"use strict"; const {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0]; const {useMDXComponents: _provideComponents} = arguments[0]; function _createMdxContent(props) { const _components = { a: "a", blockquote: "blockquote", code: "code", em: "em", h2: "h2", h3: "h3", h4: "h4", li: "li", ol: "ol", p: "p", pre: "pre", strong: "strong", ul: "ul", ..._provideComponents(), ...props.components }; return _jsxs(_Fragment, { children: [_jsx(_components.p, { children: "Task 5 - Core Dumped - (Reverse Engineering, Cryptography) Points: 500" }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Description:" }) }), "\n", _jsx(_components.p, { children: "The FBI knew who that was, and got a warrant to seize their laptop. It looks like they had an encrypted file, which may be of use to your investigation." }), "\n", _jsxs(_components.p, { children: ["We believe that the attacker may have been clever and used the same RSA key that they use for SSH to encrypt the file. We asked the FBI to take a core dump of ", _jsx(_components.code, { children: "ssh-agent" }), " that was running on the attacker's computer."] }), "\n", _jsx(_components.p, { children: "Extract the attacker's private key from the core dump, and use it to decrypt the file." }), "\n", _jsxs(_components.p, { children: ["Hint: if you have the private key in PEM format, you should be able to decrypt the file with the command ", _jsx(_components.code, { children: "openssl pkeyutl -decrypt -inkey privatekey.pem -in data.enc" })] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Downloads:" }) }), "\n", _jsxs(_components.ul, { children: ["\n", _jsx(_components.li, { children: "Core dump of ssh-agent from the attacker's computer (core)" }), "\n", _jsx(_components.li, { children: "ssh-agent binary from the attacker's computer. The computer was running Ubuntu 20.04. (ssh-agent)" }), "\n", _jsx(_components.li, { children: "Encrypted data file from the attacker's computer (data.enc)" }), "\n"] }), "\n", _jsx(_components.p, { children: _jsx(_components.strong, { children: "Prompt:" }) }), "\n", _jsx(_components.p, { children: "Enter the token value extracted from the decrypted file." }), "\n", _jsx(_components.h2, { children: "Solution" }), "\n", _jsxs(_components.blockquote, { children: ["\n", _jsx(_components.p, { children: "This might be the hardest challenge in the whole competition because of how deep it takes you into reverse engineering the binary. The only other that might be a contender is Task 8." }), "\n"] }), "\n", _jsx(_components.p, { children: "There are 8 phases to solving this:" }), "\n", "\n", _jsxs(_components.ol, { children: ["\n", _jsx(_components.li, { children: "ssh-agent theory" }), "\n", _jsxs(_components.li, { children: ["Reverse engineering", "\n", _jsxs(_components.ol, { children: ["\n", _jsx(_components.li, { children: "Initial inspections" }), "\n", _jsx(_components.li, { children: "Looking in source code" }), "\n"] }), "\n"] }), "\n", _jsx(_components.li, { children: "Looking for functions" }), "\n", _jsxs(_components.li, { children: ["Looking for ", _jsx(_components.code, { children: "idtab" }), " and shielded private key"] }), "\n", _jsx(_components.li, { children: "Decrypting the shielded private key" }), "\n", _jsx(_components.li, { children: "Parsing the decrypted private key blob" }), "\n", _jsx(_components.li, { children: "RSA key as .pem" }), "\n", _jsxs(_components.li, { children: ["Decrypt ", _jsx(_components.code, { children: "data.enc" })] }), "\n"] }), "\n", _jsx(_components.h3, { children: "ssh-agent theory" }), "\n", _jsx(_components.p, { children: "The first thing to do is understand what role ssh-agent plays and how it stores and uses private keys." }), "\n", _jsxs(_components.p, { children: ["When I was researching, I found this resource: ", _jsx(_components.a, { href: "http://www.unixwiz.net/techtips/ssh-agent-forwarding.html", children: "http://www.unixwiz.net/techtips/ssh-agent-forwarding.html" }), ". It has a very good explanation of what exactly the purpose and role of ssh-agent is in ssh (Go read, if you haven't). The way that ssh-agent supports ssh is that it keeps loads the private keys into memory once when the user starts it. Then, whenever the user needs to make a connection to a remote host, the authentication is forwarded to the ssh-agent which then uses the private key to produce a response for the authentication challenge. It also helps with forwarding where if a user connects to a host and then further connects from there to another host using ssh, the authentication challenge is forwarded all the way back to the original user's host where the agent produces a response and then gets forwarded back to the end host which sent the challenge."] }), "\n", _jsxs(_components.blockquote, { children: ["\n", _jsx(_components.p, { children: "I highly recommend reading the article." }), "\n"] }), "\n", _jsx(_components.p, { children: "So, the way that the ssh-agent stores the private keys is only in memory and after the user has unlocked it once at the beginning using a passphrase. Fortunately, this means that getting a coredump of a running ssh-agent binary with the private key loaded in memory would allow us to extract it from the coredump. Later we'll see that the binary keeps these keys in memory in encrypted form, but it's possible to get around that." }), "\n", _jsx(_components.p, { children: "Other resources:" }), "\n", _jsxs(_components.ul, { children: ["\n", _jsx(_components.li, { children: _jsx(_components.a, { href: "https://stackoverflow.com/questions/2976496/how-to-extract-private-keys-from-an-ssh-agent", children: "https://stackoverflow.com/questions/2976496/how-to-extract-private-keys-from-an-ssh-agent" }) }), "\n", _jsx(_components.li, { children: _jsx(_components.a, { href: "http://www.unixwiz.net/techtips/ssh-agent-forwarding.html", children: "http://www.unixwiz.net/techtips/ssh-agent-forwarding.html" }) }), "\n", _jsx(_components.li, { children: _jsx(_components.a, { href: "https://www.netspi.com/blog/technical/network-penetration-testing/stealing-unencrypted-ssh-agent-keys-from-memory/", children: "https://www.netspi.com/blog/technical/network-penetration-testing/stealing-unencrypted-ssh-agent-keys-from-memory/" }) }), "\n", _jsx(_components.li, { children: _jsx(_components.a, { href: "https://github.com/NetSPI/sshkey-grab/blob/75f1028a762936d004ae9a9bcd9fb51d9b4e1d99/parse_mem.py#L37", children: "https://github.com/NetSPI/sshkey-grab/blob/75f1028a762936d004ae9a9bcd9fb51d9b4e1d99/parse_mem.py#L37" }) }), "\n"] }), "\n", _jsx(_components.h3, { children: "Reverse Engineering" }), "\n", _jsxs(_components.p, { children: ["In order to reverse engineer the binary and see how it is working, we need to use pwndbg. I initially had problems getting it to work with the dump and binary provided, but after reinstalling pwndbg, it worked. This is ", _jsx(_components.em, { children: "far" }), " better than using stock gdb."] }), "\n", _jsx(_components.p, { children: "Keep in mind that pretty everything now onwards can fall under Reverse Engineering." }), "\n", _jsx(_components.h4, { children: "Initial inspections" }), "\n", _jsx(_components.p, { children: "Let's load the binary in gdb with the core dump. To load the binary with the coredump:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "$ sudo gdb ssh-agent --core=core\n" }) }), "\n", _jsx(_components.p, { children: "Observations from just loading in gdb:" }), "\n", _jsxs(_components.ol, { children: ["\n", _jsxs(_components.li, { children: ["The ", _jsx(_components.code, { children: "rip" }), " is at an invalid address:"] }), "\n"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "──────────────────────────[ DISASM / x86-64 / set emulate on ]───────────────────────────\nInvalid address 0x7f8c72ae3967\n" }) }), "\n", _jsxs(_components.ol, { start: "2", children: ["\n", _jsxs(_components.li, { children: ["Looking at ", _jsx(_components.code, { children: "vmmap" }), " to see how the memory is laid out:"] }), "\n"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> vmmap\nLEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA\n 0x5585d287b000 0x5585d2881000 r--p 6000 0 /usr/bin/ssh-agent\n 0x5585d28cf000 0x5585d28d1000 r--p 2000 53000 /usr/bin/ssh-agent\n 0x5585d28d1000 0x5585d28d2000 ---p 1000 55000 /usr/bin/ssh-agent\n 0x5585d28d2000 0x5585d28d4000 ---p 2000 0 load4\n 0x5585d30b2000 0x5585d30f4000 ---p 42000 0 load5\n 0x7f8c729a6000 0x7f8c729a8000 ---p 2000 0 load6\n 0x7f8c729a8000 0x7f8c729ae000 r--p 6000 0 /usr/lib/x86_64-linux-gnu/libpthread-2.31.so\n 0x7f8c729c5000 0x7f8c729c6000 r--p 1000 1c000 /usr/lib/x86_64-linux-gnu/libpthread-2.31.so\n 0x7f8c729c6000 0x7f8c729c7000 ---p 1000 1d000 /usr/lib/x86_64-linux-gnu/libpthread-2.31.so\n 0x7f8c729c7000 0x7f8c729cb000 ---p 4000 0 load10\n 0x7f8c729cb000 0x7f8c729cc000 r--p 1000 0 /usr/lib/x86_64-linux-gnu/libdl-2.31.so\n 0x7f8c729cf000 0x7f8c729d0000 r--p 1000 3000 /usr/lib/x86_64-linux-gnu/libdl-2.31.so\n 0x7f8c729d0000 0x7f8c729d1000 ---p 1000 4000 /usr/lib/x86_64-linux-gnu/libdl-2.31.so\n 0x7f8c729d1000 0x7f8c729f3000 r--p 22000 0 /usr/lib/x86_64-linux-gnu/libc-2.31.so\n 0x7f8c72bb9000 0x7f8c72bbd000 r--p 4000 1e7000 /usr/lib/x86_64-linux-gnu/libc-2.31.so\n 0x7f8c72bbd000 0x7f8c72bbf000 ---p 2000 1eb000 /usr/lib/x86_64-linux-gnu/libc-2.31.so\n 0x7f8c72bbf000 0x7f8c72bc3000 ---p 4000 0 load17\n 0x7f8c72bc3000 0x7f8c72c3b000 r--p 78000 0 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1\n 0x7f8c72e67000 0x7f8c72e93000 r--p 2c000 2a3000 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1\n 0x7f8c72e93000 0x7f8c72e95000 ---p 2000 2cf000 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1\n 0x7f8c72e95000 0x7f8c72e9b000 ---p 6000 0 load21\n 0x7f8c72e9e000 0x7f8c72e9f000 r--p 1000 0 /usr/lib/x86_64-linux-gnu/ld-2.31.so\n 0x7f8c72ecb000 0x7f8c72ecc000 r--p 1000 2c000 /usr/lib/x86_64-linux-gnu/ld-2.31.so\n 0x7f8c72ecc000 0x7f8c72ecd000 ---p 1000 2d000 /usr/lib/x86_64-linux-gnu/ld-2.31.so\n 0x7f8c72ecd000 0x7f8c72ece000 ---p 1000 0 load25\n 0x7ffe2962f000 0x7ffe29650000 rw-p 21000 0 [stack]\n 0x7ffe2975b000 0x7ffe2975d000 r-xp 2000 0 load27\n0xffffffffff600000 0xffffffffff601000 r-xp 1000 0 [vsyscall]\n" }) }), "\n", _jsx(_components.p, { children: "This shows a few things" }), "\n", _jsxs(_components.ol, { children: ["\n", _jsx(_components.li, { children: "There isn'ta segment marked as heap" }), "\n", _jsx(_components.li, { children: "There is a stack though" }), "\n", _jsxs(_components.li, { children: ["It has some segments marked as ", _jsx(_components.code, { children: "load4" }), ", ", _jsx(_components.code, { children: "load5" }), ", ", _jsx(_components.code, { children: "load25" }), ", etc. which have different sizes."] }), "\n"] }), "\n", _jsx(_components.p, { children: "Telescoping the stack shows something interesting:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> telescope rsp\n00:0000│ rsp 0x7ffe2964df58 ◂— 0x5585d28838d1\n01:0008│ 0x7ffe2964df60 ◂— 0xffff6\n02:0010│ 0x7ffe2964df68 —▸ 0x7ffe2964dfa0 ◂— 0x1\n03:0018│ 0x7ffe2964df70 ◂— 0x5\n04:0020│ 0x7ffe2964df78 ◂— 0xffff6\n...\n...\n1b:00d8│ 0x7ffe2964e030 —▸ 0x7f8c72bc22e8 (X509_verify_cert+296) ◂— 0x0\n1c:00e0│ 0x7ffe2964e038 ◂— 0x5585d28a7550\n" }) }), "\n", _jsxs(_components.p, { children: ["At an offset of ", _jsx(_components.code, { children: "0x00d8" }), " from ", _jsx(_components.code, { children: "rsp" }), ", there is a pointer to ", _jsx(_components.code, { children: "X509_verify_cert+296" }), " which sounds interesting from the name. It seems to be doing some x509 cert verification judging from the name, which might be useful because it's at least something. It doesn't really come in too handy later on but for now it gives us some hanlde on things."] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> p &X509_verify_cert\n$2 = ( *) 0x7f8c72bc21c0 <__pthread_keys+10016>\n" }) }), "\n", _jsx(_components.h4, { children: "Looking in source code" }), "\n", _jsxs(_components.p, { children: ["The source code can be found at ", _jsx(_components.a, { href: "https://github.com/openssh/openssh-portable/blob/master/ssh-agent.c", children: "https://github.com/openssh/openssh-portable/blob/master/ssh-agent.c" })] }), "\n", _jsx(_components.p, { children: "One interesting thing I saw was on line 2229:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "#ifdef HAVE_SETRLIMIT\n\t/* deny core dumps, since memory contains unencrypted private keys */\n" }) }), "\n", _jsx(_components.p, { children: "Interesting that it prevents coredump, but we already have it provided for us. But one thing it tells us is that we're looking in the right place (source code) for private keys, it does store it in memory somewhere---we just need to find where." }), "\n", _jsxs(_components.p, { children: ["Next, looking through the source, I found the ", _jsx(_components.code, { children: "reaper()" }), " function which \"removes expired keys and returns number of seconds until the next expiry\". This seems interesting because in order to remove the expired keys, the program would have to access the location where the keys are stored. So, we can follow the logic to get to that location. I was able to also find it in Ghidra."] }), "\n", _jsx(_components.p, { children: "To find the function in gdb, I tried looking for the string and matching instructions, as well as tried other things. At this point, I was focusing on function in the source code finding them and in Ghidra and then locating them in gdb. I was using a gdb session of the ssh-agent binary without the coredump." }), "\n", _jsxs(_components.p, { children: ["I spent some time looking for and analysing the reaper function, it ultimately wasn't as useful as I had hoped but I did get a few important insights from it. In the source code for the ", _jsx(_components.code, { children: "reaper()" }), " function, there are interesting variables being used."] }), "\n", _jsxs(_components.ol, { children: ["\n", _jsxs(_components.li, { children: ["The variables of type ", _jsx(_components.code, { children: "Identity" }), ":"] }), "\n"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "\tIdentity *id, *nxt;\n" }) }), "\n", _jsxs(_components.ol, { children: ["\n", _jsx(_components.li, { children: "There is pointer being used to get what seems to be a linked list of identities:" }), "\n"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "\tfor (id = TAILQ_FIRST(&idtab->idlist); id; id = nxt) {\n ...\n \t\t\tTAILQ_REMOVE(&idtab->idlist, id, next);\n ...\n ...