1/30
Buffer Overflow
Mehdi Bahbah Axel Yildiz Elie Vigouroux Baptiste Gouyet Guillaume Gaudin
UCA-ISIMA
November 2020
2/30
Table of Contents
Theories
Shellcode
Defense
Real cases
Demonstration
References
3/30
THEORIES
4/30
THEORIES - Stack
5/30
THEORIES - Heap
6/30
THEORIES - Buffer Overflow
7/30
THEORIES - No Op Slide
8/30
SHELLCODE
---.`````
---.```
---.``````````
---...--....```
---...---...```
...-..---...```
---.-...---....```
...---....``
...---....```
...---...```
...---...``` ````````` ````````````````````````````````````...`
...---....`` ` ...--....``````..-::::::::::::::::::::::::::::.
...`...---...``` ` ...----..```` `.-::::::::::::::::::::::::::.
...`````...---...``` ...----..```` `-:::::::::::::::::::::::::.
...``````...---....`` ...-...````` `-::::::::::::::::::::::::.
...````````...---...``` `` ...````` `...`
...`````````...---...``` .. `...````` ``````````````````````
``````````````````.``````````...---....``` ``` `...````` ``````````````````````
`````````````````````````````...---...``` ``````````````````````````````` ``````````````````...````` ```````````````````````
`````````````````````````````...---...``` `...`` ``````````````````...````` ```````````````````````
``````````````````````````````...---...```` `.---. ``````````````````...````` `---.
``````````````````````````````...---...``` `.---. ````````````````````...````` `.---.
``````````````````````````````...---...````..---..-. `````...````` `...`
```````````````````````````````...---...```` ````.---..` `` `````````````````````...````` .---.
`````````````````````````````````...---...``` ``.---.. `````````````````````...`````` `...`
``````````````````````````````````...---...`````.---.. `````````````````````...`````` `...`
```````````````````````````````````...---....``` `..---.. `````````````````````...`````` `---.
````````````````````````````````````...---...``` ``.---.. `````````````````````...`````` .---`
````````````````````````````````````...---...``` `...---.. `````````````````````...`````` .:::::::::::::::::.
`````````````````````````````````````...---...``` ``.---.. `````````````````````...`````` `-::::::::::::::::.
...-.``````````````````````````````...---...``` `..----.. `````````````````````...``````` `---.
---:+:-.-.````````````````````````````...---...```` `..--.. `````````````````````...`````` `-:::::::::::::::.
---:+/--:::.---.```````````````````...---...```` `.... ``````````````````````...`````` .:::::::::::::::.
---:+/--:::::/::---.````````````````````...---...```` `. ``````````````````````...`````` -::::::::::::::.
---:+/--:::::://-.```````````````````````...---...```` ` ``````````````````````...``````` `-:::::::::::::.
---:+/--:::::://::-.``````````````````````...---...```` ``````````````````````...````` .:::::::::::::.
---:+/--:::::://:://:...`````````````````...---...```` `` ` ``````````````````````...`````` `-::::::::::::.
---:+:--::::::///////+/....`````````````````...---...```` ``..````` .` ``````````````````````...`````` .::::::::::::.
---::---::::::///////:-....`````````````````...---...```` ``-.````` .` `...`````````...`````` `-:::::::::::.
---...---:::::///////-...```````````````...---...```` ``-.````` .` ://///:--...````````...`````` `:::::::::::.
...---::::::://///:...````````````...-.---...```` ``-.````` .` +oooo++///:....````````...`````` -::::::::::.
````.```...---::::::////:-...``.``````...---...```` ``-.````` .` +oooo+++//++-..````````...`````` `.:::::::::.
`````````...---::::://///-...`````...---...```` ``-.````` .` +oooo+++++++o+-.```````...`````` `-::::::::.
``````````...---:::::////:...````...---...```` `-.````` .` +oooo////+++oo:.```````...``````` `::::::::.
````````````...---:::::////:-...`````.`...---...```` `.````` .` +ooo/-::///+++/.``..```...`````` .:::::::.
`````````````...---:::::////-...````````...---...``` ````` .` /++/----::///+/-....```...`````` `-::::::.
```````````````...---::::////:-...`````````...---...``` ````` .` ...---::://+:.`....`...`````` `.:::::.
````````````````...---:::://///:...``````````...---...```` ```` .` `````..---::://:.``...`...````` .::::.
``````````````...---::::////:-...```````````...---...`````````````...---:::::////:-...```````````...---...```` ```` .```` .` `````...----:://...``````````...----::/...```` .:::..::.
````````...----::::::////-...````````...---...````````````...----::::::///:-...`...---...```` `` .`.` ``````....---:-...```````````...---:-...```` .:...
````````...---::::::://:-...---...```````````...---:::::::/::--::::---...---...```` ``.-`..``` `` ``.``...```` ```` ````````...---:-...````````````...---:...```` ````````````````````````````````````-::::::::::::::::::::::::::::::::
`````````...---:::::::://///://////::::--...---...```` ``.-`..` ``.``...`` `````````...--:-...````` `-:::::::::::::::::::::::::::::::
` ``````````...---:::::/::::::::::::::://///:--...---...```` `.-`..` ``.``...`` `````````...--:...````` `-::::::::::::::::::::::::::::::
````` ``````````...---::::::---::::::::://////::-...---...``````````````...---:---::::::::///////::--...---...```` `.-`..``-`..` ``.``...````.``...`` `````````...--:-...``````````````...----...---.-...`````` `.:::::::::::::::::::::::::::::.::::::::::::::::::::::::::::
``` ```````````...---...---:::::::////////::--...---...```` .`..` ``.``...`` `````````...---...---...`````` `.-:::::::::::::::::::::::::
``` ``````````...---...---::::::://///////:--...---...```` `.` ``.``...`` ```````...----...---...`````` `.---
```` ``````````...----...---:::::::////////:--...---...```` `` ``.``...`` ```````...----...---...`````` `````````````````````````
`````` ``````````...----...---::::::::////////:--...---...```` ``.``...`` ```````...---...---...````` ```````````````````````
``````` ```````````...---...---:::::::////////::--...---...```` ``.``...`` ```````...----...---...`````` ``...
