurityLevel"; char yn[5]; if (H_SOF < 0) { printf("\nSOFTWARE-hive not loaded, and there's where RecoveryConsole settings are..\n"); return; } cmd = get_dword(hive[H_SOF],0,scpath,TPF_VK_EXACT); sec = get_dword(hive[H_SOF],0,slpath,TPF_VK_EXACT); if (cmd == -1 && sec == -1) { printf("\nDid not find registry entries for RecoveryConsole.\n(RecoveryConsole is only in Windows 2000 and XP, not Vista)\n"); return; } printf("\nRecoveryConsole:\n- Extended SET command is \t%s\n", cmd>0 ? "ENABLED (1)" : "DISABLED (0)"); printf("- Administrator password login: %s\n", sec>0 ? "SKIPPED (1)" : "ENFORCED (0)"); fmyinput("\nDo you want to change it? (y/n) [n] ",yn,2); if (*yn == 'y') { cmd ^= 1; sec ^= 1; if (!put_dword(hive[0], 0, scpath, TPF_VK_EXACT, cmd)) printf("Update of SET level failed registry edit\n"); if (!put_dword(hive[0], 0, slpath, TPF_VK_EXACT, sec)) printf("Update of login level failed registry edit\n"); printf("Done!\n"); } } /* Interactive menu system */ void interactive(void) { int il; char inbuf[20]; while(1) { printf("\n\n<>========<> chntpw Main Interactive Menu <>========<>\n\n" "Loaded hives:"); for (il = 0; il < no_hives; il++) { printf(" <%s>",hive[il]->filename); } printf("\n\n 1 - Edit user data and passwords\n" " 2 - Syskey status & change\n" " 3 - RecoveryConsole settings\n" " - - -\n" " 9 - Registry editor, now with full write support!\n" " q - Quit (you will be asked if there is something to save)\n" "\n\n"); il = fmyinput("What to do? [1] -> ", inbuf, 10); if (!il) useredit(); if (il) { switch(inbuf[0]) { case '1': useredit(); break; case '2': handle_syskey(); break; case '3': recoveryconsole(); break; case '9': mainloop(); break; case 'q': return; break; } } } } void usage(void) { printf("chntpw: change password of a user in a NT/2k/XP/2k3/Vista SAM file, or invoke registry editor.\n" "chntpw [OPTIONS] [systemfile] [securityfile] [otherreghive] [...]\n" " -h This message\n" " -u Username to change, Administrator is default\n" " -l list all users in SAM file\n" " -i Interactive. List users (as -l) then ask for username to change\n" " -e Registry editor. Now with full write support!\n" " -d Enter buffer debugger instead (hex editor), \n" " -t Trace. Show hexdump of structs/segments. (deprecated debug function)\n" " -v Be a little more verbose (for debuging)\n" " -L Write names of changed files to /tmp/changed\n" " -N No allocation mode. Only (old style) same length overwrites possible\n" "See readme file on how to get to the registry files, and what they are.\n" "Source/binary freely distributable under GPL v2 license. See README for details.\n" "NOTE: This program is somewhat hackish! You are on your own!\n" ); } int main(int argc, char **argv) { int dodebug = 0, list = 2, inter = 0,edit = 0,il,d = 0, dd = 0, logchange = 0, mode = 0; extern int /* opterr, */ optind; extern char* optarg; char *filename,c; char *who = "Administrator"; char iwho[100]; FILE *ch; /* Write out names of touched files to this */ char *options = "LNidehltvu:"; printf("%s\n",chntpw_version); while((c=getopt(argc,argv,options)) > 0) { switch(c) { case 'd': dodebug = 1; break; case 'e': edit = 1; break; case 'L': logchange = 1; break; case 'N': mode |= HMODE_NOALLOC; break; case 'l': list = 1; who = 0; break; case 't': list = 3; who = 0; mode |= HMODE_TRACE; break; case 'v': mode |= HMODE_VERBOSE; gverbose = 1; break; case 'i': list = 2; who = 0; inter = 1; break; case 'u': who = optarg; list = 2; break; case 'h': usage(); exit(0); break; default: usage(); exit(1); break; } } filename=argv[optind]; if (!filename || !*filename) { usage(); exit(1); } do { if (!(hive[no_hives] = openHive(filename, HMODE_RW|mode))) { printf("Unable to open/read a hive, exiting..\n"); exit(1); } switch(hive[no_hives]->type) { case HTYPE_SAM: H_SAM = no_hives; break; case HTYPE_SOFTWARE: H_SOF = no_hives; break; case HTYPE_SYSTEM: H_SYS = no_hives; break; case HTYPE_SECURITY: H_SEC = no_hives; break; } no_hives++; filename = argv[optind+no_hives]; } while (filename && *filename && no_hives < MAX_HIVES); if (dodebug) debugit(hive[0]->buffer,hive[0]->size); else { check_get_samdata(); if (list && !edit && !inter) { if ( list_users(1) ) edit = 1; } if (edit) mainloop(); else if (who) { handle_syskey(); find_n_change(who); } if (inter) interactive(); } if (list != 1) { printf("\nHives that have changed:\n # Name\n"); for (il = 0; il < no_hives; il++) { if (hive[il]->state & HMODE_DIRTY) { if (!logchange) printf("%2d <%s>\n",il,hive[il]->filename); d = 1; } } if (d) { /* Only prompt user if logging of changed files has not been set */ /* Thus we assume confirmations are done externally if they ask for a list of changes */ if (!logchange) fmyinput("Write hive files? (y/n) [n] : ",iwho,3); if (*iwho == 'y' || logchange) { if (logchange) { ch = fopen("/tmp/changed","w"); } for (il = 0; il < no_hives; il++) { if (hive[il]->state & HMODE_DIRTY) { printf("%2d <%s> - ",il,hive[il]->filename); if (!writeHive(hive[il])) { printf("OK\n"); if (logchange) fprintf(ch,"%s ",hive[il]->filename); dd = 2; } } } if (logchange) { fprintf(ch,"\n"); fclose(ch); } } else { printf("Not written!\n\n"); } } else { printf("None!\n\n"); } } /* list only check */ return(dd); } chntpw_0.99.6.110511/ntreg.c0000600000175000017500000034707211562562244013360 0ustar jfsjfs/* * ntreg.c - Windows (NT and up) Registry Hive access library * * 2011-may: Seems like large values >16k or something like that is split * into several blocks (db), have tried to implement that. * Vista seems to accept it. Not tested on others yet. * 2011-may: Expansion now seems to be working, have lot of test accepted by * vista and win7. But no warranties.. * 2011-may: Found a couple of nasty bugs inn add_key(), making Vista and newer * reject (remove) keys on hive load. * May have been there for a long time according to reports. * 2011-apr: Fixed some problems with the allocator when at the end of a hbin. * 2011-apr: .reg file import. Ugly one, but it seems to work. Found * quite a lot of bugs in other places while testing it. * String handling when international characters or wide (UTF-16) * is a pain, and very ugly. May not work in some cases. * Will keep wide (16 bit) characters in strings when importing from * .reg file that has it, like what regedit.exe generates for example. * 2011-apr: Added routines for hive expansion. Will add new hbin at end of file * when needed. If using library, please read ugly warnings in "alloc_block()". * 2010-jun: Patches from Frediano Ziglio adding support for wide characters * and some bugfixes. Thank you! * 2008-mar: Type QWORD (XP/Vista and newer) now recognized * 2008-mar: Most functions accepting a path now also have a parameter specifying if * the search should be exact or on first match basis * 2008-mar: Fixed bug which skipped first indirect index table when deleting keys, * usually leading to endless loop when recursive deleting. * 2008-mar: Export to .reg file by Leo von Klenze, expanded a bit by me. * 2008-mar: 64 bit compatible patch by Mike Doty, via Alon Bar-Lev * http://bugs.gentoo.org/show_bug.cgi?id=185411 * 2007-sep: Verbosity/debug messages minor changes * 2007-apr: LGPL license. * 2004-aug: Deep indirect index support. NT351 support. Recursive delete. * Debugged a lot in allocation routines. Still no expansion. * 2004-jan: Verbosity updates * 2003-jan: Allocation of new data, supports adding/deleting keys & stuff. * Missing is expanding the file. * 2003-jan: Seems there may be garbage pages at end of file, not zero pages * now stops enumerating at first non 'hbin' page. * * NOTE: The API is not frozen. It can and will change every release. * ***** * * NTREG - Window registry file reader / writer library * Copyright (c) 1997-2010 Petter Nordahl-Hagen. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; * version 2.1 of the License. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * See file LGPL.txt for the full license. * */ #include #include #include #include #include #include #include #include #include #include #include "ntreg.h" /* Set to abort() and debug on more critical errors */ #define DOCORE 1 #define ZEROFILL 1 /* Fill blocks with zeroes when allocating and deallocating */ #define ZEROFILLONLOAD 0 /* Fill blocks marked as unused/deallocated with zeroes on load. FOR DEBUG */ const char ntreg_version[] = "ntreg lib routines, v0.95 110511, (c) Petter N Hagen"; const char *val_types[REG_MAX+1] = { "REG_NONE", "REG_SZ", "REG_EXPAND_SZ", "REG_BINARY", "REG_DWORD", /* 0 - 4 */ "REG_DWORD_BIG_ENDIAN", "REG_LINK", /* 5 - 6 */ "REG_MULTI_SZ", "REG_RESOUCE_LIST", "REG_FULL_RES_DESC", "REG_RES_REQ", /* 7 - 10 */ "REG_QWORD", /* 11 */ }; static char * string_prog2regw(void *string, int len, int* out_len); /* Utility routines */ /* toupper() table for registry hashing functions, so we don't have to * dependent upon external locale lib files */ static const unsigned char reg_touppertable[] = { /* ISO 8859-1 is probably not the one.. */ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */ 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */ 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, /* 0x18-0x1f */ 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, /* 0x20-0x27 */ 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, /* 0x28-0x2f */ 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* 0x30-0x37 */ 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, /* 0x38-0x3f */ 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x40-0x47 */ 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x48-0x4f */ 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x50-0x57 */ 0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, /* 0x58-0x5f */ 0x60, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x60-0x67 */ 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x68-0x6f */ 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x70-0x77 */ 0x58, 0x59, 0x5a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */ 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 0x80-0x87 */ 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, /* 0x88-0x8f */ 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, /* 0x90-0x97 */ 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 0x98-0x9f */ 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, /* 0xa0-0xa7 */ 0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, /* 0xa8-0xaf */ 0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0x00, 0xb6, 0xb7, /* 0xb0-0xb7 */ 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, /* 0xb8-0xbf */ 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 0xc0-0xc7 */ 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, /* 0xc8-0xcf */ 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, /* 0xd0-0xd7 */ 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, /* 0xd8-0xdf */ 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 0xe0-0xe7 */ 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, /* 0xe8-0xef */ 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xf7, /* 0xf0-0xf7 */ 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0x00, /* 0xf8-0xff */ }; /* Use table above in strcasecmp else add_key may put names in wrong order and windows actually verifies that on hive load!! or at least it finds out in some cases.. */ int strn_casecmp(const char *s1, const char *s2, size_t n) { char r; while ( *s1 && *s2 && n ) { r = (unsigned char)reg_touppertable[(unsigned char)*s1] - (unsigned char)reg_touppertable[(unsigned char)*s2]; if (r) return(r); n--; s1++; s2++; } if ( (!*s1 && !*s2) || !n) return(0); if ( !*s1 ) return(-1); return(1); } char *str_dup( const char *str ) { char *str_new; if (!str) return 0 ; CREATE( str_new, char, strlen(str) + 1 ); strcpy( str_new, str ); return str_new; } /* Copy non-terminated string to buffer we allocate and null terminate it * Uses length only, does not check for nulls */ char *mem_str( const char *str, int len ) { char *str_new; if (!str) return 0 ; CREATE( str_new, char, len + 1 ); memcpy( str_new, str, len); *(str_new+len) = 0; return str_new; } int fmyinput(char *prmpt, char *ibuf, int maxlen) { printf("%s",prmpt); fgets(ibuf,maxlen+1,stdin); ibuf[strlen(ibuf)-1] = 0; return(strlen(ibuf)); } /* Print len number of hexbytes */ void hexprnt(char *s, unsigned char *bytes, int len) { int i; printf("%s",s); for (i = 0; i < len; i++) { printf("%02x ",bytes[i]); } printf("\n"); } /* HexDump all or a part of some buffer */ void hexdump(char *hbuf, int start, int stop, int ascii) { char c; int diff,i; while (start < stop ) { diff = stop - start; if (diff > 16) diff = 16; printf(":%05X ",start); for (i = 0; i < diff; i++) { printf("%02X ",(unsigned char)*(hbuf+start+i)); } if (ascii) { for (i = diff; i < 16; i++) printf(" "); for (i = 0; i < diff; i++) { c = *(hbuf+start+i); printf("%c", isprint(c) ? c : '.'); } } printf("\n"); start += 16; } } /* General search routine, find something in something else */ int find_in_buf(char *buf, char *what, int sz, int len, int start) { int i; for (; start < sz; start++) { for (i = 0; i < len; i++) { if (*(buf+start+i) != *(what+i)) break; } if (i == len) return(start); } return(0); } /* Get INTEGER from memory. This is probably low-endian specific? */ int get_int( char *array ) { return ((array[0]&0xff) + ((array[1]<<8)&0xff00) + ((array[2]<<16)&0xff0000) + ((array[3]<<24)&0xff000000)); } /* Quick and dirty UNICODE to std. ascii */ void cheap_uni2ascii(char *src, char *dest, int l) { for (; l > 0; l -=2) { *dest = *src; dest++; src +=2; } *dest = 0; } /* Quick and dirty ascii to unicode */ void cheap_ascii2uni(char *src, char *dest, int l) { for (; l > 0; l--) { *dest++ = *src++; *dest++ = 0; } } void skipspace(char **c) { while( **c == ' ' ) (*c)++; } int gethex(char **c) { int value; skipspace(c); if (!(**c)) return(0); sscanf(*c,"%x",&value); while( **c != ' ' && (**c)) (*c)++; return(value); } /* Get a string of HEX bytes (space separated), * or if first char is ' get an ASCII string instead. */ int gethexorstr(char **c, char *wb) { int l = 0; skipspace(c); if ( **c == '\'') { (*c)++; while ( **c ) { *(wb++) = *((*c)++); l++; } } else { do { *(wb++) = gethex(c); l++; skipspace(c); } while ( **c ); } return(l); } /* Simple buffer debugger, returns 1 if buffer dirty/edited */ int debugit(char *buf, int sz) { char inbuf[100],whatbuf[100],*bp; int dirty=0,to,from,l,i,j,wlen,cofs = 0; printf("Buffer debugger. '?' for help.\n"); while (1) { l = fmyinput(".",inbuf,90); bp = inbuf; skipspace(&bp); if (l > 0 && *bp) { switch(*bp) { case 'd' : bp++; if (*bp) { from = gethex(&bp); to = gethex(&bp); } else { from = cofs; to = 0; } if (to == 0) to = from + 0x100; if (to > sz) to = sz; hexdump(buf,from,to,1); cofs = to; break; case 'a' : bp++; if (*bp) { from = gethex(&bp); to = gethex(&bp); } else { from = cofs; to = 0; } if (to == 0) to = from + 0x100; if (to > sz) to = sz; hexdump(buf,from,to,0); cofs = to; break; case 'q': return(0); break; case 's': if (!dirty) printf("Buffer has not changed, no need to write..\n"); return(dirty); break; case 'h': bp++; if (*bp == 'a') { from = 0; to = sz; bp++; } else { from = gethex(&bp); to = gethex(&bp); } wlen = gethexorstr(&bp,whatbuf); if (to > sz) to = sz; printf("from: %x, to: %x, wlen: %d\n",from,to,wlen); for (i = from; i < to; i++) { for (j = 0; j < wlen; j++) { if ( *(buf+i+j) != *(whatbuf+j)) break; } if (j == wlen) printf("%06x ",i); } printf("\n"); break; case ':': bp++; if (!*bp) break; from = gethex(&bp); wlen = gethexorstr(&bp,whatbuf); printf("from: %x, wlen: %d\n",from,wlen); memcpy(buf+from,whatbuf,wlen); dirty = 1; break; case '?': printf("d [] [] - dump buffer within range\n"); printf("a [] [] - same as d, but without ascii-part (for cut'n'paste)\n"); printf(": [ ...] - change bytes\n"); printf("h [ ...] - hunt (search) for bytes\n"); printf("ha [ etc. you may give 'string to enter/search a string\n"); break; default: printf("?\n"); break; } } } } /* ========================================================================= */ /* The following routines are mostly for debugging, I used it * much during discovery. the -t command line option uses it, * also the 'st' and 's' from the editor & hexdebugger. * All offsets shown in these are unadjusted (ie you must add * headerpage (most often 0x1000) to get file offset) */ /* Parse the nk datablock * vofs = offset into struct (after size linkage) */ void parse_nk(struct hive *hdesc, int vofs, int blen) { struct nk_key *key; int i; printf("== nk at offset %0x\n",vofs); /* #define D_OFFS2(o) ( (void *)&(key->o)-(void *)hdesc->buffer-vofs ) */ #define D_OFFS(o) ( (void *)&(key->o)-(void *)hdesc->buffer-vofs ) key = (struct nk_key *)(hdesc->buffer + vofs); printf("%04x type = 0x%02x %s\n", D_OFFS(type) ,key->type, (key->type == KEY_ROOT ? "ROOT_KEY" : "") ); printf("%04x timestamp skipped\n", D_OFFS(timestamp) ); printf("%04x parent key offset = 0x%0x\n", D_OFFS(ofs_parent) ,key->ofs_parent + 0x1000); printf("%04x number of subkeys = %d\n", D_OFFS(no_subkeys),key->no_subkeys); printf("%04x lf-record offset = 0x%0x\n",D_OFFS(ofs_lf),key->ofs_lf + 0x1000); printf("%04x number of values = %d\n", D_OFFS(no_values),key->no_values); printf("%04x val-list offset = 0x%0x\n",D_OFFS(ofs_vallist),key->ofs_vallist + 0x1000); printf("%04x sk-record offset = 0x%0x\n",D_OFFS(ofs_sk),key->ofs_sk + 0x1000); printf("%04x classname offset = 0x%0x\n",D_OFFS(ofs_classnam),key->ofs_classnam + 0x1000); printf("%04x dummy3 = 0x%0x (%d)\n",D_OFFS(dummy3),key->dummy3,key->dummy3); printf("%04x dummy4 = 0x%0x (%d)\n",D_OFFS(dummy4),key->dummy4,key->dummy4); printf("%04x dummy5 = 0x%0x (%d)\n",D_OFFS(dummy5),key->dummy5,key->dummy5); printf("%04x dummy6 = 0x%0x (%d)\n",D_OFFS(dummy6),key->dummy6,key->dummy6); printf("%04x dummy7 = 0x%0x (%d)\n",D_OFFS(dummy7),key->dummy7,key->dummy7); printf("%04x name length = %d\n", D_OFFS(len_name),key->len_name); printf("%04x classname length = %d\n", D_OFFS(len_classnam),key->len_classnam); printf("%04x Key name: <",D_OFFS(keyname) ); for(i = 0; i < key->len_name; i++) putchar(key->keyname[i]); printf(">\n== End of key info.\n"); } /* Parse the vk datablock * vofs = offset into struct (after size linkage) */ void parse_vk(struct hive *hdesc, int vofs, int blen) { struct vk_key *key; int i; printf("== vk at offset %0x\n",vofs); key = (struct vk_key *)(hdesc->buffer + vofs); printf("%04x name length = %d (0x%0x)\n", D_OFFS(len_name), key->len_name, key->len_name ); printf("%04x length of data = %d (0x%0x)\n", D_OFFS(len_data), key->len_data, key->len_data ); printf("%04x data offset = 0x%0x\n",D_OFFS(ofs_data),key->ofs_data + 0x1000); printf("%04x value type = 0x%0x %s\n", D_OFFS(val_type), key->val_type, (key->val_type <= REG_MAX ? val_types[key->val_type] : "(unknown)") ) ; printf("%04x flag = 0x%0x\n",D_OFFS(flag),key->flag); printf("%04x *unused?* = 0x%0x\n",D_OFFS(dummy1),key->dummy1); printf("%04x Key name: <",D_OFFS(keyname) ); for(i = 0; i < key->len_name; i++) putchar(key->keyname[i]); printf(">\n== End of key info.\n"); } /* Parse the sk datablock * Gee, this is the security info. Who cares? *evil grin* * vofs = offset into struct (after size linkage) */ void parse_sk(struct hive *hdesc, int vofs, int blen) { struct sk_key *key; /* int i; */ printf("== sk at offset %0x\n",vofs); key = (struct sk_key *)(hdesc->buffer + vofs); printf("%04x *unused?* = %d\n" , D_OFFS(dummy1), key->dummy1 ); printf("%04x Offset to prev sk = 0x%0x\n", D_OFFS(ofs_prevsk), key->ofs_prevsk + 0x1000); printf("%04x Offset to next sk = 0x%0x\n", D_OFFS(ofs_nextsk), key->ofs_nextsk + 0x1000); printf("%04x Usage counter = %d (0x%0x)\n", D_OFFS(no_usage), key->no_usage,key->no_usage); printf("%04x Security data len = %d (0x%0x)\n", D_OFFS(len_sk), key->len_sk,key->len_sk); printf("== End of key info.\n"); } /* Parse the lf datablock (>4.0 'nk' offsets lookuptable) * vofs = offset into struct (after size linkage) */ void parse_lf(struct hive *hdesc, int vofs, int blen) { struct lf_key *key; int i; printf("== lf at offset %0x\n",vofs); key = (struct lf_key *)(hdesc->buffer + vofs); printf("%04x number of keys = %d\n", D_OFFS(no_keys), key->no_keys ); for(i = 0; i < key->no_keys; i++) { printf("%04x %3d Offset: 0x%0x - <%c%c%c%c>\n", D_OFFS(hash[i].ofs_nk), i, key->hash[i].ofs_nk + 0x1000, key->hash[i].name[0], key->hash[i].name[1], key->hash[i].name[2], key->hash[i].name[3] ); } printf("== End of key info.\n"); } /* Parse the lh datablock (WinXP offsets lookuptable) * vofs = offset into struct (after size linkage) * The hash is most likely a base 37 conversion of the name string */ void parse_lh(struct hive *hdesc, int vofs, int blen) { struct lf_key *key; int i; printf("== lh at offset %0x\n",vofs); key = (struct lf_key *)(hdesc->buffer + vofs); printf("%04x number of keys = %d\n", D_OFFS(no_keys), key->no_keys ); for(i = 0; i < key->no_keys; i++) { printf("%04x %3d Offset: 0x%0x - \n", D_OFFS(lh_hash[i].ofs_nk), i, key->lh_hash[i].ofs_nk + 0x1000, key->lh_hash[i].hash ); } printf("== End of key info.\n"); } /* Parse the li datablock (3.x 'nk' offsets list) * vofs = offset into struct (after size linkage) */ void parse_li(struct hive *hdesc, int vofs, int blen) { struct li_key *key; int i; printf("== li at offset %0x\n",vofs); /* #define D_OFFS(o) ( (void *)&(key->o)-(void *)hdesc->buffer-vofs ) */ key = (struct li_key *)(hdesc->buffer + vofs); printf("%04x number of keys = %d\n", D_OFFS(no_keys), key->no_keys ); for(i = 0; i < key->no_keys; i++) { printf("%04x %3d Offset: 0x%0x\n", D_OFFS(hash[i].ofs_nk), i, key->hash[i].ofs_nk + 0x1000); } printf("== End of key info.\n"); } /* Parse the ri subindex-datablock * (Used to list li/lf/lh's when ~>500keys) * vofs = offset into struct (after size linkage) */ void parse_ri(struct hive *hdesc, int vofs, int blen) { struct ri_key *key; int i; printf("== ri at offset %0x\n",vofs); /* #define D_OFFS(o) ( (void *)&(key->o)-(void *)hdesc->buffer-vofs ) */ key = (struct ri_key *)(hdesc->buffer + vofs); printf("%04x number of subindices = %d\n", D_OFFS(no_lis), key->no_lis ); for(i = 0; i < key->no_lis; i++) { printf("%04x %3d Offset: 0x%0x\n", D_OFFS(hash[i].ofs_li), i, key->hash[i].ofs_li + 0x1000); } printf("== End of key info.\n"); } /* Parse the db block (used when value data >4k or something) * vofs = offset into struct (after size linkage) */ void parse_db(struct hive *hdesc, int vofs, int blen) { struct db_key *key; printf("== db at offset %0x\n",vofs); key = (struct db_key *)(hdesc->buffer + vofs); printf("%04x number of parts = %d\n", D_OFFS(no_part), key->no_part ); printf("%04x Data list at offset: 0x%0x\n", D_OFFS(ofs_data), key->ofs_data + 0x1000); printf("== End of key info.\n"); } /* Parse the datablock * vofs = offset into struct (after size linkage) */ int parse_block(struct hive *hdesc, int vofs,int verbose) { unsigned short id; int seglen; seglen = get_int(hdesc->buffer+vofs); // if (vofs > 0xaef000) verbose = 1; #if 0 if (verbose || seglen == 0) { printf("** Block at offset %0x\n",vofs); printf("seglen: %d, %u, 0x%0x\n",seglen,seglen,seglen); } #endif if (seglen == 0) { printf("parse_block: FATAL! Zero data block size! (not registry or corrupt file?)\n"); debugit(hdesc->buffer,hdesc->size); return(0); } if (seglen < 0) { seglen = -seglen; hdesc->usetot += seglen; hdesc->useblk++; if (verbose) { printf("USED BLOCK @ %06x to %06x : %d, 0x%0x\n",vofs,vofs+seglen,seglen,seglen); /* hexdump(hdesc->buffer,vofs,vofs+seglen+4,1); */ } } else { hdesc->unusetot += seglen; hdesc->unuseblk++; /* Useful to zero blocks we think are empty when debugging.. */ #if ZEROFILLONLOAD bzero(hdesc->buffer+vofs+4,seglen-4); #endif if (verbose) { printf("FREE BLOCK @ %06x to %06x : %d, 0x%0x\n",vofs,vofs+seglen,seglen,seglen); /* hexdump(hdesc->buffer,vofs,vofs+seglen+4,1); */ } } vofs += 4; id = (*(hdesc->buffer + vofs)<<8) + *(hdesc->buffer+vofs+1); if (verbose > 1) { switch (id) { case 0x6e6b: /* nk */ parse_nk(hdesc, vofs, seglen); break; case 0x766b: /* vk */ parse_vk(hdesc, vofs, seglen); break; case 0x6c66: /* lf */ parse_lf(hdesc, vofs, seglen); break; case 0x6c68: /* lh */ parse_lh(hdesc, vofs, seglen); break; case 0x6c69: /* li */ parse_li(hdesc, vofs, seglen); break; case 0x736b: /* sk */ parse_sk(hdesc, vofs, seglen); break; case 0x7269: /* ri */ parse_ri(hdesc, vofs, seglen); break; case 0x6462: /* db */ parse_db(hdesc, vofs, seglen); break; default: printf("value data, or not handeled yet!\n"); break; } } return(seglen); } /* ================================================================ */ /* Scan and allocation routines */ /* Find start of page given a current pointer into the buffer * hdesc = hive * vofs = offset pointer into buffer * returns: offset to start of page (and page header) */ int find_page_start(struct hive *hdesc, int vofs) { int r,prev; struct hbin_page *h; /* Again, assume start at 0x1000 */ r = 0x1000; while (r < hdesc->size) { prev = r; h = (struct hbin_page *)(hdesc->buffer + r); if (h->id != 0x6E696268) return(0); if (h->ofs_next == 0) { printf("find_page_start: zero len or ofs_next found in page at 0x%x\n",r); return(0); } r += h->ofs_next; if (r > vofs) return (prev); } return(0); } /* Find free space in page * size = requested size in bytes * pofs = offset to start of actual page header * returns: offset to free block, or 0 for error */ #define FB_DEBUG 0 int find_free_blk(struct hive *hdesc, int pofs, int size) { int vofs = pofs + 0x20; int seglen; struct hbin_page *p; p = (struct hbin_page *)(hdesc->buffer + pofs); while (vofs-pofs < (p->ofs_next - HBIN_ENDFILL)) { seglen = get_int(hdesc->buffer+vofs); #if FB_DEBUG if (vofs > 0x400000) { printf("** Block at offset %0x\n",vofs); printf("seglen: %d, %u, 0x%0x\n",seglen,seglen,seglen); } #endif if (seglen == 0) { printf("find_free_blk: FATAL! Zero data block size! (not registry or corrupt file?)\n"); printf(" : Block at offset %0x\n",vofs); if ( (vofs - pofs) == (p->ofs_next - 4) ) { printf("find_free_blk: at exact end of hbin, do not care..\n"); return(0); } abort(); debugit(hdesc->buffer,hdesc->size); return(0); } if (seglen < 0) { seglen = -seglen; #if FB_DEBUG if (vofs >0x400000) printf("USED BLOCK: %d, 0x%0x\n",seglen,seglen); #endif /* hexdump(hdesc->buffer,vofs,vofs+seglen+4,1); */ } else { #if FB_DEBUG if (vofs >0x400000) printf("FREE BLOCK!\n"); #endif /* hexdump(hdesc->buffer,vofs,vofs+seglen+4,1); */ if (seglen >= size) { #if FB_DEBUG if (vofs >0x400000) printf("find_free_blk: found size %d block at 0x%x\n",seglen,vofs); #endif #if 0 if (vofs == 0x19fb8) { printf("find_free_blk: vofs = %x, seglen = %x\n",vofs,seglen); debugit(hdesc->buffer,hdesc->size); abort(); } #endif return(vofs); } } vofs += seglen; } return(0); } #undef FB_DEBUG /* Search pages from start to find free block * hdesc - hive * size - space requested, in bytes * returns: offset to free block, 0 if not found or error */ int find_free(struct hive *hdesc, int size) { int r,blk; struct hbin_page *h; /* Align to 8 byte boundary */ if (size & 7) size += (8 - (size & 7)); /* Again, assume start at 0x1000 */ r = 0x1000; while (r < hdesc->endofs) { h = (struct hbin_page *)(hdesc->buffer + r); if (h->id != 0x6E696268) return(0); if (h->ofs_next == 0) { printf("find_free: zero len or ofs_next found in page at 0x%x\n",r); return(0); } blk = find_free_blk(hdesc,r,size); if (blk) return (blk); r += h->ofs_next; } return(0); } /* Add new hbin to end of file. If file contains data at end * that is not in a hbin, include that too * hdesc - hive as usual * size - minimum size (will be rounded up to next 0x1000 alignment) * returns offset to first block in new hbin */ #define ADDBIN_DEBUG int add_bin(struct hive *hdesc, int size) { int r,newsize,newbinofs; struct hbin_page *newbin; struct regf_header *hdr; if (hdesc->state & HMODE_NOEXPAND) { fprintf(stderr,"ERROR: Registry hive <%s> need to be expanded,\n" "but that is not allowed according to selected options. Operations will fail.\n", hdesc->filename); return(0); } r = ((size + 0x20 + 4) & ~0xfff) + HBIN_PAGESIZE; /* Add header and link, round up to page boundary, usually 0x1000 */ newbinofs = hdesc->endofs; #ifdef ADDBIN_DEBUG printf("add_bin: request size = %d [%x], rounded to %d [%x]\n",size,size,r,r); printf("add_bin: old buffer size = %d [%x]\n",hdesc->size,hdesc->size); printf("add_bin: firs nonbin off = %d [%x]\n",newbinofs,newbinofs); printf("add_bin: free at end = %d [%x]\n",hdesc->size-newbinofs,hdesc->size-newbinofs); #endif if ( (newbinofs + r) >= hdesc->size) { /* We must allocate more buffer */ newsize = ( (newbinofs + r) & ~(REGF_FILEDIVISOR-1) ) + REGF_FILEDIVISOR; /* File normally multiple of 0x40000 bytes */ #ifdef ADDBIN_DEBUG printf("add_bin: new buffer size = %d [%x]\n",newsize,newsize); #endif hdesc->buffer = realloc(hdesc->buffer, newsize); if (!hdesc->buffer) { perror("add_bin : realloc() "); abort(); } hdesc->size = newsize; } /* At this point, we have large enough space at end of file */ newbin = (struct hbin_page *)(hdesc->buffer + newbinofs); bzero((void *)newbin, r); /* zero out new hbin, easier to debug too */ newbin->id = 0x6E696268; /* 'hbin' */ newbin->ofs_self = newbinofs - 0x1000; /* Point to ourselves minus regf. Seem to be that.. */ newbin->ofs_next = r; /* size of this new bin */ /* Wonder if anything else in the hbin header matters? */ /* Set whole hbin to be one contious unused block */ newbin->firstlink = (r - 0x20 - 0); /* Positive linkage = unused */ /* Update REGF header */ hdr = (struct regf_header *) hdesc->buffer; hdr->filesize = newbinofs + r - 0x1000; /* Point header to new end of data */ #ifdef ADDBIN_DEBUG printf("add_bin: adjusting size field in REGF: %d [%x]\n",hdr->filesize,hdr->filesize); #endif /* Update state */ hdesc->state |= HMODE_DIDEXPAND | HMODE_DIRTY; hdesc->lastbin = newbinofs; /* Last bin */ hdesc->endofs = newbinofs + r; /* New data end */ return(newbinofs + 0x20); } /* Allocate a block of requested size if possible * hdesc - hive * pofs - If >0 will try this page first (ptr may be inside page) * size - number of bytes to allocate * returns: 0 - failed, else pointer to allocated block. * WARNING: Will realloc() buffer if it has to be expanded! * ALL POINTERS TO BUFFER IS INVALID AFTER THAT. (offsets are still correct) * Guess I'd better switch to mmap() one day.. * This function WILL CHANGE THE HIVE (change block linkage) if it * succeeds. */ int alloc_block(struct hive *hdesc, int ofs, int size) { int pofs = 0; int blk = 0; int newbin; int trail, trailsize, oldsz; if (hdesc->state & HMODE_NOALLOC) { printf("\nERROR: alloc_block: Hive <%s> is in no allocation safe mode," "new space not allocated. Operation will fail!\n", hdesc->filename); return(0); } size += 4; /* Add linkage */ if (size & 7) size += (8 - (size & 7)); /* Check current page first */ if (ofs) { pofs = find_page_start(hdesc,ofs); blk = find_free_blk(hdesc,pofs,size); } /* Then check whole hive */ if (!blk) { blk = find_free(hdesc,size); } if (blk) { /* Got the space */ oldsz = get_int(hdesc->buffer+blk); #if 0 printf("Block at : %x\n",blk); printf("Old block size is: %x\n",oldsz); printf("New block size is: %x\n",size); #endif trailsize = oldsz - size; if (trailsize == 4) { trailsize = 0; size += 4; } #if 1 if (trailsize & 7) { /* Trail must be 8 aligned */ trailsize -= (8 - (trailsize & 7)); size += (8 - (trailsize & 7)); } if (trailsize == 4) { trailsize = 0; size += 4; } #endif #if 0 printf("trail after comp: %x\n",trailsize); printf("size after comp: %x\n",size); #endif /* Now change pointers on this to reflect new size */ *(int *)((hdesc->buffer)+blk) = -(size); /* If the fit was exact (unused block was same size as wee need) * there is no need for more, else make free block after end * of newly allocated one */ hdesc->useblk++; hdesc->unuseblk--; hdesc->usetot += size; hdesc->unusetot -= size; if (trailsize) { trail = blk + size; *(int *)((hdesc->buffer)+trail) = (int)trailsize; hdesc->useblk++; /* This will keep blockcount */ hdesc->unuseblk--; hdesc->usetot += 4; /* But account for more linkage bytes */ hdesc->unusetot -= 4; } /* Clear the block data, makes it easier to debug */ #if ZEROFILL bzero( (void *)(hdesc->buffer+blk+4), size-4); #endif hdesc->state |= HMODE_DIRTY; #if 0 printf("alloc_block: returning %x\n",blk); #endif return(blk); } else { printf("alloc_block: failed to alloc %d bytes, trying to expand hive..\n",size); newbin = add_bin(hdesc,size); if (newbin) return(alloc_block(hdesc,newbin,size)); /* Nasty... recall ourselves. */ /* Fallthrough to fail if add_bin fails */ } return(0); } /* Free a block in registry * hdesc - hive * blk - offset of block, MUST POINT TO THE LINKAGE! * returns bytes freed (incl linkage bytes) or 0 if fail * Will CHANGE HIVE IF SUCCESSFUL (changes linkage) */ #define FB_DEBUG 0 int free_block(struct hive *hdesc, int blk) { int pofs,vofs,seglen,prev,next,nextsz,prevsz,size; struct hbin_page *p; if (hdesc->state & HMODE_NOALLOC) { printf("free_block: ERROR: Hive %s is in no allocation safe mode," "space not freed. Operation will fail!\n", hdesc->filename); return(0); } size = get_int(hdesc->buffer+blk); if (size >= 0) { printf("free_block: trying to free already free block!\n"); #ifdef DOCORE printf("blk = %x\n",blk); debugit(hdesc->buffer,hdesc->size); abort(); #endif return(0); } size = -size; /* So, we must find start of the block BEFORE us */ pofs = find_page_start(hdesc,blk); if (!pofs) return(0); p = (struct hbin_page *)(hdesc->buffer + pofs); vofs = pofs + 0x20; prevsz = -32; if (vofs != blk) { /* Block is not at start of page? */ while (vofs-pofs < (p->ofs_next - HBIN_ENDFILL) ) { seglen = get_int(hdesc->buffer+vofs); if (seglen == 0) { printf("free_block: EEEK! Zero data block size! (not registry or corrupt file?)\n"); debugit(hdesc->buffer,hdesc->size); return(0); } if (seglen < 0) { seglen = -seglen; /* hexdump(hdesc->buffer,vofs,vofs+seglen+4,1); */ } prev = vofs; vofs += seglen; if (vofs == blk) break; } if (vofs != blk) { printf("free_block: ran off end of page!?!? Error in chains?\n"); #ifdef DOCORE printf("vofs = %x, pofs = %x, blk = %x\n",vofs,pofs,blk); debugit(hdesc->buffer,hdesc->size); abort(); #endif return(0); } prevsz = get_int(hdesc->buffer+prev); } /* We also need details on next block (unless at end of page) */ next = blk + size; nextsz = 0; if (next-pofs < (p->ofs_next - HBIN_ENDFILL) ) nextsz = get_int(hdesc->buffer+next); #if 0 printf("offset prev : %x , blk: %x , next: %x\n",prev,blk,next); printf("size prev : %x , blk: %x , next: %x\n",prevsz,size,nextsz); #endif /* Now check if next block is free, if so merge it with the one to be freed */ if ( nextsz > 0) { #if 0 printf("Swallow next\n"); #endif size += nextsz; /* Swallow it in current block */ hdesc->useblk--; hdesc->usetot -= 4; hdesc->unusetot -= 4; /* FIXME !??!?? */ } /* Now free the block (possibly with ajusted size as above) */ #if ZEROFILL bzero( (void *)(hdesc->buffer+blk), size); #endif *(int *)((hdesc->buffer)+blk) = (int)size; hdesc->usetot -= size; hdesc->unusetot -= size; /* FIXME !?!? */ hdesc->unuseblk--; hdesc->state |= HMODE_DIRTY; /* Check if previous block is also free, if so, merge.. */ if (prevsz > 0) { #if 0 printf("Swallow prev\n"); #endif hdesc->usetot -= prevsz; hdesc->unusetot += prevsz; prevsz += size; /* And swallow current.. */ #if ZEROFILL bzero( (void *)(hdesc->buffer+prev), prevsz); #endif *(int *)((hdesc->buffer)+prev) = (int)prevsz; hdesc->useblk--; return(prevsz); } return(size); } /* ================================================================ */ /* ** Registry manipulation routines ** */ /* "directory scan", return next name/pointer of a subkey on each call * nkofs = offset to directory to scan * lfofs = pointer to int to hold the current scan position, * set position to 0 to start. * sptr = pointer to struct to hold a single result * returns: -1 = error. 0 = end of key. 1 = more subkeys to scan * NOTE: caller must free the name-buffer (struct ex_data *name) */ int ex_next_n(struct hive *hdesc, int nkofs, int *count, int *countri, struct ex_data *sptr) { struct nk_key *key, *newnkkey; int newnkofs; struct lf_key *lfkey; struct li_key *likey; struct ri_key *rikey; if (!nkofs) return(-1); key = (struct nk_key *)(hdesc->buffer + nkofs); if (key->id != 0x6b6e) { printf("ex_next error: Not a 'nk' node at 0x%0x\n",nkofs); return(-1); } #define EXNDEBUG 0 lfkey = (struct lf_key *)(hdesc->buffer + key->ofs_lf + 0x1004); rikey = (struct ri_key *)(hdesc->buffer + key->ofs_lf + 0x1004); if (rikey->id == 0x6972) { /* Is it extended 'ri'-block? */ #if EXNDEBUG printf("%d , %d\n",*countri,*count); #endif if (*countri < 0 || *countri >= rikey->no_lis) { /* End of ri's? */ return(0); } /* Get the li of lf-struct that's current based on countri */ likey = (struct li_key *)( hdesc->buffer + rikey->hash[*countri].ofs_li + 0x1004 ) ; if (likey->id == 0x696c) { newnkofs = likey->hash[*count].ofs_nk + 0x1000; } else { lfkey = (struct lf_key *)( hdesc->buffer + rikey->hash[*countri].ofs_li + 0x1004 ) ; newnkofs = lfkey->hash[*count].ofs_nk + 0x1000; } /* Check if current li/lf is exhausted */ #if EXNDEBUG printf("likey->no_keys = %d\n",likey->no_keys); #endif if (*count >= likey->no_keys-1) { /* Last legal entry in li list? */ (*countri)++; /* Bump up ri count so we take next ri entry next time */ (*count) = -1; /* Reset li traverse counter for next round, not used later here */ } } else { /* Plain handler */ if (key->no_subkeys <= 0 || *count >= key->no_subkeys) { return(0); } if (lfkey->id == 0x696c) { /* Is it 3.x 'li' instead? */ likey = (struct li_key *)(hdesc->buffer + key->ofs_lf + 0x1004); newnkofs = likey->hash[*count].ofs_nk + 0x1000; } else { newnkofs = lfkey->hash[*count].ofs_nk + 0x1000; } } sptr->nkoffs = newnkofs; newnkkey = (struct nk_key *)(hdesc->buffer + newnkofs + 4); sptr->nk = newnkkey; if (newnkkey->id != 0x6b6e) { printf("ex_next: ERROR: not 'nk' node at 0x%0x\n",newnkofs); return(-1); } else { if (newnkkey->len_name <= 0) { printf("ex_next: nk at 0x%0x has no name!\n",newnkofs); } else if (newnkkey->type & 0x20) { #if 0 printf("dummy1 %x\n", *((int*)newnkkey->dummy1)); printf("dummy2 %x\n", *((int*)newnkkey->dummy2)); printf("type %x\n", newnkkey->type); printf("timestamp+8 %x\n", *((int*)(newnkkey->timestamp+8))); printf("dummy3+0 %x\n", *((int*)(newnkkey->dummy3+0))); printf("dummy3+4 %x\n", *((int*)(newnkkey->dummy3+4))); printf("dummy3+8 %x\n", *((int*)(newnkkey->dummy3+8))); printf("dummy3+12 %x\n", *((int*)(newnkkey->dummy3+12))); printf("dummy4 %x\n", *((int*)&newnkkey->dummy4)); printf("len %d\n", newnkkey->len_name); printf("len class %d\n", newnkkey->len_classnam); fflush(stdout); #endif sptr->name = mem_str(newnkkey->keyname,newnkkey->len_name); // sptr->name = string_rega2prog(newnkkey->keyname, newnkkey->len_name); } else { sptr->name = string_regw2prog(newnkkey->keyname, newnkkey->len_name); } } /* if */ (*count)++; return(1); /* return( *count <= key->no_subkeys); */ } /* "directory scan" for VALUES, return next name/pointer of a value on each call * nkofs = offset to directory to scan * lfofs = pointer to int to hold the current scan position, * set position to 0 to start. * sptr = pointer to struct to hold a single result * returns: -1 = error. 0 = end of key. 1 = more values to scan * NOTE: caller must free the name-buffer (struct vex_data *name) */ int ex_next_v(struct hive *hdesc, int nkofs, int *count, struct vex_data *sptr) { struct nk_key *key /* , *newnkkey */ ; int vkofs,vlistofs; int *vlistkey; struct vk_key *vkkey; if (!nkofs) return(-1); key = (struct nk_key *)(hdesc->buffer + nkofs); if (key->id != 0x6b6e) { printf("ex_next_v error: Not a 'nk' node at 0x%0x\n",nkofs); return(-1); } if (key->no_values <= 0 || *count >= key->no_values) { return(0); } vlistofs = key->ofs_vallist + 0x1004; vlistkey = (int *)(hdesc->buffer + vlistofs); vkofs = vlistkey[*count] + 0x1004; vkkey = (struct vk_key *)(hdesc->buffer + vkofs); if (vkkey->id != 0x6b76) { printf("ex_next_v: hit non valuekey (vk) node during scan at offs 0x%0x\n",vkofs); return(-1); } /* parse_vk(hdesc, vkofs, 4); */ sptr->vk = vkkey; sptr->vkoffs = vkofs; sptr->name = 0; sptr->size = (vkkey->len_data & 0x7fffffff); if (vkkey->len_name >0) { if (vkkey->flag & 1) { sptr->name = mem_str(vkkey->keyname, vkkey->len_name); // sptr->name = string_rega2prog(vkkey->keyname, vkkey->len_name); } else { sptr->name = string_regw2prog(vkkey->keyname, vkkey->len_name); } } else { sptr->name = str_dup(""); } sptr->type = vkkey->val_type; if (sptr->size) { if (vkkey->val_type == REG_DWORD) { if (vkkey->len_data & 0x80000000) { sptr->val = (int)(vkkey->ofs_data); } } } #if 0 else if (vkkey->len_data == 0x80000000) { /* Data SIZE is 0, high bit set: special inline case, data is DWORD and in TYPE field!! */ /* Used a lot in SAM, and maybe in SECURITY I think */ sptr->val = (int)(vkkey->val_type); sptr->size = 4; sptr->type = REG_DWORD; } else { sptr->val = 0; sptr->size = 0; } #endif (*count)++; return( *count <= key->no_values ); } /* traceback - trace nk's back to root, * building path string as we go. * nkofs = offset to nk-node * path = pointer to pathstring-buffer * maxlen = max length of path-buffer * return: length of path string */ int get_abs_path(struct hive *hdesc, int nkofs, char *path, int maxlen) { /* int newnkofs; */ struct nk_key *key; char tmp[ABSPATHLEN+1]; char *keyname; int len_name; maxlen = (maxlen < ABSPATHLEN ? maxlen : ABSPATHLEN); key = (struct nk_key *)(hdesc->buffer + nkofs); if (key->id != 0x6b6e) { printf("get_abs_path: Not a 'nk' node!\n"); return(0); } if (key->type == KEY_ROOT) { /* We're at the root */ return(strlen(path)); } strncpy(tmp,path,ABSPATHLEN-1); if (key->type & 0x20) keyname = mem_str(key->keyname, key->len_name); // keyname = string_rega2prog(key->keyname, key->len_name); else keyname = string_regw2prog(key->keyname, key->len_name); len_name = strlen(keyname); if ( (strlen(path) + len_name) >= maxlen-6) { free(keyname); snprintf(path,maxlen,"(...)%s",tmp); return(strlen(path)); /* Stop trace when string exhausted */ } *path = '\\'; memcpy(path+1,keyname,len_name); free(keyname); strncpy(path+len_name+1,tmp,maxlen-6-len_name); return(get_abs_path(hdesc, key->ofs_parent+0x1004, path, maxlen)); /* go back one more */ } /* Value index table lookup * hdesc - hive as usual * vlistofs - offset of table * name - value name to look for * returns index into table or -1 if err */ int vlist_find(struct hive *hdesc, int vlistofs, int numval, char *name, int type) { struct vk_key *vkkey; int i,vkofs,len; int32_t *vlistkey; int approx = -1; len = strlen(name); vlistkey = (int32_t *)(hdesc->buffer + vlistofs); // printf("vlist_find: <%s> len = %d\n",name,len); for (i = 0; i < numval; i++) { vkofs = vlistkey[i] + 0x1004; vkkey = (struct vk_key *)(hdesc->buffer + vkofs); if (vkkey->len_name == 0 && *name == '@' && len == 1) { /* @ is alias for nameless value */ return(i); } // printf("vlist_find: matching against: <%s> len = %d\n",vkkey->keyname,vkkey->len_name); if ( (type & TPF_EXACT) && vkkey->len_name != len ) continue; /* Skip if exact match and not exact size */ if ( vkkey->len_name >= len ) { /* Only check for names that are longer or equal than we seek */ if ( !strncmp(name, vkkey->keyname, len) ) { /* Name match */ if (vkkey->len_name == len) return(i); /* Exact match always best, returns */ if (approx == -1) approx = i; /* Else remember first partial match */ } } } return(approx); } /* Recursevely follow 'nk'-nodes based on a path-string, * returning offset of last 'nk' or 'vk' * vofs - offset to start node * path - null-terminated pathname (relative to vofs, \ is separator) * type - type to return TPF_??, see ntreg.h * return: offset to nk or vk (or NULL if not found) */ int trav_path(struct hive *hdesc, int vofs, char *path, int type) { struct nk_key *key, *newnkkey; struct lf_key *lfkey; struct li_key *likey; struct ri_key *rikey; int32_t *vlistkey; int newnkofs, plen, i, lfofs, vlistofs, adjust, r, ricnt, subs; char *buf; char part[ABSPATHLEN+1]; char *partptr; if (!hdesc) return(0); buf = hdesc->buffer; // printf("trav_path: called with vofs = %x, path = <%s>, type = %x\n",vofs, path, type); if (!vofs) vofs = hdesc->rootofs+4; /* No current key given , so start at root */ if ( !(type & TPF_ABS) && *path == '\\' && *(path+1) != '\\') { /* Start from root if path starts with \ */ path++; vofs = hdesc->rootofs+4; } key = (struct nk_key *)(buf + vofs); // printf("check of nk at offset: 0x%0x\n",vofs); if (key->id != 0x6b6e) { printf("trav_path: Error: Not a 'nk' node!\n"); return(0); } if ( !(type & TPF_ABS)) { /* Only traverse path if not absolute literal value name passed */ /* TODO: Need to rethink this.. */ /* Find \ delimiter or end of string, copying to name part buffer as we go, rewriting double \\s */ partptr = part; for(plen = 0; path[plen] && (path[plen] != '\\' || path[plen+1] == '\\'); plen++) { if (path[plen] == '\\' && path[plen+1] == '\\') plen++; /* Skip one if double */ *partptr++ = path[plen]; } *partptr = '\0'; #if 0 printf("Name part: <%s>\n",part); printf("Name path: <%s>\n",path); #endif adjust = (path[plen] == '\\' ) ? 1 : 0; // printf("Checking for <%s> with len %d\n",path,plen); if (!plen) return(vofs-4); /* Path has no lenght - we're there! */ if ( (plen == 1) && (*(path+1) && *path == '.') && !(type & TPF_EXACT)) { /* Handle '.' current dir */ // printf("** handle current\n"); return(trav_path(hdesc,vofs,path+plen+adjust,type)); } if ( !(type & TPF_EXACT) && (plen == 2) && !strncmp("..",path,2) ) { /* Get parent key */ newnkofs = key->ofs_parent + 0x1004; /* Return parent (or only root if at the root) */ return(trav_path(hdesc, (key->type == KEY_ROOT ? vofs : newnkofs), path+plen+adjust, type)); } } /* at last name of path, and we want vk, and the nk has values */ if ((type & TPF_VK_ABS) || (!path[plen] && (type & TPF_VK) && key->no_values) ) { // if ( (!path[plen] && (type & TPF_VK) && key->no_values) ) { if (type & TPF_ABS) { strcpy(part, path); plen = de_escape(part,0); partptr = part + plen; } // printf("VK namematch for <%s>, type = %d\n",part,type); vlistofs = key->ofs_vallist + 0x1004; vlistkey = (int32_t *)(buf + vlistofs); i = vlist_find(hdesc, vlistofs, key->no_values, part, type); if (i != -1) { return(vlistkey[i] + 0x1000); } } if (key->no_subkeys > 0) { /* If it has subkeys, loop through the hash */ char *partw = NULL; int partw_len, part_len; // printf("trav_path: subkey loop: path = %s, part = %s\n",path,part); lfofs = key->ofs_lf + 0x1004; /* lf (hash) record */ lfkey = (struct lf_key *)(buf + lfofs); if (lfkey->id == 0x6972) { /* ri struct need special parsing */ /* Prime loop state */ rikey = (struct ri_key *)lfkey; ricnt = rikey->no_lis; r = 0; likey = (struct li_key *)( hdesc->buffer + rikey->hash[r].ofs_li + 0x1004 ) ; subs = likey->no_keys; if (likey->id != 0x696c) { /* Bwah, not li anyway, XP uses lh usually which is actually smarter */ lfkey = (struct lf_key *)( hdesc->buffer + rikey->hash[r].ofs_li + 0x1004 ) ; likey = NULL; } } else { if (lfkey->id == 0x696c) { /* li? */ likey = (struct li_key *)(buf + lfofs); } else { likey = NULL; } rikey = NULL; ricnt = 0; r = 0; subs = key->no_subkeys; } partw = string_prog2regw(part, partptr-part, &partw_len); // string_prog2rega(part, partptr-part); part_len = strlen(part); do { for(i = 0; i < subs; i++) { if (likey) newnkofs = likey->hash[i].ofs_nk + 0x1004; else newnkofs = lfkey->hash[i].ofs_nk + 0x1004; newnkkey = (struct nk_key *)(buf + newnkofs); if (newnkkey->id != 0x6b6e) { printf("ERROR: not 'nk' node! (strange?)\n"); } else { if (newnkkey->len_name <= 0) { printf("[No name]\n"); } else if ( ( ( part_len <= newnkkey->len_name ) && !(type & TPF_EXACT) ) || ( ( part_len == newnkkey->len_name ) && (type & TPF_EXACT) ) ) { /* Can't match if name is shorter than we look for */ int cmp; // printf("trav_path: part = <%s>, part_len = %d\n",part,part_len); if (newnkkey->type & 0x20) cmp = strncmp(part,newnkkey->keyname,part_len); else cmp = memcmp(partw, newnkkey->keyname, partw_len); if (!cmp) { // printf("Key at 0x%0x matches! recursing! new path = %s\n",newnkofs,path+plen+adjust); free(partw); return(trav_path(hdesc, newnkofs, path+plen+adjust, type)); } } } /* if id OK */ } /* hash loop */ r++; if (ricnt && r < ricnt) { newnkofs = rikey->hash[r].ofs_li; likey = (struct li_key *)( hdesc->buffer + newnkofs + 0x1004 ) ; subs = likey->no_keys; if (likey->id != 0x696c) { /* Bwah, not li anyway, XP uses lh usually which is actually smarter */ lfkey = (struct lf_key *)( hdesc->buffer + rikey->hash[r].ofs_li + 0x1004 ) ; likey = NULL; } } } while (r < ricnt && ricnt); free(partw); } /* if subkeys */ /* Not found */ return(0); } /* ls - list a 'nk' nodes subkeys and values * vofs - offset to start of data (skipping block linkage) * type - 0 = full, 1 = keys only. 2 = values only */ void nk_ls(struct hive *hdesc, char *path, int vofs, int type) { struct nk_key *key; int nkofs; struct ex_data ex; struct vex_data vex; int count = 0, countri = 0; nkofs = trav_path(hdesc, vofs, path, 0); if(!nkofs) { printf("nk_ls: Key <%s> not found\n",path); return; } nkofs += 4; key = (struct nk_key *)(hdesc->buffer + nkofs); VERBF(hdesc,"ls of node at offset 0x%0x\n",nkofs); if (key->id != 0x6b6e) { printf("Error: Not a 'nk' node!\n"); debugit(hdesc->buffer,hdesc->size); } printf("Node has %d subkeys and %d values",key->no_subkeys,key->no_values); if (key->len_classnam) printf(", and class-data of %d bytes",key->len_classnam); printf("\n"); if (key->no_subkeys) { printf(" key name\n"); while ((ex_next_n(hdesc, nkofs, &count, &countri, &ex) > 0)) { if (!(hdesc->state & HMODE_VERBOSE)) printf("%c <%s>\n", (ex.nk->len_classnam)?'*':' ',ex.name); else printf("[%6x] %c <%s>\n", ex.nkoffs, (ex.nk->len_classnam)?'*':' ',ex.name); FREE(ex.name); } } count = 0; if (key->no_values) { printf(" size type value name [value if type DWORD]\n"); while ((ex_next_v(hdesc, nkofs, &count, &vex) > 0)) { if (hdesc->state & HMODE_VERBOSE) printf("[%6x] %6d %-16s <%s>", vex.vkoffs - 4, vex.size, (vex.type < REG_MAX ? val_types[vex.type] : "(unknown)"), vex.name); else printf("%6d %-16s <%s>", vex.size, (vex.type < REG_MAX ? val_types[vex.type] : "(unknown)"), vex.name); if (vex.type == REG_DWORD) printf(" %*d [0x%x]",25-(int)strlen(vex.name),vex.val , vex.val); printf("\n"); FREE(vex.name); } } } /* Get the type of a value */ int get_val_type(struct hive *hdesc, int vofs, char *path, int exact) { struct vk_key *vkkey; int vkofs; vkofs = trav_path(hdesc, vofs,path,exact | TPF_VK); if (!vkofs) { return -1; } vkofs +=4; vkkey = (struct vk_key *)(hdesc->buffer + vkofs); return(vkkey->val_type); } /* Get len of a value, given current key + path */ int get_val_len(struct hive *hdesc, int vofs, char *path, int exact) { struct vk_key *vkkey; int vkofs; int len; vkofs = trav_path(hdesc, vofs,path,exact | TPF_VK); if (!vkofs) { return -1; } vkofs +=4; vkkey = (struct vk_key *)(hdesc->buffer + vkofs); len = vkkey->len_data & 0x7fffffff; if ( vkkey->len_data == 0x80000000 && (exact & TPF_VK_SHORT)) { /* Special inline case, return size of 4 (dword) */ len = 4; } return(len); } /* Get void-pointer to value-data, also if inline. * If val_type != 0 a check for correct value type is done * Caller must keep track of value's length (call function above to get it) */ void *get_val_data(struct hive *hdesc, int vofs, char *path, int val_type, int exact) { struct vk_key *vkkey; int vkofs; // printf("get_val_data: path = %s\n",path); vkofs = trav_path(hdesc,vofs,path,exact | TPF_VK); if (!vkofs) { printf("get_val_data: %s not found\n",path); abort(); return NULL; } vkofs +=4; vkkey = (struct vk_key *)(hdesc->buffer + vkofs); if (vkkey->len_data == 0) { return NULL; } if (vkkey->len_data == 0x80000000 && (exact & TPF_VK_SHORT)) { /* Special inline case (len = 0x80000000) */ return(&vkkey->val_type); /* Data (4 bytes?) in type field */ } if (val_type && vkkey->val_type && (vkkey->val_type) != val_type) { printf("Value <%s> is not of correct type!\n",path); #if DOCORE abort(); #endif return NULL; } /* Negative len is inline, return ptr to offset-field which in * this case contains the data itself */ if (vkkey->len_data & 0x80000000) return(&vkkey->ofs_data); /* Normal return, return data pointer */ return(hdesc->buffer + vkkey->ofs_data + 0x1004); } /* Get and copy key data (if any) to buffer * if kv==NULL will allocate needed return struct & buffer * else will use buffer allocated for it (if it fits) * return len+data or NULL if not found (or other error) * NOTE: caller must deallocate buffer! a simple free(keyval) will suffice. */ struct keyval *get_val2buf(struct hive *hdesc, struct keyval *kv, int vofs, char *path, int type, int exact ) { int l,i,parts,list,blockofs,blocksize,point,copylen,restlen; struct keyval *kr; void *keydataptr; struct db_key *db; void *addr; l = get_val_len(hdesc, vofs, path, exact); if (l == -1) return(NULL); /* error */ if (kv && (kv->len < l)) return(NULL); /* Check for overflow of supplied buffer */ keydataptr = get_val_data(hdesc, vofs, path, type, exact); // if (!keydataptr) return(NULL); /* Allocate space for data + header, or use supplied buffer */ if (kv) { kr = kv; } else { ALLOC(kr,1,l*sizeof(int)+4); } kr->len = l; // printf("get_val2buf: keydataprtr = %x, l = %x\n",keydataptr,l); if (l > VAL_DIRECT_LIMIT) { /* Where do the db indirects start? seems to be around 16k */ db = (struct db_key *)keydataptr; if (db->id != 0x6264) abort(); parts = db->no_part; list = db->ofs_data + 0x1004; printf("get_val2buf: Long value: parts = %d, list = %x\n",parts,list); point = 0; restlen = l; for (i = 0; i < parts; i++) { blockofs = get_int(hdesc->buffer + list + (i << 2)) + 0x1000; blocksize = -get_int(hdesc->buffer + blockofs) - 8; /* Copy this part, up to size of block or rest lenght in last block */ copylen = (blocksize > restlen) ? restlen : blocksize; printf("get_val2buf: Datablock %d offset %x, size %x (%d)\n",i,blockofs,blocksize,blocksize); printf(" : Point = %x, restlen = %x, copylen = %x\n",point,restlen,copylen); addr = (void *)&(kr->data) + point; memcpy( addr, hdesc->buffer + blockofs + 4, copylen); // debugit((char *)&(kr->data), l); point += copylen; restlen -= copylen; } } else { if (l && kr && keydataptr) memcpy(&(kr->data), keydataptr, l); } return(kr); } /* DWORDs are so common that I make a small function to get it easily */ int get_dword(struct hive *hdesc, int vofs, char *path, int exact) { struct keyval *v; int dword; v = get_val2buf(hdesc, NULL, vofs, path, REG_DWORD, exact | TPF_VK); if (!v) return(-1); /* well... -1 COULD BE THE STORED VALUE TOO */ dword = (int)v->data; FREE(v); return(dword); } /* Sanity checker when transferring data into a block * ofs = offset to data block, point to start of actual datablock linkage * data = data to copy * size = size of data to copy */ int fill_block(struct hive *hdesc, int ofs, void *data, int size) { int blksize; blksize = get_int(hdesc->buffer + ofs); blksize = -blksize; #if 0 printf("fill_block: ofs = %x - %x, size = %x, blksize = %x\n",ofs,ofs+size,size,blksize); #endif /* if (blksize < size || ( (ofs & 0xfffff000) != ((ofs+size) & 0xfffff000) )) { */ if (blksize < size) { printf("fill_block: ERROR: block to small for data: ofs = %x, size = %x, blksize = %x\n",ofs,size,blksize); debugit(hdesc->buffer,hdesc->size); abort(); } memcpy(hdesc->buffer + ofs + 4, data, size); return(0); } /* Free actual data of a value, and update value descriptor * hdesc - hive * vofs - current value offset */ int free_val_data(struct hive *hdesc, int vkofs) { struct vk_key *vkkey; struct db_key *db; int len,i,blockofs,blocksize,parts,list; vkkey = (struct vk_key *)(hdesc->buffer + vkofs); len = vkkey->len_data; if (!(len & 0x80000000)) { /* Check for inline, if so, skip it, nothing to do */ if (len > VAL_DIRECT_LIMIT) { /* Where do the db indirects start? seems to be around 16k */ db = (struct db_key *)(hdesc->buffer + vkkey->ofs_data + 0x1004); if (db->id != 0x6264) abort(); parts = db->no_part; list = db->ofs_data + 0x1004; printf("free_val_data: Long value: parts = %d, list = %x\n",parts,list); for (i = 0; i < parts; i++) { blockofs = get_int(hdesc->buffer + list + (i << 2)) + 0x1000; blocksize = -get_int(hdesc->buffer + blockofs); printf("free_val_data: Freeing long datablock %d offset %x, size %x (%d)\n",i,blockofs,blocksize,blocksize); free_block(hdesc, blockofs); } printf("free_val_data: Freeing indirect list at %x\n", list-4); free_block(hdesc, list - 4); printf("free_val_data: Freeing db structure at %x\n", vkkey->ofs_data + 0x1000); } /* Fall through to regular which deallocs data or db block ofs_data point to */ if (len) free_block(hdesc, vkkey->ofs_data + 0x1000); } /* inline check */ vkkey->len_data = 0; vkkey->ofs_data = 0; return(vkofs); } /* Allocate data for value. Frees old data (if any) which will be destroyed * hdesc - hive * vofs - current key * path - path to value * size - size of data * Returns: 0 - error, >0 pointer to actual dataspace */ int alloc_val_data(struct hive *hdesc, int vofs, char *path, int size,int exact) { struct vk_key *vkkey; struct db_key *db; int vkofs,dbofs,listofs,blockofs,blocksize,parts; int datablk,i; int *ptr; vkofs = trav_path(hdesc,vofs,path,exact); if (!vkofs) { return (0); } vkofs +=4; vkkey = (struct vk_key *)(hdesc->buffer + vkofs); free_val_data(hdesc, vkofs); /* Get rid of old data if any */ /* Allocate space for new data */ if (size > 4) { if (size > VAL_DIRECT_LIMIT) { /* We must allocate indirect stuff *sigh* */ parts = size / VAL_DIRECT_LIMIT + 1; printf("alloc_val_data: doing large key: size = %x (%d), parts = %d\n",size,size,parts); dbofs = alloc_block(hdesc, vkofs, sizeof(struct db_key)); /* Alloc db structure */ db = (struct db_key *)(hdesc->buffer + dbofs + 4); db->id = 0x6264; db->no_part = parts; listofs = alloc_block(hdesc, vkofs, 4 * parts); /* block offset list */ db = (struct db_key *)(hdesc->buffer + dbofs + 4); db->ofs_data = listofs - 0x1000; printf("alloc_val_data: dbofs = %x, listofs = %x\n",dbofs,listofs); for (i = 0; i < parts; i++) { blocksize = VAL_DIRECT_LIMIT; /* Windows seem to alway allocate the whole block */ blockofs = alloc_block(hdesc, vkofs, blocksize); printf("alloc_val_data: block # %d, blockofs = %x\n",i,blockofs); ptr = (int *)(hdesc->buffer + listofs + 4 + (i << 2)); *ptr = blockofs - 0x1000; } datablk = dbofs; } else { /* Regular size < 16 k direct alloc */ datablk = alloc_block(hdesc, vkofs, size); } } else { /* 4 bytes or less are inlined */ datablk = vkofs + (int32_t)&(vkkey->ofs_data) - (int32_t)vkkey; size |= 0x80000000; } if (!datablk) return(0); vkkey = (struct vk_key *)(hdesc->buffer + vkofs); /* alloc_block may move pointer, realloc() buf */ // printf("alloc_val_data: datablk = %x, size = %x, vkkey->len_data = %x\n",datablk, size, vkkey->len_data); /* Link in new datablock */ if ( !