\n" }) }), "\n", _jsxs(_components.p, { children: ["The ", _jsx(_components.code, { children: "idtab" }), " variable looks very interesting beacuse it either is the place where the identities are stored or is a handle to where the identities are stored."] }), "\n", _jsx(_components.h3, { children: "Looking for functions" }), "\n", _jsxs(_components.p, { children: ["I looked for the ", _jsx(_components.code, { children: "main()" }), " function by starting gdb and then stepping through the instructions in ", _jsx(_components.code, { children: "__libc_start_main" }), " until I came to this point:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "► 0x7ffff7801e3b <__libc_start_main+123> call __libc_start_call_main <__libc_start_call_main>\n rdi: 0x55555555c1d0 ◂— endbr64\n rsi: 0x1\n rdx: 0x7fffffffda78 —▸ 0x7fffffffde3d ◂— '/home/zaid/CTFs/NSA22/task_5/downloads/ssh-agent'\n" }) }), "\n", _jsxs(_components.p, { children: ["The value in ", _jsx(_components.code, { children: "rdi" }), " is a pointer to a some instructions. I inspected the instructions at that location and compared with Ghidra and source code to see if this was ", _jsx(_components.code, { children: "main()" }), ". I looked for the Ghidra function by looking at the last bytes, because even with ASLR, the last bytes remain same. One indication is the use of ", _jsx(_components.code, { children: "getgid()" }), " and ", _jsx(_components.code, { children: "setegid()" }), ". The functions matched and so I was fairly sure that this was ", _jsx(_components.code, { children: "main()" }), "."] }), "\n", _jsx(_components.p, { children: "As I was working on reverse engineering, I kept note and track of the locations of functions in a separate file and I also prefixed the Ghidra function names with the actual names (as I understood)." }), "\n", _jsx(_components.p, { children: "I also looked at the coredump and it didn't seem to have any code sections, which made me drop looking for functions in it and decided to find the private key storage location in the gdb binary (without coredump) and then correspond it in the coredump later." }), "\n", _jsxs(_components.p, { children: ["I also did a similar approach to find ", _jsx(_components.code, { children: "sanitise_stdfd()" }), ", ", _jsx(_components.code, { children: "platform_disable_tracing()" }), ", ", _jsx(_components.code, { children: "ssh_get_progname()" }), " and ", _jsx(_components.code, { children: "seed_rng()" }), " in gdb."] }), "\n", _jsxs(_components.p, { children: ["There was a problem executing ", _jsx(_components.code, { children: "platform_disable_tracing()" }), " but if I jumped over it, things worked fine."] }), "\n", _jsxs(_components.p, { children: ["While looking through the source code, I found that in line 2145, it calls the function ", _jsx(_components.code, { children: "getpid()" }), " and then stores the value in ", _jsx(_components.code, { children: "parent_pid" }), "."] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "\tparent_pid = getpid();\n" }) }), "\n", _jsx(_components.p, { children: "In Ghidra, this looked like this:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "DAT_00156014 = getpid();\n" }) }), "\n", _jsxs(_components.p, { children: ["This is interesting because the variable is a global variable---declared as a global variable in the source code, and assigned to a ", _jsx(_components.code, { children: "DAT_" }), " variable in Ghidra which means that it is a global variable. And that is interesting because these are usually stored in the heap segment. So, if we can correspond the section in the coredump, then we can find the segment which is should have the private key, making the reasonable assumption that the private key is stored using ", _jsx(_components.code, { children: "malloc" }), " and in the heap. In gdb, the instruction looked like this:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "► 0x55555555c55f mov dword ptr [rip + 0x4daaf], eax\n" }) }), "\n", _jsxs(_components.p, { children: ["So, the value gets stored at ", _jsx(_components.code, { children: "rip + 0x4daaf" }), ". Let's see what it looks like around there:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> telescope $rip+0x4daaf\n00:0000│ 0x5555555aa00e ◂— 0xffff000000020000\n01:0008│ 0x5555555aa016 ◂— 0x20ffffffffffff\n02:0010│ 0x5555555aa01e ◂— 0x1000000020000\n03:0018│ 0x5555555aa026 ◂— 0x30000\n04:0020│ 0x5555555aa02e ◂— 0xffffffffffff0000\n05:0028│ 0x5555555aa036 ◂— 0x10000003fffff\n06:0030│ 0x5555555aa03e ◂— 0x10000\n07:0038│ 0x5555555aa046 ◂— 0x555555582a880000\n\npwndbg> vmmap $rip+0x4daaf\nLEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA\n 0x5555555aa000 0x5555555ab000 rw-p 1000 55000 /home/zaid/CTFs/NSA22/task_5/downloads/ssh-agent +0xe\n" }) }), "\n", _jsxs(_components.p, { children: ["The address is at an offset of ", _jsx(_components.code, { children: "+0xe" }), " in the vmmap segment. The vmmap segment is of size ", _jsx(_components.code, { children: "1000" }), " and matches with the coredump vmmap segment:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: " 0x5585d28d1000 0x5585d28d2000 ---p 1000 55000 /usr/bin/ssh-agent\n" }) }), "\n", _jsx(_components.p, { children: "Now, lets see what is at the same offset in the coredump segment:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> telescope 0x5585d28d1000+0xe\n00:0000│ 0x5585d28d100e ◂— 0x12000000020000\n01:0008│ 0x5585d28d1016 ◂— 0x20ffffffff0000\n02:0010│ 0x5585d28d101e ◂— 0x20000\n03:0018│ 0x5585d28d1026 ◂— 0x30000\n04:0020│ 0x5585d28d102e ◂— 0xffffffffffff0000\n05:0028│ 0x5585d28d1036 ◂— 0x10000003fffff\n06:0030│ 0x5585d28d103e ◂— 0x10000\n07:0038│ 0x5585d28d1046 ◂— 0x5585d28a9a880000\n" }) }), "\n", _jsxs(_components.p, { children: ["If we look at the values stored here, they are exactly the same, except for the first one which I assume is going to be assigned after the instruction or later. This tells us that we are probably looking at the right location for where the ", _jsx(_components.code, { children: "parent_pid" }), " is stored. We can also assume that around this place is where the global variables are stored."] }), "\n", _jsx(_components.p, { children: "At this point, the program forks a child process at line 2190 in the source code. In Ghidra, at line 155:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pid_Var7 = fork();\n" }) }), "\n", _jsx(_components.p, { children: "We want to follow the child process because the parent executes some logic and then exits. In the source, lines 2195-2215:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "\tif (pid != 0) {\t\t/* Parent - execute the given command. */\n\t\tclose(sock);\n\t\tsnprintf(pidstrbuf, sizeof pidstrbuf, \"%ld\", (long)pid);\n\t\tif (ac == 0) {\n\t\t\tformat = c_flag ? \"setenv %s %s;\\n\" : \"%s=%s; export %s;\\n\";\n\t\t\tprintf(format, SSH_AUTHSOCKET_ENV_NAME, socket_name,\n\t\t\t SSH_AUTHSOCKET_ENV_NAME);\n\t\t\tprintf(format, SSH_AGENTPID_ENV_NAME, pidstrbuf,\n\t\t\t SSH_AGENTPID_ENV_NAME);\n\t\t\tprintf(\"echo Agent pid %ld;\\n\", (long)pid);\n\t\t\texit(0);\n\t\t}\n\t\tif (setenv(SSH_AUTHSOCKET_ENV_NAME, socket_name, 1) == -1 ||\n\t\t setenv(SSH_AGENTPID_ENV_NAME, pidstrbuf, 1) == -1) {\n\t\t\tperror(\"setenv\");\n\t\t\texit(1);\n\t\t}\n\t\texecvp(av[0], av);\n\t\tperror(av[0]);\n\t\texit(1);\n\t}\n" }) }), "\n", _jsxs(_components.p, { children: ["For that, we can set the option in gdb: ", _jsx(_components.code, { children: "set follow-fork-mode child" }), ". FOllowing the child is useful because it sets up some sockets and calls some ssh related functions: (lines 2241-2251)"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "#ifdef ENABLE_PKCS11\n\tpkcs11_init(0);\n#endif\n\tnew_socket(AUTH_SOCKET, sock);\n\tif (ac > 0)\n\t\tparent_alive_interval = 10;\n\tidtab_init();\n\tssh_signal(SIGPIPE, SIG_IGN);\n\tssh_signal(SIGINT, (d_flag | D_flag) ? cleanup_handler : SIG_IGN);\n\tssh_signal(SIGHUP, cleanup_handler);\n\tssh_signal(SIGTERM, cleanup_handler);\n\n" }) }), "\n", _jsxs(_components.p, { children: ["I then continued to look for interesting functions which references id related structs or arguments, etc. I saw the ", _jsx(_components.code, { children: "pkcs11_init()" }), " function which I looked into. It seemed to be initialising some stroage for pkcs providers. The source was at: ", _jsx(_components.a, { href: "https://github.com/openssh/openssh-portable/blob/97f9b6e61316c97a32dad94b7a37daa9b5f6b836/ssh-pkcs11.c", children: "https://github.com/openssh/openssh-portable/blob/97f9b6e61316c97a32dad94b7a37daa9b5f6b836/ssh-pkcs11.c" }), ". I didn't find too much here."] }), "\n", _jsxs(_components.p, { children: ["I also found the ", _jsx(_components.code, { children: "idtab_init()" }), " function which I thought was potentially very important. The function is very short but it importantly assigns ", _jsx(_components.code, { children: "idtab" }), " (I thought it was potentially important but didn't realise it's full importance at the time). The function is at lines 210-216:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "static void\nidtab_init(void)\n{\n\tidtab = xcalloc(1, sizeof(*idtab));\n\tTAILQ_INIT(&idtab->idlist);\n\tidtab->nentries = 0;\n}\n" }) }), "\n", _jsx(_components.p, { children: "Looking at what exactly idtab is at lines 149-155:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "struct idtable {\n\tint nentries;\n\tTAILQ_HEAD(idqueue, identity) idlist;\n};\n\n/* private key table */\nstruct idtable *idtab;\n" }) }), "\n", _jsx(_components.p, { children: "It looks like a linked list of identities." }), "\n", _jsxs(_components.p, { children: ["The ", _jsx(_components.code, { children: "xcalloc" }), " uses ", _jsx(_components.code, { children: "sizeof(*idtab)" }), " which is ", _jsx(_components.code, { children: "0x18" }), " when I break at the function call and look at arguments and also according to Ghidra. The calloc return value was ", _jsx(_components.code, { children: "RAX 0x5555555c9140 ◂— 0x0" }), " which then got stored into the ", _jsx(_components.code, { children: "idtab" }), " global variable as: ", _jsx(_components.code, { children: " 0x5555555aa7c0 —▸ 0x5555555c9140 ◂— 0x0" }), " (in gdb).\nThe instructions in Ghidra looked like this (I renamed the idtab_init function):"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: " puVar14 = (undefined4 *)idtab_init_FUN_0011baf0(1,0x18);\n DAT_001567c0 = puVar14;\n" }) }), "\n", _jsx(_components.p, { children: "Looking at the vmmap for this gdb address and telescoping:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> vmmap 0x5555555aa7c0\nLEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA\n 0x5555555aa000 0x5555555ab000 rw-p 1000 55000 /home/zaid/CTFs/NSA22/task_5/downloads/ssh-agent +0x7c0\n\npwndbg> telescope $rip+0x4d8dc\n00:0000│ 0x5555555aa7c0 —▸ 0x5555555c9140 ◂— 0x0\n01:0008│ 0x5555555aa7c8 ◂— 0x0\n... ↓ 2 skipped\n04:0020│ 0x5555555aa7e0 ◂— '/tmp/ssh-avGuDr88j45x/agent.54645'\n05:0028│ 0x5555555aa7e8 ◂— '-avGuDr88j45x/agent.54645'\n06:0030│ 0x5555555aa7f0 ◂— '8j45x/agent.54645'\n07:0038│ 0x5555555aa7f8 ◂— 'ent.54645'\n" }) }), "\n", _jsx(_components.p, { children: "The vmmap segment in the coredump which looks similar to this one is (see above for full coredump vmmap):" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA\n...\n 0x5585d28d1000 0x5585d28d2000 ---p 1000 55000 /usr/bin/ssh-agent\n...\n" }) }), "\n", _jsx(_components.p, { children: "Looking at the same offset in this coredump segment:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> telescope 0x5585d28d1000+0x7c0\n00:0000│ 0x5585d28d17c0 —▸ 0x5585d30ce3c0 ◂— 0x1\n01:0008│ 0x5585d28d17c8 ◂— 0x0\n... ↓ 2 skipped\n04:0020│ 0x5585d28d17e0 ◂— '/tmp/ssh-gH19cuv11Hop/agent.18'\n05:0028│ 0x5585d28d17e8 ◂— '-gH19cuv11Hop/agent.18'\n06:0030│ 0x5585d28d17f0 ◂— '11Hop/agent.18'\n07:0038│ 0x5585d28d17f8 ◂— 0x38312e746e65 /* 'ent.18' */\n" }) }), "\n", _jsxs(_components.p, { children: ["We can see that it looks similar, so we can make a reasonable conclusion that this is where the ", _jsx(_components.code, { children: "idtab" }), " global variable is stored in the coredump."] }), "\n", _jsxs(_components.blockquote, { children: ["\n", _jsxs(_components.p, { children: ["I did a bunch of stuff here at this point, before and during resolving the idtab location in gdb and the coredump, which was me tryng different things to see if something works.\nI was looking at things related to the address that calloc returns. I wasn't seeing the address in the heap chunks and was trying to figure things out related to that.\nI also looked at some stuff related to the ", _jsx(_components.code, { children: "prepare_poll()" }), " and ", _jsx(_components.code, { children: "poll()" }), " functions.\nI also looked at the (returned) ", _jsx(_components.code, { children: "pkcs11_provider" }), " struct, the ", _jsx(_components.code, { children: "pkcs11_provider_lookup()" }), " function, the ", _jsx(_components.code, { children: "pkcs11_key" }), " struct, etc. I looked at these because I thought these would lead me some place where the identities are managed, because pkcs11 seemed related."] }), "\n", _jsx(_components.p, { children: "While I was doing these things, I also stumbled upon a region (when looking at the calloc pointers) which seemed to hold a lot of pointers to places and I was thinking this was useful and perhaps pointers to where the different identities are stored." }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "0x5585d30d2290: 0x00005585d30d22a0 0x0000000000000031\npwndbg>\n0x5585d30d22a0: 0x00005585d30d03f0 0x00005585d30d1410\n0x5585d30d22b0: 0x0000000000000000 0x0000000000000000\n0x5585d30d22c0: 0x0000000000000030 0x00000000000000a0\n0x5585d30d22d0: 0x0000000000000000 0x00005585d30b2010\n0x5585d30d22e0: 0x00005585d30d1a50 0x00005585d30d1ad0\n0x5585d30d22f0: 0x00005585d30d1b50 0x00005585d30d1bf0\n0x5585d30d2300: 0x00005585d30d1c50 0x00005585d30d1d30\n0x5585d30d2310: 0x00005585d30d1d90 0x00005585d30d1e30\n0x5585d30d2320: 0x00005585d30d1f00 0x00005585d30d1f60\n0x5585d30d2330: 0x00005585d30d21f0 0x00005585d30d2270\n0x5585d30d2340: 0x0000000000000000 0x0000000000000000\n" }) }), "\n", _jsx(_components.p, { children: "The pointers seemed to be in chunks, where there would be a bunch of null 64-bit values in between locations that have multiple 64-bit pointers." }), "\n", _jsx(_components.p, { children: "Telescoping to see what these are:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> telescope 0x5585d30d2290\n00:0000│ 0x5585d30d2290 —▸ 0x5585d30d22a0 —▸ 0x5585d30d03f0 —▸ 0x5585d30d0400 —▸ 0x7f8c72bbdc00 (X509_TRUST_get_by_id) ◂— ...\n01:0008│ 0x5585d30d2298 ◂— 0x31 /* '1' */\n02:0010│ 0x5585d30d22a0 —▸ 0x5585d30d03f0 —▸ 0x5585d30d0400 —▸ 0x7f8c72bbdc00 (X509_TRUST_get_by_id) —▸ 0x5585d30d3160 ◂— ...\n03:0018│ 0x5585d30d22a8 —▸ 0x5585d30d1410 —▸ 0x5585d30d1420 —▸ 0x5585d30d2290 —▸ 0x5585d30d22a0 ◂— ...