````````` ```````````...--...````````...---::::::://///////:--...---...```` ``.``...`` ```````...---...---...`````` `-:::::::::::::::::::
`````````` ``````````...-...`````````````...---:::::::://///////:-...---...```` ``..`...`` ```````...---:-...---...````` `..`-:::::::::::::::`
``````````` ``````````...-....````````````````...---::::::://///////:-...---...```` ```...`` ```````...----:--.-....---...````` `./::::::::::::::`
```````````...``````````````````...---::::::://///////:-...---...````` ``..`` ``````...---:----..---...`````` .:::::::::::::::`
```````````...``````````````````````...---::::::://///////:--...---...```` ````` ``````...````.----::---...`````` `::::::::::::::`
`` ```````````...````````````````````````...---:::::://///////::-...-...---...```` `` ``` ````````````````````````````````````````````````````````````````````````````````````````````````````````````...``.---:---...`````` `.::---
``.-/:.` ````````````...``````````````````````````...---::::://///////:---...---...```` `.``...``...````````````````````````````````````````````````...```````....-::.``.--::---...`````` ``
``-:+//:--.` ```````````...````````````````````````````...---:::::://////+//:---...---...```` ```...``...````````````````````````````````````````````````--:---````...-//:-`.--:---...``````
``-:/::::::-.`` ```````````...``````````````````````````````...---::::://////+//:---...---...```` ``...``...````````````````````````````````````````````````---:::.```..-:/+/-``-:---...``````
`..---:::.`` ````````````...````````````````````````````````...---::::://///++//:---...---...```` ``...``...`...---::-..`...:/++/-.``-:---::::---...```````
`...---:-.` `````````````````...````````````````````````````````...---::::://////+//:---...---...````` ``.``...-::::::::::::::::::::::::::::::::::::::::::::-..--:::...-:/++/-.` .---:::::::::::---...``````` `````
``````..``...---.``````````````````````....``````````````````````````````````...---::::::////////::---...---...```` ```...```````````````````````````````````````````...--::...-/+++/-.`` .---::::::::::::::::---...`````` `````
```````````...---.````````````````````````..````````````````````````````````````...---::::://///////:---...---...````` ````...` ```...---:...:/+++/:.`` `---::::::::::::::::::---...``````` ```
`````````````...---.``````````````...---.`````````````````````````...`````````````````````````````````````...---::::::////////:---..-...---...````````````````````````````..`````````````````````````````````````...---::::::////////:---.-....---...``` ...`````...````````````````````````````````````````````....--:-.`.-//+++/:-.`````....--:-...-//+++/:-.` `.---::::::::::::::::::::---...```````.---::::::::::::::::::::::---...```````
``````````````...---`````````````````````````````..```````````````````````````````````````...---::::://///////:---...---...`````` `````````````...----.````````````````````````````....```````````````````````````````````````...---::::://///////:---.-...---...```` ``...`````````...````````````````````````````````````````````....--.`.-:/++++/:-.``````....----.`.:/++++/:-.`` `---::::::::::::::::::::::::---...`````````---:::::::::::::::::::::::::---...```````
`````````````...---.```````````````````````````...```````````````````````````````````````...---::::://///////:---...---...```````````````...---.``````````````````````````...`````````````````````````````````````...---::::::////////:---...---...``` `...``...``````````````````````````````````````````....-.`.-:/++++//:-..````````....--..-://++++/:-..`` `---::::::::::::::::::::::::::::---...```````.---::::::::::::::::::::::::::::::---...``````` `
`````````````...---.````````...````...```````````````````````````````````...---::::::////////:---...---...```````````````...---.`...---:::::----...``````````````````````````````````...---::::://///////::---...```` `...``````````````````````````````````````````...``-::/++++//:--.````...``````````````````````````````````````````...``.-://++++//:--.``` .---::::::::::::::::::::::::::::::::---...``````.-:::::::::::::::::::::::::::::::::::::---...``````
```````````...---...---::::----...````````````````````````````````...---::::://///////:---...```````````````...--...---::::---...```````````````````````````````...---::::://///////:---...``` ``````````````````````````````````````````````````````````````````````````...`.--://+++///::-.```````````````````````````````````````````..``.-:://+++///::-.```` `-::::::::::::::::::::::::::::::::::::::---...```````:::::::::::::::::::::::::::::::::::::::---...`````` ```````````````````````````
`````````````...---:::::---...`````````````````````````````...---::::://///////:---...`````````````````...```````...---:::::---...`````````````````````````````...---:::::::///////::---...``` ``````````````````````````````````````..```.-://++++///::-..`````````````````````````````````````````..```.-:://++++///::-..````` `::::::::::::::::::::::::::::::::::::::::---...```````:::::::::::::::::::::::::::::::::::::::::---...`````` .---`.::::::::::`
``````````````...`````````...---::::::----...````````````````````````````...---:::::::///////::---...``````````````````.```````````````...---::::::::----...```````````````````````````...---::::::///////::---...``` ```````````````````````````````````...```.-://+++++///::--..````...`````..```.-:://+++++///::--...```` `-:::::::::::::::::::::::::::::::::::::::::---...```````-:::::::::::///////////////:/:::::::::::::---...``````` `-:::::::::``-::::::::`
```````````````````````````````...---::::::::---...```````````````````````````...---::::::///////:---....```````````````````````````````````...---:::::::::--...```````````````````````````...---::::::://////:---...```` `...```...``..-:///+++++///:::-...```````````````````````````````````...```.-:://++++++////::--...````` -/:////////////////////////////:::::::::::---...```````-////////////////////////////////::::::::::---...``````` `-:::::::``-::::::`
`````````````````````````````````...---:::::::---...````````````````````````````...---::::::://////:---....```````````````````````````````````...---:::::::--...````````````````````````````...---:::::://///::---...``` `.````````````````````````````..```..-:///++++++////:::--...```````````````````````````````````..```.-:://++++++++////::---....`````` -/////////////////////////////////::::::::::---....```````-//////////////////////////////////:::::::::---...``````` `-:::::`.---`
`````````````````````````````````...---:::---...````````````````````````````...---:::::://////:---....``` ````````````````````````````.```.-:://+++++++++////:::----...`````` -////////////////////////////////////::::::::---....`````` .----`
``````````````````````````````````...---...``````````````````````````...---:::::://////:---....``` ..`````````````````````````.``.--://++++++++++/////::::----...`````` :////////////////////+////////////////:::::::---....`````` `----`
```````````````````````````````````...---...```````````````````````...---:::::://///:---...````````````````````````````````````````...---...````````````````````...---:::::://////:---....``` ` /+`-sshyys+:...``.-://+++++ooooo+++++/////////::::---...``````/+`.+/:-..````````````````.```.-://++++++++++++/////::::::---....````` `:+//+++++++++++++++++++++/////////////:::::::---....```````:++++++++++++++++++++++++//////////////:::::::----....`````` .---``-::`
```````````````````````````````````````...---...`````````````````...---::::://////:---...```````````````````````````````````````````...---...``````````````...---:::::://////:---...``` `s./+`-sshhhhhhh/hs.```````````.://+ooossssssssssssssyyyyyyyyyyyyyyyyyyyyyyyyyyyysssoo+++/ooooo++++++++++++++++++++++++++++////////::::::---...`````o./+`-sshhhhhhy-:-````````````.-://+++ooooooooooo++++++++++++++++++////:::----....```./++++++++++++++++++++++++++++++////////:::::::---...`````` .--``.-`
`````````````````````````````````````````...---...``````````...---:::::://///:---...``````````````````````````````````````````...---::---...`````...---:::::://///:---...``` ```````````````` /d./+`-sshhhhhhh/hh:. ````````.:/+oosssyyyyyhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhyyyyyyyysssooo+++++++++++++++++++///////:::::----...`````````````````````+m./+`-sshhhhhhh/hh-.``````.:+osyyhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhyyyssooo+++++++++++++///////:::::----...````` .-``-`
```````````````````````````````````````````...---...---:::::://////:---...``` ```````````````/dd./+`-sshhhhhhh/hh-.`. ::/osyhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhyssoo++++++++++///////:::::----...```` -`
``.``` ```````````````````````````````````````````...---...---:::::://////:---..``` ymd./+`-sshhhhhhh/hh--`.-++yyhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhysoo+++++++///////:::::---....```` `
``----.` ```````````````````````````````````````````````...---...---::::://////:---...`` ``````````-hmd./+`-sshhhhhhh/hh+osyhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhyysoo+++++//////:::::---....```` `` ````
`....---..`` ``````````````````````````````````````````````````...````...---:---...---:::::///////:---...`` `-:---ydmd./+`-sshhhhhhhshhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhddddhhdhhyso++++//////:::::----...``` `````.```````..-```` `````..--.`
`...` `````````````````````````````````````````````````...``````````...---...---::::///////:---...``` `````````-hdmd./+`-sshhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdddhhhdddddddddddhs+++++//////:::::----....``` `.``...--...-://++/-``...