(size & 0x80000000)) vkkey->ofs_data = datablk - 0x1000; vkkey->len_data = size; return(datablk + 4); } /* Add a value to a key. * Just add the metadata (empty value), to put data into it, use * put_buf2val afterwards * hdesc - hive * nkofs - current key * name - name of value * type - type of value * returns: 0 err, >0 offset to value metadata */ struct vk_key *add_value(struct hive *hdesc, int nkofs, char *name, int type) { struct nk_key *nk; int oldvlist = 0, newvlist, newvkofs; struct vk_key *newvkkey; char *blank=""; if (!name || !*name) return(NULL); nk = (struct nk_key *)(hdesc->buffer + nkofs); if (nk->id != 0x6b6e) { printf("add_value: Key pointer not to 'nk' node!\n"); return(NULL); } if (vlist_find(hdesc, nk->ofs_vallist + 0x1004, nk->no_values, name, TPF_EXACT) != -1) { printf("add_value: value %s already exists\n",name); return(NULL); } if (!strcmp(name,"@")) name = blank; if (nk->no_values) oldvlist = nk->ofs_vallist; newvlist = alloc_block(hdesc, nkofs, nk->no_values * 4 + 4); if (!newvlist) { printf("add_value: failed to allocate new value list!\n"); return(NULL); } nk = (struct nk_key *)(hdesc->buffer + nkofs); /* In case buffer was moved.. */ if (oldvlist) { /* Copy old data if any */ memcpy(hdesc->buffer + newvlist + 4, hdesc->buffer + oldvlist + 0x1004, nk->no_values * 4 + 4); } /* Allocate value descriptor including its name */ newvkofs = alloc_block(hdesc, newvlist, sizeof(struct vk_key) + strlen(name)); if (!newvkofs) { printf("add_value: failed to allocate value descriptor\n"); free_block(hdesc, newvlist); return(NULL); } nk = (struct nk_key *)(hdesc->buffer + nkofs); /* In case buffer was moved.. */ /* Success, now fill in the metadata */ newvkkey = (struct vk_key *)(hdesc->buffer + newvkofs + 4); /* Add pointer in value list */ *(int *)(hdesc->buffer + newvlist + 4 + (nk->no_values * 4)) = newvkofs - 0x1000; /* Fill in vk struct */ newvkkey->id = 0x6b76; newvkkey->len_name = strlen(name); if (type == REG_DWORD || type == REG_DWORD_BIG_ENDIAN) { newvkkey->len_data = 0x80000004; /* Prime the DWORD inline stuff */ } else { newvkkey->len_data = 0x80000000; /* Default inline zero size */ } newvkkey->ofs_data = 0; newvkkey->val_type = type; newvkkey->flag = newvkkey->len_name ? 1 : 0; /* Seems to be 1, but 0 for no name default value */ newvkkey->dummy1 = 0; memcpy((char *)&newvkkey->keyname, name, newvkkey->len_name); /* And copy name */ /* Finally update the key and free the old valuelist */ nk->no_values++; nk->ofs_vallist = newvlist - 0x1000; if (oldvlist) free_block(hdesc,oldvlist + 0x1000); return(newvkkey); } /* Remove a vk-struct incl dataspace if any * Mostly for use by higher level stuff * hdesc - hive * vkofs - offset to vk */ void del_vk(struct hive *hdesc, int vkofs) { struct vk_key *vk; vk = (struct vk_key *)(hdesc->buffer + vkofs); if (vk->id != 0x6b76) { printf("del_vk: Key pointer not to 'vk' node!\n"); return; } if ( !(vk->len_data & 0x80000000) && vk->ofs_data) { free_val_data(hdesc, vkofs); } free_block(hdesc, vkofs - 4); } /* Delete all values from key (used in recursive delete) * hdesc - yer usual hive * nkofs - current keyoffset */ void del_allvalues(struct hive *hdesc, int nkofs) { int vlistofs, o, vkofs; int32_t *vlistkey; struct nk_key *nk; nk = (struct nk_key *)(hdesc->buffer + nkofs); if (nk->id != 0x6b6e) { printf("del_allvalues: Key pointer not to 'nk' node!\n"); return; } if (!nk->no_values) { /* printf("del_avalues: Key has no values!\n"); */ return; } vlistofs = nk->ofs_vallist + 0x1004; vlistkey = (int32_t *)(hdesc->buffer + vlistofs); /* Loop through index and delete all vk's */ for (o = 0; o < nk->no_values; o++) { vkofs = vlistkey[o] + 0x1004; del_vk(hdesc, vkofs); } /* Then zap the index, and update nk */ free_block(hdesc, vlistofs-4); nk->ofs_vallist = -1; nk->no_values = 0; } /* Delete single value from key * hdesc - yer usual hive * nkofs - current keyoffset * name - name of value to delete * exact - NKF_EXACT to do exact match, else first match * returns: 0 - ok, 1 - failed */ int del_value(struct hive *hdesc, int nkofs, char *name, int exact) { int vlistofs, slot, o, n, vkofs, newlistofs; int32_t *vlistkey, *tmplist, *newlistkey; struct nk_key *nk; char *blank=""; if (!name || !*name) return(1); if (!strcmp(name,"@")) name = blank; nk = (struct nk_key *)(hdesc->buffer + nkofs); if (nk->id != 0x6b6e) { printf("del_value: Key pointer not to 'nk' node!\n"); return(1); } if (!nk->no_values) { printf("del_value: Key has no values!\n"); return(1); } vlistofs = nk->ofs_vallist + 0x1004; vlistkey = (int32_t *)(hdesc->buffer + vlistofs); slot = vlist_find(hdesc, vlistofs, nk->no_values, name, TPF_VK); if (slot == -1) { printf("del_value: value %s not found!\n",name); return(1); } /* Delete vk and data */ vkofs = vlistkey[slot] + 0x1004; del_vk(hdesc, vkofs); /* Copy out old index list */ CREATE(tmplist,int32_t,nk->no_values); memcpy(tmplist, vlistkey, nk->no_values * sizeof(int32_t)); free_block(hdesc,vlistofs-4); /* Get rid of old list */ nk->no_values--; if (nk->no_values) { newlistofs = alloc_block(hdesc, vlistofs, nk->no_values * sizeof(int32_t)); if (!newlistofs) { printf("del_value: FATAL: Was not able to alloc new index list\n"); abort(); } nk = (struct nk_key *)(hdesc->buffer + nkofs); /* In case buffer was moved */ /* Now copy over, omitting deleted entry */ newlistkey = (int32_t *)(hdesc->buffer + newlistofs + 4); for (n = 0, o = 0; o < nk->no_values+1; o++, n++) { if (o == slot) o++; newlistkey[n] = tmplist[o]; } nk->ofs_vallist = newlistofs - 0x1000; } else { nk->ofs_vallist = -1; } return(0); } /* Add a subkey to a key * hdesc - usual.. * nkofs - offset of current nk * name - name of key to add * return: ptr to new keystruct, or NULL */ #undef AKDEBUG struct nk_key *add_key(struct hive *hdesc, int nkofs, char *name) { int slot, newlfofs = 0, oldlfofs = 0, newliofs = 0; int oldliofs = 0; int o, n, i, onkofs, newnkofs, cmp; int rimax, rislot, riofs, namlen; struct ri_key *ri = NULL; struct lf_key *newlf = NULL, *oldlf; struct li_key *newli = NULL, *oldli; struct nk_key *key, *newnk, *onk; int32_t hash; key = (struct nk_key *)(hdesc->buffer + nkofs); if (key->id != 0x6b6e) { printf("add_key: current ptr not 'nk'\n"); return(NULL); } namlen = strlen(name); slot = -1; if (key->no_subkeys) { /* It already has subkeys */ oldlfofs = key->ofs_lf; oldliofs = key->ofs_lf; oldlf = (struct lf_key *)(hdesc->buffer + oldlfofs + 0x1004); if (oldlf->id != 0x666c && oldlf->id != 0x686c && oldlf->id != 0x696c && oldlf->id != 0x6972) { printf("add_key: index type not supported: 0x%04x\n",oldlf->id); return(NULL); } rimax = 0; ri = NULL; riofs = 0; rislot = -1; if (oldlf->id == 0x6972) { /* Indirect index 'ri', init loop */ riofs = key->ofs_lf; ri = (struct ri_key *)(hdesc->buffer + riofs + 0x1004); rimax = ri->no_lis-1; #ifdef AKDEBUG printf("add_key: entering 'ri' traverse, rimax = %d\n",rimax); #endif oldliofs = ri->hash[rislot+1].ofs_li; oldlfofs = ri->hash[rislot+1].ofs_li; } do { /* 'ri' loop, at least run once if no 'ri' deep index */ if (ri) { /* Do next 'ri' slot */ rislot++; oldliofs = ri->hash[rislot].ofs_li; oldlfofs = ri->hash[rislot].ofs_li; oldli = (struct li_key *)(hdesc->buffer + oldliofs + 0x1004); oldlf = (struct lf_key *)(hdesc->buffer + oldlfofs + 0x1004); } oldli = (struct li_key *)(hdesc->buffer + oldliofs + 0x1004); oldlf = (struct lf_key *)(hdesc->buffer + oldlfofs + 0x1004); #ifdef AKDEBUG printf("add_key: top of ri-loop: rislot = %d, rimax = %d\n",rislot,rimax); #endif slot = -1; if (oldli->id == 0x696c) { /* li */ #ifdef AKDEBUG printf("add_key: li slot allocate\n"); #endif FREE(newli); ALLOC(newli, 8 + 4*oldli->no_keys + 4, 1); newli->no_keys = oldli->no_keys; newli->id = oldli->id; /* Now copy old, checking where to insert (alphabetically) */ for (o = 0, n = 0; o < oldli->no_keys; o++,n++) { onkofs = oldli->hash[o].ofs_nk; onk = (struct nk_key *)(onkofs + hdesc->buffer + 0x1004); if (slot == -1) { #if 1 printf("add_key: cmp <%s> with <%s>\n",name,onk->keyname); #endif cmp = strn_casecmp(name, onk->keyname, (namlen > onk->len_name) ? namlen : onk->len_name); if (!cmp) { printf("add_key: key %s already exists!\n",name); FREE(newli); return(NULL); } if ( cmp < 0) { slot = o; rimax = rislot; /* Cause end of 'ri' search, too */ n++; #ifdef AKDEBUG printf("add_key: li-match: slot = %d\n",o); #endif } } newli->hash[n].ofs_nk = oldli->hash[o].ofs_nk; } if (slot == -1) slot = oldli->no_keys; } else { /* lf or lh */ oldlf = (struct lf_key *)(hdesc->buffer + oldlfofs + 0x1004); FREE(newlf); ALLOC(newlf, 8 + 8*oldlf->no_keys + 8, 1); newlf->no_keys = oldlf->no_keys; newlf->id = oldlf->id; #ifdef AKDEBUG printf("add_key: new lf/lh no_keys: %d\n",newlf->no_keys); #endif /* Now copy old, checking where to insert (alphabetically) */ for (o = 0, n = 0; o < oldlf->no_keys; o++,n++) { onkofs = oldlf->hash[o].ofs_nk; onk = (struct nk_key *)(onkofs + hdesc->buffer + 0x1004); if (slot == -1) { #if 0 printf("add_key: cmp <%s> with <%s>\n",name,onk->keyname); #endif cmp = strn_casecmp(name, onk->keyname, (namlen > onk->len_name) ? namlen : onk->len_name); if (!cmp) { printf("add_key: key %s already exists!\n",name); FREE(newlf); return(NULL); } if ( cmp < 0 ) { slot = o; rimax = rislot; /* Cause end of 'ri' search, too */ n++; #ifdef AKDEBUG printf("add_key: lf-match: slot = %d\n",o); #endif } } newlf->hash[n].ofs_nk = oldlf->hash[o].ofs_nk; newlf->hash[n].name[0] = oldlf->hash[o].name[0]; newlf->hash[n].name[1] = oldlf->hash[o].name[1]; newlf->hash[n].name[2] = oldlf->hash[o].name[2]; newlf->hash[n].name[3] = oldlf->hash[o].name[3]; } if (slot == -1) slot = oldlf->no_keys; } /* li else check */ } while ( (rislot < rimax) && (rimax > 0)); /* 'ri' wrapper loop */ } else { /* Parent was empty, make new index block */ #ifdef AKDEBUG printf("add_key: new index!\n"); #endif ALLOC(newlf, 8 + 8, 1); newlf->no_keys = 0 ; /* Will increment to 1 when filling in the offset later */ /* Use ID (lf, lh or li) we fetched from root node, so we use same as rest of hive */ newlf->id = hdesc->nkindextype; slot = 0; } /* if has keys before */ /* Make and fill in new nk */ newnkofs = alloc_block(hdesc, nkofs, sizeof(struct nk_key) + strlen(name)); if (!newnkofs) { printf("add_key: unable to allocate space for new key descriptor for %s!\n",name); FREE(newlf); FREE(newli); return(NULL); } key = (struct nk_key *)(hdesc->buffer + nkofs); /* In case buffer moved */ newnk = (struct nk_key *)(hdesc->buffer + newnkofs + 4); newnk->id = 0x6b6e; newnk->type = KEY_NORMAL; /* Some versions use 0x1020 a lot.. */ newnk->ofs_parent = nkofs - 0x1004; newnk->no_subkeys = 0; newnk->ofs_lf = -1; newnk->no_values = 0; newnk->ofs_vallist = -1; newnk->ofs_sk = key->ofs_sk; /* Get parents for now. 0 or -1 here crashes XP */ newnk->ofs_classnam = -1; newnk->len_name = strlen(name); newnk->len_classnam = 0; memcpy(newnk->keyname, name, newnk->len_name); if (newli) { /* Handle li */ #if AKDEBUG printf("add_key: li fill at slot: %d\n",slot); #endif /* And put its offset into parents index list */ newli->hash[slot].ofs_nk = newnkofs - 0x1000; newli->no_keys++; /* Allocate space for our new li list and copy it into reg */ newliofs = alloc_block(hdesc, nkofs, 8 + 4*newli->no_keys); if (!newliofs) { printf("add_key: unable to allocate space for new index table for %s!\n",name); FREE(newli); free_block(hdesc,newnkofs); return(NULL); } key = (struct nk_key *)(hdesc->buffer + nkofs); /* In case buffer moved */ newnk = (struct nk_key *)(hdesc->buffer + newnkofs + 4); /* memcpy(hdesc->buffer + newliofs + 4, newli, 8 + 4*newli->no_keys); */ fill_block(hdesc, newliofs, newli, 8 + 4*newli->no_keys); } else { /* lh or lf */ #ifdef AKDEBUG printf("add_key: lf/lh fill at slot: %d, rislot: %d\n",slot,rislot); #endif /* And put its offset into parents index list */ newlf->hash[slot].ofs_nk = newnkofs - 0x1000; newlf->no_keys++; if (newlf->id == 0x666c) { /* lf hash */ newlf->hash[slot].name[0] = 0; newlf->hash[slot].name[1] = 0; newlf->hash[slot].name[2] = 0; newlf->hash[slot].name[3] = 0; strncpy(newlf->hash[slot].name, name, 4); } else if (newlf->id == 0x686c) { /* lh. XP uses this. hashes whole name */ for (i = 0,hash = 0; i < strlen(name); i++) { hash *= 37; hash += reg_touppertable[(unsigned char)name[i]]; } newlf->lh_hash[slot].hash = hash; } /* Allocate space for our new lf list and copy it into reg */ newlfofs = alloc_block(hdesc, nkofs, 8 + 8*newlf->no_keys); if (!newlfofs) { printf("add_key: unable to allocate space for new index table for %s!\n",name); FREE(newlf); free_block(hdesc,newnkofs); return(NULL); } key = (struct nk_key *)(hdesc->buffer + nkofs); /* In case buffer moved */ newnk = (struct nk_key *)(hdesc->buffer + newnkofs + 4); /* memcpy(hdesc->buffer + newlfofs + 4, newlf, 8 + 8*newlf->no_keys); */ fill_block(hdesc, newlfofs, newlf, 8 + 8*newlf->no_keys); } /* li else */ /* Update parent, and free old lf list */ key->no_subkeys++; if (ri) { /* ri index */ ri->hash[rislot].ofs_li = (newlf ? newlfofs : newliofs) - 0x1000; } else { /* Parent key */ key->ofs_lf = (newlf ? newlfofs : newliofs) - 0x1000; } if (newlf && oldlfofs) free_block(hdesc,oldlfofs + 0x1000); if (newli && oldliofs) free_block(hdesc,oldliofs + 0x1000); FREE(newlf); FREE(newli); return(newnk); } /* Delete a subkey from a key * hdesc - usual.. * nkofs - offset of current nk * name - name of key to delete (must match exactly, also case) * return: 1 - err, 0 - ok */ #undef DKDEBUG int del_key(struct hive *hdesc, int nkofs, char *name) { int slot = 0, newlfofs = 0, oldlfofs = 0, o, n, onkofs, delnkofs; int oldliofs = 0, no_keys = 0, newriofs = 0; int namlen; int rimax, riofs, rislot; struct ri_key *ri, *newri = NULL; struct lf_key *newlf = NULL, *oldlf = NULL; struct li_key *newli = NULL, *oldli = NULL; struct nk_key *key, *onk, *delnk; char fullpath[501]; key = (struct nk_key *)(hdesc->buffer + nkofs); namlen = strlen(name); #ifdef DKDEBUG printf("del_key: deleting: <%s>\n",name); #endif if (key->id != 0x6b6e) { printf("add_key: current ptr not nk\n"); return(1); } slot = -1; if (!key->no_subkeys) { printf("del_key: key has no subkeys!\n"); return(1); } oldlfofs = key->ofs_lf; oldliofs = key->ofs_lf; oldlf = (struct lf_key *)(hdesc->buffer + oldlfofs + 0x1004); if (oldlf->id != 0x666c && oldlf->id != 0x686c && oldlf->id != 0x696c && oldlf->id != 0x6972) { printf("del_key: index other than 'lf', 'li' or 'lh' not supported yet. 0x%04x\n",oldlf->id); return(1); } rimax = 0; ri = NULL; riofs = 0; rislot = 0; if (oldlf->id == 0x6972) { /* Indirect index 'ri', init loop */ riofs = key->ofs_lf; ri = (struct ri_key *)(hdesc->buffer + riofs + 0x1004); rimax = ri->no_lis-1; #ifdef DKDEBUG printf("del_key: entering 'ri' traverse, rimax = %d\n",rimax); #endif rislot = -1; /* Starts at slot 0 below */ } do { /* 'ri' loop, at least run once if no 'ri' deep index */ if (ri) { /* Do next 'ri' slot */ rislot++; oldliofs = ri->hash[rislot].ofs_li; oldlfofs = ri->hash[rislot].ofs_li; } oldli = (struct li_key *)(hdesc->buffer + oldliofs + 0x1004); oldlf = (struct lf_key *)(hdesc->buffer + oldlfofs + 0x1004); #ifdef DKDEBUG printf("del_key: top of ri-loop: rislot = %d\n",rislot); #endif slot = -1; if (oldlf->id == 0x696c) { /* 'li' handler */ #ifdef DKDEBUG printf("del_key: li handler\n"); #endif FREE(newli); ALLOC(newli, 8 + 4*oldli->no_keys - 4, 1); newli->no_keys = oldli->no_keys - 1; no_keys = newli->no_keys; newli->id = oldli->id; /* Now copy old, checking where to delete */ for (o = 0, n = 0; o < oldli->no_keys; o++,n++) { onkofs = oldli->hash[o].ofs_nk; onk = (struct nk_key *)(onkofs + hdesc->buffer + 0x1004); if (slot == -1 && onk->len_name == namlen && !strncmp(name, onk->keyname, (onk->len_name > namlen) ? onk->len_name : namlen)) { slot = o; delnkofs = onkofs; delnk = onk; rimax = rislot; o++; } newli->hash[n].ofs_nk = oldli->hash[o].ofs_nk; } } else { /* 'lf' or 'lh' are similar */ #ifdef DKDEBUG printf("del_key: lf or lh handler\n"); #endif FREE(newlf); ALLOC(newlf, 8 + 8*oldlf->no_keys - 8, 1); #ifdef DKDEBUG printf("alloc newlf: %x\n",newlf); #endif newlf->no_keys = oldlf->no_keys - 1; no_keys = newlf->no_keys; newlf->id = oldlf->id; /* Now copy old, checking where to delete */ for (o = 0, n = 0; o < oldlf->no_keys; o++,n++) { onkofs = oldlf->hash[o].ofs_nk; onk = (struct nk_key *)(onkofs + hdesc->buffer + 0x1004); if (slot == -1 && (onk->len_name == namlen) && !strncmp(name, onk->keyname, onk->len_name)) { slot = o; delnkofs = onkofs; delnk = onk; rimax = rislot; o++; } if (n < newlf->no_keys) { /* Only store if not last index in old */ #ifdef DKDEBUG printf("del_key: n = %d, o = %d\n",n,o); #endif newlf->hash[n].ofs_nk = oldlf->hash[o].ofs_nk; newlf->hash[n].name[0] = oldlf->hash[o].name[0]; newlf->hash[n].name[1] = oldlf->hash[o].name[1]; newlf->hash[n].name[2] = oldlf->hash[o].name[2]; newlf->hash[n].name[3] = oldlf->hash[o].name[3]; } } } /* else lh or lf */ } while (rislot < rimax); /* ri traverse loop */ if (slot == -1) { printf("del_key: subkey %s not found!\n",name); FREE(newlf); FREE(newli); return(1); } #ifdef DKDEBUG printf("del_key: key found at slot %d\n",slot); #endif if (delnk->no_values || delnk->no_subkeys) { printf("del_key: subkey %s has subkeys or values. Not deleted.\n",name); FREE(newlf); FREE(newli); return(1); } /* Allocate space for our new lf list and copy it into reg */ if ( no_keys && (newlf || newli) ) { newlfofs = alloc_block(hdesc, nkofs, 8 + (newlf ? 8 : 4) * no_keys); #ifdef DKDEBUG printf("del_key: alloc_block for index returns: %x\n",newlfofs); #endif if (!newlfofs) { printf("del_key: WARNING: unable to allocate space for new key descriptor for %s! Not deleted\n",name); FREE(newlf); return(1); } key = (struct nk_key *)(hdesc->buffer + nkofs); oldli = (struct li_key *)(hdesc->buffer + oldliofs + 0x1004); oldlf = (struct lf_key *)(hdesc->buffer + oldlfofs + 0x1004); /* memcpy(hdesc->buffer + newlfofs + 4, ((void *)newlf ? (void *)newlf : (void *)newli), 8 + (newlf ? 8 : 4) * no_keys); */ fill_block(hdesc, newlfofs, ((void *)newlf ? (void *)newlf : (void *)newli), 8 + (newlf ? 8 : 4) * no_keys); } else { /* Last deleted, will throw away index */ newlfofs = 0xfff; /* We subtract 0x1000 later */ } if (newlfofs < 0xfff) { printf("del_key: ERROR: newlfofs = %x\n",newlfofs); #if DOCORE debugit(hdesc->buffer,hdesc->size); abort(); #endif } /* Check for CLASS data, if so, deallocate it too */ if (delnk->len_classnam) { free_block(hdesc, delnk->ofs_classnam + 0x1000); } /* Now it's safe to zap the nk */ free_block(hdesc, delnkofs + 0x1000); /* And the old index list */ free_block(hdesc, (oldlfofs ? oldlfofs : oldliofs) + 0x1000); /* Update parent */ key->no_subkeys--; key = (struct nk_key *)(hdesc->buffer + nkofs); oldli = (struct li_key *)(hdesc->buffer + oldliofs + 0x1004); oldlf = (struct lf_key *)(hdesc->buffer + oldlfofs + 0x1004); if (ri) { ri = (struct ri_key *)(hdesc->buffer + riofs + 0x1004); /* In case realloc */ if (newlfofs == 0xfff) { *fullpath = 0; get_abs_path(hdesc, nkofs, fullpath, 480); VERBF(hdesc,"del_key: need to delete ri-slot %d for %x - %s\n", rislot,nkofs,fullpath ); if (ri->no_lis > 1) { /* We have subindiceblocks left? */ /* Delete from array */ ALLOC(newri, 8 + 4*ri->no_lis - 4, 1); newri->no_lis = ri->no_lis - 1; newri->id = ri->id; for (o = 0, n = 0; o < ri->no_lis; o++,n++) { if (n == rislot) o++; newri->hash[n].ofs_li = ri->hash[o].ofs_li; } newriofs = alloc_block(hdesc, nkofs, 8 + newri->no_lis*4 ); if (!newriofs) { printf("del_key: WARNING: unable to allocate space for ri-index for %s! Not deleted\n",name); FREE(newlf); FREE(newri); return(1); } key = (struct nk_key *)(hdesc->buffer + nkofs); oldli = (struct li_key *)(hdesc->buffer + oldliofs + 0x1004); oldlf = (struct lf_key *)(hdesc->buffer + oldlfofs + 0x1004); fill_block(hdesc, newriofs, newri, 8 + newri->no_lis * 4); free_block(hdesc, riofs + 0x1000); key->ofs_lf = newriofs - 0x1000; FREE(newri); } else { /* Last entry in ri was deleted, get rid of it, key is empty */ VERB(hdesc,"del_key: .. and that was the last one. key now empty!\n"); free_block(hdesc, riofs + 0x1000); key->ofs_lf = -1; } } else { ri->hash[rislot].ofs_li = newlfofs - 0x1000; } } else { key->ofs_lf = newlfofs - 0x1000; } FREE(newlf); return(0); } /* Recursive delete keys * hdesc - usual.. * nkofs - offset of current nk * name - name of key to delete * return: 0 - ok, 1 fail */ void rdel_keys(struct hive *hdesc, char *path, int vofs) { struct nk_key *key; int nkofs; struct ex_data ex; int count = 0, countri = 0; if (!path || !*path) return; nkofs = trav_path(hdesc, vofs, path, TPF_NK_EXACT); if(!nkofs) { printf("rdel_keys: Key <%s> not found\n",path); return; } nkofs += 4; key = (struct nk_key *)(hdesc->buffer + nkofs); /* VERBF(hdesc,"rdel of node at offset 0x%0x\n",nkofs); */ if (key->id != 0x6b6e) { printf("Error: Not a 'nk' node!\n"); debugit(hdesc->buffer,hdesc->size); } #if 0 printf("Node has %d subkeys and %d values\n",key->no_subkeys,key->no_values); #endif if (key->no_subkeys) { while ((ex_next_n(hdesc, nkofs, &count, &countri, &ex) > 0)) { #if 0 printf("%s\n",ex.name); #endif rdel_keys(hdesc, ex.name, nkofs); count = 0; countri = 0; FREE(ex.name); } } del_allvalues(hdesc, nkofs); key = (struct nk_key *)(hdesc->buffer + nkofs); del_key(hdesc, key->ofs_parent+0x1004, path); } /* Get and copy keys CLASS-data (if any) to buffer * Returns a buffer with the data (first int32_t is size). see ntreg.h * NOTE: caller must deallocate buffer! a simple free(keyval) will suffice. */ struct keyval *get_class(struct hive *hdesc, int curnk, char *path) { int clen = 0, dofs = 0, nkofs; struct nk_key *key; struct keyval *data; void *classdata; if (!path && !curnk) return(NULL); nkofs = trav_path(hdesc, curnk, path, 0); if(!nkofs) { printf("get_class: Key <%s> not found\n",path); return(NULL); } nkofs += 4; key = (struct nk_key *)(hdesc->buffer + nkofs); clen = key->len_classnam; if (!clen) { printf("get_class: Key has no class data.\n"); return(NULL); } dofs = key->ofs_classnam; classdata = (void *)(hdesc->buffer + dofs + 0x1004); #if 0 printf("get_class: len_classnam = %d\n",clen); printf("get_class: ofs_classnam = 0x%x\n",dofs); #endif ALLOC(data, sizeof(struct keyval) + clen,1); data->len = clen; memcpy(&data->data, classdata, clen); return(data); } /* Write to registry value. * If same size as existing, copy back in place to avoid changing too much * otherwise allocate new dataspace, then free the old * Thus enough space to hold both new and old data is needed * Pass inn buffer with data len as first DWORD (as routines above) * returns: 0 - error, len - OK (len of data) */ int put_buf2val(struct hive *hdesc, struct keyval *kv, int vofs, char *path, int type, int exact ) { int l; void *keydataptr, *addr; struct db_key *db; int copylen, blockofs, blocksize, restlen, point, i, list, parts; if (!kv) return(0); l = get_val_len(hdesc, vofs, path, exact); if (l == -1) return(0); /* error */ // printf("put_buf2val: l = %d\n",l); // printf("put_buf2val: %s, kv len = %d, l = %d\n",path,kv->len,l); if (kv->len != l) { /* Realloc data block if not same size as existing */ if (!alloc_val_data(hdesc, vofs, path, kv->len, exact)) { printf("put_buf2val: %s : alloc_val_data failed!\n",path); return(0); } } keydataptr = get_val_data(hdesc, vofs, path, type, exact); if (!keydataptr) { printf("put_buf2val: %s : get_val_data failed!\n",path); return(0); /* error */ } if (kv->len > VAL_DIRECT_LIMIT) { /* Where do the db indirects start? seems to be around 16k */ db = (struct db_key *)keydataptr; if (db->id != 0x6264) abort(); parts = db->no_part; list = db->ofs_data + 0x1004; printf("put_buf2val: Long value: parts = %d, list = %x\n",parts,list); point = 0; restlen = kv->len; for (i = 0; i < parts; i++) { blockofs = get_int(hdesc->buffer + list + (i << 2)) + 0x1000; blocksize = -get_int(hdesc->buffer + blockofs) - 8; /* Copy this part, up to size of block or rest lenght in last block */ copylen = (blocksize > restlen) ? restlen : blocksize; printf("put_buf2val: Datablock %d offset %x, size %x (%d)\n",i,blockofs,blocksize,blocksize); printf(" : Point = %x, restlen = %x, copylen = %x\n",point,restlen,copylen); addr = (void *)&(kv->data) + point; fill_block( hdesc, blockofs, addr, copylen); // debugit((char *)&(kr->data), l); point += copylen; restlen -= copylen; } } else { memcpy(keydataptr, &kv->data, kv->len); } hdesc->state |= HMODE_DIRTY; return(kv->len); } /* And, yer basic DWORD write */ int put_dword(struct hive *hdesc, int vofs, char *path, int exact, int dword) { struct keyval *kr; int r; ALLOC(kr,1,sizeof(int)+sizeof(int)); kr->len = sizeof(int); kr->data = dword; r = put_buf2val(hdesc, kr, vofs, path, REG_DWORD, exact); FREE(kr); return(r); } /* ================================================================ */ /* Code to export registry entries to .reg file initiated by * Leo von Klenze * Then expanded a bit to handle more types etc. */ /* * converts a value string from an registry entry into a c string. It does not * use any encoding functions. * It works very primitive by just taking every second char. * The caller must free the resulting string, that was allocated with malloc. * * string: string where every second char is \0 * len: length of the string * return: the converted string as char* */ char * string_regw2prog(void *string, int len) { int i, k; char *cstring; int out_len = 0; for(i = 0; i < len; i += 2) { unsigned v = ((unsigned char *)string)[i] + ((unsigned char *)string)[i+1] * 256u; if (v < 128) out_len += 1; else if(v < 0x800) out_len += 2; else out_len += 3; } CREATE(cstring,char,out_len+1); for(i = 0, k = 0; i < len; i += 2) { unsigned v = ((unsigned char *)string)[i] + ((unsigned char *)string)[i+1] * 256u; if (v < 128) cstring[k++] = v; else if(v < 0x800) { cstring[k++] = 0xc0 | (v >> 6); cstring[k++] = 0x80 | (v & 0x3f); } else { cstring[k++] = 0xe0 | (v >> 12); cstring[k++] = 0x80 | ((v >> 6) & 0x3f); cstring[k++] = 0x80 | (v & 0x3f); } } cstring[out_len] = '\0'; return cstring; } #if 0 // Not used at the moment static char * string_rega2prog(void *string, int len) { int i, k; char *cstring; int out_len = 0; for(i = 0; i < len; ++i) { unsigned v = ((unsigned char *)string)[i]; if (v < 128) out_len += 1; else out_len += 2; } CREATE(cstring,char,out_len+1); for(i = 0, k = 0; i < len; ++i) { unsigned v = ((unsigned char *)string)[i]; if (v < 128) cstring[k++] = v; else { cstring[k++] = 0xc0 | (v >> 6); cstring[k++] = 0x80 | (v & 0x3f); } } cstring[out_len] = '\0'; return cstring; } static void string_prog2rega(char *string, int len) { char *out = string; unsigned char *in = (unsigned char*) string; for (;*in; ++in) { if (!(*in & 0x80)) { *out++ = *in; } else if ((in[0] & 0xe0) == 0xc0 && in[1]) { *out++ = (in[0] & 0x1f) << 6 | (in[1] & 0x3f); ++in; } else if (in[1] && in[2]) { /* assume 3 byte*/ *out++ = (in[1] & 0xf) << 6 | (in[2] & 0x3f); in += 2; } } *out = 0; } #endif // Not used static char * string_prog2regw(void *string, int len, int *out_len) { unsigned char *regw = (unsigned char*) malloc(len*2+2); unsigned char *out = regw; unsigned char *in = (unsigned char*) string; for (;len>0; ++in, --len) { if (!(in[0] & 0x80)) { *out++ = *in; *out++ = 0; } else if ((in[0] & 0xe0) == 0xc0 && len >= 2) { *out++ = (in[0] & 0x1f) << 6 | (in[1] & 0x3f); *out++ = (in[0] & 0x1f) >> 2; ++in, --len; } else if (len >= 3) { /* assume 3 byte*/ *out++ = (in[1] & 0xf) << 6 | (in[2] & 0x3f); *out++ = (in[0] & 0xf) << 4 | ((in[1] & 0x3f) >> 2); in += 2; len -= 2; } } *out_len = out - regw; out[0] = out[1] = 0; return (char *) regw; } static char * quote_string(const char *s) { int len = strlen(s); const char *p; char *dst, *out; for (p = s; *p; ++p) if (*p == '\\' || *p == '\"') ++len; dst = out = (char*) malloc(len + 1); for (p = s; *p; ++p) { if (*p == '\\' || *p == '\"') *dst++ = '\\'; *dst++ = *p; } *dst = 0; return out; } static void export_bin(int type, char *value, int len, int col, FILE* file) { int byte; if (type == REG_BINARY) { fprintf(file, "hex:"); col += 4; } else { fprintf(file, "hex(%x):", type); col += 7; } byte = 0; int start = (col - 2) / 3; while (byte + 1 < len) { /* go byte by byte.. probably slow.. */ fprintf(file, "%02x,", (unsigned char)value[byte]); byte++; if (!((byte + start) % 25)) fprintf(file, "\\\r\n "); } if (len) fprintf(file, "%02x\r\n", (unsigned char)value[len - 1]); } /* * Exports the named subkey and its values to the given file. * * hdesc: registry hive * nkofs: offset of parent node * name: name of key to export * prefix: prefix for each key. This prefix is prepended to the keyname * file: file descriptor of destination file */ void export_subkey(struct hive *hdesc, int nkofs, char *name, char *prefix, FILE *file) { int newofs; int count = 0; int countri = 0; int len; char *path = (char*) malloc(1024); char *value; struct nk_key *key; struct ex_data ex; struct vex_data vex; // switch to key newofs = trav_path(hdesc, nkofs, name, TPF_NK_EXACT); if(!newofs) { printf("export_subkey: Key '%s' not found!\n", name); free(path); return; } nkofs = newofs + 4; // get the key key = (struct nk_key *)(hdesc->buffer + nkofs); printf("Exporting key '%.*s' with %d subkeys and %d values...\n", key->len_name, key->keyname, key->no_subkeys, key->no_values); *path = 0; get_abs_path(hdesc, nkofs, path, 1024); // export the key fprintf(file, "\r\n"); fprintf(file, "[%s\%s]\r\n", prefix, path); // export values if(key->no_values) { while ((ex_next_v(hdesc, nkofs, &count, &vex) > 0)) { int col = 0; char *name = quote_string(vex.name); /* print name */ if (!name[0]) { fprintf(file, "@="); free(name); name = str_dup("@"); col += 2; } else { fprintf(file, "\"%s\"=", name); col += strlen(name) + 3; } if(vex.type == REG_DWORD) { fprintf(file, "dword:%08x\r\n", vex.val); } else if(vex.type == REG_SZ) { char *val, *quoted; value = (char *)get_val_data(hdesc, nkofs, name, vex.type, TPF_VK_EXACT|TPF_ABS); len = get_val_len(hdesc, nkofs, name, TPF_VK_EXACT|TPF_ABS); val = string_regw2prog(value, len); /* dump as binary if invalid characters are embedded */ if (strchr(val, 0xa) || strchr(val, 0xd)) { free(val); //if (len >= 2 && value[len-2] == 0 && value[len-1] == 0) len -= 2; export_bin(vex.type, value, len, col, file); } else { quoted = quote_string(val); free(val); fprintf(file, "\"%s\"", quoted); free(quoted); fprintf(file, "\r\n"); } } else { /* All other types seems to simply be hexdumped. Format is: "valuename"=hex(typenum):xx,xx,xx,xx,xx... for example: "qword64"=hex(b):4e,03,51,db,fa,04,00,00 this is type = 0xb = 11 = REG_QWORD "expandstring"=hex(2):46,00,6f,00,6f,00,62,00,61,00,72,00,20,00,25,00,73,00,20,\ 00,42,00,61,00,7a,00,00,00 this is type 2 = REG_EXPAND_SZ and the line is continued with ,\ don't know how many bytes for each line. Around 18-24 seems to be it?? depends on name lenght?? NOTE: Exception: type = REG_BINARY starts like this: "valuename"=hex:xx,xx,xx... */ value = (char *)get_val_data(hdesc, nkofs, name, vex.type, TPF_VK_EXACT|TPF_ABS); len = get_val_len(hdesc, nkofs, name, TPF_VK_EXACT|TPF_ABS); export_bin(vex.type, value, len, col, file); } FREE(vex.name); free(name); } } // export subkeys if (key->no_subkeys) { count = 0; countri = 0; while ((ex_next_n(hdesc, nkofs, &count, &countri, &ex) > 0)) { export_subkey(hdesc, nkofs, ex.name, prefix, file); FREE(ex.name); } } free(path); } /* * Exports the given key to a windows .reg file that can be imported to the * windows registry. * The prefix is used to determine the destination hive in the windows * registry, set it to HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE or whatever you * want. * * hdesc: hive * nkofs: offset of parent node * name: name of subkey to export * filename: name of destination .reg file (will be overridden) * prefix: prefix for each exported key */ void export_key(struct hive *hdesc, int nkofs, char *name, char *filename, char *prefix) { FILE *file; // open file file = fopen(filename, "w"); if(!file) { printf("export: Cannot open file '%s'. %s (%d).\n", filename, strerror(errno), errno); return; } printf("Exporting to file '%s'...\n", filename); fprintf(file, "Windows Registry Editor Version 5.00\r\n"); export_subkey(hdesc, nkofs, name, prefix, file); fprintf(file,"\r\n"); /* Must end file with an empty line, windows does that */ fclose(file); } /* ================================================================ */ /* Import from .reg file routines */ #define MAXLINE 20000 /* Wide character fgetsw() may not be available on all small libraries.. * so.. roll our own fgets() that handles wide if needed */ char *my_fgets(char *s, char *w, int max, FILE *file, int wide) { int i = 0; char prev = 1; char c = 1; while (c != '\n' && !feof(file) && max) { c = (char)fgetc(file); /* printf("char = %c\n",c); */ if (!c && (!prev && !wide) ) break; /* Stop on 1 (or 2 if wide) null */ prev = c; if (c != '\r') { *(s+i) = c; *(w+i) = c; i++; } max--; } *(s+i) = 0; *(s+i+1) = 0; *(w+i) = 0; *(w+i+1) = 0; if (wide) { /* Convert to C string, de widing it.. */ cheap_uni2ascii(w, s, i); // printf("cheap returns len = %d : %s\n",strlen(s), s); fgetc(file); /* Skip second byte of CR/LF termination */ } // printf("my_fgets returning :\n"); //hexdump(w, 0, i, 1); //printf("====== hexdump end\n"); return(s); } /* Read one line, while skipping blank lines, also checks for = * line = line buffer * file = you know.. * assigner - left part of value assignemt (before =) * value - right part of assignment (after =) * value = NULL if [KEY] line. * assigner = NULL if value continuation line * Returns total lenght of line */ #undef GETLINE_DEBUG int get_line(char s[], char w[], FILE *file, char **assigner, char **value, int wide) { int l,q; char *b; /* Start of line after spaces */ char *c; *assigner = NULL; *value = NULL; do { s[0] = 0; my_fgets(s, w, MAXLINE, file, wide); s[MAXLINE] = 0; b = s; l = strlen(s); #ifdef GETLINE_DEBUG printf("get_line: read line len %d : %s\n",l,s); #endif if (l == 0) { if (feof(file)) return 0; break; } while (isspace(*b)) b++; c = b; while (*c && *c != '\n' && *c != '\r') c++; *c = 0; /* Terminate with null not cr/lf */ if (!*b) continue; /* Blank line */ l = strlen(s); #ifdef GETLINE_DEBUG printf("get_line: stripped line len %d : %s\n",l,s); #endif c = b; if (*b == '[') { /* Key line starts with [ */ #ifdef GETLINE_DEBUG printf("get_line: key line..\n"); #endif while (*c && (*c != ']')) c++; if (!*c) { printf("get_line: WARNING: un-terminated key line..\n"); } *c = 0; *assigner = b+1; *value = NULL; return(l); } q = 0; while (*c) { /* printf(" char = %c : q = %d\n",*c,q); */ if (*c == '"') q ^= 1; /* Flip quote indicator */ if (*c == '=' && !q) { /* Found = outside quotes */ *c = 0; *assigner = b; *value = c + 1; #ifdef GETLINE_DEBUG printf("get_line: value line\n"); #endif return(l); } c++; } /* At this point we don't have a = outside quotes, so probably a value cont line */ *assigner = NULL; *value = b; #ifdef GETLINE_DEBUG printf("get_line: cont line\n"); #endif return(l); } while (!feof(file)); return(l); } /* Wide strlen */ int wide_strlen(char *s) { int l = 0; while ( *(s+l) || *(s+l+1) ) l += 2; return(l); } /* De-quote a string (removing quotes first and last) * Does nothing if no quoutes * String MUST be null-terminated */ char *dequote(char *s) { int l; if (*s != '"') return(s); /* No first quote, then don't change anything, even at end */ l = strlen(s); if ( *(s+l-1) == '"' ) { *(s+l-1) = 0; } return(s+1); } /* de-escape a string, handling \ backslash * s = string buffer, WILL BE CHANGED * wide = true to make it handle wide characters * returns new lenght */ int de_escape(char *s, int wide) { int src = 0; int dst = 0; if (wide) { while ( *(s + src) || *(s + src +1)) { if ( *(s + src) == '\\' && *(s + src + 1) == 0) src += 2; /* Skip over backslash */ *(s + dst) = *(s + src); *(s + dst + 1) = *(s + src + 1); dst += 2; src += 2; } *(s + dst) = 0; *(s + dst + 1) = 0; dst += 2; } else { while ( *(s + src) ) { if ( *(s + src) == '\\' ) src++; *(s + dst) = *(s + src); dst++; src++; } *(s + dst) = 0; dst++; } return(dst); } /* Parse the value to be assigned * s = string to parse * bufptr = pointer to buffer pointer for binary data (will be allocated). * First byte of buffer is value type. * returns lenght * "stringvalue"="this is a string" "binaryvalue"=hex:11,22,33,aa,bb,cc,12,34,01,02,ab,cd,ef,be,ef "dwordvalue"=dword:12345678 "qwordvalue"=hex(b):ef,cd,ab,89,67,45,23,01 "multistringvalue"=hex(7):73,00,74,00,72,00,69,00,6e,00,67,00,20,00,31,00,00,\ 00,73,00,74,00,72,00,69,00,6e,00,67,00,20,00,32,00,00,00,73,00,74,00,72,00,\ 69,00,6e,00,67,00,20,00,33,00,00,00,00,00 "expstringvalue"=hex(2):73,00,74,00,72,00,69,00,6e,00,67,00,20,00,77,00,69,00,\ 74,00,68,00,20,00,25,00,73,00,20,00,65,00,78,00,70,00,61,00,6e,00,73,00,69,\ 00,6f,00,6e,00,00,00 * */ int parse_valuestring(char *s, char *w, int len, int wide, struct keyval **kvptr) { unsigned int dword; int type = -1; int i; int quote; int strstart; uint8_t byte; uint8_t *array; char *widebuf = NULL; struct keyval *kv = NULL; // printf("parse_val: input string: <%s>\n",s); if (!strncmp(s,"dword",4)) { /* DWORD */ sscanf(s,"dword:%x",&dword); // printf("parse_vals: dword is %x\n",dword); type = REG_DWORD; len = 4; ALLOC(kv,1,len + 8); kv->data = dword; } else if (!strncmp(s,"hex",3)) { /* Hex string */ if (!sscanf(s,"hex(%x):",&type)) type = REG_BINARY; // printf("parse_vals: hex type is %d\n",type); while (*s && *s != ':') s++; /* Move up to : */ s++; len = strlen(s); if (len > 0) len = len / 3 + 1; /* 3 characters per byte */ // printf("parse_vals: hex byte count %d\n", len); ALLOC(kv,1,len + 8); array = (uint8_t *)&kv->data; for (i = 0; i < len; i++) { if (!sscanf(s,"%hhx",&byte)) { fprintf(stderr,"parse_values: hex string parse error: %s\n",s); abort(); } // printf("parse_vals: adding byte: %02x\n",byte); *(array+i) = byte; s += 3; } } else { /* Assume it simply is a string */ type = REG_SZ; if (wide) { /* File is wide, find string limits and de-escape it, then copy in as wide */ quote = 0; i = 0; strstart = 0; while ( *(w+i) ) { if ( *(w+i) == '"' && *(w+i+1) == 0) quote ^= 1; if (!quote && !strstart && ( *(w+i) == '=' && *(w+i+1) == 0) ) { strstart = i + 4; /* Skip past start quote */ } i += 2; } if ( *(w+i-2) == '"' && *(w+i-1) == 0) { /* Remove end quoute */ *(w+i-2) = 0; *(w+i-1) = 0; i -= 2; } i += 2; // hexdump(w+strstart,0,i-strstart,1); len = de_escape(w + strstart, wide); // hexdump(w+strstart,0,len,1); // printf("wide string: i = %d, strstart = %d, len = %d\n",i,strstart,len); ALLOC(kv,1,len + 8); memcpy(&kv->data,w + strstart, len); } else { /* File is not wide, so we must widen string before putting into registry */ len = strlen(s); // printf("parse_vals: len %d string <%s>\n",len,s); len = de_escape(s, 0); // printf("parse_vals: after de-escape len %d string <%s>\n",len,s); widebuf = string_prog2regw(s, strlen(s), &len); len += 2; /* Also store the terminating NULLs */ // printf("parse_vals: len after wide expansion: %d\n",len); ALLOC(kv,1,len + 8); memcpy(&kv->data,widebuf,len); FREE(widebuf); } } if (kv) { kv->len = len; *kvptr = kv; } return(type); } /* Main import routine * Only reading into one hive at a time supported. * Will support 8 bit or 16 bit (wide) character .reg file. * Windows regedit.exe usually generates 16 bit. * NOTE: Not a lot of sanity checking, a broken input file may end in strange behaviour or corrupt registry! * hdesc - Loaded hive * filename - (path)name of .reg file to read * prefix - HKEY_ */ void import_reg(struct hive *hdesc, char *filename, char *prefix) { FILE *file; char line[MAXLINE+2]; char wline[MAXLINE+2]; /* Wide buffer */ int l, plen; char *assigner = NULL; char *value = NULL; int wide = 0; int c,wl; void *valbuf; char *valname = NULL; char *plainname = NULL; char *valstr, *key, *walstr = NULL; int nk, prevnk; /* offsets to nk */ int type,oldtype; struct keyval *valbinbuf = NULL; int numkeys = 0; int numkeyadd = 0; int numtotvals = 0; int numkeyvals = 0; int bailout = 0; plen = strlen(prefix); file = fopen(filename, "r"); if(!file) { fprintf(stderr,"import_reg: Cannot open file '%s'. %s (%d).\n", filename, strerror(errno), errno); return; } c = fgetc(file); if (c == 0xff) { /* Wide characters file */ fprintf(stderr,"import_reg: WARNING: Wide character (16 bit) file..\n" "import_reg: WARNING: Implementation is not 100%% accurate, some things may not import correctly!\n"); c = fgetc(file); /* Get second wide indicator character */ wide = 1; } else { ungetc(c, file); } line[0] = 0; my_fgets(line, wline, MAXLINE, file, wide); line[MAXLINE] = 0; if (strncmp("Windows Registry Editor",line,23)) { fprintf(stderr,"import_reg: ERROR: Windows Registry Editor signature missing on first line\n"); fclose(file); return; } do { l = get_line(line, wline, file, &assigner, &value, wide); if (!feof(file) && !assigner && value) { // printf("import_reg: value continuation line: %s\n",value); l = strlen(value); if ( *(value+l-1) == '\\' ) { /* Strip off cont character */ *(value+l-1) = 0; l--; } value = dequote(value); l = strlen(value); valstr = realloc(valstr, strlen(valstr) + l + 3); if (valstr == NULL) { perror("import_reg: realloc(valstr)"); abort(); } strcat(valstr, value); // printf("import_reg: build value string: %s\n",valstr); if (wide) { wl = wide_strlen(wline); walstr = realloc(walstr, wide_strlen(walstr) + wl + 4); if (walstr == NULL) { perror("import_reg: realloc(valstr)"); abort(); } memcpy(walstr + wl, wline, wl); } } else { /* End continuation, store built up value */ if (valname) { // printf("import_reg: end of value %s, result string: %s\n\n",valname,valstr); type = parse_valuestring(valstr, walstr, l, wide, &valbinbuf); // printf("import_reg: got value type = %d\n",type); // printf("import_reg: data lenght = %d\n",(*valbinbuf).len); VERBF(hdesc," Value <%s> of type %d length %d",valname,type,(*valbinbuf).len); oldtype = get_val_type(hdesc, nk + 4, valname, TPF_VK_ABS|TPF_EXACT); if (oldtype == -1) { // printf("Value <%s> not found, creating it new\n",valname); plainname = str_dup(valname); de_escape(plainname,0); // printf("de-escaped to <%s> creating it new\n",plainname); add_value(hdesc, nk + 4, plainname, type); oldtype = get_val_type(hdesc, nk + 4, valname, TPF_VK_ABS|TPF_EXACT); FREE(plainname); VERB(hdesc," [CREATED]"); } if (oldtype != type) { fprintf(stderr,"ERROR: import_reg: unable to change value <%s>, new type is %d while old is %d\n",valname,type,oldtype); bailout = 1; } else { VERB(hdesc,"\n"); put_buf2val(hdesc, valbinbuf, nk + 4, valname, type, TPF_VK_ABS|TPF_EXACT); numkeyvals++; numtotvals++; FREE(valbinbuf); FREE(valstr); FREE(valname); FREE(walstr); } } } if (assigner && !value) { /* Its a key line */ //printf("import_reg: read key name: %s\n",assigner); if ( !strncmp(assigner,prefix,plen)) { /* Check and strip of prefix of key name */ assigner += plen; } else { fprintf(stderr,"import_reg: WARNING: found key <%s> not matching prefix <%s>\n",assigner,prefix); abort(); } if (numkeys) { if (hdesc->state & HMODE_VERBOSE) printf("--- END of key, with %d values\n",numkeyvals); else printf(" with %d values.\n",numkeyvals); numkeyvals = 0; } printf("--- Import KEY <%s> ",assigner); numkeys++; key = strtok(assigner,"\\"); prevnk = hdesc->rootofs; while (key) { nk = trav_path(hdesc, prevnk + 4, key, TPF_NK_EXACT); if (!nk) { if (!add_key(hdesc, prevnk + 4, key)) { fprintf(stderr,"\nERROR: import_reg: failed to add (sub)key <%s>\n",key); bailout = 1; } else { printf(" [added <%s>] ",key); nk = trav_path(hdesc, prevnk + 4, key, TPF_NK_EXACT); numkeyadd++; } } prevnk = nk; key = strtok(NULL,"\\"); } fflush(stdout); VERB(hdesc,"\n"); } if (assigner && value) { // printf("import_reg: value assignment line: %s = %s\n",assigner,value); valname = str_dup(dequote(assigner)); if (wide) { FREE(walstr); ALLOC(walstr, 1, wide_strlen(wline)); memcpy(walstr, wline, wide_strlen(wline)); } l = strlen(value); if ( *(value+l-1) == '\\' ) { /* Strip off cont character */ *(value+l-1) = 0; l--; } value = dequote(value); valstr = str_dup(value); valbuf = NULL; //printf("import_reg: val name = %s\n",valname); //printf("import_reg: val str = %s\n",valstr); } } while (!feof(file) && !bailout); printf("\nEND OF IMPORT, file <%s>, operation %s!\n", filename, (bailout ? "FAILED" : "SUCCEEDED")); printf("%d keys\n",numkeys); printf("%d new keys added\n",numkeyadd); printf("%d values total\n\n",numtotvals); fclose(file); if (bailout) hdesc->state &= ~HMODE_DIRTY; /* Don't save if error. Or should we? */ } /* ================================================================ */ /* Hive control (load/save/close) etc */ void closeHive(struct hive *hdesc) { // printf("closing hive %s\n",hdesc->filename); if (hdesc->state & HMODE_OPEN) { close(hdesc->filedesc); } FREE(hdesc->filename); FREE(hdesc->buffer); FREE(hdesc); } /* Compute checksum of REGF header page * hdesc = hive * returns checksum value, 32 bit int */ int32_t calc_regfsum(struct hive *hdesc) { int32_t checksum = 0; struct regf_header *hdr; int i; hdr = (struct regf_header *) hdesc->buffer; for (i = 0; i < 0x1fc/4; ++i) checksum ^= ((int32_t *) hdr)[i]; return(checksum); } /* Write the hive back to disk (only if dirty & not readonly */ int writeHive(struct hive *hdesc) { int len; struct regf_header *hdr; if (hdesc->state & HMODE_RO) return(0); if ( !(hdesc->state & HMODE_DIRTY)) return(0); if ( !(hdesc->state & HMODE_OPEN)) { /* File has been closed */ if (!(hdesc->filedesc = open(hdesc->filename,O_RDWR))) { fprintf(stderr,"writeHive: open(%s) failed: %s, FILE NOT WRITTEN!\n",hdesc->filename,strerror(errno)); return(1); } hdesc->state |= HMODE_OPEN; } /* Seek back to begginning of file (in case it's already open) */ lseek(hdesc->filedesc, 0, SEEK_SET); /* compute new checksum */ hdr = (struct regf_header *) hdesc->buffer; hdr->checksum = calc_regfsum(hdesc); len = write(hdesc->filedesc, hdesc->buffer, hdesc->size); if (len != hdesc->size) { fprintf(stderr,"writeHive: write of %s failed: %s.\n",hdesc->filename,strerror(errno)); return(1); } hdesc->state &= (~HMODE_DIRTY); return(0); } #undef LOAD_DEBUG struct hive *openHive(char *filename, int mode) { struct hive *hdesc; int fmode,r,vofs; struct stat sbuf; uint32_t pofs; int32_t checksum; char *c; struct hbin_page *p; struct regf_header *hdr; struct nk_key *nk; struct ri_key *rikey; int verbose = (mode & HMODE_VERBOSE); int trace = (mode & HMODE_TRACE) ? 1 : 0; CREATE(hdesc,struct hive,1); hdesc->filename = str_dup(filename); hdesc->state = 0; hdesc->size = 0; hdesc->buffer = NULL; if ( (mode & HMODE_RO) ) { fmode = O_RDONLY; } else { fmode = O_RDWR; } hdesc->filedesc = open(hdesc->filename,fmode); if (hdesc->filedesc < 0) { fprintf(stderr,"openHive(%s) failed: %s, trying read-only\n",hdesc->filename,strerror(errno)); fmode = O_RDONLY; mode |= HMODE_RO; hdesc->filedesc = open(hdesc->filename,fmode); if (hdesc->filedesc < 0) { fprintf(stderr,"openHive(%s) in fallback RO-mode failed: %s\n",hdesc->filename,strerror(errno)); closeHive(hdesc); return(NULL); } } if ( fstat(hdesc->filedesc,&sbuf) ) { perror("stat()"); exit(1); } hdesc->size = sbuf.st_size; hdesc->state = mode | HMODE_OPEN; /* fprintf(stderr,"hiveOpen(%s) successful\n",hdesc->filename); */ /* Read the whole file */ ALLOC(hdesc->buffer,1,hdesc->size); r = read(hdesc->filedesc,hdesc->buffer,hdesc->size); if (r < hdesc->size) { fprintf(stderr,"Could not read file, got %d bytes while expecting %d\n", r, hdesc->size); closeHive(hdesc); return(NULL); } /* Now run through file, tallying all pages */ /* NOTE/KLUDGE: Assume first page starts at offset 0x1000 */ pofs = 0x1000; hdr = (struct regf_header *)hdesc->buffer; if (hdr->id != 0x66676572) { fprintf(stderr,"openHive(%s): File does not seem to be a registry hive!\n",filename); return(hdesc); } checksum = calc_regfsum(hdesc); #ifdef LOAD_DEBUG printf("openhive: calculated checksum: %08x\n",checksum); printf("openhive: file REGF checksum: %08x\n",hdr->checksum); #endif if (checksum != hdr->checksum) { fprintf(stderr,"openHive(%s): WARNING: REGF header checksum mismatch! calc: 0x%08x != file: 0x%08x\n",filename,checksum,hdr->checksum); } printf("Hive <%s> name (from header): <",filename); for (c = hdr->name; *c && (c < hdr->name + 64); c += 2) putchar(*c); hdesc->rootofs = hdr->ofs_rootkey + 0x1000; printf(">\nROOT KEY at offset: 0x%06x * ",hdesc->rootofs); /* Cache the roots subkey index type (li,lf,lh) so we can use the correct * one when creating the first subkey in a key */ nk = (struct nk_key *)(hdesc->buffer + hdesc->rootofs + 4); if (nk->id == 0x6b6e) { rikey = (struct ri_key *)(hdesc->buffer + nk->ofs_lf + 0x1004); hdesc->nkindextype = rikey->id; if (hdesc->nkindextype == 0x6972) { /* Gee, big root, must check indirectly */ printf("openHive: DEBUG: BIG ROOT!\n"); rikey = (struct ri_key *)(hdesc->buffer + rikey->hash[0].ofs_li + 0x1004); hdesc->nkindextype = rikey->id; } if (hdesc->nkindextype != 0x666c && hdesc->nkindextype != 0x686c && hdesc->nkindextype != 0x696c) { hdesc->nkindextype = 0x666c; } printf("Subkey indexing type is: %04x <%c%c>\n", hdesc->nkindextype, hdesc->nkindextype & 0xff, hdesc->nkindextype >> 8); } else { fprintf(stderr,"openHive: WARNING: ROOT key does not seem to be a key! (not type == nk)\n"); } while (pofs < hdr->filesize + 0x1000) { /* Loop through hbins until end according to regf header */ #ifdef LOAD_DEBUG int htrace = 1; // if (htrace) hexdump(hdesc->buffer,pofs,pofs+0x20,1); #endif p = (struct hbin_page *)(hdesc->buffer + pofs); if (p->id != 0x6E696268) { printf("Page at 0x%x is not 'hbin', assuming file contains garbage at end\n",pofs); break; } hdesc->pages++; if (verbose) printf("###### Page at 0x%0x ofs_self 0x%0x, size (delta ofs_next) 0x%0x ######\n", pofs,p->ofs_self,p->ofs_next); if (p->ofs_next == 0) { fprintf(stderr,"openHive: ERROR: Page at 0x%x has size zero! File may be corrupt, or program has a bug\n",pofs); return(hdesc); } vofs = pofs + 0x20; /* Skip page header, and run through blocks in hbin */ while (vofs-pofs < p->ofs_next && vofs < hdesc->size) { vofs += parse_block(hdesc,vofs,trace); } pofs += p->ofs_next; } /* hbin loop */ hdesc->endofs = hdr->filesize + 0x1000; hdesc->lastbin = pofs - p->ofs_next; /* Compensate for loop that added at end above */ if (verbose) { printf("Last HBIN at offset : 0x%x\n",hdesc->lastbin); printf("First non-HBIN page offset: 0x%x\n",hdesc->endofs); printf("hdr->unknown4 (version?) : 0x%x\n",hdr->unknown4); } printf("File size %d [%x] bytes, containing %d pages (+ 1 headerpage)\n",hdesc->size,hdesc->size, hdesc->pages); printf("Used for data: %d/%d blocks/bytes, unused: %d/%d blocks/bytes.\n\n", hdesc->useblk,hdesc->usetot,hdesc->unuseblk,hdesc->unusetot); /* So, let's guess what kind of hive this is, based on keys in its root */ hdesc->type = HTYPE_UNKNOWN; if (trav_path(hdesc, 0, "\\SAM", 0)) hdesc->type = HTYPE_SAM; else if (trav_path(hdesc, 0, "\\ControlSet", 0)) hdesc->type = HTYPE_SYSTEM; else if (trav_path(hdesc, 0, "\\Policy", 0)) hdesc->type = HTYPE_SECURITY; else if (trav_path(hdesc, 0, "\\Microsoft", 0)) hdesc->type = HTYPE_SOFTWARE; if (verbose) printf("Type of hive guessed to be: %d\n",hdesc->type); return(hdesc); } chntpw_0.99.6.110511/cpnt.c0000644000175000017500000000413111562562244013177 0ustar jfsjfs/* * cpnt.c - Copy over file without truncating. * For use on my current floppy, since it's 'cp' insist * on truncating first, and NTFS doesn't like that yet. * * 2003-apr: First version * ***** * * Copyright (c) 1997-2007 Petter Nordahl-Hagen. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; version 2 of the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * See file GPL.txt for the full license. * */ #include #include #include #include #include #include #include #include #include #define BUFSIZE 16384 int main(int argc, char **argv) { void *buf; int sf,df,rb,wb; int going = 1; int e = 0; if (argc != 3) { printf("usage: cpnt \n"); printf(" sorry, only one file at a time yet.\n"); return(1); } #if 0 printf("input : %s\n",argv[1]); printf("output: %s\n",argv[2]); #endif buf = malloc(BUFSIZE); if (!buf) { printf("cpnt: could not allocate buffer\n"); return(1); } sf = open(argv[1],O_RDONLY); if (sf < 0) { e = errno; printf("cpnt: %s: %s\n",argv[1],strerror(e)); return(1); } df = open(argv[2],O_WRONLY|O_CREAT,00666); if (df < 0) { e = errno; printf("cpnt: %s: %s\n",argv[2],strerror(e)); return(1); } while (going) { rb = read(sf,buf,BUFSIZE); if (rb < 0) { e = errno; printf("cpnt: error while reading: %s\n",strerror(e)); going = 0; break; } if (rb == 0) going = 0; wb = write(df,buf,rb); if (wb < 0) { e = errno; printf("cpnt: error while writing: %s\n",strerror(e)); going = 0; } } close(sf); close(df); free(buf); return(e ? 