\n04:0020│ 0x5585d30d22b0 ◂— 0x0\n05:0028│ 0x5585d30d22b8 ◂— 0x0\n06:0030│ 0x5585d30d22c0 ◂— 0x30 /* '0' */\n07:0038│ 0x5585d30d22c8 ◂— 0xa0\n08:0040│ 0x5585d30d22d0 ◂— 0x0\n09:0048│ 0x5585d30d22d8 —▸ 0x5585d30b2010 ◂— 0x7000400070007\n0a:0050│ 0x5585d30d22e0 —▸ 0x5585d30d1a50 ◂— 0x0\n0b:0058│ 0x5585d30d22e8 —▸ 0x5585d30d1ad0 ◂— 0x0\n0c:0060│ 0x5585d30d22f0 —▸ 0x5585d30d1b50 —▸ 0x5585d30d1a40 ◂— 0x0\n0d:0068│ 0x5585d30d22f8 —▸ 0x5585d30d1bf0 ◂— 0x0\n0e:0070│ 0x5585d30d2300 —▸ 0x5585d30d1c50 ◂— 0x0\n0f:0078│ 0x5585d30d2308 —▸ 0x5585d30d1d30 ◂— 0x0\n10:0080│ 0x5585d30d2310 —▸ 0x5585d30d1d90 ◂— 0x0\n11:0088│ 0x5585d30d2318 —▸ 0x5585d30d1e30 —▸ 0x5585d30d1c40 ◂— 0x0\n12:0090│ 0x5585d30d2320 —▸ 0x5585d30d1f00 ◂— 0x0\n13:0098│ 0x5585d30d2328 —▸ 0x5585d30d1f60 ◂— 0x0\n14:00a0│ 0x5585d30d2330 —▸ 0x5585d30d21f0 ◂— 0x0\n15:00a8│ 0x5585d30d2338 —▸ 0x5585d30d2270 ◂— 0x0\n16:00b0│ 0x5585d30d2340 ◂— 0x0\n17:00b8│ 0x5585d30d2348 ◂— 0x0\n" }) }), "\n", _jsxs(_components.p, { children: ["I did some stuff with this and tried to format it as a key and use it decrypt the ", _jsx(_components.code, { children: "data.enc" }), " file, decode with asn1, etc. but those things didn't work because it was wrong and this is not the key or the identities."] }), "\n", _jsxs(_components.p, { children: ["I spent a lot of time on these tangents. But realising that I could and should follow the ", _jsx(_components.code, { children: "idtab" }), " variable because it is a global variable was a ", _jsx(_components.strong, { children: "clicking point" }), " for me."] }), "\n"] }), "\n", _jsxs(_components.h3, { children: ["Looking for ", _jsx(_components.code, { children: "idtab" }), " and shielded private key"] }), "\n", _jsxs(_components.p, { children: ["Going back to following ", _jsx(_components.code, { children: "idtab" }), ", the following structs and definitions are useful:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "struct idtable {\n\tint nentries;\n\tTAILQ_HEAD(idqueue, identity) idlist;\n};\n" }) }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "#define TAILQ_HEAD(name, type)\t\t\t\t\t\t\\\nstruct name {\t\t\t\t\t\t\t\t\\\n\tstruct type *tqh_first;\t/* first element */\t\t\t\\\n\tstruct type **tqh_last;\t/* addr of last next element */\t\t\\\n}\n" }) }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "typedef struct identity {\n\tTAILQ_ENTRY(identity) next;\n\tstruct sshkey *key;\n\tchar *comment;\n\tchar *provider;\n\ttime_t death;\n\tu_int confirm;\n\tchar *sk_provider;\n\tstruct dest_constraint *dest_constraints;\n\tsize_t ndest_constraints;\n} Identity;\n" }) }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "#define TAILQ_ENTRY(type)\t\t\t\t\t\t\\\nstruct {\t\t\t\t\t\t\t\t\\\n\tstruct type *tqe_next;\t/* next element */\t\t\t\\\n\tstruct type **tqe_prev;\t/* address of previous next element */\t\\\n}\n" }) }), "\n", _jsxs(_components.p, { children: ["In the coredump, the address where the idtab global variable is located is ", _jsx(_components.code, { children: "0x5585d28d17c0" }), " corresponding to the same offset in the vmmap region. It points to this location:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> telescope 0x5585d28d1000+0x7c0\n00:0000│ 0x5585d28d17c0 —▸ 0x5585d30ce3c0 ◂— 0x1\n" }) }), "\n", _jsx(_components.p, { children: "Then, the idtab struct (not the pointer to it) looks like this:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> telescope 0x5585d30ce3c0\n00:0000│ 0x5585d30ce3c0 ◂— 0x1\n01:0008│ 0x5585d30ce3c8 —▸ 0x5585d30d3b90 ◂— 0x0\n02:0010│ 0x5585d30ce3d0 —▸ 0x5585d30d3b90 ◂— 0x0\n03:0018│ 0x5585d30ce3d8 ◂— 0x1e1\n04:0020│ 0x5585d30ce3e0 ◂— 0x0\n05:0028│ 0x5585d30ce3e8 —▸ 0x5585d30b2010 ◂— 0x7000400070007\n06:0030│ 0x5585d30ce3f0 ◂— 0x0\n07:0038│ 0x5585d30ce3f8 ◂— 0x0\n\npwndbg> x/4gx 0x5585d30ce3c0\n0x5585d30ce3c0: 0x0000000000000001 0x00005585d30d3b90\n0x5585d30ce3d0: 0x00005585d30d3b90 0x00000000000001e1\n" }) }), "\n", _jsxs(_components.p, { children: ["Now what we are going to do is try and manually parse the structs that are present in memory by using the definitions in the source code. So,", _jsx(_components.code, { children: "idtab" }), " is an ", _jsx(_components.code, { children: "idtable" }), " struct and after resolving the ", _jsx(_components.code, { children: "TAILQ_HEAD" }), " macro, it should look like below. I have also added the values that correspond to the struct elements by corresponding it with the ", _jsx(_components.code, { children: "x/4gx" }), " command above."] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "struct idtable {\n\tint nentries; = 0x1\n struct idqueue idlist {\n struct identity *tqh_first;\t= 0x5585d30d3b90 ◂— 0x0 (only 1 elem so both first and last are same)\n struct identity **tqh_last;\t= 0x5585d30d3b90 ◂— 0x0\n }\n};\n" }) }), "\n", _jsxs(_components.blockquote, { children: ["\n", _jsx(_components.p, { children: "This kind of manual parsing of the structs from the memory required a little guessing as well about the size of each data type and which value corresponds to which struct element, etc. For people following along, this wasn't something I did perfectly by just looking at it at first glance." }), "\n"] }), "\n", _jsxs(_components.p, { children: ["This shows us that there is only ", _jsx(_components.code, { children: "0x1" }), " entry in the ", _jsx(_components.code, { children: "idtable" }), " and the ", _jsx(_components.code, { children: "tqh_first" }), " and ", _jsx(_components.code, { children: "tqh_last" }), " both point to the same address. This is because there is only one entry in the idtable which is a double-ended linked list. This single entry is located at ", _jsx(_components.code, { children: "0x5585d30d3b90" }), " and is of an ", _jsx(_components.code, { children: "identity" }), " struct. The struct definition for an ", _jsx(_components.code, { children: "identity" }), " (with the macros resolved) along with the values for each element are below:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "typedef struct identity {\n struct {\n struct identity *tqe_next; = 0x0\n struct identity **tqe_prev;\t= 0x5585d30ce3c8 —▸ 0x5585d30d3b90 ◂— 0x0 (prev -> idtab.idlist.tqhfirst -> this)\n } next;\n\n\tstruct sshkey *key; = 0x5585d30d1ee0 ◂— 0x0\n\tchar *comment; = 0x5585d30cfc00 ◂— 'T5upqypQDpDE9kBYlQsOAw'\n\tchar *provider; = 0x0000000000000000\n\ttime_t death; = 0x0000000000000000\n\tu_int confirm;\n\tchar *sk_provider;\n\tstruct dest_constraint *dest_constraints;\n\tsize_t ndest_constraints;\n} Identity;\n" }) }), "\n", _jsxs(_components.p, { children: ["The ", _jsx(_components.code, { children: "TAILQ_ENTRY" }), " looks like this, defined in ", _jsx(_components.a, { href: "https://github.com/openssh/openssh-portable/blob/2dc328023f60212cd29504fc05d849133ae47355/openbsd-compat/sys-queue.h", children: "this file" }), ":"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "#define TAILQ_ENTRY(type)\t\t\t\t\t\t\\\nstruct {\t\t\t\t\t\t\t\t\\\n\tstruct type *tqe_next;\t/* next element */\t\t\t\\\n\tstruct type **tqe_prev;\t/* address of previous next element */\t\\\n}\n" }) }), "\n", _jsxs(_components.p, { children: ["From this, we can see that the ", _jsx(_components.code, { children: "identity" }), " holds a pointer to an ", _jsx(_components.code, { children: "sshkey" }), " struct and the value for this pointer is ", _jsx(_components.code, { children: "0x5585d30d1ee0" }), ". Telescoping and examining this address:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> telescope 0x5585d30d1ee0\n00:0000│ 0x5585d30d1ee0 ◂— 0x0\n01:0008│ 0x5585d30d1ee8 —▸ 0x5585d30d50e0 ◂— 0x0\n02:0010│ 0x5585d30d1ef0 ◂— 0x0\n03:0018│ 0x5585d30d1ef8 ◂— 0xffffffff\n04:0020│ 0x5585d30d1f00 ◂— 0x0\n... ↓ 3 skipped\n\npwndbg> x/24gx 0x5585d30d1ee0\n0x5585d30d1ee0: 0x0000000000000000 0x00005585d30d50e0\n0x5585d30d1ef0: 0x0000000000000000 0x00000000ffffffff\n0x5585d30d1f00: 0x0000000000000000 0x0000000000000000\n0x5585d30d1f10: 0x0000000000000000 0x0000000000000000\n0x5585d30d1f20: 0x0000000000000000 0x0000000000000000\n0x5585d30d1f30: 0x0000000000000000 0x0000000000000000\n0x5585d30d1f40: 0x0000000000000000 0x0000000000000000\n0x5585d30d1f50: 0x0000000000000000 0x0000000000000000\n0x5585d30d1f60: 0x0000000000000000 0x00005585d30d4ab0\n0x5585d30d1f70: 0x0000000000000570 0x00005585d30d5c00\n0x5585d30d1f80: 0x0000000000004000 0x0000000000000031\n0x5585d30d1f90: 0x00005585d30d1650 0x00007f8c72bbdc00\n" }) }), "\n", _jsx(_components.p, { children: "Parsing the sshkey struct:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "struct sshkey *key; = 0x5585d30d1ee0 ◂— 0x0\nkey @ `0x5585d30d1ee0`\n\nstruct sshkey {\n\tint\t type; = 0x00000000\n\tint\t flags; = 0x00000000\n\t/* KEY_RSA */\n\tRSA\t*rsa; = 0x00005585d30d50e0\n\t/* KEY_DSA */\n\tDSA\t*dsa; = 0x0000000000000000\n\t/* KEY_ECDSA and KEY_ECDSA_SK */\n\tint\t ecdsa_nid;\t/* NID of curve */ = 0x00000000ffffffff\n\tEC_KEY\t*ecdsa; = 0x0000000000000000\n\t/* KEY_ED25519 and KEY_ED25519_SK */\n\tu_char\t*ed25519_sk; = 0x0000000000000000\n\tu_char\t*ed25519_pk; = 0x0000000000000000\n\t/* KEY_XMSS */\n\tchar\t*xmss_name; = 0x0000000000000000\n\tchar\t*xmss_filename;\t/* for state file updates */ = 0x0000000000000000\n\tvoid\t*xmss_state;\t/* depends on xmss_name, opaque */ = 0x0000000000000000\n\tu_char\t*xmss_sk; = 0x0000000000000000\n\tu_char\t*xmss_pk; = 0x0000000000000000\n\t/* KEY_ECDSA_SK and KEY_ED25519_SK */\n\tchar\t*sk_application; = 0x0000000000000000\n\tuint8_t\tsk_flags; = 0x0000000000000000\n\tstruct sshbuf *sk_key_handle; = 0x0000000000000000\n\tstruct sshbuf *sk_reserved; = 0x0000000000000000\n\t/* Certificates */\n\tstruct sshkey_cert *cert; = 0x0000000000000000\n\t/* Private key shielding */\n\tu_char\t*shielded_private; = 0x00005585d30d4ab0\n\tsize_t\tshielded_len; = 0x0000000000000570\n\tu_char\t*shield_prekey; = 0x00005585d30d5c00\n\tsize_t\tshield_prekey_len; = 0x0000000000004000\n};\n\n" }) }), "\n", _jsxs(_components.p, { children: ["This struct has something described as private key shielding. It also has an ", _jsx(_components.code, { children: "RSA *rsa" }), " value but that wasn't very helpful. Let's try and see what is stored at the addresses for ", _jsx(_components.code, { children: "shielded_private" }), " and ", _jsx(_components.code, { children: "shield_prekey" }), "; they also have the corresponding lengths which is useful."] }), "\n", _jsxs(_components.p, { children: ["The ", _jsx(_components.code, { children: "shielded_private" }), " length is ", _jsx(_components.code, { children: "0x570" }), " and in 64-bit addressing, we want to examine:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> x/174gx 0x00005585d30d4ab0\n0x5585d30d4ab0: 0x8b44180d6f8017fe 0x4f490242e641b746\n0x5585d30d4ac0: 0x2d6a123566a36b9e 0xf9155b0655a2a9f1\n0x5585d30d4ad0: 0x06b8470b89678f8e 0x4780366363538f44\n0x5585d30d4ae0: 0x9c598b53900e5684 0x2653bc4f9351f923\n0x5585d30d4af0: 0x87d93aa6a98fa707 0x5978a0df28a94128\n0x5585d30d4b00: 0x0122c3dc8f0d3226 0x29eb41959cf1de1d\n0x5585d30d4b10: 0xe01d1cfa645e12ff 0x45fde0c6302cbc0e\n0x5585d30d4b20: 0x63d277a1dc7ed391 0x83da0930efa33199\n0x5585d30d4b30: 0x4a37ed9ca8237d18 0x1560015ec4008999\n0x5585d30d4b40: 0x8a6039f46f0e7ed7 0x11fb7a0cee4bc8c8\n0x5585d30d4b50: 0x75aae05c832d86c2 0x07facd4decae460a\n0x5585d30d4b60: 0xf99371f381b4833f 0x729523aeb85c3438\n0x5585d30d4b70: 0x38b8e7d796d226f8 0xeb2aa45089ea9fab\n0x5585d30d4b80: 0x9894df0067ba512b 0x5e7e1af3ced556ca\n0x5585d30d4b90: 0x9ae29912ffa9da18 0x9149fdb99bf23678\n0x5585d30d4ba0: 0x6ee0146d8f0d6d30 0x4adb2dab7d7ae42a\n0x5585d30d4bb0: 0xb8b6e296d207e3f1 0x966479f50abc5d83\n0x5585d30d4bc0: 0xba6a25745a57a898 0x64cf2cc3ff6d41e0\n0x5585d30d4bd0: 0x81c6530bf542ed80 0x5bf9723a8b015595\n0x5585d30d4be0: 0xb73f30921ea8fc3c 0xe7fcd4b552cd04f0\n0x5585d30d4bf0: 0x792f5955b54aebdf 0xc6a9accc707ae9c0\n0x5585d30d4c00: 0x7afb3e8bc3c3661e 0xcd3a5fc01a3f3458\n0x5585d30d4c10: 0xf37ef1383a011956 0x4e3407943a808e3c\n0x5585d30d4c20: 0x65eccfd8eadd621b 0x5cbc3a756c354373\n0x5585d30d4c30: 0x84c4382dc570623b 0x966356cf6bbb90f5\n0x5585d30d4c40: 0x2f80f8518e5538b3 0xf1717e1b05eb6372\n0x5585d30d4c50: 0x861faba9634a81a8 0x46ab0e7e30af6705\n0x5585d30d4c60: 0xd0c6539bec378f21 0xa39f55a6494b70bf\n0x5585d30d4c70: 0x1ae2c4a824e7a816 0x8754253e3d5522dd\n0x5585d30d4c80: 0xc8411667525729cc 0xf79c32e4eb0a6784\n0x5585d30d4c90: 0x9a8a4af8a230b7c0 0x46c0f590342dd31a\n0x5585d30d4ca0: 0x138698c7e8392929 0xfe7670e7d898900b\n0x5585d30d4cb0: 0x9d7765e6ad3b4e6e 0xb74018118ccbc2bf\n0x5585d30d4cc0: 0x1a604146086d1612 0xac346914d5195df3\n0x5585d30d4cd0: 0x2618bcc03024a5c8 0x63fa829d8bac6355\n0x5585d30d4ce0: 0x2cf1d51b23285031 0xbff3eea4452d6367\n0x5585d30d4cf0: 0xf95925c927b6dbca 0xfd89ebde751e2c2b\n0x5585d30d4d00: 0xa219aaa2a90d69bb 0x93f6f2d6cd04ec25\n0x5585d30d4d10: 0x0ae136b1417499a8 0xfe34fc180d902bd3\n0x5585d30d4d20: 0x8bba0999c3c06b4d 0x78303a39113b89c7\n0x5585d30d4d30: 0x2f211b23d1978177 0x8f67e7105541c431\n0x5585d30d4d40: 0xa03af6f29ba057ca 0x51fc114d1b1a84cb\n0x5585d30d4d50: 0x0998e01cb16d811f 0x35f1756f74eafa7d\n0x5585d30d4d60: 0x2defc08610dfe473 0xb7cefa5f2b062500\n0x5585d30d4d70: 0xea03a20f8a2cc70d 0xdedc984992102403\n0x5585d30d4d80: 0x5f004ee2a4e85b89 0xcb9a72682d6627a5\n0x5585d30d4d90: 0xd62061e1d92c9cd0 0x71b81f98b9b459f3\n0x5585d30d4da0: 0x1c4ce9432219910d 0xba09f8f23423b121\n0x5585d30d4db0: 0x92d5597fe5e75495 0x81e6e75f0e501745\n0x5585d30d4dc0: 0x7bf7f9714056caf5 0xc9107bf6e78dbf35\n0x5585d30d4dd0: 0x3e86276578ff5396 0x21d2641a7cc3bea7\n0x5585d30d4de0: 0xf17da7b0e34cb922 0x1e44632314f327f6\n0x5585d30d4df0: 0xcbedb904ab420e1d 0x471838e210aac786\n0x5585d30d4e00: 0x7fc3d1e0ee415a34 0xae68f1f3a25f9668\n0x5585d30d4e10: 0x4828448e395b5a9b 0x97f4b23c58a4669d\n0x5585d30d4e20: 0x35cc0b8ef6ef2b87 0x7e59b4cc3ba220de\n0x5585d30d4e30: 0xaea98f373f3e2bae 0x244691453f4b1650\n0x5585d30d4e40: 0xf2a27ccfcc595d5f 0x693d62b236ee5035\n0x5585d30d4e50: 0xae0bde7f5d68013c 0x3260a0315468e461\n0x5585d30d4e60: 0x4506b83655a44a25 0x08e410f5a671565c\n0x5585d30d4e70: 0x6f67f3e4e2f1f74a 0xf0c5155ff0cdcb68\n0x5585d30d4e80: 0xa27754778a47f308 0xb9f82dfe6eca112b\n0x5585d30d4e90: 0x37a4ec35a5712598 0xaa22f5c90f85fbec\n0x5585d30d4ea0: 0xb35e5e8cdca0feb0 0x4593a24d3b80c27a\n0x5585d30d4eb0: 0x36dfc72a9aba103b 0xd0d5ba575dc34b0b\n0x5585d30d4ec0: 0xbb1d75c6d371f6e2 0x26b0b4e1eec5e6a7\n0x5585d30d4ed0: 0x2c85b8301e5fe775 0xf2af7460c2ab330c\n0x5585d30d4ee0: 0x3c7349b249c9991c 0xd72026bc16091035\n0x5585d30d4ef0: 0x262c97d357b3cfec 0xad3fbf26362b6ca5\n0x5585d30d4f00: 0x8d8434d6ab078de4 0x9045662915f8e76a\n0x5585d30d4f10: 0x3a0f4129deadff4e 0xc9107e8a0585d236\n0x5585d30d4f20: 0xd339f4dd78c834df 0x88a4665bf8c815a2\n0x5585d30d4f30: 0x43c4ee6d04013ccd 0x8d278b602155e1f5\n0x5585d30d4f40: 0xde4341f9ff7b16ce 0x0edec09f888d1012\n0x5585d30d4f50: 0x522dd8bb38ccdbc0 0x8fa1aff7e5e8a805\n0x5585d30d4f60: 0x2481a1fdf7826ad4 0x631c1b2bf3760efc\n0x5585d30d4f70: 0xa43fac76377028da 0x122e30266c63ba56\n0x5585d30d4f80: 0x2addb59eb8d46fa5 0x740eec5e1dccbc2b\n0x5585d30d4f90: 0x66d49758d8b887ff 0x6b700919c690268f\n0x5585d30d4fa0: 0xaa61cdd31f6f2155 0x6c02d92ace680283\n0x5585d30d4fb0: 0x562fc6d6cd63988f 0x9f80c02d4ad366ef\n0x5585d30d4fc0: 0x8a38d6c29e5d5465 0x109a60e97da95130\n0x5585d30d4fd0: 0x8d44eeba3c8e1865 0xbe72ddea5198b862\n0x5585d30d4fe0: 0x63b59ee0b90f531d 0xdd409c7cc2bb2eb1\n0x5585d30d4ff0: 0xe0f959f330287a26 0x8df66e630942ca12\n0x5585d30d5000: 0xbded2c64436b3949 0x27532c5c43105121\n0x5585d30d5010: 0x120b3307f2f07f79 0xdcd3ac65d37329b0\npwndbg>\n0x5585d30d5020: 0x0000000000000000 0x00000000000000b1\n" }) }), "\n", _jsx(_components.p, { children: "We can see that it ends with null bytes." }), "\n", _jsxs(_components.p, { children: ["Similarly, the ", _jsx(_components.code, { children: "shield_prekey" }), " is of length ", _jsx(_components.code, { children: "0x4000" }), " at address ", _jsx(_components.code, { children: "0x00005585d30d5c00" })] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> x/2048gx 0x00005585d30d5c00\n0x5585d30d5c00: 0x5b6f73e215957b73 0x9b35dd973f5b7838\n0x5585d30d5c10: 0xbfbeb5fb6ff66b32 0x3036ef3496a56943\n0x5585d30d5c20: 0xb7b78b39289d6c7d 0x3b98c2907b014c75\n0x5585d30d5c30: 0x6afbeec92f58f1ea 0x316d3f352bbd1fdf\n0x5585d30d5c40: 0xccf93bbef8ea7607 0x21c76ca7abf91071\n0x5585d30d5c50: 0xcc2bbe1b9d1cbd4e 0x692c2a93214d4158\n0x5585d30d5c60: 0xf7cf561ef348f49f 0xb509c18ebeeec19c\n0x5585d30d5c70: 0x66dbbda9f2f7b1b8 0x5577a6e429b51b65\n0x5585d30d5c80: 0xd8550219023336b5 0x451662a255da825c\n0x5585d30d5c90: 0x3e21080f7da61c38 0x2f8db3c56e3be2c6\n0x5585d30d5ca0: 0x1dcff36d7b60fc82 0x2fb55976f181d26b\n0x5585d30d5cb0: 0x9c025d2c2a215a84 0xa2cc93e14717ee50\n0x5585d30d5cc0: 0x2b0388c24bc29ffe 0x3f249ec7c1efdaef\n0x5585d30d5cd0: 0x68287d82d020b3fb 0x673cc78365ac13b6\n0x5585d30d5ce0: 0xb2995e0bbe48a8c6 0xb9e812885d534ea6\n0x5585d30d5cf0: 0x28b1501be05876f3 0xfc36cd7f7ed387ba\n0x5585d30d5d00: 0x201956496f36974b 0xc677e223a3d33787\n0x5585d30d5d10: 0xa995cbcb51855c38 0xd0e9748be564f667\n0x5585d30d5d20: 0x53e5b3436c8be869 0xfe76e2a3ce65851d\n0x5585d30d5d30: 0x3b1efc6f41db6f59 0x40dc2954c8aa8fa3\n0x5585d30d5d40: 0x31f09c55e6dc9296 0xcbd189e5b511d23e\n0x5585d30d5d50: 0x8b3bea32e6d5bf49 0xf6b4386942dabf16\n0x5585d30d5d60: 0x03500129d442c2a7 