``````...`` ````````````````````````````````````````````````..``````````````...---...---::::///////:---...`` ````````omdmd./+`-sshhdhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdddddddddddddddddddddy+++++//////:::::---....``` `...``...--://+oooo+/-``:::::::::::::::::::::::::::::::
``````````...`` ``````````````````````````````````````````````..```````````````...---...---::::://////:---..``` ``````-mmdmd./o:shddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdddddddddddddddddddddmmmmmNNNmho+++++//////::::---....``` --...--::/++oossoo+/-.``...
`````````````...``````````````...`` ``````````````````````````````````````````````````````````````...---...---::::://////:---..```````````````````````````````````````````````````````````````...---...---:::::://///:---...``` `````ommdmd:sdddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdhdddddddddddddddddddmmmmmNNNNNNNmmmmhhhyyyyso++///::::--...````` +mmmdmmdddddddddddddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdhhdhddddddddddddddddddddddmmmmNNNNNNNmmmmddddhhhhhhhhhhhhhys+/::::--...```..---:::://++oossssoo++/:..```..---::/++oossssoo+/-.``......
`````````````...``` ```````````````````````````````````````````````````````````````...---...---::::://///---...``` `-dNmmmdddddddddddddddddddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdddddddhhddddddddddhdddddddddddddddddddddddmmmmNNNNNNNNmmmmdddddddddhhhhhhhhhhhhhhhhhys+/::--..``````.--:::::::::::///+++ooossssooo+//:-.```...
`````````````````...````...``````````````````````````````````````````````````````````...---...---:::::::////---..``` /NmmmddddddddddddddddddddddddddddddhhhhhhhhhhhhhddhhddhddddddhhhhhhhhdddddddddddddddddddddddddddddddddmmmmNNNNNNNNmmmddddddddddddddddhhhhhhhhhhhhhhhhhhhhhs+:---:::://///////////+++oooooosoooo++//:--.`` `...
````````````````````...---.---...``````````````````````````````````````````````````````...---...---::::::///:---..```````````````````````...---....```````````````````````````````````````````````````...---...---::::::///:--.----..---...``` oNmmmmddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmmmNNNNNNNNNmmmddddddddddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhys+/////////////////++++++oooooooooooo++//::--..`-mNmmmmmmdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmmmmmmmNNNNNNNNNmmmmdddddhhhhhdhhdhhhhhhhhhhhhhhhhhhhhhhhhhhhhyyso++//////+++++++++++++++ooooooossssooooo++//::---.`` `......
``````````````````...---...``````````````````````````````````````````````````...---...---:::::///--...---...``` oNNNNmmmmmdddddddddddddddddddddddddddddddddddddddddddddddddddddddddmmmmmmmmmmmNNNNNNNNNNNNNNNNNNNmmmddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhyyso+++//+++++++++++++++oooooooosssssssssooooo++//:::--..`...
````````````````...---....````````````````````````````````````````````````...---...---::::://:-...---...`` .dNNNNNNmmmmmddddddddddddddddddddddddddddddddddddmmmmmmmmmNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNmdddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhyso++++++++++++++ooooooooooossssssssssssssoooo+++//:::--..`` `...```
```````````````````````...---...```````````````````````````````````````````````...---::::://-...---...`````````````````````````````...---...`````````````````````````````````````````````...---::::::/:-...---..``` /NMMNNNNNNmmmmdddddddddddddddddmmmmmmmmNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNmmmmmmmddddmmNNNNNNNNdddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhyooooooooooooooooooooooossssssssssssssssssoooo+++//:::--...``...---.`hNMMMNNNNNNNmmmmmmmmmmmmNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNmmmmmmmdddddddddddhhhhhhhhhhdNNNNNNNmdddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhsoooooooooooooooooooossssssssssssssssssssooo+++////:::--..`` `...----:.
`````````````````````````````...---...``````````````````````````````````````````...---::::://-...---...``````````````````````````````````...---...````````````````````````````````````...---::::::/:-...---...`` :mNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNmmmmmddddddddddddddddddhhhhhhhhhhhhhhhhhhhdNNNNNNmdddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhysssssoooooooooooosssssssssssssssssssssssooo+++////:::--..`` `...---:.`ommmNNNNNNNNNNNNNNNNNNNNNNNNNNNNmmmmmmdddddddddddddddddddddhdhhhhhhhhhhhhhhhhhhhhhhhhhhmNNNNNNdddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhyssssssssooooossssssssssssyyyyysssssssssooo+++////::::-...````...---:.
`````````````````````````````````...---...`````````````````````````...---::::://-...---..````````````````````````````````````...---...---...``````````````````...---::::::/:...---...``` -hddmmmNNNNNNNNNNNNNNmmmmmmddddddddddddddddddddddddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdNNNNNNmddddhhhhhhhhhhhhhhhhhhhhhhyyyyyyyyyhhhhhhysssssssssssssssssssssyyyyyyyysssssssssooo++++////:::--..````...`.---:.`sdddmmNNNNNNNNNmmddddddddddddddddddddddddddddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdNNNNNNmddddhhhhhhhhhhhhhhhhhhhhyyyyyyyyyyyyhhhhhyyyssssssssssssssssyyyyyyyyyysssssssssooo+++++///::::--..````...```.---:.