1 : 0); } chntpw_0.99.6.110511/hash.c0000644000175000017500000000531311562562244013161 0ustar jfsjfs/* Mickeysoft hashroutine in XP 'lh' key index lists */ #include #include #include static const unsigned char charset2upper[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, /* 0x00-0x07 */ 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, /* 0x08-0x0f */ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, /* 0x10-0x17 */ 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, /* 0x18-0x1f */ 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, /* 0x20-0x27 */ 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, /* 0x28-0x2f */ 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, /* 0x30-0x37 */ 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, /* 0x38-0x3f */ 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x40-0x47 */ 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x48-0x4f */ 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x50-0x57 */ 0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, /* 0x58-0x5f */ 0x60, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, /* 0x60-0x67 */ 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, /* 0x68-0x6f */ 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, /* 0x70-0x77 */ 0x58, 0x59, 0x5a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, /* 0x78-0x7f */ 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, /* 0x80-0x87 */ 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, /* 0x88-0x8f */ 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, /* 0x90-0x97 */ 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f, /* 0x98-0x9f */ 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, /* 0xa0-0xa7 */ 0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, /* 0xa8-0xaf */ 0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0x00, 0xb6, 0xb7, /* 0xb0-0xb7 */ 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf, /* 0xb8-0xbf */ 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 0xc0-0xc7 */ 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, /* 0xc8-0xcf */ 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, /* 0xd0-0xd7 */ 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, /* 0xd8-0xdf */ 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, /* 0xe0-0xe7 */ 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, /* 0xe8-0xef */ 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xf7, /* 0xf0-0xf7 */ 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0x00, /* 0xf8-0xff */ }; int main(void) { char str[500]; long hash = 0; int i; FILE *f; f = fdopen(0,"r"); fgets(str, 499, f); str[strlen(str)-1] = 0; for (i = 0; i < strlen(str); i++) { hash *= 37; hash += charset2upper[(unsigned char)str[i]]; } printf("hash = %08x\n",hash); } chntpw_0.99.6.110511/README.txt0000600000175000017500000002061511562562244013562 0ustar jfsjfs The Offline NT Password Editor (c) 1997-2011 Petter Nordahl-Hagen This is free software, licensed under the following: "ntreg" (the registry library) is licensed under the GNU Lesser Public License. See LGPL.txt. "chntpw" (the password reset / registry editor frontend) is licensed under the GNU General Public License, see GPL.txt. "reged" (registry editor /export tool) is licensed under the GNU General Public License, see GPL.txt. See INSTALL.txt for compile/installation instructions. Where to get more info: ----------------------- http://pogostick.net/~pnh/ntpasswd/ At that site there's a floppy and a bootable CD that use chntpw to access the NT/2k/XP/Vista-system it is booted on to edit password etc. The instructions below are for the standalone program itself, not the floppy. What does chntpw do? -------------------- This little program will enable you to view some information and change user passwords in a Windows (NT/XP/Vista/win7) etc SAM userdatabase file. You do not need to know the old passwords. However, you need to get at the file some way or another yourself. In addition it contains a simple registry editor with full write support, and hex-editor which enables you to fiddle around with bits&bytes in the file as you wish yourself. Also have registry import or export ----------------------------------- "reged" is a program that can do import and export of .reg files into the registry hive (binary) files. Also has an editor, but still rudimentary text based command line type thing. Why? ---- I often forget passwords. Especially on test installations (that I just _must_ have some stuff out of half a year later..) On most unix-based boxes you just boot the thingy off some kind of rescue bootmedia (cd/floppy etc), and simply edit the password file. On Windows NT however, as far as I know, there is no way except reinstalling the userdatabase, losing all users except admin. (ok, some companies let you pay lotsa $$$$$ for some rescue service..) How? ---- Currently, this thing only runs under linux, but it may just happen to compile on other platforms, too. (there are dos-versions available, look for links on my webpage) So, to set a new adminpassword on your NT installation you either: 1) Take the harddrive and mount it on a linux-box 2) Use a linux-bootdisk or CD one is available at: http://pogostick.net/~pnh/ntpasswd/ ie. you do it offline, with the NT system down. Usage: ------ This is usage of the "chntpw" program binary only. For info on the bootdisk, see the web site. Some of the output format has changed a little since the docs were first written. chntpw version 0.99.2 040105, (c) Petter N Hagen chntpw: change password of a user in a NT SAM file, or invoke registry editor. chntpw [OPTIONS] [systemfile] [securityfile] [otherreghive] [...] -h This message -u Username to change, Administrator is default -l list all users in SAM file -i Interactive. List users (as -l) then ask for username to change -e Registry editor. Now with full write support! -d Enter buffer debugger instead (hex editor), -t Trace. Show hexdump of structs/segments. (deprecated debug function) -v Be a little more verbose (for debuging) -L Write names of changed files to /tmp/changed -N No allocation mode. Only (old style) same length overwrites possible Normal usage is: > chntpw sam system security - open registry hives 'sam' and 'system' and change administrator account. Verions dated later from Feb 1999 and later also supports and will find the admin account, even if the name has been changed, or the name has been localized (different languageversion of NT use different admin-names) The -u option: Specifies user to change: > chntpw -u jabbathehutt mysam - Prompt for password for 'jabbathehutt', if found (otherwise do nothing) Or you may give RID number in hex: > chntpw -u 0x1f4 mysam - Will edit administrator. Names does not support multibyte (unicode) characters like some russian and asian locales. Give RID in hex to edit users with such names. Must start with 0x. Ex: 0x2fa The -l option: Will list all users in the sam-file. The -i option: Go into the interactive menu system. The -d option: This will load the file, and then immediately enter the buffer debugger. This is a simple hex-editor with only a few commands, enter ? at the . prompt to se a short command overview. 'q' exits without saving, 's' exit and saves. The -e option: Will enter the registry editor. You can navigate the registry like a filesystem at the command-line prompt: See regedit.txt file for more info. The -t option: This is a debug function (extended -l) to show how it traces the chain of structs in the file. This also includes a raw interpretation of the different registry structures + a hex dump. The -L option: Drops the filenames of the changed hives in /tmp/changed Used by the bootdisk scripts. The -N option: Will fall back to old edit mode, disable the block allocations and only support overwrite-same-size. Used to ensure safety in testing period. How does it work: ----------------- A struct, called the V value of a key in the NT registry was suddenly somewhat documented through the pwdump utility included in the unix Samba distribution. This struct contains some info on a user of the NT machine, along with 2 crypted versions of the password associated with the account. One password is the NT console login password, the other the LANMAN network share password (which essentially is the first one in uppercase only, and no unicode) This is how NT encrypts the passwords: The logon cleartext password a user enters is: 1) Converted to unicode 2) A MD4 hash is made out of the unicode string 3) Then the hash is crypted with DES, using the RID (lower part of the SID, userid) as the crypt key. This is the so called "obfuscation" step, so it's not obvious on a hex dump of the file that two or more users have the same password. 4) The result of stage 3 (16 bytes) is put into the V struct. For the LANMAN password: 1) Uppercased (and illegal characters probably removed) 14 bytes max, if less the remaining bytes are zeroed. 2) A known (constant) string is DES-encrypted using 7 first characters of the password as the key. Another constant is encrypted using the last 7 chars as the key. The result of these two crypts are simply appended, resulting in a 16 byte string. 3) The same obfuscation DES stage as 3 above. 4) 16 bytes result put into the V struct. Since the number of possible combinations in the lanman password is relatively low compared to the other one, and it's easy to see if it's shorter than 8 chars or not it's used first in brute-force-crackers. This program, however, don't care at all what the old one is, it just overwrites it with the new one. Ok. So, how do we find and identify the V struct? Yeah.. that was the hard part.. The files structure is not documented (as far as I know..) But, with help from an unnamed German, and a lot of testing and guesswork from myself, it's now possible to follow the actual registry tree. (see source code for struct-defines and comments on the registry structure) The usernames are listed in: \SAM\Domains\Account\Users\Names\ [2d18] \SAM\Domains\Account\Users\Names> l ls of node at offset 0x2d1c Node has 4 subkeys and 1 values nk-offset name 0x003290 - 0x003630 - 0x001c88 - 0x003428 - Each name is a subkey, with one namless value containing the RID. [2d18] \SAM\Domains\Account\Users\Names> cd pnh [3428] \SAM\Domains\Account\Users\Names\pnh> l ls of node at offset 0x342c Node has 0 subkeys and 1 values vk-offs size type name 0x003688 0 (unknown) <> INLINE: val (in type field?): 1000 (0x3e8) To get the userinfo (V struct), access \SAM\Domains\Account\Users\\V [2c90] \SAM\Domains\Account\Users> l ls of node at offset 0x2c94 Node has 5 subkeys and 1 values nk-offset name 0x003320 - <000001F4> 0x0036b8 - <000001F5> 0x003550 - <000003E8> 0x001d00 - <000003E9> 0x002d18 - [2c90] \SAM\Domains\Account\Users> cd 000003E8 [3550] \SAM\Domains\Account\Users\000003E8> l ls of node at offset 0x3554 Node has 0 subkeys and 2 values vk-offs size type name 0x0035a8 80 REG_BINARY 0x003228 508 REG_BINARY For more techincal info, look it up in the source code. chntpw_0.99.6.110511/COPYING.txt0000644000175000017500000004313311562562244013745 0ustar jfsjfs GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. chntpw_0.99.6.110511/GPL.txt0000644000175000017500000004311411562562244013256 0ustar jfsjfs GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. chntpw_0.99.6.110511/chntpw.c0000600000175000017500000011521711562562244013536 0ustar jfsjfs/* * chntpw.c - Offline Password Edit Utility for Windows SAM database * * This program uses the "ntreg" library to load and access the registry, * it's main purpose is to reset password based information. * It can also call the registry editor etc * 2011-apr: Command line options added for hive expansion safe mode * 2010-jun: Syskey not visible in menu, but is selectable (2) * 2010-apr: Interactive menu adapts to show most relevant * selections based on what is loaded * 2008-mar: Minor other tweaks * 2008-mar: Interactive reg ed moved out of this file, into edlib.c * 2008-mar: 64 bit compatible patch by Mike Doty, via Alon Bar-Lev * http://bugs.gentoo.org/show_bug.cgi?id=185411 * 2007-sep: Group handling extended, promotion now public * 2007-sep: User edit menu, some changes to user info edit * 2007-apr-may: Get and display users group memberships * 2007-apr: GNU license. Some bugfixes. Cleaned up some output. * 2004-aug: More stuff in regedit. Stringinput bugfixes. * 2004-jan: Changed some of the verbose/debug stuff * 2003-jan: Changed to use more of struct based V + some small stuff * 2003-jan: Support in ntreg for adding keys etc. Editor updated. * 2002-dec: New option: Specify user using RID * 2002-dec: New option: blank the pass (zero hash lengths). * 2001-jul: extra blank password logic (when NT or LANMAN hash missing) * 2001-jan: patched & changed to use OpenSSL. Thanks to Denis Ducamp * 2000-jun: changing passwords regardless of syskey. * 2000-jun: syskey disable works on NT4. Not properly on NT5. * 2000-jan: Attempt to detect and disable syskey * 1999-feb: Now able to browse registry hives. (write support to come) * See HISTORY.txt for more detailed info on history. * ***** * * Copyright (c) 1997-2011 Petter Nordahl-Hagen. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; version 2 of the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * See file GPL.txt for the full license. * ***** * * Information and ideas taken from pwdump by Jeremy Allison. * * More info from NTCrack by Jonathan Wilkins. * */ #include #include #include #include #include #include #include #include #include #include #include #include #define uchar u_char #define MD4Init MD4_Init #define MD4Update MD4_Update #define MD4Final MD4_Final #include "ntreg.h" #include "sam.h" const char chntpw_version[] = "chntpw version 0.99.6 110511 , (c) Petter N Hagen"; extern char *val_types[REG_MAX+1]; /* Global verbosity */ int gverbose = 0; #define MAX_HIVES 10 /* Array of loaded hives */ struct hive *hive[MAX_HIVES+1]; int no_hives = 0; /* Icky icky... globals used to refer to hives, will be * set when loading, so that hives can be loaded in any order */ int H_SAM = -1; int H_SYS = -1; int H_SEC = -1; int H_SOF = -1; int syskeyreset = 0; int dirty = 0; int max_sam_lock = 0; /* * of user with RID 500, because silly MS decided * to localize the bloody admin-username!! AAAGHH! */ char admuser[129]="Administrator"; /* ============================================================== */ /* Crypto-stuff & support for what we'll do in the V-value */ /* Zero out string for lanman passwd, then uppercase * the supplied password and put it in here */ void make_lanmpw(char *p, char *lm, int len) { int i; for (i=0; i < 15; i++) lm[i] = 0; for (i=0; i < len; i++) lm[i] = toupper(p[i]); } /* * Convert a 7 byte array into an 8 byte des key with odd parity. */ void str_to_key(unsigned char *str,unsigned char *key) { int i; key[0] = str[0]>>1; key[1] = ((str[0]&0x01)<<6) | (str[1]>>2); key[2] = ((str[1]&0x03)<<5) | (str[2]>>3); key[3] = ((str[2]&0x07)<<4) | (str[3]>>4); key[4] = ((str[3]&0x0F)<<3) | (str[4]>>5); key[5] = ((str[4]&0x1F)<<2) | (str[5]>>6); key[6] = ((str[5]&0x3F)<<1) | (str[6]>>7); key[7] = str[6]&0x7F; for (i=0;i<8;i++) { key[i] = (key[i]<<1); } DES_set_odd_parity((des_cblock *)key); } /* * Function to convert the RID to the first decrypt key. */ void sid_to_key1(uint32_t sid,unsigned char deskey[8]) { unsigned char s[7]; s[0] = (unsigned char)(sid & 0xFF); s[1] = (unsigned char)((sid>>8) & 0xFF); s[2] = (unsigned char)((sid>>16) & 0xFF); s[3] = (unsigned char)((sid>>24) & 0xFF); s[4] = s[0]; s[5] = s[1]; s[6] = s[2]; str_to_key(s,deskey); } /* * Function to convert the RID to the second decrypt key. */ void sid_to_key2(uint32_t sid,unsigned char deskey[8]) { unsigned char s[7]; s[0] = (unsigned char)((sid>>24) & 0xFF); s[1] = (unsigned char)(sid & 0xFF); s[2] = (unsigned char)((sid>>8) & 0xFF); s[3] = (unsigned char)((sid>>16) & 0xFF); s[4] = s[0]; s[5] = s[1]; s[6] = s[2]; str_to_key(s,deskey); } /* DES encrypt, for LANMAN */ void E1(uchar *k, uchar *d, uchar *out) { des_key_schedule ks; des_cblock deskey; str_to_key(k,(uchar *)deskey); #ifdef __FreeBSD__ des_set_key(&deskey,ks); #else /* __FreeBsd__ */ des_set_key((des_cblock *)deskey,ks); #endif /* __FreeBsd__ */ des_ecb_encrypt((des_cblock *)d,(des_cblock *)out, ks, DES_ENCRYPT); } /* Check if hive is SAM, and if it is, extract some * global policy information from it, like lockout counts etc */ void check_get_samdata(void) { struct accountdb_F *f; struct keyval *v; if (H_SAM >= 0) { /* Get users F value */ v = get_val2buf(hive[H_SAM], NULL, 0, ACCOUNTDB_F_PATH, REG_BINARY, TPF_VK); if (!v) { printf("Login counts data not found in SAM\n"); return; } printf("\n* SAM policy limits:\n"); f = (struct accountdb_F *)&v->data; max_sam_lock = f->locklimit; printf("Failed logins before lockout is: %d\n",max_sam_lock); printf("Minimum password length : %d\n",f->minpwlen); printf("Password history count : %d\n",f->minpwlen); } } /* Try to decode and possibly change account lockout etc * This is \SAM\Domains\Account\Users\\F * It's size seems to always be 0x50. * Params: RID - user ID, mode - 0 silent, 1 silent, 2 edit. * Returns: ACB bits with high bit set if lockout count is >0 */ short handle_F(int rid, int mode) { struct user_F *f; char s[200]; struct keyval *v; unsigned short acb; int b; if (H_SAM < 0) return(0); /* Get users F value */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\%08X\\F",rid); v = get_val2buf(hive[H_SAM], NULL, 0, s, REG_BINARY, TPF_VK_EXACT); if (!v) { printf("Cannot find value <%s>\n",s); return(0); } if (v->len < 0x48) { printf("handle_F: F value is 0x%x bytes, need >= 0x48, unable to check account flags!\n",v->len); FREE(v); return(0); } f = (struct user_F *)&v->data; acb = f->ACB_bits; if (mode == 1) { printf("Account bits: 0x%04x =\n",acb); for (b=0; b < 15; b++) { printf("[%s] %-15.15s | ", (acb & (1<failedcnt,max_sam_lock); printf("Total login count: %u\n",f->logins); } if (mode == 2) { acb |= ACB_PWNOEXP; acb &= ~ACB_DISABLED; acb &= ~ACB_AUTOLOCK; f->ACB_bits = acb; f->failedcnt = 0; put_buf2val(hive[H_SAM], v, 0, s, REG_BINARY,TPF_VK_EXACT); printf("Unlocked!\n"); } return (acb | ( (f->failedcnt > 0 && f->failedcnt >= max_sam_lock)<<15 ) | (acb & ACB_AUTOLOCK)<<15 | (acb & ACB_DISABLED)<<15); } /* List users membership or check if admin (is in admin group) * rid - users rid * check - if 1 just check if admin, do not list * returns true if user is admin */ int list_user_groups(int rid, int check) { char s[200]; char g[200]; char groupname[128]; int nk = 0; struct keyval *m = NULL, *c = NULL; struct group_C *cd; unsigned int *grps; int count = 0, isadmin = 0; int i, size, grp, grpnamoffs, grpnamlen; if (!rid || (H_SAM < 0)) return(0); /* Get member list for user. Go for the first full SID, it's usually local computer I hope */ snprintf(s,180,"\\SAM\\Domains\\Builtin\\Aliases\\Members\\S-1-5-21-\\%08X",rid); /* Now, the TYPE field is the number of groups the user is member of */ /* Don't we just love the inconsistent use of fields!! */ nk = trav_path(hive[H_SAM], 0, s, 0); if (!nk) { /* This probably means user is not in any group. Seems to be the case for a couple of XPs built in support / guest users. So just return */ if (gverbose) printf("list_user_groups(): Cannot find RID under computer SID <%s>\n",s); return(0); } nk += 4; count = get_val_type(hive[H_SAM],nk,"@",TPF_VK_EXACT); if (count == -1) { printf("list_user_groups(): Cannot find value <%s\\@>\n",s); return(0); } if (!check) printf("User is member of %d groups:\n",count); /* This is the data size */ size = get_val_len(hive[H_SAM],nk,"@",TPF_VK_EXACT); /* It should be 4 bytes for each group */ if (gverbose) printf("Data size %d bytes.\n",size); if (size != count * 4) { printf("list_user_groups(): DEBUG: Size is not 4 * count! May not matter anyway. Continuing..\n"); } m = get_val2buf(hive[H_SAM], NULL, nk, "@", 0, TPF_VK_EXACT); if (!m) { printf("list_user_groups(): Could not get value data! Giving up.\n"); return(0); } grps = (unsigned int *)&m->data; for (i = 0; i < count; i++) { grp = grps[i]; if (!check) printf("%08x ",grp); if (grp == 0x220) isadmin = 1; if (!check) { snprintf(g,180,"\\SAM\\Domains\\Builtin\\Aliases\\%08X\\C",grp); c = get_val2buf(hive[H_SAM], NULL, 0, g, 0, TPF_VK_EXACT); if (c) { cd = (struct group_C *)&c->data; grpnamoffs = cd->grpname_ofs + 0x34; grpnamlen = cd->grpname_len; cheap_uni2ascii((char *)cd + grpnamoffs, groupname, grpnamlen); printf("= %s (which has %d members)\n",groupname,cd->grp_members); } else { printf("Group info for %x not found!\n",grp); } } } return(isadmin); } /* Promote user into administrators group (group ID 0x220) * And remove from all others... * rid - users rid * no returns yet * THIS IS VERY HACKISH YET */ void promote_user(int rid) { char s[200]; char g[200]; int nk = 0; struct keyval *m = NULL, *c = NULL; struct keyval admember = { 4, 0x220 }; unsigned int *grps, *gcnts; int count = 0; int i, size, grp; if (!rid || (H_SAM < 0)) return; /* Get member list for user. Go for the first full SID, it's usually local computer I hope */ snprintf(s,180,"\\SAM\\Domains\\Builtin\\Aliases\\Members\\S-1-5-21-\\%08X",rid); /* Now, the TYPE field is the number of groups the user is member of */ /* Don't we just love the inconsistent use of fields!! */ nk = trav_path(hive[H_SAM], 0, s, 0); if (!nk) { printf("Cannot find path <%s>\n",s); return; } nk += 4; count = get_val_type(hive[H_SAM],nk,"@",TPF_VK); if (count == -1) { printf("Cannot find value <%s\\@>\n",s); return; } printf("User is member of %d groups.\n",count); /* This is the data size */ size = get_val_len(hive[H_SAM],nk,"@",TPF_VK); /* It should be 4 bytes for each group */ if (size != count * 4) { printf("DEBUG: Data size %d bytes.\n",size); printf("DEBUG: Size is not 4 * count! May not matter anyway. Continuing..\n"); } m = get_val2buf(hive[H_SAM], NULL, nk, "@", 0, TPF_VK); if (!m) { printf("Could not get value data! Giving up.\n"); return; } printf("User was member of groups: "); grps = (unsigned int *)&m->data; for (i = 0; i < count; i++) { grp = grps[i]; printf("%08x ",grp); switch (grp) { case 0x220: printf("=Administrators, "); break; case 0x221: printf("=Users, "); break; case 0x222: printf("=Guests, "); break; default: printf(", "); break; } snprintf(g,180,"\\SAM\\Domains\\Builtin\\Aliases\\%08X\\C",grp); c = get_val2buf(hive[H_SAM], NULL, 0, g, 0, TPF_VK); if (c) { gcnts = (unsigned int *)&c->data; gcnts[0xc]--; /* Decrease members counter */ put_buf2val(hive[H_SAM], c, 0, g, 0, TPF_VK); } else { printf("Group info for %x not found!\n",grp); } } #if 1 printf("\nDeleting user memberships\n"); del_value(hive[H_SAM], nk, "@", TPF_VK); printf("Adding into only administrators:\n"); if (!add_value(hive[H_SAM], nk, "@", 1)) { /* Type is # of groups, here 1 */ printf("Failed to add @ value to key\n"); } #endif put_buf2val(hive[H_SAM], &admember, nk, "@", 0, TPF_VK); /* Now bumb up administrator groups count */ c = get_val2buf(hive[H_SAM], NULL, 0, "\\SAM\\Domains\\Builtin\\Aliases\\00000220\\C", 0, TPF_VK); if (!c) printf("Group info for 220 (adm) not found!\n"); gcnts = (unsigned int *)&c->data; gcnts[0xc]++; put_buf2val(hive[H_SAM], c, 0, "\\SAM\\Domains\\Builtin\\Aliases\\00000220\\C", 0, TPF_VK); printf("Promotion DONE!\n"); } /* Decode the V-struct, and change the password * vofs - offset into SAM buffer, start of V struct * rid - the users RID, required for the DES decrypt stage * * Some of this is ripped & modified from pwdump by Jeremy Allison * */ char *change_pw(char *buf, int rid, int vlen, int stat) { uchar x1[] = {0x4B,0x47,0x53,0x21,0x40,0x23,0x24,0x25}; char yn[4]; int pl; char *vp; static char username[128],fullname[128]; char comment[128],homedir[128],md4[32],lanman[32]; char newunipw[34], newp[20], despw[20], newlanpw[16], newlandes[20]; int username_offset,username_len; int fullname_offset,fullname_len; int comment_offset,comment_len; int homedir_offset,homedir_len; int ntpw_len,lmpw_len,ntpw_offs,lmpw_offs,i; int dontchange = 0; struct user_V *v; des_key_schedule ks1, ks2; des_cblock deskey1, deskey2; MD4_CTX context; unsigned char digest[16]; unsigned short acb; v = (struct user_V *)buf; vp = buf; username_offset = v->username_ofs; username_len = v->username_len; fullname_offset = v->fullname_ofs; fullname_len = v->fullname_len; comment_offset = v->comment_ofs; comment_len = v->comment_len; homedir_offset = v->homedir_ofs; homedir_len = v->homedir_len; lmpw_offs = v->lmpw_ofs; lmpw_len = v->lmpw_len; ntpw_offs = v->ntpw_ofs; ntpw_len = v->ntpw_len; if (!rid) { printf("No RID given. Unable to change passwords..\n"); return(0); } if (gverbose) { printf("lmpw_offs: 0x%x, lmpw_len: %d (0x%x)\n",lmpw_offs,lmpw_len,lmpw_len); printf("ntpw_offs: 0x%x, ntpw_len: %d (0x%x)\n",ntpw_offs,ntpw_len,ntpw_len); } *username = 0; *fullname = 0; *comment = 0; *homedir = 0; if(username_len <= 0 || username_len > vlen || username_offset <= 0 || username_offset >= vlen || comment_len < 0 || comment_len > vlen || fullname_len < 0 || fullname_len > vlen || homedir_offset < 0 || homedir_offset >= vlen || comment_offset < 0 || comment_offset >= vlen || lmpw_offs < 0 || lmpw_offs >= vlen) { if (stat != 1) printf("change_pw: Not a legal V struct? (negative struct lengths)\n"); return(NULL); } /* Offsets in top of struct is relative to end of pointers, adjust */ username_offset += 0xCC; fullname_offset += 0xCC; comment_offset += 0xCC; homedir_offset += 0xCC; ntpw_offs += 0xCC; lmpw_offs += 0xCC; cheap_uni2ascii(vp + username_offset,username,username_len); cheap_uni2ascii(vp + fullname_offset,fullname,fullname_len); cheap_uni2ascii(vp + comment_offset,comment,comment_len); cheap_uni2ascii(vp + homedir_offset,homedir,homedir_len); #if 0 /* Reset hash-lengths to 16 if syskey has been reset */ if (syskeyreset && ntpw_len > 16 && !stat) { ntpw_len = 16; lmpw_len = 16; ntpw_offs -= 4; (unsigned int)*(vp+0xa8) = ntpw_offs - 0xcc; *(vp + 0xa0) = 16; *(vp + 0xac) = 16; } #endif if (stat) { acb = handle_F(rid,0); printf("| %04x | %-30.30s | %-6s | %-8s |\n", rid, username, (list_user_groups(rid,1) ? "ADMIN" : "") , ( acb & 0x8000 ? "dis/lock" : (ntpw_len < 16) ? "*BLANK*" : "") ); return(username); } printf("\nRID : %04d [%04x]\n",rid,rid); printf("Username: %s\n",username); printf("fullname: %s\n",fullname); printf("comment : %s\n",comment); printf("homedir : %s\n\n",homedir); list_user_groups(rid,0); printf("\n"); acb = handle_F(rid,1); if (lmpw_len < 16 && gverbose) { printf("** LANMAN password not set. User MAY have a blank password.\n** Usually safe to continue. Normal in Vista\n"); } if (ntpw_len < 16) { printf("** No NT MD4 hash found. This user probably has a BLANK password!\n"); if (lmpw_len < 16) { printf("** No LANMAN hash found either. Sorry, cannot change. Try login with no password!\n"); dontchange = 1; } else { printf("** LANMAN password IS however set. Will now install new password as NT pass instead.\n"); printf("** NOTE: Continue at own risk!\n"); ntpw_offs = lmpw_offs; *(vp+0xa8) = ntpw_offs - 0xcc; ntpw_len = 16; lmpw_len = 0; } } if (gverbose) { hexprnt("Crypted NT pw: ",(unsigned char *)(vp+ntpw_offs),16); hexprnt("Crypted LM pw: ",(unsigned char *)(vp+lmpw_offs),16); } /* Get the two decrpt keys. */ sid_to_key1(rid,(unsigned char *)deskey1); des_set_key((des_cblock *)deskey1,ks1); sid_to_key2(rid,(unsigned char *)deskey2); des_set_key((des_cblock *)deskey2,ks2); /* Decrypt the NT md4 password hash as two 8 byte blocks. */ des_ecb_encrypt((des_cblock *)(vp+ntpw_offs ), (des_cblock *)md4, ks1, DES_DECRYPT); des_ecb_encrypt((des_cblock *)(vp+ntpw_offs + 8), (des_cblock *)&md4[8], ks2, DES_DECRYPT); /* Decrypt the lanman password hash as two 8 byte blocks. */ des_ecb_encrypt((des_cblock *)(vp+lmpw_offs), (des_cblock *)lanman, ks1, DES_DECRYPT); des_ecb_encrypt((des_cblock *)(vp+lmpw_offs + 8), (des_cblock *)&lanman[8], ks2, DES_DECRYPT); if (gverbose) { hexprnt("MD4 hash : ",(unsigned char *)md4,16); hexprnt("LANMAN hash : ",(unsigned char *)lanman,16); } printf("\n- - - - User Edit Menu:\n"); printf(" 1 - Clear (blank) user password\n" " 2 - Edit (set new) user password (careful with this on XP or Vista)\n" " 3 - Promote user (make user an administrator)\n"); printf("%s4 - Unlock and enable user account%s\n", (acb & 0x8000) ? " " : "(", (acb & 0x8000) ? " [probably locked now]" : ") [seems unlocked already]"); printf(" q - Quit editing user, back to user select\n"); pl = fmyinput("Select: [q] > ",newp,16); if ( (pl < 1) || (*newp == 'q') || (*newp == 'Q')) return(0); if (*newp == '3') { printf("NOTE: This function is still experimental, and in some cases it\n" " may result in stangeness when editing user/group in windows.\n" " Also, users (like Guest often is) may still be prevented\n" " from login via security/group policies which is not changed.\n"); fmyinput("Do you still want to promote the user? (y/n) [n] ",yn,2); if (*yn == 'y' || *yn == 'Y') { promote_user(rid); } return(username); } if (*newp == '4') { acb = handle_F(rid,2); return(username); } if (*newp == '2') { if (dontchange) { printf("Sorry, unable to edit since password seems blank already (thus no space for it)\n"); return(0); } pl = fmyinput("New Password: ",newp,16); if (pl < 1) { printf("No change.\n"); return(0); } cheap_ascii2uni(newp,newunipw,pl); make_lanmpw(newp,newlanpw,pl); /* printf("Ucase Lanman: %s\n",newlanpw); */ MD4Init (&context); MD4Update (&context, newunipw, pl<<1); MD4Final (digest, &context); if (gverbose) hexprnt("\nNEW MD4 hash : ",digest,16); E1((uchar *)newlanpw, x1, (uchar *)lanman); E1((uchar *)newlanpw+7, x1, (uchar *)lanman+8); if (gverbose) hexprnt("NEW LANMAN hash : ",(unsigned char *)lanman,16); /* Encrypt the NT md4 password hash as two 8 byte blocks. */ des_ecb_encrypt((des_cblock *)digest, (des_cblock *)despw, ks1, DES_ENCRYPT); des_ecb_encrypt((des_cblock *)(digest+8), (des_cblock *)&despw[8], ks2, DES_ENCRYPT); des_ecb_encrypt((des_cblock *)lanman, (des_cblock *)newlandes, ks1, DES_ENCRYPT); des_ecb_encrypt((des_cblock *)(lanman+8), (des_cblock *)&newlandes[8], ks2, DES_ENCRYPT); if (gverbose) { hexprnt("NEW DES crypt : ",(unsigned char *)despw,16); hexprnt("NEW LANMAN crypt: ",(unsigned char *)newlandes,16); } /* Reset hash length to 16 if syskey enabled, this will cause * a conversion to syskey-hashes upon next boot */ if (syskeyreset && ntpw_len > 16) { ntpw_len = 16; lmpw_len = 16; ntpw_offs -= 4; *(vp+0xa8) = (unsigned int)(ntpw_offs - 0xcc); *(vp + 0xa0) = 16; *(vp + 0xac) = 16; } for (i = 0; i < 16; i++) { *(vp+ntpw_offs+i) = (unsigned char)despw[i]; if (lmpw_len >= 16) *(vp+lmpw_offs+i) = (unsigned char)newlandes[i]; } printf("Password changed!\n"); } /* new password */ else if (pl == 1 && *newp == '1') { /* Setting hash lengths to zero seems to make NT think it is blank * However, since we cant cut the previous hash bytes out of the V value * due to missing resize-support of values, it may leak about 40 bytes * each time we do this. */ v->ntpw_len = 0; v->lmpw_len = 0; printf("Password cleared!\n"); } #if 0 hexprnt("Pw in buffer: ",(vp+ntpw_offs),16); hexprnt("Lm in buffer: ",(vp+lmpw_offs),16); #endif dirty = 1; return(username); } /* Registry edit wrapper */ void mainloop(void) { regedit_interactive(hive, no_hives); } /* List users in SAM file * pageit - hmm.. forgot this one for this release.. */ int list_users(int pageit) { char s[200]; struct keyval *v; int nkofs /* ,vkofs */ ; int rid; int count = 0, countri = 0; struct ex_data ex; if (H_SAM < 0) return(1); nkofs = trav_path(hive[H_SAM], 0,"\\SAM\\Domains\\Account\\Users\\Names\\",0); if (!nkofs) { printf("list_users: Cannot find usernames in registry! (is this a SAM-hive?)\n"); return(1); } printf("| RID -|---------- Username ------------| Admin? |- Lock? --|\n"); while ((ex_next_n(hive[H_SAM], nkofs+4, &count, &countri, &ex) > 0)) { /* Extract the value out of the username-key, value is RID */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\Names\\%s\\@",ex.name); rid = get_dword(hive[H_SAM], 0, s, TPF_VK_EXACT|TPF_VK_SHORT); if (rid == 500) strncpy(admuser,ex.name,128); /* Copy out admin-name */ /* Now that we have the RID, build the path to, and get the V-value */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\%08X\\V",rid); v = get_val2buf(hive[H_SAM], NULL, 0, s, REG_BINARY, TPF_VK_EXACT); if (!v) { printf("Cannot find value <%s>\n",s); return(1); } if (v->len < 0xcc) { printf("list_users: Value <%s> is too short (only %d bytes) to be a SAM user V-struct!\n", s, v->len); } else { change_pw( (char *)&v->data , rid, v->len, 1); } FREE(v); FREE(ex.name); } return(0); } /* Find a username in the SAM registry, then get it's V-value, * and feed it to the password changer. */ void find_n_change(char *username) { char s[200]; struct keyval *v; int rid = 0; if ((H_SAM < 0) || (!username)) return; if (*username == '0' && *(username+1) == 'x') sscanf(username,"%i",&rid); if (!rid) { /* Look up username */ /* Extract the unnamed value out of the username-key, value is RID */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\Names\\%s\\@",username); rid = get_dword(hive[H_SAM],0,s, TPF_VK_EXACT|TPF_VK_SHORT); if (rid == -1) { printf("Cannot find value <%s>\n",s); return; } } /* printf("Username: %s, RID = %d (0x%0x)\n",username,rid,rid); */ /* Now that we have the RID, build the path to, and get the V-value */ snprintf(s,180,"\\SAM\\Domains\\Account\\Users\\%08X\\V",rid); v = get_val2buf(hive[H_SAM], NULL, 0, s, REG_BINARY, TPF_VK_EXACT); if (!v) { printf("Cannot find value <%s>\n",s); return; } if (v->len < 0xcc) { printf("Value <%s> is too short (only %d bytes) to be a SAM user V-struct!\n", s, v->len); } else { change_pw( (char *)&v->data , rid, v->len, 0); if (dirty) { if (!(put_buf2val(hive[H_SAM], v, 0, s, REG_BINARY, TPF_VK_EXACT))) { printf("Failed to write updated <%s> to registry! Password change not completed!\n",s); } } } FREE(v); } /* Check for presence of syskey and possibly disable it if * user wants it. * This is tricky, and extremely undocumented! * See docs for more info on what's going on when syskey is installed */ #undef LSADATA void handle_syskey(void) { /* This is \SAM\Domains\Account\F */ struct samkeyf { char unknown[0x50]; /* 0x0000 - Unknown. May be machine SID */ char unknown2[0x14]; char syskeymode; /* 0x0064 - Type/mode of syskey in use */ char syskeyflags1[0xb]; /* 0x0065 - More flags/settings */ char syskeyobf[0x30]; /* 0x0070 - This may very well be the obfuscated syskey */ }; /* There may be more, usually 8 null-bytes? */ /* Security\Policy\SecretEncryptionKey\@, only on NT5 */ /* Probably contains some keyinfo for syskey. Second DWORD seems to be syskeymode */ struct secpoldata { int unknown1; /* Some kind of flag? usually 1 */ int syskeymode; /* Is this what we're looking for? */ int unknown2; /* Usually 0? */ char keydata[0x40]; /* Some kind of scrambled keydata? */ }; #ifdef LSADATA /* SYSTEM\CurrentControlSet\Control\Lsa\Data, only on NT5?? */ /* Probably contains some keyinfo for syskey. Byte 0x34 seems to be mode */ struct lsadata { char keydata[0x34]; /* Key information */ int syskeymode; /* Is this what we're looking for? */ }; #endif /* void *fdata; */ struct samkeyf *ff = NULL; struct secpoldata *sf = NULL; /* struct lsadata *ld = NULL; */ int /* len, */ i,secboot, samfmode, secmode /* , ldmode */ ; struct keyval *samf, *secpol /* , *lsad */ ; char *syskeytypes[4] = { "off", "key-in-registry", "enter-passphrase", "key-on-floppy" }; char yn[5]; printf("\n---------------------> SYSKEY CHECK <-----------------------\n"); if (H_SAM < 0) { printf("ERROR: SAM hive not loaded!\n"); return; } samf = get_val2buf(hive[H_SAM], NULL, 0, "\\SAM\\Domains\\Account\\F", REG_BINARY, TPF_VK_EXACT); if (samf && samf->len > 0x70 ) { ff = (struct samkeyf *)&samf->data; samfmode = ff->syskeymode; } else { samfmode = -1; } secboot = -1; if (H_SYS >= 0) { secboot = get_dword(hive[H_SYS], 0, "\\ControlSet001\\Control\\Lsa\\SecureBoot", TPF_VK_EXACT ); } secmode = -1; if (H_SEC >=0) { secpol = get_val2buf(hive[H_SEC], NULL, 0, "\\Policy\\PolSecretEncryptionKey\\@", REG_NONE, TPF_VK_EXACT); if (secpol) { /* Will not be found in NT 4, take care of that */ sf = (struct secpoldata *)&secpol->data; secmode = sf->syskeymode; } } #ifdef LSADATA lsad = get_val2buf(hive[H_SYS], NULL, 0, "\\ControlSet001\\Control\\Lsa\\Data\\Pattern", REG_BINARY, TPF_VK_EXACT); if (lsad && lsad->len >= 0x38) { ld = (struct lsadata *)&lsad->data; ldmode = ld->syskeymode; } else { ldmode = -1; } #endif printf("SYSTEM SecureBoot : %d -> %s\n", secboot, (secboot < 0 || secboot > 3) ? "Not Set (not installed, good!)" : syskeytypes[secboot]); printf("SAM Account\\F : %d -> %s\n", samfmode, (samfmode < 0 || samfmode > 3) ? "Not Set" : syskeytypes[samfmode]); printf("SECURITY PolSecretEncryptionKey: %d -> %s\n", secmode, (secmode < 0 || secmode > 3) ? "Not Set (OK if this is NT4)" : syskeytypes[secmode]); #ifdef LSADATA printf("SYSTEM LsaData : %d -> %s\n\n", ldmode, (ldmode < 0 || ldmode > 3) ? "Not Set (strange?)" : syskeytypes[ldmode]); #endif if (secboot != samfmode && secboot != -1) { printf("WARNING: Mismatch in syskey settings in SAM and SYSTEM!\n"); printf("WARNING: It may be dangerous to continue (however, resetting syskey\n"); printf(" may very well fix the problem)\n"); } if (secboot > 0 || samfmode > 0) { printf("\n***************** SYSKEY IS ENABLED! **************\n"); printf("This installation very likely has the syskey passwordhash-obfuscator installed\n"); printf("It's currently in mode = %d, %s-mode\n",secboot, (secboot < 0 || secboot > 3) ? "Unknown" : syskeytypes[secboot]); if (no_hives < 2) { printf("\nSYSTEM (and possibly SECURITY) hives not loaded, unable to disable syskey!\n"); printf("Please start the program with at least SAM & SYSTEM-hive filenames as arguments!\n\n"); return; } printf("SYSKEY is on! However, DO NOT DISABLE IT UNLESS YOU HAVE TO!\n"); printf("This program can change passwords even if syskey is on, however\n"); printf("if you have lost the key-floppy or passphrase you can turn it off,\n"); printf("but please read the docs first!!!\n"); printf("\n** IF YOU DON'T KNOW WHAT SYSKEY IS YOU DO NOT NEED TO SWITCH IT OFF!**\n"); printf("NOTE: On WINDOWS 2000 and XP it will not be possible\n"); printf("to turn it on again! (and other problems may also show..)\n\n"); printf("NOTE: Disabling syskey will invalidate ALL\n"); printf("passwords, requiring them to be reset. You should at least reset the\n"); printf("administrator password using this program, then the rest ought to be\n"); printf("done from NT.\n"); printf("\nEXTREME WARNING: Do not try this on Vista or Win 7, it will go into endless re-boots\n\n"); fmyinput("\nDo you really wish to disable SYSKEY? (y/n) [n] ",yn,2); if (*yn == 'y') { /* Reset SAM syskey infostruct, fill with zeroes */ if (ff) { ff->syskeymode = 0; for (i = 0; i < 0x3b; i++) { ff->syskeyflags1[i] = 0; } put_buf2val(hive[H_SAM], samf, 0, "\\SAM\\Domains\\Account\\F", REG_BINARY, TPF_VK_EXACT); } /* Reset SECURITY infostruct (if any) */ if (sf) { memset(sf, 0, secpol->len); sf->syskeymode = 0; put_buf2val(hive[H_SEC], secpol, 0, "\\Policy\\PolSecretEncryptionKey\\@", REG_BINARY, TPF_VK_EXACT); } #if LSADATA if (ld) { ld->syskeymode = 0; put_buf2val(hive[H_SYS], lsad, 0, "\\ControlSet001\\Control\\Lsa\\Data\\Pattern", REG_BINARY, TPF_VK_EXACT); } #endif /* And SYSTEM SecureBoot parameter */ put_dword(hive[H_SYS], 0, "\\ControlSet001\\Control\\Lsa\\SecureBoot", TPF_VK_EXACT, 0); dirty = 1; syskeyreset = 1; printf("Updating passwordhash-lengths..\n"); list_users(1); printf("* SYSKEY RESET!\nNow please set new administrator password!\n"); } else { syskeyreset = 1; } } else { printf("Syskey not installed!\n"); return; } } /* Interactive user edit */ void useredit(void) { char iwho[100]; int il; printf("\n\n===== chntpw Edit User Info & Passwords ====\n\n"); if (H_SAM < 0) { printf("ERROR: SAM registry file (which contains user data) is not loaded!\n\n"); return; } list_users(1); while (1) { printf("\nSelect: ! - quit, . - list users, 0x - User with RID (hex)\n"); printf("or simply enter the username to change: [%s] ",admuser); il = fmyinput("",iwho,32); if (il == 1 && *iwho == '.') { printf("\n"); list_users(1); continue; } if (il == 1 && *iwho == '!') return; if (il == 0) strcpy(iwho,admuser); find_n_change(iwho); } } void recoveryconsole() { int cmd = 0; int sec = 0; static char *scpath = "\\Microsoft\\Windows NT\\CurrentVersion\\Setup\\RecoveryConsole\\SetCommand"; static char *slpath = "\\Microsoft\\Windows NT\\CurrentVersion\\Setup\\RecoveryConsole\\SecurityLevel"; char yn[5]; if (H_SOF < 0) { printf("\nSOFTWARE-hive not loaded, and there's where RecoveryConsole settings are..\n"); return; } cmd = get_dword(hive[H_SOF],0,scpath,TPF_VK_EXACT); sec = get_dword(hive[H_SOF],0,slpath,TPF_VK_EXACT); if (cmd == -1 && sec == -1) { printf("\nDid not find registry entries for RecoveryConsole.\n(RecoveryConsole is only in Windows 2000 and XP)\n"); return; } printf("\nRecoveryConsole:\n- Extended SET command is \t%s\n", cmd>0 ? "ENABLED (1)" : "DISABLED (0)"); printf("- Administrator password login: %s\n", sec>0 ? "SKIPPED (1)" : "ENFORCED (0)"); fmyinput("\nDo you want to change it? (y/n) [n] ",yn,2); if (*yn == 'y') { cmd ^= 1; sec ^= 1; if (!put_dword(hive[0], 0, scpath, TPF_VK_EXACT, cmd)) printf("Update of SET level failed registry edit\n"); if (!put_dword(hive[0], 0, slpath, TPF_VK_EXACT, sec)) printf("Update of login level failed registry edit\n"); printf("Done!\n"); } } /* Interactive menu system */ void interactive(void) { int il; char inbuf[20]; while(1) { printf("\n\n<>========<> chntpw Main Interactive Menu <>========<>\n\n" "Loaded hives:"); for (il = 0; il < no_hives; il++) { printf(" <%s>",hive[il]->filename); } printf("\n\n"); /* Make menu selection depending on what is loaded but it is still possible to select even if not shown */ if (H_SAM >= 0) printf(" 1 - Edit user data and passwords\n"); #if 0 if (H_SAM >= 0 && H_SYS >= 0 && H_SEC >= 0) { printf(" 2 - Syskey status & change\n"); } #endif if (H_SOF >= 0) { printf(" 3 - RecoveryConsole settings\n"); printf(" 4 - Show product key (DigitalProductID)\n"); } printf(" - - -\n" " 9 - Registry editor, now with full write support!\n" " q - Quit (you will be asked if there is something to save)\n" "\n\n"); il = fmyinput("What to do? [1] -> ", inbuf, 10); if (!il) useredit(); if (il) { switch(inbuf[0]) { case '1': useredit(); break; case '2': handle_syskey(); break; case '3': recoveryconsole(); break; case '4': cat_dpi(hive[H_SOF],0,"\\Microsoft\\Windows NT\\CurrentVersion\\DigitalProductId"); break; case '9': mainloop(); break; case 'q': return; break; } } } } void usage(void) { printf("chntpw: change password of a user in a Windows SAM file,\n" "or invoke registry editor. Should handle both 32 and 64 bit windows and\n" "all version from NT3.x to Win7\n" "chntpw [OPTIONS] [systemfile] [securityfile] [otherreghive] [...]\n" " -h This message\n" " -u Username to change, Administrator is default\n" " -l list all users in SAM file\n" " -i Interactive. List users (as -l) then ask for username to change\n" " -e Registry editor. Now with full write support!\n" " -d Enter buffer debugger instead (hex editor), \n" " -v Be a little more verbose (for debuging)\n" " -L For scripts, write names of changed files to /tmp/changed\n" " -N No allocation mode. Only same length overwrites possible (very safe mode)\n" " -E No expand mode, do not expand hive file (safe mode)\n" "See readme file on how to get to the registry files, and what they are.\n" "Source/binary freely distributable under GPL v2 license. See README for details.\n" "NOTE: This program is somewhat hackish! You are on your own!\n" ); } int main(int argc, char **argv) { int dodebug = 0, list = 2, inter = 0,edit = 0,il,d = 0, dd = 0, logchange = 0, mode = 0; extern int /* opterr, */ optind; extern char* optarg; char *filename,c; char *who = "Administrator"; char iwho[100]; FILE *ch; /* Write out names of touched files to this */ char *options = "LENidehlvu:"; printf("%s\n",chntpw_version); while((c=getopt(argc,argv,options)) > 0) { switch(c) { case 'd': dodebug = 1; break; case 'e': edit = 1; break; case 'L': logchange = 1; break; case 'N': mode |= HMODE_NOALLOC; break; case 'E': mode |= HMODE_NOEXPAND; break; case 'l': list = 1; who = 0; break; case 'v': mode |= HMODE_VERBOSE; gverbose = 1; break; case 'i': list = 2; who = 0; inter = 1; break; case 'u': who = optarg; list = 2; break; case 'h': usage(); exit(0); break; default: usage(); exit(1); break; } } filename=argv[optind]; if (!filename || !*filename) { usage(); exit(1); } do { if (!(hive[no_hives] = openHive(filename, HMODE_RW|mode))) { printf("Unable to open/read a hive, exiting..\n"); exit(1); } switch(hive[no_hives]->type) { case HTYPE_SAM: H_SAM = no_hives; break; case HTYPE_SOFTWARE: H_SOF = no_hives; break; case HTYPE_SYSTEM: H_SYS = no_hives; break; case HTYPE_SECURITY: H_SEC = no_hives; break; } no_hives++; filename = argv[optind+no_hives]; } while (filename && *filename && no_hives < MAX_HIVES); if (dodebug) debugit(hive[0]->buffer,hive[0]->size); else { check_get_samdata(); if (list && !edit && !inter) { if ( list_users(1) ) edit = 1; } if (edit) mainloop(); else if (who) { handle_syskey(); find_n_change(who); } if (inter) interactive(); } if (list != 1) { printf("\nHives that have changed:\n # Name\n"); for (il = 0; il < no_hives; il++) { if (hive[il]->state & HMODE_DIRTY) { if (!logchange) printf("%2d <%s>",il,hive[il]->filename); if (hive[il]->state & HMODE_DIDEXPAND) printf(" WARNING: File was expanded! Expermental! Use at own risk!\n"); printf("\n"); d = 1; } } if (d) { /* Only prompt user if logging of changed files has not been set */ /* Thus we assume confirmations are done externally if they ask for a list of changes */ if (!logchange) fmyinput("Write hive files? (y/n) [n] : ",iwho,3); if (*iwho == 'y' || logchange) { if (logchange) { ch = fopen("/tmp/changed","w"); } for (il = 0; il < no_hives; il++) { if (hive[il]->state & HMODE_DIRTY) { printf("%2d <%s> - ",il,hive[il]->filename); if (!writeHive(hive[il])) { printf("OK"); if (hive[il]->state & HMODE_DIDEXPAND) printf(" WARNING: File was expanded! Expermental! Use at own risk!\n"); printf("\n"); if (logchange) fprintf(ch,"%s ",hive[il]->filename); dd = 2; } } } if (logchange) { fprintf(ch,"\n"); fclose(ch); } } else { printf("Not written!\n\n"); } } else { printf("None!\n\n"); } } /* list only check */ return(dd); } chntpw_0.99.6.110511/sam.h0000644000175000017500000001612711562562244013030 0ustar jfsjfs/* * sam.h - known structures in the SAM hive of NT registry * ***** * * NTREG - Window registry file reader / writer library * Copyright (c) 1997-2011 Petter Nordahl-Hagen. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; * version 2.1 of the License. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * See file LGPL.txt for the full license. * */ #ifndef _INCLUDE_SAM_H #define _INCLUDE_SAM_H 1 #include #include /* This contains some policy settings for the account database */ #define ACCOUNTDB_F_PATH "\\SAM\\Domains\\Account\\F" struct accountdb_F { char unknown1[8]; /* 0 */ char unknown2[8]; /* 8 */ uint32_t updatecnt; /* 10 Number of times policy data updated */ char unknown3[4]; /* 14 */ char t_maxpwage[8]; /* 18 Maximum password age, GUI shows only days */ char t_minpwage[8]; /* 20 Minimum password age, GUI shows only days */ char unknown4[8]; /* 28 */ char t_lockdur[8]; /* 30 Account lockout duration, GUI shows minutes */ char t_lockrel[8]; /* 38 Release account lockout after, GUI show minutes */ char unknown5[8]; /* 40 */ uint32_t rid; /* 48 RID of user doing last edit? */ uint32_t flags; /* 4c Some flags & options, see below */ unsigned short minpwlen; /* 50 Minimum password lenght */ unsigned short numhist; /* 52 How many passwords to keep in history */ unsigned short locklimit; /*54 How many tries before lockout */ char unknown6[0x9a]; /* Rest is unknown */ }; /* Total size 0xF0 bytes, seems to be constant */ /* Known bits in flags field */ #define ACF_COMPLEX 0x0001 /* Pass must meet complexity req. */ #define ACF_REVERSIBLE 0x0010 /* Store password using reversible encryption */ /* This is users F value, contains account type & state etc */ #define USER_F_PATH "\\SAM\\Domains\\Account\\Users\\%08X\\F" struct user_F { char unknown1[8]; char t_lockout[8]; /* Time of lockout */ char unknown2[8]; char t_creation[8]; /* Time of account creation */ char unknown3[8]; char t_login[8]; /* Time of last login */ int32_t rid; char unknown4[4]; unsigned short ACB_bits; /* Account type and status flags */ char unknown5[6]; unsigned short failedcnt; /* Count of failed logins, if > than policy it is locked */ unsigned short logins; /* Total logins since creation */ char unknown6 [0xc]; }; #define ACB_DISABLED 0x0001 /* Act disabled */ #define ACB_HOMDIRREQ 0x0002 /* Home directory required */ #define ACB_PWNOTREQ 0x0004 /* User password not req */ #define ACB_TEMPDUP 0x0008 /* Temporary duplicate account?? */ #define ACB_NORMAL 0x0010 /* Normal user account */ #define ACB_MNS 0x0020 /* MNS logon user account */ #define ACB_DOMTRUST 0x0040 /* Interdomain trust account */ #define ACB_WSTRUST 0x0080 /* Workstation trust account */ #define ACB_SVRTRUST 0x0100 /* Server trust account */ #define ACB_PWNOEXP 0x0200 /* User password does not expire */ /* Seems not to be used on failed console logins at least */ #define ACB_AUTOLOCK 0x0400 /* Account auto locked */ char *acb_fields[16] = { "Disabled" , "Homedir req." , "Passwd not req." , "Temp. duplicate" , "Normal account" , "NMS account" , "Domain trust act." , "Wks trust act." , "Srv trust act" , "Pwd don't expire" , "Auto lockout" , "(unknown 0x08)" , "(unknown 0x10)" , "(unknown 0x20)" , "(unknown 0x40)" , "(unknown 0x80)" , }; /* Users V data struct */ /* First 0xCC bytes is pointer & len table, rest is data which * the table points to * String data is unicode, not zero terminated (must use len) */ struct user_V { int unknown1_1; /* 0x00 - always zero? */ int unknown1_2; /* 0x04 - points to username? */ int unknown1_3; /* 0x08 - always 0x02 0x00 0x01 0x00 ? */ int username_ofs; /* 0x0c */ int username_len; /* 0x10 */ int unknown2_1; /* 0x14 - always zero? */ int fullname_ofs; /* 0x18 */ int fullname_len; /* 0x1c */ int unknown3_1; /* 0x20 - always zero? */ int comment_ofs; /* 0x24 */ int comment_len; /* 0x28 */ int unknown4_1; /* 0x2c - alway zero? */ int unknown4_2; /* 0x30 - points 4 or 8 byte field before hashes */ int unknown4_3; /* 0x34 - zero? or size? */ int unknown4_4; /* 0x38 - zero? */ int unknown4_5; /* 0x3c - to field 8 bytes before hashes */ int unknown4_6; /* 0x40 - zero? or size of above? */ int unknown4_7; /* 0x44 - zero? */ int homedir_ofs; /* 0x48 */ int homedir_len; /* 0x4c */ int unknown5_1; /* 0x50 - zero? */ int drvletter_ofs; /* 0x54 - drive letter for home dir */ int drvletter_len; /* 0x58 - len of above, usually 4 */ int unknown6_1; /* 0x5c - zero? */ int logonscr_ofs; /* 0x60 - users logon script path */ int logonscr_len; /* 0x64 - length of string */ int unknown7_1; /* 0x68 - zero? */ int profilep_ofs; /* 0x6c - profile path string */ int profilep_len; /* 0x70 - profile path stringlen */ char unknown7[0x90-0x74]; /* 0x74 */ int unknown8_1; /* 0x90 - pointer to some place before hashes, after comments */ int unknown8_2; /* 0x94 - size of above? */ int unknown8_3; /* 0x98 - unknown? always 1? */ int lmpw_ofs; /* 0x9c */ int lmpw_len; /* 0xa0 */ int unknown9_1; /* 0xa4 - zero? */ int ntpw_ofs; /* 0xa8 */ int ntpw_len; /* 0xac */ int unknowna_1; /* 0xb0 */ int unknowna_2; /* 0xb4 - points to field after hashes */ int unknowna_3; /* 0xb8 - size of above field */ int unknowna_4; /* 0xbc - zero? */ int unknowna_5; /* 0xc0 - points to field after that */ int unknowna_6; /* 0xc4 - size of above */ int unknowna_7; /* 0xc8 - zero ? */ char data[4]; /* Data starts here. All pointers above is relative to this, that is V + 0xCC */ }; /* Groups C data struct * First 0x34 bytes is pointer & len table, rest is data which * the table points to * String data is unicode, not zero terminated (must use len) */ struct group_C { int groupid; /* 0x00 - Seems to be the group ID */ int unknown1_1; /* 0x04 - always zero? */ int unknown1_2; /* 0x08 - points to groupname? */ int unknown1_3; /* 0x0c - always 0x02 0x00 0x01 0x00 ? */ int grpname_ofs; /* 0x10 */ int grpname_len; /* 0x14 */ int unknown2_1; /* 0x18 - always zero? */ int fullname_ofs; /* 0x1c */ int fullname_len; /* 0x20 */ int unknown3_1; /* 0x24 - always zero? */ int unknown3_2; /* 0x28 - always zero? */ int unknown3_3; /* 0x2c - always zero? */ int grp_members; /* 0x30 - number of group members */ /* 0x34 - data starts here. pointers above are offset from this */ char data[]; }; #endif chntpw_0.99.6.110511/chntpw.static0000755000175000017500000270462011562562244014622 0ustar jfsjfsELF40 4 (C! C! D! DDbԀԀ D! DD(QtdGNU *US[Ì t~蛈 'LX[%h1^PTRhh QVh$US=uTh`9s`9r踠 t $\;[]ÍU tD$$\=?ltt $lUS$E EE E}~E"E] EE$*EE;E|փ$[]U(EE E PEE ȈE PEE ȈE PEE ȈE PEE ȈE PEE ȈE PE?E ȈE UEEE UU ҈E}~E $BU(EEEEEEEEEEEEEEE D$E$^U(EEEEEEEEEEEEEEE D$E$UpD$E$xD$p$UE D$ xL$T$$vU8  FD$D$D$ D$D$$]E}u$ Xq$ XEEE@T00 T$$#GE@Pи0 T$$GE@PиX T$$FUVS y  UT$ D$D$ $F FD$D$ T$ D$D$$\E}u!  T$$IFEG8E T$$F}tE$"EEEE@8fE} U T$$EEsEUE։t# % ' \$D$$EMVUUU)‰Љ)ƒu $ [E}~ 0E@@и8 L$T$$#EE@Bиi T$$E} unfMfefeEUfP8Ef@@ FD$D$ T$ D$UT$$N$ UE@@ftE@@С09|E E% E Ё[^]UhEEEEE}t y  UT$ D$D$$D FD$ T$D$$NEȃ}u* t T$${C|E FD$ D$ UȉT$$WE܃}u! T$$"C#} u. U܉T$$B FD$ D$ UȉT$$WE tL UT$$BE;Et $d S FD$D$D$ UȉT$D$$XẼ}u$ |SMẼEE)EE؋E} u UT$$B} uE}  UT$ D$D$8$A FD$D$8T$ D$D$$WEЃ}tbEЃEԋEԋ@4EEԋ@EUԋE‹ED$D$$&EԋP0 T$T$$A= UT$$AEE;EEUEEEDž<Dž@ E} y UT$ D$D$ $@ FD$ T$D$$KEԃ}u[  T$$/@E FD$ D$ UԉT$$kTE}ur  T$$? UT$$? FD$ D$ UԉT$$]TEE;Et UT$$u?$ P FD$D$D$ UԉT$D$$cUE؃}u$ IP1 $?E؃EENEEE UT$$>E=!t="t%= u-M $>+_ $>h $> r $~> UT$ D$D$D$> FD$D$DT$ D$D$$OTE܃}tUE܃EE0 FD$D$DT$ D$U܉T$$ly= UT$$=EE;E$u N FD$ D$ UԉT$$+_$ N FD$ D$ UԉT$$Zu $ JN FD$D$D$ UԉT$E@ȋE‹E@8)É؉+U L$T$$E@ȋE‹E@8)Ɖ+U L$T$$E‹E@8)ȉ+U T$$EEUD$5$EE@;E$  [^]UVS U T$$EE@8‹E EE@ȋE‹E@8)É؉+U L$T$$ E@E‹E@8)Ɖ+U  L$T$$ E@E‹E@8)É؉+U 4 L$T$$ EX EH E ‹E@8)Ɖ+U X \$ L$T$$J EXEHE‹E@8)Ɖ+U \$ L$T$$ $ 0 [^]UWVSL U T$$ E@8‹E EE@ȋE‹E@8)É؉+U L$T$$ EUED EЋUEDPUED UED؋UEDEԋEE‹E@8)ȉ+M EЉD$|$t$\$]ԉ\$ ED$L$$ EE@;EG$ L[^_]UVS0 U T$$ E@8‹E EE@ȋE‹E@8)É؉+U L$T$$U E]UELUEDEE‹E@8)Ɖ+U 4 L$\$ ML$T$$ EE@;E$ 0[^]US$c U T$$ E@8‹E EE@ȋE‹E@8)É؉+U L$T$$k EOUEDEE‹E@8)É؉+U x L$ ML$T$$ EE@;E$ *$[]US$ U T$$ E@8‹E EE@ȋE‹E@8)É؉+U L$T$$ EOUEDEE‹E@8)É؉+U x L$ ML$T$$< EE@;E$ O$[]US$ U T$$E@8‹E EE@ȋE‹E@8)É؉+U L$T$$E@E‹E@8)É؉+U  L$T$${$ $[]U8EP8E $E}u.$( jEP$E@8T$$B[}y^]E@UEPE@PEP}EU t UT$UT$ L$U T$$XE@ UEP E@PEP}t2EU  UT$UT$ L$U T$$_E EP8E fE@8U ffE}^E=il=il&=fl=hl=bd=ir=ir =knt=ks=kvt#ED$E D$E$ED$E D$E$ED$E D$E$_ED$E D$E$xED$E D$E$P]ED$E D$E$BED$E D$E$'ED$E D$E$ $ EU(EeEEE@8‹EEE=hbintKE@u UT$$d&E@EE;E ~EE@$;EU(E EE@8‹E EEP8E$QE}uM$( t UT$$E U)‹E@9u$ >f}y] E;E|E!EEE U)‹E@9bU(E tE ƒ)E EyE@8‹EEE=hbintiE@u UT$$DE D$ED$E$E}tEE@EE@0;ExUHE@t)E L$T$$OE $%EE@0E츄 UT$UT$ U T$U T$$0EH$EP$ L$T$$ UT$UT$$E@$+ME@$+U L$T$$EU‹E@$9|rEU%E( UT$UT$$UE@8T$$‹EP8E@8u$L 3EUP$E@8‹EEED$E$REhbinE썐EPEUPEPEP E@8EEUEP(EH(EP(d L$T$$E@ƒ$EPEUP,EU‹EP0E U8EEE@t E T$$O&EEtEƒ)E} t1E D$E$REED$ED$E$E}uED$E$kE}[EP8E$ EEU)ȉE}u EEEtEEEƒ)E}u EEE@8‹EUډE@PEPE@PEPE@UEPE@ +UEP }tZEUEE@8‹E‹EE@PEPE@PEPE@PEPE@ PEP EUR8MʉD$$E@ƒEPEO UT$$ZED$E$E}tED$ED$E$UHE@t E@ T$$EP8E $+E}x=$  U T$$EP$E@8T$$P]E D$E$Eԃ}u lE@8‹EԍEEԃ EEE;E hEP8E؍$zE܃}u.$ @EP$E@8T$$}y]܋E؉EEE؋E;E tEԋU)‹E@9|E;E tK$$ \ U T$ UԉT$U؉T$$EP$E@8T$$)EP8E$EEU EEEԋU)‹E@9}EP8E$nE}~3EEE@PEPE@PEPE@ PEP EUJ8U D$$E@8‹E ‹EE@+UEPE@ +UEP E@PEPE@ƒEP}~iE@+UEPE@ UEP EEEUJ8UD$$UE@8‹E‹EE@PEPEEU8} u E@8‹E EEf=nkt| U T$$FEP8E@EEP8E@EEf=riExEE@9| EH8EEDEEf=liuEEDE1EH8EEDEEEDEEE@9EPEEsE@~EE@9| !Ef=liu-EP8E@EEEDEEEDEEUE@8UЉEEUPEf=nkt UT$$E@Hf UT$$QE@ t"E@HULD$$kUB E@HULD$$E8UBEPEU8} u E@8‹E EEf=nkt U T$$E@$~EE@$9| fE@(EE@8‹EEEEEE@8‹EEEf=vkt  UT$$EUPEUE@E@EP E@f~SE@t"E@UD$$UB4E@UD$$6UB$r PUBEP EPE@ t!E@ uE@y EPEPEPEEE@$9U(E=~EE@8‹E EEf=nkt$d qnE@f,uE$QED$D$$-E@ tE@HULD$$EE@HULD$$5EE$WEE$IUE9r@E$> EL$ T$D$E$E$E\EUD$ED$$E$E+EEEL$T$$"E@ED$ ED$T$E$DU8EE$_EE@8‹E EEEEEE@8‹EEE@fuE<@u }uEzE%t E@;EuME@;E|AEUD$T$E$xu!E@;EuE"}u EEEE;EDEU}u E@8E} u E@(E E@u'E<\uE<\tEE@(E UE EEf=nkt$ uwE@vEE7EE<\uEăE<\uEEEEEEEEtEE<\uEăE<\tEEE<\Eԃ}u E }uQEtDE<.u:E%u.UċEԍEUT$ D$E D$E$otE%uu}uoD$ED$$ {uPE@EUċEԍUE@f,uE EML$ T$D$E$EAu-EEEE@$E@t=ED$$!D$$>EċEčEE@(EЋUEЍEE@$UT$T$ D$EЉD$E$+Eȃ}tEEE@EE@E̋UE̍EEf=riunEEE@EEEH8U؋EDEE@EEf=liteEH8U؋EDEEBEf=liuUE̍EEEEEE@EU荅)D$T$$ 1E썅$aEED}tUȋEDEUȋEDEUEEEf=nkt$ E@Hf$ eE@H;E| E%t!E@H;EE%E@ t$EULD$T$$8E"ULD$T$E$E}u9E$PUċEԍEUT$ D$ED$E$EE;EE}tbE;E}ZU؋EDEE@8UЉEE@EEf=lit"EH8U؋EDEEE;E} }&E$UVS`EED$ E D$ED$E$E}u U T$$nEE@8‹EEE@%t UT$$1Ef=nkt$$ IEP$E@8T$$!EH$EP0 L$T$$E@JftE@JиR T$$$ ]E@$o E@%u2ME@Jft* z L$D$$O7]E@Jft* M亃 \$ D$L$$EtE$EED$EĉD$ EȉD$ED$E$@EE@$"$ E@%tD]Eԃ  Eԋb M؋U̍r \$D$ L$t$$W8]Eԃ  Eԋb Mغ \$ D$L$$Eԃu1u܋]܋E$)¸ t$ \$T$$$ EtE$EẺD$ EȉD$ED$E$>`[^]U(ED$ ED$E D$E$E}uEE@8‹EEE@ U(ED$ ED$E D$E$CE}uFEE@8‹EEE@%EE@=uE%tEEU(ED$ ED$E D$E$E}u UT$$s.EE@8‹EEE@u{E@=uE%tE Z}t.E@ t$E@ ;Et, UT$$E@yEEP8E@UhED$ ED$ED$E$kEă}u "} tE ;E} ED$ED$ ED$ED$E$E} tE E3EăD$$'E}u$  EUĉ}?WEEEf=dbtE@E̋E@EиP UЉT$ỦT$$EEĉEEE@8UыUЍЉ$EԋEP8Eԍ$)ȉE؋UE9~ЉE฀ U؉T$U؉T$ UԉT$UȉT$$ UT$ UT$U܉T$$EPE܍EEUR8MԃʉD$T$E$/EE܋E)EEE;E.}t(}t"}tEċUD$ED$$EU8ED$D$ED$ E D$D$E$jE}u$E@E}tE$EEU(EP8E $:E]E;E}? UT$ UT$U T$$EP$E@8T$$XEUR8M ʉD$ED$$UHE@8‹E E؋E؋@E}e}?8EP8E؋@E܋Ef=dbtE@EE܋@E< UT$UT$$E~E@8UыUЉ$EEP8E$؉Ep UT$UT$ UT$UT$$iED$E$:EE;EvEP T$$0ED$E$E؋@ T$$}tE؋@D$E$E@E@E UHED$ ED$E D$E$Eԃ}u (EE@8‹EԍE̋EԉD$E$}}?hM7H` )ȃE  UT$ UT$UT$$D$EԉD$E$gE؋E@8U؃ЉEЋEfdbE‹EfPED$EԉD$E$#E܋E@8U؃ЉEЋE܍EЉPL U܉T$U؉T$$kElE?ED$EԉD$E$Ex UT$UT$$$E@8UыU܍ЉEEEEE;E|E؉E@ED$EԉD$E$GE"ẼUԋẺ)ȉEE E}u5E@8‹EԍẼ}xE썐ẺPE̋UPEUSDEEr }t Eu E@8‹E EEf=nkt$ :E@$UR(D$UT$ D$L$E$t UT$$3D$ E$&uEEE@$t E@(EE@$D$E D$E$E}u$ rE@8‹E E}t! T$$tES! \cT$$IE̋E@(EE؍PD$ ẺD$T$E$VEԃ}E؍PẺD$T$E$8u&X! M̉L$T$$誧E?! ỦT$$轧E؍PD$ ẺD$T$E$˲EԃEEԉEظS! D$$gẼ}"$轮E@%t $ \c Xc\c$$|E}tw}tEЉ$趃E`c$D$$uEЃ}u$  蜧w`c$kD$`cD$EЉ$Xc$2EXcU<\uXcUmXc$>XcXc$蟈EEE$u }}t! ! ! D$E D$$! UT$$ҥ! UT$$辥! UT$$誥E$诨}tE@ƒEPԜ[]UE@tE@$EtE$EE@8tE@8$E@8}tE$́EUEE@8EEEUЋ1EE}~~EUS$E@t TE@u =E@usED$$UBE@u=詄$?U" D$ \$L$$E@ƒEPE@D$D$$E@8EE$UE@$EP8E@L$T$$EE@$;Et:$脘U8" D$ \$L$$@E@ƒEP$[]UVSE %EE % ED$<$rEă}u$  ۣ趇E$WUĉE@E@$E@8E t EEEċUȉT$$UĉBEċ@т$gUċ\" D$ \$L$$#EM EċUȉT$$TUĉBEċ@yHo$Uċ" D$ \$L$$Eĉ$gEċ@lT$$t$" 蔢$UEĉP$E ƒEĉPEċ@$D$${p‹EĉP8Eċ@8u$  =Eċ@$EċP8Eċ@L$T$$$E̋Eċ@$;E~, pEЍTPP$Vs}2P$D$ P$?0 $?, 8$X, ,$,  $, $, $$- $d- $- $- ؝$- ̝$,. $P. 贝$t. 訝$. 蜝$. 萝$/ 脝$l/ x$/ l$/ `iPPP$ rPUD$T$E$謺(PPP$qPUD$T$E$PPP$qED$E$uPPP$TqPUD$ D$T$E$gPPP$ qoP%u ,P$pE؍P$pPu PUJU؉T$ D$L$E$PPP$\pEPPD$ T$D$E$toPPP$pPUD$T$E$E}t?EED$ T$D$$m}tE$tfEPPP$oEPPT$D$E$PPP$IoPUD$T$E$dPPP$oPP$ oE؃}xnE;E }fE؉EEEX$EEH$EE/ \$L$ T$UT$$芈EEEE@(EEEE8EEp$EEX$EE@tD E;Eu* '0 |$t$\$]؉\$ T$D$ $܇EE;E jPPP$mPUD$ D$T$E$赒E}tEEPB0 T$$[PPP$8mPUD$ D$T$E$KPPP$lPUD$T$E$ PPP$lPUD$ D$T$E$ PPP$elPEEEPPP< t PuӋEEPPP$lPEEEPPP< t PuӋEEPPP$kPUJỦT$UȉT$ D$L$E$PPP$LkEEԋPtP$KkED$EԉD$E$|KEP$E@8T$$ltE@ƒEPPX0 T$$DŽĬ[^_]ÐUWVp$$e L$l1ɉD$t$|$T$\$6WOt$w |$\{t&(xl$Xl$|$Tl$X1!1|=ht$Tl$P1!1h L$Pl$L1!1hT$L l$H1!1h|$Hl$D1!1ht$Dl$@1!1hL$@l$<1!1h T$< l$81!1h$|$8l$41!1h(t$4l$01!1h,l$,L$01!1h0 T$,l$(1!1h4|$(l$$1!1h8t$$l$ 1!1h<@L$ l$1!1T$1 !1l$X/yZ͉|$ ! ! l$H|$ 5yZՉt$ ! ! l$8t$  yZL$ ! ! l$(L$ yZT$ ! ! l$TT$ =yZ͉|$ ! ! l$D|$ 5yZՉt$ ! ! l$4t$  yZL$ !! l$$L$ yZT$ ! ! l$PT$ =yZ͉|$ ! ! l$@|$ 5yZՉt$ ! ! l$0t$  yZL$ ! ! l$ L$ yZT$ ! ! l$LT$ =yZ͉|$ ! ! l$<|$ 5yZՉt$ ! ! l$,t$  yZL$ ! ! l$L$ yZT$ ! ! l$XT$ /nl$8|$11׍5nl$H|$t$1΍ n1t$L$l$(1 1nl$PL$T$1=nl$0 1T$|$15nl$@1|$t$1΍ nl$ 1t$L$1эn 1L$T$l$1 1ՋT$T:n11׋T$42n11t$D nt$$L$11э.n1L$ 1t$L>n11t$,|$nT$t$11֋T$< n11ыT$ *n1|$1ʍTl$W/WOw l$\Ow D$le3up^_]'S(eD$1D$4o D$D$D$0$D$e3u([Í&+t&'WeD$ 1T$ #EgBBܺB vT2T$ e3u_ MEL$(TED$(E:UT$(E&UT$($ED$XD$@aD$dT$8|$D$D$4$T$,l$<fvCvLT$\D$PT$T$XD$,D$TT$ T$4T$T$8T$T$(D$($1eD$<1D$,T$4u D$8 D$8T$t1t tD$ e3u\$t$ |$$l$(, \t$Pt$`\$LeD$<1mq |$T|$dl$Xl$h~wǃt'ǃD$l$ |$t$$Љl$|$4$t!$D$,D$l$ |$t$ҋD$,T$4$W O<$T$4L$8gT$4L$8T$L$D$ D$HD$)D$.$ !%tꩀuO)T$4 $L$8 #T$4L$8D$,})9D$,D$@)Ѝ$D$L$ !%tꩀt7))t&$\e3l[^_]Ð))d&G$f,$D$ 6D$)D$z,$""yvG$t$\=T$PT$@D$4$D$ 6D$)U!%t驀u)謙e L$ 1ɋD$ T$$L$ e3 u3n&',t$(eD$1F\$$Gd F~D$e3u(\$$t$(,ÍFt4$\t&<\$0葯c t$41eD$,1|$8tNt$4$it$$`9t*xtG|$$:FF~ T$,e3u*\$0t$4|$8<ÐFto4$2f,\$ Ѯ,c |$(1eD$1t$$u'T$e3\$ t$$|$(,Ít&|$6<$hD$ &t$D$$vjt-D$ +t$D$$Hjtv|$1$\gt빍Kt&'L\$<׏&\D$dT$h\$LiZ D$D$pT$eT$<1҉|$T|$`l$Xl$lt$Pt)D$Fn VF$_ F F|$ <$t_F t|$$-t@F t$$0tP tj$$fFFfMv$;2FcvF4t&HD$$2<$24$*rt&<$$l&袍fl\$\D$|=ØX $e L$L1Ƀ$t$`t$t|$d|$pl$hl$xt,D$Le3\$\t$`|$dl$hlÍ&tЅt`t$D$(D$|$($-t0hD$$.