0x7d6a91241f2fa32d\n0x5585d30d5d70: 0x4d6b3085935cb034 0xb87e4230988b623c\n0x5585d30d5d80: 0xfcb8b99a0b3a9903 0xcfe39ad622dd7cdf\n0x5585d30d5d90: 0xb2d4c96ea7ca1b61 0xa9563b1f0bca23e0\n0x5585d30d5da0: 0xa896eb9d8b90d8da 0xbcc1dfba9afa83b3\n0x5585d30d5db0: 0x4639187818969e44 0xed870c0a0fe7711c\n0x5585d30d5dc0: 0xfb6a9fd6cf12408f 0xed784ed86c500105\n0x5585d30d5dd0: 0xc0ea4e47f3e65665 0x09ca6ac32e10ba8c\n0x5585d30d5de0: 0xf15f2e4089f42949 0x818182f55136d8e3\n0x5585d30d5df0: 0x9e45b8c335dc1823 0x3645fe02773b2da9\n0x5585d30d5e00: 0xd4db5b9e98821d21 0x90f8578aa1d3d400\n0x5585d30d5e10: 0x06fa0d63efb69fcb 0x1d55c8b18555e9aa\n0x5585d30d5e20: 0xefde4d8256721f1f 0xc2b68325b8370528\n0x5585d30d5e30: 0x8914ac4f51f2c9dc 0x94affd663b97f889\n0x5585d30d5e40: 0x302e67e4280881c4 0x26053cbc09e1828c\n0x5585d30d5e50: 0x66e2fac05245697e 0x8c1495cc9db951d2\n0x5585d30d5e60: 0x2426ff5b7fe8adbf 0xe774d98d5b3fede1\n0x5585d30d5e70: 0xe3b9bf7e90e702f2 0x08b5053d750aeb72\n0x5585d30d5e80: 0x00d988762cf0aae0 0xbdb4a77342ccc4c3\n0x5585d30d5e90: 0xda3a1b5d3e140522 0xbf689c4e032d1d5a\n0x5585d30d5ea0: 0x8dfbe320df4bf2ba 0xb986c59f00274807\n0x5585d30d5eb0: 0x6be324bc0f62f7ba 0x2f4c6340fea1116f\n0x5585d30d5ec0: 0x891142aa6409d4ac 0x2fa18eef779f69a6\n0x5585d30d5ed0: 0xe6333d95f9fd7af6 0x37a01e33d5ed83d2\n0x5585d30d5ee0: 0x58be091ef7bb93ac 0x1214e011c2ed2195\n0x5585d30d5ef0: 0x1d06fa08d8c34b4f 0x23648b918db31943\n0x5585d30d5f00: 0xc8f80e949a407818 0x0e6e4c8b5a59372d\n0x5585d30d5f10: 0x71720d9c3a3fbe69 0x854029db5b8f123a\n0x5585d30d5f20: 0x2b335f16b1888498 0x4dfecc658c3324b9\n0x5585d30d5f30: 0x01b42f985e5c59cf 0xf5ded970454a3ca0\n0x5585d30d5f40: 0x36a6ef5ff27220ed 0x6b919542dc25a09a\n0x5585d30d5f50: 0xb3c65d7880ba63d9 0x9cc7aa23207eb77a\n0x5585d30d5f60: 0xae2b2e932006bc10 0x100c822244688716\n0x5585d30d5f70: 0x835eac78b1c441a5 0xef5c55546debb0f9\n0x5585d30d5f80: 0x61e1058fa6fe8088 0x56904da6a272c4a8\n0x5585d30d5f90: 0xa5255c9a62109766 0x64c98ded8670ecec\n0x5585d30d5fa0: 0xaa4fb92a33045b1f 0xcb318e9020336794\n0x5585d30d5fb0: 0x9f72209d564392af 0x44f1754de04e19b8\n0x5585d30d5fc0: 0xfcea3dc3b3139045 0x9d9db96723c636fe\n0x5585d30d5fd0: 0x95f2ffbbe8e8efd8 0x5ef58c8a10741bc0\n0x5585d30d5fe0: 0x47b8dd00e11326d3 0x86342180a36299bb\n0x5585d30d5ff0: 0xd887634dfb079060 0xb07bc3c88bd343ca\n0x5585d30d6000: 0x8c80c518fd879254 0xcbcf1f1cfadcf4bf\n0x5585d30d6010: 0xd89fd814f3c6eae1 0x03fb4f960f2501c9\n0x5585d30d6020: 0xa303332ace47a63a 0xde130c534397599f\n0x5585d30d6030: 0x9b01e64ba35aab51 0x73d4758b701e789f\n0x5585d30d6040: 0xa77a4311d6bd6713 0x541e2f6219070d45\n0x5585d30d6050: 0xbf4f6698069ecd3d 0x36d3857c488ee115\n0x5585d30d6060: 0x72c5dd5ac52194c7 0xc50113419967964b\n0x5585d30d6070: 0x612f0e4161e3e031 0x8cf99d85bc576414\n0x5585d30d6080: 0x5e3086d2d354f8a4 0x43271a9b7f17000e\n0x5585d30d6090: 0xbc5dec54e2102ab4 0xe4f7b39b76e3a700\n0x5585d30d60a0: 0x2105bb911340cb36 0x5a63a30630e5a106\n0x5585d30d60b0: 0x78596149ba43bd52 0xada609248515beaa\n0x5585d30d60c0: 0x3924bc8838c82403 0xf4136edbaf9d4fc6\n0x5585d30d60d0: 0x0d201f4caf3656c4 0xd9a1e4e5eb567d29\n0x5585d30d60e0: 0x79b42c2207097699 0x3ecb5544eb674850\n0x5585d30d60f0: 0xce91c3076fd69683 0x6c92d7551e9f5082\n0x5585d30d6100: 0x8dfd3f43c0b7a547 0x4a355b181b445b75\n0x5585d30d6110: 0xbdbb81563aba5383 0x5bd3069f3cce20e2\n0x5585d30d6120: 0xdea0e7565fceb485 0x36b6dfd5ef17dcf4\n0x5585d30d6130: 0x8fc01380ec246e79 0xb0fc9f9b4577f188\n0x5585d30d6140: 0x4bce6c79df9f03f3 0x134cefab4eb84bd2\n0x5585d30d6150: 0xccea66cc4c6484fb 0x16d9b7f302acf69f\n0x5585d30d6160: 0x6908990d01681d46 0x22a48980dfa94149\n0x5585d30d6170: 0x90b08b30037849dd 0x9d2bc41bb17501db\n0x5585d30d6180: 0x7afbe6f72a04e959 0x00710caaf114f42d\n0x5585d30d6190: 0xe500577ded8efb37 0xfe15592d9dd328e5\n0x5585d30d61a0: 0xc8e5b8c069f520fb 0xe51a72dca2e888a3\n0x5585d30d61b0: 0x46eb775ee271f6c3 0x34f4d7b10a70d1f3\n0x5585d30d61c0: 0x1e51af1817d09cc1 0x1e321cbde2f4eef7\n0x5585d30d61d0: 0x75fd5b9d5a59b668 0xcd7ba69227e1fb9f\n0x5585d30d61e0: 0x6608bbbbfe693d53 0x8137bce12b8ab8be\n0x5585d30d61f0: 0x94c11fea369c8880 0xc5a5726f74499aeb\n0x5585d30d6200: 0x2046a3a6925c4147 0x755ca75de5f1a914\n0x5585d30d6210: 0x47aad77f2028a48e 0xb1d8aaab673c12ff\n0x5585d30d6220: 0x9350a859b5fe4939 0x8473711e0e157ea5\n0x5585d30d6230: 0x92762d49ac5f96df 0x5de9ebaff8f0b04f\n0x5585d30d6240: 0xa7b50e918254d59c 0xac92df540e7bf5bd\n0x5585d30d6250: 0x489c8e52d2300179 0xd45f951aa212564f\n0x5585d30d6260: 0x8f6ba3a56c5d96b6 0x91e6cc067f02bec1\n0x5585d30d6270: 0x2bf06f06d2db4da7 0x60556b4f3abb7b34\n0x5585d30d6280: 0xf4e9d237ab045d5a 0x370b8af16b15f60c\n0x5585d30d6290: 0xe53fb3d7103fc031 0x1fe5090435928c7e\n0x5585d30d62a0: 0x7b64278ab502b385 0xe84e3e591789cf12\n0x5585d30d62b0: 0xb5af5ea72772775e 0x689e78186cf87edd\n0x5585d30d62c0: 0x67604f31ee3d9c78 0x73847b6eeaad1567\n0x5585d30d62d0: 0x9d3d75282792a921 0x7035c9e58da888e9\n0x5585d30d62e0: 0x7ac4caf764929729 0x66506ca46504b94c\n0x5585d30d62f0: 0x2a6268576fb27739 0x85f3bdc59db34d0c\n0x5585d30d6300: 0x431ca8e8600fdcaf 0xb28c666e4745c2d5\n0x5585d30d6310: 0xee514ca617dea3f7 0xdb7026ba4958f316\n0x5585d30d6320: 0x6e371c1a54a2c062 0x3be345a47aff7811\n0x5585d30d6330: 0xcbf2fa67937b75e2 0xe73e9133967ae570\n0x5585d30d6340: 0x9a63e8e58bf05453 0xd9bb80b8da13b1d8\n0x5585d30d6350: 0xe5e361f74a3a3871 0x3df83ffac8b4dda9\n0x5585d30d6360: 0x565acc1dcc1d2073 0x63b254f55125cbec\n0x5585d30d6370: 0x1cc024677bd97396 0x57e78a3540635008\n0x5585d30d6380: 0xe3c5c024a8a4a428 0x8420da553815931e\n0x5585d30d6390: 0x69ef9092f9262f13 0x01b870aa97bab44f\n0x5585d30d63a0: 0x990e55f7335b6b76 0xe90b7b260e44da62\n0x5585d30d63b0: 0xde4121b01b24b9be 0x1ad29e438a753cad\n0x5585d30d63c0: 0x0097b91e574f796b 0x28f5b663b6101761\n0x5585d30d63d0: 0x1e604939aecf52c7 0xf4e581cbc2bd496a\n0x5585d30d63e0: 0x2ce6b83f65e21de1 0x668325c5f9dba172\n0x5585d30d63f0: 0xcfda332b16002ef3 0x01998b69f09baea8\n0x5585d30d6400: 0x60a37a98eae649cc 0x6f3dc77e3faf652c\n0x5585d30d6410: 0xae867322cd5e4831 0x5649d30fcc614b4c\n0x5585d30d6420: 0xb02e60eaa1398a34 0x169fea708897e2fd\n0x5585d30d6430: 0x5c7446e15ae68966 0x180a1ecda570a338\n0x5585d30d6440: 0x999c3ddadf950e09 0x258915f060ac15a8\n0x5585d30d6450: 0x07211901e4b32569 0x139ec171fe17d6d8\n0x5585d30d6460: 0x3155d10f27edd91c 0x1b05cf4bc5392b7e\n0x5585d30d6470: 0xcb5dbe08b16bea67 0xe32a84ceba6e2a31\n0x5585d30d6480: 0x22fa404a29f47bf2 0xe90ae9b789caa8f8\n0x5585d30d6490: 0xc9b66f4556966d99 0xe8f98b03c7b9e573\n0x5585d30d64a0: 0xc07c9709e9bc227b 0x12be01d239ce7a02\n0x5585d30d64b0: 0x81fdedd229bfec68 0xc8ffb8125066bad2\n0x5585d30d64c0: 0x337c2611ccb5b641 0xbba2a9e783a4aaba\n0x5585d30d64d0: 0xc00452c1dac130f0 0xca8aa90a399f228a\n0x5585d30d64e0: 0xe8718b7f31aa5d4c 0x342f559fcff42d28\n0x5585d30d64f0: 0x4d0c5f3b379a24ec 0x56e8e08451bc7069\n0x5585d30d6500: 0xd3ffe9ca544c88a3 0x0daf4f619112a244\n0x5585d30d6510: 0x70ed4f65d7222734 0x8a8f07d39eb8aa18\n0x5585d30d6520: 0x0e1ef5f0279b19ca 0x6aa167f9a3117c26\n0x5585d30d6530: 0xbf51bb6f4e8594c1 0x0f6b224de34a8332\n0x5585d30d6540: 0x8beed61112d91105 0x71a21da706193553\n0x5585d30d6550: 0xb5eb24eefcf1d190 0x8d4315997fa08dc8\n0x5585d30d6560: 0x3f1806ebb37e25ff 0x34dffd723164ad57\n0x5585d30d6570: 0x548aeba50634f252 0x2338c0e978cfa7cf\n0x5585d30d6580: 0x546b2745008d532d 0xebca3aca34f8a85e\n0x5585d30d6590: 0xa4af151b5d46f225 0x5bda6eeeed86d613\n0x5585d30d65a0: 0xdb7eb02d8e92a954 0x103e707ae88d38ad\n0x5585d30d65b0: 0xb82b38db73e4835f 0x80556bcd20749661\n0x5585d30d65c0: 0x0ac56777e334530b 0x3ac8c818bbb8be15\n0x5585d30d65d0: 0x313d5613ddf94a65 0x694f0af235e2a2ec\n0x5585d30d65e0: 0x810ebbf9eec7dcae 0x58b6dbe3dfa99a1e\n0x5585d30d65f0: 0x26558565f0d30d23 0x366d3156ce0a01b5\n0x5585d30d6600: 0x582c3b0acdc470f6 0x53ee580bde9a2607\n0x5585d30d6610: 0xc3d09b19d94d877f 0x40d025bee3c3bad9\n0x5585d30d6620: 0x09d095fca5bfae5b 0x948e4a4f086e49fd\n0x5585d30d6630: 0x01b54f411e41f112 0x84ce1005955d7657\n0x5585d30d6640: 0xda3f95d7b0eca93b 0x83a8e15ae310f340\n0x5585d30d6650: 0x3fffb48aa7b08792 0x6ff99366fa78c7b8\n0x5585d30d6660: 0x011b771aa24d544a 0x39b915172dc1c68d\n0x5585d30d6670: 0xae82098130729108 0x20bc721a55889a86\n0x5585d30d6680: 0xda4b93c26bdbde1d 0x8a09d9fb1fb6027b\n0x5585d30d6690: 0x896233cd7386c542 0xa605f33e2ae3f856\n0x5585d30d66a0: 0x43483c64cd4f2195 0xfa0e4f2165d2bb77\n0x5585d30d66b0: 0xdab11bdd4f265626 0x73ba759b9858b1ff\n0x5585d30d66c0: 0x42cb51c0cc5f05d0 0x985d5d2514142205\n0x5585d30d66d0: 0x523048da8db64c7c 0x034fe620073f1cbe\n0x5585d30d66e0: 0xffdc0b054f1dbf2e 0x44a012cb034b9686\n0x5585d30d66f0: 0xf980a6212ba06430 0xe27e6e7bcd7ce844\n0x5585d30d6700: 0x27efc23da5361a5f 0xd3a02ac2dfe6bafd\n0x5585d30d6710: 0x17fc8cd0c6623ac5 0xc65391df9227956d\n0x5585d30d6720: 0x3a48049e3cc3fc5e 0x086f78794571e09f\n0x5585d30d6730: 0x8c1855bee7fa0d8a 0xe525ddd842caaf35\n0x5585d30d6740: 0x50ca79dcf37cb167 0xd1b69efcf14f531f\n0x5585d30d6750: 0x43c0b37e86865bf2 0x9ab6347d72322798\n0x5585d30d6760: 0x4b2b39fdcc62250e 0x802f0a585592a99d\n0x5585d30d6770: 0x29a51e533fa546f5 0xabf7546122c32173\n0x5585d30d6780: 0x144cdc338d1601d1 0xf53e7ec85168d827\n0x5585d30d6790: 0x57c4a4569cd97aa5 0xacb39b82fdce1545\n0x5585d30d67a0: 0x4c509f579316a495 0x634b9efb6897b35b\n0x5585d30d67b0: 0xf4ec8be9becbde88 0x90f650fe937e3e4c\n0x5585d30d67c0: 0xda9edfdd321c1c87 0xcabfc325b932606a\n0x5585d30d67d0: 0x0ff3563836b75bc3 0xb0fce57b9d2546df\n0x5585d30d67e0: 0x9870644542d96e01 0x5077927259ad75ea\n0x5585d30d67f0: 0xd54e2f8966d5c010 0x3c3555d3e37cea4e\n0x5585d30d6800: 0x7a5fcb378474a832 0xe1ffa42b03a0f71f\n0x5585d30d6810: 0xe1298db6e9f44053 0x0d9e4a7bdebd69b3\n0x5585d30d6820: 0x79dece2e60e3eb43 0xa4f16e671d4e175c\n0x5585d30d6830: 0x63694c0f61060efa 0x83fe4a54eafe0b6b\n0x5585d30d6840: 0x148da2b826a4f408 0xe5bf5927df4da484\n0x5585d30d6850: 0x1981dda57ddad644 0xa34aab004b02a502\n0x5585d30d6860: 0xc5a315fa02d24314 0x9b6a0a0a4054e560\n0x5585d30d6870: 0x3c161893c515f622 0x596261205ca62b70\n0x5585d30d6880: 0x4fbc82c62468f79d 0xf7defcd87f4e0e23\n0x5585d30d6890: 0x75db9459707d1c45 0xf41fcc653841ce7a\n0x5585d30d68a0: 0x947d687a1e4dc40c 0x8bc19079ed697316\n0x5585d30d68b0: 0xbc536181830cca25 0xc9f075e0a2b969a7\n0x5585d30d68c0: 0x07ff26ac99eec295 0xb89c6edad840bfbd\n0x5585d30d68d0: 0x2301529eda76231b 0x9f2fda2ecba25d7a\n0x5585d30d68e0: 0x0273b6f821c4fb15 0x3434d6808fc4305e\n0x5585d30d68f0: 0x1beb15756c5dabe6 0x98773ae7cb71b7f3\n0x5585d30d6900: 0xa1cf84b7690a1501 0x1656d52c35b94017\n0x5585d30d6910: 0x9899aa4941830fd2 0x6483c0b35b605ea2\n0x5585d30d6920: 0xb32f5ced44f05c8a 0x4293a60fcfa4fb8c\n0x5585d30d6930: 0xc35988a18602165d 0xffa29a2675e86342\n0x5585d30d6940: 0x8b4fb263fe931625 0xb5b19366aa1af1bd\n0x5585d30d6950: 0x26b4a3409857d407 0xd8c4898568739bb2\n0x5585d30d6960: 0x5b1f2aa8cdbbb4ba 0x5eb85a95139595ad\n0x5585d30d6970: 0x87e97ca15344db9a 0xd9f6b82a5b455447\n0x5585d30d6980: 0xae9c1c2d16640275 0x7674d98423c5537b\n0x5585d30d6990: 0x52aed1b2d4defa45 0xfdaeca9c34ccae1e\n0x5585d30d69a0: 0xfbe766e867c90b3d 0x9268e2b69bd1fa1d\n0x5585d30d69b0: 0x6871dd568c9efb5c 0xa349568e4144b8ce\n0x5585d30d69c0: 0x0342b4aea3f0c04e 0xbe4e7776e4d690c2\n0x5585d30d69d0: 0x6d181814ba5ebde3 0xec675ed35983a236\n0x5585d30d69e0: 0x2592774b525a09f3 0x73fd264954fd0d14\n0x5585d30d69f0: 0xdd71090d50d81f2f 0xd3b44ae76c5d4b20\n0x5585d30d6a00: 0xe1fa2e787feffc34 0x799a3be1f7f06fd0\n0x5585d30d6a10: 0xb71b21165cd41d7a 0x7025e8f95a39ce98\n0x5585d30d6a20: 0x18163349b329cd4f 0x556ccb952f90b73c\n0x5585d30d6a30: 0xc4ad70881435014f 0x1e1589046eaecbd7\n0x5585d30d6a40: 0x14e47fc9e0eb1c78 0x646a1c01aa03aee5\n0x5585d30d6a50: 0xfe7c34f925bd7cc9 0x03cf2e864a7255b5\n0x5585d30d6a60: 0x08dcd26854a1ff18 0x73d91730df58afd1\n0x5585d30d6a70: 0x3e7bf01181dbface 0x4a6ff0a35500841b\n0x5585d30d6a80: 0x2d268088d912c70f 0xfbf19b4c9a59aeb4\n0x5585d30d6a90: 0xf83a029f6c67eadc 0x7bd059fb96dc3e70\n0x5585d30d6aa0: 0x9f44f21d5e4fcd81 0x3262161e367abe9e\n0x5585d30d6ab0: 0xdcaf4eebfdf991cd 0x60139350df17f71b\n0x5585d30d6ac0: 0xeeaee2f646750ac7 0x7988f32cafd042a6\n0x5585d30d6ad0: 0xdfdea25fe788f57a 0xe6311145a205adca\n0x5585d30d6ae0: 0xf69585d4ff57d5eb 0x59b0d4bd37c714f3\n0x5585d30d6af0: 0xd4fc243a12d7ed45 0xa9b0d6052ec832c7\n0x5585d30d6b00: 0xee451714babc74a3 0x49a86dbe4fb8300a\n0x5585d30d6b10: 0xfd8223d4aa3319df 0x3497a4da8efafb1e\n0x5585d30d6b20: 0x89bbbac99d33cb12 0xde223ee900cf724e\n0x5585d30d6b30: 0x4f3bfb6682ca2464 0x19ff46983fd4f473\n0x5585d30d6b40: 0xff108f07eb035886 0x65941c3c3ba2b79f\n0x5585d30d6b50: 0x7b9675a14b4299b3 0x3a9336666fc23424\n0x5585d30d6b60: 0x69ac9c2e8ad88cbd 0x2f7b91719a5e6cb7\n0x5585d30d6b70: 0x82f5d0749d1a7a25 0xab6c7ef6cb2006ae\n0x5585d30d6b80: 0x685d832c6b0fae9f 0x51fc47996646bb9d\n0x5585d30d6b90: 0xbcfbe85a1296b122 0x95e915456c8fcfd0\n0x5585d30d6ba0: 0xb0678fc1e7c66e6a 0xe22aaef0a101c0a5\n0x5585d30d6bb0: 0x4c696cad7775b912 0x95e1276f342322c6\n0x5585d30d6bc0: 0xbb76b5a80cf4c24f 0x83610d7a1bb00bb1\n0x5585d30d6bd0: 0x65fd131405d0bc0f 0xdb1ed2551e69db15\n0x5585d30d6be0: 0x55b3296b93d6b60d 0xaaacd29ea9374b9b\n0x5585d30d6bf0: 0xc64b6ca617dcabdf 0x8e6b521f068b5b4e\n0x5585d30d6c00: 0xb2f1fa5056c07902 0x625f3c81c3116ba3\n0x5585d30d6c10: 0x3fd7ae531efe6785 0xf0784ab158c1add4\n0x5585d30d6c20: 0xfb43bf433c1b662f 0x2e8b994d599b09d6\n0x5585d30d6c30: 0x3450bf04da1cf092 0x23636ec57aa38bae\n0x5585d30d6c40: 0xe29e4be5547ab4f5 0x37a354f2a11e5b27\n0x5585d30d6c50: 0xa70490f02e39d7e9 0x150df6f17015e335\n0x5585d30d6c60: 0x70936096818cbc38 0xd8b6e54be7790c30\n0x5585d30d6c70: 0xee7aebe9464065a0 0x40e18cd34d5d1b58\n0x5585d30d6c80: 0xf712d6fb3175b79f 0x624b5ae01b9ce875\n0x5585d30d6c90: 0x84da2036f4349213 0x96ebe0ad714064d0\n0x5585d30d6ca0: 0x0d60b62f9e268774 0x4a8d3d297721fdad\n0x5585d30d6cb0: 0xf27f16afc37347a7 0xff28addf6bd429f5\n0x5585d30d6cc0: 0xba4707c7392748b8 0x4b3c8771d4bd8d41\n0x5585d30d6cd0: 0x97a19aa230f2d41f 0x85d2a74e69e3ffe0\n0x5585d30d6ce0: 0xa2e03f3fce50ff17 0x8f00c3a38565c267\n0x5585d30d6cf0: 0xbdaf1c9565fa0b85 0xeb94a4ae776d5d14\n0x5585d30d6d00: 0x01166b424549cce4 0x472b82207d42ae61\n0x5585d30d6d10: 0x549df42e7d7a0c5c 0x53ac06aef3d1162c\n0x5585d30d6d20: 0x84f975914dcf2486 0x3a8ac4ddbc47a6a7\n0x5585d30d6d30: 0xdc8740b48faa1c0d 0xac1a9bf106fc8fec\n0x5585d30d6d40: 0xbdddea4fe53f6d60 0x70bd044f5d87648a\n0x5585d30d6d50: 0xaa7818b471367e2b 0x0d72ae1b907615ce\n0x5585d30d6d60: 0x9a96e3662157be66 0xe4b91a1f32a4b5e9\n0x5585d30d6d70: 0x611e5e5ce6098055 0xdb7c79fde092492a\n0x5585d30d6d80: 0x1e67532785aa8d0b 0x9031643d97475f9c\n0x5585d30d6d90: 0x15222cca50931446 0x969acef283f4f321\n0x5585d30d6da0: 0xb1b1a3ecbfea2906 0x022b83e84b113768\n0x5585d30d6db0: 0x123911a422222ceb 0x903ae29b4097f3bd\n0x5585d30d6dc0: 0x6ff62d88101ffceb 0x77fccb572c9421c5\n0x5585d30d6dd0: 0x035e2d3278208437 0x5f339e2561339ceb\n0x5585d30d6de0: 0x829cf80b16e54dbd 0xa75e3647adbc59da\n0x5585d30d6df0: 0xffebc39d8f24eb3b 0x9435b06f9f36fcfd\n0x5585d30d6e00: 0xaafe060acb970990 0x853fbba7556c2079\n0x5585d30d6e10: 0x716ea0f35c41d1aa 0x4a1e9e271739f714\n0x5585d30d6e20: 0x68a5faece94b1edd 0xc7320720ef3d8ca2\n0x5585d30d6e30: 0xb19162024814259f 0x32e65bf7183b99f3\n0x5585d30d6e40: 0x038f2ad6dfafda1e 0x043f201ff0dcd4a4\n0x5585d30d6e50: 0xc554c27c1716be67 0x58bb438bdb47e148\n0x5585d30d6e60: 0x9b31f4fd652050c5 0x79305238e844535d\n0x5585d30d6e70: 0x4ab6b5b5ec6f102f 0xca986805c8a8160c\n0x5585d30d6e80: 0xc4591e8c3a3533c7 0x8641741ea93d0f1a\n0x5585d30d6e90: 0x0212bd6b4395e74a 0x379c8cb6a19c72be\n0x5585d30d6ea0: 0x360c022a3d2382a1 0x7d06a1b5e0dc0b0e\n0x5585d30d6eb0: 0x94dcbaa15584760b 0x4111c3e2228d732e\n0x5585d30d6ec0: 0xac0e830b449d05e1 0x18af46b96dfa3dfc\n0x5585d30d6ed0: 0xefb22ab310534896 0x7a94671cd5f65d9c\n0x5585d30d6ee0: 0xb3b883617ee39601 0x218738ef80571901\n0x5585d30d6ef0: 0xc06c9cc52010b3bd 0x240ba7bb99a36aad\n0x5585d30d6f00: 0xacd97aed9bcea7cd 0x9bfd0dbea11abd81\n0x5585d30d6f10: 0xa73cfc3ee8a43d4e 