```````````````````````````````````...---...---...``````````````...---:::::::-...---....`````````````````````````````````````...---...`````````...---:::::/-...---....---...``` :hdddmNNNNNNNmmddddddddddddddddddddddddddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhmNNNNNNmddddhhhhhhhhhhhhhhhhhhyyyyyyyyyyyyyhhhhhyyyyysssssssssyyyyyyyyyyyssysssssssssoooo++++////:::--...````...---. ``.---:.`yddmmNNNNNNmddddddddddddddddddddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdNNNNNNmddddhhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyhhhdhyyyyyyyyyyyyyyyyyyyyyyyssyyssssssssooooo++++///:::---...```...----. ``.---:.
``````````````````````````````````````...````...---...`````...---::::/:...---...-....````````````````````````````````````````````...````````...---...---::::-...---...-....``` /ddmNNMNNNmdddddddddddddddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhmNNNNNmdddddhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyhhhhhhyyyyyyyyyyyyyyyyyyyyyyyysssssssssooooo++++////:::---...``...`.---. ``.---:.-dmNNMNNNmddddddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdNNNNNNmddddhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyhhhhdhhyyyyyyyyyyyyyyyyyyyyyysssssssssooooo++++////:::---...`...-``---. ``.---:.
```````````````````````````````````````````...````````````...---...---:::-...---.---...-...`````````````````````````````````````````````````....``````````````...---...---::-...---...```` `ymNNMNNNdddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdNNNNNNmddddhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyhhhhhdhhyyyyyyyyyyyyyyyyyyyyysssssssssooooo++++///::::---....`...---sNNMNNNmdddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhmNNNNNmdddddhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyhhhhhdhhhyyyyyyyyyyyyyyyyyyyssssssssooooo++++////:::---...`.----`---. ``.---:.`---. ``.---:.
``````````````````````````````````````````````..````````````````...---..-...---::-...---..-...`````````````````````````````````````````````````.``````````````````...---...---::...---..--...```` +NMNNNmdddddddhhhhhhyyysooo++//:::://////+oooosyyyyhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdNNNNNNmdddddhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyhhhhddhhhyyyyyyyyyyyyyyyyyssssssssoooo++++////::::---....`...```.----:mNNNNddddddhhhyo/:-..`` ``..:/+syyhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhmNNNNNmdddddhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyhhhhddhhhyyyyyyyyyyyyyyyysssssssoooo+++++////::::----...`..```````.----`---. ``.---:.`---. ``.---:.
``````````````````````````````````````````````````````````````````...---::...---.---..-...```````````````````````````````````````````````````````````````````````...---:-...-.---.-...````.dNNNmddddhhhyo:.``hNNmddddhhhy+++:.` .-+syhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdNNNNNNmdddddhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyhhhhhdhhhyyyyyyyyyyyyyyysssssssoooo++++//////:::----...````````.----`-+syhhhhhhhhhhhhhhhhhhhhhhhhhhdNNNNNNmdddddhhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyyhhhhhhhhhyyyyyyyyyyyyyssssssoooo++++++/////:::----...-.````````.---.`---. ``.---:.`---. ``.---:.
``````````````````````````````````````````````````````````````````````...---:-...---.-.--.-..-...``````````````````````````````````````````````````````````````````````````````...----:-...-....--.--...```` sNNddddhhhy+/+++/-.``+Nmdddhhhho://++o+/:-.``` `/shhhhhhhhhhhhhhhhhhhhhhhhhhmNNNNNmddddddhhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyyyhhhhhhhhhyyyyyyyyyyyssssssoooo++++++/////::::---..---...```````.+yhhhhhhhhhhhhhhhhhhhhhhhhdNNNNNNmdddddhhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyyyyyhhhhhhhhhhyyyyyyyyysssssoooo+++++++////:::----.:/---...```````````` ` `...--```
`````````````````````````````````````````````````````````````````````````````...----:-...---...-.--.--...````/mdddhhhhy::://+ooo++/:-.``` -shhhhhhhhhhhhhhhhhhhhhhhhmNNNNNmddddddhhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyyyyyyhhhhhhhhhyyyyyyyyyssssooooo++++++///::::---syo:--...````` `````
```````````````````````````````````````````````````````````````````````````````````...---::...-...````-dddhhhhho-::///+oooo++/:--.``` .shhhhhhhhhhhhhhhhddhhhhhdNNNNNNddddddddhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyyyyyyyhhhhhhhhhyyyyyyysssssooooo+++++///::::----/yhys/---...````` ``````
````````````````````````````````````````````````````````````````````````````````````````...---:-...-.-...`````.hdhhhhhy:-::///++oooooo+//:-..```` -yhhhhhhhhhhhhhhddddhhhhdNNNNNNmdddddddhhhhhhhhhhhhhhyyyyyyyyyyyyyyysssssyyyyyyyyhhhhhhhhyyyysssssssooooo++++///::::---:shhyyy+---...````` ```````