$qt&D$T$ D$l$4$K蚌USVW1ҜX5 PX111GenuŁineI Łntel t^AuthƁenti ƁcAMD u;=r-Fsu9wh`ruustwЉ_^[] 11YoV !s1ÐYSV !s#XuX s1RP1+$T$11ÜX s"D$L$ؐ1@;t11Ð11YU !s:!s ffffffff㐍D$ÍvT$L$Su[ÍUM $UT$ED$ED$ ED$E D$E$D$U]ÍvT$L$1st RuÐt IRIRuuÐUWV|$$eD$ 1L$ t$(t6tT1  9wD$ e3u7^_]Ít&tl11t&uU9rG&UWVS,l$Hݟ8T L$@eD$1T$Dv^:tJ1 t&:t?wu&$T$e3u,[^_]1t&1誈v'VS$D$8?ÚS T$0e5t$1L$4tF:u?t&:t&t u$D$L$T$e3u $[^1$t&\|$T|$`\$Lt$P1賞S eD$<1l$Xl$dt;o7T$T$,D$,$GT$,t3l$|$$mT$\$Lt$P|$Tl$X\D$T$ D$AD$h$"I[t&',t$(t$0\$$eD$1ݝ8R t4$4$D$T$e3u \$$t$(,t&L\$D葝Q t$HeD$<1D$C$ o7t$0t-@@T$\$Dt$HLÉD$,D$Ft$ D$AD$e$HD$,H&Lt$@t$P\$FF FFFFF F(F$F,F0F4l$t$$KGt 4$Ѕt*T$e3u0\$,t$0|$4l$8<Ít&l$t$$\J1nvL\$t!4$aT$e3u$[^Í1t&Kgt&'t$,&AEAMtA1t$9uߍiMut$,T$(;VsHT$ D$8$^DžL$ FD l$v\\$LD$`T8 L$ht$Pt$p|$T|$ll$Xl$dD$$L$(eD$<1ʃ);L$( D ͋L$$H ͋lHt+t!D$ $ҙD$ DŽDŽD$u<$vt2D$ D$,$l$ET$nuD$FfVvǃTD$ lD$D$$ D$ D$,e3uG<![^_]D$D$ GD$$D$b D$ O됍{7t&'\$Nl t$t$ |$|$$eD$ 1D$ e3u\$|$t$x7eD$ 1T$ e3)u6'SeD$ 1xM T$ e3%u[6&SeD$ 18MÓ T$ e3%u[h6&SeD$ 1LS T$ e3%u[(6&SL eD$ 1D$ %D$ e3u[5t&SL eD$ 1D$ %D$ e3u[5t&SDLß eD$ 1D$ %D$ e3u[d5t&SeD$ 1KS T$ e3%u[(5&SeD$ 1K T$ e3%u[4&SK eD$ 1D$ %D$ e3u[4t&SDKß eD$ 1D$ %D$ e3u[d4t&SKb eD$ 1T$ %tT$ e3u[Ðt&%4SeD$ 1J T$ e3%u[3&eD$ 1D$ @T$ e3u3t&SeD$ 18JÓ T$ e3%u[h3&SJ_ eD$ 1D$ %D$ e3u[$3t&SeD$ 1I T$ e3u[2&eD$ 1T$ e3u2t&'SeD$ 1HIã T$ e3u[v2S(Io eD$1D$4D$ D$0D$D$$0D$e3u([Ív2vS(eD$1D$8H D$ D$4D$D$0D$<$_ʧv'SgH (eD$1%tD$e3u`([Ð<ǃ%$t,D$D$$脶묍&諤)1',\$$G t$(t$0eD$1%t$$tăD$ a|$D$$ UFT$e3u\$ t$$|$(,`*L\$<A\ l$HeD$,1t$@|$D% DeD$<1t$P%tV4$>thD$%$t)T$D$ D$AD$f$1D$,l$D$$T$t$%t>D$ t$D$$ ^D$e3u\$$t$(,Ðt&%]$'<\$,:L eD$1t$0t$@|$4|$Dl$8l$H%t0l$|$4$PD$e3u"\$,t$0|$4l$8<Ð%#&'<\$,a:ü eD$1t$0t$@|$4|$Dl$8l$H%t0l$|$4$PT$e3u"\$,t$0|$4l$8<ÐK%>#&'<\$,9, eD$1t$0t$@|$4|$Dl$8l$H%t0l$|$4$P T$e3u"\$,t$0|$4l$8<Ð%"&'\\$LD$`=9Ø T$pt$PL$t|$Tt$dD$,|$heD$<1l$Xl$l%t@T$T$,L$l$ |$$t$PT$|$$ TD$ w|$D$F$ %T$e3u\$ t$$|$(,1 <\$,6, t$0|$41l$8l$@eD$1D$ %>t$D$$ %tHD$ t$D$$ T$e3u%\$,t$0|$4l$8<Ðt&%fw&S6r (eD$1D$0${D$e3u([Í&+t&',\$ 5 t$$eD$1|$(D$ D$%>t$$ %tJD$ t$D$$ uT$e3u<\$ t$$|$(,ÍH1D$$%uUt&\\$L4L t$Pl$XeD$<1|$T%=%>l$0D$ 0|$D$$ D$0D$%$tHD$ E|$D$$ T$D$8D$D$ D$$T$4B$ D$,D$8D$D$D$,$v|$41l$<ʼnt$G$ D9t$,T$81l$T$8T$D$ D$$L$4A$Ƌ$9D$,0T$,4D$8D$D$D$,$UtD$04l$<1l$4|$4ǐt$E$;t$,|T$81l$<|$4D$ T$D$$?L$HL$4&t$<$L$0D$Ht-Jt&BD$t$ |$,$D$D$4D$ыD$Ht$D$,$;t$,|T$0$SuL$Le3 \[^_]Ðt&t$,T$,D$8D$ D$$D$l맋D$8D$ D$$D$AT$8D$D$AD$jT$ $1P9'UWVS\D$t.( T$xD$0eD$L1D$pT$D$8D$D$ D$$T$4B$D$8D$D$$q|$41D$,t$G$yT$,9D$81D$ D$$D$l$,l$D$SD$(D$$p D$,T$0ED$4UT$8ED$D$ T$D$F$LgD$(t.Ff Qt&1 &S(eD$1D$4T"ï D$D$D$0$T$e3u([Í&k t&'S(D$0eT$1!N $T$T$4T$ZT$e3u([ v<\$,! |$4t$0l$8l$@eD$1D$}/>|$$DetQD$|$$&eFtU@@@ nF FT$e3u \$,t$0|$4l$8<É4$1f9 'S 2 (eD$1$T$e3u([Í& t&',|$(|$0\$ y t$$eD$1G$t\/>D$ cD$G D$F$dtRFW$L$T$ GFG F GFT$e3u\$ t$$|$(,f4$1 eD$ 1D$ @@H D$ e3u'eD$ 1D$ @@D$ e3uSDß eD$ 1|$ |~t&D$ e3u[ÍCvSB eD$ 1T$ ‰T$ e3u[UWV@D$PT$Tl$XD$D$\T$ T$`D$$D$dT$eT$<1҉D$(1tZD$ D$,~h1t&tn~9~.D$$4/T$D$ $D$D$T$}Ή9҅t41D$(u2vT$D$ D$eD$f$z1vD${čt&SXT$`@Û eD$L1|w1tRt_RT$Le3u}X[Ív&1tߍD$,D$HD$DD$DT$4D$ $(tF@밐t&D$Jp>D$ D$eD$h$1vD$[čt&SXT$``û eD$L1|w1tRt_RT$Le3u}X[Ív&1tߍD$,D$HD$DD$DT$4D$ $HtF@벍&D$*p>D$ D$eD$g$1vD$;čt&S(eD$1D$4t @D$D$0$qT$e3u([Í&vS(eD$1D$4o @D$D$0@$T$e3u([Í#vUWVSl$$$ T$0eT$\1҅D$,$M~BZv t$ z>D$BD$4D$(D$$T$D$,t6D$0T$8D$D$,T$$s9t$0T$0T$,D$0t$(/$Ct$,tT$0D$,l$T$$Ys,$聄D$(D$,D$(pk؍40l$,)l$0T$$$D$(3t$,)t$0VT$$D$P$4D$(<$S+t&t&'\|$T|$d\$LeD$<1]ø t$Pt$`l$XuJ4$u 4$t2$T$D$$lUtD$8D$8$D$D$ |$D$jUD$8D$ t$|$$NMD$,l$4$D$D$4D$.J,$D$(VD$(dt&,\$ \ eD$1D$0t$$|$(D$$VƉ$4$FT$e3u\$ t$$|$(,&'eD$ 1D$ \$t$|$0D$$cþ N @+B uz9ɋv(T$ e3u\$t$|$cv,t$$t$0\$ L$4|$(eD$1> +u"vyt?~}t`t&tNT$e3\$ t$$|$(,Í&tbt-T$$~뾍F+G밋Fvt6WuӸ똅uN +G uv9ɋ(pfi'UWVS_ LeD$<1l$`&D$,D$0D$4D$8,$H18p>D$t$$^RD$8O t+Ut$D$t$$,RD$,t$D$t$$RD$0ot D$t$$QD$4t_1l$,Dt#0xD$&$Jt$~Su̓gGT$<$R1x&;D$A$舚&*f1BL\\$LD$d 8 T$hl$Xl$`t$PD$(|$TeD$<1T$,D$ l$D$$H1~fp>T$T$$D$4$vcvST$ [ eD$ 1t5t8t;1u (&T$ e3u#[Í& &؋$&t&'SeD$ 1xӷ T$ e3u[&SD$ @Û eT$ 1ҩtt2ffu*T$ e3u%[t&',T$0\$$t$( reD$1t$0T$e3u \$$t$(,.~1vL|$D|$T\$\$Dt$HLÉD$,D$0t$ D$AD$q$՟D$, v'UWVSLD$`T$d|$h D$,T$(1eD$<1L$(l$(;w1҃1wG |$&9T$(t-|$,, u|$19T$(uӋ|$G~v uuGT$gT$,e3u\$-t#T$e3uZ\$ t$$|$(,Í@ Bt>u9|$4T$8tLl$<9|$4t:4$D$ D$8D$D$0)D$>tЃ>u9|$4ufl$<1t&D$0-}ƃt.T$0)T$< D$0$+D$0)T$4D$<3UWVSl$$$ D$@4)ƋEe L$\1D$< )t$<99l$@:L$@)U ;AQ 5T$@L$@}AT$Dt$D1ҋ  uD$@PL$@uu|$@Wt&|$@D$<$dT$\e3l[^_]Í/‰D$LtKt$1։|$Ht&|$HL$lL$t$T$x71401/ ‰؉%;L$uۋL$Q~%fuuD$PT$,e3u=<[^_]ÐD$$pӐT$$t‹NL$&UWVSL$@D$L$4 (l$H:9l$ut&D$,$cT$DD$8BUWVSLl$deD$<1T$`hÓ tQJ1΃L$,xA121|$l$>l$D$ D$<$l$1L$,D$9L$uЋ|$W))уMKW ))уMK W))уMKW))уMKW))уKty) N)K N)KN )K N)KN)KN)KN)K ul$$) MN)KMN)KMN )K MN)KMN)KMN)K NKNKN K NKNKNKNK uNjl$$t: Mt3NKMt*NKMt!N K MtNKMtNKMtNK_^[]ÐS8eD$,1D$Lo D$( D$D$PD$D$DD$$D$@D$D$HD$ D$$iT$,e3u8[Í& t&'VS$t$0~ eD$1tDFt-t$'Ft$FFu$t4$D$e3u-$[^Ðt&Vt $FFF Y'VSQ~ DeD$<1D$_$0t$ t<@ @@@@T$FtF ty F>1fT$e3u1\$$t$(,fFuF4$D$uF?t&苢t&'eT$ 1ҋD$ T$ e3u7RfeT$ 1ҋD$ T$ e3u"feD$ 1D$ T$ e3ut&eD$ 1T$$D$ D$ e3ueD$ 1D$ @T$ e3u蔡t&eD$ 1D$ @T$ e3udt&L\$@\l eD$<1D$P|$H|$Tt$Dt$/D$ D$ {>D$4$PZ|$ |$"D$D$ <$.ED$ ND$|$t$$ZD$u\$,t$0|$4l$8 D$81D$8σ|$@L$@1D$,D$@D$8t$8 ՃuQvWD$4D$T$ D$D$r$ ]D$4 HD$PD$Dt$@t$Hl$8l$LD$,D$@D$@D$8L$HL$PD$D L$HT$@T$,t$8cvL|$D|$T\$1x&\t$Pt$h\$LeD$<1Xe |$T|$`l$Xl$d;7WWFL$$T$(L$,D$ D$VL$,T$(G7tGt$l$$u*G0T$|!DžPUЍD21),@3Eȉ$,D$ẺD$!dD;,[C]܍]EEEQ̀ED3.@FUЋÈ%243Uȉ583,3F.03.1|UЍD21EuС G5FD }CEԣF<[^_]f$|  it&ڋE+UЍ,ff댍v'UD$$ÐUVSTTt4Pfu[^]5&'UWVS,uET} mT}Ut%1ۍE|$4$D$T;]rETmT}Et"1ۍvE|$4$D$T;]r,[^_]Ít&'UWVSt1=*u051f<*4u9r[^_]$ gUe]ÐUEwe @0]ÍvUEwe @(]ÍveU tU]P%ø@$ ۍt&eU tU]P%ø@$ ۍt&eU tU]P% ø@$ ۍt&eU t U]Pø@$ ݍeU tU]P%@ø@$ ۍt&eU tU]P%ø@$ ۍt&eU tU]P%ø@$ ۍt&eU tU]P%ø@$ ۍt&eU t U]Pø@$ ݍeU tU]P%ø@$ ۍt&eU t U]Pø@$ ݐeU t]  I0 ㍶'eU t]  I( ㍶'eU t]  I$ 㐐1T$rzL$e3  J $e3  Jj BÐU ED$ D$$ÐUWe9h3t%1e= t `3h3\3d3t=5t&tfftHtD| \3D$| T$$h\3\3$oP\3$f\3z\3^\3\d3\3d3u"h3e= t-`3$mfe9h3t%1e= t `3h3d31#󫍅p\39uDžtD$D$$g\3q\3$r\3? `3 `3- `3IUWVSlEЉUȉM׋ủM)EЉEЋP@M܋MЉEԋI M؋MЋAtT6׉‹M؉$U\$L$UԋUMuSv׉E؉ $M\$D$UԋMkSW@UuŰM)u܋AD$Eȉt$$4l[^_]Ít&}ׅtBEtU؋M\$T$ $UԅE܃\$<$D$d]܅u}}dt&EE܉|$$D$Dt&EE)E ׉OEE܉$UMEE؉\$D$UԋUM]]9}M܅uЉ\fQ&QmWfE܋U<$D$T$rMMmmUmU9wAEċEE)EmEĉMUăEE}1 U ;}uMU1׉‹E؉UD$D$$UԋU~#Mufmڍt&'UWVS|uE ƃ F؁ p3#=l31҉9_e=$MU)UME-UUE UuEE܉U8M UEʉU9UEUsEU]9wUEEEʋM ] "EufEU;]tvEĉD$UT$E$UMU1+EuċUƋE Eĉ\$ $D$Uىu;]uĉ8EĉD$U<$T$tEE9E UUaUT$Et$D$ U T$E$$ce[^_]Ít&u0Eu*Et&EvM EԋUE$'e[^_]Í&)܍D$#EE+f$UJt PIp3$eJ p3ǣl3EgE[t&'U(ED$D$ ED$E D$E$UWVSu4$< <ۉu1[^_]Í>t~tUu3WUtЉ}Ǎvf;>u&EUD$FT$$ u E<=tE3uftҀ=f;u ff;tuet&ZUDMUWVS,} EuEtBt&CLt"Ctjt=uދ}t$(s (r4$JGfP @ e34$D$tt&P t$@ e3$Lt&D e30$UED$D$ $U1WVSe= t 3jE1Kt3QDu9D yuuCtQ볍v tEȃTKG Ge= t-3[^_]Åt VFD$$1҅tU2͍&U1WVSe= t 3zE01&Kt3Q|u9D yuuCt~މ볍v trȃTKG Ge= t-3Ҹt$Ee3 BE BEB 1[^_]Éޅt VFD$$U1҅tU2fU1WVSe= t 3Z5 1Kt3ATu9T yuuCt~މ볍v trȃTKG Ge= t-3Ҹt$Ee3 BE BEB 1[^_]Éޅt VFD$$1҅t 5 ɍ 3s3t 3sv3s 3s3s.UeD$ D$ED$E D$E$Ít&UeD$ED$ ED$E D$E$ÐUeD$ D$ED$E D$E$Ít&UeD$ED$ ED$E D$E$ÐUWVS0}UBE1ۃ}u}$u}v4u}DV tuUt&DN uU<-<+EE0U2EV} LE1E}  ɉUE|E9Ep‰؍NEEMԍC< vFt%1: t f : u9w9`MۋA4DXA<79EM9MM9MMMȉE9Ulu tu ]}-9EEU؅DEe10[^_]Ë}I1E EE_t&9EH&EF9UFUM 1t+E~}JB_<UMtS$UMPUMt8D$ $UMUMt u]]]|4$UMMUM^U ED$E D$E$ÐUS\$ED$D$ D$D$}E$E D$ D$D${E$MD$E D$ D$AĴ[]UWVSu] D5Fh~Ye$x)čD$t1Ґt&  9wU4$T$D$wee[^_]Ít&E\$4$D$ae[^_]ÐUWVS] 1fx6SHe59rt!1e= t eSHrB ƒ fxSHBBD$$PSh~}{T1e= t dHG$zGPze= t-dH;t;t;t$[^_]ÍvC$tƉ$l뼍&$(`Ƌ&&$PxBe= t*uh f;x'SHBBuBe= t*u= $ .b dHbdH>b2b돍)b뺐UWVSU x9VHeE9Bt$1e= t VHEBBE\$4$D${`f>x+NHAAuAe= t)ukt&9t 1u lj]u}]Ít&1f>x'VHBBuBe= t*u $} ZFZ댍ZڐU$]]u}f;x4SHe59rt!1e= t VSHrBD$D$ D$D$$щ‹Ή׉u tuBfx[HCCtUt& }։1҉1 uV]u}]Ðshs,+s$)׉։u뛐t&Ce= t+듍veK됍e maf;x'SHBBuBe= t*u $ XYc YאUuu}} ]]f;x9SHeE9Bt$1e= t SHEBBChtOtQE1f;xKHAAtf9t}u 1u Ɖ]u}]ÍChU|$$T$PE듍&1뷍t&Ae= t)uEf;x'SHBBuBe= t*u $P W W벍WڐUWVS]}ut EOh.U 1UuKt&9Cމ\$E$D$UUuf\$)މT$E$y_]t7W_)Ӆ<$str;EUUu̍vE+E [^_]fÉE)Ӆx }\$T$U$MME+E O[^_]ËUtEE+E 뚃}~EUEztU<$T$m\`GhUED$D$ED$ ED$E D$E$[ÐUEu}]$ff:։x@ZHe M9Kt*1e= t ZHECCBhuoBhM|$$L$P9tUt&f>x+VHBBuBe= t*]u}]Ívu두P;PsM PHf>x'VHBBuBe= t*u; $>D$ $Y=롍 \TTYtT뼐UuuE U]]}}D$T$t+Kh|Ut&tCX@ ttJxj$}}uT$L$]u]U M@$]t&S$tǃutSC+C)D$T$떍t&$]딍e]u}]U ]]u}f;x4SHe59rt!1e= t SHrBEU$D$ET$D$ E D$f;Ɖx'SHBBuBe= t*uT]u}]f;x'SHBBuBe= t*u $ PRMtR룍kRڐUuu]] }twf;x0SHe=9zt1e= t uZSHzBt$$Xf;x'KHAAuAe= t)u]Ћu}]Í Q띍QߐU E D$D$E$ÐUu}}]f:x?ZHeE9Ct*1e= t ZHMKCB;BsLBf>x'VHBBuBe= t*uh]u}]Á|$$+Uf>x'VHBBuBe= t*u $ 9P@]P돍TPڐUUE JXR0+At&J9Ou]UE @XPH(P(P HHPH ]Ðt&UES@XHP(X H(HPXH []ÍvUS]$P¸t SX  []ÍUS]CXP;P wCu,PPP;PvP#PPP 1[]fP$PPڐt&D$$P ¸tȋCX똍vU]]uE KX;Qv9Brt$D$$Rt#]u]f1t&US]CX;PvJBt#[]ÍD$$P֍v'USM ]9s'x Pt9s: u)[]ÐE[]UMQtuBX+PA)]Ðt&BX+PvU$t$M Q;Ut $t$]ËIxAtjBXPX(P(P XXPX 1$t$]Íu1BXXP(p X(XPpX 뽐t&BXP밋BXPUS]tOCXPH(P(PHH P H$CX@ @(@$[]Í&CXP ː&U]]uu ChuD$$W"u u]]@ ]'US]CXHtOS<t$M HMHMu9S<[]Ðt&@ $)%D$CCXS<봃S<[]ÍUS]SXBtC<tFC0t&@uC$tB $IC$][]%at&R$)T$OCSXBB농UWVS U‹uE@XR0H)҉M&y 9O߅uH()މMH })9)ۉ}xfu2}H$M+Ht )Bu1 [^_]Ðt&}Ut$ $D$BM]AXS0H 륐UD$ $D$!MEQXJ)D$EL$)؍B $UBXR0H DH(1MH })E$ִǸ*xQMt$AXX$\$q]CX@ $PMCXx P(S0UBXpT$X($\$9Ut$)T$$! U ]]u}KXȋq9v@3ulCp@;E #y KXf;uNq A Y(A(A Q YډAȍJE BE ]u}]Í&y)E$NtH|$CXU@$D$CX@$޽CXUpuP$p{t&z$ftދKXA A(A$s<&U1WVSu}] t&GXPHE)~<9B΃y1ɉMu萋449uuÍUB+utkGhuUD$<$U䋇T$<$P t7lt&\$$ML$UBE땍&E)[^_]ÍvErt&US]K0tC0S$tItJCXPH(P(PHH P H$ CX@ @(@$[]fCXP А&UVS]D$D$D$ "D$D$ $A=Ƹt)CXHtNS<t#ppS<[^]Ðt&@ $)%D$=CXS<뵐&UVS] u^uFCXu+PC0Vs0[^]Ít&+PC0Vs0[^]ÍCXP;P w8u(PPP;PvPPPP ʀ눍vP$PPދD$$P t CX먋PUVS]{h|htMunCX;PS0 P8u-]@[^]D$$ [^]ÍvCXH;H PPP;PvPPPP #;P[[^]fH(PpHP(P p 9ʉP4̐t&KhD$$mUt&P$PPkfs$$ED$$P CX'UWVSE] EUzXw)~99uBuX1ut&9uÍE)EutU$uE+E[^_]Í$ut$L$mUËBXU몍t&'UVS]{h|htMunSX ;JK0Ru-]@[^]D$$[^]ÍvSXJ;J BBB;BvB #;JBBB [ [^]Ðt&JB(rJ(J Br 9J ,č&shD$$Mt&B$BBcfB $D$$P SXU]]u}CXxt]u}]Í&uW$P4uʋCXPt0C<u*@$)%D$B8CX&xpK<uUS]$>&tCX]@[]v[]Ív'UVS$]CX;PS;SsTUPP,H0P4H8CXPPPT$PT$,T$UT$ST$ SD$4$T$V ECCX;Pr#eT $[^]Ð$[^]Í&$(¸tދSCXUPH@ t$虴#$CX# e 눍UWVS}] uD$4GXP9PMu11EWP;P wt<$ GXH}H}UҐGLWPD$ED$ED$D$D$D$ ED$C(D$<$֋M‹EE$K(w ([^_]Ív'U0]E]u}CTE{PCXE Chwt e354$=ED$CTD$D$D$D$ D$D$<$֋KT‹Ew ]u}]Ít&'UWVS(]E{PCTE CXE Chwt e35E4$E<ED$ED$D$D$D$ ED$CTD$<$֋M‹EE$KTw ([^_]Ív'U8M]]uu}A)čD$/]V$F(ȉF,E F<zt e3=<$(U$<EUD$Et$D$D$D$ ED$D$$׋Eu})؋]]É'U18} uu]}E|EVhtUE]u}]Í&u}.^XCED$D$ D$D$$P$!Ѓt E>{<>o鐍t&U4U]Eu] }uҋ}uG +GօD$ \$t$<$P@҉D$T$GW D$$T$ )‰9։D$T$OD$$ىG OOT$L$'WLOPT&G+G օlefG+G_LwP)։؉]u}]f9jL$ T$$OW OfUS]UT$ U M$T$L$P@xCLSP[]Ðt&[]U ]]u}C;Ct^D$ +CD$T$C8$sK+Kω11 u4CLC SPCC1]u}]Í+Cҍ Ӎ&'UE@8E]&'U]ÉuU}T$$PHuE%=t.Kh  O‰CX]u}]ËEċU tƃ|&wsLKP!σt9| 9&rC8D$D$D$ D$D$T$$NEUD$ D$C8T$$M3Uĉ1 tL$4$CLCPD$D$ t$$K$CL#CPtBCL@ s CEƉsshCLEąCP@ O‰CXCLCP뮍&'U $t$|$]u }}u ]$@ t$|$]'US]][]@fU]ÉuU}T$$PHuE%=tnSC $)ЉD$b{h  C CO‰CXC CC]u}]Ít&}ċu t|&lfډUM!ʉUSK |#M9MƋ|#uD$ L$t$$UC|‰S C+CsL{P‹K )׋|ȉsL{P)ЉS 9׉MMEU|9s |UEMC+|K9}LD$C8D$ T$$K +Kω11 tX 1|s Jf9r1v#u)L$$KE|ȉC CL1SPD'U uu]M }~^);]s2ulUMhUM~^);]su)ȋ]u}]Ðt&9]F]$M\$|$îM^É $M\$|$覮)]4$EX~^UM)9]v[]L$4$\$P UM)hv'US]C;Cs []ÍvuC;Cr ݋][]@t&'UWVS]Ci} uvCS)9Ct S )9C CCCCCtS )ƒUv 1u)ЉL$|$$P8SL)ƋKPUUM!ʃTEUCLSPCE[)^_]Ít$<$D$hEs1[)^_]Í$vT$<$D$U转US)։$2wfu0 vhvC$t$1#$4u ;U$]Éu։}tfCLCPL$t$$P<CDShC҉C CCCCC C]u}]Ít&CS9t)‰MD$ T$D$$W@M!׉}1}tCLSP[vfq|$t$$AfCDOt&^t&Rt&'U1WVS]} U}% = UދBR9w`UD$$P My +y1Ƀv1щ)tpM}t$|$ $$)V)1Et8M9؉F1f  9uM}Q)ƋEJ)[^_]ÍыRA 1E)9w49s~~ Nt 9sp9 u)AEY|$$t$ƩU}Bk)Evt&UEK)9REt&t&'U1WVS ]}u 3)Å~JG<uI\$t$G8$yۋE )؋wP_Lx‰WLOP [^_]ËE)։\$t$G8$P뵍t&UE@8E]h&'US]SC $)ЉD$C8C CE[]t&U E D$E@8$D$=Ít&'UEU M@<uMU @8E]@8E]UWVS]S;S.KKfxArHeE9Ft*1e= trHEFF%=uD$$P f?x2WHBBu"Be= t*8&$XCS C)‰C CCCCT$D$$Q8~ESLKPC!΃tƉωsL{PC[^_]Ít&[^_]Ðt&u> [^_]ÍC$t$Y#$;.t& v e zf?x+WHBBuBe= t*  $|t&'UWVS]u}C ;C_CSD$uE E9C<SLKPT$D$L$ !ȃUS J A{C)D$D$T$T$ +D$T$9UD$T$ ST$ 9U| D$9E E +D$C#SLCCP{ {{{x+D$ T$D$$Q@E U &E UĄ[^_]Í&D$$D$$RH$T&t$ MU $L$T$P@!уtK#CLSPK KKKKKĄ[^_]Ít& uK Cu })ȉ!ƋE !׋U)D$+CT$ 9T$ |9D$vu }D$D$ t$|$D$ $P@҉ƉT$ T$H8D$ SC )ЉT$D$$щ9L$ | 9D$D$CC D$CCD$CϋUsLCC{P#CCCE YvC+C)E CLUSP!уE UM 1/ t&D$4%=(D$PT$TE U1fC;CD$t&C t$!#$*CCCCC CCD$ D$D$$P@!уUCLSPt&$)'9E e11D$Nt$|$ u }t$|$ )ωu }D$St&'US E]D$E $D$$t$CCCCC CC؃ []Í&1ۃ []Í&'U ]]uU }MuC<}E% ȉt$D$$ƅ% s8 Ёt$؋u]}]Ít&D$D$ D$D$$P$!Ѓue<t4$v1뙃% ȉt$D$$ B'US] $CLCP$C8[]Í'US ]CXǃ ǀ ED$E $D$I"tCCCCC CC؃ []ËCXǃ@ ǀ@  1[]É'US ]{8t*Sh~ICXP @$T$)D$@tE ] []bf$PDfSK)tˉO'U uu]]}} u1]u}]Ðt&CS9t2)‰D$ T$D$$Q@!уtsCLSPt$|$$P<CDt(ft#T$U|$$ UfCDKhCɉC CCCC~2C 9։C80fCLCPtt&fuUS]SC9wtC+CuCL1CP[]ÍD$ D$L$$R@!ЃtCC봸e<t[]ÍvKh~1CXP @$T$)D$Z뾍t&)‰T$D$$ٍ&UVS]U tBKC;C + Cuu tfƒ[^]Ít&CCVC9C s CC ssss shtCxt&t&tKU$)ȉD$L$&UleS$)ЉD$T$KCCCef e  U$"C UC CCsh~:CXUH @$L$)D$?UDCKU$)ȉD$L$>U͋sU$) C U+K9F)ȋ C C~t&UWVS]{81%=$9$PDSh҉~^CX@ t$"D$ D$D$$µCX@@@@ @D$ D$D$$ C CCCCC$D $DC8CLCP[^_]fKh~)CXP @$T$)D$t&SC$T$)ЉD$'UWVSu/S;CS vC#CCCC1[]Í&S(S ׋D$$P ¸tˋC띍t&'UEM Phu@hM E]B &U]ÍUS]$P¸t SS[]ÍUE]B &'USEM]L$M \$D$ $L$R$[]Í&UU E@<@@ @ @@@@@@4@$@(@,@0f@D@Ht@@]Ív'U1]É'U]ÐUS]U C;C v H@8t T$$Pt#[]fK퐍&US]C;C vPS@#[]ÍvD$$Puۃ[]É'UVSM u19s&{ Ctv9s: u)[^]ÍE[^] UUJA0t9uf9tu]Ã0]Ív'UEU ]@+B US]StuJ+J C)[]ËJ+JU$t$M Q;Ut $t$]ËAxAtjBZ,B,B ZZ$B$AZ ZB1$t$]Ít&u1Br$Z,B,B r ZZB$A뽍t&Z 봍vZ묍vU]ÐU]ÍU]ÍU1]É'U]ÍU]Ít&'U]ÍU1]É'UE]@4Ðt&UE]Ð&e95Ut%1e= t 555]á5U5u"5e= t-5]Ð&U555]Í'US]Ctt2E MCEɉC u []Í#[]Í&S $)T$믉'US]tGS,CSS$C,C SS C$$WkC$C,C([]Ít&C$ԍvU1WVSu}] fJz9s:)9FwZt(u1֍&9uuJ)tH $UL$P Ut*f\$U|$ $ˌUB뵍vE)[^_]ÍvUWVSÃ$@ U)ljEC0J9OuK,)MK$})9}u)օxRu.41U+S s(t)Pu1$[^_]Ðt&}T$ $|${C0s$븍v؉D$E $D$5C ){$D$׋U<$)‰T$4C0s$nK,MK$U)ʉU1FBdU܉E$^U܉ǸQx:s Od $t$MT$ыM΋C$$iC0{$}{,S s,؍Od $Mt$U܉D$U܋uT$)։t$$uM뢍&'U$]]uM }SC 9v)3ЁtUPSH]u}]Ít&3u~s$t=sC, s,s$CS$Cs 벍&Br9t={$M$K]MC$耉C,C(t&S딍vsdsM)ƍ6E$ ]tY0C U$t$D$[C $gU{ M}ЉS{S(t&؉MM{UWVS EE6Ee95t%1e= t 55555ۣ5e=vf;5x-SH9zt!1e= t \SHzB%=f;x+SHBBuBe= t*559][4`55u"5e= t-5EtED$$E [^_]Ðt&D$$P :&ED$D$6$W&UWVS(uEE6Et;e95t%1e= t 555=5EeEDž5t9f;x3SHE9Bt$1e= t SHE܉BBKhCXP;P v#D$$P EEEt8f;x2SHBBu"Be= t*6&559![4$t55tAU؅tED$$?E([^_]Ít&C;C5S&5e= t-5뛍t&ED$D$6$չUWVS$ۉEeEƃ%{hSH1M;Je= t t5{SHE;Be= t fCHU@P=5u'u!S5S`C\C 5)ЉCdD$D$$P,u2fCh[4E[^_]ÍvB낐t&SHBBuBe= t* Ch[4룐s.'U$.ÍU(]]u}% E6Ee95t%1e= t 5f 55f;5x4SHe=9zt!1e= t 3 SHzB5f;C4xSHBB555u"5e= t-5 tED$$϶]u}]fED$D$6$襶Be= t*x ]UWVS];QfE6Ee95t%1e= t 5 55f;5x4SHe=9zt!1e= t  SHzBt59 B4t&9fu9ÍP4@4fu#f;xSHBB555u"5e= t-5L tED$$[^_]Ã4&C45i&ED$D$6$մBe= t* BC45US]Ctt:C0tv@uC$t$]C$][]S $)T$C C뙍vUM ES]UHH@<@@ @ @@@@@@4@$@(@,@0f@DtAAۉXhxXMPXBBBBB BBB B$B(@\[]ÍUU EPH@<@@ @ @@@@@@4@$@(@,@0f@DtBB@h@\]ÍUS]C0tC0C$tAtCS,KC,C SK C$$[C$C,C([]Ð&UVS]D$D$D$ "D$D$ $Ƹt Ctt!#s s [^]ÍS $)T$'U]]uu}} $P0tgtcƒSt 47{s CCCCCC ؋u]}]ÍsGS҉ttss 랐t&1뿍t&C $)%D$-ȍvC $)%D$ E&UVS] u^u6SuC0+S Vs0[^]ÐC0+SVs0[^]ÍvC;Cw:u+S;CS vCCCCCȀ뛍S(S ۋD$$P t C릋a&US]ChChS;SS0C$tA tC K,SC,C KS C$$XC$C,C(]@[]fk[]Ít&SC,K S,S$CK$9ЉS SVS[]É$a맍Svq덍US]ChChC;CK0C$tA tC K,SC,C KS C$$RWC$C,C(]@[]fk[]Ít&S,CK SC,C$K$9‰C CV[]É$7%뭍t&S؍vKv뒐UWVSU u}UvN^9s9)9F߃wRt'}}19u}]N)߅t 4$yuE[^)_]Í&E\$L$$]x^E뾐t&U]]u}{t]u}]ftsh~4$P4uԋC{GsHtt{s 뷍{GsHS $)T$ȍ5% 55 5j2 ^5r 52 &OJ5:O. 5 5'| 5 5UUJ;JvJ% = tJ9Jv]Í&B"JBٍ&UU]B9BCB+B Ít&'US]Ctu $CE ][]UE Utt ]ÍE U]t&U0]É}׉upP 1)9}CKEMt]u}]Ít&GdE$tՅt,C +C$UD$t$u4$UCME+ET$щEUD$ L$$EUEuE)K )K)K)KK SK)‰|$D$$`t10)K)K)K)KK S K빐UU]] uu}}tAWG 9WCW)ET$ Mu/]u}]ÍvtYt|GW 9GCG)ЉD$ }}u D$ օ9\$ G؉G딍t&tG+G |t&G+GhWG 9WCWE)‰T$ }t>}u D$ օxa9\$ |EG M؉GD$ G GW)‰ŋG+G2ډ$Ttډ$/Րt&U0U ]]u}t1҅u]Ћu}]f tHCK{ M)ω+KM >9MsBtC9CsCv뭍C㍶KCKC먐t&qD?d9ljEbU$UI}t/E $M|$D$CrE$MUCEUMD$)<9<$D$HqM}D$ $L$9D$7MUȉK+EC +EC+ECȋK +ECKCU E]]uu }}uaD$4$qD$ED$ t$$Ess st6{C{ǃ]u}]Í9B렐ssCȐt&U U]]uu }}Hхu_D$4$GqD$ED$ t$$ Ess st4{C{ǃ]u}]Ít&9B릐t&ssCʍ'UE]]uu }H…uZD$4$plj|$t$$D$ ` ss sss{ǃ]u}]Ít&9B뭐UWVS1ҹe= t :e=E 61۾t&؉e= t \@ 6uڡ U @:66:::[^_]Ðe=E<tۉe= t :6\Lt&U~}::ule : : 6 :6t&e= t*[@ 6ue= t-:[]Ít& U~le : :1ң :6 6v9tD‹@= 6u:::]Ðt&;Uu4; 06];]Ít&UEtPuDt B]Ít&1]Ít&B]Ð&U :u։}lj]B01ҋXD)x~$‹F09t1]u}]Ív߉U<$6Uu3U$Ut)tF0)Ӄ)HXЋUƍU]Éu}u;p~uE $6Ma :9M81]u}]Í&U@U!tTtO tJtEt=@t8ft.t&ttwuNqK)ˍ  ˅Z>}; MMM2M9ȉMtI X9]Mt&P9);Eu݉׉‰Јf MM h:9MDtzE;ȉ EEE2E9EtXY9]LEt&8Q9-)ȍ;Mu3K }t'ۍ<9=:\9M'UVSÃ$u$[^]Ðt&EEuD$ D$D$ $UU9v 90wE 4HT  D$T$ D$D D΃$L$b$[^]ÍvT$D$$A`wN&UWVS:EVe= tH0UEE,E܉U&1ۋEuvF׋V ;p |;rs~P Bv VoUBZX vCCSUC<;S ]twCSǃ4;UVUu8)NjCS ;X ;Z{P Bv SE9p0t1UD#fNfU9UtnE&}E{X0Vt&MU0ȁ(&@ @9u} 6t UBBUBJ0[^_]:H$6ۡٺ^ P:^ :xt(FBFPzxt/CBCP9t8PVPVBVBE9t%PSPSBSB@@@@t&U $Ét$օq1e= t 6S 65 v0ve= t- 6SЋ$t$]Ív$ 1҃PwɅt G£:뤍t&~5:돍&5::n1ҁw5::G&5::&5::5:55: UWVS=x [^_]Ðt&::::e:: 6`: 6:::p\:p]:^ 6t::$:<=Tt%1t&8Mutu#6t[^_]ÍPи5tË;t ;; 06vxAXxLNxLCxO9xC/x_f#ƒU1L=u $ D$D$S E$^UDD$D$ E$^D$D$ U$o^pD$ D$E$IV¸A9D$ D$ U$^D$ D$E $U¸CD$ D$E$UƒD$ D$ U$]D$ D$ E$k]lD$ D$E $EU¸=f3D$D${ U$]D$D$ E$\D$ D$E $T¸D$ D$E $T¸D$ D$E $hT¸`&U]]u};/;AELDt]u}]Ðt&C1e= t 6Me= t $6{iHt уG:1(6 uCP6P:T:X:P6\:T6ht&y}&}89R=X6R LA P6Ly X6|y LN=LtE{~?wJ|z ljQ J }QMMM :t D:e= t-:G>t:1e= t 8>e[^]Í&:9: 6u : 69wu 61ɉe= tt)@; 6u1e= t =e@ 6Lt&h:_Xp@8&R R9u 6SSSHPs0 :LHt)Ⱦ)ЉBS0e1҉e= t <Љe= t :<`:@`::e= t-:<4U<U~' : 6Q 6 6 6O6:$:H$6:h1nUWVS :=E 6EP!ˉ0렉J|[vEuX0{ڃ;}]E@U}UaM}&MQ]}]A}} }1E}E!}~BUU t&}L;} 6tK:U%D$$T$9t&]ԋ}܍DP9XM;JLJfIQӃ9]w@ 9ȉE& y9W} MM+};J A ;HB PExv H;ML} 6tIu졼:}%D$4$|$8fE@E8E91e t[^_]ËYAuQ +};H ME9J<P BUzv"ыRtxtMABAPV;r EE}p PB FwUB4v@@1ҋM} 6]<8ƒ щKPE v;EwHwE#e}L} 6OnEEEE~P|CUԉUK CUs 1҉H0= 6E+} ЉC:yM%D$4$L$6:M; :E:;:E}\8!9&UEZ0{ڃ} 6"ދḾF)ɉEMU(UE!MF 9EEN+MH:Fv+E)փ:rUH;LvLC9EM}U4 1Ɂ 6+E ʃw0SFs1ۅ:pU%D$4$T$H5QE: UMpPHPHE:H0BWA;@ISˉ8EmN, ;q u]EEp HA Fv@@1ҋM} 6]<8ƒ щKPxU ]HD$D$D$ "D$\$$跓tGڃP:;::~::;::v:pPMEY0{ڃY9tt&9GT 6tXe= t 6U 6,e= t- 6t&e= t `:UDމe= t- 6xUe= t+xE191e "UT$U$Ѕ E4$D$D$,ED$4$D$,U }}]uKe e= t t)e= t+]u}]Í 6|e= t+qe= t 6^ 6-e= t- 6H널1M1i`:҉D؉e= t- 6-e= t+ U<$T$ЉvUS] ][]`US$XM1e= t 6 6jP6CC P6AELDCCCt&LJ L =t(J9uD D=u܍t&:h::ǃ0:: :$(l:,:4:8:<:@;D:H:L:P:Te= t- 64؃[]Ít&'UWVSӃZw-vHe 1[^_]ÍBtуt̸&9w߉w EFEET1t1҉qttڍD!Ѓ)Ew ؉‰E)^؃)Ѓ 6]KLF ȹ ЉF uFuDU9v7M1Ɂ 6+E ȹBF EFF[^_]Ã[^_]2fQMAȉ]K1ɃLFMt&'U]u}:}E!ǡUe e= t CtC:EL!e= t+t]u}]É聾봍& 6txe= t 6U 6Be= t- 6돍;EMTH1' `:EɋMDލTH|;Ue= t+U|$T$U$ЉvU]u}=:Ke e= t Ct9M؋:e= t+t]u}]É뾍& 6|e= t 6BM 6e= t- 6)f ET1 11Z`:UDމ;M0e= t+U<$T$UT$Љt&'U]]uu }jwu]u}]et&e F<tQe= t1ډmt?e= t/]ȋu}]Ít&1T3u1؍v 6t]e= t/ȱe= t 6 6e= t- 6p`:De= t- 6M5M5e= t/vUt$$T$Љ'U$t$]u >]u $t$]'US E Mu Zt  []Åtu$L$$…Ҹ tՋE 1[]Ë]L$$\$҉fUVS6MtpQZu! 6t %1[^]i:u;:w?A)á: փuN-:):\$$贁[^]Ðt&w::멋U $T$ˡp [^[^]t&'UWVSӃBEhH9ʉUW4 V/9U#;MMsn9w0DfUU9UNV ;q UR9։UU~EQ JvUR҉UEE+EvOM M 6u Ήs JLC[^_]ÐE1ҁ 6 E ЉCELfUU9UUMMEU1tE9P CKuHNHNv.H N HNvH NHNu PV@ F Ef M1Kv1Ɂ 6U E ȋMC)ʍ G0PCvuL$D$4$}닍vщMKMS Kc1 ^ DKMytUJUJNVJU9Ut UEQVQVJVJIIEvUWVS$E ]EFMsFƒU9}M σGרu~ 6ue1e= t+$MSe= t/Ӄ$[^_]Ðtl$1:%8됐t&:|!NjE9ljE^$[^_]Í&1e 놐EE$[^_]U$E E\$D$E$A1ɉ6]+D$)D$ |$$UMUMt5)ʍ4уN+}=:;=:=:=:E9E$=tVE\$<$D$ٺ 1耲hUT$U$T$ЉN1Gv'U$t$]u  u ]$t$]/ UWVS$=P6qP6Guƒ5Mu$ljƃub:KT!ȍ)É$6tEҋE+:5P6)h:1^$[^_]Ð)듐t&G$6u:h:9($1[^_]ÍUEED$ D$D$<$UvU9v 90wE4HT D$D$ % D$D DуT$4$n_D$% D$4$M_e fUWVS]1e= t 6 11҅xS 6R‰e= t- 6 tmBUƃ )9s8)ށ<wG&v,-9rEU 1ˆʃ[^_]Ív(ڈ׍&e 1̐Ue $t$|$]<tR1e= t : e= t-: ]$t$|$]t&=:0tڋt$ 6$|$]m1xsS 6tbxWуɃ )9s6)ف4wAt&v)9r߉ 1$t$|$]É(و ۍv'UWVS,] u1e= t 6EUe= t- 6SF߉UXS уMGMEMe= t 6jFUU܅GE$M 6Dže= t- 6tdOȃ )9s6)ށ wut&-v]9r 1׈,[^_]Í& :|}!ύ 9x7f(؈ 맍&1e ,[^_]ÐE11fD$E1$ eM 蔫D$$d<)ЉL$D$ |$$U܉M]{U܋M؃t3))ωP=:;=:=: =:E}9EJ0U 6sED$E<$D$9t&UWVSu] F{1e= t 6d11҅x 6‰e= t- 6tPBUƃ )9s)ށ<wAt&(ڈEU 1ˆʃ[^_]Ít&v-9r뽍u#ve 1҃[^_]Ð1e= t 6\11҅xS 6‰e= t- 6EBUƃ )9 )ށ<w-9r (zC :z麣1ρGu3H 1ѿs)1ρGu1ѿs1ρG&1_Ãt8t@t8t@t8t@_ÐL$T$:u ABu1øBÐU1҉EVu SX Lu[^]ÐU]]u}D$D$$t ]u}]áHe=7t7D$D$$EU$U7HuD$D$ $`념U<]]uu }}x<;}4t)D$D$$`Ɖ]u}]D$D$" $`$E$ED$ D$ E؍ED${eU9}؉4$T$ËEGljD$9}ryD>o+M؍U)9GщT$\$$ǐD$!t$z80@80@t 80@1ҋ)ʁJsX1ʁuN)ʁJs>1ʁu4)ʁJs$1ʁu)ʁJs 1ʁtt@t @t@+D$ÐU1WVSM1ۋu} vb8t)[^_]Ít&tF_8u߄tF_8uτtF_8ututt8u1҃tD\8uu)[^_]ÐUW}}VM S_}uSCtAASCt3ASCt%ASCtt8ӍSCuM)Ѝ\t1D9u[^_]Ðt&]tt܄uȐ@1׋$;DЅ$t' Ht Ht H uӍB tH tH t H u@@@P 8 tJ8 tJ8 t J8 uBBB9tJEщ;1;VWD$ T$t$H։fʨ8g@N?8O@N'87@N&11ρGH11ρGH11ρGH 11ρGqr[1st1ρGuir;1sT1ρGuIr1s41ρGu)t8t0@Nt 8t(@Nt8t 1t@t @t@_^ÐSD$T$ L$u: u1[[|Vƃ Ɖýv'FJ9YFJ9KFJ9=FJ9/FJ9!FJ9FJ9^1[ËFJ9FJ9FJ9FJ9FJ9FJ9FJ9F:B^1[ËFJ9~FJ9pFJ9bFJ9TFJ9FFJ98FJ9*FJ8.9&^1[ËFJ9FJ9FJ9FJ9FJ9FJ9FJ9FJ89F:B^1[Ív' ;ulF;BuaF;BuVF ;B uKF;Bu@F;Bu5F;Bu*F;Bu }lc 8u8u 8u9^[ÐWL$|$t$ )9sssf֋D$_|tssf֋D$_ÐWT$L$D$ ,׃tzItItuIiD$_ÐL$ |$t$ssf󥗉ÐWT$L$ 1&׃tzItItuI_Ð|$t$1L$ u<v7tIt ItIPXlj֋D$ssf萐WD$T$ ։fʨt)8@t8@t8@1sd1ρGuYH1sH1ρGu=H1s,1ρGu!H 1s1ρGu똃t@t @t@_ÐWD$T$ ։fʨtL8<4@t58%@t8@ 1ѿ1ρG1ѿ1ρGH1ѿ1ρGu~1ѿss1ρGuhH1ѿsW1ρGuL1ѿsA1ρGu6H 1ѿs%1ρGu1ѿs1ρG*t8t@t8t @t8t@_Ð@HUtRH ]EÍxݐUWVS<1ɉDžfЉ)ωэ9UvI>8rtQĐ;pʋ먐t&Dž1ɉ)п+э9UvE<<8wtQ;1xʋ뤐9sM1& =u]t)Uf1uf 9w닅9IUDž)DžDžU)‰T$D$$%}oD\9C9vb:2T0'q:9w؋9:T#qx:u 9r֋9E)svDž‰ҁ<1[^_]Ët;sE+Dž똋E+;B}Dž)Džu)‰T$D$$#D 9ss:T0(&q:9r؋tb: ubT3fq:u#uۋ<[^_]Ít&vՋ9e<[^_]Ëv&UWVS@E uEMt3˿ t)8!u;t1@[^_]Ít&uUD$F$EtΉ+MMfu+]E+E;uBẼ}]ԉEv }MԋŰE}@[^_]t&E1ɿvЉ)Eωэ9UvUqx]̉:]u9ErߋU9u؋}u}Et&UUEEދE+E];EBE1]MԃuEċEM]Ћ]E)uȉM܉}uމ)‰uT$D$E$E};]fvN}܋uЋME:}EM܍T8Ufq]؉:]uq9wEM}u}}T:TuY}uM܍T>Uvq]̉:]u)uuUUEEfEEEg5M]k}u<>}뙋uuYuQUe]Ue]cUe]USXt+@S @C qSp$[]ÐUED$M$U Ezƒ1uUvEp1Í&EEÍ&'U }}]Éu= uUD$4$/zUv$EDp]u}]ÍvESE= D$4$yuWUv_EoECSo&tA1{|t&hC뾍&ES Cu머?&UWVSø$t $BP#{$ ECK\ 1҃E܉ȉU&/ƒu)ȍD)čD$Et=҃u*U}u= D$4$WxUvdElnEEE@MtQAnE$C t $B"e[^_]fEMQtE= D$4$wuPUEm1EUBcUCStvM6fUB///uMܺ$ɹ EыMT$L$ &EP E_fUeVSø0Ft1HKHK @ ɉC tBCt@[^]Á t‰LF붐U ED$ GD$$Í'U E D$D$E$ÐUUS1۸ dt[]ÐU;S;Gk<;F؃Fi[] UWVSӃt~9Pto~qrimYQE+E)NjAiҀQUt7s~A iQEE+AAYA[^_]fAEuA ЃiҀQUf;vuغQ)kd9EQfu21A{fUCuQUֺ*)kd)NjE ERU)‰Ѓ@TUEgfffE)…GTHFI<:$I)))Љ)q )Q v=FEE+};}~$uM fV9} փ9wMuiQuSt&غQ)kd9u)iҐ9 &]I)iҐ9MU $Ӊt$Ή|$RǸ@;lFS`;l3t4X; x;9@19~1 C D;S(C$$t$|$]Ít&19919봍'UWVS E$;1҅ۉu.t&ËC9w)|E|$$tBu؉ڍF 1$Ut$xpE<$D$Ut  [^_]É;fU@;1WVS@]`;@;$XP)čD$/T$\$$D$| $E܋U܍ED$ T$襊;<dKe=]܉E t&Eru<+t<-t<>+E܃ MU܉$;ۉu .ËC9w)|E܉|$$BtDu؍F 1$蛹t+xpE܉Uԉ<$D$7ۋUUU=@;t<-t~<+tzЃ0 vo&T;1ҋ5`;;t;؉<$ ;$;= 5$4$LG9w9vLGe[^_]fLG<-<+IT;ED$UD$D$ ET$UT$UT$D$ $ˆtwtb1ҋ=@;=t;T;5`;1t&EEÉ];ET;^;fEfE1MU]]T;T;;u"5@;1ңt;؉5`;E뺋E܍UT$ D$| $D$ڇ<<DsMe=]؉U vEZu<+t<-t<>]+E܃^U܉$`;<-<+t;UT$UET$UD$D$D$ T$D$ $'t&T;t;t <,u>{u8t;D$ T;D$`;D$@;$PG@;t&<,`D$\$$l$u EU3;3; $D$w $f`T$$D$L$4H$`d ;E;UH\$ ;E;UD$D$,;D$bD u}ωXMLXɋuΉPtUEʉ;T<2U ȃ; ;$iH, ;405;;;;;֋u ;YH\$ L$D$$l5;9 ;=;\9T1҉t& 9|9w틵THfʉu\1fK};KsKt0K;Kr剕H$VHuՅt&K;KK ;4D1K;KK;X ;D1 ;E9;19X;\$ D$t$$9N;1KU;KsKt0K;Kr剕H$UHuՅt&;K\E;KUsKt-K;Kr剕H$UHuՅ;\E9=;D $L1t0LfS;SS;D9r؋;9s#;9rP1t/PS;SS;D9r؋;9s#;9r}8;t8u ;$ ;t*1ېt&;D;$9;w݋; $t&tL;;p u@;$v) 4 t  $g;X2:tА8u)щ9 LGs LG9rՋ;?;1ҋ;;؉ ;$;PG$S<&$8F i P t&\ ;ЋE`d3;3; E;;"u\$ D$D$,4$ʊ!D  Mu΍ E}ϋU܍k\Uʍk\ D$$D$$臈P}9MS)ǍG)čt$;SS SWT$H\$ D$4$҉H9$D74$;t&5;11ɋ;1ۋ=;;;\XuD\TX׀zu*۱;tK;1;;S&u"\TX׀zt;ɻu0{u;1ң; $;;$ [H$OH H$OH 9t&6$OvO$Ogt&UWVS$E$\U E$KMXىMED$L$$ iPGV=;QED$UT$E$E\$M L$$=;U;;}H15;;U܉E1(zu9}M + ; R9Ev9J zu݅u}M + ; R9EwNjU܋EM; ;FFMFH}@EM ~} E $:أ$;:tА8u)щ9 LGs LG9wՃ$[^_]PG$[^_]Ë5;`\$d̀el~u ehtød҉ue hÐUWeVSxE$ U$$‰<$UUD)č\$T$t$$M/POS@IX_Vf@6_M |$$L$aE\$D$$z]U e[^_]Ðt& Y'UHuu]}Gv;"PbfcA=v4$t&苖]u}]Í|Jfe륍ED$$ Q 0D$}ȉ$eEtt&D$|$$~uMă<t׸dTEDD$ D$<$谺U9- v&$l t& 0MȻ døi9 &vD g]vP F<f0&fcf;¸&ff|fpv&v` Pv%v@@0v'v @v3)vvv1&vv'{)vED$$UE=G\&EMUWVS UMEB ]R$ EԉEUM؉M]܍]9] UE؋ME+B$J$B [^_]ÍvE9E~؋}u+}+u98~)EME1ɍ029u}뎍~1M]EE+E1ɍt&8:9u)uKvUWVST] UuCE::EEEdC @KuQC$C C$H 萰M E$C-+RCCsut Euu 9K$~K$9K ~K {9MU :X Z8-P}t 1ɀ- MKEЋuM U MA<-EtM[UȀz3}=Au}u1E؍=tuE؋E0aU؉+U]EU1EE)EuUB;GRE7tJML$E4$D$uډ4$-;EUu}7]uű]MM? $߷ECCT[^_]Ðt&EljD$M $ C0ECt$M $}utG}:tA8WP:uAx: C8C Cut&}}s?T[^_]ÍvP:Y P:Z C$9C 9t E MK$ C ;E6T[^_]ÍE 8D$D$y $`wt$ |$D$E$ЯCx<P}G}EȀx-M }Eȋ78D$D$ $`Ut$|$ UD$ET$$+x>p<PUB9R 1:P;SU:S EC=Ut ҉E*MM܍v}7E+E]EE1EEt&E7UT$M4$L$[u։4$菲9EMu]Љ}붉`t&9K CE\vK UE}-D}ȋE 78D$D$@ $`Ut$ |$T$D$E$Kx>p<P:t:fU :D$D$` $`Rt$ |$D$E$諦<x<P+Ðe= uڋ\$d=+ڋ\$dPuX=*Ðe= u%ST$L$ \$d[=*PST$L$\$ d[$ X=n*Ðe= u%ST$L$ \$d[=2*<PST$L$\$ d[$X=)ÐST$L$ \$d[=)ÐUUSM ]d=w[]e 捴&U]M u]Ue u d=wF؋u]]Ãtu։UM<UMƸd=w뺸e؃e ʐڋ\$)d=(ÐU}U Et!e]Í& @@@\J@$@(@0H HXJ@<HJ HJ HJHJH JH,JH4JH8J H@J$HDJ(HHJ,HLJ0R4HPPT1]Ít&UVSU }Ete[^]Ív Zf@XJ\ZXɉX JZ$f@(HJHJHJHJ X$H J,r09މH,uSJ4rEU19EEЉL$D$$1EE1Ee= t ,< <x=8$<Ne= t-,<EU9t$Ĉ[^_]Ð\$D$ $#t&H(<eTED$ @D$ED$<$ _ <D<$Z$<1ɡ(<< < <ED$ @D$ED$<$ = <<$< <t&$<1ɡ(<[=8 <nEe+D$ 4$D$跣>fEU4$D$T$t&Eout }ܾgfffEof mEemorEy [vȃ))0҈ uݍU)߉\$1ۉ$|$V]P@E)‰EUt&D$D$$ <]D$ $\$K4$hD$ 4$~eD$:4$iF;ÍE$$\xÉ4$b$Jxv'UED$D$ E D$E$Í&UED$ ED$E D$E$Ð&UED$ E D$D$E$YÍ,<  ,<k ,< ,<,<IUSVW\$L$T$t$ |$$l$(u d_^[]=*ÐUSVWT$(L$,u: u1Ջ\$L$T$t$ |$$d_^[]=_^[]ڋL$\$[d=ÐST$L$ \$}d[=lÐST$L$ \$d[=<ÐUWVS D$w E$6 GtqE\$D$ 4$\t8ED$|$4$=BuUIȉ E$Eue & [^_]É'UD ]"fUT ]fU4u΋M]}>ED$ <$U)D$M܉EM܅'@9499]u}]ËU|$}T$<$JM܋+؉>)ЉD$ET$$M܅>ED$ )D$<$zM܅q;]ڿ+U]uRډE)‰EU/;D$D$ <$" 339u}EU;D$|$$y1;}t ;] SfE)ӉT$U؉M܉\$$-U؋EM)ЋUE T$)ЉD$E$M܅xUtu‰ً>fuىË>냋]{'UWVS($ % P)ԍT$ЉUE܉EED$$e HEtq]E]Ի EEt&Ɖ߹u-@0 UU܉T$E؉$MԋUEBuƋ]dEe[^_]D$$p EEtҍE~ UEEԉU߹ (҃UE܉D$U؉$MԋUEuċ]dEe[^_]ÍvUWVS$ k|Ef$tTxup uݍUpD$ T$4$蛏tE9t8$U蠨ut&$@E[^_]E됐GdU]DÐU]] ut)3t#D$/4$gZtHD]u]f5HU]MuU }]}d=w&u$T$]u}]Í&e͐WVS|$ t$T$L$\$d[^_=Ðe= u"ڸfL$dӃVƉڸfL$dӖ>^Ðe= u"ڸf L$dӃuV~Ɖڸf L$dӖ^BÐڸfL$dӃÐUetPwetD;E]ÐRSV1e 9u dЇu^[ZfSQRe dZY[ÐU $t$|$u*ee ʉȃe9u t$t$|$]ÉсÄ1e ̀eЃ uvUeу9te 9u ể t]Ée(e eUMfHe= t H9u]ÍU1VSe= t <<10HukÃ@@tDMHM H MHMH& He= tH9ukLe= t-<u\ [^]Ë6RD$D1$et</5<A <x <뗐UVS] uEEۉuE]ED$$07,hE~ MP tg9~CU;Ur;;Pw3 t)9Ut&w9Prur9Ë1؃Dƒ[^]Í뚐[^]Í&U]] uu}{t;4$=S;SSt D$4$>C 4$=C1]u}]ÐUWVSE uE1ۍU艅ptht&EЅx8o$EyEE؅$E EEMEEEE;;DՈ  )EDՌ $D$ D$D$UODՈt)‰ЋUDՌEWDň.> DŌGED D}|$D$ D$|x$p|x)ljDՈE|Ռ}UD͈D͌D$T$<$ڧ9] ~=MU$`}E1=t&e[^_]DՈ + Et/E EEEEmED$ 9D$2mU]]uu }f;x4SHe=9zt!1e= t SHzB~K<E$D$ED$#~MC9}}r9ftXu }9}t X]9]s]t ]u;sv};xwUtEE9Es,:f[ UEuEL9u.1;]M̅t}̉EtEMԋEABA t $hջ8[^_]S0}ȅt Rz}19}]v9H ރwtpffutFH]39uurf}tpu ]9]t pu9ust9Jsu;0G녋Hz밋]CC ]1Ls,HUSt[]˗贗9t[T]f˗贗19uᐐUGtED$E$Í'UED$E$ÐUWVS.$֔1Dž( YЀ wQZRɃ0rЉ< wv҃ LJrЉ< v( (.u tS뤃) ӥ(([^_]D$$p Ry֍}D$@|$$4$~ָ??NÉDUjt&U(]]uu }}t tV$0H54H=<}}u u]]]&뷐e ÐU1SntelDHtcAMD@H[]fGenuuineIuTHLHà PH @HHHXH \Httuى \H눐t&AuthmentiaTH£HH@HLH PHXH\H%f%XH \Ht&'@HUSt @H[]Ív1ntelDHtcAMD@H[@H]ÐGenuuineIuݸTHLHà PH @HHHXH \Ht|X \HJt&AuthaentiUTH£HH@HLH PHXH\Hf% XH \HU`H]ÍUhH]ÍUuu ]]D$$vuFuE C]E]v]u]ÍUE E EE]v&U ]Éu0t8@Cu+s t e354$$֋n]u]Ív'U$uƸ]Ӊ}D$0`$@B謴MډpluE]u}]Ít&}]D$JD$hH<$jt @E؉uD$JD$hH<$At @E\$4$u댃=@BlC @B[&UWVSà 1e= t dH k<|YvtJGGu=G t# e3U$EE<$ЋUU~mU$]KU=M@t$$L$8xM̉|$L$$xM܉K CECD$PJD$FFu1F t e3$E0E4$Ћd<9wD‹Mk1ҋMtPE E|$ $ىD$ e= t-dH:C1҃?‰Ѝe[^_]e= t-dH=@B @B\$4$UMiUMt`t$\$iUMtF,L$4$UMiUMt"L$$iUMe= t-dHuhQ dHdH dHdHdHdHdH}닐UW`HVSUE$fE$D$ht!~I7u؋][^_]Ív1t&$D$zhuUBV$T$aht~vuˍv뮋]F9C|"vtEt$t&[P뎋C ;F }FCFCFC4$5P[^_]Í'UWVS8U؋MDr tDr uɉt3Dr u; ω&DJ u ue[^_] t&HΉM@Dz t&Dz utDz u3 EM}fɃDJ u u냋E&E䍴&DJ uMvDz ruMEUME$GM؉ $mEtHEۉ]u܍D$JD$hH4$E uп }D$<$NjD$p4$;jÍ@E؋EM؉${u]Me[^_]Ít& MM DJ tvDB uE}ى]EDB u5ڋ5} ʉˋKCDG tYyDJ tfDJ ueDJ Z5vDK u  u9#EčJ$Ev DBMЍPDBUԉD$ED$E$o &T: D<1҉RfE] [tH HB]HB}UWV1Sà $D$\t u GG G GG4G G$ G( G, G0[^_]ÐUU ]ʄIÍv'UWVS\M EU ] q<$EUEuxE}Ѓx<t e3=}ЅS}U Uԋ] EE}DE[}$EE]t} _dt&UMEuċˉMU؉UQr9u K9M=Z(,fEˉMuUE9UuUEUM q tE}؉]؋]fFt)$E؋UԉD$T$ |$D$F $Vvuɋ]؋M A A9]s_} }EEЉ$U$MED$T$ỦL$D$\$ |$D$$UЃt(U9EEu ] } w]}tEt} E\[^_]Ã}t }E= }t} w } v$EUMT$UD$EL$D$D$ F \$$D$tE]:E}܍t&Ft)$)UM\$T$ |$D$F $Vvuɋ} G G+9]M }؋<$EE$MU}̉L$D$ED$T$D$\$ |$$U؃tDE9dM } MO}?9}}]EE}tɃ}toEԃP[^_]Ã}t}u&EEEUEU}1҃9s^D}$tE1ɋ9Uv&u Љ^T U9EwM)} G EB)Ѓ9Erw}E9} DM 9]vvEM܍(f*U}} &)ЋUO!}DM99]\]EEv}UEl)ÉػU)M 1QEE @3U؉$lM$}E̋UЉL$\$|$D$D$ D$D$$U؉EEEM]EE}tt }ăfE UWVSlEu M ] PEЃl[^_]Í>с<9}}E}]]u? 94ǀt܉]u;M]z}}UEE&E"M yEƉE؋GUuEЉȁ E]]؉EȋE9vUЋuȃ?UĀMĀUĈmmwEEE؋Uu)ȃ9EEE9E܉E Uw 9uwE UMȃMMċUE9]aMċu} )ى˃)ËEWEԉM8]u]t ׃o(]E}$fE} UwE+U؉>wVU؋}9Uv#? };Uu})׍L9k FE<딋U uM)ىM2E>9]3? E P1EE @Ủ$DM$u}EL$\$t$D$D$ D$|$$ỦEVu6uE؋]EM-k MGE{ uE}u VD>EME9MȉMMuU3UЁ€umU? 9w܋UMu}tkMƃt(}t4t/uEUEމuăU9UMuwEM9MȉMv4%u$uyEuu9ugEȋME)؉EUu)E7>9]v33? dEtk MGU_u؋ME U؋]ȉ1}uԉ}x})V9UU]Љ]Ћu9]uҋEU؉Ej|OH9M€EڋE9EЉ}U؉]ȋ}ȋM9uԉ9E h [>G< 9}}}u4uāƀIu? 9w؋u}t ǃt(},}"MӃсu0fсu)u)Eсu)u?EE1҃ 9Mvw tUE139Evw3%tu;uEu.u!f1}C9EEoZډu u29ыu}u Eu (}1҃9Evw%t}j&'UWVSlu EM }^E9*u{uE U 6J9މEuߋuE}tˋEԃL[^_]Ã}t}uEEvUȉEM뵋E P1EE @uU؉$6}$t$EŰuЉ|$D$D$D$ D$T$4$U؉EGEE}uEU2UE7})‰)fUWVSLM } Eu$] MЋOPE=Ef/}uEU}ԋ 1҉}}M9sbD}$E1ɋ9Uv&u Љ^T U9EwM)] C E)Ѓ9El}E9}EEЉ]M9MwtE]EE=(`Mf}fEEE;E‹}+U#)EU Eԋrkm끋U]}t!MUuEUEU]]EM)HM 1QEE @WUЉ$M$\$}ȋ]ẺL$D$\$D$ D$|$$UЉE M M>U}}E pS}+"}EEE=t}E މӋx M$UED$\$T$UT$UUD$ G $D$E D$Mu-릋ETME9E` EډEEډ΃uVEE3ы})ȉ)ȉE) 9KEEEMEE^ UWVSLEu ] EPU|$T$$ …҉tXB rCCCBsC8C 1t+ e354$舔$֋St e3 Se[^_]Í&UĀ$ ]ulHt]u]D$D$$ jt΍ED$\$$&jEăXBD$\$D$ D$D$$QyTBdTB8$ ujXBH9s\H9vTXftKۍ 9rAH 9v9H 9r11TB$NTBd=\Btr$ \BTBXB$7TBtXB1)T$D$$jnXB9sTBЋXB$T$x\BvUWVSrʼn+MMk<$U̅EUM}EEMEԋUԋEMP UABk B80EEԉBAE8QMUwEEr͉+M븍U܉T$E$Uԉ1,[^_]Í&[f]ҋTBCECE؋E܉$_SU1҉uEE1uC׋XB)UEE؍49ffR9EvED$E܉$t];u>rɉ+MfSE)ЋUԉ,1[^_]ÐUSE Utu8;dBt8CPw%CuCt$ Ct&[]fkfUdB`BD$$(Í&'UVSEED$D$`B$'t6t#CStHOщS[^]Ít&E$p$'tԋU@t$$T${CCD$D$`B$,k$1끍D$$CD$7 $C tpD$= C$CD$H C${CC e3 C Ct e3 CCt e3 CCM1UE E EE]UWVS1ۃ EUEEff9]ts<`<$dM DЅۉE~,Mt%M<$D$UUDEE "t}uE<땐U:덐Et{MD$, $UtD$e$Uu,  [^_]Í&r4$tދUt$$D$B É[^_]ËM $t¿1EN&9utU` $` D$,=\$$ ;P t}uE벋M뫋]+t&UWVS] } t $B*Bu< $|$qu-t$BA< e[^_]Í&EE$R t 8}E1] t1E$MUE#xt@], t$6EEU U t` < tЋ} 9t=, t$< x9t=, t$hxHt $B@E$;}e[^_]Ít \~D$;$g tDى$UEDxt@|, `<$T$xgxTCމÃuvU}T$|$ D$:$x xu$D$ :D$ |$$$B1c?m<$0Dt*CNE<`e[^_]Ít&|, t։؉ t=s1 tE=, t;`t$e u1t $B>E$8vE=, t$EUUYt&t Dt\ tЋt\9t=, t$4\ ~x9t=, t$=xH t $B=1e1эA)čD$L$\$$ | $D$=tQtǾ)1ۉ} Ut ;Eu ` D$E $D$xt2xtuTD$;$t HE| 7t9\uǐUWVS E5=7&_t4-t/.vt',t":t/tV tt&^tNj  u}UJ/~[^_]Ít&E}t/똺 JUɉJu8z t( H9QtI 9QuAA]f]ÍU\uu]É}U؋M܀8t8tzTuW>D$, <$vt`D$e<$btLE܉؋u]}]D$/$tt&, E,  $ t8u9U ` $t8u$ t&> E<$<1эA)čD$;L$T$$?UT$UT$UT$ UT$UT$$CUD$(\$ H$NjEUЁ` L$$D$ EMԉ|$ D$ED$ED$ED$E؉D$?UЋMԅ;~~1ۅtm}?*EtD$ $u C^CC^ U'DxkD\xuӋU܉gU܃ً T$1у)̍D$;EU1у)̍\$;E܋ u uU܉K~E$D$/$Pt&ʀz/Ju)ЉD$$^ED$(L$$|$ D$ E\$$D$ED$ED$ED$E؉D$/=1Ftt~USÃPtҋC u/C$C t $$[]Ít&uڋCD$C$bC ÍUWVSà  tٸ   E9F;@ 9$$DEtm@@@Vpx@҉P tAN9rEE1 L;Hw2Fv}u < <t>HL$9P wЋE [^_]É$}eEu׋x L$UWVS@@D$U$QED$\$$QE%=@eeEED$\$UD$ D$D$$/`Edt MEtQUFP e[^_]Ë}|<$C|uMd뾃}uE<$D$G`맋E<&,E$'EIU~7u׉މEÉ|$\$4$PP)Dž}uMUE d1E уD9)ċE\$'L$ T$$` Ed/SYS@_U|$$T$$D$^OML$D$$NE1+UEU ]+ÐUWVS2HL$7 CۉPu8|$4$,t t"{9u㋅LH8De[^_]ÐD$.4$tX@<@tBBDžD``4$1ҍt& 9w`؋`\RIX1؉h1щڃIdϋX@t׉t&d;hËN9~u`D$\$4040uY`11Džd t&t| DŽxl|tp~l1dt$D$ D$$PPBك<\Xt&tSClp`TыS9sfCS9ދ[ u牵<plT`BwT8@hp`T ;hUX#\t9Cv;d}PA9rD@T8`#\)‰ThD$D$DD$ D$T$T$L$Z$44`m`hX HTTH0BBD$$ FDD$BD$$F BB|  1D$D$DT$D$ D$D$$40fU4`kX Xk@$lh`@ h`;hLh@h`@h;hLh931;B|%;=BrDdDžD`=BB4$1 Ut$$ Z$B$TP XHe<0  \t$t$]Ðt&0 $t$]ÐUED$D$ D$D$E D$E$ ÐU $Ét$։|$|tftN1$t$|$]ÍvCNjCtTtɋC 뷍vCvЋ\uCZ넅tvfjCv^SsMC C /$99999)49119vUVS] uStcSFtQFT$$u0D$$uCD$F$uF+C[^]Í&F뭍vS뛍vUWVSLxEĉUM܅#EċXSs0U؉1҅XM܉ $eu܉EЉ4$>s,1҉FEȋK4Mԉ1uUE+U)EC04΅9uK ɉMCE;Er:EȋEMDEȉD$E܉$UUu|M9׋u 7BMԅnC04pEE܍e[^_]t&M+EC$;s@뇐CEWfMDgf;u+EC(PU܉E}MMIɉMt C@$V$S<Rt;;<$躾 hCHChCH=hCHhCH hCH1hCH?UWVSøLU܉Mt $C$ UD$(D$ D$T$$UD$D$T$D$ D$\$$Ct $C&t^^~KNt e[^_]Ft}fC@uڋCtЋP܍t&Uv멋E܉$Yt3$E*UԍH)čD$;L$T$$E܍EU܉D$ED$ED$ ED$ED$$tE4t $C3$UD$(\$$CT$$UD$T$ UT$UT$UT$UT$U܉T$ t $Ct^~UNtEE$2fFt݉fC@u͋CtËPUۋU럐UWVSUe9Ct%1e= t CVCCPCVt6Cu"Ce= t-C e[^_]ÍvFFPD$$-5ED$\$$&-}E|/D$\$D$ D$D$$E<dDžt==h $h謯t~F|8tCSC1?C WʉM1Ƀ} $t<$$Ft&FCCqCe= t-C e[^_]Ë|$Ԯt_‹|etxމӉωE~-)r |$\$4$,uݸU<t݉xd7&OɉKO ɍ KOɍ KOɃK,EvO MMf҉C4K0MW$ʉllWʉUG ȋM)čD$'ɉx\ K 1hdӉX[Tʍ Ʌ@| 5 P+Izj  x ;EuT 륍&C C$C(C8C<tC@D$$ ED$$UKdS`~%qW#OKO KOKOEf|<$T$^9O;`LHKz 64 f1zRuzIuJd`i\pt`uotut xtXuJ8:1F3Qz2t&uzu`c\ QpoY ?pu -px pX &O$lEdhKGEG FhdXG(ȍTG,ȍPC,`XDžhDž\dLHfDžpp hT`Cȃ1tP99u[^_]ÅxE]4&EU!t&t;t%4$vx93tuًF Fэ&Fݍ1[^_]Í&'UWVS8XDž,DžDž4Dž$Dž 4 0fx9,'jދ,')Vہ'Fۉ(;,|()|$҉T$D$<$(0$wT$L$, G9044 =tW$$$$w $ 5(w 94 ҉44 X)ȃ4 (;(()ɉ)ˉB4vrʉ44540( uf9td=t5wf u|};]v1E}E} $|$U|t{9wǐt&1,[^_]ÐUWVS\E U]EEMۉDžDž1+uUT$L$Elj<$UE|$D$$U]t&U|$$T$Ug] t&Mt$<$L$Ӆx拝91  9Eu99D]9t+9)9r$R9\[^_]ÃEEE9FuuE9rr]NjU&M\$4$L$UH׉)9s;]t,U1} 4  9u܋]ۍK|t&9}ދ &|$t$$Ux苽u9wM9ov 9r3v0ڋֈ)9<vډ9pv^}>+9\)9sS9~5q9]]xJ(E‰ 1f  9Eu1t&  9EuM<$L$D$U1  9EuU1e= t D <; Dt&<e= t-D1Åt։$謇 DUWVS];D$=$ӝ$QƉe= t D~<t/:t)t$\$<$U͡Uu<7=t0:ue= t-D=1[^_]Ðt&ЍɉHufe[^_]Ð&UWVS E$|M EɉtU $aE1e= t D=<Et[7tK]1ۍvEU4$D$T$ u E<=t 7uх]]t UD$ D$誉WEtiE]<; DtUD$4$T$=U5<5 DDe= t-D1e[^_]Ít&ETB)č|$\$]UM<$\$P=]$\$] \$褧ED$`D$D<$FUMt[$UyU|$T$$@;D$`D$D<$ve= t-D$U.U$Uhy1ɋUe= t-D= D4$}auft.7Qe= t-DMK;ED=EE)čT$\$]M$U\$蛥=]$\$] \$UD$`D$D$蔻UMt 0Bɉt*EU$ )ǃu?~;|$D$ $K+\9{>\t$T$$P9Y>+\9D>\t8~4|$D$ $sK+\9>\H(7LD$%$趖ƉNj)։t$T$$P9+\9\?q!$l@U׋@X)1L$#Pk$40D/DkA$ 8T$D$P$g=,)ƒu?~;T$D$ $J+\9<\|$P$L$P9<+\9}<\t8~4T$D$ $I+\9<<\@D($pWG$T$)ЉD$QW+W9>+\9+\$h$9k$40O ЉʃЉʃЉʃЉʃȉЃW ЉʃЋW,DW WGG tk ҉,W:Gtk DS6,9DMD= 3H 5A)čD$# PDž(H҉4/3<3G,1ɉ)čT$#@G$@k ;rދ@|$$L$42e +\9R \fk$409k@$ 8E+"Epp1DUm:D8D1Ƀ)čT$#}|$ D$D$EԉD$e ,),>*ud,t[,D$ $D$EP+\9P P\T$|$$P9 +\9 \tT,tK,D$ $|$D+\9[ \|7k$40ZC;C[9%C\ \d11 󫋅<\8XH` d     ȈdedhN/N VdN|UM|E܍E܉D$XD$$:@ +\9\dn'VdVɉ@t؃ډ4׉ẺUDž8 <&b4 Tt 8&Pƅ 44E̋P)9<$t}t8u 044+PDž<H )ǃ}"t 8GD @fC;C1-C\T\t 8(~/|$D$0$A¸+\9\P+4t$$|$P9+\9\pD$D$`$蘁dDž8…!HSt 8^Exx1<U1<1<1)čT$#ML$ <$D$EԉD$3` ) !uYtUL$D$ $'@H+\9H~H\T$t$$P9>+\9+\t=t9L$D$ $~?+\9\$f8 u3~/|$D$ $?¸+\9~\CV;Cdy+C\H\aY|$D$ $>~d}LLH u<11эq1эq냃PP@0ƅ Dž<iPPA0ƅ tl~dڅE‰@EDž8 |$T$$P9+\9\eFd놃D{Dn112C;C60CLG0 RV6<A<։LkG$ \6%PP@0ƅ y~DžDžM}Dž4DžDPMC;C C,1ɿ6PEC;Cb0C\C;CHC\\3EDžDžDž4"~dDžDžEDž@й,D`\X<D P P< P P P P deh. }EE܍XE܉D$L$$UC;C\0C\C;CHC\\ ~dݝ|w3kG$ \PPB04ƅ k@$ DžDžDž4E4k D8Ѓ LOЃ v4zL$m DFDD4P)ĸL$#CljDEtt1@U}9Dw_ E)׃)1ɋ4@ ED$PL$ DM؉L$)D$@<$7u4C;C 0C\C;C} C\\mC;C 0C\lC;C C\A\,XPDž( D1эy1{~dݝ|tKV\dsO  ZyuB~\dD$0$ZKN\df8Yh1щL$h$~z$@T$$z($:D$$YD$%$s! \1Qih1щL$h $}(L $ $L/(PH$D$D$0$D$%$vD$#$fXD$'$B3D$-$ DžDD$+$H$D$D$0$D$I$|mD$ $RCD$+D$-$$D$.$RL1Dž7]t)D$-$7uQhD$$n_XD$+$J<T$$%C~;CsQC\\V2D$ $jT$$u<$\<$+tQM}ԉL$ D$@|$$|.+HUA1)čT$#ED$ L$@$L$%.lP(@,<t t :Dž k@$ g $脿M $*H6D$-$(D$$D$P*H$4k$40@ڃ ,WO Dž[Vd|PDC)čD$#PH(]\$$(TD$+$MD$ D$ L$$P)C;C)C9lwϋP}ԍML$ D$@|$$+>@=UԉPwuP1Ƀ)čT$#ED$ PD$@$D$%+TD$%$$v軼xP $'ml"i4$qv4$'(ػ(Pf<$:<$z'((PLl8"<<Dž<0Dž85D$ $6Dž80D$$lXl"@$Bt@LLָDž<1эy$:&([(PLD$ $薿6u2D$-$bCT]$D$&jD$0$D$+$ҾrD$ $设$D$荾3D$0$oakG$ \fdt1\Fu1\)\f81 =adz %-I鏸U1ɉVSu EZ}v#)؄t"9vxu[^]Ðt&1[^]É'UWVS˃qt yf,CS 9D$T$ D$CD$D$C$FSK sS )х҉6ut:{B uQ 4uC EC [^0_]Ðt&{ED$ T$|$<$ftS KS E[^_0]Ðt&S C3D$ T$D$$F0[^_]Ðt&QB҉A0[^_]fC bUWVSӃL$$MEo$.ED$ p$,EċED$ pƋER+]ȁC)čD$EEUȋMĉ\$T$ $N}}ȉf9]wcPЀ wue %t$4$,F)EȅtM1ƍ<vLL u9]v}u Eĉ$+Eȍe[^_]Ð}um}Ȉc<,<.uU1׃у)MʋEu$$ EEoU1׹EĉT$UD$E܉$D!UufE.1׹ẺT$t$$!RfE,GU̐/t&'L$qUWVSQYIEEEMS ȉ׉M e5uJ$MR0US M416v4uM1}wmu}476v4ɉ|Džx6MD|| t&EDž|DžxU(<$۽8M ۭ8}Eve5uJ,M9u 1v$u҉UuR0Ut&}$ݝ8+݅8]EMESP%EʺEЋ}C!s PtEE E}D$ |$E$8484;uo}&$ݝ8݅8(t&<$۽8@ۭ8uESP%EʺEt&M416v,u"&1C @BrE1]]9CXX;XƒXuK uƀ}]tzME‹EEv\?w\42)D$+`DžL`uălt }f Mu1ulDžh~;tu`V9}D}lth4pM Up1HDžtMv;}| 9}~L}~=M0uօuҋpE~ɃttpE뮐EuMH88457 sNFHME99}0HU} t&9u09uU}UH;p E9E HEtpEM9M9U}%~0FuƋMv~0Fu ƃ9|uC uMV9NUt uEtX@Efuą}}-u  t& 9}gfff)ʉщ0E ։Uʃ07}Es dM+ld)׃ MdS0M |$T$E$v;d]E}REPX B;B -BC  ud~ {0-U1DžpEC D}}UEU*M}HEElT$D$}<$8ы89 ֋LhdC MdD$CD$U$,;dHL`4$at&1s PvC @fM MQXB;B+Bht&M1]]t&E 8C;CC9uۋ]vC t}xXE$j31EExtx$F3XЉE\MǍDL<TG)čD$+E}Epl9}t|u|]f9t<9vP9uML$ML$$8:8ύML$xѐ+U^t| HHHEHMM9HElEE9ȉEr69}lt&909v}}f% l1}EEuEh 9TuTT))ʍ4]t&T;u8EEfEu EETT+UU\"vU3uu\EDžTEp}G;G-}G}G;G+}G}G;G }GxlhEX)D$T$$GlU|2]t&MlhMLvu|M)h)x)<t%u ]]9hv EE덐t&hl]Dt&9r}X<}U}WXB;B BMA;A -}G}AdD$0|$E$;dd ]zlv MAXH;H ƒHtL`$t&]D$ \$}<$Ef҉։U}ąE}DžTHD0M\pTҋEUlt 9ENEE )9UT$ E)D$E<$D$8n8MET$ E)D$l $D$nME)DuQ)UC E~}E8dL$CD$]$l{E}`El}DžhE0m~ )DžTVF;E+MEIE|DUfnuUMPL$ U|$$T$lMlEE Džp‹EEE؉E9C >SE9uD$ET$D$ D$E$mMSʍrE։U׋UЉU)ʉыU440EP9P9UM)E pe2B1ɉt0Ãυtht}c+E9uD$ )Ήt$h|$E$kEu&}GmP9uދUM9 &u͋}L;Mst&T$D$T$ ED$E$kdT$L$u4${@UB;Bk+MAhdD$0T$M $7]1t)t=UF\DžTEpySg'HpEt M )9Uzt)ET$ EȉD$E<$D$84j8)u}T$ 4EȉD$U<$D$i}4ET9<)}ElE} +MEUlpEDž\E&+E9auD$ DD$)Ήt$[}B0u D$-U$KYL`$ UB;B  MAEDu)΅u~M1]:9u]}E}lD$ ED$ED$E$kUu }NE9 )T$L$ t$E$gt Eup])ET9hllh1D$ E$"JL`$U D$ t$T$E$IgW}1DžlDžt1L$ u|$<$t$4f4EL$ UD$$T$fEME +EMEED$ D$L$ $5fEFvL`<$L ED$ ET$D$E$eUMUUEeh11E8YUlEA`1`hD0WEE 8CA`% EhElDžhT$E$4G4@$>ɉL$$88e*C :&D$+}<$84\G84}D$ <$84a84D$- $=e}ftiHp MtEɉL$$88QX‹pEEpC tl9Hul90DHpEtLMPD$+$jMH$E 8D$-~HED$ aD$+@0j@$4D$+}<$EY<$ EfUSg1҃}…D$D$$l$8lMЃ9EJs'EM $X`<$JzuD$0)ƉD$Ѓ$rE4$884$8/8DžL`D$-*T$E$PDD$ $uUS]1e= t D]Ht9HM U1e= t-D8[]ÍD$$4HtHe먍&'US]1e= t DHt9HM U1e= t-D[]ÍD$$dHtHe먍 DD3 DCDhUWVSx] EKT$h$S ΃t$pute=$J$L$dR0$pS T$ltwT$<(|$tۼ$\<$T$<$ew&e5$z,|$d$pS T$luT$<ݔ$\$\$$T$8uvw8lUDžDžpDžLDžWON JZwTUDžP Dž$DžlDžhDž Dž|Dž`DžDž,Dž<DžHDž8DžDDžx ȃ Z'N Dž|Dž먃 ȃ Z'N Dž|Dž먋hHu2~.\$D$ $%¸)9A42BX!IP;PI PHHHt2~.\$D$ $薾¸)9H42xv>D$%$ÉNj)\$T$ $P9z )9k ޅT p2t(u2~.|$D$ $ͽ¸)9k<42kp4e-\kA$ PXW<B;BK<B/<<(t8~4|$D$ $#¸)9;42x $[SCT$)D$<$Q‹C+C9)9 փpp9 kp4K lj‰lj0‰艽(ω4ƒXd{ ЉʃTЋStCSC @tk \8tC':Ctk \:t9M=2H <6)D$#<Džx@0H0@@<q0S,)čL$#1ɉ;?C$k \؋C<t  ?kp45d2kC$ \80P:D$D$$cDžÅ4"@S"]b2$L$3!D)܍\$#Dž1ED$ ET$D$$ 5t)0(u>t:T$D$ $-)9=41|$\$ $P9s4)9RD(t7t3T$D$ <$襸)9.440@kp4j1hP󫋅lU|EE`MD]  8 H < , ȃE$S KEUMEEUED$T$ $M;)9340 Z.Dž8w ȃ Z.N Dž<4 ȃ Z;+N DžP DžHDž| Dž<@`]؉EDž8Džl, `Dt |/DžP ` E؉)؉9l)Dt }t|u)0lHDž`H`҉`th)ǃ}"DDt |GD8uu <tP DPX9=B;B-=-B>Dt |#`~.|$D$0<$致¸)9=42|$\$$P96)95SXV=B;BJ=%B'=kp4d)kp4:k@$ \TɉXt؃ډTdEȉUDž )-d Tq#ƅ T dEȉ)ىȉd9d(DžTHT҉Tt)ǃ} Јt GD0uXu 4t XSPX9B;B9-B12t T~.|$D$0<$¸)9142d|$\$$P92)92kp4!S|lU l$L$諹9)܍T$#Dž]1߹󫋅\$ $D$ED$O-h)2Hu>t:|$D$ $蝰)9g041T$\$ $P90)90ރHt=t9|$D$ $)9c040m$G`0x\$#E<$ L0?31ۉ1Dž Džx k4M\$T$<$L$ *zË9xwxP)ԍT$# x$9Dxk4D$D$= AЃ wDSZЃ wCZЃ vt $v҉hyډhDžP DžHh?2hv(h<e0G)čD$#<8 N Z0QЃ w JQЃ v퉅?<3v"<?3G)čD$#<8$hOȃ Zn!N M*&PЃ $k TЃYЃ vЉl‹h9l! Z ȃ Z` N Dž Dž`^ ȃ ZMN Dž` ȃ Z$N Dž| ȃ ZN DžDAXI'P;P='%P'wkp40k@$ \kp4{,)čL$#t'kS$ 1\փ 49r답PX0B;B/%BC t2QXn0B;Bb0#BC y0PX/B;B/'BC @!QX,B;B,+BC  t,QX1B;B1-B{0N,C t8QX,B;B,IB,CM1һ `u99H;Hs>H--9oAXuT$$ uA<t X&񋽜0HD$D$ $`Dž|tL ( ȃ ZN Dž, ȃ Z8N Dž$H0EPP ȃ ZhDž||DždP kp4k@$ \\TDUDž4Dž0dEDžX kp4/kC$ \\$EED$<$š/)9#40-kp4kC$ \\$EED$<$')9vx:x4$!$|ZhHu2~.\$D$ <$¸)9)42$kQX!J;J!J H,Hw\$D$ $ߤ¸)9It(u2~.|$D$ $膤¸)9@$42kp4k&\kA$ $]PX&B;B &B%%(|$D$ $ɣ¸)9Qۉt؃ډ`E؉UDž| "Dž DDž5kp4 k@$ \EDž@xDžDžDžDžX 4 , ft Dždƅ g}]P)0d:#EDžxDž,DžDDž|Džl Dt |1DžDžP Dž|1hP󫋅lU|]E`MD  8 H < , ȈE$E2S KEUMEEUED$T$ $!')9$&؋5, E$\$D$@o DžXQX"B;B"-B tt}t TTt4TD$0$D$蒟¸)9\ 42dT$\$ $P9})9a+Tt|$)D$ <$9kp440QX%B;B%-B%hDt}t |`t4`D$0$D$V¸)9q%42T$\$ $P9 )9+`hb|$)D$ <$ȝ9Jkp4i T k@$ \Dž4Dž0DžXEw E苍9CɋA<Z)܍|$#ЉT$D$<$Gk )čL$#)܍\$# \x1҉XdPsK$D$Hx$L$t$ 4; sDC tCtC,t̓uK(s$ xs0C$4뮋Xd1ɉ-} EPU 9~=&v&&uHiCC뒃4n QXB;B+BG;DžP X`Dʃ| || 1҃|u샽Lt$,tL$xQ| )ډЉ<<QX#B;B#+BnE4QX B;B +B<%QX; B;B/ +Bƅ @X`Dʃ   1҃u샽t$LtL$Q  )ډЉd===,E(P U; tMDž<Dž8DžEmDžlK`Dž<Dž8DžEDž|Dž4Dž|DžDžEPUEPUPS $L$fDžƅ 1T@Xd|$D$$L$D$ +Lt$tL$Sà u؉tclP l$L$蘹DžN DžP 1`X||$D$$L$ D$+*Lt",tL$SÃ| $؉~.|$D$ <$褕¸)9y421~.|$D$ <$k¸)9421QXIB;B=0BQXB;B@B&'$l%&DžDDž<Dž8DžEN;QXB;B.BM1һ `u狝NBXP;PP9wKPXB;BBS]gDž4 [TdMȉ]Dž0DžX<Dž,\$T$<$P9;)9!43Xuxk@$ \Dž4Dž0DžXEOTDž4Dž0DžXE k@$ \Dž4Dž0DžXE tr򋝜Dž|Dž$`0QXB;B0BQXB;B{BY7l1у&llDž1ۺTcPX- B;B! B  _G0ƅ u_)؉dG0ƅ v ڃDž| E‰ELعXUt@M d}< ȍ 0 ( 4  ȈEEdE WO EUMEEUED$T$ $諉.؉_G0DžDžP +0 QXB;B BعXUt@M d}<E ȍ 0 ( 4  ȈEdEWO EUMEEUED$T$ $`Dž`ƒu"d1Ҿ u답dƒuR1Ҿ u답*6Dž Dž`DžP DžH$蒣DžS8]QXZB;BN B%E=?<EG)čD$#<8`@\  Zkp4Tk@$ \XڃXDž E‰EDž$(Dž_]8QXB;B ByDžXjƒuDžl0QXfB;BZ BƒuTDžxv|$\$$P9 )947N Dž8Dž<l\QXkB;B_ B'DžlK$?؉|)ÉȉT/kC$ \z1уQXSB;BG0B$QXB;B@Bt(BX&P;P0PBXP;P Ph_G0DžP `BӃك0 vfll=S?t6Dž1TfZЃ k DDžX-D$ $]dt-10H:TtM1 L$$Xul1ۋ0<$4I<$xMzo1f0-ID$<$'D$%$D$ $XDž4Dž0DžXEfO@|xu)čD$#$Ht$TDž4Dž0DžXEl<$2<$xx7"9$]$D$y$@P\$$؃ tCK Dž(dYNCL$$D$ $nDžLt)9w547L$$uD$.$T5^SH=2'x<$PwX4@,L<t tDžLH4@,L<tDžLdYNC8-f0nD$ $lHDžl@Dž|D$+$h+rDž|@SH=2L$$ $PXcB;BWB;$<$- ~D$-$AKKQXtFB;Bs>0BD$+$)D$0$uD$I$>|L$$LVK@D$$%D$0$1Dž |<$7xx <$踓<$D$U[U"7]>\$L$$Ix7)9j D$%$_iD$'$58?"!<$K*tM齿D$#<$<$Bxx ND$+$kuD$+$AGKQ]'D$-$.D$-$ND$ $~$žkp4GcX@D$$",!D$0$D$-$2D$-$$'E$ tDž>k`UD$${)D$0$D$%<$D$+$y2xXu2k@$ \%Tt*k@$ \XL$ $$%ϻ$t,DžȻXukC$ \0D`kC$ \8f0$Džlg$L$$HD$0 $0v'U씁D$]Éu}׉|~$t]u}]Ív~($S<|$]ԉ,|~DžDžDžDž`T$$tƸE@o ]f;x?SHe|~9Bt'1e= t SH|~BBH P)~*T$x~L$$Px~9иEf;xSHBBtAED$$~E\$D$@o $a)t&Be= t*u&릍 "鋰# "#ѐUeWVSQM(AqI (LDChcChƒ$7DOy$ I(9EщP҅҉BE@o ]f T(1TEE,Dž`DžhDž$Dž0DžXDž DžDž@DžpDžtDž4&oT%GDV4DB pC;CK0CptltHDpV4lDB t {;{8{DB uቅpl9p1lTt!1f;;t 74e10t70$0Dž44eY[^_]ÍT$袯TUT$ $D$ىyptvdtTK;KVK9ӉTdplftlf@L4FDž4fTDž<ƒ0 T^a dId`d h%9&1tftT<-<]Tߋht&<]j<- Dž\Gt1HlH=!<)-,,t1@lZH@Dž\pC;C\K0Cpp% tl1pB C;C.Cpt1d)dp#p+ p-ƅDpG8nYi&p0/!1ƅ8eHthƅp\ lHƅt\0 ։wz;`p׈ 2dO p!C;CDCp1d)dpl0 v@88D7dOdth 9p*:tz\։hC;CFCl9 >uË h\p 6t`\Ӌtv7;9ΉuCʍy)|$tt$D$<$땐t&-\zCЃ C;\;`phpp71d)dBB;B)Alht&\ 8tdPOdt9P<6pǐ;`ht0?B;BBlpt9ttDpdhNd;`d6C‹h`)č|$\ht$<$L$ApCp`)čD$htht$D$t$蚥tht&DG4DX&@Lh9t&tpЉډ9Ptp6t҃lT$$PWp9vJdމ4$D$v9PrPdW)plPp)tpHp( DC;Cw8+Cppl<nZDpw8C;C,+8Cppl<iDpq8C;Cs4Cppl<lp8C;CB0Cpp)`hl0Džt` p1hd)dC;CD0Cplp0DžtddWh)d`9t5t>0C;C=CpldtDpG8HuH<#,,t1l<(D<\%,,t1tlzD$H1W<(L0LDž4D$H1;<(TXh$38LTp\$pl$D$^` H! 0ʋ);$T$$pcp\$덋<(D0<(T D$x1<(D<(L @LDž\ j<(DpH 0$D8Dž04 ppl$D$ucl9t*H$DW4E$LTd6Cʉȃ)čT$`t$t$|$^p!t $]0 )9@<(T0<(T 6=CЉЃ)ĉ`T$t$t$|$S3t$hDž``hpFHHpC;C8Cptd~dhƅ8p*<(L0g(<<DEЋD$H1 6=CЉЃ)ĉ`T$t$t$|$} @L4L$hDž`I$L@D$\\fDž`ht$Dž`k@L<aD$hDž`p\Jpl$D$~P1<(D$puL@c$p$}~f-1\d)d`u*\t$fAFDž`pFdC;CJCDʋG8Htu $hvpC;C?Cplh$.|$/ƉpEĉ1󫍍3Eĉ $D$t$J Ƅ311у9u, 3t$<$7l ƉHx1 h$,D$;‰l ‹1󫋽MĉL$T$<$IHk}Ƅ wh\֋`8:D7x΋pDž\`dhOd94;v^G;GNGl봋 1эA9L$ 3<$ ƉL$(u t.hF0$|$舕‰DRP1эAL$P"$L$tW$pL@@L<<$Ll@9sgtlɋhL$$ڃ9v#hD$ $֍C)lV)  hppplD$$l)dNd \p`dK907dphB;Bs>hpB1dl)dUld$puĸL`h\@\L@`h<`h\w6B؍C)čT$t$t$|$qt y `h\p+t p-H9t^p7d*DpA88:  9tg87ƅƅt6B؍C)čT$t$t$|$p[6B؍C)čT$t$t$|$npR 6`P9tT3`ۄ 6`9tq3`ہ`C`_)܍\$tt$D$$o_ƅt`C`_)܍\$bt$D$$4o>ƅt?$^pL@x$)p$ pL@o$bpLt@~$p@L dht$Dž`T$$ OtF0ѥ$1X$p$$0D$$N01Xr$gvp8HpDž\d1pdOd\tt1\w$D$m;\Xu։t 9{suF%t&pAl9uJ>tf}ps$QU79BƉIM{ xC(Tt&C(Dt&C(3vC(#vC(vC fC(vvC(vC <0C(Bz}}0 wdz J M}0 w#uf2эGR~Ѓ vuut)}$u#}PS9BƒCME UCE щUt&ut]C(C(t&}PS 9B‰QK UUT$$PHx'E%= u̅~ % D$D$D$ "D$D$$&t 40D$ t$D$$qx[^]ÍvMU% -wú OW&C8$`)ΐUE]] u}$Ef;x4SHe=9zt!1e= t SHzBChupChUt$$T$P9tf;x'KHAAuAe= t)uc]Ћu}]Í&uf;vx'SHBBuBe= t*u $# 2<딍3ڐUVSuF^ )t%D$D$D$ "D$D$$t T$D$ D$4$9h[^]Ív4$FnUWVSu ]Mfx6SHe59rt!1e= t  SHrB $Et U u"M x$xU8{s)E&&${sE)EMt$<$L$>Ft)EEM E 9ȉMv59ȉϋMC|$U$,UME 8{MEUt$|$$^KUs@UMfx+KHAAuAe= t)[^_]É$~u 믋{s)fe붸eKif;x'SHBBuBe= t*u $  JאUWVS M }E| t#0EtU䐈 uU]1>~0D$U<$T$Pƃtփ [^_]Ít&~\$U<$T$P [Ɖ^_]ÐUS\$ED$D$ D$D$E$E D$ D$D$E$D$ D$E D$͍Ĵ[]ÐUWVSPU }E t#0MEtuM]1>~0D$U<$T$PƃtփP[^_]Ít&~\$U<$T$PP[Ɖ^_]ÐU]u$pu1ۋu؋]]Ít&CHD$ $tˉ$D$ǃ t$ t$$D$ +E#ǃОE ǃ؋u]]ÍUS]C;Ct&SC+C1[]fD$$kfUVS]CS)Љ$D$X(tC+CC+CCE ][^]VUWVS}$dPT4$ED$D$ D$D$14$E \$ D$d\$ET4$D$E EОED$觫dhl))9r.p\$$,'tQDĴ[^_]Ít&$htčST$p$T$Ep$"up륍vp$"뗐UVSh`D$ ED$ D$D$$E $E$D$谍tI`$%D`ED$E D$bD$$ƋEPh[^]É$吐U$]]u}f;x4SHe59rt!1e= t VSHrBD$D$ D$D$$Wщ‹Ή׉u tuBfx[HCCtUt& }։1҉1 uV]u}]Ðshs,+s$)׉։u뛐t&Ce= t+듍veK됍e maf;x'SHBBuBe= t*u $h 衪Ūc蹪אU]]}} uu1ۉ؋u]}]ÐEt$D$E$j9t1ΐU,E ]]uu};߉D$D$ D$t$$Su'EE u };]u}]ÐU te E< u uM볍1믐Uuu]] }4$8NjChuBCh|$t$$P¸9t t&]u}]Íu뾐U]]u$8p4$1tt$\$$&A]u]ÐUuE u]D$4$BÍ@$u1t\$t$$@]u]ÐU1M S]toٸBt;u P8t&tFu6v-t :t/zBtzBtzBt 9wɐ9G)[]É򐐐WV1t$ L$͉f8uFth8ukFtO8uRF<uF uF F uF 1ׁG1ʿs1ׁGuV1ׁG1ʿh1ׁGoVsf1ׁGu[1ʿ61ׁG=V s.1ׁGu#1ʿ1ׁG"8ut 8uFt8uFt8uF^_ÐUt6~&ffoftft $tt&o]ffs]fÍ&fs ]fÍ&fs ]fÍ&fs ]fÍ&fs ]fÍ&fs ]fÍ&fs]fÍ&fs]fÍ&fs]fÍ&fs]fÍ&fs]fÍ&fs]fÍ&fs]fÍ&fs]fÍ&fs]f UWVS4E }u 4[^_]Ívtu] {u8t1fqu ~foE ff: fD$ foѺfoL$ f:c …ÉtbfftfσT$Xf $t$fo $f:c ΃L$8q] D$\$1ۅÅE L$mD$L$fD$ u[foL$ fsfoD$ f`f`fpftfD$Ѕt&=D$tD$BDD$D$9L$NL$π?nfoL$ f:c … t$_fD$ t&foL$ f:c foLfD$ 묅f $.fo $f:c …Åt1[u [vjZffftL$ ftff971f$fo $fD$ 8ȍvcD$L$)t$TPtTPt TPu@@@ÐeUW} VS19}t*J81ҍt&E4+u u[^_]ÐUW1VS] utv4$=0tu[^_]ÐUWVS}u <$ 0X$E U u>vt'9u};v+xt%u܍vtU1҃[^_]Ív븍vU$U}E1Ë}1ҋE[^_]ÐUWVS] u}u !Ɖ\$4$#)ƒZw߃[^_]ÐUWVS}]<$.p1vvU MD$$‹E҉ tNM t&t,9u};v(xt"uِt&E 01[^_]Ð뻐UE M18t]Í&Ut$Ƹ$1ҁ9v 1$t$]Éсw$ft=u%렉%ft눉 $fj%?^ ƒ$$f@%3)`@t&0 f1%%?1t&'UWVSӃ$EMVUUU})ʍ4RMfItkED$@ D$ D$BD$<$ptP9titDtÃ@uE uf1$[^_]Í u=\Ht 뀍vE봃=XHum^U)tt@$[^_]Ë@$[^_]@닉'UWVSuEEEE}UMta‰M4$uvMډ4$ucUM4$suOUM4$_u;M9MvM돍v0U땍w }E[^_]Ð&U@H]u}t t*]u}]Ðt&蓮@Hu֋DHDHEELHEDHE1t&;Uu%E~1ƋE~ E25qEdEWuǸ~=wHt uFE4vvM\Kt& t1밍1}  uMvtuM!؉YfDHE:f@HUS]tt3t1[]fÍ&c@H܍t&[]&DH[]U1MtLQtCQt:y u#+|Bt | BtBt ƒ|Bu]ÐUWEVuSM ‰ǃv. JJJ w|tt OuO[^_]ÐU`]]u}؁v]u}]Ít&tÀte8w~xu,t(t e3=ۉ<$襨\$$돍EEEU؉EE׉E1]EEEUԃ8EXt e3$:ED$ED$D$D$D$ ED$ED$$ӃttDEE >wUDE$D‰D$ E D$ED$ÐUW DVS\uEM] UDDDžE؍FEeEEEEMEuċ8GڹBыy t e3=]<$EUȦMD$D$L$D$UT$ UT$UĉT$E$׃tu!9ut1҅tU)ڃ\[^_]Ðt&tڃtUT\[^_]Ívκ U=GUUW(DVe5SPE]RX)ԍT$/DDž[E܋EEE8E]ȋGX؉E̋G/P zt e3=U <$EEUT$UD$D$D$D$ D$T$Eċ@$׃t~Te[^_]Ðt&U U<$E迤UD$D$T$D$UT$ UT$UȉT$Eċ@$׃t}E)؍e[^_]ÍvE)vE  :;GUe E0DDD$ ET$D$E D$E$\ÐU8DWVShEEuEED‰EeECx_t e3M ED$$Mu$MĉM싅L$D$D$DD$ E D$<$D$ED$ӋU)tu zt$t&ttTh[^_]Ðt&M 14$sUԉuJD1ljMMUUUԍMčt&E$'UT$MED$D$$D$|$ L$D$ӋU+փtt U  08C!U@DWVS`EUD1ۅEԋE EEET$E$7e\C8wt e35]UE4$UEĠED$E D$D$D$D$EL$ D$<$֋U+UӃtHtDt/t+t&vtT&`[^_]ÍvM uM 뢍M 1ۋEEԋPUUEEEԍUčM4$ϟEMD$EL$T$ D$D$D$D$<$֋M+Ӄtty Y]6CJUSU Mtgtat`AtYt]9t&Xt8|t1Xt)|t"Xt| ttu[]Ð[]1f㐐UEM u&t9u]ÐUWVShEE]EEEԋEE0FZxt e3=uQE ۋ0UMu쉍UUEčEf\$4$<$\ȝD$L$D$D$\$ D$T$ $׃t~tyuU+UM Ӊ1tM u M …!ʄt"tteTh[^_]Ðu9u){t#U])hv뜋UUE $]MD1ۉEԋPUUEEEԍE쉕Uĉt&u<$eD$T$L$ D$D$T$D$ $׋U)ӃttE 1ۉ0 2FUE.‰WVSE )iQ)] y(&ÀQxQ~t&QQغų} )‰Wi)Ӻ)‰Wk<)Ӻ$IY))Љ)…҉W_vQ)kd9u)iҐ9Bn9BȺˉ)im)É)ӃFIEQUUU+UUUUыU)щMMiҐ)kdM+MMMU+U)ǸQ))}+})}уI)}+ukd)i}+}<)Ӄ)<9imu )مm9UۉBJu9Q)kd9t )iҐ9t1ہà C9~ S9])SK [^_]Ðt&WUWVSE]UMߋs R[TGIp1҉EG h* ‰؉|)ȍ IE)ˉ)؉EE1TU  DžxDXPxT<;LTxEQXhE1})EE ME)))‹El\Fim#E+l@k<pk<Px`EL0݉p`)ȉ1)ЃQ`DždEEEEE}|$$U q1Q)É؉))ljh)‹p+A+ytA)؋])imuXE)Љ\+l@Njxk<tk<+ 8198uw~ F99Uu$M;MtM܅xU||<Å8u@mV]E1}U]d9dUP+`EU9TUMUQUĉQUȉQ ỦQUЉQUԉQU؉QU܉Q UQ$UQ(İ[^_]Ít&u11Ҹ ډ9t9fxl)UMuT$ $U tމ9uɅuF)뒍İ[^_]ËEQE)¸kd9}1fq}]}\$<$U W|U܅xg;|t_x[p, fUp, <}߉U89‰؉U8u}t݉Et&EUD$$U t|9EZu뽋u1Ʌt㉝dˉt9tBx.)ߍME}L$$U tǍ&)ЍًtɋdnfMUMT$ $U N`҉)ȉ1)ȃ)+``Pux1u1<T+xE<}D$E$LU L98T98Eu1Qp)ȉ+}))É؉ӋU)ËEph))im+}xXE)\+l@k<pk<+E U98uJOM]EL$$U t1uu~tuM]}L$$U uuXu1EB9tx')EUuD$$U tމlj)׍JLI'U U8ED$HDD$$zÐUWVSuUUvR UUuR(U uΉEE9E+E}t MMEU%u1EEF^<0t{i<#<-&tfЍrЃ EEEƉE}Eu}MUNU$I+N4 )}EU}ME2Ee}EM}MUqU@}En}Muuu}ELM}MUqUU&UDEMEB%|$<$uE)ƋEIEEE+E9EE~>}0vC t$D$ E$UMuB%|$M/EU4M1]]LS<TMucu,uEIƍxE+E9_Mt@%~'}0B Ut$D$ $uMMt&}3 u1IƍxE+E9Utȅ~$}0 Mt$D$ $uu u뒃}OX}EsMM}E3EMOUqUMuEAEAEċA EȋAE̋AEЋAEԋAE؋A E܋A$EA(4$EʍEƉE׉Ut&gfff)‰Ѝ)щʉ؅EЃ0ɈuE}EguEUv@RuƁ~+uUlEU$I)‹E<))D8E1Eu8EQE)¸kd9UuU1}$Im)lj+E~))ЉEU)DxEEGbg$E$I}MuEUu)ru1IƍxE+E9cE@~$}0EUt$D$ $ uM M}EM}MUq U0}EE}Muup U}O}EUUUDE҉EOUMB%|$<$PuE)ƋEIEEE+E9EUE,~;}0lt$D$ E$UMuB%|$MiEU4M1]]fLS<TMu}EmE}Muup&U  $|H|u1)IEE+E9EBM1~0}0yM|t$D$ $|uEM1]]U49t&ULS<T8u&t$u|$<>4$:}fET$|D$0$S|U)t&E+E9ZMt&MT$|D$ $|UMU)9UOEs<$t$D$0}U1 M.TE<0]]1Ut&ULS<T0uuE|$t$$MU4REEM|$T$ $E48=1 M.Dt$D$E$U<2-MM49U1]]Ut&ULS<T8uE|$D$0$^Et$D$0$q|uEQ}MMEM)kdU)JdPUuOMMEE8`bUU:FsUU:,@u1IƃEE+E9EEt4~$}0Ut$D$ ${uM-MuuU1kUu*оduUf1u$ImE+E~)‹E<))D8EDEt$D$0$uE|t$D$0$|uoUt$D$0$|uUE RM}OUq+pp0UpUEl@$E~11EUEEP 1}1эq)IEE+E9E}~*}0y|$D$ E$M}Q }1E<0t,]]1UULS<T0u]}k|>u M|A yuM|$4$L$E48%E|t$D$0$|unEt$D$0$ut$D$0Ot$D$0t$D$0t$D$0'Et$D$0$^uMt$T$ $E<0|$D$0&UEMU ED$ED$E$EÐUWVStBt $BF/FE}Gtt $B/[^_]ÐE'U}9ztk4$D$SÅEU䋶EPt&1;+DC0F C D$$=C$D$$')4փC(D$$SC,4D$$SE}9}vgpFCVS~ }{ FECFCN9‰K~{41;+DC05t$ZE@t&9M|E9f몍$TFK1rVF UU$}Gpt&U$Ét$֋RtJtk4t$$]ÐV1uߋ$t$]Ðt&UWVSÃrF~CK[ E}]1?fz99t&|zuu;r |pt&u};z~b49]vUr9~z9|Guz9}}|:t|}9}t&uȋ};z}븍wI1[^_]Ít&uz}벍};z fF};zfxf1v};zxt&몐UWVSÃxtbGuSGtB$:G t/1 &G 44$D$pu܃[^_]$Ct1rC {k'UWVSӃ EE䋂Et $B*CtPuC@ EE1EvU<<$;Ev%D$E<$D$UEuDӉUudut $B*}tEUE [^_]EEUSÃcv 1ۉ؃[]Ë8ttU$B)UBtHuЉUUBt(@ t!t$Bq)돍&1ލt&Uc]Éu}v1ۉ؋u]}]Ð8ttU$B)UBEEpuX@tG$UBt\1 UB<0<$D$LNxuًUBt!?$B{(.1މU$3UBt1rBB E3USXt6@@$C $C$$|[]ÐU҉]É}ωuUtnH~]t4Cw4F$a@p@ @@]u}]ÍvD$D$$PEy1}te 2d1 2fD$D$$EH*v$ t =UE8t!D$ $Bx 1ɺe1ÐUSEt$][]Bve[]ÐUWe=VS]E1e= tKCsJȋJCKJ u7;C rK~K~C 1CÍvu)E1e= tku&[^_]ø1҃<uȍKYkC9YАڋ\$zd=lÐUWVS &HCtHHJu1 &CƋCtЃD$pu܉EaelEel1һ e=уhָxd=Htehel1ee GG`,v$`@H@@$``9uYa1ǀhr]tt]쐋P tҋ[@u<e[^_]Éeމ4vEel`MtJuuPtҋH„tPte X̀vuċue[^_]Í&ESUd]Ud]Ud]Ud]ÉڋL$\$!d=.jÐU}} uu]u7C=Mȉ $M"Mu1/t&d=wQxftD]u}]ÍuD$$`ҍt&1ee &h$8둉t&>UDEĉD$E$ɅÐUTWVS$u UЋ]6d=w|upUЍ~UԉVU؉VM܁N MV4V8NUVUWUWUW UfWUW~$F$GGG $[^_]e ᐐUS]-d19ãLDw []Íe ېUWV1SӃ$ɉEM~NR11&T)9փ9EEFU)čD$҉EE~D1҉u։9u~&\9F߉\$ $L$Ua)ߋUuҋut$UT$E$U؋M1tEU$^UxhUD$蒭U_hUDF T$\$$fU;PD^vPD:/ h҅t 1T9wEU VDM|$$L$rFGUE5G4ENv/|/u<&H/u$wM:/?/-MUe[^_]E1:/1 9t3|F'11Ҹ $iT$\$<$UMkUM܅uUW1VSӃpu ,fFt!Ƌ$D$Aue[^_]Ðt&$FP $U腫Ut.@ \$T$$FFwe[^_]$W1ɉڸ h'UWVSÃ(lPDU܉M)$s|$pPM܉U9WUEPT$@ <$D$Ehڋ]1v|tcdU؋HL$M $D$oU99E@۹> E1ۉU؉|$$oU؃95hw]Ӄt U9P?}tPM9u LEEU$D$T$oe[^_]Ít&?/l&aM$L$UoǍvU]ˉuu }}Et$ 't#FtN@ FkL4$GE$t G iE1ɉډ$Eft&FkLǂG몍&'UWVS8EEUUD$E׉$%Ee EUM1$ED$D$&M3‰u Myruf~LFf@Efx* TMA,I4 9MM]9]U& M9:urvzvڋZM3;Ẻ]U'&3KL p9wt)ˋ}̉޹u҅UKSC[[Gt)%9-t&Ee[^_]Ðt&uUF,CU%?)čD$L$$ED$%Mu\$L$4$$9MA,F)D$B\$UЃD$E$T%Mt$\$ $a$U9KẺUMD$ D$EЉ $UЅu~ELFExE u4$#UظEMA,U؋4D؀}uCMUD$ \$D$$UztU1,1뷋}1эA)ĉL$MD$$L$NjE$}zMytO1X_Uػ4Jf141(1uF<tt 1E1B xEfUWVSEEU|xlxDžtPD1)1T$UU҉l&pGpFD$F D$E$ hEE1uFt&/MD||;hCÃ|tdPT$D$U$wML$U$T$a+}pGD$ED$U$UME,‹D> E>;hCUfEteEx tx0p~UtMkALGuDlU}T$M$L$uE%=@tyD1 Ef<$h*M h|$M$L$the[^_]Ít&te[^_]D낃 ׋M$ L$vgR=TET$D$$hWhu E$e$5N9pNpxUzt $趫}pM&UWVS`UT1|`XED$`$D$e kELGE]܋Mux& ti u11 u܋x31 uċ`$M $軪Te[^_]Ít&E pG@ XƅSq ED$UT$E $MTE=  |AYdTA,f\fXY,A|;dEXL@)ԉL$CU9Up` ]uƅlDžxDžh@B&uVWVfZ&ƒ U9vQtdfRtdt&buVt4F8FdLJ<F0F,< Qp DXU9\xB \px|p\Rt )ƃ|QT$`D$ T$Qt$T$#L$)Qp0+lV@pCjPuS C9tGlډ\lD t#\;tF9sLC )ȉ $D$D$HDDCHD\9tBxpR9S9K)‰L$`D$ L$KT$L$$a(DžlhVHVLIVh:f GV˃Ӊ<C^tZt+VxpGH뢋];$UD$襂U։$ E N D$<$tҹVA WA ?EAfUH,UWVSTEEEPU䍴&]xX{ډE1Pt&t :t}}s1{1LN t t :t\}1D$$$ծEE[^_]fX{ ډE1Ott&t :t}|};utU ~:fEt&Sv/t&ttM :učt&v/t&tҍt&}M i:i{v]fWwESe}PpE/ttu :f(vvfkvO_! U$D$$$]ӉuƉ} u8$葰p4$֋1tt$\$$.]u}]D$$Et1уMtbtktb1уlGU9CED$H1tD$ T$\$4$(eb@v1b‰@v1돍&UWVSIM G1ɉھt<:u44$荊ME$L$D$$7Ge[^_]=TduE t:8؈Et}uۍt&t*:utuπ:tۍvu1늋E$胔$11Ҹ =G荶UWVSӃ ɉEMoB|E1Z\ttًӉFxCHtF}uދHTL$@ $D$PD u׋E싐iىӋ}t&t&FxCHtF}uދHTL$@ $D$pPD u׋EtW}t Ce[^_]Ðt&/BB1t&/B넍t&pt$vCxCPr׃}u֋PLv*T$@ $D$茴WHD 붐/At&‹lUJ4PEQM$EM싑Bv1}މ׉ÍvQ}׋U"t&FxCHمtH˃}uڋHTZL$@ $D$茳PKD u}U苿l EM}HK5G=95<#ދ]!FxCHً˃}u֋H|L$@ U<$D$谲UKD 몋G\O4PQ$lمN/BF\tmN4PQ$%RtuLJǂ/#[dž빋Et&UWVSӁHkELGuBfv t,u u EtЍe[^_] t&ED$/$5 0ډEt;uD$t$$E EPEED$ED$E D$ |$D$E$e[Ɖ^_] t&pG@GW8t$T$D$ E\$$D$HLӉ$諧pG_Q=\tXGEM D$E׉D$ED$D$T$ $\uet\EM D$D$ED$D$|$ 4$fƒtzpGB$>G%t&kULG:O4PQ$QBE %*tlED$D$$%t&E$tet =pD$ D$UED$؉T$D$@$pkELG둡GU ƅfED$ED$|$ T$D$$bp;ltEtuV\F4RP$t[<ցƘEM D$E׉D$ED$D$T$ 4$WdžFXZV4RP$T$:1A‹}kELG%LJ=TYD$D$$褧=D$ D$4$脧}vqGvUT$E ډ<$D$ tcǀǀx9B\J4PQ$cR{$1ɉ$4 :U\$$T$B!E$赇:}t!$1ɉ1b:ǂe1ɸ$84:UWVSt&YЀ :wЉ ɃqЉك0]yЉ w$]fɃtQQЀ v]:_Ѐ w2]uƉύt& \HHЀ vu];uM])؃[^_]:wЉ v;8u+"[^_]Ã[^_])밃뫐UTDPvÍv\D$T$VTDÍv'UWVS8pGE*TDE3}XDU=G \DMt& 1ۉt$<$euEE}GE2EUEE)EkUT49UMU& XЀ :wЉ pЉ؃0]xЉ w$]ȉftPPЀ v]ȉ:_Ѐ w/]ȉMǍɃ\A A< vM];uP]ȉ)؃tv]]u9u%EEMRUT49U1ۃ8[^_]:wЉ v_8ug؃uuus}kD49E‹EdʋMMM),}\DG MSk MD)‰Ek UT9U-EMUt&,XЀ :wЉ pЉ؃0]xЉ w$]ȉftPPЀ v]ȉ:_Ѐ w/]ȉMǍɃ\A A< vM];uP]ȉ)؃|gMM]9]AUйU]Ek T9U:wЉ v8tUUyK0]ԃ}MuЉ}b]u1;u~kUD49Ev*‹EPuk}L0tJtE9u}…ZpGM\$$ {<8}jt&kUD89E܉Evt; XuGt k};D1+E>džE9ut7u.EEUU҉ЉUtt9uE}EtM1 M9Ev]9ttуMPTEUMu>$h]MkALG9G@ 1eu#ee Xdt$h]]E9E9uE;TuU;Pu1t $h}t e}t MM]\$ut$ }|$E D$U$MUEUUtv9Ety19;tBOE;T@U;P1M<t@1ۉ]FM;]vUD;09wuU9voMtpG@]SK:uLF^8uL\$1ۉL$T$ D$$p%(O,E $7btft,H $MD$L$UtUt]U1$:$1EmUWVS }$ME4D$PiU$i^M荓\CXdhSUL$t$$蛎UBU䉃\EC ЈqGUlǃSkULG{ &‹B u\SZ EkMLxGG |GPTxG |G'UfϋluUU1\t9tE _P1 0M썃\ $U蝄U/Ee 1ҋ}]ÉM$U|$NnUt'\$$9뀉M<"t]$3j [^_] ǃRGE$_DžtvUM$T$L$Ѐx/Pu9ExD$]4$x/t/fU]u}@u]u}]Ít&8;Fw܋F )=vȋ<-49r)1))ƋA5F@u 1낉 $P1rvU4u։}}ԉ]ÉL$<$Q1Ƀ@PS1<$4t&USà HG؉!L!9t)D$T$ $x]e S1$ 'US Ee+@e DًDD04L$,)ˉ$D$ډ\$D$$v []U]u}@t8;FvQ11$F )=vً<-49r)1))ƋA5F@u]u}]É $PfUWVSEe@MvpG 0]CxEM}A4@EuEEEFdEt@E؋Fh@E܋}Gpt xu܋EUMUM8EXɉU9s9C3 M >9]wҋM9E U9U0Mq땃}M]k]Lt ve[^_]Ëy|A,@P]Xu@x ҋUDUUsUB8@E1҅t@9G}4tt9sf89wM@9uE$}F}U% _}]UEp]} EDC ڋ};h}#} Є}%}$})} 1ʋM} U t zD׋}M;D$E T$UD$D$ $HMU(lj$1tBtJ  }*v\U1ɋEUt,RK9"D$E9GщT$$̅9uhu>IU$ UMЋ]9u1Ǎ&E@q]SP)9uS~ 넍t&Ei@F}+P9uKvE1@}9u$t& D]9uit&E@F]P)9u.M9ufU+E9u&}9urfuP U]B|ۋ@u܋ME]A(@]E9uR }v^}>؁E}EE -M}A ; # Є%$) 1҃}‹M ‹E E} MT$UD$D$ <$D$UNjE($1tBtJ   *v[E1ɉ7Ut0]RK9  9GыMT$D$ $q9uE8f$]}ЉыEt@a ]SP)ʉS~ 롋Et@ }+P|Eq@]d\DMLEA@E ]P)ʉ!UU+E }%E~ u܋U9O}G(puf];]EEEC=GULUD‹W4RUUD$MD$T$ $ EUM@REȉMEڅɺDʋL|$\$t$DЋL$ T$D$vD$ $D$$t&D$D$$hdDžM'UHpGuu]}u&`Dt`t$T$$Ӌ]u}]=`DUB L$E߉T$EUM܉\$t$ $M܋UE떉4$U҉HSt kLHu yt[]ÄDHkLAA _ GA[]Í&'U]ÐUVSx9tE);w!t&9щt")9sJ9ut&[^]fUVSÃB$D$at%vu (vvt$D$au[^]Ã1[^]Í&UWV1SӁDE Džf~.UDŽ %t ɉDŽ%PHƅ 04E*Dž1.DžUZluNja%st&&de[^_]Í&t t%tu)ɉt % sU$at;GEe= tDUU<> Ӊ9}G8fyfe= tlDUlD9uE؋Mf]e= tUU;|Dsre= t DMM}܃f R dDۉExDA AfCe= tlDe= tA[^_]Ít&MxD 9tZft$=xD&ۍZft 19u9tUF 덶UWVSd=GXP9y G1ۉى f 9sI8u@tpL7H#!9F9Gك 9ЉrQhDDƍD)5DƣD艅v1|D|D2DžxMEEEEEEċEEsecoEndsEfEEE̡`GEs$=ZáG$.ZD)ġ`G\$'$D$ )/G$T$(.pro@file@D$D$B$<`D$|$$ױxp%=e<$KD$D$$;X\$t$$D$ e[^_]Ív>|D@DžN}ez&Uu ‰1Ћ1 tB<$eG\$D$$D$ D,D$|$D$ D$$t$蹿<$8TЃdDE EpDrEu?Pu2ƒED$ D$$;\uBT$ $菿Dž1۾eGe5B)čL$' $T$D$^D$G#<$D$̰Iːt&G#\$<$D$" <t̋u)1t ft ~Au1t ftpD@D$$-tDD=|DxDpD9s8=lDtqk xDtD 5dDNt&D XDNj3 W:f{fu5D)9s*1҉øwvI1D$ t$T$ $ChD!ev@11҉fPr)Åu$.‰Gt9B|Elj>BED GDe[^_]1ɺG G$PU E$t$|$DtHe ; Guƒt/$t$|$];BsF[);9s;Ls1͍U =F$t$|$uFBF$t$|$]áGF F9w091)9rIt9)9s\ t9vF또&UWV1Sà xUGEGt&9s#|ut$7U9r݋E$7}t+ $t7 [^_]ÍUWVS0E\F@ FEU1҉Eu];3]9EMuЉUԍ\ |vM䋰D)ыUM DD04+0t$,M܉D$E$XMD$L$$tXUEM9 v[9=FGrpNjt܋@K9MCMԃM\DuDDUEM9 w΋Uԋ Fu9Ms][]fUԋuE0[^_]Ðt&UF] u}$\$Z3p1uGu:FD$x$'t38C؋u]}]Ít&vft鐉4$ 51ɍt&{wt&fcUWVS0EFD$X$'lUEB F1EM Fv}];3]9EMuЉUԍ\ |vM䋰D)ыUM DD04+0t$,D$E$MCVMD$L$$UUEM; s[;=FGwpNjt܋@K9MCMԃM\DuDDUEM; r΋Uԋ Fu9Ms][]fUԋuE0[^_]EE0[^_]VEt׋@EyUWVSr Ud~=vjG$Lƍ@$(Gt$$D$TKt&x/Pu9w [^_]Ð[tft5H /DWuY/tbكu$q't+tF|$t$$ST [^_]Ív [^_]ÍQ먐f/HU ]]ue u$11]u]Ë5Gt>1w \1GtD$h1u$&Gt X1G$+1tUSà ;PGu3 XD$!Љ$L$^u \1 []øe␐PQRT$D$ аZ $$D$ fT$UPQRD$T$$QL$(T$$D$ $yZZ $$D$$WVt$,ك)߉3{S KC܋\$$T$|$|$TL$$D$8T$<_$T$l$l$<ÐU]&U]]uK CC D$4$D$ D$D$$C]u]Ít&UVS$]uEEK C CD$D$ D$t$EEc 4$譹Ce[^]US<]D$ D$D$4HD$0HD$CD$$:C[]ÐUS]EUME\$$y VU1t}u]f$EM.E]Ðt&US$E]EUMEE EE\$$0z Ut 1}u]Ív$-1]ÐU1tU]BÍv'U}} E1D$D<$ @ |$0|$@L$$T$,D$@D$<9D$DL$D$@u.|$(1u ;T$PA1t&et$("1u%fe11҃T[^_]Ðt$Dj1E D$D!D$<&T$4&\$LT$ D$P\$LE}t|$<w}G< [^_]fIh:Kc}MU v:'uU}7t&D$ ʚ;D$ED$$lMME }9ȉ}w)111EM}11҃vtv<``Mu T$D$ ED$$kuu9>vvtHt1}E ؉ [^_]Ðt&}U뽸v'U$]ËEuu}ϋM E}i)Ѓ UH3D$ D$\$$M>gMe"sEtgt(~-ً]u}]ÐEЉ}u]}U ]]axuEeMt|e!듐D$ D$\$$UVfU H31 EUWVS]UۋB^Dž|EX$$$}uEO4xDA u-o+DžttEEM1:t/&:  DŽu>}+EEt!D$ D$ML$ $>SuĉuE }}EUډU9uƉ׋E u9u1)׉ME ƋU ))ƒU )EE D$+E4$D$tE9p߉)ރm+E9FQ}},uE }vsv+}1ɾMM*+EEt*D$ D$]\$$Q +M EU0&m }uސt&1ҋu}E)։) щMHD$]D$؉<$tUEċ}ȉEEUMÉM9lj|}TMU}}D$E<$D$VUUU+M})ʍB M MU 9/}p%t&l1}uE)΅X}MEDž|}~"}1&J9uxU19}E}DLv}EEuEщ]Ã]uU]E M)]Í4EFMM ЋU9߉U؋E)…1T$ D$u)}t$}$jOUkڅ҉D |1M9|dEH8PЀ vЋav<_t<)UED$ D$D$T$<$9]{D$|$E$P+E|D$ D$ED$$NMEEGkMEDž|D}}M)MD$}$|$1+u9'UEE EI}1UE؃ Ee"4et"]؃ ELۃ }te}"tktD0 v} XمXU 2X%@EЁXمXtD듸e"[H,M}X(|;v|E0t4}t?M8?1U: u| uǃU 1U U: u | uUTUU)t&UED$D$ E D$E$ÐUW1VSà E1҉MMt&HЀ vMt M:] |H~& uUM911룍vM ~  M`u> [^_]fIh:Kc}MU v:'uU}7t&D$ ʚ;D$ED$$=NMME }9ȉ}w)111EM}11҃vtv<``Mu T$D$ ED$$Muu9>vvtHt1}E ؉ [^_]Ðt&}U뽸v'U(]ËEuu }}L$D$)Ѓ5b T$5pL$T‹a<vD$\D$`L$`uv8t$TD$X|$\|$Xt$HtBt$`D$XD$L8)D$LL$Xt$`&:  uL$`1ҋt$\L$8|$X|$H\$@t$LD$LpЉ v"|$P\$T4^u<0EfD$4t&Ĭ[^_]Ívt&E@8D$TFL$TD$P {D$HD$\aD$XD$<5)D$<|$<Z|$<D$@L$ [^_]fIh:Kc}MU v:'uU}7t&D$ ʚ;D$ED$$=+MME }9ȉ}w)111EM}11҃vtv<``Mu T$D$ ED$$*uu9>vvtHt1}E ؉ [^_]Ðt&}U뽸v'U(]ËEuu }}ME)Ѓ@ U@{pEMU T$DAt&B< T$0L$,9D$p9G9 D$pEL$p0 9wL$pL$lD$XvU tE D$p\$X|$dT$h^\$d8L$h_t8L$h_u|$dt(:L$dt ΍:uÃfuD$XT$X|$X|$`ED$XT$H)$)|$pT$d|$` $D$p+D$l9O‹L$l)‰$ =EL$lnD$l $$|$L$\$T$D$h|$@|$p+|$lD$<9lj|$p~L$pD$<D$pL$tL$XL$l\$`)1҉t$8Ɖ\$4D$\;WD$D$l T$0L$$T$0thۃt1ޅtL$lT$T$0L$ GD$D$D$`$NOT$0T uD$lL$`D$`L$lu\$49\$lt$8T$\D$PT$HL$Lt$t$@D$D$dT$ T$pL$ى4$|$\tt|$d~?T$XD$\t$ T$$D$$t$ \$$D$^ L$h|$\$n|$\ T$dL$\$ttT$\|tL$`L$XD$)‰|$lD$$|L $PDŽ$;T$\ ҍ~&P9uL$\D$PDtD$\T$dD$LT$@9D$ptp|$dʉ\$H׉D$p 7D$ld$pT$8v;D$l‰ׁ)|$8+D$l9\$8wu|$`;v)l$p9sË\$HD$pT$LL$X$D$ T$L$,|$\;tD$X|$ \$$D$l$pT$d|$\҉~D$@&P9uD$h< |$pZ D$p$ ))ǃ@$@ t$\)D$PD$p苌$L$\t$p L$<+D$PWL$L$DD$D$T4$YL$d‹a<&D$lD$pL$pE@8\$hD$d|$l|$hD$Xt;D$p\$hD$\8D$\L$h\$p :  uL$p1ҋ\$lL$Ht$Lމ|$h&XЀ v&|$`\$d\$\a|$Xu\$X<0Eډ\$X밃D$DzE@8D$dCL$dD$` UEu9Eu MD+EExMUEuMẺU9u M&mUE̋UEЉU9EtUuԉщE4EeUv;E‰ׁ)}+E9Mw uU};:vى)߃m9vʋML$ ut$}|$E$9Ett$ |$UT$$mM؋uEԉ1m8Mu9u !UԋEȋUx.M1U}}MU̍129u}ME}|E_}܋7H9ىUMEU }|:} EUډEU/t&;Euԋ}mm7u)Ӄ}}9} rm9ˋE܋EvƉӋE< uԐ9vˉ)΃m+E9v덋UMuE:T9E MuEMx)] M荶uM E+Ex 11&9] uuEĉH[^_]9w9+uEr!EȉD$UT$M $ut$ }|$ED$$UE:)Ev9ivU9EsD}m+]umu}?E܃E܉0EăH[^_]Ðt&1ҋE})Љ‹E4WVS|$t$T$L$1Jt.Pu؍&؉JÉJuX[^_[^_ÐWVS|$t$T$L$|4ڋ1Bt(Pu ؐ؉BÉBuX[^_[^_ÐUWVS@u1U+D$ ML$] \$E$M]~\߻u-t&D$ UT$M <$L$vG9]~!Uw19]ߍe[^_]f<)\$#]؉\$t$ ED$U T$M $uEU ]ڋ]EU)9EM]D1e[^_]ËML$ E |$<$D$n3t.U1~UM&9u1vE~M1] }9u1t&\$E܉t$D$ UT$M؉ $'t$ E؉D$UT$$UU:EE9w/9 {1f9| t뵍t&)UL$#؃)MMEȉ]M̃MЋMTU썴&M؉t$ L$]\$E܉D$Uԉ$t$ MԉL$]\$$M̋U9ӋUЉ]]9ljCىw[9t{~1t&9|Uȋ]UMEEE9cuu뽐WVUS|$t$L$\$ <41fAu[]^_ÐUWVS} Uu$UD$ t$|$U ~OU)t&MD$ t$|$$CM9~Ewt19[^_]ÉMt$ |$T$$qM붍t&t&1f~:9u1Zv~1f 9u1;닍t&'UWVS(uE]t$ \$M L$E$u <}\$D$ U <$T$BMًD$ ED$U <$T$BM]([^_]Í]UM} EщUljMt$ \$|$ $\$E <$D$\$ U |$T$M $\$M4$L$EU 1&9:9uMU\$  <|$ML$ $MMEEL$ $t$D$ MM܉EU\$D$ E 4$D$M*M܋UL$ $t$T$ MU+UMt 9Љvڐt t~}1&9u\$ uL$ $t$6MB9‰$Uσft([^_]Ðt&UM} EщUljM\$|$ $(v\$E D$U$ Tt&U\$D$ M4$L$)UM\$ <|$ED$$MUMEL$ $T$ t$MhM܉Ef\$U 4$T$MzM[f\$ |$E D$U$&xUWVSUu}D$ E |$4$D$~UU,t&U D$ |$4$T$I?U9~UwtU19[^_]Ðt&E |$ t$4$D$뮍&t&1f~B9u1Ov~ M 1&9u1({&UWVS,uE]t$\$ ED$U T$M $EU4\$D$ M 4$L$'>UM ڋD$ ED$U4$T$>M],[^_]Ë]BM} EU׋UME‰Ut$\$ L$|$$\$M <$L$\$ E |$D$U$E\$UT$M $EEE\$ UT$M$L$u\$ ED$U4$T$N~#EU 1t&9:9uMU\$  <|$ML$ $tEEEt$D$ UT$$M)M{\$ ML$E 4$D$Ut$T$ ML$ $Ut 9Љvڐt t~M1&9u\$ ut$ED$$MB9‰Uσ&t,[^_]Ðt&U} MENjEUMȉE\$ T$|$$&\$ ED$U T$M $M܉\$ D$ED$U4$T$| &U܉\$ D$ML$E 4$D$Lv&Et$D$ UT$$vEE'vEEE\$ UT$M$L$_\$ |$M L$E$Ev'UU MuE]u9t\~7)܍\$#\$D$ L$T$4$w]u]Ðt&4$D$ L$T$4]u]fD$T$4$c뺐 )̍L$#L$ D$T$4$L듐WV|$ t$T$L$؃tA))) t&FBGFBGF B G FBGFBGFBGFBG v R Iu^_WVUS|$t$L$\$ <41f)Au[]^_ÐU |$}U$]t$Eu 0Pu4tPuPփ q )J p)Љt&P$t$|$]Ívt<  ) ։p )뽍t&JpU Mt$u \$]|$U $Et$L$ \$]ɉ L$ffɍ$\$XuStmۉXtqt8 ) ߉x)\$t$|$]Ít&tߋuمu͍tۉXut!X)ȉ딐t&@뀐UUM E ЉEEUD$UD$M% ЋU %f ЉD$T$$A% ‰T$$ÐUUD$ M ЋU D$ D$f?ff% fD$$AD$,$ÐUWVS` E}U uEEE؃ҍEoH9tU1ҋEEEUUUEEUTUUU1tt&1҃uE9EUR9։U}(ʉu؋u90|uu֍ UU딍Eǃ<|܃uNo&ҋEt7 fǃ<|ԃu׃ ljNux&ƒu [^_]fUvЃ҉u [^_]fEEEEЉUNԉV놐UWVSEEH4U1MUIVEEM}Et]fN;MEtSvt9uCuu0+U9~'N6E܉Mt }׍VuEtԍt&6uEtE UMf PE܉1[^_]Ã[^_]ËEfUWVSEEH4M1UEEIUVMEt\N;MEtSvt9uFuu4+U9}(N6EMt!E׍VuEtЍt&6uߋMtE UMf PE1[^_]Ã[^_]ËE뎍v'UWVS ]t ft/=ve [^_]ÍDe= t DH)$H DFCD$F D|$$yH4Ve= t-Duc [^_]D$$iHYt&e DD9됐UED$$w^tÍt&'U$]]u}stu]u}]Ít&M UE$z$tʋEtË@uC$*믐&Uu DDD$ $DauÍt&'UWVSփD$p $D"Dt`Ct {uCCKSC t$<$_=1{C1{e[^_]Ðt&$P볍tD$uD$$X}t#]D\$$dGD==D& D&UWVSED$p $DZD$CSt4Ctt$ECE[^_]ÍvCtED$D$$`K 9L$D$ED։T$ D$$2CECC[^_]Ðt&$軡D$ƋC$`D$^K 9t$D$ED׉T$ L$D$$蝜kE냍&D$Y=Do D^'U(]]u}stu9$豈tDD$$]u}]ÍM UE$ tEtHuC$BU u5D}tu u}]fM UE$" tϋEtȋpuD$Ї벐U1ɉU E$ÐUS]EU Mt t3$1]Ðt& $1]Í$t]ÐUEUEEEE EEE" %ɃÍUS]{ Cv$1119vS$D1҅C ]ÍS @]ÍvS ]ÍS 1ɋ] fS ]&D$C $;]ÍS D]f$0MaUEUEE EEEEE# 1tÍvE$YE$EÍ'UVS]uYCSKD$ DƋ5<L$T$$t$54Ht$50Ht$C e[^]11Ҹ$7U1W} 9}VSt)E1ҋH8E4+u u[^_]ÐUWVSE} u1[^_]Ð9}tE1ҋH8vE4+u҉t̃9Uu[^_]ÐUuu]E t%t>xt+D$$?*t(؋u]]Í& 8t܄u؋u]]ÐҍCT$$^뭐UEM t&9tu1]ÐUt$։ʉ$ød=w $t$]e ސUED+tE %xE;pEs lEfÍvUS]lEtRD$D$D$)yĨ[]D$D$D$8xҍt&E `lEDž` & EpEEtEExEE9uD$DD$$aE@BEEUEEUD$DD$$(Ĩ[]ÍlE1D$D$D$(D$D$D$lEUG]ÐU]'UWVS$M<7H4IMH|IT H8Y]C 7IQpJe EMD$D$L$ MT$]$‰a Ee u`EtU1tU2p@  Gu7E Mt$ $64$UzCU܋x`C B1$$ ,GU뷍UWVS Uu؋ZCpG@tD$ CD$C$D$8/E{woEEE~@Ǎ@+1/@NjE䉸GwD$ CD$C$D$.$U9UEe u0$PE$1ɺG1%Dv$1ɺG1%UWVS)ρUˈU9NɉdJdU+U 9ʉM4d| t GdLD ;FGUUMd҃‰M܍L ‹}+Uu䐅Du9e1tޣFĬ[^_]ÐL tGD T;FtĬ[^_]ÍvGUM1ƒML u)څE9s!f1ouE9rĬ1[^_]Ít&d}U܉NjMM)ωMԉ}9׉UM܋IɉMR}؉UU?)щỦM9}OU؋R҉UMЉ‹}} )}U9ʉM}Ћ}UNjMM)ωMȉ}9׉UWMIɉMu}UU?)щUM9}UR҉UM‹}} )}U9ʉMH}}.UĉNjMM)ωMt9׉UMċQt$}M} $ UċE GU}ĉM҉M +UL dUm}DU;Urډd}E=G}fU؋M܋L t G}܃LD ;FSGUUԋ}܋MT dM؉+Mԉ}܋}ԉufDu92t=G}롍uUЋM؋| t G}؃LD ;FGUŰM}҃MЍ L d+Ủ}؋}̉u̐t&Du91t E܋uԉddEUȋMЋL t G}ЃLD ;FGUUM}҃Mȍ L d+U}Ћ}uDu91t[ GME؋M܋ủdE%Mċ}| t GUăLD ;F> GMUȋ}ҍ U}ċdL +Uȉ}}ȅD}99tEЋU؋udE.UċM| t G}LD ;FGUMU}҉M L d+UUċUҺDU9Umt=G}E}ЉdE-Mċ}| t GUăLD ;F GM}U}+} U}ċdL }DU9Uv6mtZ GMMEȉd?UEdt}ă| t GtLD ;F*#GU5fUWVSlE҉utpG@ e[^_]Ë=|Et |EՋ@EkLGEEe|E@E؃M؃)č\$)čT$UU)čt$u܅t1҉񐉐 @ uMD$$L$uD$t$E$&9UM܋u M<u<EMǁ tu$]Љ9~Ff>t]ЍEED$D$ D$D$$,1EEE΃ |1уt&F D$E$W[1e[^_]fU]ЅEtۋE1UEԷEEǃU؍UE.