0x81f6dbf4426c50d2\n0x5585d30d6f20: 0x97e19efc58b52b4b 0x7203eef1a5d2767a\n0x5585d30d6f30: 0xc6a0a0c536810c7e 0x10da6e18216e6137\n0x5585d30d6f40: 0xd8657441c474b838 0xe6850cb7c5474ecb\n0x5585d30d6f50: 0xe99e977077c8eb94 0xe56bad6e02ca81b2\n0x5585d30d6f60: 0x78569b2e1532fac1 0x1e1793e1da6af3d6\n0x5585d30d6f70: 0x7ca30656cb63b3b5 0xc1d2819ba299cc78\n0x5585d30d6f80: 0x7a992e0a6f55d2d9 0xaad7fe64a09bddcc\n0x5585d30d6f90: 0x31c58dd0dfbf232e 0xc48a86227314e9c9\n0x5585d30d6fa0: 0xbb00353e4d64a607 0xf68c9f45f3128896\n0x5585d30d6fb0: 0x95498a0db3057e39 0xa7dae550fdf9b762\n0x5585d30d6fc0: 0xa719a6f703d1b5ea 0xf752075dad8114fc\n0x5585d30d6fd0: 0x3eedc0ec4f154d28 0x6a57c2be55ea0be9\n0x5585d30d6fe0: 0xa44d6091da52478d 0x3c128e42be244ef4\n0x5585d30d6ff0: 0x037539baf37a4763 0x34cf58c49a19afe3\n0x5585d30d7000: 0x1b77ee75922a5570 0xd431f58f91dfa44f\n0x5585d30d7010: 0x20db26226e8a1b4d 0x61dda96978c77bc1\n0x5585d30d7020: 0x3f724e049902f7e9 0xb224a2489f6030bc\n0x5585d30d7030: 0xfca0937387840475 0x2ac9ae469395554e\n0x5585d30d7040: 0x41ca993c20cafd30 0x2b166a3f52688929\n0x5585d30d7050: 0x0b09258bfc9cb06f 0x12dcf454c2014189\n0x5585d30d7060: 0xc295f0eea2e5f87c 0x8cbe4dc26be09bda\n0x5585d30d7070: 0xa8bfc5e1f9f5f8c5 0x225f044dd4d0dab6\n0x5585d30d7080: 0x2d091bea460a1f34 0xcd06a0e3a855c320\n0x5585d30d7090: 0xec546e41464b6dc6 0xb9f70cecc139e210\n0x5585d30d70a0: 0x4c51b89262485995 0xa7c0339c5ddeee4b\n0x5585d30d70b0: 0x4e8181b065622a28 0x5950e9a9e0a24f9a\n0x5585d30d70c0: 0xa804f8b03c887058 0xac9789745ea97706\n0x5585d30d70d0: 0xaad8eefe251b08a9 0x66f41f31da5aa694\n0x5585d30d70e0: 0x95a0741afb04b0bd 0x8aa6e89f08cff9f4\n0x5585d30d70f0: 0xbd4da54756dc5ea8 0xaa2b2ff9fe85d731\n0x5585d30d7100: 0xdc9bc362e3fffb40 0xea3026164ae755ee\n0x5585d30d7110: 0x96deaef04db27e6e 0x1a98ae0d93e0fcfd\n0x5585d30d7120: 0x0b39358a42022015 0x59e6dbe99401985d\n0x5585d30d7130: 0x920b2e0c13f30e22 0x2f6081f496947ad1\n0x5585d30d7140: 0x4b2094d60a808b59 0x182c1c0f0d50b2d3\n0x5585d30d7150: 0x2cae8e3132ef9a1a 0x4f94e0ee77212fa0\n0x5585d30d7160: 0x524a6b8728c7999a 0x0b52fd2fb06f20e4\n0x5585d30d7170: 0xb7c3dd846a48ab92 0x118d87c1fd9a33b5\n0x5585d30d7180: 0x7e045b362ce650a8 0x41c5ac15c7ec9d86\n0x5585d30d7190: 0xddf5be09ca10a4ef 0xc95e9726cfffe84b\n0x5585d30d71a0: 0xf19af70d3ce00e27 0x48e54304dbd1f521\n0x5585d30d71b0: 0x362840c4ccbec293 0x0d9dc66246c4d0f1\n0x5585d30d71c0: 0x53494d36e69da96d 0x8ca1b7d869096828\n0x5585d30d71d0: 0x33a346e3dd616a50 0xb00ef385a0e61247\n0x5585d30d71e0: 0xad953c39ac7eb39f 0x5f5e566bc8162270\n0x5585d30d71f0: 0xc9d6d90e7d1b7c56 0xa624a27f1bfa0c92\n0x5585d30d7200: 0x7abedec817bccf5f 0x6fe399d579716080\n0x5585d30d7210: 0x0c5e6963163af550 0xdeab28eb7f6bd5a9\n0x5585d30d7220: 0xa9b5fbb832822b00 0x3007f58987b53cc7\n0x5585d30d7230: 0xb98f13940052fa01 0xdbe3acb3d04798fe\n0x5585d30d7240: 0x220b1774c21f5e4d 0x7c67f4527ce519ed\n0x5585d30d7250: 0x71a263d570ebb039 0xc7988decb34a5702\n0x5585d30d7260: 0x215b4e13e7ffba18 0x89d58517f2bc09ad\n0x5585d30d7270: 0x161cb555018f7d7a 0x6ed62d057b811661\n0x5585d30d7280: 0xcded55f8740ee7f6 0xcca5fdb58be59e80\n0x5585d30d7290: 0xab582e1d09547682 0x5d0781c6815670f7\n0x5585d30d72a0: 0x2a0a2c9e88e70cdb 0x18fb16b67ae6ce2f\n0x5585d30d72b0: 0xf1f8b63e207b0faf 0xcd3de921761bef6c\n0x5585d30d72c0: 0x78b7198432f3b364 0x0673d10f155ae2a1\n0x5585d30d72d0: 0x5d9bf36021c54e50 0x5df0a092a54606cf\n0x5585d30d72e0: 0x7d59bd32cdc1186c 0x636324bcdacc5481\n0x5585d30d72f0: 0xb43273b99ace42eb 0xa74d042925f1cf36\n0x5585d30d7300: 0x6c887080634ea59d 0xa3d8050c04e216af\n0x5585d30d7310: 0x95b59af872a9a619 0x8da0797623b211ce\n0x5585d30d7320: 0x011b4aca49a67485 0xd9d0ca4aead11049\n0x5585d30d7330: 0xc6b8e71adcdb78b3 0xee818eefd98e5c67\n0x5585d30d7340: 0x7e0504db73ad4460 0x49c034be124282b9\n0x5585d30d7350: 0x27b054994653e34f 0xe3be4ca8fef017a7\n0x5585d30d7360: 0x7f39cfcca0d1d7b8 0xfcbf6d7655c3ab1a\n0x5585d30d7370: 0x79c9fea2976a64e2 0x6fd9a5bd262dcefd\n0x5585d30d7380: 0xf5a3e3277f88632b 0xd764de943667d08e\n0x5585d30d7390: 0x50e980249d7d68b6 0x8b1d27e9b32096f0\n0x5585d30d73a0: 0xddadda23dcd77241 0x05ea606d0d462b33\n0x5585d30d73b0: 0xe8d7b1c1260f26ad 0xdca14ae7413232b3\n0x5585d30d73c0: 0x6931f6e45a7a98da 0x7f1faf2e96c1eae7\n0x5585d30d73d0: 0x1d9cf18e6b580bde 0x05e79a10416ee0aa\n0x5585d30d73e0: 0x18d8730753860fbd 0x4e4a65696ab04b51\n0x5585d30d73f0: 0xf039bd644861c585 0xd44a2c27bc30f2e6\n0x5585d30d7400: 0x505a0f04c9f96deb 0xb3163513ff9574b5\n0x5585d30d7410: 0x2bde1c5241cb223c 0x2f91659821b2890f\n0x5585d30d7420: 0xd60a915fdfd9c2f4 0x022764c23377fbd6\n0x5585d30d7430: 0xe4afc7cf57ce647f 0x691f93881adb0a1c\n0x5585d30d7440: 0x924b8e16d3dc1647 0xca7c18e125215b4c\n0x5585d30d7450: 0xcae08c91ce53f353 0xf41f65a9856e0b70\n0x5585d30d7460: 0x4b66bf868f660d9b 0x49b4ce8320a82291\n0x5585d30d7470: 0xdb51974b19783998 0x82d77feda292b6bf\n0x5585d30d7480: 0x7abe5ad08aca63a6 0xa8b3f6c2ffb8833a\n0x5585d30d7490: 0x83d2da78b064c2cc 0x365c9b251c105fbf\n0x5585d30d74a0: 0x368ca8cc4e7cb8f5 0x42fb5ceb1f33407c\n0x5585d30d74b0: 0xb12b7f14fb00358b 0xdaecd9a40a8323dd\n0x5585d30d74c0: 0x21c7f5f6cfbdca29 0x5ec091b40be984d5\n0x5585d30d74d0: 0x26c1e34b41bc924d 0xf95886fdd2769916\n0x5585d30d74e0: 0xf1e938c4ffcf0609 0x089207ac0b3a36a1\n0x5585d30d74f0: 0xa1c3ba157e022036 0x75a75c5a21714cc8\n0x5585d30d7500: 0xb17821b9c73375e0 0xaeeee0b6b8cc14bc\n0x5585d30d7510: 0x66d40abef9813489 0x37136654c827187e\n0x5585d30d7520: 0x24f8f782bc6ae4db 0x860075d0df9f8620\n0x5585d30d7530: 0x0bbe85f957f7d478 0x3fb2bf9abfee9a9a\n0x5585d30d7540: 0xf48c11ebdcd6a91b 0x44e31abaace7d34a\n0x5585d30d7550: 0x1f8ad3bcc0b6dc47 0x93fbf08abd615b30\n0x5585d30d7560: 0x8cab64badd83f69f 0x2009dcd3ddad359f\n0x5585d30d7570: 0xea3580f663725a5f 0x4a4b23bad9fa422b\n0x5585d30d7580: 0x895ddd3cd0175cac 0x7b8c14ae33673c98\n0x5585d30d7590: 0x78acd2cf6283d000 0x008df509173f694d\n0x5585d30d75a0: 0x927948387d659591 0x12b2e62dbfb2bad9\n0x5585d30d75b0: 0x60c89c5e6d2ddcbf 0xc5296eb4a49bd1f8\n0x5585d30d75c0: 0x91b6c17522d52de0 0xd51e82482102b1d3\n0x5585d30d75d0: 0xb24ba41c3482d409 0xe6285df3b1dc5158\n0x5585d30d75e0: 0xd1b3d1bee74654e2 0x8ac9b529d54b159c\n0x5585d30d75f0: 0x7937288b753896ab 0x5b81ddfc4d1a3306\n0x5585d30d7600: 0xbfe57b1fb75d37d8 0x10616e9f00c757b1\n0x5585d30d7610: 0x38fc869a03c5f073 0x3a94f7572c4c2d77\n0x5585d30d7620: 0x55727a9a6f5bbd7f 0xc70655f0d2594534\n0x5585d30d7630: 0x4ffc959a3d6b8284 0x6a4f4b7f250ad539\n0x5585d30d7640: 0x23bbc1e525ec7b1f 0x034d7adeeacde7b7\n0x5585d30d7650: 0x353ccee63716919c 0x472464fcba1f220b\n0x5585d30d7660: 0xb92867d1e027dd0d 0xaf8a5947793624db\n0x5585d30d7670: 0x45ced7db7c24772a 0x553547aeb6c2cc56\n0x5585d30d7680: 0x753206c456cd9273 0xba102fd5363e0465\n0x5585d30d7690: 0x2cc84f6c1ac24d2c 0x682a7258cc96501a\n0x5585d30d76a0: 0xdd75540176cefb11 0x4147eb586d1df25b\n0x5585d30d76b0: 0x389b53b29922b430 0x3e8e76d2b63042c7\n0x5585d30d76c0: 0xd4976f86f7a74763 0x6280c1727232aa9c\n0x5585d30d76d0: 0x2be4a16f170a4012 0x0a45ed3ac758f7bf\n0x5585d30d76e0: 0x1788aaee50e8816a 0x6e20523a249d9935\n0x5585d30d76f0: 0x1b7fa739ef59bc95 0xb5949eaaa5338bd7\n0x5585d30d7700: 0x8a7db30b3baa6579 0xa48fe4b760670709\n0x5585d30d7710: 0x5c6a9104bc0914e0 0xd5369ca4c1daf066\n0x5585d30d7720: 0x7a610e38a5b606ad 0xb2a6756ea0bc9ff2\n0x5585d30d7730: 0x939d349554bb9492 0xe25c182658f66bb8\n0x5585d30d7740: 0xc3aeb5c189127449 0xabc58fa8af0ce53a\n0x5585d30d7750: 0x631d4b0c56c98010 0x1442facbf787686a\n0x5585d30d7760: 0xb96c19686cc46fe0 0xe595cd143c8b8ada\n0x5585d30d7770: 0xc629441af4bed0f8 0xeaa18394bcf73363\n0x5585d30d7780: 0x6c9e9eb68b487d4c 0xf19b8f081be82e74\n0x5585d30d7790: 0x4cbb1483a1454f45 0xd95e6e0c5e4c5bb8\n0x5585d30d77a0: 0x2718c0bcd34b702b 0x2418f234e9067028\n0x5585d30d77b0: 0x8c239984720a94b9 0x865a2ad0f89df66e\n0x5585d30d77c0: 0x94e5909d8ea06077 0x44c625873123fb3a\n0x5585d30d77d0: 0x917284136e913e0c 0x66bd1e0ab7eb3212\n0x5585d30d77e0: 0x58f8697e92e0b3dd 0x50468b9e8c700eb2\n0x5585d30d77f0: 0x58bd4ef7dda0322b 0xf3d18e6cc71c58cd\n0x5585d30d7800: 0x33486d50dfcdd9b2 0x6b7afe545e83bfb1\n0x5585d30d7810: 0x7858fe38b120528c 0x2d6db470eabcda20\n0x5585d30d7820: 0x07136ca43f941053 0x30c16d784f47bdd8\n0x5585d30d7830: 0x3edcf45d9fcd61b1 0xd3781aac20484c57\n0x5585d30d7840: 0x896fa92e3e3629fe 0x48ee1b267cea8f15\n0x5585d30d7850: 0xd2a268959cd21bd0 0x293f513317861a8e\n0x5585d30d7860: 0xe7c132d4bb4ba850 0xbff4fc8dff41fba0\n0x5585d30d7870: 0xcffad190ab7bae7e 0x92e544408994642a\n0x5585d30d7880: 0xe31e2d3f842d6354 0xa49d8ac472c56034\n0x5585d30d7890: 0xff091d0921ba75b1 0x7e4d97b39c0c597f\n0x5585d30d78a0: 0x7a3b06ea1ff19ba6 0xed33edb7a3e2c5b6\n0x5585d30d78b0: 0xcb62112af529069a 0xbde78b73ce57062d\n0x5585d30d78c0: 0x519b3eae42c9009d 0xd1dfd647c10b194e\n0x5585d30d78d0: 0xfc9215693fb496ef 0xf1176179a4e6494c\n0x5585d30d78e0: 0x1653a66fe8f31c37 0x27a960b9657dfab0\n0x5585d30d78f0: 0x5ddbecead3bd7232 0xb227353627ea0aa1\n0x5585d30d7900: 0x95604e5ba0009dd7 0x02fe5d676b405ed0\n0x5585d30d7910: 0xff046bb625c88e07 0xb69e9bda1f9d9ab5\n0x5585d30d7920: 0x75c4b80a8dcde62f 0xa4625b22fa4761b4\n0x5585d30d7930: 0xaa8aced6c840073d 0x3325599d96a09b1a\n0x5585d30d7940: 0x49c48d0e485bc2ff 0xca474c926986e951\n0x5585d30d7950: 0x458c0bf4f7c0a90b 0x8916794a066d643a\n0x5585d30d7960: 0x62666a8d82ae75ae 0x7242b9edd38dec75\n0x5585d30d7970: 0xd609b3cba39f222e 0xe0c02b600411c082\n0x5585d30d7980: 0x585f158e59cdd841 0xac2fe3bec00c306b\n0x5585d30d7990: 0x15e85242fe679a16 0xe370ce4123bbc592\n0x5585d30d79a0: 0xac300e56467598a7 0x040460b5debaa963\n0x5585d30d79b0: 0x32053236da1e20d1 0x626ab524291cdb43\n0x5585d30d79c0: 0x2da3fd5ffa6e2b32 0x34bc80682695f5e5\n0x5585d30d79d0: 0xd1ebc38bbe3c0b84 0x5a4a7225c139d2de\n0x5585d30d79e0: 0x3ad93e2143da64d4 0x671a4f5eac099ad7\n0x5585d30d79f0: 0xdcb3212691a2c579 0x1461cc3908c05d24\n0x5585d30d7a00: 0x5043be5d4cda0b93 0xf2628823db455f4c\n0x5585d30d7a10: 0x6c015c8c705f1f24 0x1da5e910ce778db6\n0x5585d30d7a20: 0xcf9f4a0bf80629b7 0xc075304498e135a9\n0x5585d30d7a30: 0xb0f80e00ac8b49b8 0xef056ef618f9f4e0\n0x5585d30d7a40: 0x3d1df47feda9b972 0x4b9d4c88341076b8\n0x5585d30d7a50: 0x94c72d703bcfb4de 0x4df697053249d127\n0x5585d30d7a60: 0x2ac2d524f3bf266e 0x9ff286ecf2949355\n0x5585d30d7a70: 0xee197c15f5afb698 0x4ee20a22f43cb932\n0x5585d30d7a80: 0xe8a2db73200dcec7 0x8260d7ad8d7f1626\n0x5585d30d7a90: 0x8f17ca5f24a37ad0 0x0e2ee3e1bf0587df\n0x5585d30d7aa0: 0x2fcb4f93737b8d1f 0x7190225953c1eaa3\n0x5585d30d7ab0: 0x32e0bba24b3715e3 0x7ec745425cd50654\n0x5585d30d7ac0: 0xe1fc47ccadda4222 0x3aa1ba23f29b7d8e\n0x5585d30d7ad0: 0x1a0ea6d1708c9eb5 0x0a4c446b7f706cc2\n0x5585d30d7ae0: 0x071bb89e51131356 0xe91b628228e4288e\n0x5585d30d7af0: 0x9f277f8d519727d8 0xe409276f9aa348ea\n0x5585d30d7b00: 0x4ce2722d221ad3fe 0xf95b778e5c5c23ca\n0x5585d30d7b10: 0x4931250905742e10 0x27a49d811f1b899a\n0x5585d30d7b20: 0xe6afae519ccb5a64 0xa2e0ab1050444216\n0x5585d30d7b30: 0x6863a1b78fc01599 0xad3dffd793d54c15\n0x5585d30d7b40: 0x5db121066682e18a 0x1069181b91abf3b9\n0x5585d30d7b50: 0x61a3dcc22e4d2a37 0xfcb81b41b5f2efcf\n0x5585d30d7b60: 0x80302f273be67f81 0x55c5381c19aeba58\n0x5585d30d7b70: 0xb88cb7caea75a1fe 0x1cadee6e9c7897b7\n0x5585d30d7b80: 0xf2dc4ca879f81c59 0x487c35f7150ac23f\n0x5585d30d7b90: 0xa6ad1a5d48e156ec 0x46a48c0550503946\n0x5585d30d7ba0: 0xed966707f3d7efc2 0x53d821d94c1bad42\n0x5585d30d7bb0: 0x9ba74855b1bec10c 0x164decf29bec101c\n0x5585d30d7bc0: 0xe2010d16481e4f00 0x33c912050e5d0c5c\n0x5585d30d7bd0: 0x44aaca88c429ac01 0x8071e1b326da63bc\n0x5585d30d7be0: 0x39ce52e7e992fa9f 0x45083f606ecd7725\n0x5585d30d7bf0: 0xee53c69427e79209 0x08dd7f65c40c8097\n0x5585d30d7c00: 0x4d056fdcfeecec9a 0xd9f130ce3ab2b1d7\n0x5585d30d7c10: 0x02dbc8a178fac257 0x898daa77ef1ad70f\n0x5585d30d7c20: 0x8b829443e9facd99 0x01bff0aae8e6af1f\n0x5585d30d7c30: 0x0863d6579ec11dec 0xfc7382fb4ef4d8c1\n0x5585d30d7c40: 0x416f321ee9325ea7 0x1107e8de08394968\n0x5585d30d7c50: 0xd08acf204fcf44b1 0xfd6d1ea0ef7b0c67\n0x5585d30d7c60: 0x2ff6da8dbeca739e 0xd7ce10e5af500a1e\n0x5585d30d7c70: 0x9e37ba3e32ea2bae 0x8ae414023570486e\n0x5585d30d7c80: 0x5c5e21d3edcc21c8 0xc6f2f558f4a7a113\n0x5585d30d7c90: 0xe562ca0e2468436a 0xcd8880ce78fdbc71\n0x5585d30d7ca0: 0x64a9e97c79038eaf 0x8fa11acf790898b6\n0x5585d30d7cb0: 0xfa9712822e1f92f5 0x0be0a47e7c33794a\n0x5585d30d7cc0: 0x0f513f6dfa219683 0x7882a2fd7ad96f95\n0x5585d30d7cd0: 0x724103437a884352 0x38856f600ee9c153\n0x5585d30d7ce0: 0x34844c1c042e4031 0xa25072078f86d4b0\n0x5585d30d7cf0: 0x198ebf757f3ce869 0xc19a41f94296d3f4\n0x5585d30d7d00: 0x15253a9cd3916853 0x4e63ded01c521c71\n0x5585d30d7d10: 0xdd7320b7e2575f4c 0x27a5680626ba3a3b\n0x5585d30d7d20: 0x22126f89ee83b6aa 0x93ba54007bb31b86\n0x5585d30d7d30: 0x9223523b754a6398 0x41e09449d7b89bf9\n0x5585d30d7d40: 0xc88439c35bf3c9c0 0x3f2c59b8c9819aa8\n0x5585d30d7d50: 0x131cbfa7b1a189cd 0xb65edcd66c1bc99f\n0x5585d30d7d60: 0xf47c981edad2f0cb 0xdf8d4d2c96ddbeaa\n0x5585d30d7d70: 0x18574111ff0734ba 0xd0e93b5438cd4afc\n0x5585d30d7d80: 0x10d43fd61bdb8f22 0x738cf2854d70f45d\n0x5585d30d7d90: 0x0c674b0d4e824ddf 0x7038a38b2d798915\n0x5585d30d7da0: 0x32b6526eccbfdc96 0x180c079be4ac34e5\n0x5585d30d7db0: 0xc176bb77b22141d0 0xff21c2ae147d4f6a\n0x5585d30d7dc0: 0x8b40d6bdc6539848 0x697c85f228d8efe8\n0x5585d30d7dd0: 0x33b66e95c3ed31cf 0x1efd0b3d9134086b\n0x5585d30d7de0: 0x57f12eab85d92859 0xd3245da1f30da714\n0x5585d30d7df0: 0x9240e371486eba6a 0x01f700f3d54de9ef\n0x5585d30d7e00: 0x8a808614211c71a2 0x58c4d221bea647f7\n0x5585d30d7e10: 0xe3fa18751da412b9 0xd2c8a94ac4fbf865\n0x5585d30d7e20: 0x5391d799d97952c7 0x99401c7c531de610\n0x5585d30d7e30: 0xe21205f95344dc74 0x9f5cd417a6c932d5\n0x5585d30d7e40: 0x454af2c839aba3ec 0xdb874569a41f63c8\n0x5585d30d7e50: 0xb132e85219026d4c 0x914987fd87bfa10f\n0x5585d30d7e60: 0xd85443ea0d384fd5 0xaee9f5bc343a2cb0\n0x5585d30d7e70: 0xdfdcafdfb073856d 0x87a720c53d6cb449\n0x5585d30d7e80: 0xf1fcbb192e47a7e9 0x6acc3444a6899a26\n0x5585d30d7e90: 0xe5422a71e506487f 0x12f67f68a9287f7c\n0x5585d30d7ea0: 0x69591c316466a675 0xb3dda204b95e95c5\n0x5585d30d7eb0: 0xe0ea8a3644e502dc 0xb45fc87d020ca2df\n0x5585d30d7ec0: 0x68d94bfb134e512f 0xef0ceeded204d647\n0x5585d30d7ed0: 0x255880926e620233 0x81150acc3645cbbb\n0x5585d30d7ee0: 0x1420578d995054c2 0x8d5c569f6912a050\n0x5585d30d7ef0: 0x2aa8099da719ab76 0x187ee6a936e5b8a1\n0x5585d30d7f00: 0xfef5bd49ff67bbe5 0x35be16580484e123\n0x5585d30d7f10: 0x88e167bf8d8954e1 0x1f281cf3bb1b8f94\n0x5585d30d7f20: 0x9cfeadc52bf7683d 0xe697c68b320b00f3\n0x5585d30d7f30: 0xb49a9ee1014c880a 0x1d27e9b9e0cb95e0\n0x5585d30d7f40: 0xb0c0ebe0643d666c 0xd043ab92caec666f\n0x5585d30d7f50: 0xe78d9bb3e21509e2 0xaef674dab867dc5c\n0x5585d30d7f60: 0x717239a68a8d6eca 0x84963a2cb56fb0b5\n0x5585d30d7f70: 0xfec088b27b2983b4 0x66a1bc84321cf390\n0x5585d30d7f80: 0x190e3d7ae3b183c9 0xcfba36ba02d139ae\n0x5585d30d7f90: 0x21febf6acd388fb0 0x1050297a4c25e62f\n0x5585d30d7fa0: 0xd87277a697909755 0x7dd5d0f353aaa9cd\n0x5585d30d7fb0: 0x9f065a210b6dabb4 0x254519dc30782065\n0x5585d30d7fc0: 0x5839d3e7fa3a5fa8 0xd0e5d4c427a5eb85\n0x5585d30d7fd0: 0x7fc41886d9d97cd1 0x15abc186126a4dd8\n0x5585d30d7fe0: 0xafe07fee732e1e78 0x11c1dcea5dd1ee48\n0x5585d30d7ff0: 0xe6355800792cb2f7 0xd03e3f0c768b8981\n0x5585d30d8000: 0x3dd3c7fafef577b0 0x8c6947a4f38ae315\n0x5585d30d8010: 0xcda3d603ea9a2c55 0x9687e306e7c6f9cc\n0x5585d30d8020: 0x311553926e580edf 0x7dadc6d4824b4109\n0x5585d30d8030: 0xdf054e8c36ae5b4b 0xb59b19c580aed11d\n0x5585d30d8040: 0x56176eb9b970b869 0x5b1187e521eb2e25\n0x5585d30d8050: 0xfda241c8854f6e20 0xfa066cbc10e11b7d\n0x5585d30d8060: 0x012eb95dfd73bcc7 0xb947a7b386ca41c2\n0x5585d30d8070: 0x5edb248fae9f2949 0xf8aa78edba78ff77\n0x5585d30d8080: 0xe0518c83acfe6856 0x4bb4514b0fae6b15\n0x5585d30d8090: 0x200b16afeb6d1f5c 0xce46b789def043fe\n0x5585d30d80a0: 0x3d86fc1622c79511 0x181777325cbbb0ae\n0x5585d30d80b0: 0xc9e356b2c2a11f0c 0xba2bee9c1730fa35\n0x5585d30d80c0: 0x597f198044a6b75e 