``````````````````````````````````````````````````````````````````````````````````````````````...---:-...-...```````.sdhhhhho--:::///++oooooo++//:--..`````` `+hhhhhhhhhhhhhhdddddhhhhmNNNNNmddddddddhhhhhhhhhhhhhhyyyyyyyyyyyyssssssssssssyyyyyhhhhhhhyyyysssssssoooo++++////::::--oyyyyhyyo:--...`````` ``````..`
```...```````````````````````````````````````````````````````````````````````````````````...----...`````` ```.shhhhhh/--::::///+++oooooo+++/::-...````````` .yhhhhhhhhhhhhhhddddhhhhdNNNNNNmdddddddhhhhhhhhhhhhhhyyyyyyyyyyssssssssssssssssssyyyyhhhhhhyyyyssssssoooo+++/////:::-+yyyyyyyyyo:---..``````````````````````...`
``...`````````````````````````````````````````````````````````````````````````````````...--:-...``````````.shhhhhy:--::::////+++ooooooo+++//:--...``````````````````````` ```+hhhhhhhhhhhhhhdddddhhhdNNNNNNmddddddhhhhhhhhhhhhhhhhyyyyyyyyyyssssssssooooooosssssyyyyhhhhhhyyssssssooo+++/////:::+yhyyyyyyyyys/---....`````````````````....`
````````````````````...``````````````````````````````````...````````````````````````````...---...``````````.yhhhhhs::::::::////+++ooossooo++///:---...````````````````````````:hhhhhhhhhhhhhhdddddhhhhmNNNNNNdddddddhhhhhhhhhhhhhhhhyyyyyyyyyyssssssooooo+++oooosssyyyyyyhhhhhhyysssooo++++////+syyyyyyyyyyyyyy/:---...``````````...````````
``````````````````````````````````````````````...`````````````````````````````...````````````````...---...`````````-yhhhhhs/::::::://///+++ooosssooo++///::--...```````````````````-yhhhhhhhhhhhhhdddddhhhhdNNNNNNmddddddddhhhhhhhhhhhhhhhyyyyyyyyyyssssssooo++++++++ooossssyyyyyhhhhhhhyyyysssssyyyyyhyyyyyyyyyyyyyy+::---...``````````
```````````````````````````````````````````````````...````````````````````````````````````...``````...---...`````````-hhhhhhs//////:://////+++ooossssooo++///::---...``````````-yhhhhhhhhhhhhhddddddhhyhNNNNNNNdddddddddhhhhhhhhhhhhhhhhyyyyyyyyyssssssooo++++////+++oosssyyyyyyyyhhyhhyyyyyyyyyyyyyyyyyyyyyyyyyyyo:::---...--.```````````
`````````````````````````````````````````````````````...`````````````````````````````````````...--...```````./hhhhhhs+//////////////+++oooosssooo+++///:::---.../yhhhhhhhhhhhhhhdddddhhyhmNNNNNNmdddddddddhhhhhhhhhhhhhhhhhyyyyyyyyysssssooo+++//////+++oosssyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyys/:::---.````````````
`````````````````...``````````````````````````````````````````...--...`...-ohhhhhhs++/////////////++++ooooossoooo+++///:::---...---+hhhhhhhhhhhhhhhdddddhhhydNNNNNNNmdddddddddhhhhhhhhhhhhhhhhhyyyyyyyyyyssssooo+++//////++ooossssyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyys/::::---.``````````````````````````````...````````````````````````````````````````````````...-...-:+hdhhhhhyoo+++//////////+++++ooooosssoooo+++///:::::---:ohhhhhhhhhhhhhhdddddddhhyhNNNNNMNNmddddddddddhhhhhhhhhhhhhhhhhyyyyyyyyysssssooo++++++++oooosssssyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyys/::::::::::::-.``````````````
`````````````````...````````````````````````````````````````````````````````````...--...--::/+ohddddddhsoo++++///////++++++oooooossssoooo+++////:::::::::::::::::/yhhhhhhhhhhhhhhhddddddhhyhmNNNNNMNNmdddddddddddhhhhhhhhhhhhhhhhhyyyyyyyyysssssoooooooooosssssssyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyhhys////:::::::-```````````````````````````````````...`````````````````````````````````````````````````````````````...-...-..----::///+sddddddddyssooo+++++++++++++++ooooossssssoooo+++/////::::::::://///shhhhhhhhhhhhhhhdddddddhhydNNNNNNNNMNNmmdddddddddddhhhhhhhhhhhhhhhyyyyyyyyyyysssssssssssssssssyyyyyyyyyyyyyyyyyyyyyyyyyyyyyhhyhhhyhhhhhhhs//////:::-`````````````````
```````````````````...`````````````````````````````````````````````````````````````...-...---::://///+ydddddmmmhyyssooo+++++++++++++ooooossssssssoooo++++///////////////shhhhhhhhhhhhhhhddddddddhhhmNNNNNNNNNNNNNNmmddddddddddhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyssssssyyyyyyyyyyyyyyyyyyyyyhhhhhhhhhhhhhhhhhhhhhhhhhhhhs/////::.``````````````````
`````````````````````...`````````````````````````````````````````````````````````````...-...---:::://///++dmmmmmmmmdhyysssooo+++++++++ooooooossssssssssooooo+++++/////////+shhhhhhhhhhhhhhhddddddddhhhdNNNNNNNNNNNNNNNNNNmmddddddddddhhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhs///:-.```````````````````
`````````````````````...``````````````````````````````````````````````````````````...-...---::://////++smmmmmmmmmmdhhyysssooooo+++ooooooooossssssssssssooooo++++++++++++shhhhhhhhhhhhhhhhdddddddddhdmNNNNNNmdddmmNNNNNNNNNmmdddddddddhhhhhhhhhhhhhhhhhhhyyyyyyyyyyyyyyyyyyyyyyyhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhho::-```````````````````````````````````...````````````````````````````````````````````````````````...---:::://////++hmmmmmmmNNNmdhhyyysssooooooooooooooosssssssssysssssoooooooo++++oyhhhhhhhhhhhhhhhhhdddddddddddmNNNMNmddhhhhddmNNNNNNNNNmmmddddddddhhhhhhhhhhhhhhhhhhhhhhhhyyyyyyyyhhhhhhhhhhhhhhhhhhhhhhhhhhdddddddddddddddddddhhhoo+++++/:.