> tUȉ$YUǃu1)|$'T$$o(t Tt&f1S:uL11<$,1)t$'UUȉL$$ (Ut 뚃}vU̹.E8E.> U1҃΃tU|1уCs8uLT$ỦD$EMȉt$ T$D$$M81)t$'UUȉL$$>'Ut 1U EEԼEU1҉EE.> ΃t|1у1)t$'UԃUȉL$$&U ݐUWVStEU‹@4MI@ɉEM}`Af8E9}EEt&EUPkGLŰGv  tE]u}[ &Ë}CKw}̉EfM GW8uL}|$ }t$|$uuĉ4$ EC%9ECEЉEЋC u}̋UB tg‰U`t>11;`s*\E1t݋\4&1 EE}tFM}QB%9ECEЉEЋBt!MЍt&B%9BȋBuMЋuЅu Eȍe[^_]Ë]D$$-lj‹EpMt]@ۉEuX}ЋCH8| PMЁQPSQ P tDMpPJHJH KJ P uƋC t}ËpgMUMBt&@X u+Pppt]D PuËEȍe[^_]EEȍe[^_],EEuD$D$ D$MD$$蛹1EEE˃t8<1у h}W:uL$1a1)܍\$#؍}T$$W"t1뫉'UWV1SÃMtft1ҋ[ օu[^_]fM\uҐU]]uKCD$s D$t$ st$4$m]u]Í&'UWVSLGEġGUE߅toE,HEt:t&;r&;s@[ u˃EE9GvELE릍&Mą};=Gv‹luEM|$D$ D$D$$ESU1ttBR  e[^_]f>E MUD$D$D$ ED$E$Ee u2E MD$D$D$ ED$$BE}̉EЋEEԋE E؍EEeUME]E\$$p RREȋEeu!ee dUu?MАt&t;r ;S111$1эA)čD$#L$T$$XUى׉1эA)čD$#L$T$$~X}t E$5E1ɉډ4$|UD$$ÐU$]ˉ}1uME tTKLKAK6K+ C!% 1uMEE$ED$D]u}]U1ɉW1VU0҉U ׉xwE@t ׋U:^_]fUE]@HÐt&UE]@LÐt&UUM B`BL]Ív'UU EPL]fUE]@PÐt&UE]@\Ðt&UE]@XÐt&UE]@TÐt&UUBt T$$ÐU$t$E hÐUuBc@>ut$;&|lt4$t$]Ív0$t$]ÍvUU ]MTu}Ac@>t :t&@c@t@pH[]Ív:0ÏU]Ɓ>Ɓ>Ɓ>Ɓ>Ɓ>Ɓ>Ɓ>Ɓ>Ɓ> Ɓ> Ɓ> Ɓ> Ɓ> Ɓ> Ɓ>Ɓ>US$<ED$E$yF#E$[]É'UWVSLu ŰUuԉUeU1;EdžMЋQ`QL9UMEUM8ʉʁ@t(tp|/T9t&Uԃ? 9EvUԋMЋQ`QL9rue35e[^_]Ít&?1M1ɍ0 ׉xMԋuD<넍+LrBy p@ՊzI#Z!Ɉ- caaaaaaaaaaaaaaaaaaaaaa ݌t&Uԃ?DE11f0 ׉x}110 ׉xMԋuD߉<7Mp ҍvt vEPEzP BuԉME11v0 ׉x}110 ׉x11ɍ&0 ׉xMD.11ɍt&0 ׉xMD11ɍt&0 ׉xMDMMԋE11f0 ׉x}110 ׉xMȋuD<8UąUċMċuԹ)uԉMԋ}ԋ)uĉUĉ11ɍ&0 ׉xMԉ11ɍv0 ׉xMԉǁ~11ɍt&0 ׉xMԉǁF11ɍt&0 ׉xMԉu11ɉdžv0 ׉x11ɐt&0 ׉xMD11ɍ0 ׉x11ɐt&0 ׉xUMԋUDA11ɍ&0 ׉xMԋUwuԋUdžUMMԋUE11f0 ׉x}110 ׉xMԋuDluEt MԀ|9lt>tT/&t"}t9t>T$$L$rJuFc@uV1t"L[^_]ÍvUא~pVt1uD$Eԉ$U+FHBhL[^_]ÉЃ*MԍEQH$HvUWVSLE 29։fE>ME܉t&ЉPv .t&҉+H|fууyуpzzzzzzz0{P{p{{{{||уy}}}}}yy}}y}}}}}}}}}}}|}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}||||||||||||||||||||||||||||||||@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~@~~ууyуууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууууXzt&Ft&?Ɖ9L[^_]Í&11Džt&Ѓ DŽxꋕ{ MAc@t |1lu3U䉕11Džt&ƒ ׄxꉽu4MAc@t|1l{_&[pPLuMFc@ t|lu M䉍vE<Љ+vUvBv(vvYwууEw2wуw wvvуmvuvvvv0 fEtPTUBc@ t |lu fOWGB&.WGt&O9ʉU)ыFvlt&kMMt&11Džt&ƒ ׄxꉽ&FFFF&F&F&Fw&F6ɀvʃp @Pt&08URX<tLv*<#<]< t&<&< ft DžP x+Ćfywwyxууууwdwyxt'py &ÉDžV̋MIT'MI\ Fvxn&q6G11ɉ׍vƒ ׄx  6U1҈1ɉאt&0 ׉xaV] J7"ꉕ 19191919319m#Z@)ʉ+119 t&'U WVSPPeE1TdDuuE@tQ}ttEgPBc@tBpPT@ttj t&t볋TE@>dt"|tTL\t&uލ&T11ɋЃ DŽxꋅD>D$$/LP1LBH>@t&T|D+Ћsxrr s`stT11ɋPD2lMTP``Ue3[^_]fT>'PD2lL늍&T11ɋ$bt >t>tƃ>>ƃ>ƃ>ƃ>ƃ>ƃ>ƃ>ƃ>ƃ> ƃ> ƃ> ƃ> ƃ> ƃ> ƃ>ƃ>uFc@EtFpEFEEE(EFL[^_]Í&UWVpEU teE1EU$lt&Ot(t$ЋUe3uDp^_]Í&4$D$ut_&UWVƁ@ V84,0v4$t^_]Í& 0|$t$T$ND$$T$L$ ,u$tiEt:|$t$ND$ $T$L$ Ѓ$t1h4[6`$^_]Í&'UHEEUU u}EeU1ҍU]dE$[ 󥍵B B3tUe3u ]u}]0D L EU]u}mÍ&'UWVS( býd$Z&EЅt5Ot$|$L$ T$$L$ЃtGu=uC$$ VH;Wt [^_]fUHEEe M1ɉ]蚯cdEUUu}$ H ut"w&_uދ0L TEU]u}mÍt&UWV`E t eU1ҍ1EE@Et.Dž}e3=`^_]Ít&Tu"ǐt&t;Dt5TT\uҋƋT֍vƋTĐHALfAXhfAZE܉A pAEt&UWVSRPEeU1ҍUd E$ 󥍵$։Ot&utt0t$|$OD$$T$L$ ЃtGu:}uUe3]u}øސ  @ ,B󥋅u B0D L EU]u}mx&UHEEU]u}p U`eU1҉u)$9Ue3]u}]Ít&dEU$ 󥋅t K0D L EU]u}m联 $ÐUEM P9Qv]]Ít&UWV0MEE U|;}ELfEUM<D$D$E$UUMyPEE|69}u~6w9u~UMD$D$E$UUMx 놐0^_]Ðu&UWV UUEEzEx fMUEt$|$ $y~BEtt&UMBQUE|$D$$EɃ ^_]Ív'US葩]FtUBt'؍|9}tIUEE}܉E؋UtE}U؉D$F$r{w UVt>l&@^_]É'UWV uFfUFT$U f$UFT$Uf$U9Uv ^_]Ðt&UWV u +F%UUT$4$‰eE+@UUT$U$‰1U9Uv ^_]Ðt&t&UWVփ@‰Exfl҉EEUEEԉU/fFEV Ut M)9tFtMAt+؍L9Mt ȉMUM̉M܉E؅tEԉɉMD$F$U؉=MUЃT$1҉$$E,w EKMU)9;@^_]Ðt&1@^_]Í'USaüU|[^_]Ív1|[^_]ÍPDžЋ}9xt&MMuV~` E(?,?d `?@@@9uUH?ǃ@@EBE t&Hp ;EMuPMuQp@UFmMFL$N $FvrEt?$AEąFU FBFfFhUT$Uă$‰EU BEăL[^_]Ív4?Eĉ}t&0?tcFU0?K4?Mąt>;:v ;:w JRuV1tEċ}E+@G}EẺD$}EEEEE$ #E܅EEЋU EԉBE؉BfU(uEu ]VñF}FEFEFFfNF t2?<$?0?F0?<$?]u}]Ë0?F0?⍶'UE D$ D$D$E$8ÍUS蔑E$D$E$[]Í'U(E]LçEuu }tu]u}]ÐUVUF FfFVt'?<$>0?F0?<$>럋0?F0?뎍t&UE D$ D$D$E$8ÍUuu]yDt$4$D$]u]ÐUWVS\*ÅD}t \[^_]ÐE u\[^_]Ðt&E$t݋UEtU$EMЀMp Ett&fEPX }q+DfC==C>XBXBXBXB|==C>Et }E؄҉Ey Eč&?wt x11ɈUЃ DŽxM<>}̉ $虱;ủEEǃEpE}t/ 6unE&vuE} wPU+hfA??A AXBXBXBXB@?A At&tvKv@Pp0vu$E}Pul t uE}PuL} zM؉+<A>>Ac?XBXBXBXBH?V?p?>tU}y}ZuE끐t&M $UBUE]$Et&뎐EEt`EE}yM M} tvjfE}Pu} JM؉+l`@>>`@=XBXBXBXB$>2>?>L>E܋M܅t!EE܀}y M܋ M܍t&xU9UU9U9u11ɉ}׍&‰E܃ DŽx}=E@3 %11ɉ}܉אЃ DŽx}MSMFE8E1ɉU} ExU}@ EM}11EU&Ѓ DŽx}U}EM/}11EUЃ DŽx}܋U}EMEE1ɉU}t& E܄xU}@ EvMi311ɉƈUt&Ѓ ƄxU11ɉƈU̍v‰E ƄxUE@ &@P&0$UUE vuE5@P0vj$U蛫UE$蔫Emt&Et&}@}P|}0E$U4UE_$U)UE=$UUEEt&MԉM_$U親UE v$U詪UEMԉMt&MM=t&EM $U7UErM܉ME܅uuED$D$E$?D$D$U$$t$M $襩jUWVSDt $h"4G}5GEE~NkLGt1t&q;r;s@EĉE[ uӃmLEąkEL1Guċ} uE$&|$D$(4$Uuj[ tc|GEE̋CUEЋPEXfEءxGE+EUȉE䋃DUEt$ãE농Ǹt $h2D[^_]Í&؉M$tMt&UHGuu }}]tVG1fE؋ GxGEUԋ|GEE)ȉEẺUډUt$D$($ׅu t$<$]u}]ÍvUt Eh]2]ÐUSXtXfЋu[]ÐU55t1fPdT$@`$z]5@\5uU;t$;;u硄;$;UWVS1ۃe= t <uR<؋<QHe= t-<u+uڋ$du[^_]Í <}d롍<dUWVS}_ W11fH~,@ t% e3$EuWډ$EЋW<9w wB $W Gkt&E$]Et&UVShHtD$$`HtDCtCt"Cs8/u$tt&Cs8/tut eNt eN t eN t e@N t eN qx=, t$Mx,  UWVS5 CtSt&F>$t&tDPtҋD$ ~ډ4$t벡B CtQBBD$B$SBu%vCs D$$S$juރ[^_]USHt=&HC= t$C$$ Huʡ=At$CD$$9CCt$CCu[]UVSCu+t&Ct*s $m$euك[^]UWVS @`=t2WU܉ $UzUBW t1z v9u| t1MЋŰE؉$UĉM(E܋MU@E@E܋E܋EUEE@ MԋẺUЋM؋U܍v9| t1o UVSGtG1u}L95GwFCtDt8S t r 1t$t u9w$9CGG$[^]ËCP;hGq dG$Te Ut@1e= t :u':D:e= t-:u]Í :R̍:RUS[`%lY[DisabledHomedir req.Passwd not req.Temp. duplicateNormal accountNMS accountDomain trust act.Wks trust act.Srv trust actPwd don't expireAuto lockout(unknown 0x08)(unknown 0x10)(unknown 0x20)(unknown 0x40)(unknown 0x80)chntpw version 0.99.6 110511 , (c) Petter N Hagen\SAM\Domains\Account\FLogin counts data not found in SAM * SAM policy limits:Failed logins before lockout is: %d Minimum password length : %d Password history count : %d \SAM\Domains\Account\Users\%08X\FCannot find value <%s> handle_F: F value is 0x%x bytes, need >= 0x48, unable to check account flags! Account bits: 0x%04x = X [%s] %-15.15s | Failed login count: %u, while max tries is: %u Total login count: %u Unlocked!\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-\%08Xlist_user_groups(): Cannot find RID under computer SID <%s> @list_user_groups(): Cannot find value <%s\@> User is member of %d groups: Data size %d bytes. list_user_groups(): DEBUG: Size is not 4 * count! May not matter anyway. Continuing..list_user_groups(): Could not get value data! Giving up.%08x \SAM\Domains\Builtin\Aliases\%08X\C= %s (which has %d members) Group info for %x not found! Cannot find path <%s> Cannot find value <%s\@> User is member of %d groups. DEBUG: Data size %d bytes. DEBUG: Size is not 4 * count! May not matter anyway. Continuing..Could not get value data! Giving up.User was member of groups: =Administrators, =Users, =Guests, , Deleting user membershipsAdding into only administrators:Failed to add @ value to key\SAM\Domains\Builtin\Aliases\00000220\CGroup info for 220 (adm) not found!Promotion DONE!No RID given. Unable to change passwords..lmpw_offs: 0x%x, lmpw_len: %d (0x%x) ntpw_offs: 0x%x, ntpw_len: %d (0x%x) change_pw: Not a legal V struct? (negative struct lengths)*BLANK*dis/lockADMIN| %04x | %-30.30s | %-6s | %-8s | RID : %04d [%04x] Username: %s fullname: %s comment : %s homedir : %s ** LANMAN password not set. User MAY have a blank password. ** Usually safe to continue. Normal in Vista** No NT MD4 hash found. This user probably has a BLANK password!** No LANMAN hash found either. Sorry, cannot change. Try login with no password!** LANMAN password IS however set. Will now install new password as NT pass instead.** NOTE: Continue at own risk!Crypted NT pw: Crypted LM pw: MD4 hash : LANMAN hash : - - - - User Edit Menu: 1 - Clear (blank) user password 2 - Edit (set new) user password (careful with this on XP or Vista) 3 - Promote user (make user an administrator) [probably locked now]) [seems unlocked already](%s4 - Unlock and enable user account%s q - Quit editing user, back to user selectSelect: [q] > NOTE: This function is still experimental, and in some cases it may result in stangeness when editing user/group in windows. Also, users (like Guest often is) may still be prevented from login via security/group policies which is not changed.Do you still want to promote the user? (y/n) [n] Sorry, unable to edit since password seems blank already (thus no space for it)New Password: No change. NEW MD4 hash : NEW LANMAN hash : NEW DES crypt : NEW LANMAN crypt: Password changed!Password cleared!\SAM\Domains\Account\Users\Names\list_users: Cannot find usernames in registry! (is this a SAM-hive?)| RID -|---------- Username ------------| Admin? |- Lock? --|\SAM\Domains\Account\Users\Names\%s\@\SAM\Domains\Account\Users\%08X\Vlist_users: Value <%s> is too short (only %d bytes) to be a SAM user V-struct! %iValue <%s> is too short (only %d bytes) to be a SAM user V-struct! Failed to write updated <%s> to registry! Password change not completed! offkey-in-registryenter-passphrasekey-on-floppy ---------------------> SYSKEY CHECK <-----------------------ERROR: SAM hive not loaded!\ControlSet001\Control\Lsa\SecureBoot\Policy\PolSecretEncryptionKey\@Not Set (not installed, good!)SYSTEM SecureBoot : %d -> %s Not SetSAM Account\F : %d -> %s Not Set (OK if this is NT4)SECURITY PolSecretEncryptionKey: %d -> %s WARNING: Mismatch in syskey settings in SAM and SYSTEM!WARNING: It may be dangerous to continue (however, resetting syskey may very well fix the problem) ***************** SYSKEY IS ENABLED! **************This installation very likely has the syskey passwordhash-obfuscator installedUnknownIt's currently in mode = %d, %s-mode SYSTEM (and possibly SECURITY) hives not loaded, unable to disable syskey!Please start the program with at least SAM & SYSTEM-hive filenames as arguments! SYSKEY is on! However, DO NOT DISABLE IT UNLESS YOU HAVE TO!This program can change passwords even if syskey is on, howeverif you have lost the key-floppy or passphrase you can turn it off,but please read the docs first!!! ** IF YOU DON'T KNOW WHAT SYSKEY IS YOU DO NOT NEED TO SWITCH IT OFF!**NOTE: On WINDOWS 2000 and XP it will not be possibleto turn it on again! (and other problems may also show..) NOTE: Disabling syskey will invalidate ALLpasswords, requiring them to be reset. You should at least reset theadministrator password using this program, then the rest ought to bedone from NT. EXTREME WARNING: Do not try this on Vista or Win 7, it will go into endless re-boots Do you really wish to disable SYSKEY? (y/n) [n] Updating passwordhash-lengths..* SYSKEY RESET! Now please set new administrator password!Syskey not installed! ===== chntpw Edit User Info & Passwords ==== ERROR: SAM registry file (which contains user data) is not loaded! Select: ! - quit, . - list users, 0x - User with RID (hex)or simply enter the username to change: [%s] SOFTWARE-hive not loaded, and there's where RecoveryConsole settings are.. Did not find registry entries for RecoveryConsole. (RecoveryConsole is only in Windows 2000 and XP)ENABLED (1)DISABLED (0) RecoveryConsole: - Extended SET command is %s SKIPPED (1)ENFORCED (0)- Administrator password login: %s Do you want to change it? (y/n) [n] Update of SET level failed registry editUpdate of login level failed registry editDone! <>========<> chntpw Main Interactive Menu <>========<> Loaded hives: <%s> 1 - Edit user data and passwords 3 - RecoveryConsole settings 4 - Show product key (DigitalProductID) - - - 9 - Registry editor, now with full write support! q - Quit (you will be asked if there is something to save) What to do? [1] -> \Microsoft\Windows NT\CurrentVersion\DigitalProductIdchntpw: change password of a user in a Windows SAM file, or invoke registry editor. Should handle both 32 and 64 bit windows and all version from NT3.x to Win7 chntpw [OPTIONS] [systemfile] [securityfile] [otherreghive] [...] -h This message -u Username to change, Administrator is default -l list all users in SAM file -i Interactive. List users (as -l) then ask for username to change -e Registry editor. Now with full write support! -d Enter buffer debugger instead (hex editor), -v Be a little more verbose (for debuging) -L For scripts, write names of changed files to /tmp/changed -N No allocation mode. Only same length overwrites possible (very safe mode) -E No expand mode, do not expand hive file (safe mode) See readme file on how to get to the registry files, and what they are. Source/binary freely distributable under GPL v2 license. See README for details. NOTE: This program is somewhat hackish! You are on your own!AdministratorLENidehlvu:Unable to open/read a hive, exiting.. Hives that have changed: # Name%2d <%s> WARNING: File was expanded! Expermental! Use at own risk!Write hive files? (y/n) [n] : w/tmp/changed%2d <%s> - OK%s Not written! None! gJZ-:֩t\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevelntreg lib routines, v0.95 110511, (c) Petter N HagenREG_NONEREG_SZREG_EXPAND_SZREG_BINARYREG_DWORDREG_DWORD_BIG_ENDIANREG_LINKREG_MULTI_SZREG_RESOUCE_LISTREG_FULL_RES_DESCREG_RES_REQREG_QWORD  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~malloc failure%s%02x :%05X %02X %xBuffer debugger. '?' for help..Buffer has not changed, no need to write..from: %x, to: %x, wlen: %d %06x from: %x, wlen: %d d [] [] - dump buffer within rangea [] [] - same as d, but without ascii-part (for cut'n'paste): [ ...] - change bytesh [ ...] - hunt (search) for bytesha [ etc. you may give 'string to enter/search a string? ܵµ== nk at offset %0x ROOT_KEY%04x type = 0x%02x %s %04x timestamp skipped %04x parent key offset = 0x%0x %04x number of subkeys = %d %04x lf-record offset = 0x%0x %04x number of values = %d %04x val-list offset = 0x%0x %04x sk-record offset = 0x%0x %04x classname offset = 0x%0x %04x dummy3 = 0x%0x (%d) %04x dummy4 = 0x%0x (%d) %04x dummy5 = 0x%0x (%d) %04x dummy6 = 0x%0x (%d) %04x dummy7 = 0x%0x (%d) %04x name length = %d %04x classname length = %d %04x Key name: <> == End of key info.== vk at offset %0x %04x name length = %d (0x%0x) %04x length of data = %d (0x%0x) %04x data offset = 0x%0x (unknown)%04x value type = 0x%0x %s %04x flag = 0x%0x %04x *unused?* = 0x%0x == sk at offset %0x %04x *unused?* = %d %04x Offset to prev sk = 0x%0x %04x Offset to next sk = 0x%0x %04x Usage counter = %d (0x%0x) %04x Security data len = %d (0x%0x) == End of key info.== lf at offset %0x %04x number of keys = %d %04x %3d Offset: 0x%0x - <%c%c%c%c> == lh at offset %0x %04x %3d Offset: 0x%0x - == li at offset %0x %04x %3d Offset: 0x%0x == ri at offset %0x %04x number of subindices = %d == db at offset %0x %04x number of parts = %d %04x Data list at offset: 0x%0x parse_block: FATAL! Zero data block size! (not registry or corrupt file?)USED BLOCK @ %06x to %06x : %d, 0x%0x FREE BLOCK @ %06x to %06x : %d, 0x%0x value data, or not handeled yet!find_page_start: zero len or ofs_next found in page at 0x%x find_free_blk: FATAL! Zero data block size! (not registry or corrupt file?) : Block at offset %0x find_free_blk: at exact end of hbin, do not care..find_free: zero len or ofs_next found in page at 0x%x ERROR: Registry hive <%s> need to be expanded, but that is not allowed according to selected options. Operations will fail. add_bin: request size = %d [%x], rounded to %d [%x] add_bin: old buffer size = %d [%x] add_bin: firs nonbin off = %d [%x] add_bin: free at end = %d [%x] add_bin: new buffer size = %d [%x] add_bin : realloc() add_bin: adjusting size field in REGF: %d [%x] ERROR: alloc_block: Hive <%s> is in no allocation safe mode,new space not allocated. Operation will fail! alloc_block: failed to alloc %d bytes, trying to expand hive.. free_block: ERROR: Hive %s is in no allocation safe mode,space not freed. Operation will fail! free_block: trying to free already free block!blk = %x free_block: EEEK! Zero data block size! (not registry or corrupt file?)free_block: ran off end of page!?!? Error in chains?vofs = %x, pofs = %x, blk = %x ex_next error: Not a 'nk' node at 0x%0x ex_next: ERROR: not 'nk' node at 0x%0x ex_next: nk at 0x%0x has no name! ex_next_v error: Not a 'nk' node at 0x%0x ex_next_v: hit non valuekey (vk) node during scan at offs 0x%0x get_abs_path: Not a 'nk' node!(...)%strav_path: Error: Not a 'nk' node!..ERROR: not 'nk' node! (strange?)[No name]nk_ls: Key <%s> not found ls of node at offset 0x%0x Error: Not a 'nk' node!Node has %d subkeys and %d values, and class-data of %d bytes key name%c <%s> [%6x] %c <%s> size type value name [value if type DWORD][%6x] %6d %-16s <%s>%6d %-16s <%s> %*d [0x%x]get_val_data: %s not found Value <%s> is not of correct type! get_val2buf: Long value: parts = %d, list = %x get_val2buf: Datablock %d offset %x, size %x (%d) : Point = %x, restlen = %x, copylen = %x fill_block: ERROR: block to small for data: ofs = %x, size = %x, blksize = %x free_val_data: Long value: parts = %d, list = %x free_val_data: Freeing long datablock %d offset %x, size %x (%d) free_val_data: Freeing indirect list at %x free_val_data: Freeing db structure at %x alloc_val_data: doing large key: size = %x (%d), parts = %d alloc_val_data: dbofs = %x, listofs = %x alloc_val_data: block # %d, blockofs = %x add_value: Key pointer not to 'nk' node!add_value: value %s already exists @add_value: failed to allocate new value list!add_value: failed to allocate value descriptordel_vk: Key pointer not to 'vk' node!del_allvalues: Key pointer not to 'nk' node!del_value: Key pointer not to 'nk' node!del_value: Key has no values!del_value: value %s not found! del_value: FATAL: Was not able to alloc new index listadd_key: current ptr not 'nk'add_key: index type not supported: 0x%04x add_key: cmp <%s> with <%s> add_key: key %s already exists! add_key: unable to allocate space for new key descriptor for %s! add_key: unable to allocate space for new index table for %s! add_key: current ptr not nkdel_key: key has no subkeys!del_key: index other than 'lf', 'li' or 'lh' not supported yet. 0x%04x del_key: subkey %s not found! del_key: subkey %s has subkeys or values. Not deleted. del_key: WARNING: unable to allocate space for new key descriptor for %s! Not deleted del_key: ERROR: newlfofs = %x del_key: need to delete ri-slot %d for %x - %s del_key: WARNING: unable to allocate space for ri-index for %s! Not deleted del_key: .. and that was the last one. key now empty!rdel_keys: Key <%s> not found get_class: Key <%s> not found get_class: Key has no class data.put_buf2val: %s : alloc_val_data failed! put_buf2val: %s : get_val_data failed! put_buf2val: Long value: parts = %d, list = %x put_buf2val: Datablock %d offset %x, size %x (%d) hex:hex(%x):%02x,\ %02x export_subkey: Key '%s' not found! Exporting key '%.*s' with %d subkeys and %d values... [%s%s] @="%s"=dword:%08x "%s"wexport: Cannot open file '%s'. %s (%d). Exporting to file '%s'... Windows Registry Editor Version 5.00 get_line: WARNING: un-terminated key line..dworddword:%xhex%hhxparse_values: hex string parse error: %s rimport_reg: Cannot open file '%s'. %s (%d). import_reg: WARNING: Wide character (16 bit) file.. import_reg: WARNING: Implementation is not 100%% accurate, some things may not import correctly! Windows Registry Editorimport_reg: ERROR: Windows Registry Editor signature missing on first line import_reg: realloc(valstr) Value <%s> of type %d length %d [CREATED]ERROR: import_reg: unable to change value <%s>, new type is %d while old is %d import_reg: WARNING: found key <%s> not matching prefix <%s> --- END of key, with %d values with %d values. --- Import KEY <%s> \ ERROR: import_reg: failed to add (sub)key <%s> [added <%s>] FAILEDSUCCEEDED END OF IMPORT, file <%s>, operation %s! %d keys %d new keys added %d values total writeHive: open(%s) failed: %s, FILE NOT WRITTEN! writeHive: write of %s failed: %s. openHive(%s) failed: %s, trying read-only openHive(%s) in fallback RO-mode failed: %s stat()Could not read file, got %d bytes while expecting %d openHive(%s): File does not seem to be a registry hive! openHive(%s): WARNING: REGF header checksum mismatch! calc: 0x%08x != file: 0x%08x Hive <%s> name (from header): <> ROOT KEY at offset: 0x%06x * openHive: DEBUG: BIG ROOT!Subkey indexing type is: %04x <%c%c> openHive: WARNING: ROOT key does not seem to be a key! (not type == nk) Page at 0x%x is not 'hbin', assuming file contains garbage at end ###### Page at 0x%0x ofs_self 0x%0x, size (delta ofs_next) 0x%0x ###### openHive: ERROR: Page at 0x%x has size zero! File may be corrupt, or program has a bug Last HBIN at offset : 0x%x First non-HBIN page offset: 0x%x hdr->unknown4 (version?) : 0x%x File size %d [%x] bytes, containing %d pages (+ 1 headerpage) Used for data: %d/%d blocks/bytes, unused: %d/%d blocks/bytes. \SAM\ControlSet\Policy\MicrosoftType of hive guessed to be: %d edlib version 0.1 110511, (c) Petter N Hagencat_dpi: No such value <%s> cat_dpi: Value <%s> is too short for decoding cat_dpi: Value <%s> references NULL-pointer (bad boy!) Only binary values(unknown)Value <%s> of type %s, data length %d [0x%x] Decoded product ID: [%s] cat_vk: No such value <%s> cat_vk: Value <%s> has zero length cat_vk: Value <%s> could not fetch data 0x%08xDon't know how to handle type yet!<544H5 5<5<54Value <%s> not found! Unable to get data of value <%s> EDIT: <%s> of type %s with length %d [0x%x] DWORD: Old value %d [0x%x], enter new value (prepend 0x if hex, empty to keep old value) -> %iDWORD: New value %d [0x%x], [%2d]: %s Now enter new strings, one by one.Enter nothing to keep old.'--n' to quit (remove rest of strings)'--i' insert new string at this point'--q' to quit (leaving remaining strings as is)'--Q' to quit and discard all changes'--e' for empty string in this position[NEW][INSERT]-> --q--n--Q--i--emalloc failurenewkv->len: %d Type not handeled (yet), invoking hex editor on data!New length (ENTER to keep same): Failed to set value!??<4747K<6?<?<47Command syntax is: nv where should be the HEX NUMBER from one of these registry value types: %2x : %s Example: nv 4 foobarto make a new value named foobar of the type REG_DWORD Simple registry editor. ? for help. [%0x] %s> %s> Simple registry editor:hive [] - list loaded hives or switch to hive numer ncd - change current keyls | dir [] - show subkeys & values,cat | type - show key valuedpi - show decoded DigitalProductId valuehex - hexdump of value datack [] - Show keys class data, if it has anynk - add keydk - delete key (must be empty)ed - Edit valuenv - Add valuedv - Delete valuedelallv - Delete all values in current keyrdel - Recursively delete key & subkeysek - export key to (Windows .reg file format)debug - enter buffer hexeditorst [] - debug function: show struct infoq - quitSwitching to hive #%d, named <%s>, size %d [0x%x] %c %c %2d %9d 0x%08x <%s> Key %s not found! Unknown command: %s, type ? for help G EVBHzEfGG?MFCiCGGA^A'A@@F(CBEMD4 part of OpenSSL 1.0.0a 1 Jun 2010        0 0 0  0 0  0 0  0           0  0 0 0 0  0  0  0          $$  $ $ $$  $ $             $$  $ $ $$  $ $                  0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0                            ((  ((  ((  ((  ((  ((  ((  ((          """"   " " " " ((((((((    """" ( ( ( ("("("("(  ##%%&&))**,,//1122447788;;==>>@@CCEEFFIIJJLLOOQQRRTTWWXX[[]]^^aabbddgghhkkmmnnppssuuvvyyzz||16risc1ptrdes(%s,%s,%s,%s)libdes part of OpenSSL 1.0.0a 1 Jun 2010DES part of OpenSSL 1.0.0a 1 Jun 2010b_print.c0123456789abcdef0123456789ABCDEFdoapr()xxwwHwv8x z(x(xz(x(x(x(x(x(x(xy(xy(x(xyHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxzHxzHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxHxzHxHxHxHxHxHxHxHxHxHx@z`}zHx@HxHxHxHx{ }HxHx{Hx{Hx{{ A?mem.cmem_dbg.c[%02d:%02d:%02d] %5lu file=%s, line=%d, thread=%lu, number=%d, address=%08lX " thread=%lu, file=%s, line=%d, info="%ld bytes leaked in %d chunks buffer.cbio_lib.ca+r+wbss_file.c')','fopen('FILE pointerlhash.clhash part of OpenSSL 1.0.0a 1 Jun 2010err.cint_thread_get (err.c)int_err_get (err.c)lib(%lu)func(%lu)reason(%lu)error:%08lX:%s:%s:%sunknownunknown librarysystem librarybignum routinesrsa routinesDiffie-Hellman routinesdigital envelope routinesmemory buffer routinesobject identifier routinesPEM routinesdsa routinesx509 certificate routinesasn1 encoding routinesconfiguration file routinescommon libcrypto routineselliptic curve routinesSSL routinesBIO routinesPKCS7 routinesX509 V3 routinesPKCS12 routinesrandom number generatorDSO support routinestime stamp routinesengine routinesOCSP routinesFIPS routinesCMS routinesHMAC routinessystem libBN libRSA libDH libEVP libBUF libOBJ libPEM libDSA libX509 libASN1 libCONF libCRYPTO libEC libSSL libBIO libPKCS7 libX509V3 libPKCS12 libRAND libDSO libENGINE libOCSP libTS libnested asn1 errorbad asn1 object headerbad get asn1 object callexpecting an asn1 sequenceasn1 length mismatchmissing asn1 eosfatalmalloc failurepassed a null parameterinternal errorfopenconnectgetservbynameioctlsocketbindlistenacceptopendirfreadcalled a function you should not callcalled a function that was disabled at compile-time%s(%d): OpenSSL internal error, assertion failed: %s OPENSSL_ia32capdynamicERRORcryptlib.cpointer != NULL<>errex_datax509x509_infox509_pkeyx509_crlx509_reqrsaevp_pkeyx509_storessl_ctxssl_certssl_sessionssl_sess_certsslssl_methodrand2debug_mallocBIOgethostbynamereaddirRSA_blindingdebug_malloc2dsodynlockengineuiecdsaecdhbnec_pre_compfipsfips2ex_data.cstack.cStack part of OpenSSL 1.0.0a 1 Jun 2010obj_dat.c.%luUNDEFundefinedrsadsiRSA Data Security, Inc.pkcsRSA Data Security, Inc. PKCSmd2rc4rsaEncryptionRSA-MD2md2WithRSAEncryptionRSA-MD5md5WithRSAEncryptionPBE-MD2-DESpbeWithMD2AndDES-CBCPBE-MD5-DESpbeWithMD5AndDES-CBCX500directory services (X.500)X509CNcommonNamecountryNamelocalityNamestateOrProvinceNameorganizationNameOUorganizationalUnitNamepkcs7pkcs7-datapkcs7-signedDatapkcs7-envelopedDatapkcs7-signedAndEnvelopedDatapkcs7-digestDatapkcs7-encryptedDatapkcs3dhKeyAgreementDES-ECBdes-ecbDES-CFBdes-cfbdes-cbcDES-EDEdes-edeDES-EDE3des-ede3IDEA-CBCidea-cbcIDEA-CFBidea-cfbIDEA-ECBidea-ecbrc2-cbcRC2-ECBrc2-ecbRC2-CFBrc2-cfbRC2-OFBrc2-ofbshaRSA-SHAshaWithRSAEncryptionDES-EDE-CBCdes-ede-cbcDES-EDE3-CBCdes-ede3-cbcDES-OFBdes-ofbIDEA-OFBidea-ofbpkcs9emailAddressunstructuredNamecontentTypemessageDigestsigningTimecountersignaturechallengePasswordunstructuredAddressextendedCertificateAttributesNetscapeNetscape Communications Corp.nsCertExtnsDataTypeNetscape Data TypeDES-EDE-CFBdes-ede-cfbDES-EDE3-CFBdes-ede3-cfbDES-EDE-OFBdes-ede-ofbDES-EDE3-OFBdes-ede3-ofbRSA-SHA1sha1WithRSAEncryptionDSA-SHAdsaWithSHADSA-olddsaEncryption-oldPBE-SHA1-RC2-64pbeWithSHA1AndRC2-CBCPBKDF2DSA-SHA1-olddsaWithSHA1-oldnsCertTypeNetscape Cert TypensBaseUrlNetscape Base UrlnsRevocationUrlNetscape Revocation UrlnsCaRevocationUrlNetscape CA Revocation UrlnsRenewalUrlNetscape Renewal UrlnsCaPolicyUrlNetscape CA Policy UrlnsSslServerNameNetscape SSL Server NamensCommentNetscape CommentnsCertSequenceNetscape Certificate SequenceDESX-CBCdesx-cbcid-cesubjectKeyIdentifierX509v3 Subject Key IdentifierkeyUsageX509v3 Key UsageprivateKeyUsagePeriodsubjectAltNameissuerAltNamebasicConstraintsX509v3 Basic ConstraintscrlNumberX509v3 CRL NumbercertificatePoliciesX509v3 Certificate PoliciesauthorityKeyIdentifierBF-CBCbf-cbcBF-ECBbf-ecbBF-CFBbf-cfbBF-OFBbf-ofbmdc2RSA-MDC2mdc2WithRSArc4-40RC2-40-CBCrc2-40-cbcGNgivenNameSNsurnameinitialscrlDistributionPointsRSA-NP-MD5md5WithRSAserialNumbertitledescriptionCAST5-CBCcast5-cbcCAST5-ECBcast5-ecbCAST5-CFBcast5-cfbCAST5-OFBcast5-ofbpbeWithMD5AndCast5CBCDSA-SHA1dsaWithSHA1MD5-SHA1md5-sha1RSA-SHA1-2sha1WithRSAdsaEncryptionripemd160RSA-RIPEMD160ripemd160WithRSARC5-CBCrc5-cbcRC5-ECBrc5-ecbRC5-CFBrc5-cfbRC5-OFBrc5-ofbRLErun length compressionZLIBzlib compressionextendedKeyUsageX509v3 Extended Key UsagePKIXid-kpserverAuthTLS Web Server AuthenticationclientAuthTLS Web Client AuthenticationcodeSigningCode SigningemailProtectionE-mail ProtectiontimeStampingmsCodeIndmsCodeCommsCTLSignMicrosoft Trust List SigningmsSGCMicrosoft Server Gated CryptomsEFSnsSGCNetscape Server Gated CryptodeltaCRLX509v3 Delta CRL IndicatorCRLReasonX509v3 CRL Reason CodeinvalidityDateInvalidity DateSXNetIDStrong Extranet IDPBE-SHA1-RC4-128pbeWithSHA1And128BitRC4PBE-SHA1-RC4-40pbeWithSHA1And40BitRC4PBE-SHA1-3DESPBE-SHA1-2DESPBE-SHA1-RC2-128pbeWithSHA1And128BitRC2-CBCPBE-SHA1-RC2-40pbeWithSHA1And40BitRC2-CBCkeyBagpkcs8ShroudedKeyBagcertBagcrlBagsecretBagsafeContentsBagfriendlyNamelocalKeyIDx509CertificatesdsiCertificatex509CrlPBES2PBMAC1hmacWithSHA1id-qt-cpsPolicy Qualifier CPSid-qt-unoticePolicy Qualifier User NoticeRC2-64-CBCrc2-64-cbcSMIME-CAPSS/MIME CapabilitiesPBE-MD2-RC2-64pbeWithMD2AndRC2-CBCPBE-MD5-RC2-64pbeWithMD5AndRC2-CBCPBE-SHA1-DESpbeWithSHA1AndDES-CBCmsExtReqMicrosoft Extension RequestextReqdnQualifierid-peid-adauthorityInfoAccessAuthority Information AccessOCSPcaIssuersCA IssuersOCSPSigningOCSP SigningISOisomember-bodyISO Member BodyISO-USISO US Member BodyX9-57X9.57X9cmX9.57 CM ?pkcs1pkcs5SMIMES/MIMEid-smime-modid-smime-ctid-smime-aaid-smime-algid-smime-cdid-smime-spqid-smime-ctiid-smime-mod-cmsid-smime-mod-essid-smime-mod-oidid-smime-mod-msg-v3id-smime-ct-receiptid-smime-ct-authDataid-smime-ct-publishCertid-smime-ct-TSTInfoid-smime-ct-TDTInfoid-smime-ct-contentInfoid-smime-ct-DVCSRequestDataid-smime-ct-DVCSResponseDataid-smime-aa-receiptRequestid-smime-aa-securityLabelid-smime-aa-mlExpandHistoryid-smime-aa-contentHintid-smime-aa-msgSigDigestid-smime-aa-encapContentTypeid-smime-aa-contentIdentifierid-smime-aa-macValueid-smime-aa-equivalentLabelsid-smime-aa-contentReferenceid-smime-aa-encrypKeyPrefid-smime-aa-smimeEncryptCertsid-smime-aa-timeStampTokenid-smime-aa-ets-sigPolicyIdid-smime-aa-ets-signerAttrid-smime-aa-ets-otherSigCertid-smime-aa-ets-certValuesid-smime-aa-ets-escTimeStampid-smime-aa-signatureTypeid-smime-aa-dvcs-dvcid-smime-alg-ESDHwith3DESid-smime-alg-ESDHwithRC2id-smime-alg-3DESwrapid-smime-alg-RC2wrapid-smime-alg-ESDHid-smime-alg-CMS3DESwrapid-smime-alg-CMSRC2wrapid-smime-cd-ldapid-smime-spq-ets-sqt-uriid-smime-spq-ets-sqt-unoticemd4id-pkix-modid-qtid-itid-pkipid-algid-cmcid-onid-pdaid-acaid-qcsid-cctid-pkix1-explicit-88id-pkix1-implicit-88id-pkix1-explicit-93id-pkix1-implicit-93id-mod-crmfid-mod-cmcid-mod-kea-profile-88id-mod-kea-profile-93id-mod-cmpid-mod-qualified-cert-88id-mod-qualified-cert-93id-mod-attribute-certid-mod-timestamp-protocolid-mod-ocspid-mod-dvcsid-mod-cmp2000biometricInfoBiometric InfoqcStatementsac-auditEntityac-targetingaaControlssbgp-ipAddrBlocksbgp-autonomousSysNumsbgp-routerIdentifiertextNoticeipsecEndSystemIPSec End SystemipsecTunnelIPSec TunnelipsecUserIPSec Userid-it-caProtEncCertid-it-signKeyPairTypesid-it-encKeyPairTypesid-it-preferredSymmAlgid-it-caKeyUpdateInfoid-it-currentCRLid-it-unsupportedOIDsid-it-subscriptionRequestid-it-subscriptionResponseid-it-keyPairParamReqid-it-keyPairParamRepid-it-revPassphraseid-it-implicitConfirmid-it-confirmWaitTimeid-it-origPKIMessageid-regCtrlid-regInfoid-regCtrl-regTokenid-regCtrl-authenticatorid-regCtrl-pkiPublicationInfoid-regCtrl-pkiArchiveOptionsid-regCtrl-oldCertIDid-regCtrl-protocolEncrKeyid-regInfo-utf8Pairsid-regInfo-certReqid-alg-des40id-alg-noSignatureid-alg-dh-sig-hmac-sha1id-alg-dh-popid-cmc-statusInfoid-cmc-identificationid-cmc-identityProofid-cmc-dataReturnid-cmc-transactionIdid-cmc-senderNonceid-cmc-recipientNonceid-cmc-addExtensionsid-cmc-encryptedPOPid-cmc-decryptedPOPid-cmc-lraPOPWitnessid-cmc-getCertid-cmc-getCRLid-cmc-revokeRequestid-cmc-regInfoid-cmc-responseInfoid-cmc-queryPendingid-cmc-popLinkRandomid-cmc-popLinkWitnessid-cmc-confirmCertAcceptanceid-on-personalDataid-pda-dateOfBirthid-pda-placeOfBirthid-pda-genderid-pda-countryOfCitizenshipid-pda-countryOfResidenceid-aca-authenticationInfoid-aca-accessIdentityid-aca-chargingIdentityid-aca-groupid-aca-roleid-qcs-pkixQCSyntax-v1id-cct-crsid-cct-PKIDataid-cct-PKIResponsead_timestampingAD Time StampingAD_DVCSad dvcsbasicOCSPResponseBasic OCSP ResponseOCSP NonceCrlIDOCSP CRL IDacceptableResponsesAcceptable OCSP ResponsesnoCheckOCSP No CheckarchiveCutoffOCSP Archive CutoffserviceLocatorOCSP Service LocatorextendedStatusExtended OCSP StatustrustRootTrust RootalgorithmrsaSignatureX500algorithmsORGorgDODdodIANAianaDirectorymgmtManagementexperimentalExperimentalprivatePrivatesecuritySecuritysnmpv2SNMPv2MailenterprisesEnterprisesdcobjectdcObjectDCdomainComponentdomainselected-attribute-typesSelected Attribute TypesclearanceRSA-MD4md4WithRSAEncryptionac-proxyingsubjectInfoAccessSubject Information Accessid-aca-encAttrspolicyConstraintsX509v3 Policy ConstraintstargetInformationX509v3 AC TargetingnoRevAvailansi-X9-62ANSI X9.62prime-fieldcharacteristic-two-fieldid-ecPublicKeyprime192v1prime192v2prime192v3prime239v1prime239v2prime239v3prime256v1ecdsa-with-SHA1CSPNameMicrosoft CSP NameAES-128-ECBaes-128-ecbAES-128-CBCaes-128-cbcAES-128-OFBaes-128-ofbAES-128-CFBaes-128-cfbAES-192-ECBaes-192-ecbAES-192-CBCaes-192-cbcAES-192-OFBaes-192-ofbAES-192-CFBaes-192-cfbAES-256-ECBaes-256-ecbAES-256-CBCaes-256-cbcAES-256-OFBaes-256-ofbAES-256-CFBaes-256-cfbholdInstructionCodeHold Instruction CodeholdInstructionNoneHold Instruction NoneholdInstructionCallIssuerHold Instruction Call IssuerholdInstructionRejectHold Instruction RejectpssuclpilotpilotAttributeTypepilotAttributeSyntaxpilotObjectClasspilotGroupsiA5StringSyntaxcaseIgnoreIA5StringSyntaxpilotObjectpilotPersonaccountdocumentroomdocumentSeriesrFC822localPartdNSDomaindomainRelatedObjectfriendlyCountrysimpleSecurityObjectpilotOrganizationpilotDSAqualityLabelledDataUIDuserIdtextEncodedORAddressmailrfc822MailboxfavouriteDrinkroomNumberphotouserClassmanagerdocumentIdentifierdocumentTitledocumentVersiondocumentAuthordocumentLocationhomeTelephoneNumbersecretaryotherMailboxlastModifiedTimelastModifiedByaRecordpilotAttributeType27mXRecordnSRecordsOARecordcNAMERecordassociatedDomainassociatedNamehomePostalAddresspersonalTitlemobileTelephoneNumberpagerTelephoneNumberfriendlyCountryNameorganizationalStatusjanetMailboxmailPreferenceOptionbuildingNamedSAQualitysingleLevelQualitysubtreeMinimumQualitysubtreeMaximumQualitypersonalSignaturedITRedirectaudiodocumentPublisherx500UniqueIdentifiermime-mhsMIME MHSmime-mhs-headingsmime-mhs-bodiesid-hex-partial-messageid-hex-multipart-messagegenerationQualifierpseudonymid-setset-ctypecontent typesset-msgExtmessage extensionsset-attrset-policyset-certExtcertificate extensionsset-brandsetct-PANDatasetct-PANTokensetct-PANOnlysetct-OIDatasetct-PIsetct-PIDatasetct-PIDataUnsignedsetct-HODInputsetct-AuthResBaggagesetct-AuthRevReqBaggagesetct-AuthRevResBaggagesetct-CapTokenSeqsetct-PInitResDatasetct-PI-TBSsetct-PResDatasetct-AuthReqTBSsetct-AuthResTBSsetct-AuthResTBSXsetct-AuthTokenTBSsetct-CapTokenDatasetct-CapTokenTBSsetct-AcqCardCodeMsgsetct-AuthRevReqTBSsetct-AuthRevResDatasetct-AuthRevResTBSsetct-CapReqTBSsetct-CapReqTBSXsetct-CapResDatasetct-CapRevReqTBSsetct-CapRevReqTBSXsetct-CapRevResDatasetct-CredReqTBSsetct-CredReqTBSXsetct-CredResDatasetct-CredRevReqTBSsetct-CredRevReqTBSXsetct-CredRevResDatasetct-PCertReqDatasetct-PCertResTBSsetct-BatchAdminReqDatasetct-BatchAdminResDatasetct-CardCInitResTBSsetct-MeAqCInitResTBSsetct-RegFormResTBSsetct-CertReqDatasetct-CertReqTBSsetct-CertResDatasetct-CertInqReqTBSsetct-ErrorTBSsetct-PIDualSignedTBEsetct-PIUnsignedTBEsetct-AuthReqTBEsetct-AuthResTBEsetct-AuthResTBEXsetct-AuthTokenTBEsetct-CapTokenTBEsetct-CapTokenTBEXsetct-AcqCardCodeMsgTBEsetct-AuthRevReqTBEsetct-AuthRevResTBEsetct-AuthRevResTBEBsetct-CapReqTBEsetct-CapReqTBEXsetct-CapResTBEsetct-CapRevReqTBEsetct-CapRevReqTBEXsetct-CapRevResTBEsetct-CredReqTBEsetct-CredReqTBEXsetct-CredResTBEsetct-CredRevReqTBEsetct-CredRevReqTBEXsetct-CredRevResTBEsetct-BatchAdminReqTBEsetct-BatchAdminResTBEsetct-RegFormReqTBEsetct-CertReqTBEsetct-CertReqTBEXsetct-CertResTBEsetct-CRLNotificationTBSsetct-CRLNotificationResTBSsetct-BCIDistributionTBSsetext-genCryptgeneric cryptogramsetext-miAuthmerchant initiated authsetext-pinSecuresetext-pinAnysetext-track2setext-cvadditional verificationset-policy-rootsetCext-hashedRootsetCext-certTypesetCext-merchDatasetCext-cCertRequiredsetCext-tunnelingsetCext-setExtsetCext-setQualfsetCext-PGWYcapabilitiessetCext-TokenIdentifiersetCext-Track2DatasetCext-TokenTypesetCext-IssuerCapabilitiessetAttr-CertsetAttr-PGWYcappayment gateway capabilitiessetAttr-TokenTypesetAttr-IssCapissuer capabilitiesset-rootKeyThumbset-addPolicysetAttr-Token-EMVsetAttr-Token-B0PrimesetAttr-IssCap-CVMsetAttr-IssCap-T2setAttr-IssCap-SigsetAttr-GenCryptgrmgenerate cryptogramsetAttr-T2Encencrypted track 2setAttr-T2cleartxtcleartext track 2setAttr-TokICCsigICC or token signaturesetAttr-SecDevSigsecure device signatureset-brand-IATA-ATAset-brand-Dinersset-brand-AmericanExpressset-brand-JCBset-brand-Visaset-brand-MasterCardset-brand-NovusDES-CDMFdes-cdmfrsaOAEPEncryptionSETJOINT-ISO-ITU-Tjoint-iso-itu-tinternational-organizationsInternational OrganizationsmsSmartcardLoginMicrosoft SmartcardloginmsUPNAES-128-CFB1aes-128-cfb1AES-192-CFB1aes-192-cfb1AES-256-CFB1aes-256-cfb1AES-128-CFB8aes-128-cfb8AES-192-CFB8aes-192-cfb8AES-256-CFB8aes-256-cfb8DES-CFB1des-cfb1DES-CFB8des-cfb8DES-EDE3-CFB1des-ede3-cfb1DES-EDE3-CFB8des-ede3-cfb8streetstreetAddresspostalCodeid-pplproxyCertInfoProxy Certificate Informationid-ppl-anyLanguageAny languageid-ppl-inheritAllInherit allnameConstraintsX509v3 Name Constraintsid-ppl-independentIndependentRSA-SHA256sha256WithRSAEncryptionRSA-SHA384sha384WithRSAEncryptionRSA-SHA512sha512WithRSAEncryptionRSA-SHA224sha224WithRSAEncryptionsha256sha384sha512sha224identified-organizationcerticom-arcwapwap-wsgid-characteristic-two-basisonBasistpBasisppBasisc2pnb163v1c2pnb163v2c2pnb163v3c2pnb176v1c2tnb191v1c2tnb191v2c2tnb191v3c2onb191v4c2onb191v5c2pnb208w1c2tnb239v1c2tnb239v2c2tnb239v3c2onb239v4c2onb239v5c2pnb272w1c2pnb304w1c2tnb359v1c2pnb368w1c2tnb431r1secp112r1secp112r2secp128r1secp128r2secp160k1secp160r1secp160r2secp192k1secp224k1secp224r1secp256k1secp384r1secp521r1sect113r1sect113r2sect131r1sect131r2sect163k1sect163r1sect163r2sect193r1sect193r2sect233k1sect233r1sect239k1sect283k1sect283r1sect409k1sect409r1sect571k1sect571r1wap-wsg-idm-ecid-wtls1wap-wsg-idm-ecid-wtls3wap-wsg-idm-ecid-wtls4wap-wsg-idm-ecid-wtls5wap-wsg-idm-ecid-wtls6wap-wsg-idm-ecid-wtls7wap-wsg-idm-ecid-wtls8wap-wsg-idm-ecid-wtls9wap-wsg-idm-ecid-wtls10wap-wsg-idm-ecid-wtls11wap-wsg-idm-ecid-wtls12anyPolicyX509v3 Any PolicypolicyMappingsX509v3 Policy MappingsinhibitAnyPolicyX509v3 Inhibit Any PolicyOakley-EC2N-3ipsec3Oakley-EC2N-4ipsec4CAMELLIA-128-CBCcamellia-128-cbcCAMELLIA-192-CBCcamellia-192-cbcCAMELLIA-256-CBCcamellia-256-cbcCAMELLIA-128-ECBcamellia-128-ecbCAMELLIA-192-ECBcamellia-192-ecbCAMELLIA-256-ECBcamellia-256-ecbCAMELLIA-128-CFBcamellia-128-cfbCAMELLIA-192-CFBcamellia-192-cfbCAMELLIA-256-CFBcamellia-256-cfbCAMELLIA-128-CFB1camellia-128-cfb1CAMELLIA-192-CFB1camellia-192-cfb1CAMELLIA-256-CFB1camellia-256-cfb1CAMELLIA-128-CFB8camellia-128-cfb8CAMELLIA-192-CFB8camellia-192-cfb8CAMELLIA-256-CFB8camellia-256-cfb8CAMELLIA-128-OFBcamellia-128-ofbCAMELLIA-192-OFBcamellia-192-ofbCAMELLIA-256-OFBcamellia-256-ofbsubjectDirectoryAttributesissuingDistributionPointcertificateIssuerX509v3 Certificate IssuerKISAkisaSEED-ECBseed-ecbSEED-CBCseed-cbcSEED-OFBseed-ofbSEED-CFBseed-cfbHMAC-MD5hmac-md5HMAC-SHA1id-PasswordBasedMACpassword based MACid-DHBasedMacDiffie-Hellman based MACid-it-suppLangTagscaRepositoryCA Repositoryid-smime-ct-compressedDataid-ct-asciiTextWithCRLFid-aes128-wrapid-aes192-wrapid-aes256-wrapecdsa-with-Recommendedecdsa-with-Specifiedecdsa-with-SHA224ecdsa-with-SHA256ecdsa-with-SHA384ecdsa-with-SHA512hmacWithMD5hmacWithSHA224hmacWithSHA256hmacWithSHA384hmacWithSHA512dsa_with_SHA224dsa_with_SHA256whirlpoolcryptoprocryptocommd_gost94GOST R 34.11-94id-HMACGostR3411-94HMAC GOST 34.11-94gost2001GOST R 34.10-2001GOST R 34.10-94gost89GOST 28147-89gost89-cntgost-macGOST 28147-89 MACprf-gostr3411-94GOST R 34.11-94 PRFid-GostR3410-2001DHGOST R 34.10-2001 DHid-GostR3410-94DHGOST R 34.10-94 DHid-GostR3411-94-TestParamSetid-Gost28147-89-TestParamSetid-GostR3410-94-TestParamSetid-GostR3410-94-aid-GostR3410-94-aBisid-GostR3410-94-bid-GostR3410-94-bBisid-Gost28147-89-ccgost94ccGOST 34.10-94 Cryptocomgost2001ccGOST 34.10-2001 Cryptocomid-GostR3410-2001-ParamSet-ccHMAChmacLocalKeySetMicrosoft Local Key setfreshestCRLX509v3 Freshest CRLid-on-permanentIdentifierPermanent IdentifiersearchGuidebusinessCategorypostalAddresspostOfficeBoxphysicalDeliveryOfficeNametelephoneNumbertelexNumberteletexTerminalIdentifierfacsimileTelephoneNumberx121AddressinternationaliSDNNumberregisteredAddressdestinationIndicatorpreferredDeliveryMethodpresentationAddresssupportedApplicationContextmemberownerroleOccupantseeAlsouserPassworduserCertificatecACertificateauthorityRevocationListcertificateRevocationListcrossCertificatePairenhancedSearchGuideprotocolInformationdistinguishedNameuniqueMemberhouseIdentifiersupportedAlgorithmsdeltaRevocationListdmdNamel[]\^lnmo o +<>!,=?-P|tBqFC)cW  }"#$.Xr_9n{ DEb%'&(axzy{u|`hw*As   )@d z }! pkxrZrWm\qYs625gXt&%{kg~w|"#0u8~tcY/+S-.,R !y89:;3=<>47QHIJKLVG1@ABCDEF?MNOP265'U(T* cbdefCFED ijhQNZJPOSRHIQXYWMUVTLGK.*7/,6438-5+120Z[ `a\_]  g9<?>=@;:BAee&'(VS)k3qHLJ:OGN;KIMlvp_/^]hi0Tvfmy#"$[nisq~}|_plwotvum{xyzsrnkghjica`befd@:;<ABC=X.P/QWVDE !"FGH#$%I>?063ST45UJK&'(LMN)*+O71  ,-   89R2^YZ\[]4URzj`ba%jwx71pou$dkpm~t-Q/SR+1,2)0'U(TV*z&'(XHLJG:ON9;KIMroqnsEZw ZWgXY~YVSTUR! l^xr[]\^\qlnmos6y 25t&%{ +<>!,=?-kgP zw||tCBqF"#)0xu8cwYc.W   !y}89:;3=<>47HIJKLG@ABCDEF?MNOP65 cbdefCFED ijhQNZJPOSRHIQXYWMUVTLGK.*7/,6438-5+120[ `a\_]  g9<?>=@;:BA"#$.eeorh_`kZ3{lvm p D_/^]hivb%'&(axzy{fuwmy|#"$[{n   iq~}|_pltvusrnkghjica`befd@:;<ABC=X.P/QWVDE !"FGH#$%I>?063ST45UJK&'(LMN)*+O71  ,-   89R2\[])@sA*4zjd`ba%jx71pou$d}{ | zQ} dijk[\]^_`abcdefghijklmnopqrstceuvwxyz{|RSTUVWXgYZ~Y~x`_      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^lmno_`abcdefghijk|}~%&h-yCB* )@Fsupqrstuv$|'()*+,-/012wwxyz{43MNOP56789:;<=>?@ABCDEFGHIJKLtq    9   TURSQV/ !%,x  !"#$%&'()*+,-./0123456789:CDEFGHIJKLMNOPQRSTUVWXYZ[Z\]_`abcdefghijkl  :;lpA DE012345678X[;<=>?@ABmnopqrstuvw"#GHIJKLMNO}"*H *H *H *H *H *H *H *H *H *H UUUUUUU U U*H *H *H *H *H *H *H *H *H ++ +++<*H ++*H +*H  *H  *H  *H  *H  *H  *H  *H  *H  *H  `HB`HB`HB+*H + + *H  *H  +`HB`HB`HB`HB`HB`HB`HB `HB `HBUUUUUUUUU U#+UUeUdU*UU+U+UU U *H}B *H}B *H8+*H8+$+$*H )*H  U%++++++++7+7+7 +7 +7 `HBUUU+e*H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H *H ++*H  *H *H *H  +7*H  U)U.++0++0+0+ (**H*H8*H8*H *H *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H   *H   *H   *H   *H   *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H  *H ++++++++ + + + +++++++++ + + + + +++++++++++ +++++ +++++++++ + + + + +++++++++++++++++++++++++ + + +++++++++++ + + + + + + + + + + + + + +0+0+0+0+0+0+0+0+0+0+0 +0 +0 ++ U++++++++++++:X &,d &,d UU7*H + + + UHU$U7U8*H=*H=*H=*H=*H=*H=*H=*H=*H=*H=*H=*H=+7`He`He`He`He`He`He`He`He`He)`He*`He+`He,U*H8*H8*H8 & &, &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d &,d% &,d& &,d' &,d( &,d) &,d* &,d+ &,d- &,d. &,d/ &,d0 &,d1 &,d2 &,d3 &,d4 &,d5 &,d6 &,d7 &,d8U-+++++U,UAg*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g* g* g* g* g* g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g* g*!g*"g*#g*$g*%g*&g*'g*(g*)g**g*+g*,g*-g*.g*/g*0g*1g*2g*3g*4g*5g*6g*7g*8g*9g*:g*;g*g*?g*@g*Ag*Bg*Cg*Dg*Eg*Fg*Gg*Hg*Ig*Jg*Kg*Lg*Mg*Ng*Og*Pg*Qg*Rg*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g* g* g* g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*g*"g*#g*g*g*{*H  *H Pg+7+7U U++++U+*H  *H  *H  *H `He`He`He`He++g+g+*H=*H=*H=*H=*H=*H=*H=*H=*H=*H=*H=*H=*H= *H= *H= *H= *H= *H=*H=*H=*H=*H=*H=*H=+++++ ++++ +!+ +"+#+++++++++++++++$+%+&+'g+g+g+g+g+g+g+g+ g+ g+ g+ U U!U6*K=*K=*K=1 1 1 )1 1 1 ,1 1 1 +U UU*D*D*D*D*D++*H}B *H}B++0*H   *H  `He`He`He-*H=*H=*H=*H=*H=*H=*H *H *H  *H  *H  `He`He(7** *** * ******b*c************* * * * * *!*!*!*#*#*#*#*$*$***** * * * * * +7U.+UUUUUUUUUUUUUUUUUU U!U"U#U$U%U&U'U(U/U0U1U2U3U4U5U6Netscape Certificate ExtensionX509v3 Private Key Usage PeriodX509v3 Subject Alternative NameX509v3 Issuer Alternative NameX509v3 Authority Key IdentifierX509v3 CRL Distribution PointsMicrosoft Individual Code SigningMicrosoft Commercial Code SigningMicrosoft Encrypted File SystempbeWithSHA1And3-KeyTripleDES-CBCpbeWithSHA1And2-KeyTripleDES-CBCid-smime-mod-ets-eSignature-88id-smime-mod-ets-eSignature-97id-smime-mod-ets-eSigPolicy-88id-smime-mod-ets-eSigPolicy-97id-smime-aa-signingCertificateid-smime-aa-ets-commitmentTypeid-smime-aa-ets-signerLocationid-smime-aa-ets-contentTimestampid-smime-aa-ets-CertificateRefsid-smime-aa-ets-RevocationRefsid-smime-aa-ets-revocationValuesid-smime-aa-ets-certCRLTimestampid-smime-aa-ets-archiveTimeStampid-smime-cti-ets-proofOfOriginid-smime-cti-ets-proofOfReceiptid-smime-cti-ets-proofOfDeliveryid-smime-cti-ets-proofOfSenderid-smime-cti-ets-proofOfApprovalid-smime-cti-ets-proofOfCreationdirectory services - algorithmsX509v3 No Revocation AvailableSecure Electronic TransactionsMicrosoft Universal Principal NameX509v3 Subject Directory AttributesX509v3 Issuing Distrubution Pointid-GostR3411-94-with-GostR3410-2001GOST R 34.11-94 with GOST R 34.10-2001id-GostR3411-94-with-GostR3410-94GOST R 34.11-94 with GOST R 34.10-94id-Gost28147-89-CryptoPro-KeyMeshingid-Gost28147-89-None-KeyMeshingid-GostR3411-94-CryptoProParamSetid-Gost28147-89-CryptoPro-A-ParamSetid-Gost28147-89-CryptoPro-B-ParamSetid-Gost28147-89-CryptoPro-C-ParamSetid-Gost28147-89-CryptoPro-D-ParamSetid-Gost28147-89-CryptoPro-Oscar-1-1-ParamSetid-Gost28147-89-CryptoPro-Oscar-1-0-ParamSetid-Gost28147-89-CryptoPro-RIC-1-ParamSetid-GostR3410-94-CryptoPro-A-ParamSetid-GostR3410-94-CryptoPro-B-ParamSetid-GostR3410-94-CryptoPro-C-ParamSetid-GostR3410-94-CryptoPro-D-ParamSetid-GostR3410-94-CryptoPro-XchA-ParamSetid-GostR3410-94-CryptoPro-XchB-ParamSetid-GostR3410-94-CryptoPro-XchC-ParamSetid-GostR3410-2001-TestParamSetid-GostR3410-2001-CryptoPro-A-ParamSetid-GostR3410-2001-CryptoPro-B-ParamSetid-GostR3410-2001-CryptoPro-C-ParamSetid-GostR3410-2001-CryptoPro-XchA-ParamSetid-GostR3410-2001-CryptoPro-XchB-ParamSetGOST 28147-89 Cryptocom ParamSetid-GostR3411-94-with-GostR3410-94-ccGOST R 34.11-94 with GOST R 34.10-94 Cryptocomid-GostR3411-94-with-GostR3410-2001-ccGOST R 34.11-94 with GOST R 34.10-2001 CryptocomGOST R 3410-2001 Parameter Set Cryptocomobj_lib.cbn_lib.cbn(%d,%d)Big Number part of OpenSSL 1.0.0a 1 Jun 2010bn_print.c%u%09u0123456789ABCDEFa_object.c offset=address=asn1_lib.cASN.1 part of OpenSSL 1.0.0a 1 Jun 2010FATAL: kernel too old FATAL: cannot determine kernel version /dev/null/dev/fullset_thread_area failed when setting up thread-local storage unexpected reloc type in static binaryUUUU?3333*$I$qtEUUU;$I8^Cy 0 ,d! p= ^B{ I$ B|uPq  w+,0@09*~ #`""P#<<,0@09@,~ #`"#P#<<,0@09@,~ #`""P#<<P  U@U8U`>RPW9N9 N`<p<@<9P<<<LIBC_FATAL_STDERR_/dev/tty======= Backtrace: ========= ======= Memory map: ======== /proc/self/maps,ccs=,@/#8@ %9*`.p| #`""P#<<,@/8@ 9@,0p| #`"#P#<<,@/8@ 9@,`.p| #`""P#<<UY@U8U`>RPW9N9 N`<p<@<9P<<<corrupted double-linked listTOP_PAD_PERTURB_MMAP_MAX_ARENA_MAXARENA_TESTTRIM_THRESHOLD_MMAP_THRESHOLD_ Arena %d: system bytes = %10u in use bytes = %10u Total (incl. mmap): max mmap regions = %10u max mmap bytes = %10lu free(): invalid sizefree(): invalid pointermalloc(): memory corruptionrealloc(): invalid old sizerealloc(): invalid next sizerealloc(): invalid pointermalloc: top chunk is corrupt*** glibc detected *** %s: %s: 0x%s *** munmap_chunk(): invalid pointer free(): invalid next size (normal)free(): invalid next size (fast)double free or corruption (top)double free or corruption (out)double free or corruption (!prev)free(): corrupted unsorted chunksdouble free or corruption (fasttop)malloc(): memory corruption (fast)malloc(): smallbin double linked list corruptedmalloc(): corrupted unsorted chunksmalloc(): corrupted unsorted chunks 2break adjusted to free malloc spaceXfgfgpffffe(f`iIh kjjIhIhIhIhiXp؁(Unknown errorUnknown error % }oaxSjE\7ANSI_X3.4-1968//TRANSLIT @  = Ћ e=  %[A-Za-z]%n%hu%n:%hu%n:%hu%nM%hu.%hu.%hu%nTZ/etc/localtimeUniversalUTCGMT../TZDIRTZifposixrules/usr/share/zoneinfoGETCONF_DIR/usr/libexec/getconf/proc/sys/kernel/ngroups_maxLP64_OFF64LPBIG_OFFBIG/proc/sys/kernel/rtsig-max..8E8YEYeYOOOEOUe%E85.......oy8EEeoyeY8888.........u..POSIXLY_CORRECT--%s: option '%s' is ambiguous %s: invalid option -- '%c' %s: option '--%s' doesn't allow an argument %s: option '%c%s' doesn't allow an argument %s: option '%s' requires an argument %s: unrecognized option '--%s' %s: unrecognized option '%c%s' %s: option requires an argument -- '%c' %s: option '-W %s' is ambiguous %s: option '-W %s' doesn't allow an argument /dev/log<%d>%h %e %T [%d]/dev/console%s syslog: unknown facility/priority: %x/proc/meminfoMemFree: %ld kBMemTotal: %ld kB/proc/stat/proc/cpuinfoprocessor/sys/devices/system/cpu(+0x-0x[0xbuffer overflow detected*** %s ***: %s terminated (>H<>@<H<H<H<H<====H<p=X=H<H<H<H<H<0=H<=H<H<H<H<H<H<=</var/tmp/var/profilefpuvmedepsetscmsrpaemcecx8apic10sepmtrrpgemcacmovpatpse36pnclflush20dtsacpimmxfxsrssesse2sshttmia64pbei386i486i586i686GCONV_PATHGETCONF_DIRHOSTALIASESLD_AUDITLD_DEBUGLD_DEBUG_OUTPUTLD_DYNAMIC_WEAKLD_LIBRARY_PATHLD_ORIGIN_PATHLD_PRELOADLD_PROFILELD_SHOW_AUXVLD_USE_LOAD_BIASLOCALDOMAINLOCPATHMALLOC_TRACENIS_PATHNLSPATHRESOLV_HOST_CONFRES_OPTIONSTMPDIRTZDIRLD_AOUT_LIBRARY_PATHLD_AOUT_PRELOADLD_WARNLD_LIBRARY_PATHLD_BIND_NOWLD_BIND_NOTLD_DYNAMIC_WEAKLD_PROFILE_OUTPUT/etc/suid-debugMALLOC_CHECK_i586LD_ASSUME_KERNEL/proc/sys/kernel/osreleasealiasmoduleISO-10646/UCS4/=INTERNAL->ucs4=ucs4->INTERNALUCS-4LE//=INTERNAL->ucs4le=ucs4le->INTERNALISO-10646/UTF8/=INTERNAL->utf8=utf8->INTERNALISO-10646/UCS2/=ucs2->INTERNAL=INTERNAL->ucs2ANSI_X3.4-1968//=ascii->INTERNAL=INTERNAL->asciiUNICODEBIG//=ucs2reverse->INTERNAL=INTERNAL->ucs2reverse.soUCS4//ISO-10646/UCS4/UCS-4//ISO-10646/UCS4/UCS-4BE//ISO-10646/UCS4/CSUCS4//ISO-10646/UCS4/ISO-10646//ISO-10646/UCS4/10646-1:1993//ISO-10646/UCS4/10646-1:1993/UCS4/ISO-10646/UCS4/OSF00010104//ISO-10646/UCS4/OSF00010105//ISO-10646/UCS4/OSF00010106//ISO-10646/UCS4/WCHAR_T//INTERNALUTF8//ISO-10646/UTF8/UTF-8//ISO-10646/UTF8/ISO-IR-193//ISO-10646/UTF8/OSF05010001//ISO-10646/UTF8/ISO-10646/UTF-8/ISO-10646/UTF8/UCS2//ISO-10646/UCS2/UCS-2//ISO-10646/UCS2/OSF00010100//ISO-10646/UCS2/OSF00010101//ISO-10646/UCS2/OSF00010102//ISO-10646/UCS2/ANSI_X3.4//ANSI_X3.4-1968//ISO-IR-6//ANSI_X3.4-1968//ANSI_X3.4-1986//ANSI_X3.4-1968//ISO_646.IRV:1991//ANSI_X3.4-1968//ASCII//ANSI_X3.4-1968//ISO646-US//ANSI_X3.4-1968//US-ASCII//ANSI_X3.4-1968//US//ANSI_X3.4-1968//IBM367//ANSI_X3.4-1968//CP367//ANSI_X3.4-1968//CSASCII//ANSI_X3.4-1968//OSF00010020//ANSI_X3.4-1968//UNICODELITTLE//ISO-10646/UCS2/UCS-2LE//ISO-10646/UCS2/UCS-2BE//UNICODEBIG// 0 0   @} p e6 lF @eg Ћ ex   gconv_trans_contextgconv_transgconv_trans_initgconv_trans_endGCONV_PATH/usr/lib/gconv/gconv-modules.cachegconvgconv_initgconv_endLOCPATHLC_COLLATELC_CTYPELC_MONETARYLC_NUMERICLC_TIMELC_MESSAGESLC_PAPERLC_NAMELC_ADDRESSLC_TELEPHONELC_MEASUREMENTLC_IDENTIFICATION +3?HP[hw   LC_ALLLANG/usr/share/locale@n- Vo.          T h    /usr/share/locale/locale-archive     `     `  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~  !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~   ~~~~>>xx(( 8HHHHHIupperloweralphadigitxdigitspaceprintgraphblankcntrlpunctalnumtouppertolower, V  \kHTFDs U{ j{ E : g  Q F 8 (08@HPFDs U{ j{ E : g  Q F 0123456789I@)S iX   @  ` @@  "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~              " $ & ( * , . 0 2 4 6 8 : < > @ B D F H J L N P R T V X Z \ ^ ` b d f h j l n p r t v x z | ~              " $ & ( * , . 0 2 4 6 8 : < > @ B D F H J L N P R T V X Z \ ^ ` b d f h j l n p r t v x z | ~ 23IRRSS                    " $ % & / 5 6 7 9 : < D G H I _ ` a b c !!!!! ! ! ! !!!!!!!!!!!!!!!"!$!&!(!,!-!.!/!0!1!3!4!9!E!F!G!H!I!S!T!U!V!W!X!Y!Z![!\!]!^!_!`!a!b!c!d!e!f!g!h!i!j!k!l!m!n!o!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!!!!!!!!""""#"6"<"d"e"j"k"""$$$$$$$$$ $ $ $ $ $$$$$$$$$$$$$$$$$$$ $!$#$$$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$t$u$v$w$x$y$z${$|$}$~$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$%% %%%%%$%,%4%<%%t*u*v*00Q2R2S2T2U2V2W2X2Y2Z2[2\2]2^2_2222222222222222q3r3s3t3u3v333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333) MNOPRTUVWYZ[\_`abcdefhijk  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~    !"#$%&'()*+,-./0123456789;<=>@ABCDFJKLMNOPRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ %,37:>BFJNRVZ^aeimquy} !#%).38;@EHKNQTWZ]`cgjmpsv{ "&+158<ADGJMPTY]`diosvz !&+05:?DIMRW[_cgkpsw| %+17=CIOUY]aeimquy~ #(-27<AFKPUZ_dinsx} "',16;>ADGJMPSVY\_dhmpsy !',049=AEIMQUY]aflptx| &*.26:>BFJNRVZ^bflptx~              ! $ ' * - 0 3 6 9 < ? B E H K N Q T W Z ] ` c f i k n q t w z }          " % ( + . 1 4 7 : = @ C F I L O R U X [ ^ a d g j m p s v y |          ! $ ' * - 0 3 6 9 < ? B E H K N Q T W Z ] ` c f i l o r u x { ~          # & ) , / 2 5 8 ; > A D G J M P S V Y \ _ b e h k n q t w z }          " % ( + . 1 4 7 : = @ C F I L O R U X [ ^ a d g j m p s v y |    !$'*-0369<?BEHKNQTWZ]`cfilorux{~  #&),/258;>ADGJMPSVY\_behknqtwz}  "%(+.147:=@CFILORUX[^adgjmpsvy|  !$'*-0369<?BEHKNQTWZ]`cfilorux{~  #&),/258;>ADGJMPSVY\_behknqtwz} (C)<<-(R)u,>> 1/4 1/2 3/4 AExssaeIJij'nOEOEoeoesLJLjljNJNjnjDZDzdz'^'`_:~ -------'','"",,"+o...... ``````<>!!/???!!? RsEURa/ca/sCc/oc/ugHHHhIILlNNoPQRRRTEL(TM)ZOhmZBCeeEFMoiDdeij 1/3 2/3 1/5 2/5 3/5 4/5 1/6 5/6 1/8 3/8 5/8 7/8 1/IIIIIIIVVVIVIIVIIIIXXXIXIILCDMiiiiiiivvviviiviiiixxxixiilcdm<--><-><==><=>-/\*|:~<=>=<<>><<<>>>NULSOHSTXETXEOTENQACKBELBSHTLFVTFFCRSOSIDLEDC1DC2DC3DC4NAKSYNETBCANEMSUBESCFSGSRSUSSPDEL_NL(1)(2)(3)(4)(5)(6)(7)(8)(9)(10)(11)(12)(13)(14)(15)(16)(17)(18)(19)(20)(1)(2)(3)(4)(5)(6)(7)(8)(9)(10)(11)(12)(13)(14)(15)(16)(17)(18)(19)(20)1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)(s)(t)(u)(v)(w)(x)(y)(z)(A)(B)(C)(D)(E)(F)(G)(H)(I)(J)(K)(L)(M)(N)(O)(P)(Q)(R)(S)(T)(U)(V)(W)(X)(Y)(Z)(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)(s)(t)(u)(v)(w)(x)(y)(z)(0)-|+++++++++o::====== =(21)(22)(23)(24)(25)(26)(27)(28)(29)(30)(31)(32)(33)(34)(35)(36)(37)(38)(39)(40)(41)(42)(43)(44)(45)(46)(47)(48)(49)(50)hPadaAUbaroVpcpAnAuAmAkAKBMBGBcalkcalpFnFuFugmgkgHzkHzMHzGHzTHzulmldlklfmnmummmcmkmmm^2cm^2m^2km^2mm^3cm^3m^3km^3m/sm/s^2PakPaMPaGParadrad/srad/s^2psnsusmspVnVuVmVkVMVpWnWuWmWkWMWa.m.BqcccdC/kgCo.dBGyhaHPinKKKMktlmlnloglxmbmilmolPHp.m.PPMPRsrSvWbfffiflffifflst+___,.;:?!(){}#&*+-<>=\$%@!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzACDGJKNOPQSTUVWXYZabcdfhijkmnpqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABDEFGJKLMNOPQSTUVWXYabcdefghijklmnopqrstuvwxyzABDEFGIJKLMOSTUVWXYabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890123456789012345678901234567890123456789023456789?libcPOSIXANSI_X3.4-1968@ , , , , , , , , , , , , , 6) @OUTPUT_CHARSETcharset=LANGUAGEmessageslldllillollullxllXU    y     % A Q q  O O O O O O O O O  O O O O O O O O O O O O O O O O O O O O O O k O O O F # O    % O  O 6             { J   O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O  O O O O O O O O O O O O O # " '+"5                        plural=nplurals= к@ sH  u @  ʚ; +m!0W˜qEu}${fG5@KLnZkᬔgd QJ@iIHt#@s+A;4@ G YD G l= B ]C E G @ `5 ~F D D D D D D D D D D D D D D 5 D D 5= > G YD G l= B ]C E G @ `5 ~F D D D D D D D D D D D D D vU D D D 5= > G YD G D D D D G D D D D D D D D D D D D D D D D 8S &O 5 T 5= > G YD G l= B ]C E G @ `5 ~F 3U 5 D D D D D D D D D D H 8S &O 5 T 5= > G YD G l= B ]C E G @ `5 ~F 3U 5 D D mC C D R |M M S G H 8S &O 5 T 5= > G YD G l= B ]C E G @ `5 ~F 3U 5 S        pK, 88@`>R:9N9 N`<p<@<9P<naninfINFNANnaninfINFNAN0.0001(nil)(null)\ \ \ \ \ \ \ \ \ \ \ \ \ \  H   *  m 7    3  \ \ \ N N N N N N N N N N N N N N    ~   t       N N N N N N N N N N N N N N  N N    ~   t       N N N N N N N N N N N N N  N N N    ~  N N N N  N N N N N N N N N N N N N N N N % h  ;    ~   t       ;  N N N N N N N N N N 6 % h  ;    ~   t       ;  N N   O   -   6 % h  ;    ~   t       ;  }        P 88 :9N9`<p<@<9P<to_inpunctZ } } } } } } } } } } } } } } } } } } } } ) } } } } } }  }  }  k } } } Z } }  } } } } }                              #!    #! #! #!                           #!    #! #! #!       ` Q          SuccessOperation not permittedNo such file or directoryNo such processInterrupted system callInput/output errorNo such device or addressArgument list too longExec format errorBad file descriptorNo child processesCannot allocate memoryPermission deniedBad addressBlock device requiredDevice or resource busyFile existsInvalid cross-device linkNo such deviceNot a directoryIs a directoryInvalid argumentToo many open files in systemToo many open filesText file busyFile too largeNo space left on deviceIllegal seekRead-only file systemToo many linksBroken pipeNumerical result out of rangeResource deadlock avoidedFile name too longNo locks availableFunction not implementedDirectory not emptyNo message of desired typeIdentifier removedChannel number out of rangeLevel 2 not synchronizedLevel 3 haltedLevel 3 resetLink number out of rangeProtocol driver not attachedNo CSI structure availableLevel 2 haltedInvalid exchangeInvalid request descriptorExchange fullNo anodeInvalid request codeInvalid slotBad font file formatDevice not a streamNo data availableTimer expiredOut of streams resourcesMachine is not on the networkPackage not installedObject is remoteLink has been severedAdvertise errorSrmount errorCommunication error on sendProtocol errorMultihop attemptedRFS specific errorBad messageName not unique on networkFile descriptor in bad stateRemote address changedStreams pipe errorToo many usersDestination address requiredMessage too longProtocol not availableProtocol not supportedSocket type not supportedOperation not supportedProtocol family not supportedAddress already in useNetwork is downNetwork is unreachableConnection reset by peerNo buffer space availableConnection timed outConnection refusedHost is downNo route to hostOperation already in progressOperation now in progressStale NFS file handleStructure needs cleaningNot a XENIX named type fileNo XENIX semaphores availableIs a named type fileRemote I/O errorDisk quota exceededNo medium foundWrong medium typeOperation canceledRequired key not availableKey has expiredKey has been revokedKey was rejected by serviceOwner diedState not recoverableResource temporarily unavailableInappropriate ioctl for deviceNumerical argument out of domainToo many levels of symbolic linksValue too large for defined data typeCan not access a needed shared libraryAccessing a corrupted shared library.lib section in a.out corruptedAttempting to link in too many shared librariesCannot exec a shared library directlyInvalid or incomplete multibyte or wide characterInterrupted system call should be restartedSocket operation on non-socketProtocol wrong type for socketAddress family not supported by protocolCannot assign requested addressNetwork dropped connection on resetSoftware caused connection abortTransport endpoint is already connectedTransport endpoint is not connectedCannot send after transport endpoint shutdownToo many references: cannot splice.A[r4CSbs 7Qdw$=Zu$2Ki!<Y8`4p` >Ue|4\-C\x 0Ealq _p _p q _p _p _p q _p _p _p q _p q _p _p xq _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p _p Xq t q (t q t t t q q q q q q q q q q q 8t q q q q Ht q q q q q q q q t q ht Ht t t t q Ht q q q q xt Ht s q q s q Ht q q Ht s p p p p p p p p p p p p p  r p p p p p p p p p p p p p s p Xs p hs p p p p s p p  r p p p p p  r hw w w w w w w w w w w w w w x w w w w w w w w w w w w w y w z w z w w w w hw w w x w w w w w x hx v v Xx v v v Hx v v v 8x v (x v v x v v v v v v v v v v v v v v v v v v v v v v v v w z w z w z z z w w w w w w w w w w w z w w w w z w w w w w w w w z w z z z z z w z w w w w hz z xz w w Xz w z w w z  0000000000000000 0000000000000000 Y@U8U`>RPW9N  N`<p<@<9P<<<   ؎ Ȏ     x h X H 8 (   ڕ ϕ H 7 ȕ                v l b Ж             v l b    @     @ @@!@"@ #@ %@ )@ @,@0@9@:@;@<@=@>@?@A B C D E  F@ @G@ H @0I@@J @ `K@ L @ M@ N@``@@f@ g@@h@x@y@z@{@|@}@ @     @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@ @ @ @ ;Zx0Nm<[y1On%H:%M:%S%H:%M%m/%d/%y%Y-%m-%d%I:%M:%S %p O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O ! O O O O O O O O O O O O O O O O O O O O O O O O O O O /  c N O L    O O O  O O  O   ֹ `  Ⱥ    O O O O O O      O   O   %   O Ϲ O D I )  O #  g  stack smashing detectedcannot create cache for search pathELF file data encoding not little-endianELF file version ident does not match current oneELF file version does not match current oneonly ET_DYN and ET_EXEC can be loadedELF file's phentsize not the expected sizefile=%s [%lu]; generating link map cannot create shared object descriptorELF load command address/offset not properly alignedcannot dynamically load executablecannot change memory protectionsELF load command alignment not page-alignedcannot allocate TLS data structures for initial threadobject file has no loadable segmentsfailed to map segment from shared objectobject file has no dynamic sectionshared object cannot be dlopen()edcannot allocate memory for program headercannot enable executable stack as shared object requires dynamic: 0x%0*lx base: 0x%0*lx size: 0x%0*Zx entry: 0x%0*lx phdr: 0x%0*lx phnum: %*u cannot create search path arraycannot create RUNPATH/RPATH copy file=%s [%lu]; needed by %s [%lu] find library=%s [%lu]; searching cannot open shared object filecannot allocate name record search path= (%s from file %s) (%s) cannot read file datafile too shortinvalid ELF headerELF file OS ABI invalidELF file ABI version invalid trying file=%s cannot stat shared objectcannot map zero-fill pagescannot close file descriptorsystem search path:;ORIGINPLATFORM:RPATHRUNPATHwrong ELF class: ELFCLASS64/lib//usr/lib/ GNUELFELF/etc/ld.so.cache search cache=%s ld.so-1.7.0glibc-ld.so.cache1.1symbol=%s; lookup in file=%s [%lu] file=%s [%lu]; needed by %s [%lu] (relocation dependency) binding file %s [%lu] to %s [%lu]: %s symbol `%s'out of memory (no version symbols)symbol , version not defined in file with link time reference