0x9eef2f0b6f6d3515\n0x5585d30d80d0: 0x464d678f4d750d27 0x5e19e83554f64bc1\n0x5585d30d80e0: 0xf6556f3383b9d0e1 0x51ee49d6fcd057ae\n0x5585d30d80f0: 0x2ac4b1dd650c2f11 0xa8eb62193e42bac8\n0x5585d30d8100: 0x53d1927e12bd857a 0xa1ac241ba241a4a4\n0x5585d30d8110: 0xa84c4379bf4fffbb 0x1696b001698c6568\n0x5585d30d8120: 0xe16f273ef8303293 0xc32c77a05b0a24a8\n0x5585d30d8130: 0x1365051799df7795 0xfb7f1ed32c9be6de\n0x5585d30d8140: 0x6d6bc8a0ac72376c 0x66df7e581ae69a4c\n0x5585d30d8150: 0x6e54926f40ed6141 0x592fc8c6a79cc1f7\n0x5585d30d8160: 0x2ee42a4c99bfd51f 0x0fc54c034d871b0f\n0x5585d30d8170: 0x3eb44e7f0d2b5202 0x155271d89fd82d79\n0x5585d30d8180: 0x0038a271af152d68 0xfcfa563735ef5607\n0x5585d30d8190: 0xf2ec405ba8f83da5 0x2b97e1aa248dbe21\n0x5585d30d81a0: 0x9485147aeafdf41b 0x60d91e17572e4295\n0x5585d30d81b0: 0x2794b129fc8db57b 0x3764b5790f142ad1\n0x5585d30d81c0: 0x306b2a1fea7e7b57 0xa987405704922e71\n0x5585d30d81d0: 0x49ce446b421999ea 0x5d70d72a98643390\n0x5585d30d81e0: 0x3bd019d7537d91f5 0x1367f5c0e6dc9d4a\n0x5585d30d81f0: 0x2e28dfd4585c4902 0x0fa74e98e4206a21\n0x5585d30d8200: 0x3272fed7bd9b7bd3 0xebaef603231f0392\n0x5585d30d8210: 0x1a425fb26e756a46 0x9d4b9acc47583e06\n0x5585d30d8220: 0x56a184287df2578e 0x3e1c84f1d56dbabe\n0x5585d30d8230: 0xce2649927140b807 0xaf34cad084d30660\n0x5585d30d8240: 0x628e6d1091740ffa 0x6dd1891275b8633d\n0x5585d30d8250: 0x517aef2ed6660c69 0x9239b567b502176e\n0x5585d30d8260: 0xf9e4d8caa6da304c 0xc6122f1d0d4b73d6\n0x5585d30d8270: 0x135ef7c95d073e48 0xfd86d03390d04393\n0x5585d30d8280: 0xc7d14a80390bbf90 0x37046a41a3ccf236\n0x5585d30d8290: 0xea1acc1444d3ab20 0x09eabdd48cc560f7\n0x5585d30d82a0: 0x31c339584dd552d0 0x26a448852aa27422\n0x5585d30d82b0: 0x3921e06f4bbbdfff 0x87269050ba0bf318\n0x5585d30d82c0: 0x5d883bcfb5609be6 0x89fa7a715b125a2f\n0x5585d30d82d0: 0x6c9339f1f11f200a 0x8ff853a27b30dd6c\n0x5585d30d82e0: 0x1f10f3941de9048c 0xb3b207cffb85cf11\n0x5585d30d82f0: 0x355cc1bd7a1cbeae 0xa902d8f833e553eb\n0x5585d30d8300: 0xf5a6f1efbb64fdc3 0x26224710101a4703\n0x5585d30d8310: 0x4d75cef87f1e1eac 0xa28160c4573a70a8\n0x5585d30d8320: 0x31f8d1dbeffb2a5d 0xba0948dd5fe23ed9\n0x5585d30d8330: 0x01ba314a41456a17 0x360445e880ef4205\n0x5585d30d8340: 0x71e9a9e3b56a6cae 0xd8c2818296196aa9\n0x5585d30d8350: 0x887ddff3ef02a94e 0xaa8749852295054f\n0x5585d30d8360: 0x0236defbca0d6894 0x3c4a3bed9f8d1103\n0x5585d30d8370: 0x86674921a8790830 0x618f0bdd70cc03a3\n0x5585d30d8380: 0x612f034c4c31138a 0x9282af9638e202f9\n0x5585d30d8390: 0xa20d0c4da7d79415 0x1cfc9752e3c5e7f8\n0x5585d30d83a0: 0xe85b9d0ee80a4e05 0x0321a818a55e2719\n0x5585d30d83b0: 0x4e36100c3ea67267 0xdc446344a8cf90b9\n0x5585d30d83c0: 0x356f35fb8bdb32f9 0x8be8467b2e86d3de\n0x5585d30d83d0: 0xa44f7cf911c6d230 0x736b56ef1733c293\n0x5585d30d83e0: 0x2ab7f483cdedfedc 0x9264e6b7ed8719c4\n0x5585d30d83f0: 0x21957be6d8f57213 0x1ae91942ba5f0a71\n0x5585d30d8400: 0x8f77187b468576aa 0x285b3e32e4adea36\n0x5585d30d8410: 0x827b1545621d7f6a 0x415d4b5fee62d41d\n0x5585d30d8420: 0xacd3244ad5548419 0x4027d8018998d9b5\n0x5585d30d8430: 0xa5240eef0c0758d3 0x7c859c7fb28168f8\n0x5585d30d8440: 0x175bc6c6bdb4224f 0x84f55e9dd553f892\n0x5585d30d8450: 0x451fa4bf96a7b757 0x25743d9a01ff6c94\n0x5585d30d8460: 0xcfec25711ee5c2af 0x2fefc4f15aeeca8f\n0x5585d30d8470: 0x7ac3070f984df4d6 0xffc7290b4ef16d3f\n0x5585d30d8480: 0x0d14705fc53e92fa 0x262fc09d207032be\n0x5585d30d8490: 0x838b24fa43eb0a8a 0x8fb858a57b845dff\n0x5585d30d84a0: 0x720e94db4606e361 0x7d0dbe1fa3aad87c\n0x5585d30d84b0: 0x35bcddd042f345d7 0x38b00e3bc6d16838\n0x5585d30d84c0: 0xb9ce8d61b0f09e95 0x92a0192ecbdba086\n0x5585d30d84d0: 0x6dcaa93d8e96ef74 0xe1fc008afd4e05e0\n0x5585d30d84e0: 0xe74558490754adf5 0xf7461d0cc8e6cb23\n0x5585d30d84f0: 0xa6260216daa5e197 0x50a27c1bb2010ae9\n0x5585d30d8500: 0x1995aa01dea967b5 0xea253e8a58ac4ae9\n0x5585d30d8510: 0xd9d806a7ac991b41 0x8307080c77c58b90\n0x5585d30d8520: 0x3f35d35bbd04e201 0x7a20d044c68fc60a\n0x5585d30d8530: 0x387734835ab5bca5 0xca97d5e7076f48a1\n0x5585d30d8540: 0xe6cd1027d15c75ea 0x829c05f2b83b84cc\n0x5585d30d8550: 0x0820b26e4710612c 0x5455efd93a8fd26d\n0x5585d30d8560: 0x260768402bf5bc90 0x60ca21b1aa01558a\n0x5585d30d8570: 0xdfe623f2c3ecf467 0xc8d4bc80e216d1d2\n0x5585d30d8580: 0x78120d4b7205561d 0x192e1d1b61b16c9e\n0x5585d30d8590: 0x240cec29cf6ac7a2 0x1428a1d98964d270\n0x5585d30d85a0: 0x00e6e895421897a1 0xa75435ba290cbfbd\n0x5585d30d85b0: 0x02c531951c8f37bb 0x9d6c00d4bbfb84a2\n0x5585d30d85c0: 0x80b642d63c38fd17 0x5427b91833be6985\n0x5585d30d85d0: 0x2b3a8066a2de199a 0x648d453ba639a1a0\n0x5585d30d85e0: 0x162799261f96c3f7 0x756dbf4356298d94\n0x5585d30d85f0: 0x5e97f32b9c18711a 0x841d59c60ff1d1e7\n0x5585d30d8600: 0x0501fba5ea8e50c1 0x519977055381fe8c\n0x5585d30d8610: 0xe7897beb52234c68 0x330fc14f7fc48244\n0x5585d30d8620: 0xc99a2cccc7609160 0x77e60130457c8c4f\n0x5585d30d8630: 0x448493d9e1b83cbd 0x9fb1100e6669b180\n0x5585d30d8640: 0xe85667edb3b951e0 0xc777ece82e2f4072\n0x5585d30d8650: 0xc20244c3a3d20564 0x34c91ff6363bb221\n0x5585d30d8660: 0x6cf63e81d3dfe080 0x73573d5d2e364d29\n0x5585d30d8670: 0xd8d24bb95ae8e88e 0xb34eb0338bc768da\n0x5585d30d8680: 0xd5b4d62afe3710e6 0x51de453413b6d7de\n0x5585d30d8690: 0xa3c2750d12cf831f 0x0b0e73325678840e\n0x5585d30d86a0: 0x5f8273cad367fd99 0x701f937a45f1ada7\n0x5585d30d86b0: 0x1a91b2f8f81f6763 0xfc9c15e2c53215f5\n0x5585d30d86c0: 0x787981b1d3719ead 0x7f43d514f69cfbbe\n0x5585d30d86d0: 0x09667a731d0b4bbe 0x8c1de1ed9b1652ee\n0x5585d30d86e0: 0x7284a7dac2a1f4cc 0x8d478255340ac16e\n0x5585d30d86f0: 0x76975f954613d750 0x2b4bcfcddde7a057\n0x5585d30d8700: 0x77d78d02ce684b13 0xea84baac43f68f8e\n0x5585d30d8710: 0x55ff53454bde05f2 0x63505ca5d77d3381\n0x5585d30d8720: 0xbac62381abde1180 0xd6f63eb1c6dc174b\n0x5585d30d8730: 0x573756dd4a632ff3 0xe2d5949ee4d54fc5\n0x5585d30d8740: 0x13e7097135e67f62 0x0c08fb459b93ca7b\n0x5585d30d8750: 0x7fd2f47f9e7f65b1 0xa6df78c66e062926\n0x5585d30d8760: 0x29cd97d668e438fd 0xfe5321daf7bd40ab\n0x5585d30d8770: 0x96fad01bb60e8276 0x6a6811db19500f36\n0x5585d30d8780: 0xc1f257fd73ed5a85 0x907ee524e8ac0316\n0x5585d30d8790: 0x4eece4f5d0c72a0e 0x58cb3ee3c63e3871\n0x5585d30d87a0: 0xf21552bfd854cc3f 0xdbf29ed73810187c\n0x5585d30d87b0: 0xbcc2efc1a6ab09a2 0xb17b1e8466c80aa0\n0x5585d30d87c0: 0xd389ae6ddd0478f8 0xb632d3de5b688b66\n0x5585d30d87d0: 0x050d8333fd338914 0xf6efa5fcdfc5712f\n0x5585d30d87e0: 0x7b3fab6793953809 0xdc9800da56566dcc\n0x5585d30d87f0: 0x084cd939aa3ba2bc 0xfba0b9f2ce19c7b5\n0x5585d30d8800: 0x17ba99c1365956bf 0xfd07dea8d814aa59\n0x5585d30d8810: 0x23430f8843d071ee 0x1aa318e61cbb5c1b\n0x5585d30d8820: 0x658e6efe969c4ea2 0x2ec719fae66abc61\n0x5585d30d8830: 0x7760f8f57212cb2d 0x1dc5620b761feffc\n0x5585d30d8840: 0xe8c5edc5b96f2372 0x1347e8204cad079d\n0x5585d30d8850: 0x05934e0212402596 0x46d8c153ba7c8929\n0x5585d30d8860: 0xe876d14e3a3d1c45 0x23204ec134817d85\n0x5585d30d8870: 0x9b5cd4ed8cbce369 0x46d37d6d16e5b47a\n0x5585d30d8880: 0x2df6db5d02826d54 0xa5e89b3899dd6079\n0x5585d30d8890: 0x5d066a574cd5dfa3 0xc303e664810e6741\n0x5585d30d88a0: 0xd3bd309be31050e1 0xb31eb4063f9506f8\n0x5585d30d88b0: 0xb2b10af4d2d51b94 0xf1c0914a473e6651\n0x5585d30d88c0: 0x98a1639d184ae68f 0xda3b2fde51b7efae\n0x5585d30d88d0: 0x6659ac01c03b28a9 0xa0b1c7c6aa3ca86e\n0x5585d30d88e0: 0xce8956bc7c1afd80 0xe8c3f3d46ce85bc1\n0x5585d30d88f0: 0xe414c51fa25a0500 0xd814ef489c746141\n0x5585d30d8900: 0xea1bc065db48f012 0x565e493f7cfb0cd0\n0x5585d30d8910: 0x2b500677ff40f1e3 0x1f5a8b59993bffa0\n0x5585d30d8920: 0x1414c95000ab5165 0x21cafcd68910f494\n0x5585d30d8930: 0x7dbef994994ec65e 0xa74533c21f26dfad\n0x5585d30d8940: 0xd725bd8f285ee40d 0xfb2de0c3459dc685\n0x5585d30d8950: 0xc065709d7945e182 0xfc6df3c79eeda7fc\n0x5585d30d8960: 0x65c49c3f76d192a1 0xde0082a4cf4d469a\n0x5585d30d8970: 0xd1b095052891b014 0xcd56a6ea336a09df\n0x5585d30d8980: 0x86d15839f1986686 0x3883a724e2bf5d0f\n0x5585d30d8990: 0xbd3c1afd1c90dedd 0xa215e9de5aaeac8b\n0x5585d30d89a0: 0xcbcf20d234544383 0xe8cb016907e5d6a7\n0x5585d30d89b0: 0x3315b1ff92edb550 0x713c677493c78b5c\n0x5585d30d89c0: 0xe5e934c03056f20c 0x3172afd585d11e34\n0x5585d30d89d0: 0xcbd0bb03c20dc14e 0x45afc95bb08c71b7\n0x5585d30d89e0: 0xf34bb47a7199d5d5 0xa293916ec49700a4\n0x5585d30d89f0: 0x9429fb4e99bd13a7 0xb76f3aa00bf6e4b4\n0x5585d30d8a00: 0x23396525e3b082d7 0x67edbbb1a40db447\n0x5585d30d8a10: 0xaccd9242e976d8e3 0x3cdf0c04bed51a39\n0x5585d30d8a20: 0x1d2610c0a6a0a2d4 0x9fda31758c9dc9b4\n0x5585d30d8a30: 0xea340e37a7655d31 0x656a7c83c7ebd649\n0x5585d30d8a40: 0x82b3b7dacddde2d0 0x96a1b4f8442ce3c4\n0x5585d30d8a50: 0x1f906a20843829a5 0x67578cfd69585621\n0x5585d30d8a60: 0x891c3b75273c4a98 0xa9323db697c23ad7\n0x5585d30d8a70: 0x9fd9ec2ce6c6bfc6 0x52a9c479ca7a854b\n0x5585d30d8a80: 0xc16eb39bf2989c48 0x25cd77824cae73dd\n0x5585d30d8a90: 0x1a6bb0fec31549e4 0xca447bf1cd510b5a\n0x5585d30d8aa0: 0xd8b1d0f94b96ab2c 0xfb314ab16660e57b\n0x5585d30d8ab0: 0xbe85d66e3888ebda 0xcaf013ebc83a48b8\n0x5585d30d8ac0: 0x0abb853d85895ceb 0xa1f15001c23bc975\n0x5585d30d8ad0: 0xdfcaae7ae74bc3d6 0x7636fef5b286dc6d\n0x5585d30d8ae0: 0x4eaa11d6f4d6139a 0x046a0fd8783f2af7\n0x5585d30d8af0: 0x958754d321e886f4 0x6d1f6e40c2010f61\n0x5585d30d8b00: 0xbce6b065e2c91fce 0x636f61a4a9351c70\n0x5585d30d8b10: 0x6a579100b6ad30a1 0xd583314625d5da8c\n0x5585d30d8b20: 0x70b6c85a6163bb15 0x95e60536c329ffb3\n0x5585d30d8b30: 0x78e2bdcbe9de0726 0x6ad25a530f30bac7\n0x5585d30d8b40: 0x476049e69bf0bc14 0x94fda9c755397058\n0x5585d30d8b50: 0x9301bd67069ed57f 0x7d8793e5e673773e\n0x5585d30d8b60: 0xc46b3c86ed447ea0 0x83124df36a9270e5\n0x5585d30d8b70: 0x9c19ccda91191f55 0x851518b047e9416b\n0x5585d30d8b80: 0x7a1f605e073c8393 0x370174f1787e37d5\n0x5585d30d8b90: 0xc865254de84dece6 0x5bf068ac892b8e32\n0x5585d30d8ba0: 0x21e17fca52d75f6d 0xd17c71e5186e8adb\n0x5585d30d8bb0: 0x12cd7af1f5040d4f 0xc6be91eaa7f5632b\n0x5585d30d8bc0: 0x9998e769d33dfe78 0xf0ae1b2a3acc914f\n0x5585d30d8bd0: 0x1601232ff70adf46 0x86fb6a19e0e15dbc\n0x5585d30d8be0: 0x32762e046dc2a310 0x331ae745a0fd007b\n0x5585d30d8bf0: 0x6526a6dc7dec8195 0x1e78083eca0ae63a\n0x5585d30d8c00: 0x4ccc98ed9a510709 0x98b558a5312a3c58\n0x5585d30d8c10: 0x088daf7ae604dbcc 0xefaa6c07af12bded\n0x5585d30d8c20: 0xfe252fa8bc9ecb1f 0x0186315562aa2e19\n0x5585d30d8c30: 0x19c8e07a2884364d 0x62453c8c42c4d52d\n0x5585d30d8c40: 0xe2fb955daa9a221a 0x73f2a737da8d6a99\n0x5585d30d8c50: 0xeac2a6d804bff4e2 0x1c18c28de7222896\n0x5585d30d8c60: 0x6630c592a86603fe 0xba3d1d8af0ece587\n0x5585d30d8c70: 0x6bd17fbc0ae1f824 0xdc2fbde40a624b83\n0x5585d30d8c80: 0xfd5f4695593414e5 0x606b64a765f85a22\n0x5585d30d8c90: 0x2690ad2eca0b2624 0xce192a0bea9339ee\n0x5585d30d8ca0: 0x0c23bf21024355e7 0x52ba43948a2a372f\n0x5585d30d8cb0: 0xa7bedbe3aaaad653 0xdab21826fb7432e9\n0x5585d30d8cc0: 0x2cc4668ba1925430 0x48cf4ab4e5fee99f\n0x5585d30d8cd0: 0x2f08362a5c773f55 0x78d90c90747efc7c\n0x5585d30d8ce0: 0x459b923b3280717d 0x01c2314e8f0d40dd\n0x5585d30d8cf0: 0x0e10410f21222594 0x02888f8ae68e00de\n0x5585d30d8d00: 0x1ed516f6f5810de0 0x068f033f9525f965\n0x5585d30d8d10: 0x5728de185cf1d04b 0xf804706fe3f4103b\n0x5585d30d8d20: 0xd424ec6ed1a109f7 0x4aca0d1f7f512160\n0x5585d30d8d30: 0x61d5ef5d6b1f64c4 0x0085a13ace1fc2bb\n0x5585d30d8d40: 0xa3a87dafc5412928 0x017497fcdae824a5\n0x5585d30d8d50: 0xc3b85c45790b9bc2 0x3c218734816bf661\n0x5585d30d8d60: 0xd332dbf949e72a65 0x4a5795cf28980015\n0x5585d30d8d70: 0x3785479ba74b9ac0 0xfa160e5b7c1a7522\n0x5585d30d8d80: 0xa1410a5c15dbd36a 0x2d3c1bcc9188a015\n0x5585d30d8d90: 0x6539211965ae05f0 0xe9f2720912eea23a\n0x5585d30d8da0: 0x85496f4e32780a7f 0xbe12ac1c6a9a90e2\n0x5585d30d8db0: 0x249234e908fa97e2 0x9496e9fe82489ff5\n0x5585d30d8dc0: 0x4aee66a0c4043c5c 0x68c0db55f65ef5b1\n0x5585d30d8dd0: 0xb0ff60a962f706d4 0xb13ac1fa0da58ad6\n0x5585d30d8de0: 0xce8c2c9061e2aeea 0xe89abfc54381cc31\n0x5585d30d8df0: 0x5ac38665a55e15b0 0xbf801efff6e091a4\n0x5585d30d8e00: 0x0ffbd6b15bde8a86 0xbe480bf163d87779\n0x5585d30d8e10: 0x14d6d245897537db 0x106369c30e7dccff\n0x5585d30d8e20: 0x157dc88c257ecae7 0xe11689ebff3f88a9\n0x5585d30d8e30: 0x78d014df443cff59 0x4091601c53eac36e\n0x5585d30d8e40: 0x3f6ee00e7405947f 0xd7ef30231bafcc80\n0x5585d30d8e50: 0xbd4ea5e15f37fd81 0x79bfa02822b91ff0\n0x5585d30d8e60: 0x1038c6c6a4e433a9 0x5e03d436e7abc903\n0x5585d30d8e70: 0x0d1dcb2d5cd376f9 0x9734267c39ceea2e\n0x5585d30d8e80: 0x37e4b575f8974a53 0x4c9b3a9ac674200a\n0x5585d30d8e90: 0x163ab7df86e089f1 0x9c77e398342fefb4\n0x5585d30d8ea0: 0x9b5b9307188859b3 0x33a65b67c94a2dc1\n0x5585d30d8eb0: 0x931360fa7372c3ab 0xcc70e758fb3f7b87\n0x5585d30d8ec0: 0x6772dca7aeac125f 0x11e5541a79d8b0bb\n0x5585d30d8ed0: 0x77d8afea0c7e8458 0x84fd69af4811ed5c\n0x5585d30d8ee0: 0x2a2fe8f82b5f6bd5 0x9454e8de85cbd71a\n0x5585d30d8ef0: 0xa875a7b3da6b53dc 0xc41ca6504687cfcd\n0x5585d30d8f00: 0x8e82d547e2b9eb65 0xa1f99fb86efcac85\n0x5585d30d8f10: 0x2bae8499713ffe3e 0xa2a9585400415c22\n0x5585d30d8f20: 0xbc81af7b4839603a 0x17967a52a06090a6\n0x5585d30d8f30: 0xa45d88357a861436 0x8cb0c6ffa1fbf2a1\n0x5585d30d8f40: 0x7ecbbe6037cc4b3b 0x9b98e636a1fdaa2a\n0x5585d30d8f50: 0x99ca3c8d5797aae7 0xecbd639a10dce6ca\n0x5585d30d8f60: 0x968d030dfa270799 0xc3e724e6ebbb3cb9\n0x5585d30d8f70: 0x6ab5493cfefe375b 0xfa1812ef98f6ae90\n0x5585d30d8f80: 0xfe81bca8c084bed7 0xeb4b2b75a6e55158\n0x5585d30d8f90: 0xaff3e5970b50c61d 0x191e19cf92f317f3\n0x5585d30d8fa0: 0xa60fc6b790031f15 0x79b2cabd7e0b5368\n0x5585d30d8fb0: 0xf275888308077fa7 0x4e1a6ec5a21a3382\n0x5585d30d8fc0: 0x6b679329c4e0a432 0x5a0385f0c58b18f2\n0x5585d30d8fd0: 0xdd2ac1d04d58f9ce 0x526a4f358cb37d6d\n0x5585d30d8fe0: 0xd479f69eb203a1ad 0xe574b3fa7a2e5d74\n0x5585d30d8ff0: 0x6302c9c4400bd48d 0xa21cf1eca6409555\n0x5585d30d9000: 0xbe5cb728457de30b 0x542f580ed3e4a3a4\n0x5585d30d9010: 0x3d83d33378682271 0x974aa558e908908c\n0x5585d30d9020: 0x0b632b86b51c1329 0x5cf9bd0d75557d1f\n0x5585d30d9030: 0xff648287173081e1 0xb9365c72592d75be\n0x5585d30d9040: 0x2b46f73e172cd007 0x5c8bd41a90a2fbb9\n0x5585d30d9050: 0xb5790bd98c2e7026 0xd5b58f167de66b25\n0x5585d30d9060: 0x42b1de885002dc6b 0x7d72b4bab4486ccc\n0x5585d30d9070: 0x282b14501d09e721 0xff1361e3c5647a34\n0x5585d30d9080: 0xf0d92710e1d52d28 0x9060efd32f6bdb29\n0x5585d30d9090: 0x4c8f14d49af55ffb 0x0f57e6a07a2f334f\n0x5585d30d90a0: 0xe1cab2db2be04035 0x56421b23f8031e28\n0x5585d30d90b0: 0xac3933c6944d191c 0xea649fdd852964dd\n0x5585d30d90c0: 0xbc93cd2cf702fc94 0x2902b8783d3fbe41\n0x5585d30d90d0: 0x4dae72f6545ccdcb 0xd06b4c1940e59ff5\n0x5585d30d90e0: 0x96192430efedddd8 0x5575b0c238a79e65\n0x5585d30d90f0: 0x17caf4dc47d6871d 0x0d03ead96b948ea1\n0x5585d30d9100: 0xca9e1c7e3d4cfcc6 0x995d471ee9707a5b\n0x5585d30d9110: 0x348c71ad4e02a517 0x056174da5169804e\n0x5585d30d9120: 0x4e80701a90ae7aed 0x7bde1518876c30b3\n0x5585d30d9130: 0xcf0d2278d83a131b 0x0e8223e45fa2457c\n0x5585d30d9140: 0x301bbe36f17cdffd 0xb0f6639efc606105\n0x5585d30d9150: 0xcec022193e2f05d2 0x40d2f6d8cc4f17d3\n0x5585d30d9160: 0x7beb17a944bde322 0xb317ab69a5f32d5d\n0x5585d30d9170: 0xe098f80e478fb90d 0x8eb70b51c8ad8055\n0x5585d30d9180: 0x1935bdefed4b8113 0x11ab349afb6af145\n0x5585d30d9190: 0xb5ddfc6c5a9a40e2 0x095beba5318eb729\n0x5585d30d91a0: 0xfbae7bfe53fdcaf7 0x12184e78c7fdf86d\n0x5585d30d91b0: 0xf302f4c14434c50b 0x216068872abe4e2a\n0x5585d30d91c0: 0x25052e42b77684ad 0x0f78ece68d71ed92\n0x5585d30d91d0: 0xa35a56e4478b4562 0x88ae6ea73170916e\n0x5585d30d91e0: 0xcc7fc6d171a3925e 0x1a10a5f76aee7330\n0x5585d30d91f0: 0x63d52a619dc93661 0x616536cdda3e70a8\n0x5585d30d9200: 0xc666ea73569a9296 0x4b3d585ae32f3bb2\n0x5585d30d9210: 0x43c7a26a8b4d0ba4 0x772329115ecd7090\n0x5585d30d9220: 0x72ef01f28e2baa51 0xe5153a778f4d2684\n0x5585d30d9230: 0x7126d9a8f149a50c 0x68b5c3bbdcb93fb9\n0x5585d30d9240: 0x18dec6641b91cca0 0x2e26777e5e7237c3\n0x5585d30d9250: 0xf7d00e12d889d05a 0x1d89805feaeaf19a\n0x5585d30d9260: 0x4576c2de4d759c8d 0x9c9967491ea3e927\n0x5585d30d9270: 0x4cae8f2ed3544bb9 