```````````````````````...````````````````````````````````````````````````````...---:::://///++sdNNNNNNNNNNNmdhhhyyysssoooooooooooossssssssyyyyyysssssooooooooshhhhhhhhhhhhhhhhhhhdddddddddddNNNNMNdddhhhhhhhddmNNNNNNNNNNmmdddddddddhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhdddddddddddddddddddddddddddddddddddddhhddddo..````````````````````````...--...```````````````````````````````````````````````...---::::://///++ymNNNNNNNNNNNNmddhhhyyyssssssssosssssssssssyyyyyyyyyssssssoosyhddhhhhhhhhhhhhhhhhhdddddddddddmNNNMMmdddhhhhhhhhhhddmmNNNNNNNNNmmmddddddddddddddddhhhhhhhhhhhhhhhdddddddddddddddddddmmmmmmdddddhhyyyyyyyyyyyyyhhhhdhhdyo`
```````````````````````...---...````````````````````````````````````````...---:::://///++odNNNNNNNNNNNNNNNmddhhhyyyyysssssssssssssyyyyyyyyyyyyyyysssyyhdddhhhhhhhhhhhhhhhhhhdddddddddddmNNNMNmdddhhhhhhhhhhhhhhdmmNNNNNMNNNmmmmddddddddddddddddddddddddddddddddddddmmmmmmddhyso+//:---...``````````````...-:/+/`````````````````````````...```````````````````````````...---:::://///+++hNNNNNNNNNNNNNNNNNmmddhhhhyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyhhddddddhhhhhhhhhhhhhhhhhddddddddddddNNNMMNdddhhhhhhhhhhhhhhhhhhdmmNNNNNMNNNNmmmmmddddddddddddddddddddmmmmmmmNNmmdyo/:-..``
`````````````````````````...---::::://///++smNNNNNNNNNNNNNNNNNNNNmdddhhhhhhyyyyyyyyyyyyyyyyyhyyyyhhdddddddddhhhhhhhhhhhhhhhhhddddddddddddmNNMMMmdddhhhhhhhhhhhhhhhhhhhhhdmmNNNNMMMNNNNNmmmmmmmmmmmmmmmmmmNNNNmmdhso/:-`````````````````````````````...``..``````````````...---:::::////++odNNNNNNNNNNNNNNNNNNNNNNNmmddddhhhhhhhhhhhhhhhhhhhhhhdddmdddddddhhhhhhhhhhhhhhhhhhdddddddddddddNNMMMNmdddhhhhhhhhhhhhhhhhhhhhhhhddmNNNNNMMMMNNNNNNNNNNNNNNNNNNmdyo/:.``
`````````````````````````````````...`````````````````````````````...---:::::////++hNNNNNNNNNNNmNNNNNNNNNNNNNNNNmmmmddddddddddddddddmmmmmddddddddddhhhhhhhhhhhhhhhhddddddddddddddmNMMMMNmddddhhhhhhhhhhhhhhhhhhhdddddddmNNNNNMMMMMMMMMMMNNNNmdyo:-.````````````````````````````````````````````````...``````````````````````````````````.`...---::::::///++sNNNNNNNNmmmmmmmmmmmmmmmmmmNNNNNNNNNmmmmmmmmmmmmmmmddddddddddddddhhhhhhhhhhhhhhddddddddddddddddNNMMMMmdddddhhhhhhhhhhhhhhhhhdddddddddddmNNMMMMMMMMMNNmhs+:.```````
```````````````````````````````````````````````````````...``````````````````````````````````````````````...---::::://///+smNNNNNNmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmddddddddddddddddddhhhhhhhhhhhhdddddddddddddddddmNMMMMNmdddddddhhhhhhhhhhhdddddddddddddmmNNMMMMMMNmds+:.`````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````...---::::::////+omMNNNNNmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmdddddddddddddddddddddddddhhhhhhhhdddddddddddddddddddddNMMMMMNmdddddddddddddddddddddddddddmmNNNMMMMMNmho/-.```````````
```````````````````````````````````````````````````````````````````````````````````````````````````````````````...---::::://///omMNNNNNmmmmmmmmmmmmmmmmdddddmmdmmdddddddddddddddddddddddddddddddddhddddddddddddddddddddddddddddmNMMMMMNmddddddddddddddddddddddmmmNNMMMMMMNdy+:..`````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````...---::::::////omMMNNNNmmmmmmmmmmdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmMMMMMNmmddddddddddddddddmmmNNNMMMMMMNNds+:..`````````````````
```````````````````````````````````````````````````````````````````````````````````````````````````````...---::::::////smMMNNNNmmmmmmmmdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmNMMMMMNmmmmdddddddmmmmmNNNMMMMMMMNdyo/-...```````````````````````````````````````````````````````````````````````````````````````````````````````````````````...---:::::::///sNMMNNNNmmmmmmmdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmNMMMMMNmmmmmmmmmmmNNNMMMMMMMNmhs/-...```````````````
``````````````````````````````````````````````````````````````````````````````````````````````...---::::::://+hNMMNNNNmmmmmdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmNMMMMMNNNmNNNNNNNMMMMMMMMNmyo/-...``````````````````````````````````````````````````````````````````````````````````````````````````````...---:::::////smMMMNNNNmmmmddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmNMMMMMMNNNNMMMMMMMMMMMNdyo/---...``````````````
```````````````````````````````````````````````````````````````````````````````````...---::::////odNMMMMNNNmmmmddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmmmmmmmmmmmNMMMMMMMMMMMMMMMMMMNds+:---...`````````````````````````````````````````````````````````````````````````````````````````````...---::::////+hNMMMMMNNNmmmmddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmmmmmmmmmmmmmmNNMMMMMMMMMMMMMMNmho/:--...``````````````
` ``````````````````````````````````````````````````````````````````````````...---::::///++ymMMMMMMMNNmmmmdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddmmmmmmmmmmmmNNNNNNNNNMMMMMMMMMMMNdyo/---...``````````````````````````````````````````````````````````````````````````````````````...---:::////++ohmMMMMMMMMMNNmmmdddddddddddddddddddddddddddddddddddddddddddddddddddddddddmmmmmmmmmmmmmmmmmmNNNNNNNNNNMMMMMMMMMMNmhs+:---...````````````
```````````````````````````````````````````````````````````````````````...---:::://+++osdNMMMMNMMMMMMNNmmmmdddddddddddddddddddddddddddddddddddddddddddddddddmmmmmmmmmmmmmmmmmmmmNNNNNNNNNNMMMMMMMMMMMmdyo/:---...`````````````````````````````````````````````````````````````````````````````...---::::///+++oshmMMMMNNNNNNMMMMMNNmmmmdddddddddddddddddddddddddddddddddddddddddddmmmmmmmmmmmmmmmmmmmNNNNNNNNNNNMMMMMMMMMMMNmhs+:---...`````````
````````````````````````````````````````````````````````````````...---::::///++ooshmNMMMNNNmmmmmNNMMMMMNNmmmmddddddddddddddddddddddddddddddddddmmmmmmmmmmmmmmmmmmmmNNNNNNNNNNNNMMMMMMMMMMMMNmhso/:---...````````````````````````````````````````````````````````````````````...----:::::///++ooyhmNMMMMNNmmmmmmmmmNNMMMMMNNmmmmddddddddddddddddddddddddmmmmmmmmmmmmmmmmmmmmmNNNNNNNNNNNNNNMMMMMMMMMMMMMNmdyo/:---...````````` ```````````````````````
``` ``````````````````````````````````````````````````````...----:::////++oosyhdmNMMMMMNNmmmmmdddddmmNNMMMMMNNmmmmmdddddddddddmmmmmmmmmmmmmmmmmmmmmmmmmNNNNNNNNNNNNNNMMMMMMMMMMMMMMMNmdyo+::---...`````````` ````````````````````````````````````````
````````````````````````````````````````````````...----:::://+++ooossyhdmNNMMMMMMMMNNmmmdddddddddmmNMMMMMMNNmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmNNNNNNNNNNNNNNMMMMMMMMMMMMMMMMMNmdyo+::---...```````````` ````````````````````````...``````````````````
````````````````````...`...---:::::///++++oossyyhhdmmNNMMMMMMMMMMMMNmmmmdddddddddddmmNMMMMMMNNmmmmmmmmmmmmmmmmmmmmmmmmNNNNNNNNNNNNNNNMMMMMMMMMMMMMMMMMMMNmhyo//:---...```````````````````` ```````````````````````...````````````````