relocation errorsymbol lookup errornormalprotected [%s] undefined symbol: cannot allocate memory in static TLS blockcannot make segment writable for relocation%s: Symbol `%s' has different size in shared object, consider re-linking %s: no PLTREL found in object %s %s: out of memory to store relocation results for %s cannot restore segment prot after reloc (lazy) relocation processing: %s%s 4F G G 4F 4F AF G G 4F 4F 4F 4F 4F 4F G 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F 4F `G 8G G 4F 4F 4F F F I J J I I I J J I I I I I I J I I I I I I I I I I I I I I I I I I I I lJ TJ /J I I I I I ZM P )P ZM ZM N P P ZM ZM ZM ZM ZM ZM O ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM ZM O O O ZM ZM ZM eO WO N P }P N N fM P P N N N N N N Q N N N N N N N N N N N N N N N N N N N N Q P P N N N P P unexpected reloc type 0xunexpected PLT reloc type 0xcannot apply additional memory protection after relocationDYNAMIC LINKER BUG!!!%s: %s: %s%s%s%s%s continued%s: error: %s: %s (%s) out of memoryerror while loading shared libraries =???gmon%s: cannot open file: %s %s: cannot create file: %s %s: cannot map file: %s %s: cannot stat file: %s %s: file is no correct profile data file for `%s' Out of memory while initializing profiler dlopencannot create TLS data structures/proc/self/exeGLIBC_PRIVATE_dl_open_hookIGNORE= ^[yY]^[nN], k, .Y u'u'k, DE .kSunMonTueWedThuFriSatSundayMondayTuesdayWednesdayThursdayFridaySaturdayJanFebMarAprMayJunJulAugSepOctNovDecJanuaryFebruaryMarchAprilJuneJulyAugustSeptemberOctoberNovemberDecemberAMPM%a %b %e %H:%M:%S %Y%a %b %e %H:%M:%S %Z %YSunMonTueWedThuFriSatSundayMondayTuesdayWednesdayThursdayFridaySaturdayJanFebMarAprMayJunJulAugSepOctNovDecJanuaryFebruaryMarchAprilJuneJulyAugustSeptemberOctoberNovemberDecemberAMPM%a %b %e %H:%M:%S %Y%m/%d/%y%H:%M:%S%I:%M:%S %p%a %b %e %H:%M:%S %Z %Y, o $(,048?FNXahquy}0@P`p D`$4Dd$Dh@TTTTT:0pk, )k%p%t%g%t%m%t%f, k%a%N%f%N%d%N%b%N%s %h %e %r%N%C-%z %T%N%c%N,  @k+%c %a %l, k, kISO/IEC 14652 i18n FDCC-setKeld Simonsenkeld@dkuug.dk+45 3122-6543+45 3325-65431.01997-12-20ISO/IEC JTC1/SC22/WG20 - internationalizationC/o Keld Simonsen, Skt. Jorgens Alle 8, DK-1615 Kobenhavn Vi18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999, lS @k, k  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~UUUUUUUU?33333333*$I$I$qqqE]tEUUUUUUU;;I$I$I8885P^Cy 0 0 0 袋. ,d! p= ףp= ؉؉ %^B{ $I$I$ =B!B|PuPuPqqinity d'@Bʚ; d'o#ſt[Am-jd8n헧?O>. 8/t#ڰͼ3&N|.[Ӿr؇/PkpnJؕnq&fƭ$6ZB<TcsUe(U܀n_SlgrwFo]:FGWvyuD;s(!>p%"/.Q]OᖬW2Sq$^c_䭫*sf\wI[iCsFEHis 84c)r+[[!|nN5 }L,D4fl}C}Ο+#U>#`e!Q4\Ycɟ+1*ZibBtz["؊4س?ŏmk1Ke6ukG܉ـ( f13j~{j6h߸\A)\='_Djzp؊4|ElݾV}*@|gu "Ωo$po?b(UxI>Nkw};u  #6'0q'"(\؄t.z-TMеub <4 9Ԣ7.~2!'{n $-PԓX+1"#+%? D~br*~xxކzos{'~j=jr1|òAv09&Ѷ~j2=_+0cm-X%<|b 7w ʐ,5P6xPnx [4? E,W8 9qIHۚ풴lMP#*wg:8-ñj@?F[$GtJL0s-o|;#o`Is{Kҵ65m1 k?f%(炸r;v=4tPw?j&ATN4 @SZ E3TɤAc+;={CpfU,ie.O\Oߢݭ9^2XX%-VNqv4§v=ЉMOT+}\ IA?7߻D!WDGn®8pp;3,f%k;ܑyٸZNh.ltH Ic/~=otgx!RJݼ-ݎW5YAV9 T<!{>;b.w_ W5ƶ(NT ]=!̇odI@BuhؖҋcU4ph{3'"2I%% dKE)0b  62kg /SPL8mJ G '5$50123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_dlfcn_hook%s%s%s%s%s%s: %sunsupported dlinfo request" " # " # (# @# " " `# " invalid namespaceinvalid mode for dlopen()cannot extend global scopecannot create scope listno more namespaces available for dlmopen()invalid target namespace in dlmopen()empty dynamic string token substitutionopening file=%s [%lu]; direct_opencount=%u cannot load any more object with static TLSTLS generation counter wrapped! Please report this. closing file=%s; direct_opencount=%u file=%s [%lu]; destroying link map TLS generation counter wrapped! Please report as described in . calling fini: %s [%lu] dlcloseshared object not openinvalid mode parameterDST not allowed in SUID/SGID programscannot load auxiliary `%s' because of empty dynamic string token substitution load auxiliary object=%s requested by file=%s load filtered object=%s requested by file=%s cannot allocate dependency listcannot allocate symbol search listFilters not supported with LD_TRACE_PRELINKING calling init: %s calling preinit: %s checking for version `%s' in file %s [%lu] required by file %s [%lu] no version information available (required by cannot allocate version reference tableunsupported version of Verdef recordweak version `' not found (required by of Verneed record RTLD_NEXT used in code not dynamically loaded0F p  @   @ @ 0     zR| $,AA ACcDl2UAC0[`2QAH R|2kC@HPD4CPH[JH46UAC Kx6YAA C K(6AA AAC``($,9|AEA AAKCPP9C0OHHp9cAKC0D:MAC0[x:AA C0T8;C@O\(|YEAA ABAC`S(ZAA AAFh(<^AA AAFKhmCP|m]AC0c 8nIFYKNRdoUAC0coEAKC0oMAC0[pEAKC0,DpC SYHpC SYdlquAKC quAKC 4rC0SXHHrC _U(sC HSVsuC WU tsC HS0ptC0H[[PuC`H[JHpuC0OT$vC`H[JHvC`HSVHwC0OT(xoC0`J|xMAKC0 xEAKC <xQC`LS^J\$zC0OHS|z<AC Kz8AC Wz1C z]C `<{UC@{AA KC@|nC0OW4l|MAC0[(P|AA BAAF Z|2C @kC0F^C@OFZ4C0OFY5CPOHb $C0OTR,C0OTNL4CP_HhȆuABA KC0(rC0OF)CPSHHU.C`WaNFCpSdHH \AA AC D((ȎAA AAC@DT<|AA C0OtC`HJaL\C0H[CPOe$CPH[JFđ|C`HLe $<C`HLa, DyC0H[H 3C \ Ԕ1C p 1C  ,,C  H0C  d0C  ,C  .C  -C ( ԕuAA AAC@D( (,C < DeAC YX 5C l ĖlC0HO 5C  D5C  pMAC0[ UAC0[ mAC@[ <9C`H_JN$ \MC`HSVHD C0HJ` yAA C0D p]AKC0 ]AKC0 mAC0c LeAC0[ jC`HSVJ bCPH[JJ(0 @|AA AAC@S\ rC`HSVJ| rC`HSVJ TAA C@D $ZAA AC0O `EAKC0 C@OHHZ tCPOP(< $3AA AACPDh 88AC W \KC  C0H[ CPL\KH uAA C0D C@WWFܫC0WW0P`C0OHLC@OLHlC`OHHW$AA BACPlC hC0e sAA AC0DXUAC0OTAC0O05C D HC XHUAC Qt5C vC0H[_C0H[(`pAA AAC@DnC0H[CPF[J(:C <:C (P AA AAC`D|UAC0[8MAC0\lC@OP,EAKC0`C0HOV7C $<0C 8X]AC KTDAKC pCAA ACPLmAC@[PdC0H[AKC`HAKC` ABA CPO$ AC`O@ PAC`O\ AC`Ox ]AC0[ ]AC0[( `EAA AACN lC`H[JF rC0Oc!8}C ^4!C0He(P!AA AAKC`|!ttC`SLw(! AA ABAFR!X /CPHe!h AKC0" \C H^ "P PC`H[L@" C WVH`"puAC O|"8AC W"AC O"l`C0W"C@W"DKC (#AA AAKCp ,#AA AC@W P#AA AC0Tt#LAC X#UC # AC X#UC #C Lb #`AA AC0O$rC0H[0$`LC D$~C0H[(`$AA AACpK$C@HHS$CPH[JJ$C0HL$(VC`dX%hCPOe($% OAA AAC`LP%0|C0HJl%CPHHS%$C0H[H%C@O\(%( 5AA AACPH%w s",4Bwx FxDx w t",d"wx FxDx v Kt",wx FxDx v t",vx FxDx nv u",vx FxDx :v gu"0.!AB L.$#AB ,\Ç xBxDx  )",x FxDx g \",x FxDx 3 @",_ xBxDx  ",8 xBxDx  v"zPLR|   $AB I, xBxDx  B", xBxDx  H",É xBxDx s I" ԟAB H,D xBxDx  ",tĊ xBxDx  &", xBxDx M #"$hAB IFF1X4AB $1|AB C@10"AB ,PG xBxDx  d",# xBxDx  o", xBxDx  "$AB IFF,T xBxDx , ɋ",80 xBxDx  V",h xBxDx  "$P,AB IL, xBxDx ܍ ", xBxDx  R",  xBxDx i ?"$4@ AB IFF3ldAB I37AB ,= xBxDx  ", xBxDx ݏ 5", xBxDx  ]" P]AB R,h xBxDx m ",q xBxDx 5 Ԑ",J xBxDx  А"zPR|   AB ILI$܏1AB IL,` i xBxDx A ڐ", B xBxDx  " dAG IFH5"AB ,  xBxDx  +",0 xBxDx  ?",` ɑ xBxDx y O"$H?AB RK6|0AB 6+AB 6-AB V74AB G47ܑ}AB GP7@LAB IPp7pFAB G7@AB G7Ȓ=AG 7AG U7|hAB G8ГCAB IF 8tAB G<8dAB GX8AB N x8ؖhAB IP8$AD I8xAB G8hAB H8AB H9AB H89AB LX9AB H x9(AB IL, x xBxDx P g", T xBxDx  ", 0 xBxDx  B",$6AB GHH:AB HhhAB L 4 NAB I-AB InAD I dWAB IS dAB IFJ,(L xBxDx $ Ĵ",X% xBxDx  ", xBxDx t ",u xBxDx 9 ", xBxDx d ",h xBxDx , ",HA xBxDx  ǵ"$0 dAB IFI,ֶ xBxDx  ", xBxDx v ", xBxDx ; " dsAB H,T xBxDx  F", xBxDx  J",Ķ xBxDx t J" AB H,A xBxDx  z",8 xBxDx  ",h xBxDx  |" ̺AB IL XTAB RK PAB G  ȼAB IN, DAB  H HAB KVl CAB Q AB D SAB KV TAB IL 0EAB D dAB I , AB HEJP AD Ip AD I AB  <AB G (%AB  <0AB  PAB I$ <AB LD RAB J ` 0AB IO 3AB G @wAB G sAB G AB IFF AB G AB H 8 wAB FH AB Y,t/ xBxDx  ", x FxDx  ",x FxDx  t",x FxDx k u",4x FxDx 7 h",d xBxDx  ",g xBxDx  ",Cx FxDx  ",#x FxDx _ ?",$ xBxDx ' u",T xBxDx  ",x FxDx  ", xBxDx  ^",wx FxDx O ",W xBxDx  ",D3x FxDx  ",t xBxDx  &",x FxDx w M", xBxDx ? L",x FxDx  ",4 xBxDx  "pFrFB Ft(AB F)AB F+AB MFuAB GF)AB G( AG 4G4AB GPG@AB lGD9AB MGhAB GAD GAG GHAB GGGAB GH.",--H xBxDx B 2.",- H xBxDx }B E3",-G xBxDx EB &3",$.Gx FxDx B 7",T.Gx FxDx A 7",.Gx FxDx A 7",.aGx FxDx uA 7",.AGx FxDx AA h8",/!Gx FxDx A I8",D/Gx FxDx @ ^8",t/Fx FxDx @ z8",/Fx FxDx q@ v:",/Fx FxDx =@ i:",0Fx FxDx @ :",40aFx FxDx ? :"p\pFAI_$\HgA<Ah\HI%\TK\MH$\DNAA LAt$]OA[AFAC BCA pCA {CA CA A,]$RXAHF XEA dF]TRCBQo]R"F F SB^R6BNe$^Re8^SAT^S_A],d2Fvx FxDx "v s",2&vx FxDx u s",2vx FxDx u s",2ux FxDx u bs",$3ux FxDx Ru ds",T3ux FxDx u s" _PAB Ca _AB IQ_AB U_OAB I`}AB 4`|AB P`AB l`d`(`cKXRA XI`@Xr QAH(`cKXRA XI( aĠcKXRA XI8a%AXTa9AB Jpa@AB OaС,5ŭx FxDx  ",5x FxDx m צ",5x FxDx 9 ",(6ex FxDx  ",X6Ex FxDx Ѭ "-ܣAB -AG - AB J 3ԥhAD QF3 AD $3ΠAB HPX.)AB t.(AB .)AB 8cGAA AADLDD\A AAPc(\AA AA[DLDLA AALAA AAb*x FxDx ** w$",X>ex FxDx d 5X",>dx FxDx d X",>dx FxDx d IY",>dx FxDx Wd UY",?dx FxDx #d S\",H?wdx FxDx c -\",x?avx FxDx =v f",?Avx FxDx v f",?!vx FxDx u Eh",@U|x FxDx 1| "{",8@5|x FxDx { b{" tl\AB CHl8HAB T,@x FxDx r X",@vx FxDx > C", AVx FxDx  {",AB D0AB CGP|AB Hp AB HCAB DrAB Ô$AB W7AB [ $AB ING0 AB L1AB Rh(AB N AB LNUd!*AB ȃx!3AB L !AB TFG"*AB $,"BAB IND\" AG Q< V<  p o  k    g  8Rc Xs(  k . I h {  o F  0$ P! `p0C C C C C C C C D C C C D D D D +D /D fj :D @D MD QD B _D gD D tD D D D D D D D D C D D D E E  'E .E  FE KE  E hE  E ~  P lE  pE pE  ~E E  E E  E E  E E  ʮ E E  Ӯ F F  Ԯ F "F  ֮ , -F ٮ D 9F ܮ  FF ߮ OD ZF  kF nF  EN C  F F  F F  F F  F F   F F   F F   F F  ! F F * G G  2 G G ; "G *G @ R 2G E :G BG  J JG SG !\G eG " O nG wG #G G $I G %Z G G &G G 'G G (I G )b G G *g G G +H H ,l H %H -t -H 6H .?H ?H /y EH EH 0 RH RH 1 cH cH 2 oH oH 3 }H }H 4 H H 5 H H 6 H H 7 H H 8 ɯ H H 9ү I @ :ٯ I I ; -I 9I <EI RI =_I kI >wI I ?M M @ I I A I I B I I C I I D  J J E  J J F 'J 2J G  EJ OJ H ! aJ qJ I * J J J 3 J J K < J J L E J  K M N &K 0K N W AK PK O ` nK wK PK K Qi K K Rk K K Sn K ` Tq K  Ut K  Vw L L Wz 0L :L X} LL `L Y |L  Z L L [ L L \L L ]L L ^L L _ L L ` P L aL L bM M c M M d M M e #M  g 9M DM h OM OM i \M \M j bM bM k nM xM l M M mM M nM M oM M p M M qð M M rM N sʰ f N tϰ .N  N uְ *N 8N w۰ IN QN x YN aN yiN qN zyN N {N N | N N } N N ~ N N  N N  N N  O $O  BO NO  [O kO " }O _ * O   2 O $  < O O  F O O  P O H  Z O O  d P P m 6P @P p WP fP s vP ~P v P P  { P P  P h  P   P Q  *Q :Q  UQ UQ  \Q \Q  ± pQ pQ  ͱ xQ xQ  ر Q Q  Q Q  Q Q  Q Q   Q Q  Q Q   Q Q   Q Q  ) Q Q  2 Q Q ; Q Q C R  R K =R HR SR ^R  S rR R  \ R R  e R R  n R R  w S R  M M   S  S  S S  S S  !S 5S  RS RS  WS aS  lS xS  S S  S S  S S  S S ò S S Ȳ S S β S S ֲ S S  ޲ S S  T T  T T  T T   *T *T   6T 6T   CT CT  # PT PT  - aT aT  8 rT rT  C T T  N    Y    d    o    z T T  T T  T T  T T  T T  U U  U U  dz 4U 4U  ҳ QU QU  ݳ lU lU  U U  U U  U U  U U   U U   V V  * #V #V  5 @V @V  @ ]V ]V  K 0 0  V wV wV  a V V  l V V  w P P  p p  V V  V V           Ĵ W W  ϴ    ڴ W W     < <  Y >Y a IY IY i bY bY q {Y {Y y Y Y  Y Y  Y Y  Y Y  Y Y  Y Y  Y Y   Z  Z   Z Z ! #Z #Z "ɶ 4Z 4Z #Ѷ JZ JZ $ٶ `Z `Z % kZ zZ & Z Z ' Z Z ( _ _ ) Z Z * Z Z + Z Z , Z Z -! [ [ .) '[ '[ /1 8[ 8[ 09 N[ N[ 1A h[ h[ 2I [ [ 3Q [ [ 4Y [ [ 5a [ [ 6i [ [ 7q [ [ 8y \ \ 9 \ \ : \ \ ; .\ .\ < G\ G\ = e\ e\ > \ \ ? \ \ @ \ \ A Ƿ \ \ B з \ \ Cٷ \ \ D \ \ E ] ] F  ]  ] G 2] 2] H H] H] I ]] ]] J o] o] K ] ] L! ] ] M) ] ] N1 ] ] O9 ] ] PA ] ] QI ] ] RQ ^ ^ SY ^ ^ Ta 1^ 1^ Ui @^ @^ Vq T^ T^ Wy h^ h^ X }^ }^ Y ^ ^ Z ^ ^ [ ^ ^ \ ^ ^ ] ^ ^ _ ^ ^ ` _ _ a ._ ._ bɸ H_ H_ cѸ ^_ ^_ dٸ v_ v_ e _ _ f _ _ g _ _ h _ _ i _ _ j _ _ k _ _ l ` ` m ! /` *` n * 5` ;` o 3 G` [` p < u` }` q E ` ` r N ` ` s W ` ` t ` u i }}v r ` ` w {  a  a x a a y !a , z 0a 4a { 8a  cg cg  H rg rg  R g g  \ g g  f g g  p g g  z g g  g g  g g  g g  g g  g g  h h  h h  ʼ $h $h  Լ 3h 3h  ޼ Eh Eh  Sh Sh  ih ih  ~h ~h   h h   h h   h h  $ h h  . h h  8 h h  B h h  L  i  i  V  i  i  ` 2i 2i  j >i >i  t Di Di  ~ Vi Vi  ki ti  }i }i  i i  i i  i i  i i  i i  i l  i i   j j  *j *j  3j 3j  >j Jj  aj aj  kj kj Ľ yj yj Ƚ j j  ̽ j j  н j j  Խ j j  ؽ j j  ܽ j j  j j  j j   k  k  "k "k  4k 4k  Gk Gk  Tk Tk  ck ck  tk tk  k k  k k  k k  k k  k k  k k  k k   l  l $ !l !l  ( 1l 1l !, Bl Bl "0 Sl Sl #4 fl fl $8 zl zl %< l l &@ l l 'D l l (H l l )L l l *P l l +T m m ,X m m -\ &m &m .` >m >m /d Vm Vm 0h lm lm 1l m m 2p m m 3t m m 4x m m 5| m m 6 m m 7 m m 8 n n 9 n n : )n )n ; :n :n < Ln Ln = _n _n > qn qn ? n n @ n n A n n B n n C n n D n n E n n F  o  o Gľ o o HȾ 1o 1o I̾ Do Do Jо Uo Uo KԾ go go Lؾ xo xo Mܾ o o N o o O o o P o o Q o o R o o S p p T p p U +p +p V Dp Dp W `p `p X yp p Y p p Z p p [ p p \ p p ] p p ^ q q _$ !q !q `( 4q 4q a, Eq Eq b0 Wq Wq c4 mq mq d8 q q e< q q f@ q q gD q q hH q q iL q q jP q q kT r r lX r -r m\ Jr Jr n` \r kr od r r ph r r qm r r rr r r sw r r t| r r u r r v r s w &s 4s x Fs Ys y ks }s z s s { s s | s s } s s ~ s s   t  t  t t  .t .t  >t Gt ƿ Pt Pt  ο ot t ׿ et ut ؿ t t ٿ t t  ڿ t   t t u u !u .u ;u Hu Uu bu ou |u u u u u u u u u u u  u u  v v   v v  8v Kv  Xv jv  vv v  v v  v v   v v  ' w w  0 &w 1w  9 v Iw  B v Pw  K w Ww  T *w ^w  ] ew ew f }w }w g w w j w w l w w o w w  w w w  w w  w w  w w  w w  w w  w w  x x   x  x  x x  "x "x  -x -x  8x 8x  Cx Cx  Nx Nx  Yx Yx  dx dx  ox ox  zx zx  x x  x x " x x * x x 2 x x 7 x x < x x A x x F x x K x x P x x U x x Z y y _  y  y d y y i y y n (y (y s 2y 2y x  ہ ہ ? ( ( @ P P A% x x B,   C3   D:   EA   FH @ @ GO ` ` HV   I]   Jd   Kk   Lr   My   N   O 1 1 P F 0 Q Y b R z  S T | T   U   V  ‚ Wǂ ӂ X   Y  % Z : : [ F F \ W W ] e e ^ s s _   `   a   b ă ă c ݃ ݃ d   e   f   g ( ( h @ @ i T T j p p k w w l } } m   n   o   p   q   r Մ Մ s!   t$   u'   v* , , w- > > x0 K K y3 [ [ z6 o o {9   |<  H`,,`@            - < K Z Administrator  u ~           cdlsdirqcattypestdebughive ed nv dvdelallvnkdkhexrdelekck?dpiОpО0<> PP @> ? ? $? 1? I? c? z?  ?  ?  ?  ? ? ? @ .@  ;@ !H@ "W@ #h@ $x@ %@ /@ &@ '@ -@ .@ 0@ A  A A A !A )A 1A  9A  AA  IA  RA [A dA oA vA  ~A !A "A #A $A %A &A 'A /A :A ;A <A =B >/B ?DB @UB A[B BB CjB DB EC B  B 0B @B PB `B pB B B B d@'p%`# }3 5  5  5@         P  ?A px ;=    =  =    =  =    =  & = 6 = & F V = g = V x  =  =   @ , , , , , , , , , , , , , A @{ | z } @M 0N `N N  ! ! `" # GCC: (GNU) 4.4.3.shstrtab.note.ABI-tag.rel.plt.init.text__libc_freeres_fn__libc_thread_freeres_fn.fini.rodata__libc_atexit__libc_subfreeres__libc_thread_subfreeres.eh_frame.gcc_except_table.tdata.tbss.ctors.dtors.jcr.data.rel.ro.got.got.plt.data.bss__libc_freeres_ptrs.comment Ԁ  "ILL(L@.  N@ `yY, ,a_` `a9 g$$ u(( 0XX \\ d DD! TT! TT! ``! ll! ! T xxv v v @  4 H 0  chntpw_0.99.6.110511/LGPL.txt0000644000175000017500000006351011562562244013374 0ustar jfsjfs GNU LESSER GENERAL PUBLIC LICENSE Version 2.1, February 1999 Copyright (C) 1991, 1999 Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. [This is the first released version of the Lesser GPL. It also counts as the successor of the GNU Library Public License, version 2, hence the version number 2.1.] Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This license, the Lesser General Public License, applies to some specially designated software packages--typically libraries--of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below. When we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things. To protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it. For example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights. We protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library. To protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others. Finally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license. Most GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs. When a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library. We call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances. For example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License. In other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system. Although the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library. The precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run. GNU LESSER GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you". A "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables. The "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".) "Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library. Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does. 1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) The modified work must itself be a software library. b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change. c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License. d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful. (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library. In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices. Once this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy. This option is useful when you wish to copy part of the code of the Library into a program that is not a library. 4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange. If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code. 5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License. However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables. When a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law. If such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.) Otherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself. 6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications. You must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things: a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.) b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with. c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution. d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place. e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy. For an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. It may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute. 7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things: a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above. b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work. 8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it. 10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License. 11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation. 14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Libraries If you develop a new library, and you want it to be of the greatest possible use to the public, we recommend making it free software that everyone can redistribute and change. You can do so by permitting redistribution under these terms (or, alternatively, under the terms of the ordinary General Public License). To apply these terms, attach the following notices to the library. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Also add information on how to contact you by electronic and paper mail. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the library, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the library `Frob' (a library for tweaking knobs) written by James Random Hacker. , 1 April 1990 Ty Coon, President of Vice That's all there is to it! chntpw_0.99.6.110511/WinReg.txt0000644000175000017500000005072011562562244014030 0ustar jfsjfsAgreement: ========== The author of this document will not be responsible for any damage and/or license violation that may occur. The information within this document is provided "as is" without warranty of any kind... This information was "collected" during sleepless nights, and is NOT officially released by Microsoft! It shall give you a peek at the Windows(tm) internals to give you a chance to recover from corrupted data. The author has nothing to do with Microsoft, except that he uses their products... If you don't agree with this, stop reading this document, and delete it at once! History: ======== What is the registry? Where did it came from? Two questions, which I will try to answer here. The registry is a database (at least microsoft thinks so:) which contains configuration information about the system. It mainly is a memory dump which is saved to one or more files on the windows host drive. It is loaded every system-boot and remains resident until shutdown. Since parts of it are not used during normal operation it will be swapped out very soon. The registry appeared with windows 3.?? (sorry, I can't remember any earlier version :-), where it was used for file associations and the "OLE" functions (the conection between ole-id's and the applications). This is a critical information and since the registry has (almost) NO CHECKSUM information (!), it sometimes gets corrupted. This is the main reason for this doc. Using windows 3.x, almost every configuration was done using good old ".INI"- files, which were readable but slow and limited in size (64k). In windows 95 (and NT), the registry was used instead of these files. So, to edit a particular setting, you would have to run the application which manages these settings. :( but what if this app won't start? MS included a tool named REGEDIT in windows 3.?? and 95, and a REGEDT32 in windows NT. You can use these apps to edit ALL contents of the registry (in windows NT the registry supports security, as well as it provides the security for the whole system!) An application can open a "key", write values (variables) to it and fill them with data. Each key represents also a value called "default" and can contain any number of sub-keys. This will form a tree-structure as you can see at the left half of REGEDIT. (note: REGEDIT from windows 3.?? has to be started with /V or /Y, I can't remember now) Where can I find the registry??? ================================ That differs for each windows-version: Version File(s) Contents 3.1x REG.DAT Complete windows 3.?? Registry 95 SYSTEM.DAT System-values (HKEY_LOCAL_MACHINE) USER.DAT User-values (HKEY_USERS) NT SYSTEM32\CONFIG\SAM SAM-part of the registry (=NT Security) SYSTEM32\CONFIG\SOFTWARE Software-Specific part (HKEY_LOCAL_MACHINE\SOFTWARE) SYSTEM32\CONFIG\SYSTEM System-specific part (HKEY_LOCAL_MACHINE\System) PROFILES\%USERNAME%\NTUSER.DAT User-Specific part (HKEY_CURRENT_USER\{S-1-xxx...}) PROFILES\%USERNAME%\NTUSER.MAN like NTUSER.DAT but a MANDATORY-profile If you are using a ROAMING-profile with windows NT, NTUSER.xxx can be on a network-share as well... Terms ===== The registry consists of the following elements: Hive: strating point of the structure. The name of an hive starts with the "HKEY_"-prefix. Can be seen as a "drive" in a file system. Hive name Beschreibung 3.1 95 NT4 HKEY_CLASSES_ROOT Points to the "class" key in the "HKEY_LOCAL_MACHINE" hive, the only hive in windows 3.?? X X X HKEY_CURRENT_USER Information and settings valid for the currently logged in user. (Points to the correct X X key under "HKEY_USERS") HKEY_CURRENT_CONFIG Settings for the currently active hardware profile. Points to "HKEY_LOCAL_MACHINE\ X X CONTROL\CONTROLSETxxx HKEY_USERS Contains all currently active user settings. Since NT is a single user system, there will be only one key (the S-ID X X of the active user), and a ".DEFUALT" key (The settings for the CTRL-ALT-DEL environment) HKEY_LOCALMACHINE All local settings X X HKEY_DYN_DATA As the name says, here you'll find X dynamic data (CPU-usage,...) Key: A key to the registry can be seen as a directory in a file system. Value: can be seen as the registrys "file" Data: is the actual setting, can be seen as the contents of a file Windows 3.x =========== This registry is the easiest one. It consists of 3 blocks, which are not "signed" at all: Block Position Size Header 0 32 Bytes Navigation-Info 0x00000020 ??? Data-Block ??? ??? The "???" marked values can be read from the header. Header ====== Offset Size Description 0x0000 8 Byte ASCII-Text: "SHCC3.10" 0x0008 D-Word ? 0x000C D-Word ? (always equal the D-Word at 0x0008) 0x0010 D-Word Number of entrys in the navigation-block 0x0014 D-Word Offset of the data-block 0x0018 D-Word Size of the data-block 0x001C Word ? 0x001E Word ? Values marked "?" are not important for a read-access, and therefore unknown to me... Navigation-Block ================ This is where chaos rules! It consists of two different, 8 byte long blocks: * Navigation-Info-Record, * Text-Info-Record The first record in the navigation block is a navigation info record. Navigation-Info-Record Offset Size Contents 0x00 Word Next Key (same level) 0x02 Word First Sub-Key (one level deeper) 0x04 Word Text-Info-Record Key-Namens 0x06 Word Text-Info-Record Key-Value (default) The values are the locical number of the block inside the file: offset=blocksize*blocknumber+headersize since 2 of this values are constant: offset=8*blocknumber+0x20 Text-Info-Record ================ Offset Size Contents 0x00 Word ? 0x02 Word number of references to this text 0x04 Word Text-length 0x06 Word Offset of the text-string inside the data-block To get the text-offset inside the file you have to add this offset to the data-offset inside the header. Data-Block ========== The data-block only consists of a collection of text-strings. Right in front of every text is a word which may or may not have a meaning. The offset in the text-info record points directly to the text, the text-size has to be defined in the text-info record too. Windows 95 ========== the Windows95-Registry Files: inside the windows-directory (default: C:\WINDOWS) are 2 files which are loaded to form the registry: SYSTEM.DAT and USER.DAT This files are mapped to the following hives: HKEY_LOCAL_MACHINE in SYSTEM.DAT and HKEY_USERS in USER.DAT The file structure: =================== Both files have the same structure. Each of them consists of 3 blocks where 1 of these blocks can be repeated. Every block has a 4 byte long signature to help identify its contents. ID Block-contents Max. size CREG Header 32 Bytes @ Offset 0 RGKN Directory information (Tree-structure) ??? @ Offset 32 RGDB The real data (Values and data) max. 65535 Bytes an Offset ?? these blocks are "sticked together" with no space between them, but always a multiple of 16 in size. the CREG-Block ============== Offset Size Inhalt 0x00000000 D-Word ASCII-"CREG" = 0x47455243 0x00000008 D-Word Offset of 1st RGDB-block 0x00000010 D-Word # of RGDB-blocks all other values are not needed to read the registry... the RGKN-Block ============== I assume that RGKN stands for ReGistry-Key-Navigation. This block contains the information needed to built the tree-structure of the registry. This block will be larger then 65536 bytes (0xFFFF)! All offset-values are RELATIVE to the RGKN-block! Offset Size Contents 0x00000000 D-Word ASCII-"RGKN" = 0x4E4B4752 0x00000004 D-Word Size of the RGKN-block in bytes 0x00000008 D-Word Rel. Offset of the root-record 0x00000020 ???? Tree-Records (often the 1st Record) the Tree-Record =============== The tree-record is a "complete" registry-key. It contains the "hash"-info for the real data stored in this key. Offset Size Contents 0x0000 D-Word Always 0 0x0004 D-Word Hash of the key-name 0x0008 D-Word Always -1 (0xFFFFFFFF) 0x000C D-Word Offset of the owner (parent)-records 0x0010 D-Word Offset of the 1st sub-sey record 0x0014 D-Word Offset of the next record in this level 0x0018 D-Word ID-number of the real key the 1st entry in a "usual" registry file is a nul-entry with subkeys: the hive itself. It looks the same like other keys. Even the ID-number can be any value. The "hash"-value is a value representing the key's name. Windows will not search for the name, but for a matching hash-value. if it finds one, it will compare the actual string info, otherwise continue with the next key. End of list-pointers are filled with -1 (0xFFFFFFFF) The ID-field has the following format: Bits 31..16: Number of the corresponding RGDB-blocks Bits 15..0: continuous number inside this RGDB-block. The hash-method: ================ you are looking for the key: Software\Microsoft first you take the first part of the string and convert it to upper case SOFTWARE The "\" is used as a seperator only and has no meaning here. Next you initialize a D-Word with 0 and add all ASCII-values of the string which are smaller than 0x80 (128) to this D-Word. SOFTWARE = 0x0000026B Now you can start looking for this hash-value in the tree-record. If you want to modify key names, also modify the hash-values, since they cannot be found again (although they would be displayed in REGEDIT) the RGDB-Block ============== Header: Offset Size Contents 0x0000 D-Word ASCII-"RGDB" = 0x42444752 0x0004 D-Word Size of this RGDB-block 0x0020 ???? RGDB Records RGDB-Record (Key-Information) ============================= Offset Size Contents 0x0000 D-Word record length in bytes 0x0004 D-Word ID-number 0x0008 D-Word ??? Size ??? 0x000C Word text length of key name 0x000E Word Number of values inside this key 0x0010 D-Word always 0 0x0014 ???? Key-name 0x???? ???? Values The first size (record length) can be used to find the next record. The second size value is only correct if the key has at least one value, otherwise it is a little lower. The key-name is not 0-terminated, its length is defined by the key- text length field. The values are stored as records. Value-Record ============ Offset Size Contents 0x0000 D-Word Type of data 0x0004 D-Word always 0 0x0008 Word length of value-name 0x000A Word length of value-data 0x000C ???? value-name 0x???? ???? data Data-Types ========== value Contents 0x00000001 RegSZ - 0-terminated string (sometimes without the 0!) 0x00000003 RegBin - binary value (a simple data-block) 0x00000004 RegDWord - D-Word (always 4 bytes in size) Windows NT (Version 4.0) ======================== Whoever thought that the registry of windows 95 and windows nt are similar will be surprised! They only look much the same, but have completely other structures! Since the RGDB-blocks in the windows 95 registry are not larger than 0xFFFF, we can see that it is optimized for a 16-bit OS... Windows NT stores its registry in a page-oriented format with blocks of 4kb (4096 = 0x1000 bytes) The windows NT registry has 2 different blocks, where one can occure many times... the "regf"-Block ================ "regf" is obviosly the abbreviation for "Registry file". "regf" is the signature of the header-block which is always 4kb in size, although only the first 64 bytes seem to be used and a checksum is calculated over the first 0x200 bytes only! Offset Size Contents 0x00000000 D-Word ID: ASCII-"regf" = 0x66676572 0x00000004 D-Word ???? 0x00000008 D-Word ???? Always the same value as at 0x00000004 0x0000000C Q-Word last modify date in WinNT date-format 0x00000014 D-Word 1 0x00000018 D-Word 3 0x0000001C D-Word 0 0x00000020 D-Word 1 0x00000024 D-Word Offset of 1st key record 0x00000028 D-Word Size of the data-blocks (Filesize-4kb) 0x0000002C D-Word 1 0x000001FC D-Word Sum of all D-Words from 0x00000000 to 0x000001FB I have analyzed more registry files (from multiple machines running NT 4.0 german version) and could not find an explanation for the values marked with ???? the rest of the first 4kb page is not important... the "hbin"-Block ================ I don't know what "hbin" stands for, but this block is always a multiple of 4kb in size. Inside these hbin-blocks the different records are placed. The memory- management looks like a C-compiler heap management to me... hbin-Header =========== Offset Size Contents 0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268 0x0004 D-Word Offset from the 1st hbin-Block 0x0008 D-Word Offset to the next hbin-Block 0x001C D-Word Block-size The values in 0x0008 and 0x001C should be the same, so I don't know if they are correct or swapped... From offset 0x0020 inside a hbin-block data is stored with the following format: Offset Size Contents 0x0000 D-Word Data-block size 0x0004 ???? Data If the size field is negative (bit 31 set), the corresponding block is free and has a size of -blocksize! The data is stored as one record per block. Block size is a multiple of 4 and the last block reaches the next hbin-block, leaving no room. Records in the hbin-blocks ========================== nk-Record The nk-record can be treated as a kombination of tree-record and key-record of the win 95 registry. lf-Record The lf-record is the counterpart to the RGKN-record (the hash-function) vk-Record The vk-record consists information to a single value. sk-Record sk (? Security Key ?) is the ACL of the registry. Value-Lists The value-lists contain information about which values are inside a sub-key and don't have a header. Datas The datas of the registry are (like the value-list) stored without a header. All offset-values are relative to the first hbin-block and point to the block- size field of the record-entry. to get the file offset, you have to add the header size (4kb) and the size field (4 bytes)... the nk-Record ============= Offset Size Contents 0x0000 Word ID: ASCII-"nk" = 0x6B6E 0x0002 Word for the root-key: 0x2C, otherwise 0x20 0x0004 Q-Word write-date/time in windows nt notation 0x0010 D-Word Offset of Owner/Parent key 0x0014 D-Word number of sub-Keys 0x001C D-Word Offset of the sub-key lf-Records 0x0024 D-Word number of values 0x0028 D-Word Offset of the Value-List 0x002C D-Word Offset of the sk-Record 0x0030 D-Word Offset of the Class-Name 0x0044 D-Word Unused (data-trash) 0x0048 Word name-length 0x004A Word class-name length 0x004C ???? key-name the Value-List ============== Offset Size Contents 0x0000 D-Word Offset 1st Value 0x0004 D-Word Offset 2nd Value 0x???? D-Word Offset nth Value To determine the number of values, you have to look at the owner-nk-record! Der vk-Record ============= Offset Size Contents 0x0000 Word ID: ASCII-"vk" = 0x6B76 0x0002 Word name length 0x0004 D-Word length of the data 0x0008 D-Word Offset of Data 0x000C D-Word Type of value 0x0010 Word Flag 0x0012 Word Unused (data-trash) 0x0014 ???? Name If bit 0 of the flag-word is set, a name is present, otherwise the value has no name (=default) If the data-size is lower 5, the data-offset value is used to store the data itself! The data-types ============== Wert Beteutung 0x0001 RegSZ: character string (in UNICODE!) 0x0002 ExpandSZ: string with "%var%" expanding (UNICODE!) 0x0003 RegBin: raw-binary value 0x0004 RegDWord: Dword 0x0007 RegMultiSZ: multiple strings, seperated with 0 (UNICODE!) The "lf"-record =============== Offset Size Contents 0x0000 Word ID: ASCII-"lf" = 0x666C 0x0002 Word number of keys 0x0004 ???? Hash-Records Hash-Record =========== Offset Size Contents 0x0000 D-Word Offset of corresponding "nk"-Record 0x0004 D-Word ASCII: the first 4 characters of the key-name, padded with 0's. Case sensitiv! Keep in mind, that the value at 0x0004 is used for checking the data-consistency! If you change the key-name you have to change the hash-value too! The "sk"-block ============== (due to the complexity of the SAM-info, not clear jet) Offset Size Contents 0x0000 Word ID: ASCII-"sk" = 0x6B73 0x0002 Word Unused 0x0004 D-Word Offset of previous "sk"-Record 0x0008 D-Word Offset of next "sk"-Record 0x000C D-Word usage-counter 0x0010 D-Word Size of "sk"-record in bytes ???? ???? ???? Security and auditing settings... ???? The usage counter counts the number of references to this "sk"-record. You can use one "sk"-record for the entire registry! Windows nt date/time format =========================== The time-format is a 64-bit integer which is incremented every 0,0000001 seconds by 1 (I don't know how accurate it realy is!) It starts with 0 at the 1st of january 1601 0:00! All values are stored in GMT time! The time-zone is important to get the real time! Common values for win95 and win-nt ================================== Offset values marking an "end of list", are either 0 or -1 (0xFFFFFFFF). If a value has no name (length=0, flag(bit 0)=0), it is treated as the "Default" entry... If a value has no data (length=0), it is displayed as empty. simplyfied win-3.?? registry: ============================= +-----------+ | next rec. |---+ +-----> +------------+ | first sub | | | | Usage cnt. | | name | | +--> +------------+ | | length | | value | | | | next rec. | | | text |-------> +-------+ +-----------+ | | | name rec. |--+ +------------+ | xxxxx | +------------+ | | value rec. |--------> +------------+ +-------+ v | +------------+ | Usage cnt. | +-----------+ | | length | | next rec. | | | text |-------> +-------+ | first sub |------+ +------------+ | xxxxx | | name | +-------+ | value | +-----------+ Greatly simplyfied structure of the nt-registry: ================================================ +-------------------------------------------------------------------------+ v | +---------------+ +-------------> +-----------+ +------> +---------+ | | "nk" | | | lf-rec. | | | nk-rec. | | | ID | | | # of keys | | | parent |---+ | Date | | | 1st key |--+ | .... | | parent | | +-----------+ +---------+ | suk-keys |-------+ | values |---------------------> +----------+ | SK-rec. |---------------+ | 1. value |--> +----------+ | class |--+ | +----------+ | vk-rec. | +---------------+ | | | .... | v | | data |--> +-------+ +------------+ | +----------+ | xxxxx | | Class name | | +-------+ +------------+ | v +---------+ +---------+ +-----> | next sk |---> | Next sk |--+ | +---| prev sk | <---| prev sk | | | | | .... | | ... | | | | +---------+ +---------+ | | | ^ | | +--------------------+ | +------------------------------------+ -------------------------------------------------------------------------------- Hope this helps.... (Although it was "fun" for me to uncover this things, it took me several sleepless nights ;) B.D. chntpw_0.99.6.110511/INSTALL.txt0000600000175000017500000000325611562562244013735 0ustar jfsjfs The Offline NT Password & Registry Editor (c) 1997-2011 Petter Nordahl-Hagen This file is meant for developers. General usage is via the provided boot CD images, but static linux builds of the tools are also available in the source zip file. See REAMDE for general instructions and license info, HISTORY.txt for version info. If you want to build yourself, it should compile with most gcc compilers. However, I am not particulary good with types, so there may be some warnings. You may have to install the openssl-devel package from you linux distro to compile/link, since I need the static variant. (change the makefile to link dynamic if you wish) I link statically with libcrypto.a from OpenSSL. (chntpw only, other tools does not require crypto) Thanks to Denis Ducamp for modifying chntpw to use OpenSSL. Thanks to Mike Doty, via Alon Bar-Lev for 64 bit build compatible patch. (from http://bugs.gentoo.org/show_bug.cgi?id=185411) Look into Makefile, you may need to change things to fit your env. (also if you need 64 bit) If make goes well, you should have: chntpw - Password tool, dynamic with libc, static with OpenSSL chntpw.static - Completely static passord tool reged - Registry edit tool, dynamic linked with libc. No crypto. reged.static - Registry too, statically linked. cpnt - Simple copy utility, does not truncate file on write Now deprecated, was at least needed earlier for NTFS writes. Also, the floppies and CDs are build under a different environment for small libc size (uClibc), see website for details. (build scripts not currently available..) So, note that the binary then contains cryptographic code which may be illegal for you to export. Good luck. chntpw_0.99.6.110511/edlib.c0000644000175000017500000004156011562562244013321 0ustar jfsjfs/* * edlib.c - Registry edit interactive fuctions. * * Point of this is so that interactive registry editor * can be accessed from several other programs * * 2010-jun: New function from Aleksander Wojdyga: dpi, decode product ID * Mostly used on \Microsoft\Windows NT\CurrentVersion\DigitalProductId * Now as command in registry editor, but may be moved to chnpw menu later. * 2010-apr: Lots of bugfix and other patches from * Frediano Ziglio * His short patch comments: * remove leak * fix default value, bin and quote * support wide char in key * support wide character into value names * fix export for string with embedded end lines * remove some warnings * compute checksum writing * * 2008-mar: First version. Moved from chntpw.c * See HISTORY.txt for more detailed info on history. * ***** * * Copyright (c) 1997-2011 Petter Nordahl-Hagen. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; version 2 of the License. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * See file GPL.txt for the full license. * ***** */ #include #include #include #include #include #include "ntreg.h" const char edlib_version[] = "edlib version 0.1 110511, (c) Petter N Hagen"; #define ALLOC_DEBUG 0 /* Reg allocation debug hooks */ #define ADDBIN_DEBUG 0 /* Reg expansion debug hooks */ extern char *val_types[REG_MAX+1]; struct cmds { char cmd_str[12]; int cmd_num; }; #define MCMD_CD 1 #define MCMD_LS 2 #define MCMD_QUIT 3 #define MCMD_CAT 4 #define MCMD_STRUCT 5 #define MCMD_DEBUG 6 #define MCMD_HELP 7 #define MCMD_EXPORTKEY 8 #define MCMD_HIVE 9 #define MCMD_EDIT 10 #define MCMD_ALLOC 11 #define MCMD_FREE 12 #define MCMD_ADDV 13 #define MCMD_DELV 14 #define MCMD_DELVALL 15 #define MCMD_NEWKEY 16 #define MCMD_DELKEY 17 #define MCMD_CATHEX 18 #define MCMD_RDEL 19 #define MCMD_CK 20 #define MCMD_CAT_DPI 21 #define MCMD_ADDBIN 22 struct cmds maincmds[] = { { "cd" , MCMD_CD } , { "ls" , MCMD_LS } , { "dir", MCMD_LS } , { "q" , MCMD_QUIT } , { "cat", MCMD_CAT } , { "type",MCMD_CAT } , { "st" , MCMD_STRUCT } , { "debug", MCMD_DEBUG } , { "hive", MCMD_HIVE } , { "ed", MCMD_EDIT } , #if ALLOC_DEBUG { "alloc", MCMD_ALLOC } , { "free", MCMD_FREE } , #endif #if ADDBIN_DEBUG { "addbin", MCMD_ADDBIN }, #endif { "nv", MCMD_ADDV } , { "dv", MCMD_DELV } , { "delallv", MCMD_DELVALL } , { "nk", MCMD_NEWKEY } , { "dk", MCMD_DELKEY } , { "hex", MCMD_CATHEX } , { "rdel", MCMD_RDEL } , { "ek", MCMD_EXPORTKEY }, { "ck", MCMD_CK } , { "?", MCMD_HELP } , { "dpi", MCMD_CAT_DPI } , { "", 0 } }; /* display decoded DigitalProductId * nkofs = node * path = "DigitalProductId" or some other */ void cat_dpi(struct hive *hdesc, int nkofs, char *path) { void *data; int len,i,type; type = get_val_type(hdesc, nkofs, path, 0); if (type == -1) { printf("cat_dpi: No such value <%s>\n",path); return; } len = get_val_len(hdesc, nkofs, path, 0); if (len < 67) { printf("cat_dpi: Value <%s> is too short for decoding\n",path); return; } data = (void *)get_val_data(hdesc, nkofs, path, 0, 0); if (!data) { printf("cat_dpi: Value <%s> references NULL-pointer (bad boy!)\n",path); abort(); return; } if (type != REG_BINARY) { printf ("Only binary values\n"); return; } printf("Value <%s> of type %s, data length %d [0x%x]\n", path, (type < REG_MAX ? val_types[type] : "(unknown)"), len, len); char digits[] = {'B','C','D','F','G','H','J','K','M','P','Q','R','T','V','W','X','Y','2','3','4','6','7','8','9'}; #define RESULT_LEN 26 char result[RESULT_LEN]; memset (result, 0, RESULT_LEN); #define START_OFFSET 52 #define BUF_LEN 15 unsigned char buf[BUF_LEN]; memcpy (buf, data + START_OFFSET, BUF_LEN); for (i = RESULT_LEN - 2; i >= 0; i--) { unsigned int x = 0; int j; for (j = BUF_LEN - 1; j >= 0; j--) { x = (x << 8) + buf[j]; buf[j] = x / 24; x = x % 24; } result[i] = digits[x]; } printf ("\nDecoded product ID: [%s]\n", result); } /* display (cat) the value, * vofs = offset to 'nk' node, paths relative to this (or 0 for root) * path = path string to value * Does not handle all types yet (does a hexdump instead) */ void cat_vk(struct hive *hdesc, int nkofs, char *path, int dohex) { void *data; int len,i,type; // char string[SZ_MAX+1]; char *string = NULL; struct keyval *kv = NULL; type = get_val_type(hdesc, nkofs, path, TPF_VK); if (type == -1) { printf("cat_vk: No such value <%s>\n",path); return; } len = get_val_len(hdesc, nkofs, path, TPF_VK); if (!len) { printf("cat_vk: Value <%s> has zero length\n",path); return; } #if 0 data = (void *)get_val_data(hdesc, nkofs, path, 0, TPF_VK); if (!data) { printf("cat_vk: Value <%s> references NULL-pointer (bad boy!)\n",path); abort(); return; } #endif kv = get_val2buf(hdesc, NULL, nkofs, path, 0, TPF_VK); if (!kv) { printf("cat_vk: Value <%s> could not fetch data\n",path); abort(); } data = (void *)&(kv->data); printf("Value <%s> of type %s, data length %d [0x%x]\n", path, (type < REG_MAX ? val_types[type] : "(unknown)"), len, len); if (dohex) type = REG_BINARY; switch (type) { case REG_SZ: case REG_EXPAND_SZ: case REG_MULTI_SZ: string = string_regw2prog(data, len); // cheap_uni2ascii(data,string,len); for (i = 0; i < (len>>1)-1; i++) { if (string[i] == 0) string[i] = '\n'; if (type == REG_SZ) break; } puts(string); FREE(string); break; case REG_DWORD: printf("0x%08x",*(unsigned short *)data); break; default: printf("Don't know how to handle type yet!\n"); case REG_BINARY: hexdump((char *)data, 0, len, 1); } putchar('\n'); FREE(kv); } /* Edit value: Invoke whatever is needed to edit it * based on its type */ void edit_val(struct hive *h, int nkofs, char *path) { struct keyval *kv, *newkv; int type,len,n,i,in,go, newsize, d = 0, done, insert = 0; char inbuf[SZ_MAX+4]; char origstring[SZ_MAX+4]; char *newstring; char *dbuf; type = get_val_type(h, nkofs, path, TPF_VK); if (type == -1) { printf("Value <%s> not found!\n",path); return; } kv = get_val2buf(h, NULL, nkofs, path, type, TPF_VK); if (!kv) { printf("Unable to get data of value <%s>\n",path); return; } len = kv->len; printf("EDIT: <%s> of type %s with length %d [0x%x]\n", path, (type < REG_MAX ? val_types[type] : "(unknown)"), len, len); switch(type) { case REG_DWORD: printf("DWORD: Old value %d [0x%x], ", kv->data, kv->data); fmyinput("enter new value (prepend 0x if hex, empty to keep old value)\n-> ", inbuf, 12); if (*inbuf) { sscanf(inbuf,"%i",&kv->data); d = 1; } printf("DWORD: New value %d [0x%x], ", kv->data, kv->data); break; case REG_SZ: case REG_EXPAND_SZ: case REG_MULTI_SZ: newstring = NULL; dbuf = (char *)&kv->data; cheap_uni2ascii(dbuf,origstring,len); n = 0; i = 0; while (i < (len>>1)-1) { printf("[%2d]: %s\n",n,origstring+i); i += strlen(origstring+i) + 1; n++; } printf("\nNow enter new strings, one by one.\n"); printf("Enter nothing to keep old.\n"); if (type == REG_MULTI_SZ) { printf("'--n' to quit (remove rest of strings)\n"); printf("'--i' insert new string at this point\n"); printf("'--q' to quit (leaving remaining strings as is)\n"); printf("'--Q' to quit and discard all changes\n"); printf("'--e' for empty string in this position\n"); } n = 0; i = 0; in = 0; go = 0; done = 0; /* Now this one is RATHER UGLY :-} */ while (i < (len>>1)-1 || !done) { printf("[%2d]: %s\n",n, insert == 1 ? "[INSERT]" : ((i < (len>>1)-1 ) ? origstring+i : "[NEW]")); if (insert) insert++; if (!go) fmyinput("-> ",inbuf, 500); else *inbuf = 0; if (*inbuf && strcmp("--q", inbuf)) { if (!strcmp("--n", inbuf) || !strcmp("--Q", inbuf)) { /* Zap rest */ i = (len>>1) ; done = 1; } else if (strcmp("--i", inbuf)) { /* Copy out given string */ if (!strcmp("--e",inbuf)) *inbuf = '\0'; if (newstring) newstring = realloc(newstring, in+strlen(inbuf)+1); else newstring = malloc(in+strlen(inbuf)+1); strcpy(newstring+in, inbuf); in += strlen(inbuf)+1; } else { insert = 1; } } else { /* Copy out default string */ if (newstring) newstring = realloc(newstring, in+strlen(origstring+i)+1); else newstring = malloc(in + strlen(origstring+i) + 1); strcpy(newstring+in, origstring+i); in += strlen(origstring+i)+1; if (!strcmp("--q", inbuf)) { go = 1; done = 1; if (!(i < (len>>1)-1 )) { in--; /* remove last empty if in NEW-mode */ } } } if (!insert) i += strlen(origstring+i) + 1; if (insert != 1) n++; if (insert == 2) insert = 0; if (type != REG_MULTI_SZ) { i = (len<<1); done = 1; } } if (strcmp("--Q", inbuf)) { /* We didn't bail out */ if (newstring) newstring = realloc(newstring, in+1); else newstring = malloc(in+1); if (type == REG_MULTI_SZ) { in++; *(newstring+in) = '\0'; /* Must add null termination */ } ALLOC(newkv,1,(in<<1)+sizeof(int)); newkv->len = in<<1; printf("newkv->len: %d\n",newkv->len); cheap_ascii2uni(newstring, (char *)&(newkv->data), in); d = 1; FREE(kv); kv = newkv; } break; default: printf("Type not handeled (yet), invoking hex editor on data!\n"); case REG_BINARY: fmyinput("New length (ENTER to keep same): ",inbuf,90); if (*inbuf) { newsize = atoi(inbuf); ALLOC(newkv,1,newsize+sizeof(int)+4); bzero(newkv,newsize+sizeof(int)+4); memcpy(newkv, kv, ((len < newsize) ? (len) : (newsize)) + sizeof(int)); FREE(kv); kv = newkv; kv->len = newsize; } d = debugit((char *)&kv->data, kv->len); break; } if (d) { if (!(put_buf2val(h, kv, nkofs, path, type, TPF_VK))) { printf("Failed to set value!?\n"); } } FREE(kv); } /* look up command in array */ int parsecmd(char **s, struct cmds *cmd) { int l = 0; while ((*s)[l] && ((*s)[l] != ' ')) { l++; } while (cmd->cmd_num) { if (!strncmp(*s, cmd->cmd_str, l)) { *s += l; return(cmd->cmd_num); } cmd++; } return(0); } /* Lot of people didn't understand the "nv" command. * Actually the command should understand the type names too, but.. some later time */ void nv_help(void) { int i; printf("Command syntax is:\n\n" " nv \n\n" "where should be the HEX NUMBER from one of these registry value types:\n\n"); for (i=0; i < REG_MAX; i++) { printf(" %2x : %s\n",i,val_types[i]); } printf("\nExample:\n nv 4 foobar\n"); printf("to make a new value named foobar of the type REG_DWORD\n\n"); } /* Interactive registry editor * hive - list of loaded hives (array pointing to hive structs) * no_hives - max number of hives loaded */ void regedit_interactive(struct hive *hive[], int no_hives) { struct hive *hdesc; int cdofs, newofs; struct nk_key *cdkey; char inbuf[100], *bp, *file, *prefix; char path[1000]; int l, vkofs, nh, i; int usehive = 0; struct keyval *kv; #if ALLOC_DEBUG int pagestart; int freetest; #endif hdesc = hive[usehive]; cdofs = hdesc->rootofs; printf("Simple registry editor. ? for help.\n"); while (1) { cdkey = (struct nk_key *)(hdesc->buffer + cdofs); *path = 0; get_abs_path(hdesc,cdofs+4, path, 50); #if ALLOC_DEBUG pagestart = find_page_start(hdesc,cdofs); printf("find_page_start: 0x%x\n",pagestart); freetest = find_free_blk(hdesc,pagestart,10); printf("find_free_blk: 0x%x\n",freetest); #endif if (hdesc->state & HMODE_VERBOSE) printf("\n[%0x] %s> ",cdofs,path); else printf("\n%s> ",path); l = fmyinput("",inbuf,90); bp = inbuf; skipspace(&bp); if (l > 0 && *bp) { switch(parsecmd(&bp,maincmds)) { case MCMD_HELP: printf("Simple registry editor:\n"); printf("hive [] - list loaded hives or switch to hive numer n\n"); printf("cd - change current key\n"); printf("ls | dir [] - show subkeys & values,\n"); printf("cat | type - show key value\n"); printf("dpi - show decoded DigitalProductId value\n"); printf("hex - hexdump of value data\n"); printf("ck [] - Show keys class data, if it has any\n"); printf("nk - add key\n"); printf("dk - delete key (must be empty)\n"); printf("ed - Edit value\n"); printf("nv - Add value\n"); printf("dv - Delete value\n"); printf("delallv - Delete all values in current key\n"); printf("rdel - Recursively delete key & subkeys\n"); printf("ek - export key to (Windows .reg file format)\n"); printf("debug - enter buffer hexeditor\n"); printf("st [] - debug function: show struct info\n"); printf("q - quit\n"); break; case MCMD_DELKEY : bp++; skipspace(&bp); del_key(hdesc, cdofs + 4, bp); break; case MCMD_NEWKEY : bp++; skipspace(&bp); add_key(hdesc, cdofs + 4, bp); break; case MCMD_DELVALL : bp++; skipspace(&bp); del_allvalues(hdesc, cdofs + 4); break; case MCMD_DELV : bp++; skipspace(&bp); del_value(hdesc, cdofs + 4, bp, 0); break; case MCMD_ADDV : bp++; skipspace(&bp); if (!isxdigit(*bp)) { nv_help(); break; } nh = gethex(&bp); skipspace(&bp); if (!*bp) { nv_help(); break; } add_value(hdesc, cdofs+4, bp, nh); break; #if ALLOC_DEBUG case MCMD_FREE : bp++; skipspace(&bp); nh = gethex(&bp); free_block(hdesc, nh); break; case MCMD_ALLOC : bp++; skipspace(&bp); nh = gethex(&bp); alloc_block(hdesc, cdofs+4, nh); break; #endif #if ADDBIN_DEBUG case MCMD_ADDBIN : bp++; skipspace(&bp); nh = gethex(&bp); add_bin(hdesc, nh); break; #endif case MCMD_LS : bp++; skipspace(&bp); nk_ls(hdesc, bp, cdofs+4, 0); break; case MCMD_CK : bp++; skipspace(&bp); kv = get_class(hdesc, cdofs+4, bp); if (kv) { hexdump((char *)&kv->data, 0, kv->len, 1); FREE(kv); } break; case MCMD_RDEL : bp++; skipspace(&bp); rdel_keys(hdesc, bp, cdofs+4); break; case MCMD_EDIT : bp++; skipspace(&bp); edit_val(hdesc, cdofs+4, bp); break; case MCMD_HIVE : bp++; skipspace(&bp); if (*bp) { nh = gethex(&bp); if (nh >= 0 && nh < no_hives) { usehive = nh; printf("Switching to hive #%d, named <%s>, size %d [0x%x]\n", usehive, hive[usehive]->filename, hive[usehive]->size, hive[usehive]->size); hdesc = hive[usehive]; cdofs = hdesc->rootofs; } } else { for (nh = 0; nh < no_hives; nh++) { printf("%c %c %2d %9d 0x%08x <%s>\n", (nh == usehive) ? '*' : ' ', (hive[nh]->state & HMODE_DIRTY) ? 'D' : ' ', nh, hive[nh]->size, hive[nh]->size, hive[nh]->filename); } } break; case MCMD_CD : bp++; skipspace(&bp); newofs = trav_path(hdesc, cdofs+4,bp,TPF_NK); if (newofs) cdofs = newofs; else printf("Key %s not found!