0x7e38f64b1dcb4f52\n0x5585d30d9280: 0xfa113c8fa54b3bab 0x37f580fec20cf383\n0x5585d30d9290: 0x828303a1f95c7081 0x1899e45ea93c2454\n0x5585d30d92a0: 0xc59a64f49ec63e4d 0xc42c518eb96a6e27\n0x5585d30d92b0: 0xcfe38aabeb1fa56f 0x6864c751b2cbeb8d\n0x5585d30d92c0: 0xd30bf1361eeeb768 0x466453237f9c283e\n0x5585d30d92d0: 0x6947bed1d35d350a 0x3adaff35e16be41d\n0x5585d30d92e0: 0xa053c7ea7735e465 0x0104a9431eb3cacb\n0x5585d30d92f0: 0x5044d0e1c9751007 0x250c0e33bbec15b5\n0x5585d30d9300: 0x8dbcb982dd3e8581 0xd07a939232799b4b\n0x5585d30d9310: 0x956a81786300a2b0 0xed5590ad6d70b3bc\n0x5585d30d9320: 0x56574f23d65678b9 0x213fc816aa0f4098\n0x5585d30d9330: 0xc892995120565f3b 0x2846350fd4c9dd6c\n0x5585d30d9340: 0xff46de2d4a1d72c9 0xbb497e980130076b\n0x5585d30d9350: 0xeea73c00f7ff4f8d 0x31f52c385af42310\n0x5585d30d9360: 0x5e8afedf173c6cec 0xec15e7e8af5707f3\n0x5585d30d9370: 0x309002f99b0e7bc5 0x0e56371c6192793f\n0x5585d30d9380: 0x1825c53ffd732acb 0x5d1aa603a9cbbcd2\n0x5585d30d9390: 0xa38c1d387d933031 0x407d8996eb8cc735\n0x5585d30d93a0: 0x58281e16e897555b 0xf89bfdc846aa225d\n0x5585d30d93b0: 0x8e13d1c0d130fd15 0x853e4267e657440a\n0x5585d30d93c0: 0x13a913a3d696b763 0xe4e596833a9a8c3f\n0x5585d30d93d0: 0x2f819310b06b3662 0xcda6ac6dfd3f26ac\n0x5585d30d93e0: 0x38e546349c502402 0xf520fdc427a5e11e\n0x5585d30d93f0: 0x9ba19c329fe912bc 0x87754974d0a0a524\n0x5585d30d9400: 0xa365980392ebe482 0xf990f22d8b4edfdf\n0x5585d30d9410: 0x18b179df1f3eb211 0x1e30771a69dd3426\n0x5585d30d9420: 0x7d0eb362de20fc84 0x891e4637d20d5ac0\n0x5585d30d9430: 0xab169a29fcea0d6e 0x493804379f92084c\n0x5585d30d9440: 0x5411c28357a7e2f4 0x5c191d9986b06934\n0x5585d30d9450: 0xc9bc7f53f249dff1 0xd11969dab029b42e\n0x5585d30d9460: 0x5e56eaf2b2da3bb7 0x845b5aec55d1b76a\n0x5585d30d9470: 0x4e5553db73f1afb5 0x2637ef02abc5c003\n0x5585d30d9480: 0xe5174960cb7db311 0x9bb3ce2a421811e6\n0x5585d30d9490: 0x697e44f7aa7ffb11 0xe61d8aef69186067\n0x5585d30d94a0: 0x1890cca92c7c3ce9 0xee2ca1fe56cdc045\n0x5585d30d94b0: 0xe6a9496ac8c11303 0x615c53055310b0cd\n0x5585d30d94c0: 0xe2f3f77088f247bc 0x3d26b046463bb55c\n0x5585d30d94d0: 0x45716c8097a33329 0x062f14235b6bb199\n0x5585d30d94e0: 0x363befdfcc83af10 0x03806feff4dc240a\n0x5585d30d94f0: 0x9504003e218a690f 0x4dcd483a5b2acee2\n0x5585d30d9500: 0xed7cba4018418c9e 0x03b47e871aa6c7ae\n0x5585d30d9510: 0x49b5f6023bcdb0f4 0x781adcf8de6cd76a\n0x5585d30d9520: 0x92f6fc5fd91be3d3 0x731af624d02bcaf8\n0x5585d30d9530: 0x734496129e9ecb87 0x5f47d10c70199b39\n0x5585d30d9540: 0xf5dfc3d009ded4dd 0xb481e2b329135fe3\n0x5585d30d9550: 0x3d3bc3cb27f7cbfd 0x26a003600526b632\n0x5585d30d9560: 0xd200917a6f4315d4 0x3ca82f93e9947d61\n0x5585d30d9570: 0xba46c0f5d4d8c368 0x2c2f8ef7d82c1e50\n0x5585d30d9580: 0x197220aa1c8df910 0x776bf511cd38bbe8\n0x5585d30d9590: 0x9b76a8e8c5b2b984 0xf01fc03ab848669d\n0x5585d30d95a0: 0x5496fe005fa84cd6 0x70e235a8eec66a11\n0x5585d30d95b0: 0xfc472238ead88695 0x4219101665ce9218\n0x5585d30d95c0: 0xc3fcbdb996e373f1 0xcee102595cd0d66f\n0x5585d30d95d0: 0x745acf4efbb42c10 0x389f3cd2bf4e24dc\n0x5585d30d95e0: 0x315d3dcbc65f5d78 0xa98cb50185094ef3\n0x5585d30d95f0: 0x6c9f012c7722bf23 0x3aa77888d30efac4\n0x5585d30d9600: 0x0a2d04ef8f87fe6d 0xb2ea2d4953b01f77\n0x5585d30d9610: 0xadd1d4cc6bb6de73 0xe71f59ce82751f6a\n0x5585d30d9620: 0xf4bb1c4ba8c8a142 0xb3ece1e4c7147438\n0x5585d30d9630: 0x9851e6dbb34b98bc 0xe319e361526ed218\n0x5585d30d9640: 0x047ff1bf270e5286 0x3a8d2da4d813ff76\n0x5585d30d9650: 0x55cce854cdcc13c1 0x70a0649830c4a287\n0x5585d30d9660: 0x3f4d9195dec0dcfa 0x9a3ab00a80be8f2a\n0x5585d30d9670: 0xfb94e629b7de5ec6 0x287c22d5e1c92530\n0x5585d30d9680: 0x62206f7b536f50d7 0x7ef9f3f1ce717552\n0x5585d30d9690: 0xebc3c953dc061d75 0x03852969adf5ba64\n0x5585d30d96a0: 0xe7045f07144481b9 0x92168f186f6e65e2\n0x5585d30d96b0: 0x3553a2c6f22ca596 0x76a839fc5b220686\n0x5585d30d96c0: 0xd651f9e1dd1e5ac4 0x1ebfedfea30afa52\n0x5585d30d96d0: 0xabea6c1b0ffa5719 0xb9358b58402932af\n0x5585d30d96e0: 0x2dda014c97b0677f 0x6c04c8b28c0d839a\n0x5585d30d96f0: 0xd81580a4dc09fb8c 0x6923035e9f7d61d2\n0x5585d30d9700: 0xd7473f7e62112e84 0xd3fa38316a094d1a\n0x5585d30d9710: 0x0c2bf97aec2ab89b 0x8a768a57e95d4fc1\n0x5585d30d9720: 0x42d30ca8d2dec164 0xe8f5d46b9c95b726\n0x5585d30d9730: 0xddecaa3a43e26a17 0x0e70b33e84913854\n0x5585d30d9740: 0x1e465495044f1a45 0x2746d8b83282b89b\n0x5585d30d9750: 0xe0ae24877470e0fd 0x153dfb54d0e755d4\n0x5585d30d9760: 0x9da317b0c7452871 0x4a4bdef07dcd8c3c\n0x5585d30d9770: 0x852375df5072c7f7 0x2119d27a4fb4c53f\n0x5585d30d9780: 0x4486a2d62c146f50 0x82f7f796f555607b\n0x5585d30d9790: 0x20b0db2616bc1990 0x48ee005b08d24914\n0x5585d30d97a0: 0x44e3a16c3f3d8bef 0x86323dc6abe9ceb5\n0x5585d30d97b0: 0xcbaaaf19f7f69fe0 0xd3aaae1a63d7b57f\n0x5585d30d97c0: 0x125b6f5433a94d22 0x7a0e2bda5ce938bf\n0x5585d30d97d0: 0xeb1a15755e8c748a 0x764faef64e329462\n0x5585d30d97e0: 0xa020759141b87564 0x82278eb2f6cf62ad\n0x5585d30d97f0: 0xa7b5b7f01c94488c 0x4249c309a5fef727\n0x5585d30d9800: 0x2a35db349688b2d1 0x250f1c0a81ad47f4\n0x5585d30d9810: 0xbc040fcf95372d8b 0x611e611f04b4fe78\n0x5585d30d9820: 0xb810e819517bbcbb 0x742470d22c7d9bce\n0x5585d30d9830: 0x8ba9a2660f080967 0x9299710bc2182764\n0x5585d30d9840: 0xa55f19dff748b2d9 0xa7d0269cf131b5b0\n0x5585d30d9850: 0xe16bce5c9b7f646f 0xe1eb349baea50843\n0x5585d30d9860: 0x6d3b676f30c8071c 0x7673320ec6d4b0a0\n0x5585d30d9870: 0x1b6efe2455bc28e0 0xedf8e2033be09ee9\n0x5585d30d9880: 0x9266fb917b668e36 0xf6c244f9cc752ab8\n0x5585d30d9890: 0x4579d8546bbb93e7 0xcc253e5e19c05b8a\n0x5585d30d98a0: 0xcb6158471867109d 0xf07b4a56089d4b01\n0x5585d30d98b0: 0x4d623c2ad0d7facf 0xc4795ea2ecf3a669\n0x5585d30d98c0: 0xf3626d6f10ca8520 0x85bf809d8f730fa4\n0x5585d30d98d0: 0xb231b711d2a19f40 0x4403e1d78a78cee8\n0x5585d30d98e0: 0x73bfab424225c8e1 0xb96afc987ecf815e\n0x5585d30d98f0: 0xf764b2debeee33b3 0x43f225c4e75e0412\n0x5585d30d9900: 0x95a638a8e8fbedbb 0xdb59745003b819a6\n0x5585d30d9910: 0xbf8497d2f888f9e8 0xe70069a64e559fe6\n0x5585d30d9920: 0x3221166c14c21a22 0x2782d8c284a29d67\n0x5585d30d9930: 0xfe7b7c6661b6a31a 0xd1097828de61ac75\n0x5585d30d9940: 0x763df727ce75b8cb 0xca2188e9d4ab4354\n0x5585d30d9950: 0x12e063a58fb61d38 0x1a91ba728ca04b1e\n0x5585d30d9960: 0x968e47063f310228 0xe575a6de79434f48\n0x5585d30d9970: 0x115563c832185d3b 0x46066f9b155108cd\n0x5585d30d9980: 0x235f5e853d570e03 0x5c41169a7cd0925c\n0x5585d30d9990: 0x1cd8f1bbe70e074d 0x9c3a801500441cfb\n0x5585d30d99a0: 0x0fa84fb0bf3afd1f 0x232869fc8d3984e3\n0x5585d30d99b0: 0xbb314d84718ec6b4 0x4b637693c53b6f31\n0x5585d30d99c0: 0xae4a4d59b0fc2ac9 0xb2d7ac332678b999\n0x5585d30d99d0: 0x5f8fbd3c906894f2 0x3ab59fa7406192ec\n0x5585d30d99e0: 0x4e5c363c6ecf3795 0x053655678acc3e6c\n0x5585d30d99f0: 0xc6efcd657c5cf837 0x1e57b67f4040ad80\n0x5585d30d9a00: 0x8d979d46c857f5ca 0x59ec3f7cdda84281\n0x5585d30d9a10: 0x828c668d5a75daf6 0x4d6fe93e36d70ada\n0x5585d30d9a20: 0x08ed879bffe6c195 0x8d85ca87be939c04\n0x5585d30d9a30: 0x1ed483471b093d23 0x6e3a8ea99421a82e\n0x5585d30d9a40: 0x7a55a74700ffcb9c 0x4969441a0a054bc4\n0x5585d30d9a50: 0xf3b8cd452d4993b3 0x39e63588bb7030d6\n0x5585d30d9a60: 0x8a40b7608004485f 0xc690500fd88227d2\n0x5585d30d9a70: 0x213d4ee26bacaef6 0x6ceb15a58e8199ca\n0x5585d30d9a80: 0xc2d731c1545617ff 0x9c36d248dbcf7413\n0x5585d30d9a90: 0x0a3922fc8b1f19aa 0x049b3bdb840c13e3\n0x5585d30d9aa0: 0xc1c77f326c95ad4c 0xef0df4de1a3334cc\n0x5585d30d9ab0: 0xf01f1fcab2aef3ee 0xa3b8bfc2d2323b10\n0x5585d30d9ac0: 0x2ba2b8e57a157339 0x0db8d4e3b53f547e\n0x5585d30d9ad0: 0xe180c10eb0d5707a 0xb7a939e060f9233d\n0x5585d30d9ae0: 0x8595f3bdcaf65da4 0x562bf4f2f28665c4\n0x5585d30d9af0: 0x1723b29955104835 0xbbc6248afad14f41\n0x5585d30d9b00: 0x58f43d98be1477ab 0x28e051c8b6c8c15f\n0x5585d30d9b10: 0x01c7af69a5e8fd49 0xc3dff1152ea3155e\n0x5585d30d9b20: 0xc628bc72a298c34b 0x030442fa026ad428\n0x5585d30d9b30: 0x50299486ce1b24b0 0x42ae6bbb708efc7a\n0x5585d30d9b40: 0x8efb0b5635cfd9e4 0xf07d506dc9cb085f\n0x5585d30d9b50: 0x858939f3fab9635e 0x52d4152a6fead8ed\n0x5585d30d9b60: 0xd6dda4727cc18dd5 0xd703b90205aad540\n0x5585d30d9b70: 0xa8f531f4beeaacd5 0x52b6a9ea3ba96399\n0x5585d30d9b80: 0x522695143740b9c3 0x81487f8518c39f82\n0x5585d30d9b90: 0xa7f1bebbd11d2990 0xd6d8070b95b1a491\n0x5585d30d9ba0: 0x30aaf5021d9da3c6 0xc2bd6123ce80568b\n0x5585d30d9bb0: 0xd686d08de685b551 0xcb5568746c1bdd17\n0x5585d30d9bc0: 0xf2493c7bfe359420 0xde466714e9af387e\n0x5585d30d9bd0: 0xe189940b202a21d9 0x3db53d91141902b0\n0x5585d30d9be0: 0xaa91809521b7d87c 0xca1a1d09dbc5260d\n0x5585d30d9bf0: 0x3323faab8a69a422 0xb44641b410e19c6e\n" }) }), "\n", _jsxs(_components.p, { children: ["I tried using both the keys as-is in order to decrypt ", _jsx(_components.code, { children: "data.enc" }), " file by formatting the hex into base64 and then adding the appropriate header and trailer in a .pem file but it didn't work. So, we need to understand what the 'shielding' means. For this, I found these resources:"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsx(_components.li, { children: _jsx(_components.a, { href: "https://security.humanativaspa.it/openssh-ssh-agent-shielded-private-key-extraction-x86_64-linux/", children: "https://security.humanativaspa.it/openssh-ssh-agent-shielded-private-key-extraction-x86_64-linux/" }) }), "\n"] }), "\n", _jsx(_components.p, { children: "So, shielding means that the private key is stored encrypted even in memory. However, the key used to encrypt it is also stored in memory so that we can get the key and decrypt it ourselves. This key is the 'prekey'." }), "\n", _jsxs(_components.p, { children: ["I tried using the ", _jsx(_components.code, { children: "sshkey_unshield_private()" }), " function and the ", _jsx(_components.code, { children: "sshkey_save_private()" }), " in my own way to try and decrypt it; I also tried using the script and some other stuff but none of that worked. I tried placing the blobs into the memory of a debug session of ", _jsx(_components.code, { children: "ssh-agent" }), " (script is in ", _jsx(_components.a, { href: "https://github.com/Zaxeli/NSA-CBC-2022/blob/main/task_5/gdb_script.py", children: "python file" }), ") and then calling the functions ", _jsx(_components.code, { children: "sshkey_unshield_private" }), " and ", _jsx(_components.code, { children: "sshkey_save_private_blob" }), ". Some resources about using python scripts for gdb:"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsx(_components.li, { children: _jsx(_components.a, { href: "https://stackoverflow.com/questions/4060565/how-to-script-gdb-with-python-example-add-breakpoints-run-what-breakpoint-d", children: "https://stackoverflow.com/questions/4060565/how-to-script-gdb-with-python-example-add-breakpoints-run-what-breakpoint-d" }) }), "\n", _jsx(_components.li, { children: _jsx(_components.a, { href: "https://sourceware.org/gdb/current/onlinedocs/gdb/Basic-Python.html#Basic-Python", children: "https://sourceware.org/gdb/current/onlinedocs/gdb/Basic-Python.html#Basic-Python" }) }), "\n"] }), "\n", _jsx(_components.h3, { children: "Decrypting the shielded private key" }), "\n", _jsx(_components.p, { children: "I have to then understand how the prekey is used, which encryption was used, and how the shielded private key is decrypted in the source code." }), "\n", _jsxs(_components.blockquote, { children: ["\n", _jsx(_components.p, { children: "I also asked in 'Get Help' and got the advice that I should try reimplementing the algo myself and that it should be simple." }), "\n"] }), "\n", _jsxs(_components.p, { children: ["In order to understand how the shielded private key is decrypted using the prekey, let's look at the source code for the ", _jsx(_components.code, { children: "sshkey_unshield_private(struct sshkey *k)" }), " function in ", _jsx(_components.a, { href: "https://github.com/openssh/openssh-portable/blob/25c8a2bbcc10c493d27faea57c42a6bf13fa51f2/sshkey.c", children: "sshkey.c" }), "."] }), "\n", _jsx(_components.p, { children: "Some important variables/definitions:" }), "\n", _jsxs(_components.ul, { children: ["\n", _jsx(_components.li, { children: _jsx(_components.code, { children: "u_char *cp, keyiv[SSH_DIGEST_MAX_LENGTH];" }) }), "\n", _jsx(_components.li, { children: _jsx(_components.code, { children: "#define SSH_DIGEST_SHA512\t4" }) }), "\n", _jsx(_components.li, { children: _jsx(_components.code, { children: "#define SSHKEY_SHIELD_PREKEY_HASH\tSSH_DIGEST_SHA512" }) }), "\n", _jsx(_components.li, { children: _jsx(_components.code, { children: "ssh_digest_bytes(SSHKEY_SHIELD_PREKEY_HASH) == 64 bytes" }) }), "\n", _jsx(_components.li, { children: _jsx(_components.code, { children: "#define SSH_DIGEST_MAX_LENGTH\t64" }) }), "\n", _jsx(_components.li, { children: _jsx(_components.code, { children: "#define SSHKEY_SHIELD_CIPHER\t\t\"aes256-ctr\" /* XXX want AES-EME* */" }) }), "\n"] }), "\n", _jsxs(_components.p, { children: ["Inside the ", _jsx(_components.code, { children: "sshkey_unshield_private(struct sshkey *k)" }), " function, it does some sanity checks and then it calculates the ephemeral key. As part of this, it first calls this function to get the digest:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "\t/* Calculate the ephemeral key from the prekey */\n\tif ((r = ssh_digest_memory(SSHKEY_SHIELD_PREKEY_HASH,\n\t k->shield_prekey, k->shield_prekey_len,\n\t keyiv, SSH_DIGEST_MAX_LENGTH)) != 0)\n" }) }), "\n", _jsxs(_components.p, { children: ["The result is stored into the ", _jsx(_components.code, { children: "keyiv" }), " variable. The function header with the parameters looks like this (defined in ", _jsx(_components.a, { href: "https://github.com/openssh/openssh-portable/blob/2dc328023f60212cd29504fc05d849133ae47355/digest-openssl.c", children: _jsx(_components.code, { children: "digest-openssl.c" }) }), "):"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "int\nssh_digest_memory(int alg, const void *m, size_t mlen, u_char *d, size_t dlen)`\n" }) }), "\n", _jsx(_components.p, { children: "and within it, it initialises the digest:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "const struct ssh_digest *digest = ssh_digest_by_alg(alg);\n" }) }), "\n", _jsxs(_components.p, { children: ["The argument that was given for the algorithm was ", _jsx(_components.code, { children: "SSHKEY_SHIELD_PREKEY_HASH" }), " which was defined as ", _jsx(_components.code, { children: "SSH_DIGEST_SHA512" }), ". In this same file, it also has a struct for the different algorithms:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "/* NB. Indexed directly by algorithm number */\nconst struct ssh_digest digests[] = {\n\t{ SSH_DIGEST_MD5,\t\"MD5\",\t\t16,\tEVP_md5 },\n\t{ SSH_DIGEST_SHA1,\t\"SHA1\",\t\t20,\tEVP_sha1 },\n\t{ SSH_DIGEST_SHA256,\t\"SHA256\",\t32,\tEVP_sha256 },\n\t{ SSH_DIGEST_SHA384,\t\"SHA384\",\t48,\tEVP_sha384 },\n\t{ SSH_DIGEST_SHA512,\t\"SHA512\",\t64,\tEVP_sha512 },\n\t{ -1,\t\t\tNULL,\t\t0,\tNULL },\n};\n" }) }), "\n", _jsx(_components.p, { children: "So, the algorithm which gets used is SHA-512." }), "\n", _jsxs(_components.p, { children: ["Now, the function ", _jsx(_components.code, { children: "ssh_digest_memory" }), " stores the resulting digest into the ", _jsx(_components.code, { children: "d" }), " param, (the argument was ", _jsx(_components.code, { children: "keyiv" }), "). It calls ", _jsx(_components.code, { children: "EVP_Digest" }), " for it."] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "if (!EVP_Digest(m, mlen, d, &mdlen, digest->mdfunc(), NULL))\n\t\treturn SSH_ERR_LIBCRYPTO_ERROR;\n" }) }), "\n", _jsxs(_components.p, { children: ["Back in the ", _jsx(_components.code, { children: "sshkey_unshield_private" }), " function, after calculating the digest, it initialises the cipher:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "\tif ((r = cipher_init(&cctx, cipher, keyiv, cipher_keylen(cipher),\n\t keyiv + cipher_keylen(cipher), cipher_ivlen(cipher), 0)) != 0)\n" }) }), "\n", _jsxs(_components.p, { children: ["The function is declared like this in ", _jsx(_components.a, { href: "https://github.com/openssh/openssh-portable/blob/800c2483e68db38bd1566ff69677124be974aceb/cipher.c", children: _jsx(_components.code, { children: "cipher.c" }) }), ":"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "int\ncipher_init(struct sshcipher_ctx **ccp, const struct sshcipher *cipher,\n const u_char *key, u_int keylen, const u_char *iv, u_int ivlen,\n int do_encrypt)\n" }) }), "\n", _jsxs(_components.p, { children: ["So, here we see that the parameters are separate for the ", _jsx(_components.code, { children: "key" }), " and the ", _jsx(_components.code, { children: "iv" }), ". However, the arguments given are both using ", _jsx(_components.code, { children: "keyiv" }), ". The param and argument correspond like this:"] }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: ["param ", _jsx(_components.code, { children: "key" }), ": argument ", _jsx(_components.code, { children: "keyiv" })] }), "\n", _jsxs(_components.li, { children: ["param ", _jsx(_components.code, { children: "keylen" }), ": argument ", _jsx(_components.code, { children: "cipher_keylen(cipher)" })] }), "\n", _jsxs(_components.li, { children: ["param ", _jsx(_components.code, { children: "iv" }), ": argument ", _jsx(_components.code, { children: "keyiv + cipher_keylen(cipher)" })] }), "\n", _jsxs(_components.li, { children: ["param ", _jsx(_components.code, { children: "ivlen" }), ": argument ", _jsx(_components.code, { children: "cipher_ivlen(cipher)" })] }), "\n"] }), "\n", _jsxs(_components.p, { children: ["The ", _jsx(_components.code, { children: "cipher_keylen(cipher)" }), " and ", _jsx(_components.code, { children: "cipher_ivlen(cipher)" }), " values I found by breaking at the function and then looking at the arguments. The ", _jsx(_components.code, { children: "keylen" }), " is 32 and the ", _jsx(_components.code, { children: "ivlen" }), " is 16. SHA-512 has a digest size of 64 bytes. So, the first 32 bytes of the SHA-512 digest of the prekey are the key and the next 16 bytes are the IV, the remaining 16 bytes are not used."] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pwndbg> i args\n\tccp = 0x7fffffffd120\n\tcipher = 0x5555555d5170 \n\tkey = 0x7fffffffd1e0 \"\\326\\\"{BCs\\357\\n\\211\\332\\002\\257̽\\266}\\253\\004\\346\\310\\344\\250\\376\\232\\307\\v9\\314U\\326\\030`A}!\\360j\\266g\\274\\064\\251\\217/Ъ\\243\\353(f>\\214m\\037\\364\\307\\003p\\315}IƎ\\233\"\n\tkeylen = 32\n\tiv = 0x7fffffffd200 \"A}!\\360j\\266g\\274\\064\\251\\217/Ъ\\243\\353(f>\\214m\\037\\364\\307\\003p\\315}IƎ\\233\"\n\tivlen = 16\n\tdo_encrypt = 0\n" }) }), "\n", _jsxs(_components.p, { children: ["We now have the key and iv for the cipher, but we need the encryption scheme. Earlier in the ", _jsx(_components.code, { children: "sshkey_unshield_private" }), " function, around where it does the sanity checks, it also executes the segment below. The ", _jsx(_components.code, { children: "cipher_by_name" }), " function is defined in ", _jsx(_components.a, { href: "https://github.com/openssh/openssh-portable/blob/800c2483e68db38bd1566ff69677124be974aceb/cipher.c", children: _jsx(_components.code, { children: "cipher.c" }) }), " and it returns the ", _jsx(_components.code, { children: "sshcipher *" }), " for the cipher specified as a string. Here, the argument given is ", _jsx(_components.code, { children: "SSHKEY_SHIELD_CIPHER" }), " which is a macro defined for ", _jsx(_components.code, { children: "aes256-ctr" }), ". So, the scheme is AES-256 using CTR mode."] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "\tif ((cipher = cipher_by_name(SSHKEY_SHIELD_CIPHER)) == NULL) {\n\t\tr = SSH_ERR_INVALID_ARGUMENT;\n\t\tgoto out;\n\t}\n" }) }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "#define SSHKEY_SHIELD_CIPHER\t\t\"aes256-ctr\" /* XXX want AES-EME* */\n" }) }), "\n", _jsx(_components.p, { children: "Now, we can have everything we need to try and decrypt the shielded private key. Let's try to decrypt it using AES-256 in CTR mode with the key and IV derived from the first 32 and 16 bytes of the SHA-512 digest of the shield prekey." }), "\n", _jsxs(_components.p, { children: ["I wrote a script for this which is in ", _jsx(_components.a, { href: "https://github.com/Zaxeli/NSA-CBC-2022/blob/main/task_5/x.py", children: "x.py" }), ". The snippet which does this is this:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "ctr = Counter.new(ivlen *8, initial_value=int(iv.hex(),16))\ncipher = AES.new(key=key, mode=AES.MODE_CTR, counter=ctr)\n\nout_bytes = cipher.decrypt(shielded_private_bytes)\n" }) }), "\n", _jsx(_components.p, { children: "I outputted the decrypted private key as bytes, base64 and as a string." }), "\n", _jsxs(_components.p, { children: ["I then tried to output this decrypted private key into base64 format and add the header and trailer to form a .pem file and then use it to decrypt the ", _jsx(_components.code, { children: "data.enc" }), " file but it didn't work. There is still more to do..."] }), "\n", _jsxs(_components.blockquote, { children: ["\n", _jsx(_components.p, { children: "When using this didn't work, I was a bt confused about why." }), "\n"] }), "\n", _jsx(_components.h3, { children: "Parsing the decrypted private key blob" }), "\n", _jsxs(_components.p, { children: ["After a while, I realised that the decrypted private key bytes had the characters ", _jsx(_components.code, { children: "'ssh-rsa'" }), " near the beginning of it. That gave me an indication that these bytes are some kind of a struct which needs to be formatted properly. What we have is a decrypted blob of the private key, not the properly formatted private key. The bytes output looks like this:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: ">>> out_bytes\nb'\\x00\\x00\\x00\\x07ssh-rsa\\x00\\x00\\x01\\x81\\x00\\xd4~\\xff\\x9aW\\xecN\\x00\\xe8\"~\\xc3\\x8d\\x0b>N\\x97\\x8a\\xb7\\x82\\xb1\\x11z\\xd3\\xf4f\\xc6\\x82\\x10\\xc8\\xd9hd\\xe0]{\\x805\\xd2\\xb7oj\\xff\\xba\\x15T\\x83\\xd3\\xf5\\xfcm\\xf7\\xc5}\\x16\\xc5=>\\xbf\\xde(qD\\xd7\\x8a\\x98=`y\\n\\xad\\xe5\\xa3\\xa3?\\xd8\\xd6\\xd1\\xfc\\x88j\\xb9\\xd9\\xaa\\xcf&\\xa4\\x93\\xb6\\x84\\xd8\\xf2\\xa7\\x9e\\x9e\\x04\\x02\\xea\\x96\\t~\\x8ey\\xde2?\\xbb\\x8d{4\\xb4iF\\xabJ\\xe5!\\x98\\x94bP\\xb4\\xa0\\x928\\x8e\\xa3@\\xba-\\x81$\\xd0Q\\x12\\rW\\xa8\\r\\xa1\\x9a\\x9d>S\\xcd\\xf1\\x14\\xd6\\xc5\\xb51\\x1b\\xdc\\xab\\xb0\\xa7\\xb6\\x10\\x84\\x7f\\xdb\\xf6\\xe9\\xa7\\xe1\\xd8\\xd2\\xf9=`\\xad$\\xa3\\xb3\\xd2\\x1b<\\x05\\xb5\\xad\\x8a\\x8e\\x96\\xc7\\xcf\\xab\\x97\\xbdA\\x8e\\x89\\x88\\x00\\x9cd\\xf4\\x18I\\xd5\\x18\\xdbi\\xa9\\xac\"\\xfe\\x96\\xd9\\xe5\\xe8uI\\xce\\xbf}\\x86\\xf0F\\xa5*\\x87\\x8d\\x87\\x91|\\xc5\\xbe.\\x8e\\xe3(\\t?\\x80\\xeae\\xf6eX\\xa7[y\\x1a\\\\\\xd3\\xcc\\xb8\\xf3\\x94LM\\xcb\\xb9\\xb8M\\xd1\\xe6\\x9c\\xe7\\x0eYs\\xc8\\nK\\xbeWYaR\\xfcP\\xc3\\xe6L\\xa0m\\xd8/\\xd1\\xf0\\xdd6!\\x92\\xf3\\x8d\\x0b\\xc6c\\xa8\\xc952\\x98,\\xfc2\\x8b2^\\xb6\\xd3\\x07X\\xb2\\xf2\\xde\\xd9$n\\xd9~\\x82\\x98\\x14\\x04\\x86\\xb5\\xe3\\x07\\x8c\\xdc\\xc0\\xd7\\x97\\xf6\\xc7\\x9a\\x83WI\\xef\\xf7\\xca\\xc1\\xff\\xdb!u\\xcc U\\xe5\\xe3\\xa0\\x9f\\xdb\\x1b\\xc7\\xcd6\\xa5pk\\x8e\\x07^\\x10 \\xcb,\\x03\\xe5vtv\\xcb!\\xad\\xb4R\\xb1\\xffC\\xcc\\x0fU\\x95P\\xec\\xd8\\xa9K\\xe6i\\xf9-N\\x85\\x96]i\\xe2\\xcfg|.:\\x9foZ\\x80\\xe5\\x93\\x02Q\\xc3\\xe1%I\\xddS\\x11\\x1fz\\x87\\xc3\\x85\\xc3\\xc5+\\xc9U\\x86\\xbe\\x1a\\x82^\\x1b\\x14\\x94jy\\xdf\\x95E\\x1b\\xacb\\x0b\\xc6\\xd5\\xb8<]\\xce\\xea|\\x1e^\\xe2\"\\x1c\\x8c\\x8b\\xbc*:mM]\\x15q\\x91q|~\\xf8\\xfa\\x9cpJ\\xa0\\xb5\\xc9\\x94m\\x17V\\x15c\\xc0\\x1d\\xf0XS8\\x12\\xc1\\xd5\\xb738\\xd9\\xad\\xc9\\x92\\xee\\xe8\\xc6}\\x909(\\xca\\x88S\\xbd\"\\xa4\\x05\\x95\\xade\\xed\\xaf\\xc5\\xea\\x83\\x03v$\\x19\\xdd|\\xf9;\\xaa$\\xc2\\xe4\\xf3C)\\xf6\\x18\\xac3+\\xe6\\x07\\x8e%T\\x01 \\xed\\xce\\xf7\\xda\\xab[#\\xd1.\\x01\\xe1[tv\\x92\\xe5\\x9c\\xef\\x80\\t\\x94\\x85xp@F7\\x1d\\xf3\\xad\\x93\\xb1\\x94=\\x89\\xeb\\xcavY\\x12\\x85\\x1b\\xb6\\x89Q\\xff.\\xcf\\xda\\x8a*\\x04b\\xa1Y\\x04\\xfbM\\xde\\x99\\xc22s\\x9a\\xc9\\t\\xb1\\x02\\x1a\\xd1\\x1d8F\\xfdV\\xee\\xa1\\x9a(\\x90\\xcb}\\x175\\xc0\\x9b\\xdei\\xdd\\x9a\\'(\\x8b\\xba8\\xed\\xa9\\x95\\x81\\x00\\x00\\x00\\xc1\\x00\\x91\\\\\\x91\\x95`\\x01{\\xff\\x85\\x88\\xfbz,eF\\xe5\\x15%$Jl\\x18\\xe0\\x0e=2\\xae\\xd4\\x15k\\xc3Rsn\\xbe\\xf7\\xc1k\\x8b@}\\xebM\\x83\\xee@\\\\\\x05~\\x87+\\xddXx\\xad\\x14ae\\x8d\\xe3\\x02\\n\\xd9\\xaf)7\\xd3\\xcc\\xa4\\x148\\xc5K\\x10\\xbf\\\\\\xc0x\\xdf\\x8f\\xdc\\xf7\\x9a\\xb8\\xe9\\x10,M`k\\xe7A\\x1a\\x8d\\xae\\xf0\\x14\\xaa=X\\xe4\\xa3{04\\xbd\\xa5W\\\\\\x0b\\xac\\xca\\xb2o\\x19b\\xb54\\x90\\'v5\\xc2\\xd9\\xc6|\\x89h\\xad\\x97A\\xceoL\\xed\\x03c$\\xf4Px\\xbcA\\xe8\\x1e*[\\xa2\\'.W\\xf7.\\xf7,1>\\xb2\\x9c\\x86\\xe0\\x0e\\x98D\\xc8\\x1c\\xd0\\x0c\\x0e]IRc\\xfbT\\x9d<\\xcdVu\\x81\\xf5\\xcf\\x99\\x0b\\x81\\xb5\\x94st\\x0e\\x10\\x00\\x00\\x00\\xc1\\x00\\xf7\\xe0z)}\\x90-\\xf2jbx\\xf7\\xb4\\n\\xec\\x1e\\xd0/\\xc6\\xe4\\xb9\\xd9\\xa7\\xfc\"\\x9e<\\x87\\xbf\\xeeW\\x1b\\xcd\\xc2N\\xec\\xcdrHbT\\xb8z\\xd2\\xc2O=\\xc5w\\xf7\\x17\\xef\\x1a\\xaf\\xb1\\x14C\\xe0\\xf6\\\\\\xc6\\x13\\x94:\\x88\\xebq\\xdbW\\x1fVJU\\x82\\x95cp\\x86\\xf0Ll\\xd3\\xf6\\x855\\tkG\\xf3;\\xe5\\x96\\x9fq\\xd5*\\xa5L4B\\xaa\\xb1->\\x93\\x11\\xc3\\xd1\\xe0\\xd0%\\xbae\\xfb\\xa1f\\xfe0\\xf8Ke\\xf7q\\x02\\x8dyI\\x04kA`Z\\xac\\x90\\'\\x0c\\xa1-@\\xda\\x12\\x8d\\x08\\xd18\\x11\\x07ID\\xae\\x1a\\xa9\\xeaV\\x18s\\xbf\\t<4\\x9d\\x94\\xf9\\n|9\\xf8>C+]h\"\\xe3ir\\x1e\\x0fa9\\x9b\\xa1\\xc8\\xd8\\x96\\x02\\x032\\x93\\x97\\xd6Y\\x00\\x00\\x00\\xc1\\x00\\xdbu\\xb30\\x99\\xeb\\xfd/\\xe8z\\x17\\xfd\\x00g\\x8a\\x14\\xdb\\xf0\\x18\\xd6D\\x02\\xc0\\x032p\\xe6\\x05\\x9e\\x89\\xb0\\x03d\\xba!85d\\xe6\\xa4\\xda\\x99\\xea\\x85)\\x92g\\x0fr\\xe5~\\xb9f\\xbe\\xbfe\\xa5\\x1a\\x15\\xc5&\\xda`>> out_bytes\nb'\\x00\\x00\\x00\\x07ssh-rsa\\x00\\x00\\\n" }) }), "\n", _jsxs(_components.p, { children: ["The first 4 bytes are ", _jsx(_components.code, { children: "b'\\x00\\x00\\x00\\x07'" }), " and the following 7 bytes are: ", _jsx(_components.code, { children: "ssh-rsa" }), ". The following sequence of bytes follows the same pattern of 4 bytes for the length followed by the data of that length. Another confirmation is that at positions 400-407, we see this:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: ">>> out_bytes[400:400+4+3]\nb'\\x00\\x00\\x00\\x03\\x01\\x00\\x01'\n" }) }), "\n", _jsxs(_components.p, { children: ["The bignum here is of length ", _jsx(_components.code, { children: "0x03" }), " and the bigum is ", _jsx(_components.code, { children: "0x010001" }), "meaning 65537 which is a common value for the exponent ", _jsx(_components.code, { children: "e" }), " in RSA."] }), "\n", _jsxs(_components.p, { children: ["So, we can extract the bignums after the 'ssh-rsa' in the following order: ", _jsx(_components.code, { children: "n" }), ", ", _jsx(_components.code, { children: "e" }), ", ", _jsx(_components.code, { children: "d" }), ", ", _jsx(_components.code, { children: "iqmp" }), ", ", _jsx(_components.code, { children: "p" }), " then ", _jsx(_components.code, { children: "q" }), ". The script ", _jsx(_components.a, { href: "https://github.com/Zaxeli/NSA-CBC-2022/blob/main/task_5/x.py", children: "x.py" }), " has the code for this."] }), "\n", _jsx(_components.h3, { children: "RSA key as .pem" }), "\n", _jsxs(_components.p, { children: ["Now that we have the RSA parameters, we can initialise an RSA key object using PyCryptoDome in Python and make a .pem file using that. PyCryptoDome allows us to construct an RSA object using the exponents, factors, etc. See this: ", _jsx(_components.a, { href: "https://pycryptodome.readthedocs.io/en/latest/src/public_key/rsa.html#Crypto.PublicKey.RSA.construct", children: _jsx(_components.code, { children: "RSA.construct" }) }), " It needs the following values in this order: ", _jsx(_components.code, { children: "n" }), ", ", _jsx(_components.code, { children: "e" }), ", ", _jsx(_components.code, { children: "d" }), ", ", _jsx(_components.code, { children: "p" }), " then ", _jsx(_components.code, { children: "q" }), ". Once we have this object, we can use the method ", _jsx(_components.code, { children: "exportKey" }), " to get the .pem file contents as a string. We then just have to write this to a file."] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "pvtkey = RSA.construct((bignums[1], bignums[2], bignums[3], bignums[5], bignums[6]))\n\n# Export string\npvtkey_pem = pvtkey.export_key()\n\nwith open('privatekeys/PRIVATE.pem', 'wb+') as f:\n f.write(pvtkey_pem)\n" }) }), "\n", _jsx(_components.p, { children: "!! We now have the .pem key file we need. !!" }), "\n", _jsxs(_components.h3, { children: ["Decrypt ", _jsx(_components.code, { children: "data.enc" })] }), "\n", _jsxs(_components.p, { children: ["The challenge has given us the command to use for decrypting the ", _jsx(_components.code, { children: "data.enc" }), " file:"] }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "openssl pkeyutl -decrypt -inkey privatekey.pem -in data.enc\n" }) }), "\n", _jsx(_components.p, { children: "We just need to tweak the filepaths and filename in this." }), "\n", _jsx(_components.p, { children: "Once we decrypt it, we get the following output:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "# Netscape HTTP Cookie File\nsuvwwcedmdcyelgn.ransommethis.net\tFALSE\t/\tTRUE\t2145916800\ttok\teyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE2NTM1Mzg3NTQsImV4cCI6MTY1NjEzMDc1NCwic2VjIjoiWFE4c255RXc4YXlpT1h0a0ZhcHNuQ2lrakR0bGw2MFYiLCJ1aWQiOjEwMjk0fQ.O-6pNVAqeQ7id-eZN6yH0dRay6_4QAFtMlZg2ms2-Bg\n\n" }) }), "\n", _jsx(_components.h3, { children: "Get the points" }), "\n", _jsxs(_components.p, { children: ["The token value here is ", _jsx(_components.code, { children: "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE2NTM1Mzg3NTQsImV4cCI6MTY1NjEzMDc1NCwic2VjIjoiWFE4c255RXc4YXlpT1h0a0ZhcHNuQ2lrakR0bGw2MFYiLCJ1aWQiOjEwMjk0fQ.O-6pNVAqeQ7id-eZN6yH0dRay6_4QAFtMlZg2ms2-Bg" }), ". We submit this and get the points."] }), "\n", _jsx(_components.h3, { children: "Summary" }), "\n", _jsx(_components.p, { children: "On a high level (very high level), the steps to get to the solutions can be summarised like this:" }), "\n", _jsxs(_components.ol, { children: ["\n", _jsxs(_components.li, { children: ["Find ", _jsx(_components.code, { children: "idtab" })] }), "\n", _jsx(_components.li, { children: "Find the shielded private key and the shield prekey" }), "\n", _jsx(_components.li, { children: "Decrypt the shielded private key" }), "\n", _jsx(_components.li, { children: "Parse its structure to get the exponents and factors" }), "\n", _jsx(_components.li, { children: "Make an RSA object in Python and export to .pem" }), "\n", _jsx(_components.li, { children: "Decrypt data.enc" }), "\n"] }), "\n", _jsx(_components.h2, { children: "Answer" }), "\n", _jsxs(_components.blockquote, { children: ["\n", _jsx(_components.p, { children: "Great job!" }), "\n"] })] }); } function MDXContent(props = {}) { const {wrapper: MDXLayout} = { ..._provideComponents(), ...props.components }; return MDXLayout ? _jsx(MDXLayout, { ...props, children: _jsx(_createMdxContent, { ...props }) }) : _createMdxContent(props); } return { default: MDXContent };

Zaid Khaishagi

NSA Codebreaker Challenge 2022 Task 5 Writeup