```````````````...----:::::::::::://///////++++++oooosssyhhhdmmNNNMMMMMMMMMMMMMMMMMNmmmmmddddddddddmmmmNMMMMMMNNNmmmmmmmmmmmmmNNNNNNNNNNNNNNNNNNMMMMMMMMMMMMMMMMMMMNNmhyo//::---...``````````````````````````` ` ```````````````````````...---...````````
```````````````....`.-://++oosssyyyyyyyyyyyyyyyyyhhhhddddmmmNNMMMMMMMMMMMMMNNNNMMMMMMMNNmmmmmmmmmmmmmmmmmmmNNMMMMMMNNNNNNNNNNNNNNNNNNNNNNNNNMMMMMMMMMMMMMMMMMMMMMMNNdhso//::---...`````````````````````````````````````````````````````````````````````````````...---....```````
````````````...-:/++ossyyyhhhhhdddddddddddddmmmmmmmmmmmNNMMMMMMMNNNNNNNNNMMMMMMMNNmmmmmmmmmmmmmmmmmmmmNNMMMMMMMNNNNNNNNNNNNNNNMMMMMMMMMMMMMMMMMMMMMMMMNNmhys+//::::---...``````````````````````````````````````````````````````````````````````````````...---....``````
``````````..---.`.--:/++oossyyyyyyyhhhhhhhhhhhhhddddddddmmmmmNNNMMMMMMMMNNNMMMMMMMMNNmmmmmmmmmmmmmmmmmmmmNNNMMMMMMMMMNNNNNMMMMMMMMMMMMMMMMMMMMMMMMMMNmdhyo+//:::::::---...``````````````````````````````````````````````````````````````````````````...---..``````
``````````...---...--://++ooossssssssssyyyyyyyyyyhhhhhhhdddddmmmmmNNMMMMMMMMMMMMMMMMNNmmmmmmmmmmmmmmmmmmmmmNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNmmdhso+//:::::::::::---...````````````````````````````````````````````````````````````````````...---::://:---...---...`````
`````````..---...--::///+++ooooooooooooosssssssyyyyyyhhhhhddddmmmmNNNMMMMMMMMMMMMMMMMNNNNNNNNNNNNNNNNNNNNNMMMMMMMMMMMMMMMMMMMMMMMMMNNmmdhyso++////:::::::::::::---...`````````````````````````````````...---...-:/++ossyyyyso+::---...---...`````
``````````...---::///+++++++++++++ooooooosssssyyyyyyhhhhddddmmmmmNNNNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNNmmdhysso++////////////:::::::::::::---...``...`...---...``.-:/oyhdddhhhyyyyyyyyss+::---...`````
``````````...---::://////////++++++++oooooossssssyyyyyyhhhhdddddmmmmmmNNNNNNNNNNMMMMMMMMMMMMMMMMMMMMMMNNNNNmmmdhyyso++++//////////////////::::::::::::::::---...---...````.-:+sdmNMMNNmmddhhyyyyyyyyssso+/::---..`````
```````...----::://///////////++++++++oooossssssyyyyyyyhhhhhhdddddddmmmmmmmmmmmmmmmmmmmmmmmmdddhhhysssoooo++++++++//////////////////::::::::::::::::::---.---...---...````..:+sdmNMMMMMMNNNmmmddhhyyyyyssysssso/::::---...---...````
````...----:::::://///////////+++++++oooosssssssyyyyyyyyyyyyyyyyyyyyyyyyyyyyyysssssooooooo++++++++++++++++//////////////////::::::::::::::::::::::::---...-...---...``````.-+shmMMMMMMMMMMMMMNNNmmddhhyyyysssssssso+//::::---...---..````
``...----:::::::::://////////++++++oooooossssssssssssoooooo++++++++++++++++++++++++++++++++++++++////////////////////::::::::::::::::::::::::::::::---..----...---.---...----...---...``````.-/ohmNMMMMMMMMMMMMMMMMMMNNNmmddhyyysssssssooo+////::::---.---..```
``...---::::::::::::////////++++++ooooooooooooo++++++++/////////+++++++++++++++++++///////////////////////////::::::::::::::::::::::::::::::::::---...---...```````..:+ydNMMMMMMMMMMMMMMMMMMMMMMMNNNmmddhyyssssoooooooo///////::::---..``
`...---::::::::::::////////+++++++++++++++++////////////////////////+++++////////////////////////////////:::::::::::::::::::::::::::::::::::---...````````.-+sdNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmmddhyssoooooooooo///////::::::---..---..``
``...---::::::::::::////////++++++///////////////////////////////////////////////////////////////////::::::::::::::::::::::::::::::::::---:::::----:::::::::---:::::---...`````````.-+hmMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmmdhyssooo+++++++////////:::::---.``
`...---:::::::::////////////////////////////////////////////////////////////////////////////////::::://::::::::::::::::::::::::::---:::::::::::::::::::::::::::::::::::::---::::::::::::::::::---...`````````..-/+++mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmmdhysooo++++++++/////////:::---.``
``...---::::::::::///////////////////////////////////////////////////////////////////////////::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---...````````..-://++++++mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmddhysoo++++++++////////::::---.``
`...---::::::::////////////////////////////////////////////////////////////////////////:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---...``````..--:////////++++mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmmdhysoo++++++///://::::::::---..`
``...---::::::::::////////////////////////////////////////////////////////////////:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---...-://////:::::://+++mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmmdhysoo++++++///:/:::::::::---..``
...---:::::::::::::::::::::::://:::::::::::://////////////////////////:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---...--:////::::::::::::///+/dMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmddhysoo++++++//:-::::::::---..``
...---:::::::::::::::::::::::::::::::::::::::://///////////:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::://////:::::::::::----...-/++::::::::::::::::::::::////yMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmdhyysoo+++//:-.``:::::---..````
...---:::::::::::::::::::::::::::::::::::::::////////:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::///////:::::::----...-/+osyyys/:--::::::::::---::::///oNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmdhysso++/-..``` `:::::---..``````
...---:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---...-:/ossyyyyyyyy/---:::::---...-dMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNmmdhyso/:-..````` `-::---...````````
...---:-:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---...-:/osssssssssyyyyyyy/---..``````oMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNmmhyo/:-..``````` `-:----...````````
...---::-:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---...-/oydmNmmdyssssssssssssyy+---...``````` .mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNdhs+:--...``````` `---...````````
...---:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---..-:/oydmNMMMMMNmdyssoooosssssssso:---..``````````sMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNmdyo/:--...```````` `.----...````````
...---:---:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---:+shdNNMMMMMMMMMMNmdysoooooossssssss:-..---...```````` -mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNmdhso/:-...`````````` ``.---...````````
...---:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---:/oyhmNMMMMMMMMMMMMMMMMMmdhsoooooooossssss+-...-...``````````oMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNNmdhyo+/:-..``````````` `````...````````
...`...---:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---/+sydmNMMMMMMMMMMMMMMMMMMMMMMNdhsoooo+oooossooo+-...```````` .hMMMMMMMMMMMMMMMMMMMMMMMMNNmmddhyso+/:-..``````````````````````....````````