\n",bp); break; case MCMD_CAT: bp++; skipspace(&bp); cat_vk(hdesc,cdofs+4,bp,0); break; case MCMD_CAT_DPI: bp++; skipspace(&bp); cat_dpi (hdesc, cdofs+4, bp); break; case MCMD_CATHEX: bp++; skipspace(&bp); cat_vk(hdesc,cdofs+4,bp,1); break; case MCMD_EXPORTKEY : bp++; skipspace(&bp); file = bp; i = 0; while(*bp != ' ' && (*bp)) { i++; bp++; } file[i] = '\0'; bp++; skipspace(&bp); prefix = bp; i = 0; while(*bp != ' ' && (*bp)) { i++; bp++; } prefix[i] = '\0'; bp++; skipspace(&bp); export_key(hdesc, cdofs + 4, bp, file, prefix); break; case MCMD_STRUCT: bp++; skipspace(&bp); vkofs = cdofs; if (*bp) { vkofs = gethex(&bp); } parse_block(hdesc,vkofs,2); break; case MCMD_DEBUG: if (debugit(hdesc->buffer,hdesc->size)) hdesc->state |= HMODE_DIRTY; break; case MCMD_QUIT: return; break; default: printf("Unknown command: %s, type ? for help\n",bp); break; } } } } chntpw_0.99.6.110511/reged.static0000755000175000017500000214013011562562244014373 0ustar jfsjfsELF@44 (]]``A `A h %ԀԀ ``A `A (QtdGNU A *US[øt~X[%A h1^PTRhP)h)QVh4/US=J uTJ A |A 9sJ |A J 9r`5 t $ 蓳J []ÍU@9 tD$J $ =A tt $A U$Y USD$8D$<D$@D$DD$HD$LD$PD$TD$XD$|1] $Y D$wC5wx^ D$<vD$8lD$@bD$HXD$PNL$TK :L$T3L$T,L$T "$ $D$|D$E D$E$>D$w|$wA|$8u|$<u|$@u$詫|$@t@|$8t9G ¸<] T$ D$.D$$S^$b|$8vH E D$`H E D$dH E D$hH E D$lK t-l] T$lT$T$hT$ T$dT$T$`T$$脶|$`tAD$`t6|$dt/D$dt$|$htD$ht|$lt D$luw${K D$TD$D$`$!d d u*] G L$`L$T$$讵$"K d T$dT$T$lT$ T$hT$D$$kK K |$@YH E D$`H E D$dH E D$pK t] T$dT$T$`T$$'|$`t/D$`t$|$dtD$dt|$pt D$pu,$0K D$TD$D$`$~d d u*] G L$`L$T$$f$ڨK d T$dT$T$pT$$rK K D$L|$<tK D$$d BD$<|$<H K E D$`K D$TD$D$`$~d d u$] $K K H K E D$`|$`tD$`tK  uK D$$d uD$L|$Lk$^ D$\D$\d @ti|$PuZ|$HuSD$\d +^ T$T$\T$$D$\d @ t $8^ $ FD$DD$\K 9D$\n|$D|$Pu#|$HuD$D$.D$$t^  D$.E@8‹E EE@ȋE‹E@8)É؉+U Pi L$T$$E]UELUEDEE‹E@8)Ɖ+U i L$\$ ML$T$$蓝EE@;E$'i 趫0[^]US$i U T$$TE@8‹E EE@ȋE‹E@8)É؉+U Pi L$T$$ EOUEDEE‹E@8)É؉+U i L$ ML$T$$跜EE@;E$'i ڪ$[]US$j U T$$yE@8‹E EE@ȋE‹E@8)É؉+U ,j L$T$$0EOUEDEE‹E@8)É؉+U i L$ ML$T$$ܛEE@;E$'i $[]US$Nj U T$$螛E@8‹E EE@ȋE‹E@8)É؉+U dj L$T$$UE@E‹E@8)É؉+U j L$T$$$'i O$[]U8EP8E $E}u.$j EP$E@8T$$B[}y^]E@UEPE@PEP}EU j UT$UT$ L$U T$$VXE@ UEP E@PEP}t2EU k UT$UT$ L$U T$$E EP8E fE@8U ffE}^E=il=il&=fl=hl=bd=ir=ir =knt=ks=kvt#ED$E D$E$ED$E D$E$ED$E D$E$_ED$E D$E$xED$E D$E$P]ED$E D$E$BED$E D$E$'ED$E D$E$ $Dk 蠦EU(EeEEE@8‹EEE=hbintKE@uhk UT$$&E@EE;E ~EE@$;EU(E EE@8‹E EEP8E$QE}uM$k ǥk UT$$sE U)‹E@9u$l 蒥>F}y] E;E|E!EEE U)‹E@9bU(E tE ƒ)E EyE@8‹EEE=hbintiE@uLl UT$$螖DE D$ED$E$E}tEE@EE@0;ExUHE@t)El G L$T$$E $%EE@0Em UT$UT$ U T$U T$$ЕEH$EP$Jq EL$ T$D$E$)E$cE\EUD$ED$$lE$IE+EEEL$T$$"eE@ED$ ED$T$E$DU8EE$_cEE@8‹E EEEEEE@8‹EEE@fuE<@u }uEzE%t E@;EuME@;E|AEUD$T$E$xcu!E@;EuE"}u EEEE;EDEU}u E@8E} u E@(E E@u'E<\uE<\tEE@(E UE EEf=nkt$ q %wE@vEE7EE<\uEăE<\uEEEEEEEEtEE<\uEăE<\tEEE<\Eԃ}u E }uQEtDE<.u:E%u.UċEԍEUT$ D$E D$E$otE%uu}uoD$ED$$/q {auPE@EUċEԍUE@f,uE EML$ T$D$E$EAu-EEEE@$E@t=ED$$!^D$$>EċEčEE@(EЋUEЍEE@$UT$T$ D$EЉD$E$+Eȃ}tEEE@EE@E̋UE̍EEf=riunEEE@EEEH8U؋EDEE@EEf=liteEH8U؋EDEEBEf=liuUE̍EEEEEE@EU荅)D$T$$ 1E썅$a^EED}tUȋEDEUȋEDEUEEEf=nkt$4q 2E@Hf$Uq E@H;E| E%t!E@H;EE%E@ t$EULD$T$$8^E"ULD$T$E$bE}u9E$PCUċEԍEUT$ D$ED$E$EE;EE}tbE;E}ZU؋EDEE@8UЉEE@EEf=lit"EH8U؋EDEEE;E} }&E$BUVS`EED$ E D$ED$E$E}u_q U T$$EE@8‹EEE@%tzq UT$$рEf=nkt$$q EP$E@8T$$!EH$EPq L$T$$耀E@JftE@Jиq T$$Y$ ͐E@$q sE@%u2ME@Jft* q L$D$$7]E@Jft* Mr \$ D$L$$EtE$@EED$EĉD$ EȉD$ED$E$@EE@$"$r 荍E@%tD]Eԃ  EԋB g M؋U̍r\r \$D$ L$t$$~8]Eԃ  EԋB g Mغsr \$ D$L$$~Eԃu1u܋]܋E$Y)¸r t$ \$T$$~$ EtE$?EẺD$ EȉD$ED$E$>`[^]U(ED$ ED$E D$E$E}uEE@8‹EEE@ U(ED$ ED$E D$E$CE}uFEE@8‹EEE@%EE@=uE%tEEU(ED$ ED$E D$E$E}ur UT$$}nEE@8‹EEE@u{E@=uE%tE Z}t.E@ t$E@ ;Etr UT$$|mE@yEEP8E@UhED$ ED$ED$E$kEă}u "} tE ;E} ED$ED$ ED$ED$E$E} tE E3EăD$$'/E}u$a |lEUĉ}?WEEEf=dbtlE@E̋E@Eиr UЉT$ỦT$$M{EEĉEEE@8UыUЍЉ$EԋEP8Eԍ$)ȉE؋UE9~ЉEs U؉T$U؉T$ UԉT$UȉT$$z4s UT$ UT$U܉T$$zEPE܍EEUR8MԃʉD$T$E$?^EE܋E)EEE;E.}t(}t"}tEċUD$ED$$]EU8ED$D$ED$ E D$D$E$jE}u$E@E}tE$:EEU(EP8E $:E]E;E}?ls UT$ UT$U T$$UyEP$E@8T$$8jEUR8M ʉD$ED$$\UHE@8‹E E؋E؋@E}e}?8EP8E؋@E܋Ef=dbtiE@EE܋@Es UT$UT$$zxE~E@8UыUЉ$EEP8E$؉Es UT$UT$ UT$UT$$ xED$E$:EE;EvEP4t T$$wED$E$E؋@`t T$$w}tE؋@D$E$E@E@E UHED$ ED$E D$E$Eԃ}u (EE@8‹EԍE̋EԉD$E$}}?hM7H` )ȃE踌t UT$ UT$UT$$vD$EԉD$E$gE؋E@8U؃ЉEЋEfdbE‹EfPED$EԉD$E$#E܋E@8U؃ЉEЋE܍EЉPt U܉T$U؉T$$ vElE?ED$EԉD$E$Et UT$UT$$uE@8UыU܍ЉEEEEE;E|E؉E@ED$EԉD$E$GE"ẼUԋẺ)ȉEE E}u5E@8‹EԍẼ}xE썐ẺPE̋UPEUSDEEd }t Eu E@8‹E EEf=nkt$$u E@$UR(D$UT$ D$L$E$tPu UT$$St3D$tu E$&MuEEE@$t E@(EE@$D$E D$E$E}u$xu "E@8‹E E}tEċEf=nkt$w q EE@u$w oq E@EE@EE@8UЉEEf=lftHEf=lhtY{ U܉T$ UT$D$E$ME@$EE$EEuD{ UT$ D$D$$XE$$tu KEE1{ UT$D$E$+ME$`(UЃEEu U{ T$D$E$LE/ED$D$ ED$E D$E$ED$ ED$E D$E$E؋E؉D$E$ED$ E$$uD$ E$$t8E$ EUT$UT$ U؉T$UT$$E$:EE$N { UT$D$E$KE$( { UT$ D$D$$WvED$D$ ED$E D$E$aED$ ED$E D$E$E؋EUT$UT$ U؉T$UT$$EtE$z EE$h ED$ EЉD$E D$E$'GE@t{EE@EȋUT$UT$ D$E D$E$EȅtEȉ$ EED$ẺD$ EЉD$E D$E$E܉$ p[^]US4{ ET$$nUE}u7: :$#{ \$ D$ED$$3J{ UT$$J{ UT$ D$&D$$&UED$ED$ ED$E D$E${ UT$ D$D$$TE$L4[]U(EEEME$pE}u }u}tJEE} tEEUEE UEm} tE$mu }uEEEEEE EE }t$ED$ED$E $֛E$ToEU8EEEED$ED$ D$ NE D$E$E NEEE$m#E}u#E$l]WE{8E% uՋEEEEtE< t E< uދEEuE$WlE$"EEEE<[uOEEt E<]uEu $| UEEPEEEmE@E<"uuE<=u$}uEEUEPEE(EEuEEUEEUEEEEuEEuߋEU(E<"tE0E$!EEE<"u EEEUEE} QEE<\uEEuEEEUUEEUUEEEEuEEuEEEEEGEE<\uEEEUUEEEEuƋEEEEUHEEED$D$@| E$!uiF| EM܉L$T$$FEEED$$TE}u$a E5E܉‹EP/D$D$O| E$ { EM؉L$T$$XcXc$蟈EEE$N]u }}t  , D$E D$$8V UT$$r8_ UT$$^8r UT$$J8E$O;}tE@ƒEPԜ[]UE@tE@$~BEtE$EE@8tE@8$E@8}tE$EUEE@8EEEUЋ1EE}~~EUS$E@t TE@u =E@usED$$AUBE@u=&$?U G D$ \$L$$6E@ƒEPE@D$D$$RBE@8EE$UE@$EP8E@L$T$$AEE@$;Et:%$U G D$ \$L$$5E@ƒEP$[]UVSE %EE % ED$<$Eă}u$a {6&E$WUĉE@E@$E@8E t EEEċUȉT$$J?UĉBEċ@$$gUċ G D$ \$L$$4EM EċUȉT$$>UĉBEċ@yHo$$Uċ G D$ \$L$$a4Eĉ$gEċ@lT$$t=t$5 45$(UEĉP$E ƒEĉPEċ@$D$${‹EĉP8Eċ@8u$a 4$Eċ@$EċP8Eċ@L$T$$>E̋Eċ@$;E~|!DžPUЍD21)0K Q Eȉ$4K D$ẺD$t&ڋE+UЍ0K ff댍v'UD$$ÐUVSpA pA t4lA fu[^]/&'UWVS,uEpA } mpA }Ut%1ۍE|$4$D$pA ;]rWEpA mpA }Et"1ۍvE|$4$D$pA ;]r,[^_]Ít&'UWVSt1=*u051f<*4u9r[^_]$ <Ue]ÐeU t]  I0 ㍶'eU t]  I( ㍶'eU t]  I$ 㐐1T$rzL$e3  J $e3  Jj BÐU ED$ D$$ÐUWe9Q t%1e= t Q Q Q Q t=5t&tfftHtD| Q D$| T$$Q Q $Q $ Q zQ 6Q \Q Q Q u"Q e= t-Q $ e9Q t%1e= t Q Q Q 1#󫍅pQ 9uDžtD$D$$ Q qQ $hQ ? Q -.Q M. Q  .IUWVS,} EuEtBt&CLt"Ctjt=uދ}tt x s x r4$fP @ e34$D$tt&P t$@ e3$Lt&D e30$UED$D$C $U1WVSe= t Q jE1Kt3QDu9D yuuCtQ볍v tEȃTK(e ,e e= t-Q [^_]Åt VFD$$1҅tU2͍&U1WVSe= t Q zE01&Kt3Q|u9D yuuCt~މ볍v trȃTK(e ,e e= t-Q Ҹt$Ee3 BE BEB 1[^_]Éޅt VFD$$襼1҅tU2fU1WVSe= t Q Z5C 1Kt3ATu9T yuuCt~މ볍v trȃTK(e ,e e= t-Q Ҹt$Ee3 BE BEB 1[^_]Éޅt VFD$$e1҅tC 5C ɍ Q 3)Q S) Q )vQ 3) Q (Q ).UeD$ D$ED$E D$E$FÍt&UeD$ED$ ED$E D$E$ÐUWVS0}UBE1ۃ}u}$u}v4u}DV tuUt&DN uU<-<+EE0U2EV} LE1E}  ɉUE|E9Ep‰؍NEEMԍC< vFt%1: t f : u9w9`MۋA4DXA<79EM9MM9MMMȉE9Ulu tu ]}-9EEU؅DEe10[^_]Ë}I1E EE_t&9EH&EF9UFUM 1t+E~}JB_<x+VHBBuBe= t*]u}]Ívu두G P;PsM PHf>x'VHBBuBe= t*u; $D$ $n@=롍 Y뼐Uuu]] }twf;x0SHe=9zt1e= t uZSHzBt$$yAf;x'KHAAuAe= t)u]Ћu}]Í 띍 ߐUG u}}]f:x?ZHeE9Ct*1e= t ZHMG KCB;BsLBf>x'VHBBuBe= t*uh]u}]Á|$$>f>x'VHBBuBe= t*u $ @돍ڐUS]$tCX]@[]v[]Ív'UVS$]CX;PS;SsTUPP,H0P4H8CXPPPT$PT$,T$UT$ST$ SD$4$T$V ECCX;Pr#eT $[^]Ð$[^]Í&$X"¸tދSCXUPH@ t$9#$pCX# e 눍UWVS}] uD$4GXP9PMu11EWP;P wt<$a GXH}H}UҐGLWPD$ED$D$ D$D$$P$!Ѓt E>{<>o鐍t&U4U]Eu] }uҋ}uG +GօD$ \$t$<$P@҉D$T$GW D$$T$ )‰9։D$T$OD$$ىG OOT$L$'WLOPT&G+G օlefG+G_LwP)։؉]u}]f9jL$ T$$OW OfUS]UT$ U M$T$L$P@xCLSP[]Ðt&[]U ]]u}C;Ct^D$ +CD$T$C8$sK+Kω11 u4CLC SPCC1]u}]Í+Cҍ Ӎ&'UE@8E]&'U]ÉuU}T$$PHuE%=t.Kh  O‰CX]u}]ËEċU tƃ|&wsLKP!σt9| 9&rC8D$D$D$ D$D$T$$NEUD$ D$C8T$$M3Uĉ1 tL$4$CLCPD$D$ t$$K$CL#CPtBCL` s CEƉsshCLEąCP` O‰CXCLCP뮍&'U $t$|$]u }}u ]$@ t$|$]'US]][]@fU]ÉuU}T$$PHuE%=tnSC $)ЉD${h  C CO‰CXC CC]u}]Ít&}ċu t|&lfډUM!ʉUSK |#M9MƋ|#uD$ L$t$$UC|‰S C+CsL{P‹K )׋|ȉsL{P)ЉS 9׉MMEU|9s |UEMC+|K9}LD$C8D$ T$$K +Kω11 tX 1|s Jf9r1v#u)L$$KE|ȉC CL1SPD'U uu]M }~^);]s2ulUMhUM~^);]su)ȋ]u}]Ðt&9]F]$M\$|$ӮM^É $M\$|$趮)]4$EX~^UM)9]v[]L$4$\$P UM)hv'US]C;Cs []ÍvuC;Cr ݋][]@t&'UWVS]Ci} uvCS)9Ct S )9C CCCCCtS )ƒUv 1u)ЉL$|$$P8SL)ƋKPUUM!ʃTEUCLSPCE[)^_]Ít$<$D$xEs1[)^_]Í$vT$<$D$UͬUS)։$2wfu0 vhvC$t$1#$4u ;U$]Éu։}tfCLCPL$t$$P<CDShC҉C CCCCC C]u}]Ít&CS9t)‰MD$ T$D$$W@M!׉}1}tCLSP[vfq|$t$$AfCDOt&^t&Rt&'U1WVS]} U}% = UދBR9w`UD$$P My +y1Ƀv1щ)tpM}t$|$ $$)V)1Et8M9؉F1f  9uM}Q)ƋEJ)[^_]ÍыRA 1E)9w49s~~ Nt 9sp9 u)AEY|$$t$֩U}Bk)Evt&UEK)9REt&t&'U1WVS ]}u 3)Å~JG<uI\$t$G8$yۋE )؋wP_Lx‰WLOP [^_]ËE)։\$t$G8$뵍t&UE@8E]&'US]SC $)ЉD$C8C CE[]t&U E D$E@8$D$Ít&'UEU M@<uMU @8E]@8E]UWVS]S;S.KKG fxArHeE9Ft*1e= trHEG FF%=uD$$P f?x2WHBBu"Be= t*8&$XCS C)‰C CCCCT$D$$Q8~ESLKPC!΃tƉωsL{PC[^_]Ít&[^_]Ðt&u> [^_]ÍC$t$Y#$;.t& v e zf?x+WHBBuBe= t*  $t&'UWVS]u}C ;C_CSD$uE E9C<SLKPT$D$L$ !ȃUS J A{C)D$D$T$T$ +D$T$9UD$T$ ST$ 9U| D$9E E +D$C#SLCCP{ {{{x+D$ T$D$$Q@E U &E UĄ[^_]Í&D$$D$$RH$T&t$ MU $L$T$P@!уtK#CLSPK KKKKKĄ[^_]Ít& uK Cu })ȉ!ƋE !׋U)D$+CT$ 9T$ |9D$vu }D$D$ t$|$D$ $P@҉ƉT$ T$H8D$ SC )ЉT$D$$щ9L$ | 9D$D$CC D$CCD$CϋUsLCC{P#CCCE YvC+C)E CLUSP!уE UM 1/ t&D$4%=(D$PT$TE U1fC;CD$t&C t$!#$*CCCCC CCD$ D$D$$P@!уUCLSPt&$)'9E e11D$Nt$|$ u }t$|$ )ωu }D$St&'US E]D$E $D$$t$CCCCC CC؃ []Í&1ۃ []Í&'U ]]uU }MuC<}E% ȉt$D$$Iƅ% s8 Ёt$؋u]}]Ít&D$D$ D$D$$P$!Ѓue<t4$-v1뙃% ȉt$D$$B'US] $CLCP$C8[]Í'US ]CXǃ ǀ ED$E $D$I"tCCCCC CC؃ []ËCXǃ` ǀ`  1[]É'US ]{8t*Sh~ICXP @$T$)D${@tE ] []bf$PDfSK)tˉO'U uu]]}} u1]u}]Ðt&CS9t2)‰D$ T$D$$Q@!уtsCLSPt$|$$P<CDt(ft#T$U|$$ UfCDKhCɉC CCCC~2C 9։C80fCLCPtt&fuUS]SC9wtC+CuCL1CP[]ÍD$ D$L$$R@!ЃtCC봸e<t[]ÍvKh~1CXP @$T$)D$cZ뾍t&)‰T$D$$ٍ&UVS]U tBKC;C + Cuu tfƒ[^]Ít&CCVC9C s CC ssss shtCxt&t&tKU$)ȉD$L$&UleS$)ЉD$T$KCCCef e  U$"C UC CCsh~:CXUH @$L$)D$UDCKU$)ȉD$L$>U͋sU$) C U+K9F)ȋ C C~t&UWVS]{81%=$9$PDSh҉~^CX@ t$2.D$ D$D$$.CX@@@@ @D$ D$D$$ C CCCCC$D $DC8CLCP[^_]fKh~)CXP @$T$)D$t&SC$T$)ЉD$'UWVSu/S;CS vC#CCCC1[]Í&S(S ׋D$$P ¸tˋC띍t&'UEM Phu@hM E]B &U]ÍUS]$P¸t SS[]ÍUE]B &'USEM]L$M \$D$ $L$R$[]Í&UU E@<@@ @ @@@@@@4@$@(@,@0f@D@Ht@@]Ív'U1]É'U]ÐUS]U C;C v H@8t T$$Pt#[]fK퐍&US]C;C vPS@#[]ÍvD$$Puۃ[]É'UVSM u19s&{ Ctv9s: u)[^]ÍE[^] UUJA0t9uf9tu]Ã0]Ív'UEU ]@+B US]StuJ+J C)[]ËJ+JU$t$M Q;Ut $t$]ËAxAtjBZ,B,B ZZ$B$AZ ZB1$t$]Ít&u1Br$Z,B,B r ZZB$A뽍t&Z 봍vZ묍vU]ÐU]ÍU]ÍU1]É'U]ÍU]Ít&'UE ]ÍU1]É'UE]@4Ðt&UE]Ð&e9S Ut%1e= t S S S ]áS US u"S e= t-S ]Ð&US S S ]Í'US]Ctt2E MCEɉC u []Í#[]Í&S $)T$믉'US]tGS,CSS$C,C SS C$$WkC$C,C([]Ít&C$ԍvU1WVSu}] fJz9s:)9FwZt(u1֍&9uuJ)tH $UL$P Ut*f\$U|$ $یUB뵍vE)[^_]ÍvUWVSÃ$@ U)ljEC0J9OuK,)MK$})9}u)օxRu.41U+S s(t)Pu1$[^_]Ðt&}T$ $|$苌C0s$븍v؉D$E $D$EC ){$D$׋U<$)‰T$DC0s$nK,MK$U)ʉU1FBdU܉E$^U܉ǸQx:s Od $t$MT$M΋C$$iC0{$}{,S s,؍Od $Mt$U܉D$-U܋uT$)։t$$腋M뢍&'U$]]uM }SC 9v)3ЁtUPSH]u}]Ít&3u~s$t=sC, s,s$CS$Cs 벍&Br9t={$M$K]MC$耉C,C(t&S딍vsdsM)ƍ6E$ ]tY0C U$t$D$kC $gU{ M}ЉS{S(t&؉MM{UWVS EEPEe9S t%1e= t S S S E 5S ۣS e=vE f;S x-SH9zt!1e= t \SHzB%=f;x+SHBBuBe= t*S S 9][4`S S u"S e= t-S EtED$$i [^_]Ðt&D$$P :&ED$D$P$iW&UWVS(uEEPEt;e9S t%1e= t S S S E =S EeEE DžS t9f;x3SHE9Bt$1e= t SHE܉BBKhCXP;P v#D$$P EEEt8f;x2SHBBu"Be= t*6&S S 9![4$tS S tAU؅tED$$gE([^_]Ít&C;C5S&S e= t-S 뛍t&ED$D$P$egUWVS$E ۉEeEƃ%{hSH1M;Je= t t5苪SHE;Be= t fCHU@P=S u'u!ST S`C\C T )ЉCdD$D$$P,u2fCh[4E[^_]ÍvB낐t&SHBBuBe= t* Ch[4룐胩.'U$.ÍU(]]u}% EPEe9S t%1e= t S f S S f;S x4SHe=9zt!1e= t 3 SHzBE S f;E C4xSHBBS S S u"S e= t-S  tED$$_d]u}]fED$D$P$5dBe= t*x ]UWVS];QfEPEe9S t%1e= t S  S S f;S x4SHe=9zt!1e= t  SHzBE t59 B4t&9fu9ÍP4@4fu#f;xSHBBS S S u"S e= t-S L tED$$b[^_]Ã4&C4S i&ED$D$P$ebBe= t* BC4S E US]Ctt:C0tv@uC$t$]C$][]S $)T$C C뙍vUM ES]UHH@<@@ @ @@@@@@4@$@(@,@0f@DtAAۉXhxXMPXBBBBB BBB B$B(@\[]ÍUU EPH@<@@ @ @@@@@@4@$@(@,@0f@DtBB@h@\]ÍUS]C0tC0C$tAtCS,KC,C SK C$$[C$C,C([]Ð&UVS]D$D$D$ "D$D$ $Ƹt Ctt!#s s [^]ÍS $)T$;'U]]uu}} $P0tgtcƒSt 47{s CCCCCC ؋u]}]ÍsGS҉ttss 랐t&1뿍t&C $)%D$MȍvC $)%D$-E&UVS] u^u6SuC0+S Vs0[^]ÐC0+SVs0[^]ÍvC;Cw:u+S;CS vCCCCCȀ뛍S(S ۋD$$P t C릋a&US]ChChS;SS0C$tA tC K,SC,C KS C$$XC$C,C(]@[]fk[]Ít&SC,K S,S$CK$9ЉS SVS[]É$a맍Svq덍US]ChChC;CK0C$tA tC K,SC,C KS C$$RWC$C,C(]@[]fk[]Ít&S,CK SC,C$K$9‰C CV[]É$7%뭍t&S؍vKv뒐UWVSU u}UvN^9s9)9F߃wRt'}}19u}]N)߅t 4$yuE[^)_]Í&E\$L$$mx^E뾐t&U]]u}{t]u}]ftsh~4$P4uԋC{GsHtt{s 뷍{GsHS $)T$ȍڵS ʵ% S 芵S 誵 S j2 ^肵S r S 2 &OJS :O. S  S '| S 趴 誴S ʴ辴UUJ;JvJ% = tJ9Jv]Í&B"JBٍ&UU]B9BCB+B Ít&'US]Ctu $CE ][]UE Utt ]ÍE U]t&U0]É}׉upP 1)9}CKEMt]u}]Ít&GdE$tՅt,C +C$UD$t$u4$UCME+ET$щEUD$ L$$EUEuE)K )K)K)KK SK)‰|$D$$pt10)K)K)K)KK S K빐UU]] uu}}tAWG 9WCW)ET$ Mu/]u}]ÍvtYt|GW 9GCG)ЉD$ }}u D$ օ9\$ G؉G딍t&tG+G |t&G+GhWG 9WCWE)‰T$ }t>}u D$ օxa9\$ |EG M؉GD$ G GW)‰ŋG+G2ډ$Ttډ$/Րt&U0U ]]u}t1҅u]Ћu}]f tHCK{ M)ω+KM >9MsBtC9CsCv뭍C㍶KCKC먐t&qD?d9ljEbU$UI}t/E $M|$D$SrE$MUCEUMD$)<9<$D$XqM}D$ $L$9D$7MUȉK+EC +EC+ECȋK +ECKCU E]]uu }}uaD$4$rD$ED$ t$$Ess st6{C{ǃ]u}]Í9B렐ssCȐt&U U]]uu }}Hхu_D$4$WqD$ED$ t$$ Ess st4{C{ǃ]u}]Ít&9B릐t&ssCʍ'UE]]uu }H…uZD$4$plj|$t$$D$ ` ss sss{ǃ]u}]Ít&9B뭐UWVSG 1ҹe= t Y e=E`T 1۾t&؉e= t \@`T uڡG UG Y DT DT PY Y 8Y [^_]Ðe=E<tۉe= t Y 6\Lt&G U~}8Y 8Y ule Y  Y `T G Y DT t&e= t*[@`T ue= t-Y []Ít& G U~le Y  Y 1ңG Y DT `T v9tD‹@=`T uY Y 8Y ]Ðt&DY Uu4@Y G DT  G G  ]DY ]Ít&UEtPuDt B]Ít&1]Ít&B]Ð&U X u։}lj]B01ҋXD)x~$G ‹F09t1]u}]Ív߉U<$G HT Uu3U$G Ut)tF0)Ӄ)HXЋUƍU]Éu}u;p~uE dT Ma X 9M81]u}]Í&U萗U!tTtO tJtEt=@t8ft.t&ttwuNqK)ˍ  ˅Z>}; MMM2M9ȉMtI X9]Mt&P9);Eu݉׉‰Јf MM X 9MDtzE;ȉ EEE2E9EtXY9]LEt&8Q9-)ȍ;Mu3K }t'ۍ<9=X \9M'UVSÃ$u$[^]Ðt&EEuD$ D$D$ $UU9v 90wE f t  D$T$ D$d D΃$L$b$[^]ÍvT$D$ $A`Wv&UWVSX EVe= tH0UEE,E܉U&1ۋEuvF׋V ;p |;rs~P Bv VoUBZX vCCSUC<;S ]twCSǃ4;UVUu8)NjCS ;X ;Z{P Bv SE9p0t1UD#fNfU9UtnE&}E{X0Vt&MU0ȁ(&@ @9u}`T t UBBUBJ0[^_]X HdT ۡG ٺ~ P:G ~ :xt(FBFPzxt/CBCP9t8PVPVBVBE9t%PSPSBSB@@@@t&U G $Ét$օq1e= t `T S`T 5 v0ve= t-`T SЋ$t$]Ív$ 1҃PwɅt G£X 뤍t&~5X 돍&5X X n1ҁw5X X G&5X X &5X X 5X 5G 5X  UWVS=G x [^_]Ðt&G X X X X 9eX Y `T X `T Y X  Y $Y (Y p`T A tA ,Y 0Y $Y آY =A t%1t&8Mutu#@T tG [^_]ÍPи5G tËDY t DY @Y G DT  G G  vxAXxLNxLCxO9xC/x_f#ƒU1L=u $ D$D$s E$^UDD$D$̓ E$^D$D$ܓ U$o^pD$ D$E$v¸A9D$ D$ U$^D$ D$E $v¸CD$ D$E$pvƒD$ D$ U$]D$ D$ E$k]lD$ D$E $u¸=f3D$D$ U$]D$D$ E$\D$ D$E $vu¸D$ D$E $Gu¸D$ D$E $u¸`&U]]u}DY /;AELDt]u}]Ðt&C1e= t `T Me= t dT {iHt уGX 1hT  uCT X X X T X T ht&y}&}89R=T R LA T Ly T |y LN=LtE{~?wJ|z ljQ J }QMMM Y t DY e= t-Y G>t:1e= t 8>e[^]Í&Y 9X  PT u X  PT 9wuLT 1ɉe= tt)@;LT u1e= t =e@LT Lt&hX _Xp@8&R R9u`T SSSHPs0 Y LHt)Ⱦ)ЉBS0e1҉e= t <Љe= t Y <X @X Y e= t-Y <4U\U~' Y  PT QLT `T `T OPT Y $X HdT X h1nUWVS X =G EG `T EP!ˉ0렉J|[vEuX0{ڃ;}]E@U}UaM}&MQ]}]A}} }1E}E!}~BUU t&}L;}`T tKX U%D$$T$9t&]ԋ}܍DP9XM;JLJfIQӃ9]w@ 9ȉE& y9W} MM+};J A ;HB PExv H;ML}`T tIuX }%D$4$|$8fE@E8E91e t[^_]ËYAuQ +};H ME9J<P BUzv"ыRtxtMABAPV;r EE}p PB FwUB4v@@1ҋM}`T ]<8ƒ щKPE v;EwHwE#e}L}`T OnEEEE~P|CUԉUG KՔ CUs 1҉H0=`T E+} ЉCX yM%D$4$L$6X M; X EX ;X E}\8!9&UEZ0{ڃ}`T "ދḾF)ɉEMUxbUE!MF 9EEN+MH Y Fv+E)փ Y rUH;LvLC9EM}U4 1Ɂ`T +E ʃw0SFs1ۅX pU%D$4$T$X5QEX  UMpPHPHE Y H0BWA;@ISˉ8EmNL ;q u]EEp HA Fv@@1ҋM}`T ]<8ƒ щKPxU ]G HD$D$D$ "D$\$$itGڃPX ;X X ~X X ;X X vX pPMEY0{ڃY9tt&9GT`T tXe= t `T U`T ,e= t-`T t&e= t X UDމe= t-`T xUe= t+xE191e "UT$U$Ѕ E4$D$D$,ED$4$D$,UG }}]uKe e= t t)e= t+]u}]Í`T |e= t+qe= t `T ^`T -e= t-`T H널1M1iX ҉D؉e= t-`T -e= t+ U<$T$ЉvUS]G ][]`US$XM1e= t `T `T jT CC T AELDCCCt&LJ L =t(J9uD D=u܍t&X X X ǃ0X X  X $G (X ,X 4X 8X <X @@Y DX HX LX PY Te= t-`T 4؃[]Ít&'UWVSӃZw-vHe 1[^_]ÍBtуt̸&9w߉w EFEET1t1҉qttڍD!Ѓ)Ew ؉‰E)^؃)Ѓ`T ]KLF ȹ ЉF uFuDU9v7M1Ɂ`T +E ȹBF EFF[^_]Ã[^_]2fQMAȉ]K1ɃLFMt&'U]G u}X }E!ǡG Ue e= t CtCX EL!e= t+t]u}]É聾봍&`T txe= t `T U`T Be= t-`T 돍;EMTH1' X EɋMDލTH|;Ue= t+U|$T$U$ЉvUG ]u}G =X Ke e= t Ct9M؋X e= t+t]u}]É뾍&`T |e= t `T BM`T e= t-`T )f ET1 11ZX UDމ;M0e= t+U<$T$UT$Љt&'U]]uu }G jwu]u}]et&e F<tQe= t1ډmt?e= t/]ȋu}]Ít&1T3u1؍v`T t]e= t/ȱe= t `T `T e= t-`T pX De= t-`T M5M5e= t/vUt$$T$Љ'U$t$]u G >]u $t$]'US E Mu Zt  []ÅtG u$L$$…Ҹ tՋE 1[]Ë]L$$\$҉fUVSDT MtpQZu!`T t %1[^]iX u;X w?A)áX  փuN-X )X \$$W[^]Ðt&wX X 멋U $T$ˡG  [^[^]t&'UWVSӃBEhH9ʉUW4 V/9U#;MMsn9w0DfUU9UNV ;q UR9։UU~EQ JvUR҉UEE+EvOM M`T u Ήs JLC[^_]ÐE1ҁ`T  E ЉCELfUU9UUMMEU1tE9P CKuHNHNv.H N HNvH NHNu PV@ F Ef M1Kv1Ɂ`T U E ȋMC)ʍ G0PCvuL$D$4$닍vщMKMS G Kc1 G ~ DKMytUJUJNVJU9Ut UEQVQVJVJIIEvUWVS$E ]EG FMsFƒU9}M σGרu~`T ue1e= t+$MSe= t/Ӄ$[^_]Ðtl$1:%8됐t&X |!NjE9ljE^$[^_]Í&1e 놐EE$[^_]U$E E\$D$E$Q1ɉ6]+D$)D$ |$$UMYUMt5)ʍ4уN+}=X ;=X =X =X E9E$=tVE\$<$D$G ٺ* 1耲hUT$U$T$ЉN1Gv'U$t$]u G G u ]$t$]/ UWVS$=T lGT Guƒ5G Mu$G ljƃubX KT!ȍ)É$G HT tEҋE+X 5T )X 1^$[^_]Ð)듐t&GdT uX X 9($1[^_]ÍUEED$ D$D$<$UKU9v 90wEf t D$D$ E D$d DуT$4$n_D$E D$ 4$M_e F'UWVS]1e= t `T  11҅xS`T R‰e= t-`T  tmBUƃ )9s8)ށ<wG&v,-9rEU 1ˆʃ[^_]Ív(ڈ׍&e 1̐Ue $t$|$]<tR1e= t Y  e= t-Y  ]$t$|$]t&=Y tڋt$`T $|$]m1xsS`T tbxWуɃ )9s6)ف4wAt&v)9r߉ 1$t$|$]É(و ۍv'UWVS,] u1e= t `T EUe= t-`T SF߉UXS уMGMEMe= t `T jFUU܅GE$M`T Dže= t-`T tdOȃ )9s6)ށ wut&-v]9r 1׈,[^_]Í& X |}!ύ 9x7f(؈ 맍&1e ,[^_]ÐE11fD$E1$ eM* G 蔫D$$d<)ЉL$D$ |$$U܉M]QU܋M؃t3))ωP=X ;=X =X  =X E}9EJ0U`T sED$E<$D$9t&UWVSu] F{1e= t `T d11҅x`T ‰e= t-`T tPBUƃ )9s)ށ<wAt&(ڈEU 1ˆʃ[^_]Ít&v-9r뽍u#ve 1҃[^_]Ð1e= t `T \11҅xS`T ‰e= t-`T EBUƃ )9 )ށ<w-9r (PC Y P麣1ρGu3H 1ѿs)1ρGu1ѿs1ρG&1_Ãt8t@t8t@t8t@_ÐL$T$:u ABu1øBÐU1҉EVu SX Lu[^]ÐU]]u}D$D$$t ]u}]áf e=7t7D$D$$EU$U7f uD$D$4 $Hk )념U<]]uu }}x<; }4 t)D$D$$Hk Ɖ]u}]D$D$B $Hk $E$ED$ D$ E؍ED${:U9}؉4$T$ËEGljD$9}ryD>o+M؍U)9GщT$\$$ǐD$!t$z80@80@t 80@1ҋ)ʁJsX1ʁuN)ʁJs>1ʁu4)ʁJs$1ʁu)ʁJs 1ʁtt@t @t@+D$ÐU1WVSM1ۋu} vb8t)[^_]Ít&tF_8u߄tF_8uτtF_8ututt8u1҃tD\8uu)[^_]ÐUW}}VM S_}uSCtAASCt3ASCt%ASCtt8ӍSCuM)Ѝ\t1D9u[^_]Ðt&]tt܄uȐ@1׋$HY DЅ$t' Ht Ht H uӍB tH tH t H u@@@P 8 tJ8 tJ8 t J8 uBBB9tJEщHY 1HY VWD$ T$t$H։fʨ8g@N?8O@N'87@N&11ρGH11ρGH11ρGH 11ρGqr[1st1ρGuir;1sT1ρGuIr1s41ρGu)t8t0@Nt 8t(@Nt8t 1t@t @t@_^ÐSD$T$ L$u: u1[[|Vƃ mv'FJ9YFJ9KFJ9=FJ9/FJ9!FJ9FJ9^1[ËFJ9FJ9FJ9FJ9FJ9FJ9FJ9F:B^1[ËFJ9~FJ9pFJ9bFJ9TFJ9FFJ98FJ9*FJ8.9&^1[ËFJ9FJ9FJ9FJ9FJ9FJ9FJ9FJ89F:B^1[Ív' ;ulF;BuaF;BuVF ;B uKF;Bu@F;Bu5F;Bu*F;Bu }O} 8u8u 8u9^[Ð$ÐWL$|$t$ )9sssf֋D$_|tssf֋D$_ÐWT$L$D$ ,׃tzItItuIiD$_ÐL$ |$t$ssf󥗉ÐWT$L$ 1&׃tzItItuI_Ð|$t$1L$ u<v7tIt ItIPXlj֋D$ssf萐WD$T$ ։fʨt)8@t8@t8@1sd1ρGuYH1sH1ρGu=H1s,1ρGu!H 1s1ρGu똃t@t @t@_ÐWD$T$ ։fʨtL8<4@t58%@t8@ 1ѿ1ρG1ѿ1ρGH1ѿ1ρGu~1ѿss1ρGuhH1ѿsW1ρGuL1ѿsA1ρGu6H 1ѿs%1ρGu1ѿs1ρG*t8t@t8t @t8t@_Ð f Ut2f (]EÍMݐUWVS<1ɉDžfЉ)ωэ9UvI>8rtQĐ;pʋ먐t&Dž1ɉ)п+э9UvE<<8wtQ;1xʋ뤐9sM1& =u]t)Uf1uf 9w닅9IUDž)DžDžU)‰T$D$$}oD\9C9vb:2T0'q:9w؋9:T#qx:u 9r֋9E)svDž‰ҁ<1[^_]Ët;sE+Dž똋E+;B}Dž)Džu)‰T$D$$#D 9ss:T0(&q:9r؋tb: ubT3fq:u#uۋ<[^_]Ít&vՋ9e<[^_]Ëv&UWVS@E uEMt3˿ t)8!u;t1@[^_]Ít&uUD$F$EtΉ+MMfu+]E+E;uBẼ}]ԉEv }MԋŰE}@[^_]t&E1ɿvЉ)Eωэ9UvUqx]̉:]u9ErߋU9u؋}u}Et&UUEEދE+E];EBE1]MԃuEċEM]Ћ]E)uȉM܉}uމ)‰uT$D$E$5};]fvN}܋uЋME:}EM܍T8Ufq]؉:]uq9wEM}u}}T:TuY}uM܍T>Uvq]̉:]u)uuUUEEfEEEg5M]k}u<>}뙋uuYuQUe]#USXt+@S @CIFS?F$[]ÐUED$M$U EOƒ1uUvEE1Í&EEÍ&'U }}]Éu] uUD$4$oOUv$EE]u}]ÍvESE] D$4$OuWUv_E'EECSE&tA1{|t&hC뾍&ES Cu머?&UWVSø$t $_ {$ECK\ 1҃E܉ȉU&/ƒu)ȍD)čD$Et=k ҃u*U}u] D$4$MUvdECEEE@MtQCE$C t $_ e[^_]fEMQtE] D$4$LuPUE C1EUBcUC0-StvM6fUB///uMܺ3 $ɹ EыMT$L$,&EP E_fUeVSø0Ft1HKHK @ ɉC tBCt@[^]Á  t‰LF붐\$}G}EȀx-M }Eȋ78D$D$ $Hk Uٿt$|$ UD$ET$$x>G p<PUB9R 1:P;SU:S EC=Ut ҉E*MM܍v}7E+E]EE1EEt&E7UT$M4$L$Ku։4$9EMu]Љ}붉`t&9K CE\vK UE}-D}ȋE 78D$D$ $Hk Ut$ |$T$D$E$;x>G p<P:t:fU :D$D$ $Hk Rt$ |$D$E$蛤fEU4$D$T$t&Eout }ܾgfffEof mEemorEy [vȃ))0҈ uݍU)߉\$1ۉ$|$F]P@E)‰EUt&D$D$$O ]D$\ $\$+4$hD$ 4$^8eD$:4$I8F;ÍE$$É4$B$zv'UED$D$ E D$E$Í&UED$ ED$E D$E$Ð&UED$ E D$D$E$YÍY  Y k Y  Y Y IUSVW\$L$T$t$ |$$l$(u ED$ <$U)D$M܉EM܅'@9499]u}]ËU|$}T$<$:M܋+؉>)ЉD$ET$$>M܅>ED$ )D$<$ZM܅q;]ڿ+U]uRډE)‰EU/;D$D$ <$ 339u}EU;D$|$$y1;}t ;] SfE)ӉT$U؉M܉\$$U؋EM)ЋUE T$)ЉD$E$M܅xUtu‰ً>fuىË>냋]{'UWVS($ % P)ԍT$ЉUE܉EED$$ Etq]E]Ի EEt&Ɖ߹u-@0 UU܉T$E؉$MԋUEBuƋ]^Ðe= u"ڸf L$9}}r9ftXu }9}t X]9]s]t ]u;sv};xwUtEE9Es,:f[ UEuEL9u.1;]M̅t}̉EtEMԋEABA t $@H 8[^_]S0}ȅt Rz}19}]v9H ރwtpffutFH]39uurf}tpu ]9]t pu9ust9Jsu;0G녋Hz밋]CC ]1A s f USt[]ۿĿ9t[A ]fۿĿ19uᐐUWVS.$1Dž( YЀ wQZRɃ0rЉ< wv҃ LJrЉ< v( (.u tS뤃) ӥ(([^_]D$$ y֍}D$@|$$`4$~ָ??NÉDUEt&U(]]uu }}t tV\J XH $f 5f =Y &a}}u u]]]&XH 뷐e ÐU1Sntel$f tcAMD f []fGenuuineIu4f ,f à 0f   f (f 8f  $-vU=M@t$$L$M̉|$L$$uM܉K CECD$qD$_ $U${UP;QEUM v,\$34$UԋMC{S UKCECE܉UЉ]UE EEM,1}T$ BB BBBBуJEUu1҃u܉k<ƋM;FFu1F t e3$E`HE4$Ћ]<9wD‹MkE${rM؉ $`ETf Eۉ]`H u܍D$@rD$Hf 4$E+ I uп }D$<$.D$p4$Í@E؋EM؉${u]Me[^_]Ít& MM DJ tvDB uE}ى]EDB u5ڋ5k } ʉˋKCDG tYyk DJ tfDJ ueDJ Z5k vk DK u  u9#EčJ$Ev _ MЍP_ UԉD$ED$E$o &T: D<1҉RfE] [Tf  _ -_ MUWV1Sà $D$艇t u$ GG G( GG4G, G$- G(. G,/ G0[^_]ÐUU ]ʄIÍv'UWVS\M EU ] q<$EUEuxE}Ѓx<t e3=}ЅS}U Uԋ] EE}DE[}$EE]t} _dt&UMEuċˉMU؉UQr9u K9M=Z(,fEˉMuUE9UuUEUM q tE}؉]؋]fFt)$7E؋UԉD$T$ |$D$F $Vvuɋ]؋M A A9]s_} }EEЉ$6U$MED$T$ỦL$D$\$ |$D$$UЃt(U9EEu ] } w]}tEt} E\[^_]Ã}t }E= }t} w } v$5EUMT$UD$EL$D$D$ F \$$D$tE]:E}܍t&Ft)$Y0UM\$T$ |$D$F $Vvuɋ} G G+9]M }؋<$E0E$MU}̉L$D$ED$T$D$\$ |$$U؃tDE9dM } MO}?9}}]EE}tɃ}toEԃP[^_]Ã}t}u&EEEUEU}1҃9s^D}$tE1ɋ9Uv&u Љ^T U9EwM)} G EB)Ѓ9Erw}E9} DM 9]vvEM܍(f*U}} &)ЋUO!}DM99]\]EEv}UEl)ÉػU)M 1QEE @3U؉$-M$}E̋UЉL$\$|$D$D$ D$D$$U؉EEEM]EE}tt }ăfE UWVSlEu M ] PEЃl[^_]Í>с<9}}E}]]u? 94ǀt܉]u;M]z}}UEE&E"M yEƉE؋GUuEЉȁާ E]]؉EȋE9vUЋuȃ?UĀMĀUĈmmwEEE؋Uu)ȃ9EEE9E܉E Uw 9uwE UMȃMMċUE9]aMċu} )ى˃)ËEWEԉM8]u]t ׃o(]E}$fE} UwE+U؉>wVU؋}9Uv#? };Uu})׍L9k FE<딋U uM)ىM2E>9]3? E P1EE @Ủ$t'M$u}EL$\$t$D$D$ D$|$$ỦEVu6uE؋]EM-k MGE{ uE}u VD>EME9MȉMMuU3UЁ€umU? 9w܋UMu}tkMƃt(}t4t/uEUEމuăU9UMuwEM9MȉMv4%u$uyEuu9ugEȋME)؉EUu)E7>9]v33? dEtk MGU_u؋ME U؋]ȉ1}uԉ}x})V9UU]Љ]Ћu9]uҋEU؉Ej|OH9M€EڋE9EЉ}U؉]ȋ}ȋM9uԉ9E h [>G< 9}}}u4uāƀIu? 9w؋u}t ǃt(},}"MӃсu0fсu)u)Eсu)u?EE1҃ 9Mvw tUE139Evw3%tu;uEu.u!f1}C9EEoZډu u29ыu}u Eu (}1҃9Evw%t}j&'UWVSlu EM }^E9*u{uE U 6J9މEuߋuE}tˋEԃL[^_]Ã}t}uEEvUȉEM뵋E P1EE @uU؉$f}$t$EŰuЉ|$D$D$D$ D$T$4$U؉EGEE}uEU2UE7})‰)fUWVSLM } Eu$] MЋOPE=Ef/}uEU}ԋ 1҉}}M9sbD}$E1ɋ9Uv&u Љ^T U9EwM)] C E)Ѓ9El}E9}EEЉ]M9MwtE]EE=(`Mf}fEEE;E‹}+U#)EU Eԋrkm끋U]}t!MUuEUEU]]EM)HM 1QEE @WUЉ$M$\$}ȋ]ẺL$D$\$D$ D$|$$UЉE M M>U}}E pS}+"}EEE=t}E މӋx M$7UED$\$T$UT$UUD$ G $D$E D$Mu-릋ETME9E` EډEEډ΃uVEE3ы})ȉ)ȉE) 9KEEEMEE^ UWVSLEu ] EPMU|$T$$M …҉tXB rCCCBsC8C 1t+ e354$$֋St e3 Se[^_]Í&UĀ$ ]uHqLf t]u]D$D$$ st΍ED$\$$rEă_ D$\$D$ D$D$$a_ )_ rʼn+MMk<$sU̅EUM}EEMEԋUԋEMP UABk B80EEԉBAE8QMUwEEr͉+M븍U܉T$E$:Uԉ1,[^_]Í&[f]ҋ_ CECE؋E܉$_SU1҉uEE1uC׋_ )UEE؍49ffR9EvED$E܉$9t];u>rɉ+MfSE)ЋUԉ,1[^_]ÐUSE Utu8;_ t8CPw%CuCt$kCt&[]fkfU_ _ D$ $`^Í&'UVSEED$@D$_ $*]t6t#CStHOщS[^]Ít&E$:p$tԋU@t$$T${CCCD$@D$_ $#bk$1 끍D$$CD$ $ C tpD$ C$CD$$ C$CC e3 C Ct e3 CCt e3 CCM1UE E EE]w7UWVS1ۃ EUEEff9]ts< J <$T9M֨ DЅۉE~,Mt%M<$D$U7UDEE "t}uE<땐U:덐Et{MD$ $U6tD$Mk $6Uu  [^_]Í&r4$tދUt$$D$BA É[^_]ËM $t¿1EN&9utU J ɨ $@ D$=\$$z ;P t}uE벋M뫋]+t&UWVS] } t $_ !uD$ <$f.t`D$Mk <$R.tLE܉؋u]}]D$/$,tt& E  $t ]t8u9Uɨ @ $\t8u${ \t&> E<$<1эA)čD$;L$T$$?8UT$UT$UT$ UT$UT$$CUD$(\$ɨ `f $NjEUЁ@ L$$D$ EMԉ|$ D$ED$ED$ED$E؉D$?UЋMԅ;~~1ۅtm}?*EtD$ $Gu C^CC^ U'DxkD\xuӋU܉gU܃ً T$1у)̍D$;EU1у)̍\$;E܋k  u uU܉k~E$D$/$rPt&ʀz/Ju)ЉD$$_^ED$(L$$|$ D$ E\$$D$ED$ED$ED$E؉D$/=1Ftt~USÃPtҋC u/C$C t $$[]Ít&uڋCD$C$jC ÍUWVSà  tٸ   E9F; 9$$4Etm@@@Vpx@҉P tAN9rEE1 L;Hw2Fv}u <` <t>HL$9P wЋE [^_]É$meEu׋x L$UWVS@@D$U$ ZED$\$$YE%=@eeEED$\$UD$ D$D$$?hEs,1҉FEȋK4Mԉ1uUE+U)EC04΅9uK ɉMCE;Er:EȋEMDEȉD$E܉$UUu|M9׋u 7BMԅnC04pEE܍e[^_]t&M+EC$;s@뇐CEWfMDgf;u+EC(PU܉E}MMIɉMt C@$S<RD$<lj4$T$MI u{벉T$x4$D$<<x늋L+CxtPx6LzEzAzSzTt&J 8v136t&z 4xz L1ɍt&XvtPxFuqzA7zS-zT"J8vU13(6t&z 4z 1ɍt&vMt&u&zAzXz1Pt&zTzR~zf1`vz1ɍt&Hz617tPu@tPS X8Etx]dD$x1ҋy,Gp؉1pփ))&991Bˋ|u䋍x]AD9X]oXˋdtC4A |Q$HC0K(]t|<$L$A7t&txDa >Da p>qUWVSJ )̍\$T$D$$%/loc@ale.@aliaf@ sD$ $'DžLX‹e ̀`t&XdD$$|$ШVd$dD$ ``T:\DH u#~^u99u[^_]ÅxE]4&EU!t&t;t%4$fx93tuًF Fэ&Fݍ1[^_]Í&'UWVS8XDž,DžDž4Dž$Dž 4 0fx9,'jދ,')Vہ'Fۉ(;,|()|$҉T$D$<$(0$wT$L$, G9044 n =tW$$$$w $o  5(w p 94 q ҉44 Xq )ȃ4 (;(()ɉ)ˉB4vrq ʉ4q 45q 40( p uf9tdn =t5wf p up |};]v1E}E} $|$U|t{9wǐt&1,[^_]ÐUWVSlEЉUȉM׋ủM)EЉEЋP@M܋MЉEԋI M؋MЋAtT6׉‹M؉$U\$L$UԋUMuSv׉E؉ $M\$D$UԋMkSW@UuŰM)u܋AD$Eȉt$$l[^_]Ít&}ׅtBEtU؋M\$T$ $UԅE܃\$<$D$]܅u}}dt&EE܉|$$D$QDt&EE)E ׉OEE܉$UMEE؉\$D$UԋUM]]9}M܅uЉ\fQ&QmWfE܋U<$D$T$"MMmmUmU9wAEċEE)EmEĉMUăEE}1 U ;}uMU1׉‹E؉UD$D$$UԋU~#Mufmڍt&'UWVS|uE ƃ F؁ ha #=da 1҉9_e=$MUɰUME-UUE UuEE܉U8M UEʉU9UEUsEU]9wUEEEʋM ] "EufEU;]tvEĉD$UT$E$UMU1+EuċUƋE Eĉ\$ $D$NUىu;]uĉ8EĉD$U<$T$$EE9E UUaUT$Et$D$ U T$E$脛e[^_]Ít&u0Eu*Et&EvM EԋUE$ǹe[^_]Í&)܍D$#EE+f$Ut PIha $ ha ǣda EgE[t&'U(ED$D$ ED$E D$E$UWVSu4$Y ۉu1[^_]Í>t~tUu3WUtЉ}Ǎvf;>u&EUD$FT$$:u E<=tE3uftҀ=f;u ff;tuet&ZUDMU1e= t la  Y ;ta t&Y e= t-la 1Åt։$輷ta UWVS];D$=$$aƉe= t la ~Y t/:t)t$\$<$UUu<7=t0:ue= t-la =1[^_]Ðt&ЍɉHufe[^_]Ð&UWVS E$M EɉtU $qE1e= t la =Y Et[7tK]1ۍvEU4$D$T$u E<=t 7uх]]t UD$ta $躹WEtiE]Y ;ta tUD$4$T$]U5Y 5ta De= t-la 1e[^_]Ít&ETB)č|$\$]UM<$\$p=]$\$] \$ED$D$pa <$UMt[$UU|$T$$`;D$D$pa <$e= t-la $U>U$Ux1ɋUe= t-la =ta 4$}auft.7Qe= t-la MK;ED=EE)čT$\$]M$U\$=]$\$] \$UD$D$pa $4UMt 0Bɉt*EU$LUtw]T$$\$D$D$pa 4$h$(E$1Ʌ(e= t-la 2 e= t-la "US]tB;t=D$=$u)ED$D$ E $D$k[]Ðt&e[]Í la la 7 la rla  la Fla $la !la ala la la A UEt1]Ít&E]UeD$ D$ED$E D$E$FÍt&UeD$ED$ ED$E D$E$ÐUWVS0}UBE1ۃ}u}$u}v4u}DV tuUt&DN uU<-z<+EE0UEV} LE1E}  ɉUE|E9Ep‰؍NEEMԍC< vFt%1: t f : u9w9hMۋA4DXA<7;EM9MM9MMMȉE9Ulu tu ]vEM؅DEEE0[^_]ÐeEE0[^_]Ë}H1E EE_t&9EH&EF9UFEU Et+U~}HP_< )ǃu?~;|$D$ $M+\9{>\t$T$$P9Y>+\9D>\t8~4|$D$ $3M+\9>\H(7LD$%$ƉNj)։t$T$$P9+\9\?q!$l@U׋@X)1L$#Pk$40D/DkA$ 8T$D$P$Bx=,)ƒu?~;T$D$ $K+\9<\|$P$L$P9<+\9}<\t8~4T$D$ $GK+\9<<\@D($WG$T$)ЉD$QW+W9>+\9+\$h$9k$40O ЉʃЉʃЉʃЉʃȉЃW ЉʃЋW,DW WGG tk ҉,W:Gtk DS6,9DMD= 3H 5A)čD$# PDž(f ҉4/3<3G,1ɉ)čT$#@G$@k ;rދ@|$$L$42e +\9R \fk$409k@$ 8E+"Epp1DUm:D8D1Ƀ)čT$#}|$ D$D$EԉD$'v ,),>*ud,t[,D$ $D$tGP+\9P P\T$|$$P9 +\9 \tT,tK,D$ $|$F+\9[ \|7k$40ZC;C[9%C\ \d11 󫋅<\8XH` d     ȈdedhN/N VdN|UM|E܍E܉D$XD$$:@ +\9\dn'VdVɉ@t؃ډ4׉ẺUDž8 <&b4 Tt 8&Pƅ 44E̋P)9<$t}t8u 044+PDž<H )ǃ}"t 8GD @fC;C1-C\T\t 8(~/|$D$0$YC¸+\9\P+4t$$|$P9+\9\pD$D$`$蘬dDž8…!HSt 8^Exx1<U1<1<1)čT$#ML$ <$D$EԉD$p ) !uYtUL$D$ $AH+\9H~H\T$t$$P9>+\9+\t=t9L$D$ $>A+\9\$8 u3~/|$D$ $@¸+\9~\CV;Cdy+C\H\aY|$D$ $X@~d}LLH +HUA1)čT$#ED$ L$@$L$u>lP(@,<t t :Dž k@$ g $M $UH6D$-$(D$$D$PUH$_k$40@ڃ ,WO Dž[Vd|PDC)čD$#Pg (]\$$(TD$+$MD$ D$ L$$P)C;C)C9lwϋP}ԍML$ D$@|$$;>@=UԉPwuP1Ƀ)čT$#ED$ PD$@$D$u;TD$%$$v軽xP $Rml"i4$qv4$R(ػ(Pf<$:<$zR((PLl8"<<Dž<0t Dž85D$ $6Dž80t D$$lXl"@$Bt@LLָDž<1эy$:Q([(PLD$ $6u2D$-$bCT]$D$&jD$0$D$+$rD$ $$D$3D$0$oakG$ \fdt1\Fu1\)\f81 =adz %-I鏸U1ɉVSu EZ}v#)؄t"9vxu[^]Ðt&1[^]É'UWVS˃qt yf,CS 9D$T$ D$CD$D$C$&SK sS )х҉6ut:{B uQ 4uC EC [^0_]Ðt&{ED$ T$|$<$FtS KS E[^_0]Ðt&S C3D$ T$D$$F0[^_]Ðt&QB҉A0[^_]fC bUWVSӃL$$t MEc$.ED$О$,EċED$躞ƋER+]ȁC)čD$EEUȋMĉ\$T$ $y}}ȉf9]wcPЀ wue %t$4$,q)EȅtM1ƍ<vLL u9]v}u Eĉ$VEȍe[^_]Ð}um}Ȉc<,<.uU1׃у)MʋEu$$KEEoU1׹EĉT$UD$E܉$1UufE.1׹ẺT$t$$h1RfE,GU̐/t&'L$qUWVSQYIEEEMS ȉ׉M e5uJ$MR0US M416v4uM1}wmu}476v4ɉ|Džx6MD|| t&EDž|DžxU(<$۽84ۭ8}Eve5uJ,M9u 1v$u҉UuR0Ut&}$ݝ83݅8]EMESx Py %x Eʺx EЋ}C!s PtEE E}D$ |$E$8484;uo}&$ݝ82݅8(t&<$۽82ۭ8uESx Py %x Eʺx Et&M416v,u"&1C @BrE1]]9CXX;XƒXuK uƀ}]tSE9uD$ET$D$ Ⱦ D$E$MSʍrE։U׋UЉU)ʉыU440EP9P9UM)E pe2B1ɉt0Ãυtht}c+E9uD$ )Ήt$h|$E$襜Eu&}GmP9uދUM9 &u͋}L;Mst&T$D$Ⱦ T$ ED$E$艜dT$L$u4$;@UB;Bk+MAhdD$0T$M $]1t)t=UF\DžTEpySg'HpEt M )9Uzt)ET$ EȉD$E<$D$848)u}T$ 4EȉD$U<$D$Ś}4ET9<)}ElE} +MEUlpEDž\E&+E9auD$ DD$)Ήt$[}B0u D$-U$YL`$8UB;B  MAEDu)΅u~M1]:9u]}E}lD$ ED$ED$E$؜Uu }NE9 )T$L$ t$E$|t Eup])ET9hllh1D$ E$2L`$U7D$ t$T$E$)W}1DžlDžt1L$ u|$<$t$4肗4EL$ UD$$T$bEME +EMEED$ D$L$ $EFvL`<$L6ED$ ET$D$E$跖UMUUEeh11E8YUlEA`1`hD0WEE 8CA`% EhElDžhT$E$44@$>ɉL$$88e*C :&D$+}<$84l84}D$ <$84a84D$- $=e}ftiHp MtEɉL$$88QX‹pEEpC tl9Hul90DHpEtLMPD$+$jMH$E 8D$-~HED$ aD$+@0j@$4D$+}<$Y<$ (EfUSg1҃}…D$D$$y l$ lMЃ9EJs'EM $X2`<$J2zuD$0)ƉD$Ѓ$ E4$884$8/'8DžL`D$-*T$E$`D$ $uUS]1e= t xa ]f t9g M U1e= t-xa 8[]ÍD$$4#g tf e먍&'US]1e= t xa f t9g M U1e= t-xa []ÍD$$d"g tf e먍 xa xa 3 xa Cxa hUWVSx] EKT$h$S ΃t$pute=$J$L$dR0$pS T$ltwT$<(|$tۼ$\<$NT$<$ew&e5$z,|$d$pS T$luT$<ݔ$\$\$$KT$D$%$EÉNj)\$T$ $P9z )9k ޅT p2t(u2~.|$D$ $¸)9k<42kp4e-\kA$ PXW<B;BK<B/<<(t8~4|$D$ $¸)9;42x $[SCT$)D$<$Q‹C+C9)9 փpp9 kp4K lj‰lj0‰艽(ω4ƒXd{ ЉʃTЋStCSC @tk \8tC':Ctk \:t9M=2H <6)D$#<Džx@0f 0@@<q0S,)čL$#1ɉ;?C$k \؋C<t  ?kp45d2kC$ \80P:D$D$$c$DžÅ4"@S"]b2$L$!D)܍\$#Dž1ED$ ET$D$$ 5t)0(u>t:T$D$ $)9=41|$\$ $P9s4)9RD(t7t3T$D$ <$u)9.440@kp4j1hP󫋅lU|EE`MD]  8 H < , ȃE$S KEUMEEUED$T$ $M;)9340 Z.} Dž8| w ȃ Z.Dž<4 ȃ Z;+DžP DžHDž| Dž<@`]؉EDž8Džl, `Dt |/DžP ` E؉)؉9l)Dt }t|u)0lHDž`H`҉`th)ǃ}"DDt |GD8uu <tP DPX9=B;B-=-B>Dt |#`~.|$D$0<$W¸)9=42|$\$$P96)95SXV=B;BJ=%B'=kp4d)kp4:k@$ \TɉXt؃ډTdEȉUDž )-d Tq#ƅ T dEȉ)ىȉd9d(DžTHT҉Tt)ǃ} Јt GD0uXu 4t XSPX9B;B9-B12t T~.|$D$0<$ص¸)9142d|$\$$P92)92kp4!S|lU l$L$9)܍T$#Dž]1߹󫋅\$ $D$ED$iO-h)2Hu>t:|$D$ $m)9g041T$\$ $P90)90ރHt=t9|$D$ $)9c040m$G`0x\$#E<$ L0?31ۉ1Dž Džx k4M\$T$<$L$ *zË9xwxP)ԍT$# x$9Dxk4D$D$!= AЃ wDSZЃ wCZЃ vt $v҉hyډhDžP DžHh?2hv(h<e0G)čD$#<8 Z} | 0QЃ w JQЃ v퉅?<3v"<?3G)čD$#<8$hOȃ Zn!M*&PЃ $k TЃYЃ vЉl‹h9l! Z} {  ȃ Z` Dž Dž`^ ȃ ZMDž` ȃ Z$Dž| ȃ ZDžDAXI'P;P='%P'wkp40k@$ \kp4{,)čL$#t'kS$ 1\փ 49r답PX0B;B/%BC t2QXn0B;Bb0#BC y0PX/B;B/'BC @!QX,B;B,+BC  t,QX1B;B1-B{0N,C t8QX,B;B,IB,CM1һ  u99H;Hs>H--9oAXuT$$謰uA<t X&񋽜0HD$D$ $`Dž|tL ( ȃ ZDž, ȃ Z8Dž$H0EPP ȃ Z} | hDž||DždP kp4k@$ \\TDUDž4Dž0dEDžX kp4/kC$ \\$EED$<$š/)9#40-kp4kC$ \\$EED$<$')9vx:x4$!$|ZhHu2~.\$D$ <$O¸)9)42$QX!J;J!J H,Hw\$D$ $诨¸)9It(u2~.|$D$ $V¸)9@$42kp4k&\kA$ $PX&B;B &B%%(|$D$ $虧¸)9Qۉt؃ډ`E؉UDž| "Dž DDž5kp4 k@$ \EDž@xDžDžDžDžX 4 , ft Dždƅ g}]P)0d:#EDžxDž,DžDDž|Džl Dt |1DžDžP Dž|1hP󫋅lU|]E`MD  8 H < , ȈE$E2S KEUMEEUED$T$ $!')9$&؋5, E$\$D$DžXQX"B;B"-B tt}t TTt4TD$0$D$b¸)9\ 42dT$\$ $P9})9a+Tt|$)D$ <$Ԣ9kp440QX%B;B%-B%hDt}t |`t4`D$0$D$&¸)9q%42T$\$ $P9 )9+`hb|$)D$ <$蘡9Jkp4i T k@$ \Dž4Dž0DžXEw E苍9CɋA<Z)܍|$#ЉT$D$<$Wk )čL$#)܍\$# \x1҉XdPsK$D$g x$L$t$ 4; sDC tCtC,t̓uK(s$ xs0C$4뮋Xd1ɉ-} EPU 9~=&v&&ug iCC뒃4n QXB;B+BG;DžP X  Dʃ| || 1҃|u샽Lt$,tL$xQ| )ډЉ<<QX#B;B#+BnE4QX B;B +B<%QX; B;B/ +Bƅ @X  Dʃ   1҃u샽t$LtL$Q  )ډЉd===,E(P U; tMDž<Dž8DžEmDžlK`Dž<Dž8DžE} Dž|Džz 4} Dž|Džz DžEPUEPUPS $L$Džƅ 1T@Xd|$D$$L$D$ [Lt$tL$Sà u؉tclP l$L$DžDžP 1`X||$D$$L$ D$ [Lt",tL$SÃ| $؉~.|$D$ <$t¸)9y421~.|$D$ <$;¸)9421QXIB;B=0BQXB;B@B&'$lt %Q} DžD| Dž<Dž8DžEN;QXB;B.BM1һ  u狝NBXP;PP9wKPXB;BBS]gDž4 [TdMȉ]Dž0DžX<} Dž,| \$T$<$P9;)9!43Xuxk@$ \Dž4Dž0DžXEOTDž4Dž0DžXE k@$ \Dž4Dž0DžXE tr򋝜} Dž|z } Dž$| `0QXB;B0BQXB;B{BY7l1у&llDž1ۺTy cPX- B;B! B  _G0ƅ u_)؉dG0ƅ v ڃDž| E‰ELعXUt@M d}< ȍ 0 ( 4  ȈEEdE WO EUMEEUED$T$ $諉.؉_G0DžDžP +0 QXB;B BعXUt@M d}<E ȍ 0 ( 4  ȈEdEWO EUMEEUED$T$ $`} Dž`{ ƒu"d1Ҿ u답dƒuR1Ҿ u답*6} Dž Dž`z } | } DžP DžH| $³DžS8]QXZB;BN B%E=?<EG)čD$#<8`@ Z} y kp4Tk@$ \XڃXDž E‰EDž$XDž_]8QXB;B ByDžXy jƒuDžl0QXfB;BZ BƒuTDžxv|$\$$P9 )947Dž8} Dž<| l\QXkB;B_ B'DžlK$?؉|)ÉȉT/kC$ \z1уQXSB;BG0B$QXB;B@Bt(BX&P;P0PBXP;P Ph_G0DžP `BӃك0 vfll=S?t6Dž1Ty fZЃ k DDžXy -D$ $菍]dt-10H:TtM1 L$$Xul1ۋ0<$5I<$xMzo1f0-ID$<$)'D$%$D$ $譋XDž4Dž0DžXEfO@y |xu)čD$#$g t$TDž4Dž0DžXEl<$3<$xx7"9$荪$D$y$@t P>\$$蛉؃ tCK Dž(dYNCL$$#D$ $nDžLt)9w547L$$蕈uD$.$d5^SH=2'x<$PwX4@,L<t tDžLH4@,L<tDžLdYNC8-f0nD$ $ɆlHDžl@y Dž|D$+$x+rDž|@y SH=2L$$ $DPXcB;BWB;$<$. ~D$-$QKKQXtFB;Bs>0BD$+$)D$0$ԄuD$I$裄>|L$$\VK@D$$%%D$0$1Dž |<$7xx <$<$D$[U"7]>\$L$$Ix7)9j D$%$oiD$'$E8?"!<$K+tM齿D$#<$΁<$Bxx ND$+${uD$+$QGKQ]'D$-$.D$-$踀ND$ $莀$kp4GcX@D$$2,!D$0$D$-$2D$-$$(E$ tDž>k`UD$$/{)D$0$~D$%<$~D$+$~2xXu2k@$ \%Tt*k@$ \XL$ $}$&ϻ$t,DžȻXukC$ \0D`kC$ \8f0$Džlg$L$$|HD$0 $|0v'U씁D$]Éu}׉|~$诋t]u}]Ív~($S<|$]ԉ,|~DžDžDžDž`} T$$tƸE䰖]f;x?SHe|~9Bt'1e= t SH|~BBH P)~*T$x~L$$Px~9иEf;xSHBBtAED$$E\$D$$)t&Be= t*u&릍 #鋰$ #$ѐUeWVSQM(AqI (LDChcChƒ$7DOy$ I(9EщP҅҉BE]f T(1TEE,Dž`DžhDž$Dž0DžXDž DžDž@DžpDžtDž4&oT%GDV4DB pC;CK0CptltHDpV4lDB t {;{8{DB uቅpl9p1lTt!1f;;t 74e10t70$0Dž44eY[^_]ÍT$TUT$ $D$)yptvdtTK;KVK9ӉTdplftlf@L4FDž4fTDž<ƒ0 T^a dId`d h%9&1tftT<-<]Tߋht&<]j<- Dž\Gt1HlH=!<)-,,t1@lZH@Dž\pC;C\K0Cpp% tl1pB C;C.Cpt1d)dp#p+ p-ƅDpG8nYi&p0/!1ƅ8eHthƅp\ lHƅt\0 ։wz;`p׈ 2dO p!C;CDCp1d)dpl0 v@88D7dOdth 9p*:tz\։hC;CFCl9 >uË h\p 6t`\Ӌtv7;9ΉuCʍy)|$tt$D$<$+땐t&-\zCЃ C;\;`phpp71d)dBB;B)Alht&\ 8tdPOdt9P<6pǐ;`ht0?B;BBlpt9ttDpdhNd;`d6C‹h`)č|$\ht$<$L$ApCp`)čD$htht$D$t$tht&DG4DX&@Lh9t&tpЉډ9Ptp6t҃lT$$=PWp9vJdމ4$D$v=9PrPdW)plPp)tpHp( DC;Cw8+Cppl<nZDpw8C;C,+8Cppl<iDpq8C;Cs4Cppl<lp8C;CB0Cpp)`hl0Džt` p1hd)dC;CD0Cplp0DžtddWh)d`9t5t>0C;C=CpldtDpG8HuH<#,,t1l<(D<\%,,t1tlzD$H1W<(L0LDž4D$H1;<(TXh$328LTp\$pl$D$^` H! 0ʋ);$T$$pp\$덋<(D0<(T D$x1<(D<(L @LDž\ j<(DpH 0$D8Dž04 ppl$D$ucl9t*H$/DW4E$/LTd6Cʉȃ)čT$`t$t$|$/^p!t $]0 )9@<(T0<(T 6=CЉЃ)ĉ`T$t$t$|$c3t$hDž``hpFHHpC;C8Cptd~dhƅ8p*<(L0g(<<DEЋD$H1 6=CЉЃ)ĉ`T$t$t$|$ @L4L$hDž`I$,L@D$\\fDž`ht$Dž`k@L<aD$hDž`p\Jpl$D$~P1<(D$+puL@c$+p$}+~f-1\d)d`u*\t$fAFDž`pFdC;CJCDʋG8Htu $} hvpC;C?Cplh$.|$ƉpEĉ1󫍍3Eĉ $D$t$[ Ƅ311у9u, 3t$<$7 ƉHx1 h$,D$‰l ‹1󫋽MĉL$T$<$ZHk}Ƅ wh\֋`8:D7x΋pDž\`dhOd94;v^G;GNGl봋 1эA9L$ 3<$ ƉL$8 t.hF0$|$8‰DRP1эAL$P"$L$譟W$#pL@@L<<$#Ll@9sgtlɋhL$$ ڃ9v#hD$ $ ֍C)lV)  hppplD$$ l)dNd \p`dK907dphB;Bs>hpB1dl)dUld$!puĸL`h\@\L@`h<`h\w6B؍C)čT$t$t$|$t y `h\p+t p-H9t^p7d*DpA88:  9tg87ƅƅt6B؍C)čT$t$t$|$ś[6B؍C)čT$t$t$|$~R 6`P9tT3`ۄ 6`9tq3`ہ`C`_)܍\$tt$D$$襚_ƅt`C`_)܍\$bt$D$$D>ƅt?$^pL@x$)p$ pL@o$bpLt@~$p@L dht$Dž`T$$ ztF0ѥ$1X$p$$0D$$y01Xr$} vp8HpDž\d1pdOd\tt1\w$D$;\Xu։t 9{suF%t&pAl9uJ>tf}ps$QU79BƉIM{ xC(Tt&C(Dt&C(3vC(#vC(vC fC(vvC(vC <0C(Bz}}0 wdz J M}0 w#uf2эGR~Ѓ vuut)}$u#}PS9BƒCME UCE щUt&ut]C(C(t&}PS 9B‰QK UUT$$PHx'E%= u̅~ % D$D$D$ "D$D$$Ft 40D$ t$D$$qx[^]ÍvMU% -wú OW&C8$)ΐUE]] u}$pf;x4SHe=9zt!1e= t SHzBChupChUt$$T$P9tf;x'KHAAuAe= t)uc]Ћu}]Í&uf;vx'SHBBuBe= t*u $/t 2<딍3ڐU$]]u}f;x4SHe59rt!1e= t VSHrBD$D$ D$D$$,щ‹Ή׉u tuBfx[HCCtUt& }։1҉1 uV]u}]Ðshs,+s$)׉։u뛐t&Ce= t+듍veK됍e maf;x'SHBBuBe= t*u $xr a腴cyאUVSuF^ )t%D$D$D$ "D$D$$^t T$D$ D$4$ [^]Ív4$PFnUWVSu ]Mfx6SHe59rt!1e= t  SHrB $Et U u"M x$x HU8{s)E&&${sE)EMt$<$L$~ot)EEM E 9ȉMv59ȉϋMC|$U$VUME 8{MEUt$|$$tUs@UMfx+KHAAuAe= t)[^_]É$u 믋{s)fe붸eKif;x'SHBBuBe= t*u $Bo +OJCאUWVS M }E|  t#0E tU䐈 uU]1>~0D$U<$T$Pƃtփ [^_]Ít&~\$U<$T$P [Ɖ^_]ÐUuuE U]]}}D$T$t+Kh|Ut&tCX@ ttJxj$}}uT$L$]u]U M@$]t&S$tǃutSC+C)D$T$떍t&$딍e]u}]U ]]u}f;x4SHe59rt!1e= t SHrBEU$D$ET$D$ E D$f;Ɖx'SHBBuBe= t*uT]u}]f;x'SHBBuBe= t*u $l pM蔮룍苮ڐUS\$ED$D$ D$D$AE$E D$ D$D$E$D$ D$E D$Ĵ[]ÐUWVSPU }E  t#0ME tuM]1>~0D$U<$T$PƃtփP[^_]Ít&~\$U<$T$PP[Ɖ^_]ÐUUE JXR0+At&J9Ou]UE @XPH(P(P HHPH ]Ðt&UES@XHP(X H(HPXH []ÍvUS]$P¸t SX  []ÍUS]CXP;P wCu,PPP;PvP#PPP 1[]fP$PPڐt&D$$P ¸tȋCX똍vU]]uE KX;Qv9Brt$D$$Rt#]u]f1t&US]CX;PvJBt#[]ÍD$$P֍v'USM ]9s'x Pt9s: u)[]ÐE[]UMQtuBX+PA)]Ðt&BX+PvU$t$M Q;Ut $t$]ËIxAtjBXPX(P(P XXPX 1$t$]Íu1BXXP(p X(XPpX 뽐t&BXP밋BXPUS]tOCXPH(P(PHH P H$ICX@ @(@$[]Í&CXP ː&U]]uu ChuD$$gu u]]@ ]'US]CXHtOS<t$M HMHMu9S<[]Ðt&@ $)%D$CXS<봃S<[]ÍUS]SXBtC<tFC0t&@uC$tB $9HC$][]t&R$)T$_SXBB농UWVS U‹uE@XR0H)҉M&y 9O߅uH()މMH })9)ۉ}xfu2}H$M+Ht )Bu1 [^_]Ðt&}Ut$ $D$M]AXS0H 륐UD$ $D$MEQXJ)D$EL$)؍B $AUBXR0H DH(1MH })E$;Ǹ*xQMt$AXX$\$]CX@ $@FMCXx P(S0UBXpT$X($\$wUt$)T$$w U ]]u}KXȋq9v@3ulCp@;E #y KXf;uNq A Y(A(A Q YډAȍJE BE ]u}]Í&y)E$>:tH|$CXU@$D$\CX@$DCXUpuP$p{t&z$9ftދKXA A(A$s<&U1WVSu}] t&GXPHE)~<9B΃y1ɉMu萋449uuÍUB+utkGhuUD$<$ U䋇T$<$P t7lt&\$$ML$tUBE땍&E)[^_]ÍvErt&US]K0tC0S$tItJCXPH(P(PHH P H$CCX@ @(@$[]fCXP А&UVS]D$D$D$ "D$D$ $QƸt)CXHtNS<t#ppS<[^]Ðt&@ $)%D$蠚CXS<뵐&UVS] u^uFCXu+PC0Vs0[^]Ít&+PC0Vs0[^]ÍCXP;P w8u(PPP;PvPPPP ʀ눍vP$PPދD$$P t CX먋PUVS]{h|htMunCX;PS0 P8u-]@[^]D$$0[^]ÍvCXH;H PPP;PvPPPP #;P[[^]fH(PpHP(P p 9ʉP4̐t&KhD$$}Ut&P$PPkfs$$ED$$P CX'UWVSE] EUzXw)~99uBuX1ut&9uÍE)EutU$uE+E[^_]Í$ut$L$MpUËBXU몍t&'UVS]{h|htMunSX ;JK0Ru-]@[^]D$$[^]ÍvSXJ;J BBB;BvB #;JBBB [ [^]Ðt&JB(rJ(J Br 9J ,č&shD$$%Mt&B$BBcfB $D$$P SXU]]u}CXxt]u}]Í&uW$P4uʋCXPt0C<u*@$)%D$RCX&xpK<uUEP$J4uB$;B(E]Ít&'U1]É'UE]@$@(fUWVS(]E{$C(E C,E C<wt e35E4$EED$ED$D$D$D$ ED$C(D$<$֋M‹EE$K(w ([^_]Ív'U0]E]u}CTE{PCXE Chwt e354$ED$CTD$D$D$D$ D$D$<$֋KT‹Ew ]u}]Ít&'UWVS(]E{PCTE CXE Chwt e35E4$E.ED$ED$D$D$D$ ED$CTD$<$֋M‹EE$KTw ([^_]Ív'U8M]]uu}A)čD$/]V$F(ȉF,E F<zt e3=<$(UdEUD$Et$D$D$D$ ED$D$$׋Eu})؋]]É'U18} uu]}E|EVhtUE]u}]Í&u}.^XCvt'9u};v+xt%u܍vtU1҃[^_]Ív븍vU$#*U}E1Ë}1ҋE[^_]ÐUWVS] u}u !Ɖ\$4$#)ƒZw߃[^_]ÐUWVS}]<$iCp1vvU MD$$7-‹E҉ tNM t&t,9u};v(xt"uِt&E 01[^_]Ð뻐U1MtLQtCQt:y u#+|Bt | BtBt ƒ|Bu]ÐUe]3KUe]JUWEVuSM ‰ǃv. JJJ w|tt OuO[^_]ÐU`]]u}؁v]u}]Ít&tÀte8w~xu,t(t e3=ۉ<$\$$돍EEEU؉EE׉E1]EEEUԃ8EXt e3$JED$ED$D$D$D$ ED$ED$$ӃttDEE  rYwUa E$D‰D$ E D$ED$ÐUWa VS\uEM] UDDDžE؍FEeEEEEMEuċ8GڹBыy t e3=]<$EUMD$D$L$D$UT$ UT$UĉT$E$׃tu!9ut1҅tU)ڃ\[^_]Ðt&tڃtUT\[^_]Ívκ3   UWGUUWa Ve5SPE]RX)ԍT$/DDž[E܋EEE8E]ȋGX؉E̋G/P zt e3=U <$EUUT$UD$D$D$D$ D$T$Eċ@$׃t~Te[^_]Ðt&U U<$EUD$D$T$D$UT$ UT$UȉT$Eċ@$׃t}E)؍e[^_]ÍvE)vE  UGUe Ea DD$ ET$D$E D$E$\ÐUa WVShEEuEED‰EeECx_t e3M ED$$Mu$Mĉ-M싅L$D$D$DD$ E D$<$D$ED$ӋU)tu zt$t&ttTh[^_]Ðt&M 14$SUԉuJD1ljMMUUUԍMčt&E$7UT$MED$D$$D$|$ L$D$ӋU+փtt U   0GSC!Ua WVS`EUD1ۅEԋE EEET$E$We\C8wt e35]UE4$UEED$E D$D$D$D$EL$ D$<$֋U+UӃtHtDt/t+t&vtT&`[^_]ÍvM uM 뢍M 1ۋEEԋPUUEEEԍUčM4$EMD$EL$T$ D$D$D$D$<$֋M+Ӄtty  YPCJUSU Mtgtat`AtYt]9t&Xt8|t1Xt)|t"Xt| ttu[]Ð[]1f㐐UEM u&t9u]ÐUWVShEE]EEEԋEE0FZxt e3=uQE ۋ0UMu쉍UUEčEf\$4$<$\D$L$D$D$\$ D$T$ $׃t~tyuU+UM Ӊ1tM u M …!ʄt"tteTh[^_]Ðu9u){t#U])hv뜋UUE $]b5MD1ۉEԋPUUEEEԍE쉕Uĉt&u<$uD$T$L$ D$D$T$D$ $׋U)ӃttE 1ۉ0  }MFU ED$f D$$Í'U E D$D$E$ÐUUS1۸ +E܃ MU܉$. b ۉu .ËC9w)|E܉|$$,tDu؍F 1$ t+xpE܉Uԉ<$D$w,ۋUUU=a t<-t~<+tzЃ0 vo&a 1ҋ5b ;b ؉<$a a =dJ 5hJ -4$-f 9w9vf e[^_]ff <-<+Ia ED$UD$D$ ET$UT$UT$D$ $twtb1ҋ=a =b a 5b 1t&EEÉ];Ea ^ b fEfE1MU]]a a ;u"5a 1ңb ؉5b E뺋E܍UT$ D$ $D$<<DsMe=]؉U vEZu<+t<-t<>]+E܃^U܉$b <-<+b UT$UET$UD$D$D$ T$D$ $9't&a b t <,u>{u8b D$ a D$b D$a $f a t&<,`D$\$$\9u EU34b 30b  $D$ xL$f`T$$D$K4 g $W`d (b E,b U g \$ 0b E4b UD$D$,8b D$}D u}ωXMLXɋuΉPtUEʉDb T<2U ȃXb  F i P t&\ Xb ЋE`d3,b 3(b  E;8b "u\$ D$D$,4$*w!D  Mu΍ E}ϋU܍k\Uʍk\ D$$D$s$tP}9MS)ǍG)čt$;SS SWT$H\$ D$4$2vH9$D74$`b t&5EƉE}Eu}MUNU$I+N4 )}EU}ME2Ee}EM}MUqU@}En}Muuu}ELM}MUqUU&UDEMEB%|$<$uE)ƋEIEEE+E9EE~>}0vC t$D$ E$ UMuB%|$M/EU4M1]]LS<TMucu,uEIƍxE+E9_Mt@%~'}0B Ut$D$ $ uMMt&}3 u1IƍxE+E9Utȅ~$}0 Mt$D$ $S uu u뒃}OX}EsMM}E3EMOUqUMuEAEAEċA EȋAE̋AEЋAEԋAE؋A E܋A$EA(4$E}ʍEƉE׉Ut&gfff)‰Ѝ)щʉ؅EЃ0ɈuE}EguEUv@RuƁ~+uUlEU$I)‹E<))D8E1Eu8EQE)¸kd9UuU1}$Im)lj+E~))ЉEU)DxEEGbg$E$I}MuEUu)ru1IƍxE+E9cE@~$}0EUt$D$ $uM M}EM}MUq U0}EE}Muup U}O}EUUUDE҉EOUMB%|$<$uE)ƋEIEEE+E9EUE,~;}0lt$D$ E$UMuB%|$MiEU4M1]]fLS<TMu}EmE}Muup&U  $||u1)IEE+E9EBM1~0}0yM|t$D$ $|uEM1]]U49t&ULS<T8u&t$u|$<>4$}fET$|D$0$|U)t&E+E9ZMt&MT$|D$ $|UMU)9UOEs<$t$D$0}U1 M.TE<0]]1Ut&ULS<T0uuE|$t$$MU4REEM|$T$ $E48=1 M.Dt$D$E$yU<2-MM49U1]]Ut&ULS<T8uE|$D$0$^Et$D$0$1|uEQ}MMEM)kdU)JdPUuOMMEE8`bUU:FsUU:,@u1IƃEE+E9EEt4~$}0Ut$D$ $;uM-MuuU1kUu*оduUf1u$ImE+E~)‹E<))D8EDEt$D$0$uE|t$D$0$a|uoUt$D$0$<uUE RM}OUq+pp0UpUEl@$E~11E3 UEEP 1}1эq)IEE+E9E}~*}0y|$D$ E$ZM}Q }1E<0t,]]1UULS<T0u]}k|u M|A yuM|$4$L$E48%E|t$D$0$|unEt$D$0$ut$D$0Ot$D$0t$D$0t$D$0'Et$D$0$uMt$T$ $E<0|$D$0&UEMU ED$ED$E$EÐUWVStBt $_ FE}Gtt $_ Y[^_]ÐE'U}9ztk4$D$ÅEU䋶EPt&1;+DC0F C D$$C$D$$)4փC(D$$eC,4D$$eE}9}vgpFCVS~ }{ FECFCN9‰K~{41;+DC05t$ E@t&9M|E9f몍$FK1rVF' UU$}Gpt&U$Ét$֋RtJtk4t$$]ÐV1uߋ$t$]Ðt&UWVSÃrF~CK[ E}]1?fz99t&|zuu;r |pt&u};z~b49]vUr9~z9|Guz9}}|:t|}9}t&uȋ};z}븍wI1[^_]Ít&uz}벍};z fF};zfxf1v};zxt&몐UWVSÃxtbGuSGtB$G t/1 &G 44$D$pu܃[^_]$Ct1rC' {k'UWVSӃ EE䋂Et $_ CtPuC@ EE1EvU<<$;Ev%D$E<$D$8UEuDӉUudut $_ Y}tEUE [^_]EEUSÃcv 1ۉ؃[]Ë8ttU$_ UBtHuЉUUBt(@ t!t$_ 돍&1ލt&Uc]Éu}v1ۉ؋u]}]Ð8ttU$_ TUBEEpuX@tG$\UBt\1 UB<0<$D$<`xuًUBt!?$_ .1މU$UBt1rBB' E3USXt6@@$JC $?C$4$,[]ÐU҉]É}ωuUtnf ~]t4Cw4F$@p@ @@]u}]ÍvD$D$$y1}te 2<ÐU}} uu]u7=Mȉ $MMu1/t&UDEĉD$E$ɅÐUTWVS$u UЋ]6U؋M1tEU$UxA UD$U_A UDF T$\$$U;hb ^vhb :/ A ҅t 1T9wEU VDM|$$L$Fe UE5e 4ENv/|/u<&H/u$wM:/?/-MUe[^_]E1:/1p  9t3|F'11Ҹ $ iT$\$<$UMUM܅uUW1VSӃpu ,fFt!Ƌ$D$ue[^_]Ðt&$P $UUt.@ \$T$$IFFwe[^_]$ 1ɉڸ h'UWVSÃ(A hb U܉M)$ |$pPM܉U9WUEPT$@ <$D$*EA ڋ]1v|tcA U؋HL$M $D$U99E@۹  E1ۉU؉|$$oU؃95A w]Ӄt U9P?}tPM9u A EEU$ D$T$oe[^_]Ít&?/l&aM$. L$UoǍvU]ˉuu }}Et$t#FtN@ FkL4$e rE$gt G iE1ɉډ$Eft&FkLǂe 몍&'UWVS8EEUUD$E׉$Ee EUM1$ED$D$tM3‰u쿘  Myruf~LFf@Efx* TMA,I4 9MM]9]U& M9:urvzvڋZM3; Ẻ]U'&3KL p9wt)ˋ}̉޹u҅UKSC[[e t)%9-t&Ee[^_]Ðt&uUF,CU%?)čD$L$$ED$Mu\$L$4$9MA,F)D$B\$UЃD$E$DMt$\$ $QU9K ẺUMD$ D$ EЉ $UЅu~ELFExE u4$}UظEMA,6 U؋4L D؀}uCMUD$ \$D$$UztU1 1[ 뷋}1эA)ĉL$MD$$L$%NjE$X}zMytO1 _Uػ6 4Jf1L 41 (1t uF<tt 1n E1 x EfUWVSEEU|xA xDžthb 1)1T$UU҉l&Pe pFD$F D$E$o A EE1uFt&/MD||;A CÃ|tA PT$D$U$ML$U$T$+}Pe D$ED$U$UME,‹D> E>;A CUfEteEx tx0p~UtMkALe uDlU}T$M$L$uE%=@tyD1 Ef<$h芞M h|$M$L$he[^_]Ít&te[^_]D낃 ׋M$ L$vgR=A ET$D$$hGhu E$e$5N9pNpxUzt $}A M&UWVS`UT1|`XED$`$D$U kELe E]܋Mux& ti u11 u܋x31 uċ`$M $Te[^_]Ít&E Pe @ XƅSq ED$UT$E $MTE=  |AYdTA,f\fXY,A|;dEXL@)ԉL$CU9Up` ]uƅlDžxDžh@B&uVWVfZ&ƒ U9vQtdfRtdt&buVt4F8FdLJ<F0F,< e DXU9\xB \px|p\Rt )ƃ|QT$`D$ T$Qt$T$#$H $8Qp0+lV@pCjPuS C9te lډ\lD t#\;tF9sLC )ȉ $D$D$HDCHD\9tBxpR9S9K)‰L$`D$ L$KT$L$$Džl VHVLIVh:f e V˃Ӊ<C^tZt+Vxpte H뢋];$UD$ujU։$ E < D$<$tҹ? @ ?E[UH,UWVSA EEEPU䍴&]xX{ډE1P4 t&t :t}}s1{1L= t t :t\}1D$$$5EE[^_]fX{ ډE1O- tt&t :t}|};utU ~:fEt&Sv/t&ttM :učt&v/t&tҍt&}M i:i{v]fWwESe}PpE/ttu :f(vvfkvO_! U$D$$$]ӉuƉ}mu8$p4$61tt$\$$螵]u}]D$$Et1уMtbtktb1уLe U9CED$訇1tD$ T$\$4$(e>X@v1+X‰@v1돍&UWVSIM e 1ɉھt<:u44$ME$L$D D$$x7Ge[^_]=A duE t:8؈Et}uۍt&t*:utuπ:tۍvu1늋E$ $11Ҹ =G\ 荶UWVSӃ ɉEMoB|E1ZA ttًӉFxCHtF}uދHTL$@ $D$xPD u׋E싐iىӋ}t&t&FxCHtF}uދHTL$@ $D$PD u׋EtW}t Ce[^_]Ðt&/BB1t&/B넍t&A t$vCxCPr׃}u֋PLv*T$@ $D$WHD 붐/At&‹lUJ4PEQM$L EM싑Bv1}މ׉ÍvQ}׋U"t&FxCHمtH˃}uڋHTZL$@ $D$PKD u}U苿l EM}HK5e =95<#ދ]!FxCHً˃}u֋H|L$@ U<$D$ UKD 몋G\O4PQ$F lمN/BF\tmN4PQ$F %RtuLJǂ/#[dž빋Et&UWVSӁHkELe uBfv t,u u EtЍe[^_] t&ED$/$蕡 0ډEt;uD$t$$E EA EED$ED$E D$ |$D$E$e[Ɖ^_] t&Pe @GW8t$T$D$ E\$$ D$HA Ӊ$ Pe _Q=A tXe EM D$E׉D$ED$D$T$ $A uet\EM D$D$ED$D$|$ 4$fƒtzPe B$Z G%t&kULe :O4PQ$L QBE %*tlED$D$$%t&E$xtet =A D$ D$UED$؉T$D$@$A kELe 둡e U ƅfED$ED$|$ T$D$$bp;ltEtuV\F4RP$F t[<ցƘEM D$E׉D$ED$D$T$ 4$WdžFXZV4RP$T$蚝1A‹}kELe %LJ=A YD$D$p $=D$ D$v 4$}vQe vUT$E ډ<$D$ tcǀ ǀx9B\J4PQ$F cR{$W1ɉ$Ȝ  :U\$$ T$B!E$:}t!$T 1ɉ1b:ǂe1ɸ$̟ 4:UWVSt&YЀ :wЉ ɃqЉك0]yЉ w$]fɃtQQЀ v]:_Ѐ w2]uƉύt& \HHЀ vu];uM])؃[^_]:wЉ v;8u+"[^_]Ã[^_])밃뫐Ulb PvÍvtb $T$lb Ív'UWVS8Pe E*lb E3}pb U=te  tb Mt& 1ۉt$<$řuEE}GE2EUEE)EkUT49UMU& XЀ :wЉ pЉ؃0]xЉ w$]ȉftPPЀ v]ȉ:_Ѐ w/]ȉMǍɃ\A A< vM];uP]ȉ)؃tv]]u9u%EEMRUT49U1ۃ8[^_]:wЉ v_8ug؃uuus}kD49E‹EdʋMMM),}tb G MSk MD)‰Ek UT9U-EMUt&,XЀ :wЉ pЉ؃0]xЉ w$]ȉftPPЀ v]ȉ:_Ѐ w/]ȉMǍɃ\A A< vM];uP]ȉ)؃|gMM]9]AUйU]Ek T9U:wЉ v8tUUyK0]ԃ}MuЉ}b]u1;u~kUD49Ev*‹EPuk}L0tJtE9u}…ZPe M\$$ {<8}jt&kUD89E܉Evt; 0H ue t k};DdžE9ut7u.EEUU҉ЉUtt9uE}EtM1 M9Ev]9ttуMPTEUMu>$@H o]MkALe 9G@ 1eu#ee X9]wҋM9E U9U0Mq땃}M]k]Lt ve[^_]Ëy|A,@P]Xu@p ҋUDUUsUB8@E1҅t@9G}4tt9sf89wM@9uE$}F}U% _}]UEp]} EDC ڋ};h}#} Є}%}$})} 1ʋM} U t zD׋}M;D$E T$UD$D$ $HMU(lj$1tBtJ  }*v\U1ɋEUt,RK9"D$E9GщT$$<9uhu>IU$ UMЋ]9u1Ǎ&E@q]SP)9uS 넍t&Ei@F}+P9uKvE1@}9u$t& D]9uit&E@F]P)9u.M9ufU+E9u&}9urfuP U]B|ۋ@u܋ME]A(@]E9uR }v^}>؁E}EE -M}A ; # Є%$) 1҃}‹M ‹E E} MT$UD$D$ <$D$UNjE($1tBtJ   *v[E1ɉ7Ut0]RK9  9GыMT$D$ $~9uE8f$l ]}ЉыEt@a ]SP)ʉS 롋Et@ }+P|Eq@]d\DMLEA@E ]P)ʉ!UU+E }%E u܋U9O}G(puf];]EEECU %A  }OT$$DÉL$ D$a $葁X EeP $11 뚉ЉUUM@`CF >=e UA U D‹W4RUUD$MD$ T$ $ EUM@REȉMBtRL$|$$Bkt$L$$kB۸D؃ \$$)&3 BR B͐t&Dž3 Dž3 ux>R 3  Eڅɺ` DʋA |$\$t$DЋL$ T$D$ D$ $D$$}t&D$D$$`DžR M'UHPe uu]}u&xb t`t$T$$Ӌ]u}]=xb * 0 L$E߉T$EUM܉\$t$ $: M܋UE떉4$U҉f St kLe u yt[]ÄDf kLAA0 e A[]Í&'U]ÐU VS 9tE);w!t&9щt")9sJ9ut&[^]fUVSÃB$D$^t%vu (vvt$D$]u[^]Ã1[^]Í&UWV1SӁDE Džf~.UDŽ %t ɉDŽ%PHƅ 04E*Dž1.DžUZluNja%st&&r)Åu$a5‰Gt9B|Elj>BED e De[^_]1ɺ   e $ 0U E$t$|$DtHe ; e uƒt/$t$|$];Bse [);9s;Ls1͍U =e $t$|$ue Be $t$|$]á$e e  e 9w091)9rIt9)9s\ t9ve 또&UWV1Sà xUGEGt&9s#|ut$>U9r݋E$n>}t+C $T> [^_]ÍUWVS0E\e @ e EU1҉Eu];3]9EMuЉUԍ\ |vM䋰D)ыUM DD04+0t$,M܉D$E$_MD$L$$d_UEM9 v[9=e GrpNjt܋@K9MCMԃM\DuDDUEM9 w΋Uԋ e u9Ms][]fUԋuE0[^_]Ðt&Ue ]C u}$\$::p1uGu:e D$x$.t38C؋u]}]Ít&vft鐉4$<1ɍt&{wt&fcUWVS0Ee D$X$-lUEB e 1EM e v}];3]9EMuЉUԍ\ |vM䋰D)ыUM DD04+0t$,D$E$M3]MD$L$$\UEM; s[;=e GwpNjt܋@K9MCMԃM\DuDDUEM; r΋Uԋ e u9Ms][]fUԋuE0[^_]EE0[^_]VEt׋@EyUWVSB  U1w \1`e tD$H8u$o-e t X1`e $ 8tUSà ;A e u3 A D$!Љ$L$^u 4H 1 []øe␐PQRT$D$ Z $$D$ fT$UPQRD$T$$QL$(T$$D$ $yZZ $$D$$WVt$,ك)߉3{S KC܋\$$T$|$|$TL$$D$8T$+9\)9sS9~5q9]]xJ(E‰ 1f  9Eu1t&  9EuM<$L$D$U1  9EuUeD$ D$ED$E D$E$Ít&UeD$ED$ ED$E D$E$ÐUeD$ D$ED$E D$E$fÍt&UeD$ED$ ED$E D$E$'ÐUWVSTMUɋBD$D1ۃ}BU7}$-}uV4|$<DJ tL$<&Dr uL$<p<-<+D$(D$<<0D$LD$@>}} E1D$DD$@u.|$(1u ;T$PA1t&et$("1u%fe11҃T[^_]Ðt$Dj1E D$D!D$<&T$4&\$LT$ D$P\$LE}t|$<w}G< [^_]fIh:Kc}MU v:'uU}7t&D$ ʚ;D$ED$$lMME }9ȉ}w)111EM}11҃vtv<  Mu T$D$ ED$$kuu9>vvtHt1}E ؉ [^_]Ðt&}U뽸v'U$]ËEuu}ϋM E}i)Ѓ UH3D$ D$\$$M>gMe"sEtgt(~-  ً]u}]ÐEЉ}u]}U ]]axuEeMt|e!듐D$ D$\$$UVfU H31 EUWVS]UۋB^Dž|EX$$}uEO4xDA u-o+DžttEEM1:t/&:  DŽu>`\9Ea9E9y EMf0< 9wMME&u tu UEtrESU8Mwt8Mwu}t!:Mt f:u˃uEUM}EEx)E)Mփ} } E+E9ONjU)lj}'UEM MMĺMMMMEpM+MDžl9M~UDžlE Mhd1)ljMEEˉEEAvV Ⱦ L$D$M $`I#`tfۃt1߅tT$ED$ FD$Ⱦ D$M $`aN`T uEMEMu}9}hdU&|T$x\$L$ ]\$p<$MUE\E~<\$ UT$ML$ $,`\$ ED$]\$$`G u}uE }] MUEt\MuD$}U)ǍD$M $Z7 EHDM9M/uɍ~MP9u}Dž|LDUu}x4p9Et_}ʋDщE4Eeht&;E‰ׁ)h+E9hw u};Dvى)߃m9vƋED$ xT$ML$u4${n};Dt|$ Et$4$D$YmUuLą҉L~put&P9u}uE} փ))ǃ}])‰|ELĉEGM lWL$+|D$u4$tEt&M‹a<St&EEM'uv8uE}}Et5uEE8EMu :  uM1ҋux}}]ut&EpЉ v }]4^u<0E뽐t&Džtvt&E@8EFME }+EEt!D$ D$ML$ $>SuĉuE }}EUډU9uƉ׋E u9u1)׉ME ƋU ))ƒU )EE D$+E4$D$tE9p߉)ރm+E9FQ}},uE }vsv+}1ɾMM*+EEt*D$ D$]\$$Q +M EU0&m }uސt&1ҋu}E)։) щMHD$]D$؉<$tUEċ}ȉEEUMÉM9lj|}TMU}}D$E<$D$ VUUU+M})ʍB M MU 9/}p%t&l1}uE)΅X}MEDž|}~"}1&J9uxU19}E}DLv}EEuEщ]Ã]uU]E M)]Í4EFMM ЋU9߉U؋E)…1T$ D$u)}t$}$jOUkڅ҉D |1M9|dEH8PЀ vЋav<_t<)UED$ D$D$T$<$9] {D$|$E$+E|D$ D$ED$$NMEEGkMEDž|D}}M)MD$}$|$1+u9'UEE EI}1UE؃ Ee"4et  "]؃ ELۃ }te}"tktD 0 v} XمXU 2X%@EЁXمXtD 듸e"[H,M}X(|;v|E0t4}t?M8?1U: u| uǃU 1U U: u | uUTUU)t&UED$D$ E D$E$ÐUW1VSà E1҉MMt&HЀ vMt M:] |H~& uUM911룍vM ~  M u> [^_]fIh:Kc}MU v:'uU}7t&D$ ʚ;D$ED$$=NMME }9ȉ}w)111EM}11҃vtv<  Mu T$D$ ED$$Muu9>vvtHt1}E ؉ [^_]Ðt&}U뽸v'U(]ËEuu }}L$D$)Ѓ5b T$5pL$T‹a<vD$\D$`L$`uv8t$TD$X|$\|$Xt$HtBt$`D$XD$L8)D$LL$Xt$`&:  uL$`1ҋt$\L$8|$X|$H\$@t$LD$LpЉ v"|$P\$T4^u<0EfD$4t&Ĭ[^_]Ívt&E@8D$TFL$TD$P  {D$HD$\aD$XD$<5)D$<|$<Z|$<D$@L$ [^_]fIh:Kc}MU v:'uU}7t&D$ ʚ;D$ED$$=+MME }9ȉ}w)111EM}11҃vtv<  Mu T$D$ ED$$*uu9>vvtHt1}E ؉ [^_]Ðt&}U뽸v'U(]ËEuu }}ME)Ѓ@ U@{pEMU T$DAt&B< k UEu9Eu MD+EExMUEuMẺU9u M&mUE̋UEЉU9EtUuԉщE4EeUv;E‰ׁ)}+E9Mw uU};:vى)߃m9vʋML$ ut$}|$E$9Ett$ |$UT$$mM؋uEԉ1m8Mu9u !UԋEȋUx.M1U}}MU̍129u}ME}|E_}܋7H9ىUMEU }|:} EUډEU/t&;Euԋ}mm7u)Ӄ}}9} rm9ˋE܋EvƉӋE< uԐ9vˉ)΃m+E9v덋UMuE:T9E MuEMx)] M荶uM E+Ex 11&9] uuEĉH[^_]9w9+uEr!EȉD$UT$M $ut$ }|$ED$$UE:)Ev9ivU9EsD}m+]umu}?E܃E܉0EăH[^_]Ðt&1ҋE})Љ‹E4WVS|$t$T$L$1Jt.Pu؍&؉JÉJuX[^_[^_ÐWVS|$t$T$L$|4ڋ1Bt(Pu ؐ؉BÉBuX[^_[^_ÐUWVS@u1U+D$ ML$] \$E$M]~\߻u-t&D$ UT$M <$L$e9]~!Uw19]ߍe[^_]f<)\$#]؉\$t$ ED$U T$M $uEU ]ڋ]EU)9EM]D1e[^_]ËML$ E |$<$D$n3t.U1~UM&9u1vE~M1] }9u1t&\$E܉t$D$ UT$M؉ $'t$ E؉D$UT$$UU:EE9w/9 {1f9| t뵍t&)UL$#؃)MMEȉ]M̃MЋMTU썴&M؉t$ L$]\$E܉D$Uԉ$t$ MԉL$]\$$M̋U9ӋUЉ]]9ljCىw[9t{~1t&9|Uȋ]UMEEE9cuu뽐WVUS|$t$L$\$ <41fAu[]^_ÐUWVS} Uu$UD$ t$|$U ~OU)t&MD$ t$|$$aM9~Ewt19[^_]ÉMt$ |$T$$qM붍t&t&1f~:9u1Zv~1f 9u1;닍t&'UWVS(uE]t$ \$M L$E$u <}\$D$ U <$T$y`MًD$ ED$U <$T$W`M]([^_]Í]UM} EщUljMt$ \$|$ $\$E <$D$\$ U |$T$M $\$M4$L$EU 1&9:9uMU\$  <|$ML$ $MMEEL$ $t$D$ MM܉EU\$D$ E 4$D$M*M܋UL$ $t$T$ MU+UMt 9Љvڐt t~}1&9u\$ uL$ $t$6MB9‰$Uσft([^_]Ðt&UM} EщUljM\$|$ $(v\$E D$U$ Tt&U\$D$ M4$L$)UM\$ <|$ED$$MUMEL$ $T$ t$MhM܉Ef\$U 4$T$MzM[f\$ |$E D$U$&xUWVSUu}D$ E |$4$D$~UU,t&U D$ |$4$T$\U9~UwtU19[^_]Ðt&E |$ t$4$D$뮍&t&1f~B9u1Ov~ M 1&9u1({&UWVS,uE]t$\$ ED$U T$M $EU4\$D$ M 4$L$[UM ڋD$ ED$U4$T$[M],[^_]Ë]BM} EU׋UME‰Ut$\$ L$|$$\$M <$L$\$ E |$D$U$E\$UT$M $EEE\$ UT$M$L$u\$ ED$U4$T$N~#EU 1t&9:9uMU\$  <|$ML$ $tEEEt$D$ UT$$M)M{\$ ML$E 4$D$Ut$T$ ML$ $Ut 9Љvڐt t~M1&9u\$ ut$ED$$MB9‰Uσ&t,[^_]Ðt&U} MENjEUMȉE\$ T$|$$&\$ ED$U T$M $M܉\$ D$ED$U4$T$| &U܉\$ D$ML$E 4$D$Lv&Et$D$ UT$$vEE'vEEE\$ UT$M$L$_\$ |$M L$E$Ev'UU MuE]u9t\~7)܍\$#\$D$ L$T$4$w]u]Ðt&4$D$ L$T$4]u]fD$T$4$c뺐 )̍L$#L$ D$T$4$L듐WV|$ t$T$L$؃tA)))k t&FBGFBGF B G FBGFBGFBGFBG v R Iu^_WVUS|$t$L$\$ <41f)Au[]^_ÐU |$}U$]t$Eu 0Pu4tPuPփ q )J p)Љt&P$t$|$]Ívt<  ) ։p )뽍t&JpU Mt$u \$]|$U $Et$L$ \$]ɉ L$ffɍ$\$XuStmۉXtqt8 ) ߉x)\$t$|$]Ít&tߋuمu͍tۉXut!X)ȉ딐t&@뀐UUM E ЉEEUD$UD$M% ЋU %f ЉD$T$$A% ‰T$$ÐUUD$ M ЋU D$ D$f?ff% fD$$AD$,$ÐUWVS  E}U uEE E؃ҍq EoH9tU1ҋEEEUUUEEUTUUU1tt&1҃uE9EUR9։U}(ʉu؋u90|uu֍ UU딍Eǃ<|܃uNo&ҋEt7 fǃ<|ԃu׃ ljNux&ƒu [^_]fUvЃ҉u [^_]fEEEEЉUNԉV놐UWVSEEf 4U1MUIVEEM}Et]fN;MEtSvt9uCuu0+U9~'N6E܉Mt }׍VuEtԍt&6uEtE UMf PE܉1[^_]Ã[^_]ËEfUWVSEEf 4M1UEEIUVMEt\N;MEtSvt9uFuu4+U9}(N6EMt!E׍VuEtЍt&6uߋMtE UMf PE1[^_]Ã[^_]ËE뎍v'UWVS ]t ft/=ve [^_]Íb e= t b f )$}f  b FCD$F b |$$ _f 4Ve= t-b uc [^_]D$$yf Yt&e b 9b Y됐UVS]f;x4SHe59rt!1e= t SHrBED$$D$ E D$T$T6!Ѓf;x'SHBBuBe= t*uL[^]f;x'SHBBuBe= t*u $N 7M[뫍RU$]]u}f;x4SHe59rt!1e= t VSHrBD$D$ D$D$$L5щ‹Ή׉u tuBfx[HCCtUt& }։1҉1 uV]u}]Ðshs,+s$)׉։u뛐t&Ce= t+듍veK됍e maf;x'SHBBuBe= t*u $蘢 cאU]]}} uu1ۉ؋u]}]ÐEt$D$E$J9t1ΐUED$ $NtJ Ít&'U$]]u}stR u]u}]Ít&M`x UE$tʋEtË@uC$*믐&Uu b b D$ | $b uÍt&'UWVSփD$x $b 貆b t`Ct {uCCKSC t$<$71{C1{e[^_]Ðt&$P볍tb $2uD$$Xtt#]b \$$Gb ==b & b &UWVSED$x $b 菅Zb $uCSt4CtR t$ECE[^_]ÍvCtED$3 D$$Hk |K R 9L$D$ED։T$ D$ $2iCR ECC[^_]Ðt&$3 軘D$ƋC$Hk D$n|K R 9t$D$ED׉T$ L$D$ $hkE냍&b $Y=b o b ^'U(]]u}stR u9$tb D$$蓃]u}]ÍM`x UE$tEtHuC$BU u5b }tR u u}]fM`x UE$tϋEtȋpub $~벐U1ɉU E$VÐUS]EU Mt t3$1%]Ðt& $1]Í$]ÐUEUEEEE EEE~ %ɃÍUS]{ Cv$ 111;4vS$ D1҅C ]ÍS @]ÍvS ]ÍS 1ɋ]fS ]&D$C $;]ÍS D]f$P=aUEUEE EEEEE` 1tÍvE$IE$EÍ'UVS]uYC3 SKD$ DƋ5Y L$T$$t$5f t$5f t$@!C e[^]11Ҹ$ 2U1W} 9}VSt)E1ҋH8E4+u u[^_]ÐUWVSE} u1[^_]Ð9}tE1ҋH8vE4+u҉t̃9Uu[^_]ÐUuu]E t%t>xt+D$$Dt(؋u]]Í& 8t܄u؋u]]ÐҍCT$$^뭐UE M18t]Í&Ut$Ƹ$1ҁ9v 1$t$]Éсw$@ ft=u%렉%ft눉 $d fj%?^ ƒ$ f@%3)`@t&0 f1%%?1t&'UWVSӃ$EMVUUU})ʍ4RMfItkED$ D$ D$BD$ <$ tP9titDtÃ@uE uf1$[^_]Í u=e= tb UU<> Ӊ9}G8fyfe= tb Ub 9uE؋Mf]e= tUU;b sre= t b MM}܃f R b ۉEb A AfCe= tb e= tA[^_]Ít&Mb  9tZft$=b &ۍZft 19u9tUF 덶UWVSd=e XP9y e 1ۉى f 9sI8u@tpL7H#!9F9Gك 9ЉrQb b ƍD)5b ƣb 艅v1b b 2DžT MEEEEEEċE-EsecoEndsEfEEE̡@e Es${áde ${D)ġ@e \$'$D$5/de $T$5.pro@file@D$D$B$,`D$|$$ǩxp%=e <$;D$D$$y\$t$$D$ e[^_]Ív>b @DžNY ez&Uu ‰1Ћ1 tB<$Ude \$D$ $D$ D,D$|$D$ D$$t$9<$Ҩ8TЃb E Eb rEu?Pu2ƒED$ D$$}uBT$ $Dž1۾ ee e5B)čL$' $T$D$=D$e #<$D$輨Iːt&e #\$<$D$ <t̋s u)1t ft ~Au1t ftb @D$$(Ob b =b b b 9s8=b tqk b b  5b Nt&b  Xb Nj3 W:f{fu5b )9s*1҉øwvI1D$ t$T$ $3&b !ev@11҉fP4$UVCU܋x`C B1$=  `e U뷍UWVS Uu؋ZCPe @tD$ CD$C$ D$hE{woEEE~{Ǎ@+1/aNjE䉸GwD$ CD$C$ D$$UUEe u0$(H E$ 1ɺ 1(Dv$ 1ɺ 1 UWVS)ρUˈU9NɉdJdU+U 9ʉM4d| t e dLD ;e $e UUMd҃‰M܍L ‹}+Uu䐅Du9e1tޣe Ĭ[^_]ÐL t e D T;e tĬ[^_]Ív$e UM1ƒML u)څE9s!f1ouE9rĬ1[^_]Ít&d}U܉NjMM)ωMԉ}9׉UM܋IɉMR}؉UU?)щỦM9}OU؋R҉UMЉ‹}} )}U9ʉM}Ћ}UNjMM)ωMȉ}9׉UWMIɉMu}UU?)щUM9}UR҉UM‹}} )}U9ʉMH}}.UĉNjMM)ωMt9׉UMċQt$}M} $ UċE $e U}ĉM҉M +UL dUm}DU;Urډd}E=$e }fU؋M܋L t e }܃LD ;e S$e UUԋ}܋MT dM؉+Mԉ}܋}ԉufDu92t=$e }롍uUЋM؋| t e }؃LD ;e $e UŰM}҃MЍ L d+Ủ}؋}̉u̐t&Du91t E܋uԉddEUȋMЋL t e }ЃLD ;e $e UUM}҃Mȍ L d+U}Ћ}uDu91t[ $e ME؋M܋ủdE%Mċ}| t e UăLD ;e > $e MUȋ}ҍ U}ċdL +Uȉ}}ȅD}99tEЋU؋udE.UċM| t e }LD ;e $e UMU}҉M L d+UUċUҺDU9Umt=$e }E}ЉdE-Mċ}| t e UăLD ;e  $e M}U}+} U}ċdL }DU9Uv6mtZ $e MMEȉd?UEdt}ă| t e tLD ;e *#$e U5fUWVSlE҉utPe @ e[^_]Ë=b t b Ջ@EkLe EEeb @E؃M؃)č\$)čT$UU)čt$u܅t1҉񐉐 @ uMD$$L$huD$t$E$h&9UM܋u M<u<EMǁ tA$tE@H ]A]ËS11$d uU$)ЉD$@Í&'UىM9tÐt&t $@H @t$@H @ÍUى]Éu}x0M9t]u}]Ít&tU$@H 8@U9tt$@H @뷋@` v )lj{ ˉЉUU@ސt&Uى,]Éu}p8M9t]u}]Ít&tU$@H ?U9tt$@H z?뷋B4~` J8@EAEH tk@ ue~IU9tt$@H >뷋wJ8B4` @y}O tdG u^t}I4qpNt`D$MD$ D$t$4$}…t-@v4G)ȉC 8&1뜍t&C ЉU\U}@봐WVUS|$t$L$\$ <41fAu[]^_ÐUEUEE EEEp ۵1tÐE$E$ʴEÐt&UVS]SuU3 K D$ DƋ5Y L$T$$t$5f t$5f t$/Ce[^]D$D${ $Hk  411҉$1kU0 U]Í&U]WUSEEEEE Et $@H ;U츠 襴1ۅD]t $@H h;؃[]US]KS&C []ÐUSEEE EEEEEt $@H  ;U0 1ۅD]t $@H :؃[]Ív'US]C KS$S&C]ÐT$D$1QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQjjjjjjt' Ht Ht H uӍB8 tH8 tH8 t H8 u@@@u1ÐUED+c  %c ;c s c fÍvUS]c tRD$D$b $%yĨ[]D$D$c $txҍt&E `c Dž` E裐c Ec Ec E9uD$c D$$KtaE@BEEUEEUD$b D$$$Ĩ[]Íc 1D$D$b $$D$D$c $c sUe ]ÐU]]}upSt$sEωt$s4$C ]u}]ÍUWVS@EE EEU`uUU⟃ :P@Uu(vEU`uUĉU⟃ P@U̅uEŰ`uUȉU⟃ eP@UԅuSEUԋB`uUЉU⟃ P@U܅uEU܋`uU؉U⟃ {P@UuiEUX`uUU⟃ P@UuEU`uUU⟃ x@uvtv`uU⟃ t4PXu(vt`uҍ4u+uuuEEU+EEEEU+EEEEU+E؃E؋3EE؋U+EЃEЋE+EȃEDE+EăEE+EEoE+E@[^_]ÐUWVSpEk ]()čD$EuEX F ɈC E1<@@x 㟃 9񈟔wӍAk EMeMAUE MfuEv\uąE]ċ{$uċU F4^@U؉uЉEE܋EEԋrMEMvusD$$4$DUЉEMT$EU$ U*E`zUȅtűUȉũwuȅtiE̋Uȉƃ$#y EUȉCT$t$$oPM̉t$\$D$XPuĉEf@uEoD$$觗E A 4$&GUĉNj$GLe 9BƒED)čD$D$ED$ t$$赕8mPe t$$ _fMT$EBBQៃ UGcMčP41/pcEU97)Zf%)čL$MME t }U҉UtM<D‰E]$ EUMċ]}ED1ɉ\Eމ`X\P@uQe M]ɉ}v6\ű  9򈁔uEσ9QU1 9D`tM$EET$UT$$MuCދ9ЉUs*TM`u M\;ErM]3XEu9u6}u]̋\9uMŰ]ċ\UT$D$$ELuEuuUȋM\9tEf9uw;us8Eĉ}&:u f9t[u;ur؃EU9Ur]ċM u}t E$%}e[^_]M+EED$EĉU ML$M $0JEU8p=t =eusD$$4$>T;UPe uЍUMEt$$ UWWt$uuEU}EBtM̋EuȉM̋UM`Eup UBt R P UB t RPUMA@BQEBUBtP UEuFB E9E2uu ;P Au}uƃ1эA)čD$L$T$$IUى׉E1эA)čD$L$T$$kI}Et E$&U̅Utr]u< 1ɉ1$ E̋U]E\M$D$L$H}0Et&EE<0FD$$?=A c1уMMċ1уLe 9CMă‹UD)čD$D$ D$t$ $C8;1ɉ1$ P`UUNjEĉGM1R5e ;uE}ċM9M\Uȋ9tt"xtE΋uV1ɰ $ ډ19l M Q1$l }EE1ɋUEE$EuEpA;Eu@DuABхt R P MA t QPMUB@AREBUBiP U^MċA8uA D$T$$< 4JPe EЉD$MUE$ PPE?}3$7#&E̋U]E\M$D$L$E uuuU$%U/HPT$|$ $yES1ɸ$ uċF8uA D$T$$ (UWVSӃ<}HU҈UPPPe tREԉ|$t$$ҋEԋtKIE؋BEt0}܋}1]Éu΋U܋ET$UD$$9w<[^_]ftjEU&Ԁ}fuA  EԉL$$  EԋPP5UWVS,U䋞MEܡe tPE܅tI{t?Pe uyU1ۋBu܉ƍEUD$ET$$9wu܋`t/UM$U+uރ,[^_]F8uA D$$ cU$Ue (UWVSÃ\E U؉Mԅu[ OU؅ME̍UȉEv[ S9u tEȋ}̋09tE09uMԍWU9sM؉]čUUfu f9t4uыEUE9U븋ME؉U)эMЍJE܋EЉMD$E܉D$E؍$@E܋UMEt0]E[D$E]܋]ȉ$Ӊ\$~@U܈MU\[^_]]]ЍA9uE]ЋU؉M)ȉE܍AEЋE܍UT$UD$E؍$@E}M]ES]D$EEЈUˉ\$$?UMUWVSu$]Љ9~Ff>t]ЍEED$D$ D$D$$ p1E E E΃ |1уt&F D$E$2[1e[^_]fU]ЅEtۋE1UE E EǃU؍UE; tUȉ$4Uǃu 1)|$'T$$t Tt&f1S:uA 11<$r, 1)t$'UUȉL$$]Ut 뚃}vU̹.ET E; U1҃΃tU|1уCs8uA T$ỦD$EMȉt$ T$D$$ MT 1)t$'UUȉL$$Ut 1U EE E U1҉EE; ΃t|1у 1)t$'UԃUȉL$$U ݐUWVStEU‹@4MI@ɉEM}`Af8E9}EEt&EUPkGLŰe v tE]u}[ &Ë}CKw}̉EfM GW8uA }|$ }t$|$uuĉ4$ EC%9ECEЉEЋC u}̋UB tg‰U`t>11;`s*\Et݋\4&1 EE}tFM}QB%9ECEЉEЋBt!MЍt&B%9BȋBuMЋuЅu Eȍe[^_]Ë]D$$lj‹EpMt]@ۉEuX}ЋCH8| PMЁQPSQ P tDMpPJHJH KJ P uƋC t}ËpgMUMBt&@X u+Pppt]D PuËEȍe[^_]EEȍe[^_],EEuD$D$ D$MD$${i1E E E˃t8<1у }W:uA $1 1)܍\$#؍}T$$t1뫉'UWV1SÃMtft1ҋ[ օu[^_]fM\uҐU]]uKCD$s D$t$ st$4$]u]Í&'UWVSLe Eġe UE߅toE f Et:t&;r&;s@Z[ u˃EE9e vELE릍&Mą};=e v‹luEM|$D$ D$D$$EӠU1ttBR  e[^_]f>E MUD$D$D$ ED$E$Ebe u2E MD$D$D$ ED$$BE}̉EЋEEԋE E؍EEeUME]E\$$ RREȋEeu!ee &|lt4$t$]Ív0$t$]ÍvUU ]M/üSu}Ac@!luEt MԀ|9lt!tT2&t"}t9t!T$$L$2%uFc@uV1t"L[^_]ÍvUא~pVt1uD$Eԉ$U+FHBhL[^_]ÉЃ*MԍEQH$HvUWVSLE j#ÚG9։fE!ME܉t&ЉPv T1t&҉+f`C9G9G`=9G==> >`C0>@>P>>>>>?0?p??9G`=AAAAA`=`=AA`=AAAA0AAAAAAAX@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@p@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@H@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPB9GC9G`=9G5C9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G9G=t&Ft&?Ɖ9L[^_]Í&11Džt&Ѓ DŽxꋕ{ MAc@t |1lu3U䉕11Džt&ƒ ׄxꉽu4MAc@t|1l{_&[pPLuMFc@ t|lu M䉍vE<Љ+D$$/LP1LBH!@t&T|D+h756667T11ɋFtUBt'؍|9}tIUEE}܉E؋UtE}U؉D$F$r{w UVt>l&@^_]É'UWV uFfUFT$U f$UFT$Uf$U9Uv ^_]Ðt&UWV u +F%UUT$4$‰eE+@UUT$U$‰1U9Uv ^_]Ðt&t&UWVփ@‰Exfl҉EEUEEԉU/fFEV Ut M)9tFtMAt+؍L9Mt ȉMUM̉M܉E؅tEԉɉMD$F$U؉=MUЃT$1҉$$E,w EKMU)9;@^_]Ðt&1@^_]Í'US$|[^_]Ív1|[^_]ÍPDžЋ}9xt&MMuV~ E "$" X"@@@9uU@"ǃ"#EBE t&Hp ;EMuPMuQp#UFmMFL$N $FvrEt"$EąFU FBFfFhUT$Uă$‰EU BEăL[^_]Ív,"Eĉ}t&("tcFU("K,"Mąt>;:v ;:w JRuV1tEċ}E+@G}EẺD$P}EEEEE$ #E܅EEЋU EԉBE؉BfU(uEu ] }FEFEFFfNF t2"<$("F("<$]u}]Ë("F("⍶'UE D$ D$D$E$8ÍUS'W $¸D$E$[]Í'U(E] uu }tu]u}]ÐUVUF FfFVt'"<$("F("<$럋("F("뎍t&UE D$ D$D$E$8ÍUuu] <t$褷4$D$]u]ÐUWVS\}t \[^_]ÐE u\[^_]Ðt&E$t݋UEtU$EMЀMp Ett&fEPX }q+f)Et }E؄҉Ey Eč&?wt x11ɈUЃ DŽxM<>}̉ $虱;ủEEǃEpE}t/ 6unE&vuE} wPU+f ht&tvv@Pp0vu$E}Pul t uE}PuL} zM؉+P^tU}y}ZuE끐t&M $UBUE]$Et&뎐EEt`EE}yM M} tvjfE}Pu} JM؉+6E܋M܅t!EE܀}y M܋ M܍t&xU9UU9U9u11ɉ}׍&‰E܃ DŽx}=E@3 %11ɉ}܉אЃ DŽx}MSMFE8E1ɉU} ExU}@ EM}11EU&Ѓ DŽx}U}EM/}11EUЃ DŽx}܋U}EMEE1ɉU}t& E܄xU}@ EvMi311ɉƈUt&Ѓ ƄxU11ɉƈU̍v‰E ƄxUE@ &@P&0$UUE vuE5@P0vj$U蛫UE$蔫Emt&Et&}@}P|}0E$U4UE_$U)UE=$UUEEt&MԉM_$U親UE v$U詪UEMԉMt&MM=t&EM $U7UErM܉ME܅uuED$D$E$?D$D$U$$t$M $襩jU8UWVSDt $@H Re }5e EE~NkLe t1t&q;r;s@EĉE[ uӃmLEąkEL1e uċ} uE$&|$D$(4$Uuj[ tc\e EE̋CUEЋPEXfEءXe E+EUȉE䋃DUEt$wE농Ǹt $@H !D[^_]Í&؉MD$Mt&UHe uu }}]tV|e 1fE؋ e Xe EUԋ\e E3 E)ȉEẺUډUt$D$($ׅu t$<$]u}]ÍvUt E@H ]G]ÐU@ UVSt f t$D$X $DӉT$ ՐUStA ttA fЋu[]ÐUT S t1fPdT$@`$ T @\T uUWVS1ۃe= t @Z uR`Z ؋`Z Qf e= t-@Z u+uڋ$u[^_]Í @Z 롍@Z @UWVS}_ W11fH~,@ t% e3$E}Wډ$EЋW<9w wB $dW Gkt&E$Et&UVSHf tD$$@f tDCtCt"Cs8/u$萰tt&Cs8/tu_ tD$0G $N[^]UTf t= t$2U _ u _ t_ $T$eÍv_ $U_ D$@L $_ É'US]Ct$wz][]隯UWVSÃ9ʋ4`f tC t@  I tЃI = t$@I  u 2&ދF9t tF^ $ 4$uՃ[^_]Ðt&Ut e x1te 1 t e t e t e xt e xgt e x>t e xt e x t e x t e` x t e x q8J = t$8J   UWVS5` tSt&F>$覬t&tDPtҋD$ ~ډ4$rt벡` ` tQ ` ` D$` $` u%vCs D$$r$ uރ[^_]USf t=&f C= t$迫C$贫$謫f uʡTJ =Al t$莫a D$$ia a t$a Pa u[]UVS@a u+t&Ct*s $ $uك[^]UWVS @`=q tvWU܉ $UʤUBW t1z v9u| t1MЋŰE؉$UĉMxE܋MU@E@E܋E܋EUEE@ MԋẺUЋM؋U܍v9| t1o UVSe te 1u}L95e we CtDt8S t r 1t$t u9w$艣Ce e $k[^]ËCP;He q De $:Te Ut@1e= t Y u'Y DY e= t-Y u]Í Y ̍Y US[h (Y[reged version 0.1 110511, (c) Petter N Hagen Modes: -x Xport. Where for example is HKEY_LOCAL_MACHINE\SOFTWARE is key to dump (recursively), \ or \\ means all keys in hive Only one .reg and one hive file supported at the same time -I Import from .reg file. Where for example is HKEY_LOCAL_MACHINE\SOFTWARE Only one .reg and one hive file supported at the same time -e ... Interactive edit one or more of registry files Options: -L : Log changed filenames to /tmp/changed, also auto-saves -C : Auto-save (commit) changed hives without asking -N : No allocate mode, only allow edit of existing values with same size -E : No expand mode, do not expand hive file (safe mode) -t : Debug trace of allocated blocks -v : Some more verbose messagesvhtxCLeINEImport and export cannot be done at same time hivename: %s, prefix: %s, key: %s, output: %s Unable to open/read hive %s, exiting.. hivename: %s, prefix: %s Unable to open/read a hive, exiting.. Hives that have changed: # Name%2d <%s> WARNING: File was expanded! Experimental! Use at own risk!Commit changes to registry? (y/n) [n] : w/tmp/changed%2d <%s> - OK %s Not written! None! ւ''''̂'''''''''''''''''''''''''''''''''''''' ''‚ntreg lib routines, v0.95 110511, (c) Petter N HagenREG_NONEREG_SZREG_EXPAND_SZREG_BINARYREG_DWORDREG_DWORD_BIG_ENDIANREG_LINKREG_MULTI_SZREG_RESOUCE_LISTREG_FULL_RES_DESCREG_RES_REQREG_QWORD  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~malloc failure%s%02x :%05X %02X %xBuffer debugger. '?' for help..Buffer has not changed, no need to write..from: %x, to: %x, wlen: %d %06x from: %x, wlen: %d d [] [] - dump buffer within rangea [] [] - same as d, but without ascii-part (for cut'n'paste): [ ...] - change bytesh [ ...] - hunt (search) for bytesha [ etc. you may give 'string to enter/search a string?m__________________________________________L________(_2== nk at offset %0x ROOT_KEY%04x type = 0x%02x %s %04x timestamp skipped %04x parent key offset = 0x%0x %04x number of subkeys = %d %04x lf-record offset = 0x%0x %04x number of values = %d %04x val-list offset = 0x%0x %04x sk-record offset = 0x%0x %04x classname offset = 0x%0x %04x dummy3 = 0x%0x (%d) %04x dummy4 = 0x%0x (%d) %04x dummy5 = 0x%0x (%d) %04x dummy6 = 0x%0x (%d) %04x dummy7 = 0x%0x (%d) %04x name length = %d %04x classname length = %d %04x Key name: <> == End of key info.== vk at offset %0x %04x name length = %d (0x%0x) %04x length of data = %d (0x%0x) %04x data offset = 0x%0x (unknown)%04x value type = 0x%0x %s %04x flag = 0x%0x %04x *unused?* = 0x%0x == sk at offset %0x %04x *unused?* = %d %04x Offset to prev sk = 0x%0x %04x Offset to next sk = 0x%0x %04x Usage counter = %d (0x%0x) %04x Security data len = %d (0x%0x) == End of key info.== lf at offset %0x %04x number of keys = %d %04x %3d Offset: 0x%0x - <%c%c%c%c> == lh at offset %0x %04x %3d Offset: 0x%0x - == li at offset %0x %04x %3d Offset: 0x%0x == ri at offset %0x %04x number of subindices = %d == db at offset %0x %04x number of parts = %d %04x Data list at offset: 0x%0x parse_block: FATAL! Zero data block size! (not registry or corrupt file?)USED BLOCK @ %06x to %06x : %d, 0x%0x FREE BLOCK @ %06x to %06x : %d, 0x%0x value data, or not handeled yet!find_page_start: zero len or ofs_next found in page at 0x%x find_free_blk: FATAL! Zero data block size! (not registry or corrupt file?) : Block at offset %0x find_free_blk: at exact end of hbin, do not care..find_free: zero len or ofs_next found in page at 0x%x ERROR: Registry hive <%s> need to be expanded, but that is not allowed according to selected options. Operations will fail. add_bin: request size = %d [%x], rounded to %d [%x] add_bin: old buffer size = %d [%x] add_bin: firs nonbin off = %d [%x] add_bin: free at end = %d [%x] add_bin: new buffer size = %d [%x] add_bin : realloc() add_bin: adjusting size field in REGF: %d [%x] ERROR: alloc_block: Hive <%s> is in no allocation safe mode,new space not allocated. Operation will fail! alloc_block: failed to alloc %d bytes, trying to expand hive.. free_block: ERROR: Hive %s is in no allocation safe mode,space not freed. Operation will fail! free_block: trying to free already free block!blk = %x free_block: EEEK! Zero data block size! (not registry or corrupt file?)free_block: ran off end of page!?!? Error in chains?vofs = %x, pofs = %x, blk = %x ex_next error: Not a 'nk' node at 0x%0x ex_next: ERROR: not 'nk' node at 0x%0x ex_next: nk at 0x%0x has no name! ex_next_v error: Not a 'nk' node at 0x%0x ex_next_v: hit non valuekey (vk) node during scan at offs 0x%0x get_abs_path: Not a 'nk' node!(...)%strav_path: Error: Not a 'nk' node!..ERROR: not 'nk' node! (strange?)[No name]nk_ls: Key <%s> not found ls of node at offset 0x%0x Error: Not a 'nk' node!Node has %d subkeys and %d values, and class-data of %d bytes key name%c <%s> [%6x] %c <%s> size type value name [value if type DWORD][%6x] %6d %-16s <%s>%6d %-16s <%s> %*d [0x%x]get_val_data: %s not found Value <%s> is not of correct type! get_val2buf: Long value: parts = %d, list = %x get_val2buf: Datablock %d offset %x, size %x (%d) : Point = %x, restlen = %x, copylen = %x fill_block: ERROR: block to small for data: ofs = %x, size = %x, blksize = %x free_val_data: Long value: parts = %d, list = %x free_val_data: Freeing long datablock %d offset %x, size %x (%d) free_val_data: Freeing indirect list at %x free_val_data: Freeing db structure at %x alloc_val_data: doing large key: size = %x (%d), parts = %d alloc_val_data: dbofs = %x, listofs = %x alloc_val_data: block # %d, blockofs = %x add_value: Key pointer not to 'nk' node!add_value: value %s already exists @add_value: failed to allocate new value list!add_value: failed to allocate value descriptordel_vk: Key pointer not to 'vk' node!del_allvalues: Key pointer not to 'nk' node!del_value: Key pointer not to 'nk' node!del_value: Key has no values!del_value: value %s not found! del_value: FATAL: Was not able to alloc new index listadd_key: current ptr not 'nk'add_key: index type not supported: 0x%04x add_key: cmp <%s> with <%s> add_key: key %s already exists! add_key: unable to allocate space for new key descriptor for %s! add_key: unable to allocate space for new index table for %s! add_key: current ptr not nkdel_key: key has no subkeys!del_key: index other than 'lf', 'li' or 'lh' not supported yet. 0x%04x del_key: subkey %s not found! del_key: subkey %s has subkeys or values. Not deleted. del_key: WARNING: unable to allocate space for new key descriptor for %s! Not deleted del_key: ERROR: newlfofs = %x del_key: need to delete ri-slot %d for %x - %s del_key: WARNING: unable to allocate space for ri-index for %s! Not deleted del_key: .. and that was the last one. key now empty!rdel_keys: Key <%s> not found get_class: Key <%s> not found get_class: Key has no class data.put_buf2val: %s : alloc_val_data failed! put_buf2val: %s : get_val_data failed! put_buf2val: Long value: parts = %d, list = %x put_buf2val: Datablock %d offset %x, size %x (%d) hex:hex(%x):%02x,\ %02x export_subkey: Key '%s' not found! Exporting key '%.*s' with %d subkeys and %d values... [%s%s] @="%s"=dword:%08x "%s"wexport: Cannot open file '%s'. %s (%d). Exporting to file '%s'... Windows Registry Editor Version 5.00 get_line: WARNING: un-terminated key line..dworddword:%xhex%hhxparse_values: hex string parse error: %s rimport_reg: Cannot open file '%s'. %s (%d). import_reg: WARNING: Wide character (16 bit) file.. import_reg: WARNING: Implementation is not 100%% accurate, some things may not import correctly! Windows Registry Editorimport_reg: ERROR: Windows Registry Editor signature missing on first line import_reg: realloc(valstr) Value <%s> of type %d length %d [CREATED]ERROR: import_reg: unable to change value <%s>, new type is %d while old is %d import_reg: WARNING: found key <%s> not matching prefix <%s> --- END of key, with %d values with %d values. --- Import KEY <%s> \ ERROR: import_reg: failed to add (sub)key <%s> [added <%s>] FAILEDSUCCEEDED END OF IMPORT, file <%s>, operation %s! %d keys %d new keys added %d values total writeHive: open(%s) failed: %s, FILE NOT WRITTEN! writeHive: write of %s failed: %s. openHive(%s) failed: %s, trying read-only openHive(%s) in fallback RO-mode failed: %s stat()Could not read file, got %d bytes while expecting %d openHive(%s): File does not seem to be a registry hive! openHive(%s): WARNING: REGF header checksum mismatch! calc: 0x%08x != file: 0x%08x Hive <%s> name (from header): <> ROOT KEY at offset: 0x%06x * openHive: DEBUG: BIG ROOT!Subkey indexing type is: %04x <%c%c> openHive: WARNING: ROOT key does not seem to be a key! (not type == nk) Page at 0x%x is not 'hbin', assuming file contains garbage at end ###### Page at 0x%0x ofs_self 0x%0x, size (delta ofs_next) 0x%0x ###### openHive: ERROR: Page at 0x%x has size zero! File may be corrupt, or program has a bug Last HBIN at offset : 0x%x First non-HBIN page offset: 0x%x hdr->unknown4 (version?) : 0x%x File size %d [%x] bytes, containing %d pages (+ 1 headerpage) Used for data: %d/%d blocks/bytes, unused: %d/%d blocks/bytes. \SAM\ControlSet\Policy\MicrosoftType of hive guessed to be: %d edlib version 0.1 110511, (c) Petter N Hagencat_dpi: No such value <%s> cat_dpi: Value <%s> is too short for decoding cat_dpi: Value <%s> references NULL-pointer (bad boy!) Only binary values(unknown)Value <%s> of type %s, data length %d [0x%x] Decoded product ID: [%s] cat_vk: No such value <%s> cat_vk: Value <%s> has zero length cat_vk: Value <%s> could not fetch data 0x%08xDon't know how to handle type yet!Value <%s> not found! Unable to get data of value <%s> EDIT: <%s> of type %s with length %d [0x%x] DWORD: Old value %d [0x%x], enter new value (prepend 0x if hex, empty to keep old value) -> %iDWORD: New value %d [0x%x], [%2d]: %s Now enter new strings, one by one.Enter nothing to keep old.'--n' to quit (remove rest of strings)'--i' insert new string at this point'--q' to quit (leaving remaining strings as is)'--Q' to quit and discard all changes'--e' for empty string in this position[NEW][INSERT]-> --q--n--Q--i--emalloc failurenewkv->len: %d Type not handeled (yet), invoking hex editor on data!New length (ENTER to keep same): Failed to set value!? Command syntax is: nv where should be the HEX NUMBER from one of these registry value types: %2x : %s Example: nv 4 foobarto make a new value named foobar of the type REG_DWORD Simple registry editor. ? for help. [%0x] %s> %s> Simple registry editor:hive [] - list loaded hives or switch to hive numer ncd - change current keyls | dir [] - show subkeys & values,cat | type - show key valuedpi - show decoded DigitalProductId valuehex - hexdump of value datack [] - Show keys class data, if it has anynk - add keydk - delete key (must be empty)ed - Edit valuenv - Add valuedv - Delete valuedelallv - Delete all values in current keyrdel - Recursively delete key & subkeysek - export key to (Windows .reg file format)debug - enter buffer hexeditorst [] - debug function: show struct infoq - quitSwitching to hive #%d, named <%s>, size %d [0x%x] %c %c %2d %9d 0x%08x <%s> Key %s not found! Unknown command: %s, type ? for help b#y # "3#,!b#b#Vt!3!FATAL: kernel too old FATAL: cannot determine kernel version /dev/null/dev/fullset_thread_area failed when setting up thread-local storage unexpected reloc type in static binaryUUUU?3333*$I$qtEUUU;$I8^Cy 0 ,d! p= ^B{ I$ B|uPq  w+0\S0Z@pN}[ut@j`uu0\L0Z@pN~[ut@juu0\L0Z@pN~[ut@j`uu `b `АP0`Ў`LIBC_FATAL_STDERR_/dev/tty======= Backtrace: ========= ======= Memory map: ======== /proc/self/maps,ccs=0 v Ps@p0x}Ѐut@j`uu0o Psng~iut@juu0pl Ps lPi~Ѐut@j`uu p `АP0`Ў`corrupted double-linked listTOP_PAD_PERTURB_MMAP_MAX_ARENA_MAXARENA_TESTTRIM_THRESHOLD_MMAP_THRESHOLD_ Arena %d: system bytes = %10u in use bytes = %10u Total (incl. mmap): max mmap regions = %10u max mmap bytes = %10lu free(): invalid sizefree(): invalid pointermalloc(): memory corruptionrealloc(): invalid old sizerealloc(): invalid next sizerealloc(): invalid pointermalloc: top chunk is corrupt*** glibc detected *** %s: %s: 0x%s *** munmap_chunk(): invalid pointer free(): invalid next size (normal)free(): invalid next size (fast)double free or corruption (top)double free or corruption (out)double free or corruption (!prev)free(): corrupted unsorted chunksdouble free or corruption (fasttop)malloc(): memory corruption (fast)malloc(): smallbin double linked list corruptedmalloc(): corrupted unsorted chunksmalloc(): corrupted unsorted chunks 2break adjusted to free malloc spaceȸhx(H`л|xhx(HhUnknown errorUnknown error uhgہZÝLK>ր=0Ȁ/"!ANSI_X3.4-1968//TRANSLIT ` Ԛ ] p] Ԛ PPOSIXLY_CORRECT--%s: option '%s' is ambiguous %s: invalid option -- '%c' %s: option '--%s' doesn't allow an argument %s: option '%c%s' doesn't allow an argument %s: option '%s' requires an argument %s: unrecognized option '--%s' %s: unrecognized option '%c%s' %s: option requires an argument -- '%c' %s: option '-W %s' is ambiguous %s: option '-W %s' doesn't allow an argument /dev/log<%d>%h %e %T [%d]/dev/console%s syslog: unknown facility/priority: %xrc/proc/meminfoMemFree: %ld kBMemTotal: %ld kB/proc/stat/proc/cpuinfoprocessor/sys/devices/system/cpu(+0x-0x[0xf8df0d8d8d8d8deeee8d`eHe8d8d8d8d8d e8de8d8d8d8d8d8ddd/var/tmp/var/profilefpuvmedepsetscmsrpaemcecx8apic10sepmtrrpgemcacmovpatpse36pnclflush20dtsacpimmxfxsrssesse2sshttmia64pbei386i486i586i686GCONV_PATHGETCONF_DIRHOSTALIASESLD_AUDITLD_DEBUGLD_DEBUG_OUTPUTLD_DYNAMIC_WEAKLD_LIBRARY_PATHLD_ORIGIN_PATHLD_PRELOADLD_PROFILELD_SHOW_AUXVLD_USE_LOAD_BIASLOCALDOMAINLOCPATHMALLOC_TRACENIS_PATHNLSPATHRESOLV_HOST_CONFRES_OPTIONSTMPDIRTZDIRLD_AOUT_LIBRARY_PATHLD_AOUT_PRELOADLD_WARNLD_LIBRARY_PATHLD_BIND_NOWLD_BIND_NOTLD_DYNAMIC_WEAKLD_PROFILE_OUTPUT/etc/suid-debugMALLOC_CHECK_i586LD_ASSUME_KERNEL/proc/sys/kernel/osreleasealiasmoduleISO-10646/UCS4/=INTERNAL->ucs4=ucs4->INTERNALUCS-4LE//=INTERNAL->ucs4le=ucs4le->INTERNALISO-10646/UTF8/=INTERNAL->utf8=utf8->INTERNALISO-10646/UCS2/=ucs2->INTERNAL=INTERNAL->ucs2ANSI_X3.4-1968//=ascii->INTERNAL=INTERNAL->asciiUNICODEBIG//=ucs2reverse->INTERNAL=INTERNAL->ucs2reverse.soUCS4//ISO-10646/UCS4/UCS-4//ISO-10646/UCS4/UCS-4BE//ISO-10646/UCS4/CSUCS4//ISO-10646/UCS4/ISO-10646//ISO-10646/UCS4/10646-1:1993//ISO-10646/UCS4/10646-1:1993/UCS4/ISO-10646/UCS4/OSF00010104//ISO-10646/UCS4/OSF00010105//ISO-10646/UCS4/OSF00010106//ISO-10646/UCS4/WCHAR_T//INTERNALUTF8//ISO-10646/UTF8/UTF-8//ISO-10646/UTF8/ISO-IR-193//ISO-10646/UTF8/OSF05010001//ISO-10646/UTF8/ISO-10646/UTF-8/ISO-10646/UTF8/UCS2//ISO-10646/UCS2/UCS-2//ISO-10646/UCS2/OSF00010100//ISO-10646/UCS2/OSF00010101//ISO-10646/UCS2/OSF00010102//ISO-10646/UCS2/ANSI_X3.4//ANSI_X3.4-1968//ISO-IR-6//ANSI_X3.4-1968//ANSI_X3.4-1986//ANSI_X3.4-1968//ISO_646.IRV:1991//ANSI_X3.4-1968//ASCII//ANSI_X3.4-1968//ISO646-US//ANSI_X3.4-1968//US-ASCII//ANSI_X3.4-1968//US//ANSI_X3.4-1968//IBM367//ANSI_X3.4-1968//CP367//ANSI_X3.4-1968//CSASCII//ANSI_X3.4-1968//OSF00010020//ANSI_X3.4-1968//UNICODELITTLE//ISO-10646/UCS2/UCS-2LE//ISO-10646/UCS2/UCS-2BE//UNICODEBIG//ȡ ء  0 & 6 PV f  p P  ͢ `GCONV_PATH/usr/lib/gconv/gconv-modules.cachegconvgconv_initgconv_endLOCPATHLC_COLLATELC_CTYPELC_MONETARYLC_NUMERICLC_TIMELC_MESSAGESLC_PAPERLC_NAMELC_ADDRESSLC_TELEPHONELC_MEASUREMENTLC_IDENTIFICATION +3?HP[hw   pLC_ALLLANG/usr/share/locale          `  n- Vo.       ̮ خ  4 H `   /usr/share/locale/locale-archive     `     `  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~  !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~   ~~~~>>xx(( 8HHHHHIupperloweralphadigitxdigitspaceprintgraphblankcntrlpunctalnumtouppertolower V    <   Sk   HT  t д  j } j `k j j 8y k k k k  k (k 0k 8k   t д  j } j `k j 0123456789I `   @k  `     @   `   `    "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~   "$&(*,.02468:<>@BDFHJLNPRTVXZ\^`bdfhjlnprtvxz|~              " $ & ( * , . 0 2 4 6 8 : < > @ B D F H J L N P R T V X Z \ ^ ` b d f h j l n p r t v x z | ~              " $ & ( * , . 0 2 4 6 8 : < > @ B D F H J L N P R T V X Z \ ^ ` b d f h j l n p r t v x z | ~ 23IRRSS                    " $ % & / 5 6 7 9 : < D G H I _ ` a b c !!!!! ! ! ! !!!!!!!!!!!!!!!"!$!&!(!,!-!.!/!0!1!3!4!9!E!F!G!H!I!S!T!U!V!W!X!Y!Z![!\!]!^!_!`!a!b!c!d!e!f!g!h!i!j!k!l!m!n!o!p!q!r!s!t!u!v!w!x!y!z!{!|!}!~!!!!!!!!""""#"6"<"d"e"j"k"""$$$$$$$$$ $ $ $ $ $$$$$$$$$$$$$$$$$$$ $!$#$$$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$t$u$v$w$x$y$z${$|$}$~$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$%% %%%%%$%,%4%<%%t*u*v*00Q2R2S2T2U2V2W2X2Y2Z2[2\2]2^2_2222222222222222q3r3s3t3u3v333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333) MNOPRTUVWYZ[\_`abcdefhijk  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~    !"#$%&'()*+,-./0123456789;<=>@ABCDFJKLMNOPRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ %,37:>BFJNRVZ^aeimquy} !#%).38;@EHKNQTWZ]`cgjmpsv{ "&+158<ADGJMPTY]`diosvz !&+05:?DIMRW[_cgkpsw| %+17=CIOUY]aeimquy~ #(-27<AFKPUZ_dinsx} "',16;>ADGJMPSVY\_dhmpsy !',049=AEIMQUY]aflptx| &*.26:>BFJNRVZ^bflptx~              ! $ ' * - 0 3 6 9 < ? B E H K N Q T W Z ] ` c f i k n q t w z }          " % ( + . 1 4 7 : = @ C F I L O R U X [ ^ a d g j m p s v y |          ! $ ' * - 0 3 6 9 < ? B E H K N Q T W Z ] ` c f i l o r u x { ~          # & ) , / 2 5 8 ; > A D G J M P S V Y \ _ b e h k n q t w z }          " % ( + . 1 4 7 : = @ C F I L O R U X [ ^ a d g j m p s v y |    !$'*-0369<?BEHKNQTWZ]`cfilorux{~  #&),/258;>ADGJMPSVY\_behknqtwz}  "%(+.147:=@CFILORUX[^adgjmpsvy|  !$'*-0369<?BEHKNQTWZ]`cfilorux{~  #&),/258;>ADGJMPSVY\_behknqtwz} (C)<<-(R)u,>> 1/4 1/2 3/4 AExssaeIJij'nOEOEoeoesLJLjljNJNjnjDZDzdz'^'`_:~ -------'','"",,"+o...... ``````<>!!/???!!? RsEURa/ca/sCc/oc/ugHHHhIILlNNoPQRRRTEL(TM)ZOhmZBCeeEFMoiDdeij 1/3 2/3 1/5 2/5 3/5 4/5 1/6 5/6 1/8 3/8 5/8 7/8 1/IIIIIIIVVVIVIIVIIIIXXXIXIILCDMiiiiiiivvviviiviiiixxxixiilcdm<--><-><==><=>-/\*|:~<=>=<<>><<<>>>NULSOHSTXETXEOTENQACKBELBSHTLFVTFFCRSOSIDLEDC1DC2DC3DC4NAKSYNETBCANEMSUBESCFSGSRSUSSPDEL_NL(1)(2)(3)(4)(5)(6)(7)(8)(9)(10)(11)(12)(13)(14)(15)(16)(17)(18)(19)(20)(1)(2)(3)(4)(5)(6)(7)(8)(9)(10)(11)(12)(13)(14)(15)(16)(17)(18)(19)(20)1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)(s)(t)(u)(v)(w)(x)(y)(z)(A)(B)(C)(D)(E)(F)(G)(H)(I)(J)(K)(L)(M)(N)(O)(P)(Q)(R)(S)(T)(U)(V)(W)(X)(Y)(Z)(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)(s)(t)(u)(v)(w)(x)(y)(z)(0)-|+++++++++o::====== =(21)(22)(23)(24)(25)(26)(27)(28)(29)(30)(31)(32)(33)(34)(35)(36)(37)(38)(39)(40)(41)(42)(43)(44)(45)(46)(47)(48)(49)(50)hPadaAUbaroVpcpAnAuAmAkAKBMBGBcalkcalpFnFuFugmgkgHzkHzMHzGHzTHzulmldlklfmnmummmcmkmmm^2cm^2m^2km^2mm^3cm^3m^3km^3m/sm/s^2PakPaMPaGParadrad/srad/s^2psnsusmspVnVuVmVkVMVpWnWuWmWkWMWa.m.BqcccdC/kgCo.dBGyhaHPinKKKMktlmlnloglxmbmilmolPHp.m.PPMPRsrSvWbfffiflffifflst+___,.;:?!(){}#&*+-<>=\$%@!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzACDGJKNOPQSTUVWXYZabcdfhijkmnpqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABDEFGJKLMNOPQSTUVWXYabcdefghijklmnopqrstuvwxyzABDEFGIJKLMOSTUVWXYabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890123456789012345678901234567890123456789579023456789?libcPOSIXANSI_X3.4-1968          `                  ~qdWJOUTPUT_CHARSETcharset=LANGUAGEmessageslldllillollullxllXI1e5=554A3A3A3A34444633333333363333333333333333333333533355355[663637/7/7/7/7/7/7/7/7/7/75666'653333333333333333333333333333333333333333333333533333333333335" '+"5                        plural=nplurals= q q @ sH  u @  ʚ; +m!0W˜qEu}${fG5@KLnZkᬔgd QJ@iIHt#@s+A;4@ > > > > > > > > > > > > > > > > > > > > > > > > > >H >.D >HHH > > > > > > > > > > >yB > > > >B > >)F > > > > >H >!D@HHH >2H > > > >GGB > >lB > @ > >BSuccessOperation not permittedNo such file or directoryNo such processInterrupted system callInput/output errorNo such device or addressArgument list too longExec format errorBad file descriptorNo child processesCannot allocate memoryPermission deniedBad addressBlock device requiredDevice or resource busyFile existsInvalid cross-device linkNo such deviceNot a directoryIs a directoryInvalid argumentToo many open files in systemToo many open filesText file busyFile too largeNo space left on deviceIllegal seekRead-only file systemToo many linksBroken pipeNumerical result out of rangeResource deadlock avoidedFile name too longNo locks availableFunction not implementedDirectory not emptyNo message of desired typeIdentifier removedChannel number out of rangeLevel 2 not synchronizedLevel 3 haltedLevel 3 resetLink number out of rangeProtocol driver not attachedNo CSI structure availableLevel 2 haltedInvalid exchangeInvalid request descriptorExchange fullNo anodeInvalid request codeInvalid slotBad font file formatDevice not a streamNo data availableTimer expiredOut of streams resourcesMachine is not on the networkPackage not installedObject is remoteLink has been severedAdvertise errorSrmount errorCommunication error on sendProtocol errorMultihop attemptedRFS specific errorBad messageName not unique on networkFile descriptor in bad stateRemote address changedStreams pipe errorToo many usersDestination address requiredMessage too longProtocol not availableProtocol not supportedSocket type not supportedOperation not supportedProtocol family not supportedAddress already in useNetwork is downNetwork is unreachableConnection reset by peerNo buffer space availableConnection timed outConnection refusedHost is downNo route to hostOperation already in progressOperation now in progressStale NFS file handleStructure needs cleaningNot a XENIX named type fileNo XENIX semaphores availableIs a named type fileRemote I/O errorDisk quota exceededNo medium foundWrong medium typeOperation canceledRequired key not availableKey has expiredKey has been revokedKey was rejected by serviceOwner diedState not recoverableResource temporarily unavailableInappropriate ioctl for deviceNumerical argument out of domainToo many levels of symbolic linksValue too large for defined data typeCan not access a needed shared libraryAccessing a corrupted shared library.lib section in a.out corruptedAttempting to link in too many shared librariesCannot exec a shared library directlyInvalid or incomplete multibyte or wide characterInterrupted system call should be restartedSocket operation on non-socketProtocol wrong type for socketAddress family not supported by protocolCannot assign requested addressNetwork dropped connection on resetSoftware caused connection abortTransport endpoint is already connectedTransport endpoint is not connectedCannot send after transport endpoint shutdownToo many references: cannot splice     . A [ r     € Ԁ     4 C S b s     Á ہ    Ȉ  7 Q d w     ҂    $ = Z u     ǃ ܃    $ 2 K i     Ą      ! < Y 8 `   ؉  4 p  `     ׅ     > ̊ U e   |  4 \    Ć ׆    - C \ x    Ї     0 E a l  ϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗϗȘxxxxx؛xxxXhPPPPPPPPPPPPPPPPPPPPPPPPPPPȚPؚPPPPPPPPPPP؞0Xp؞00؟PPȟPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPhHHHHH8HHHءȡ 0000000000000000 000000000000000000`p` p `АP0Ў`xhXH8(%[A-Za-z]%n%hu%n:%hu%n:%hu%nM%hu.%hu.%hu%nTZ/etc/localtimeUniversalUTCGMT../TZDIRTZifposixrules/usr/share/zoneinfo%H:%M:%S%H:%M%m/%d/%y%Y-%m-%d%I:%M:%S %pZ                                                                  p #              o  | _       o W       t   n I      ~   e            ' a GETCONF_DIR/usr/libexec/getconf/proc/sys/kernel/ngroups_maxLP64_OFF64LPBIG_OFFBIG/proc/sys/kernel/rtsig-max. 1 1 1 1 1 0 .0 .0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 . . 0 80 . 0 0 1 E0 . 80 . . 0 Y0 0 1 0 . E0 Y0 e0 Y0 0 0 0 . . 0 0 . . . . . . . O0 . . . . . . 0 0 O0 O0 1 E0 0 O0 U1 . 0 0 0 0 0 0 1 e1 %1 E1 80 51 0 0 .0 .0 .0 .0 0 . . .0 .0 .0 0 o0 y0 80 1 E0 E0 1 0 e0 o0 y0 e0 1 0 . . 0 0 Y0 80 80 80 80 .0 .0 0 0 .0 .0 .0 0 0 . . . 0 . . . . . . . . . . . . . . . 0 0 .0 . .0 . 0 . . . . 0 . . . . . . . . . . . .0 .0 0 0 u1 . . . . 1 1 1 1 1 1 1 1 1 1 1 1 1 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 0 .0 .0 0 0 . . . . . . cannot create cache for search pathELF file data encoding not little-endianELF file version ident does not match current oneELF file version does not match current oneonly ET_DYN and ET_EXEC can be loadedELF file's phentsize not the expected sizefile=%s [%lu]; generating link map cannot create shared object descriptorELF load command address/offset not properly alignedcannot dynamically load executablecannot change memory protectionsELF load command alignment not page-alignedcannot allocate TLS data structures for initial threadobject file has no loadable segmentsfailed to map segment from shared objectobject file has no dynamic sectionshared object cannot be dlopen()edcannot allocate memory for program headercannot enable executable stack as shared object requires dynamic: 0x%0*lx base: 0x%0*lx size: 0x%0*Zx entry: 0x%0*lx phdr: 0x%0*lx phnum: %*u cannot create search path arraycannot create RUNPATH/RPATH copy file=%s [%lu]; needed by %s [%lu] find library=%s [%lu]; searching cannot open shared object filecannot allocate name record search path=:%s (%s from file %s) (%s) cannot read file datafile too shortinvalid ELF headerELF file OS ABI invalidinternal errorELF file ABI version invalid trying file=%s cannot stat shared objectcannot map zero-fill pagescannot close file descriptorsystem search path:;ORIGINPLATFORMLIBlib:RPATHRUNPATHwrong ELF class: ELFCLASS64/lib//usr/lib/ GNUELFELF/etc/ld.so.cache search cache=%s ld.so-1.7.0glibc-ld.so.cache1.1symbol=%s; lookup in file=%s [%lu] file=%s [%lu]; needed by %s [%lu] (relocation dependency) binding file %s [%lu] to %s [%lu]: %s symbol `%s'out of memory (no version symbols)symbol , version not defined in file with link time reference
relocation errorsymbol lookup errornormalprotected [%s] undefined symbol: cannot allocate memory in static TLS blockcannot make segment writable for relocation%s: Symbol `%s' has different size in shared object, consider re-linking %s: no PLTREL found in object %s %s: out of memory to store relocation results for %s cannot restore segment prot after reloc (lazy) relocation processing: %s%s D   D D Q Н Н D D D D D D  D D D D D D D D D D D D D D D D D D D D p H  D D D М   ֠ ɠ                                 | d ?      j , 9 j j  , , j j j j j j  j j j j j j j j j j j j j j j j j j j j  ϥ  j j j u g      v         )                       צ      unexpected reloc type 0xunexpected PLT reloc type 0xcannot apply additional memory protection after relocationDYNAMIC LINKER BUG!!!%s: %s: %s%s%s%s%s fatalcontinued%s: error: %s: %s (%s) out of memoryerror while loading shared libraries =???dlopencannot create TLS data structures/proc/self/exeGLIBC_PRIVATE_dl_open_hookIGNORE] gconv_trans_contextgconv_transgconv_trans_initgconv_trans_end^[yY]^[nN]   3 3 Sk  .3 3 3 3 3 3 3                3 3               u'u'Sk .  3 3 .Sk SunMonTueWedThuFriSatSundayMondayTuesdayWednesdayThursdayFridaySaturdayJanFebMarAprMayJunJulAugSepOctNovDecJanuaryFebruaryMarchAprilJuneJulyAugustSeptemberOctoberNovemberDecemberAMPM%a %b %e %H:%M:%S %Y%a %b %e %H:%M:%S %Z %YSunMonTueWedThuFriSatSundayMondayTuesdayWednesdayThursdayFridaySaturdayJanFebMarAprMayJunJulAugSepOctNovDecJanuaryFebruaryMarchAprilJuneJulyAugustSeptemberOctoberNovemberDecemberAMPM%a %b %e %H:%M:%S %Y%m/%d/%y%H:%M:%S%I:%M:%S %p%a %b %e %H:%M:%S %Z %Y o< @ D H L P T X _ f n x                ɫ ҫ ث  ޫ          B 3 T 3 3 3 3 3 3 3 P ` p      ܬ   @ d    ĭ ԭ     $ 4 D T d     خ    D d    į  < ` Ty Ty Ty Ty Ty . :00 2 4 2 3 6  Sk  )Sk %p%t%g%t%m%t%f  3 3 3 3 3 Sk %a%N%f%N%d%N%b%N%s %h %e %r%N%C-%z %T%N%c%N  ` 3 3 3 3 3 3 3 3 3 3 3 Sk +%c %a %l  3 3 3 Sk  2 Sk ISO/IEC 14652 i18n FDCC-setKeld Simonsenkeld@dkuug.dk+45 3122-6543+45 3325-6543ISO1.01997-12-20ISO/IEC JTC1/SC22/WG20 - internationalizationC/o Keld Simonsen, Skt. Jorgens Alle 8, DK-1615 Kobenhavn Vi18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999i18n:1999   $   Ĵ Ҵ 3  3 3 3   ` Sk    Sk   !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~UUUUUUUU?33333333*$I$I$qqqE]tEUUUUUUU;;I$I$I8885P^Cy 0 0 0 袋. ,d! p= ףp= ؉؉ %^B{ $I$I$ =B!B|PuPuPqqinity d'@Bʚ; d'o#ſt[Am-jd8n헧?O>. 8/t#ڰͼ3&N|.[Ӿr؇/PkpnJؕnq&fƭ$6ZB<TcsUe(U܀n_SlgrwFo]:FGWvyuD;s(!>p%"/.Q]OᖬW2Sq$^c_䭫*sf\wI[iCsFEHis 84c)r+[[!|nN5 }L,D4fl}C}Ο+#U>#`e!Q4\Ycɟ+1*ZibBtz["؊4س?ŏmk1Ke6ukG܉ـ( f13j~{j6h߸\A)\='_Djzp؊4|ElݾV}*@|gu "Ωo$po?b(UxI>Nkw};u  #6'0q'"(\؄t.z-TMеub <4 9Ԣ7.~2!'{n $-PԓX+1"#+%? D~br*~xxކzos{'~j=jr1|òAv09&Ѷ~j2=_+0cm-X%<|b 7w ʐ,5P6xPnx [4? E,W8 9qIHۚ풴lMP#*wg:8-ñj@?F[$GtJL0s-o|;#o`Is{Kҵ65m1 k?f%(炸r;v=4tPw?j&ATN4 @SZ E3TɤAc+;={CpfU,ie.O\Oߢݭ9^2XX%-VNqv4§v=ЉMOT+}\ IA?7߻D!WDGn®8pp;3,f%k;ܑyٸZNh.ltH Ic/~=otgx!RJݼ-ݎW5YAV9 T<!{>;b.w_ W5ƶ(NT ]=!̇odI@BuhؖҋcU4ph{3'"2I%% dKE)0b  62kg /SPL8mJ G '5$50123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_dlfcn_hook%s%s%s%s%s%s: %sunsupported dlinfo request#~ h~ x~ #~ ~ ~ ~ #~ #~ ~ H~ invalid namespaceŁ       ݁ с    c  c u c i c _ U F < 2     c  c u c i c _ U F < 2    @     @ @@!@"@ #@ %@ )@ @,@0@9@:@;@<@=@>@?@A B C D E  F@ @G@ H @0I@@J @ `K@ L @ M@ N@``@@f@ g@@h@x@y@z@{@|@}@ @     @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@ @ @ @ ;Zx0Nm<[y1Ongmon%s: cannot open file: %s %s: cannot create file: %s %s: cannot map file: %s %s: cannot stat file: %s %s: file is no correct profile data file for `%s' Out of memory while initializing profiler invalid mode for dlopen()cannot extend global scopecannot create scope listno more namespaces available for dlmopen()invalid target namespace in dlmopen()empty dynamic string token substitutionopening file=%s [%lu]; direct_opencount=%u cannot load any more object with static TLSTLS generation counter wrapped! Please report this. closing file=%s; direct_opencount=%u file=%s [%lu]; destroying link map TLS generation counter wrapped! Please report as described in . calling fini: %s [%lu] dlcloseshared object not openinvalid mode parameterDST not allowed in SUID/SGID programscannot load auxiliary `%s' because of empty dynamic string token substitution load auxiliary object=%s requested by file=%s load filtered object=%s requested by file=%s cannot allocate dependency listcannot allocate symbol search listFilters not supported with LD_TRACE_PRELINKING calling init: %s calling preinit: %s checking for version `%s' in file %s [%lu] required by file %s [%lu] no version information available (required by cannot allocate version reference tableunsupported version of Verdef recordweak version `' not found (required by of Verneed record RTLD_NEXT used in code not dynamically loadedstack smashing detected*** %s ***: %s terminated @F F K K K L P R R S S X X zR| R6zR| ,Ux FxDx T S",HTx FxDx T S",xTx FxDx T S",nYx FxDx JY U",NYx FxDx Y +V",.Yx FxDx X WV",8Yx FxDx X V",hXx FxDx zX W",Xx FxDx FX sW" `!AB  `#AB ,d xBxDx d %c",0dx FxDx cd Xc",`{dx FxDx /d f",df xBxDx f Df",f xBxDx of Ef" e/ AB H,g xBxDx g f",g xBxDx g "g",Hg xBxDx Ig g"$eh 0 AB IFFTg4AB xgAB C,h"AB ,i xBxDx Xi `h",$\i xBxDx i h",T5i xBxDx h h"$g@0 AB IFFhdAB I8j7AB ,k xBxDx k ~j",k xBxDx Yk j",Hqk xBxDx !k j" i](0 AB R,k xBxDx k >k",k xBxDx jk Ek"zPR|9   jAG IFH,<Hl xBxDx l _k",l$l xBxDx k sk",k xBxDx k k"$j=0 AB RK,t~ xBxDx L~ cs",$P~ xBxDx ~ v",T,~ xBxDx } >w" k6AB GDk:AB HdlAB L rL0 AB I w-AB I,xnAD I L`yWAB IS pzdAB IFJ, } xBxDx p} }", q} xBxDx 5} }", ~ xBxDx `~ }", d~ xBxDx (~ }",L =~ xBxDx } }"$}b0 AB IFI, ~ xBxDx ~ }", ~ xBxDx _~ }", t~ xBxDx $~ }" H`}q0 AB H,X xBxDx ɤ *", ͤ xBxDx  L", xBxDx Y ," |AB IL TAB RK8DPAB G TxAB INxAB  AB KVCAB QĆAB D ȆSAB KV AB IL<EAB DXAB I xAB HEJAD I@AD IAB <AB G؎%AB 00AB  X 0 AB IpAB LRAB J AB IO̖3AB GwAB GTsAB G $AB IFFHAB GdxAB H XwAB FH 0 AB Y,߽ xBxDx  ",x FxDx  ",$x FxDx O $",T{x FxDx  %",[x FxDx  ",; xBxDx  F", xBxDx w O",x FxDx C `",DӼx FxDx  ",t xBxDx ׻ %", xBxDx  \",kx FxDx k ",K xBxDx 3 ",4'x FxDx  ",d xBxDx Ǻ ",x FxDx  ",û xBxDx [ ֮",x FxDx ' ",$ xBxDx  ",T[x FxDx  ^",; xBxDx  "rFB $(AB 8)AB 4L+AB MP`uAB Glĝ)AB ؝ AG ̝4AB GAB 9AB MAB AD 0AG LHAB GhGAB GAAB H6AB @AB D0AG DXAG UAG 4ܟ AG PП AG lğAD  AG AB  AG AD  AB |AB 0p@NB L8FB h#AB  VIAB gAB G]AB GHAD I AB CD OAB IS@AG Y`p AG KpAB MAB  AB IP`AB I0}AB GAB J8AB ThAB GppAB H AB IFFܯAB H|$AB GAB G AB L ,AB II,$ xBxDx  ",Tx FxDx  ^", xBxDx m ",x FxDx 9 i",oe x FxDx d d",Le x FxDx d d",Dx FxDx } ",tx FxDx I o",x FxDx  x",x FxDx  ",x FxDx  (",4yx FxDx y ",dY xBxDx A }",5 xBxDx  ", xBxDx  ", xBxDx  ",$x FxDx e ",Tx FxDx 1 ", xBxDx  ",e xBxDx  ",A xBxDx  ",x FxDx U ",Dx FxDx ! z",t xBxDx  ", xBxDx  ",x FxDx } z",ux FxDx I k",4U xBxDx  ",d1 xBxDx  U",  xBxDx  ", xBxDx i ", xBxDx 1 ",$ x FxDx  ",T x FxDx  ", ax FxDx  {", Ax FxDx a ", ! xBxDx ) ",! xBxDx  ",D!x FxDx  ",t!x FxDx  ",! xBxDx Q ",!ux FxDx  p","U xBxDx  T",4"1 xBxDx  ",d"  xBxDx u "," xBxDx = ","x FxDx  ","x FxDx  |",$#x FxDx  ",T#e xBxDx i l",#Ax FxDx 5 ",#!x FxDx  ",# xBxDx  ",$ xBxDx  ",D$x FxDx ]  ",t$x FxDx )  ",$y xBxDx  ",$U xBxDx  ",%1 xBxDx  ",4% x FxDx M  ",d%x FxDx   ",% xBxDx  ",% xBxDx  k",% xBxDx q  L",$&a xBxDx 9  O",T&=x FxDx   '",&x FxDx  ",&x FxDx  ",& xBxDx e  ",' xBxDx -  ",D' xBxDx  ",t'qx FxDx  ",'Qx FxDx  ",'1x FxDx Y  \",(x FxDx %  0",4(x FxDx  ",d(x FxDx  ",(x FxDx  ",(x FxDx U *",(qx FxDx ! &",$)Qx FxDx  ",T)1x FxDx  ",)x FxDx  ") AI_$*gA<Ah(*%<*P*0H$l*AA LAt*lA[AFAC BCA pCA {CA CA A, +XAHF XEA dF<+CBQoX+H"F F SBx+X6BNe+|e+A+_A]+@-AB U,.OAB I ,@=}AB <,=AB X,>AB t,>,>(,?cKXRA XI,?Xr QAH(,(@cKXRA XI(-l@cKXRA XI@-@%AX\-@9AB Jx-@AB O-xA,-Lx FxDx L C",-Lx FxDx L F",-Lx FxDx qL ,F",.Lx FxDx =L NH",@.}Lx FxDx L QH"x'CAB 'CAG 'C AB J + Eh0 AD QF,XE0 AD $ ,E0 AB HP<(J)AB X(J(AB t(J)AB 8/LKGAA AADLDD\A AAP/`K\AA AA[DLDLA AALAA AAD0lK#X0K%AXt0K%AX 0KAB C^0\LAG 0PLAG  0DLAB HK10N]AB M01pOAB M(P1P1AA A` AA$|1P_L VKGB VI$1 Q_L VKGB VI1DQ"B V(1Q.AA Ah AA(2Q)AA Ac AA<2Q}AB R\2RQAB ,L2; x FxDx ; Y;",|2; x FxDx ; I;",2%Sx FxDx R Q",2S x FxDx R 8R"83RAB H X3SqAG IFF,P3DW xBxDx W TV",3 W xBxDx V zV",3V xBxDx V V"$0U0 AB IFI44Lb,4rx FxDx r f",L4rx FxDx Xr f",|4prx FxDx $r p",4Prx FxDx q p",40rx FxDx q qp", 5rx FxDx q gp",<5q x FxDx Tq p",l5}x FxDx } v",5}x FxDx X} iv",5x FxDx  ",5x FxDx [ ",,6sx FxDx ' ",\6Sx FxDx  ",63x FxDx  ",6x FxDx  ",6 x FxDx  r",7 x FxDx  t",L7 x FxDx q  ",|7x FxDx  ",7x FxDx  " 8+\AB CH,8+UAB XL8/AB Il810AB ,\88x FxDx 8 2",88x FxDx ~8 2",88x FxDx J8 2",8v8x FxDx 8 2",9V8x FxDx 7 '3",L968x FxDx 7 3",|98x FxDx z7 4",97x FxDx F7 4",97x FxDx 7 4", :7x FxDx 6 5",<:7x FxDx 6 w5",l:@? x FxDx @> =",:? x FxDx > =",:D xBxDx  A",: xBxDx  A",,; xBxDx  E",\;؍ xBxDx t F" ;?AB IL ;?AB KQ< A!AB E <0BAB E,@<0DHD PUMupZu|uxut,D<x FxDx ζ `",t<Ҷx FxDx  Q",<x FxDx f ",<x FxDx 2 ",=Vx FxDx 2 ",4=6 x FxDx  ",d=! xBxDx ! S",=! xBxDx ! ",=! xBxDx Y! u ",=! xBxDx !! " P>AB IFR t>\AB DO >(AB DC >$NAI LHK >AB SHE,>~ xBxDx }~ >'",?~ xBxDx E~ )'" d?L ]AI G?})AB ,x?~ xBxDx c~ T~",? xBxDx e ",?i xBxDx - ",@B xBxDx  Ȍ"$L=0 AB LI,`@ xBxDx d ",@h xBxDx , ",@D xBxDx  Ǎ"$>d1 AB IL,A xBxDx  ʎ",HA xBxDx  ",xA xBxDx r E" >^1 AB I,A xBxDx  5",A xBxDx  P",,Bƒ xBxDx v L" d;AB ILI$?t$1 AB ILB0AB B+AB  Cē-AB V(Cؓ4AB GDC}AB G`C`LAB IPCFAB GCĔ@AB GC=AG C AG UChAB GDCAB IF0D tAB GLDAB GhDAB N DhAB IPDDAD ID$xAB GDAB HEAB H(EȜAB HHE8AB LhE؞AB H EHAB IL$EAA FAEܱA,Ex FxDx  ",Ex FxDx V ",Fnx FxDx " ",LFNx FxDx  ",|F.x FxDx  ",Fx FxDx  ",F xCxDx  ", G xCxDx L   "hGh  |G AB Ca G AB IQG\#$De21 AB DC @@AB OP$H,RAB L DHlAB HEEhH"AB H]AB LH<AD IHZAB EH\ ZAB IFI,_AB X $I_9AB DCHI`AB LhI8hAB HI8@ AAANTI6B AEAAA E(P,Q$H AM(C C, A0 R ICO DCDPHc J0J  (J#FA AN AA LJ LA AN AA pJ LA AN AA J LA AN AA,Jx FxDx  ",Jx FxDx f "Kȸ5(,KD1^  ~}KXKXHAB T$xK2AA DDA@K@8WAA ADDNIiA AAFAAHK\8WAA ADDTIcA AAAE AA80L;9AA AADDHJWA AA$lLFAA DDA4L G<AA AAtA AA,LpOx FxDx LO ^N",LPO x FxDx O N",MP xBxDx O :O",0MO xBxDx O ]O",`MO xBxDx {O QO" JNA1 AB H,MQ xBxDx P O",MP xBxDx P P",NP xBxDx P SP"$XKNO1 AB ILNlAB N lAB QNm_AB L8N<<AA AADDHJZA AA0OKA AAAAA A$A(A,A0A4A8AAB DUXAB CG(UX|AB HHUAB HhU(CAB DUXrAB OUAB WU7AB [ UAB INGV AB $V1AB R@VAB N `VAB LNUV*AB V 3AB L V4 AB TFGV *AB V BAB INW AG Q< V<       8Rc Xs(  k . I h { o  k F g oI I I I  |  H `!_ _ ` ` ` (` =` F` S` d` v` ` cdlsdirqcattypestdebughive ed nv dvdelallvnkdkhexrdelekck?dpiQ  T E   C T `F   `D T  G  E    C `D E pP?3 3   c]  ȡ  ] ء ]    ]  ]  &  ] 6 F ] V ] F f v ]  ] v   ]  ]  ͢           `                  Al          @  @z @} `} }  @GCC: (GNU) 4.4.3.shstrtab.note.ABI-tag.rel.plt.init.text__libc_freeres_fn__libc_thread_freeres_fn.fini.rodata__libc_atexit__libc_subfreeres__libc_thread_subfreeres.eh_frame.gcc_except_table.tdata.tbss.ctors.dtors.jcr.data.rel.ro.got.got.plt.data.bss__libc_freeres_ptrs.comment Ԁ  "0,,(@@.@F @@X yYLY L_Y ~ gt tXux xX0 X X #include #include #include "ntreg.h" const char reged_version[] = "reged version 0.1 110511, (c) Petter N Hagen"; /* Global verbosity flag */ int gverbose = 0; /* Array of loaded hives */ #define MAX_HIVES 10 struct hive *hive[MAX_HIVES+1]; int no_hives = 0; void usage(void) { printf("\nModes:\n" "-x \n" " Xport. Where for example is HKEY_LOCAL_MACHINE\\SOFTWARE\n" " is key to dump (recursively), \\ or \\\\ means all keys in hive\n" " Only one .reg and one hive file supported at the same time\n" "-I \n" " Import from .reg file. Where for example is HKEY_LOCAL_MACHINE\\SOFTWARE\n" " Only one .reg and one hive file supported at the same time\n" "-e ...\n" " Interactive edit one or more of registry files\n\n" "Options:\n" "-L : Log changed filenames to /tmp/changed, also auto-saves\n" "-C : Auto-save (commit) changed hives without asking\n" "-N : No allocate mode, only allow edit of existing values with same size\n" "-E : No expand mode, do not expand hive file (safe mode)\n" "-t : Debug trace of allocated blocks\n" "-v : Some more verbose messages\n" ); } int main(int argc, char **argv) { int export = 0, edit = 0, import = 0; int d = 0; int autocommit = 0, update = 0; int logchange = 0, mode = 0, dd = 0; int il; extern int optind; extern char* optarg; char *hivename, *prefix, *key, *outputname, *inputname; char c; char yn[10]; FILE *ch; char *options = "vhtxCLeINE"; printf("%s\n",reged_version); while((c=getopt(argc,argv,options)) > 0) { switch(c) { case 'e': edit = 1; break; case 'x': export = 1; break; case 'I': import = 1; break; case 'C': autocommit = 1; break; case 'L': logchange = 1; break; case 'v': mode |= HMODE_VERBOSE; gverbose = 1; break; case 'N': mode |= HMODE_NOALLOC; break; case 'E': mode |= HMODE_NOEXPAND; break; case 't': mode |= HMODE_TRACE; break; case 'h': usage(); exit(0); break; default: usage(); exit(1); break; } } if (!export && !edit && !import) { usage(); exit(1); } if ( import && export ) { fprintf(stderr,"Import and export cannot be done at same time\n"); usage(); exit(1); } if (export) { /* Call export. Works only on one hive at a time */ hivename=argv[optind]; prefix=argv[optind+1]; key=argv[optind+2]; outputname=argv[optind+3]; if (gverbose) { printf("hivename: %s, prefix: %s, key: %s, output: %s\n",hivename,prefix,key,outputname); } if (!hivename || !*hivename || !prefix || !*prefix || !key || !*key || !outputname || !*outputname) { usage(); exit(1); } if (!(hive[no_hives] = openHive(hivename,HMODE_RO|mode))) { fprintf(stderr,"Unable to open/read hive %s, exiting..\n",hivename); exit(1); } export_key(hive[no_hives], 0, key, outputname, prefix); no_hives++; } if (import) { /* Call import. Works only on one hive at a time */ hivename=argv[optind]; prefix=argv[optind+1]; inputname=argv[optind+2]; if (gverbose) { printf("hivename: %s, prefix: %s\n",hivename,prefix); } if (!hivename || !*hivename || !prefix || !*prefix || !inputname || !*inputname) { usage(); exit(1); } if (!(hive[no_hives] = openHive(hivename,HMODE_RW|mode))) { fprintf(stderr,"Unable to open/read hive %s, exiting..\n",hivename); exit(1); } import_reg(hive[no_hives], inputname, prefix); no_hives++; update = 1; if (edit) regedit_interactive(hive, no_hives); edit = 0; } if (edit) { /* Call editor. Rest of arguments are considered hives to load */ hivename = argv[optind+no_hives]; do { if (!(hive[no_hives] = openHive(hivename, HMODE_RW|mode))) { printf("Unable to open/read a hive, exiting..\n"); exit(1); } no_hives++; hivename = argv[optind+no_hives]; } while (hivename && *hivename && no_hives < MAX_HIVES); regedit_interactive(hive, no_hives); update = 1; } if (update) { /* run for functions that can have changed things */ printf("\nHives that have changed:\n # Name\n"); for (il = 0; il < no_hives; il++) { if (hive[il]->state & HMODE_DIRTY) { if (!logchange && !autocommit) { printf("%2d <%s>",il,hive[il]->filename); if (hive[il]->state & HMODE_DIDEXPAND) printf(" WARNING: File was expanded! Experimental! Use at own risk!\n"); printf("\n"); } d = 1; } } if (d) { /* Only prompt user if logging of changed files has not been set */ /* Thus we assume confirmations are done externally if they ask for a list of changes */ if (!logchange && !autocommit) fmyinput("Commit changes to registry? (y/n) [n] : ",yn,3); if (*yn == 'y' || logchange || autocommit) { if (logchange) { ch = fopen("/tmp/changed","w"); } for (il = 0; il < no_hives; il++) { if (hive[il]->state & HMODE_DIRTY) { printf("%2d <%s> - ",il,hive[il]->filename); if (!writeHive(hive[il])) { printf("OK "); if (hive[il]->state & HMODE_DIDEXPAND) printf(" WARNING: File was expanded! Experimental! Use at own risk!\n"); printf("\n"); if (logchange) fprintf(ch,"%s ",hive[il]->filename); dd = 2; } } } if (logchange) { fprintf(ch,"\n"); fclose(ch); } } else { printf("Not written!\n\n"); } } else { printf("None!\n\n"); } } while (no_hives > 0) closeHive(hive[--no_hives]); return(dd); } chntpw_0.99.6.110511/ntreg.h0000600000175000017500000004316311562562244013357 0ustar jfsjfs/* * ntreg.h - NT Registry Hive access library, constants & structures * * NOTE: defines are not frozen. It can and will change every release. * ***** * * NTREG - Window registry file reader / writer library * Copyright (c) 1997-2011 Petter Nordahl-Hagen. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; * version 2.1 of the License. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * See file LGPL.txt for the full license. * */ #ifndef _INCLUDE_NTREG_H #define _INCLUDE_NTREG_H 1 #define SZ_MAX 4096 /* Max unicode strlen before we truncate */ #define KEY_ROOT 0x2c /* Type ID of ROOT key node */ #define KEY_NORMAL 0x20 /* Normal nk key */ #define ABSPATHLEN 4096 /* hbin page size. hbins are minimum this, and always multiple of this */ #define HBIN_PAGESIZE 0x1000 /* Hive filesize seems to always be multiple of this */ #define REGF_FILEDIVISOR 0x40000 /* Larger than this, and values seems split into several blocks */ #define VAL_DIRECT_LIMIT 0x3fd0 /* Datatypes of the values in the registry */ #define REG_NONE 0 /* No value type */ #define REG_SZ 1 /* Unicode nul terminated string */ #define REG_EXPAND_SZ 2 /* Unicode nul terminated string + env */ #define REG_BINARY 3 /* Free form binary */ #define REG_DWORD 4 /* 32-bit number */ #define REG_DWORD_BIG_ENDIAN 5 /* 32-bit number */ #define REG_LINK 6 /* Symbolic Link (unicode) */ #define REG_MULTI_SZ 7 /* Multiple Unicode strings */ #define REG_RESOURCE_LIST 8 /* Resource list in the resource map */ #define REG_FULL_RESOURCE_DESCRIPTOR 9 /* Resource list in the hardware description */ #define REG_RESOURCE_REQUIREMENTS_LIST 10 /* Uh? Rait.. */ #define REG_QWORD 11 /* Quad word 64 bit, little endian */ #define REG_MAX 12 /* The first page of the registry file is some kind of header, lot of * it's contents is unknown, and seems to be mostly NULLs anyway. * Note also, that this is the only place in the registry I've been * able to find _any_ kind of checksumming */ struct regf_header { int32_t id; /* 0x00000000 D-Word ID: ASCII-"regf" = 0x66676572 */ int32_t unknown1; /* 0x00000004 D-Word ???? Mount count */ int32_t unknown2; /* 0x00000008 D-Word ???? Always the same value as at 0x00000004 */ char timestamp[8]; /* 0x0000000C Q-Word last modify date in WinNT date-format */ int32_t unknown3; /* 0x00000014 D-Word 1 */ int32_t unknown4; /* 0x00000018 D-Word 3 - probably version #. 2 in NT3.51 */ int32_t unknown5; /* 0x0000001C D-Word 0 */ int32_t unknown6; /* 0x00000020 D-Word 1 */ int32_t ofs_rootkey; /* 0x00000024 D-Word Offset of 1st key record */ int32_t filesize; /* 0x00000028 D-Word Offset of first non-used data at end of file */ int32_t unknown7; /* 0x0000002C D-Word 1 */ char name[0x1fc-0x30]; /* 0x00000030 Seems like the hive's name is buried here, max len unknown */ int32_t checksum; /* 0x000001FC D-Word Xor sum of all D-Words from 0x00000000 to 0x000001FB */ }; /* The page header, I don't know if the 14 "dummy" bytes has a meaning, * they seem to be mostly NULLS */ struct hbin_page { int32_t id; /* 0x0000 D-Word ID: ASCII-"hbin" = 0x6E696268 */ int32_t ofs_self; /* 0x0004 D-Word Offset to itself, could be for sanity check */ int32_t ofs_next; /* 0x0008 D-Word Relative offset to next hbin (practically length of this one) */ char dummy1[14]; /* 0x14 to 0x001b may be timestamp in some windows versions, at least in first hbin */ int32_t len_page; /* 0x001C D-Word Block-size??? Don't look like it. Most often zero. */ int32_t firstlink; /* 0x0020 First data block likage */ /* char data[1]; 0x0020 First data block starts here */ }; /* Minimum block size utilized at end of hbin * Make routines accept 0 size block when at end */ #define HBIN_ENDFILL 0 /* Security descriptor. I know how it's linked, but don't know how the real security data is constructed, it may as well be like the higher level security structs defined by MS in its includes & NT docs. Currently, I have no use for it. Note that keys sharing the exact same security settings will most likely point to the same security descriptor, thus saving space and making it fast to make objects inherit settings (is inheritance supported? they speak of security inheritance as a "new" feature in the filesystem on NT5, even though I think it was also supported by the lower levels in the earlier versions) */ struct sk_key { short id; /* 0x0000 Word ID: ASCII-"sk" = 0x6B73 */ short dummy1; /* 0x0002 Word Unused */ int32_t ofs_prevsk; /* 0x0004 D-Word Offset of previous "sk"-Record */ int32_t ofs_nextsk; /* 0x0008 D-Word Offset of next "sk"-Record */ int32_t no_usage; /* 0x000C D-Word usage-counter */ int32_t len_sk; /* 0x0010 D-Word Size of "sk"-record in bytes */ char data[4]; /* Security data up to len_sk bytes */ }; /* This is the subkeylist/hash structure. NT4.0+. * ID + count, then count number of offset/4byte "hash". (not true hash) * Probably changed from the 3.x version to make it faster to * traverse the registry if you're looking for a specific name * (saves lookups in 'nk's that have the first 4 name chars different) */ struct lf_key { short id; /* 0x0000 Word ID: ASCII-"lf" = 0x666C or "lh" = 0x686c */ short no_keys; /* 0x0002 Word number of keys */ /* 0x0004 ???? Hash-Records */ union { struct lf_hash { int32_t ofs_nk; /* 0x0000 D-Word Offset of corresponding "nk"-Record */ char name[4]; /* 0x0004 D-Word ASCII: the first 4 characters of the key-name, */ } hash[1]; /* WinXP uses a more real hash instead (base 37 of uppercase name chars) */ /* padded with 0's. Case sensitiv! */ struct lh_hash { int32_t ofs_nk; /* 0x0000 D-Word Offset of corresponding "nk"-Record */ int32_t hash; /* 0x0004 D-Word ASCII: the first 4 characters of the key-name, */ } lh_hash[1]; }; }; /* 3.x version of the above, contains only offset table, NOT * any start of names "hash". Thus needs 'nk' lookups for searches. */ struct li_key { short id; /* 0x0000 Word ID: ASCII-"li" = 0x696C */ short no_keys; /* 0x0002 Word number of keys */ /* 0x0004 ???? Hash-Records */ struct li_hash { int32_t ofs_nk; /* 0x0000 D-Word Offset of corresponding "nk"-Record */ } hash[1]; }; /* Indirect pointer list for value data, vk points to this instead of values data directly * Seems to be used when value data is large, maybe larger than 3-4k. */ struct db_key { short id; /* 0x0000 Word ID: ASCII-"li" = 0x6462 */ short no_part; /* 0x0002 Word number of data parts */ /* 0x0004 ???? Pointers to data */ int32_t ofs_data; /* 0x0000 D-Word Offset to list of data blocks */ /* Something else seems to follow here, 4 bytes at least */ /* and why not list the data block in here ???? why make another list?? */ }; /* This is a list of pointers to struct li_key, ie * an extention record if many li's. * This happens in NT4&5 when the lf hashlist grows larger * than about 400-500 entries/subkeys??, then the nk_key->ofs_lf points to this * instead of directly to an lf. * The sub-indices this points to seems to be li (yes!) in NT4 and 2k. * In XP and newer they point to lh which is more efficient. * Likely to happen in HKLM\Software\classes (file extention list) and * in SAM when many users. */ struct ri_key { short id; /* 0x0000 Word ID: ASCII-"ri" = 0x6972 */ short no_lis; /* 0x0002 Word number of pointers to li */ /* 0x0004 ???? Hash-Records */ struct ri_hash { int32_t ofs_li; /* 0x0000 D-Word Offset of corresponding "li"-Record */ } hash[1]; }; /* This is the value descriptor. * If the sign bit (31st bit) in the length field is set, the value is * stored inline this struct, and not in a seperate data chunk - * the data itself is then in the ofs_data field, happens for DWORD all the time * If the name size == 0, then the struct is probably cut short right * after the val_type or flag. * The flag meaning is rather unknown. */ struct vk_key { /* Offset Size Contents */ short id; /* 0x0000 Word ID: ASCII-"vk" = 0x6B76 */ short len_name; /* 0x0002 Word name length */ int32_t len_data; /* 0x0004 D-Word length of the data */ int32_t ofs_data; /* 0x0008 D-Word Offset of Data */ int32_t val_type; /* 0x000C D-Word Type of value */ short flag; /* 0x0010 Word Flag 0x1 ANSI encoding */ short dummy1; /* 0x0012 Word Unused (data-trash) */ char keyname[1]; /* 0x0014 ???? Name */ }; /* This is the key node (ie directory) descriptor, can contain subkeys and/or values. * Note that for values, the count is stored here, but for subkeys * there's a count both here and in the offset-table (lf or li struct). * What happens if these mismatch is not known. * What's the classname thingy? Can't remember seeing that used in * anything I've looked at. */ struct nk_key { /* Offset Size Contents */ short id; /* 0x0000 Word ID: ASCII-"nk" = 0x6B6E */ short type; /* 0x0002 Word for the root-key: 0x2C, otherwise 0x20 */ /* 0x20 seems a flag for ANSI encoding */ /* 0x1000 is used in some places in Vista and newer */ char timestamp[12]; /* 0x0004 Q-Word write-date/time in windows nt notation */ int32_t ofs_parent; /* 0x0010 D-Word Offset of Owner/Parent key */ int32_t no_subkeys; /* 0x0014 D-Word number of sub-Keys */ int32_t dummy1; int32_t ofs_lf; /* 0x001C D-Word Offset of the sub-key lf-Records */ int32_t dummy2; int32_t no_values; /* 0x0024 D-Word number of values */ int32_t ofs_vallist; /* 0x0028 D-Word Offset of the Value-List */ int32_t ofs_sk; /* 0x002C D-Word Offset of the sk-Record */ int32_t ofs_classnam; /* 0x0030 D-Word Offset of the Class-Name */ int32_t dummy3; /* 0x0034 unknown some of these may be used by vista */ int32_t dummy4; /* 0x0038 unknown and newer ?? */ int32_t dummy5; /* 0x003c unknown */ int32_t dummy6; /* 0x0040 unknown */ int32_t dummy7; /* 0x0044 unknown */ short len_name; /* 0x0048 Word name-length */ short len_classnam; /* 0x004A Word class-name length */ char keyname[1]; /* 0x004C ???? key-name */ }; /*********************************************************************************/ /* Structure defines for my routines */ struct ex_data { int nkoffs; struct nk_key *nk; char *name; }; struct vex_data { int vkoffs; struct vk_key *vk; int type; /* Value type REG_??? */ int size; /* Values size (normalized, inline accounted for) */ int val; /* Actual value itself if type==REG_DWORD */ char *name; }; struct keyval { int len; /* Length of databuffer */ int data; /* Data. Goes on for length of value */ }; struct keyvala { int len; /* Length of databuffer */ int data[1]; /* Data. Goes on for length of value */ }; /* Types to trav_path() */ #define TPF_NK 0 #define TPF_VK 1 #define TPF_ABS 64 #define TPF_EXACT 128 #define TPF_VK_SHORT 256 /* To get type field instead of data field, used in SAM */ #define TPF_NK_EXACT (TPF_NK | TPF_EXACT) #define TPF_VK_EXACT (TPF_VK | TPF_EXACT) #define TPF_VK_ABS (TPF_VK | TPF_ABS) /* Name is literal, not a path */ /* Hive open modes */ #define HMODE_RW 0 #define HMODE_RO 0x1 #define HMODE_OPEN 0x2 #define HMODE_DIRTY 0x4 #define HMODE_NOALLOC 0x8 /* Don't allocate new blocks */ #define HMODE_NOEXPAND 0x10 /* Don't expand file with new hbin */ #define HMODE_DIDEXPAND 0x20 /* File has been expanded */ #define HMODE_VERBOSE 0x1000 #define HMODE_TRACE 0x2000 /* Suggested type of hive loaded, guessed by library, but not used by it */ #define HTYPE_UNKNOWN 0 #define HTYPE_SAM 1 #define HTYPE_SYSTEM 2 #define HTYPE_SECURITY 3 #define HTYPE_SOFTWARE 4 /* Hive definition, allocated by openHive(), dealloc by closeHive() * contains state data, must be passed in all functions */ struct hive { char *filename; /* Hives filename */ int filedesc; /* File descriptor (only valid if state == OPEN) */ int state; /* Current state of hive */ int type; /* Suggested type of hive. NOTE: Library will guess when it loads it, but application may change it if needed */ int pages; /* Number of pages, total */ int useblk; /* Total # of used blocks */ int unuseblk; /* Total # of unused blocks */ int usetot; /* total # of bytes in useblk */ int unusetot; /* total # of bytes in unuseblk */ int size; /* Hives size (filesize) in bytes, incl regf header */ int rootofs; /* Offset of root-node */ int lastbin; /* Offset to last HBIN */ int endofs; /* Offset of first non HBIN page, we can expand from here */ short nkindextype; /* Subkey-indextype the root key uses */ char *buffer; /* Files raw contents */ }; /***************************************************/ /* Various nice macros */ #define CREATE(result, type, number)\ { \ if (!((result) = (type *) calloc ((number), sizeof(type)))) { \ perror("malloc failure"); \ abort() ; \ } \ } #define ALLOC(result, size, number)\ { \ if (!((result) = (void *) calloc ((number), (size)))) { \ perror("malloc failure"); \ abort() ; \ } \ } #define FREE(p) { if (p) { free(p); (p) = 0; } } /* Debug / verbosity message macro */ #define VERB(h, string) \ { \ if ((h)->state & HMODE_VERBOSE) printf((string)); \ } #define VERBF(h, ...) \ { \ if ((h)->state & HMODE_VERBOSE) printf(__VA_ARGS__); \ } /******* Function prototypes **********/ char *str_dup( const char *str ); int fmyinput(char *prmpt, char *ibuf, int maxlen); void hexprnt(char *s, unsigned char *bytes, int len); void hexdump(char *hbuf, int start, int stop, int ascii); int find_in_buf(char *buf, char *what, int sz, int len, int start); int get_int( char *array ); void cheap_uni2ascii(char *src, char *dest, int l); void cheap_ascii2uni(char *src, char *dest, int l); void skipspace(char **c); int gethex(char **c); int gethexorstr(char **c, char *wb); int debugit(char *buf, int sz); int parse_block(struct hive *hdesc, int vofs,int verbose); int ex_next_n(struct hive *hdesc, int nkofs, int *count, int *countri, struct ex_data *sptr); int ex_next_v(struct hive *hdesc, int nkofs, int *count, struct vex_data *sptr); int get_abs_path(struct hive *hdesc, int nkofs, char *path, int maxlen); int trav_path(struct hive *hdesc, int vofs, char *path, int type); int get_val_type(struct hive *hdesc, int vofs, char *path, int exact); int get_val_len(struct hive *hdesc, int vofs, char *path, int exact); void *get_val_data(struct hive *hdesc, int vofs, char *path, int val_type, int exact); struct keyval *get_val2buf(struct hive *hdesc, struct keyval *kv, int vofs, char *path, int type, int exact ); int get_dword(struct hive *hdesc, int vofs, char *path, int exact); int put_buf2val(struct hive *hdesc, struct keyval *kv, int vofs, char *path, int type, int exact ); int put_dword(struct hive *hdesc, int vofs, char *path, int exact, int dword); void export_key(struct hive *hdesc, int nkofs, char *name, char *filename, char *prefix); void closeHive(struct hive *hdesc); int writeHive(struct hive *hdesc); struct hive *openHive(char *filename, int mode); void nk_ls(struct hive *hdesc, char *path, int vofs, int type); struct vk_key *add_value(struct hive *hdesc, int nkofs, char *name, int type); void del_allvalues(struct hive *hdesc, int nkofs); int del_value(struct hive *hdesc, int nkofs, char *name, int exact); struct nk_key *add_key(struct hive *hdesc, int nkofs, char *name); int del_key(struct hive *hdesc, int nkofs, char *name); void rdel_keys(struct hive *hdesc, char *path, int nkofs); struct keyval *get_class(struct hive *hdesc, int curnk, char *path); int add_bin(struct hive *hdesc, int size); void import_reg(struct hive *hdesc, char *filename, char *prefix); int de_escape(char *s, int wide); char *string_regw2prog(void *string, int len); /* From edlib.c */ void regedit_interactive(struct hive *hive[], int no_hives); void cat_dpi(struct hive *hdesc, int nkofs, char *path); #endif chntpw_0.99.6.110511/regedit.txt0000600000175000017500000003174011562562244014251 0ustar jfsjfsThe Offline NT Password Editor (c) 1997-2011 Petter Nordahl-Hagen Registry Editor Usermanual/docs See COPYING for copyright & credits. See INSTALL for compile/installation instructions. See README for docs on the passwordpart (or website for bootdisk) Some known limitations as of first half 2011: This release features full basic registry edit with add/del keys and values and resizing values, and also expanding the file. Renaming keys and values is not implemented yet. Import is slow. Export is fast. Program "reged" is used for interactive registry edit (rudimentary command prompt type interface) or to export or import .reg files. Import and export can also be scripted (non-interactive) The "chntpw" program which is for password edits, also contains the editor, but not the import / export. Usage of "reged": reged version 0.1 110504, (c) Petter N Hagen Modes: -x Xport. Where for example is HKEY_LOCAL_MACHINE\SOFTWARE is key to dump (recursively), . or \ or \\ means all keys in hive Only one .reg and one hive file supported at the same time -I Import from .reg file. Where for example is HKEY_LOCAL_MACHINE\SOFTWARE Only one .reg and one hive file supported at the same time -e ... Interactive edit one or more of registry files Options: -L : Log changed filenames to /tmp/changed, also auto-saves -C : Auto-save (commit) changed hives without asking -N : No allocate mode, only allow edit of existing values with same size -E : No expand mode, do not expand hive file (safe mode) -t : Debug trace of allocated blocks -v : Some more verbose messages -x will do export to .reg file. It will create files that seems to be compatible with regedit.exe in Windows. The prefix is the first part of the key names that windows shows/uses, it is not stored in the hive files, so you can actually put in anything unless you have to import in Windows. Current version only handles one set of files at a time (and also only one point to start export from in it) -I does import of .reg files into the specified hive file. It supports .reg files from Windows regedit.exe, they are usually UTF-16 (16 bit characters) and in the few cases I tested it will import with correct characters. Please note that the key and value names always are 8 bit in the registry, but strings the values store are 16 bit characters. Will also work with latin-1 (8 bit) character files, like the export functions creates, but again some character conversions may be wrong. Note that the current versions are pretty slow, since they are not optimized or well written in any way. Around 90000 keys with 120000 values just took around 10 minutes on my pretty fast machine. (I am lazy! You don't write hex reads with one byte at a time do you? :) -e goes into interactive editor (see below for old example) -e can be combined with -I so that the editor is entered before saving -after an import. -N and -E are safe modes, can be used with any mode. -C must be used when importing to auto-save, else it will ask first if import succeeds. The -L option will write changed hive file names to /tmp/changed, I use it for scripts that need to know. ------------------------ Here is an old demo of registry edit, via the chntpw program, but regedit is the same (except some new stuff is in there) You can navigate the registry almost like a filesystem (only difference being that the "files" actually are of a special datatype, instead of just a bytestream) Note that this demo is just some random editing, will likely cause windows to not boot if written back to it. >chntpw -h chntpw version 0.99.0 030111, (c) Petter N Hagen chntpw: change password of a user in a NT SAM file, or invoke registry editor. chntpw [OPTIONS] [systemfile] [securityfile] [otherreghive] [...] -h This message -u Username to change, Administrator is default -l list all users in SAM file -i Interactive. List users (as -l) then ask for username to change -e Registry editor. Now with full write support! -d Enter buffer debugger instead (hex editor), -t Trace. Show hexdump of structs/segments. (deprecated debug function) -L Write names of changed files to /tmp/changed -N No allocation mode. Only (old style) same length overwrites possible (example edit of a SYSTEM-hive) >chntpw -e system chntpw version 0.99.0 030111, (c) Petter N Hagen Hive's name (from header): ROOT KEY at offset: 0x001020 This is probably not a sam HIVE Simple registry editor. ? for help. [1020] > ? Simple registry editor: hive [] - list loaded hives or switch to hive numer n' cd - change key ls | dir [] - show subkeys & values, cat | type - show key value st [] - show struct info nk - add key dk - delete key (must be empty. recursion not supported yet) ed - Edit value nv - Add value dv - Delete value delallv - Delete all values in current key debug - enter buffer hexeditor q - quit (list the contents of the current key) [1020] > l ls of node at offset 0x1024 Node has 6 subkeys and 0 values offs key name [ 11b8] [ dff88] [1c2040] [ de448] [ de998] [ deab8] (now let's make a subkey here) [1020] > nk DemoKey [1020] > l ls of node at offset 0x1024 Node has 7 subkeys and 0 values offs key name [ 11b8] [ dff88] [1c2ef8] [1c2040] [ de448] [ de998] [ deab8] (and delete the key) [1020] > dk DemoKey [1020] > l ls of node at offset 0x1024 Node has 6 subkeys and 0 values offs key name [ 11b8] [ dff88] [1c2040] [ de448] [ de998]