...```...---::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::---:/oydmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdhsoo+++++oooooooo/...````````` -mMMMMMMMMMMMMMMMMMMMMNNmmddhhysso+/:-..```````````````````````````````````
...```...---::::::::::::::::::::::::::::::::::::::::::::---:/oshmNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMmdyso++++++++oooooo+-...``````````:dMMMMMMMMMMMMMMMNNNmmddhhyysso+/:--..``````````````````````````````
```````````````````````````````````````````````````````````````...``...---::::::::::::::::::::::::::::::::::::---:/oyhmNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNmdyso++////+++++++++:...`````````````....```...---:::::::---::/+oyhmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNmhyso+//////++++++++/-...`````````-hMMMMMMMMNNNNNmmmddhhyyyssoo+/:--..````.+dmNNNNNmmmdddhhhyyysssoo+//:-..```` ``````````
`...---:/+oyhdNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNmhyso+//::///++++++++:...``````````./shhhdddhhhyyyysssooo+//:-..````` ``````
`...`...---:/+oyhmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdhso++/::::///+++++++/:.``...```````````.:+ossyyysssssoo+++/::-..````` ```````
`...`...---:://+oyhhdmmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNmhyso+//::::::///+//////-.``...```````````.-://++++++++//::--..````` ````````
`...`...``...-.---::::///++oossyhhdmmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMmdyso+//:::--::://///////:.```...````````````..-:::::::--..``````` `````````
`...`...```````...---:::::::::/::::::///++ossyhhdmmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdhyo++//::----::://///////:.````...``````````````...```````` ``````````
`...`...``````````...-::-...---:::::::::::://::::::::::::::::://++oosyhhdmmNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNdhyso+//::---::::////////:.`````...```....``````````````````````` ```````````
`...`.`````````````...-::-..---::/+o+/::::::::::::::::::-::::--::://++oosyyhddmNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNmdhyso+//::---::::////////:.```````.`````....``````````````````` ````````````
`...````````````````...-:-....---::/o+/::--::----:---::://++ossyhhdmNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNmdhyso+//::---:::::///////:.``````````````....``````````` ``````````````
`...`````````````````````..-::-...---::+++::---:://++oosyyhddmNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNmdhyso+//::---:::::://////:.```````````````...````````````` `````````````````
`....`````````````````````````..-:-...---:/++/:---:://++oossyyhdmmNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNmdhysso+//:---::::::://////-``````````````....``````````````` ```````````````````
`..````````````````````````````..--...---...--:/+/:---:://++oossyyhddmNNNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNNmddhyyso++/::---:::::://////:.```````````````...``````````````````` ```` ````````````````````````
`.``````````````````````````````.--...--...-::++:---::://++oossyyhhddmmNNNMMMMMMMMMMMMMMMMMMMMMMMMMNNNmddhhyysoo+//::---::::::///////:.```````````````...`````````````````````````````````````````````````
`````````````````````````````````.--...--:/+/:---::://+++oossyyhhdddmmNNNMMMMMMMMMMMMMMMMNNNmmdddhhhyysoo+//::---::::::///////:.`````````````...```````````````````````````````````````````````
`````````````````````````````````.--...--:/+/---...---..---::://+++ooosssyyhhhddddmmmmmNNNNNMMNmmdddhhhhyyyssoo+//::---:::::::///////:-`````````````...```````````````````````````````````````````
``````````````````````````````````.-..````...--://:-...---..---:::///+++oooosssyyyyyyhhhhhhhhdNNmdhyyyyyysssoo++//:::---...---:::::::////////::.``````````````...``````````````````````````````````````
````````````````````````````````````.-.``````...--://--...---::::///+++oooosssssyyyyyyyyydNmhyssooooo++///:::---...-..---:::::::::///////::-.``````````````...``````````````````````````````````
`````````````````````````````````````.-.``````````...-://:-...---::::////++++oooooooosssssydmhso+++////::::---...---:::::::::::///////::--..``````````````````````````````````````````````````
``````````````````````````````````````.-.````````````````...-://:-...---:::::////++++++++++++oydho+///:::---...---::::::::::::://////:::::---...```````````````````````````````
```````````````````````````````````````.-.````````````````````...-://:-...---:::::://////////+shs+/:::---...---::::::::::::::::::::::::::---```````````````````````````````
```````````````````````````````````````.-.`````````````````````...-::/:-...---:::::::::/oyo/:---...---:-:::::::::::::---...```````````````````````````````
``````.-.```````````````````````...``..--:/:-...---:os+:----...---`
```````.-..`````````````````````````.`.`...```...``...-:/:-...-/++:----...---..---`
`````````.-.````````````````````````````````````..```..-:/:-...-//:---...---...---`
``````````.-..```````````````````````````````````.````..-:::-...-://:--...---...---`
````````````.-.`````````````````````````````````````````..-:::-...-:/:--...---`
``````````````...````````````````````````````````````````..-:::-...-:::--...---`
```````````````...`````````````````````````````````````````..-:::...```....--::--...---`
````````````````....````````````````````````````````````````..--::-...`..`.```...`````...--:--...---`
````````````````...-..````````````````````````````````````````..-::--...````.``````.```````...--::--...---`
````````````````...-..``````````````````````````````````````````..-::-...`...````````````````````````...---...---`
````````````````...-..````````````````````````````````````````````..-::-..``...`````````````````````````````````````...---...---`
````````````````...-..``````````````````````````````````````````````..-::-..``````....```...``.``````.````````````````````````````````````...---...-...---`
````````````````...-..````````````````````````````````````````````````..----..``````````````````````````````````````````````````````````````````````...---.```````````````````````````...`
````````````````...-..```````````````````````````````````````````````````..---..```````````````````````````````````````````````````````````````````````````...----
````````````````...-..``````````````````````````````````````````````````````..---..``````````````````````````````````````````````````````````````````````````````````````````..----
````````````````...-..`````````````````````````````````````````````````````````.---..````````````````````````````````````````````````````````````````````````````````````````..----
````````````````...-..````````````````````````````````````````````````````````````..---..````````````````````````````````````````````````````````````````````````````````````..----
````````````````...-..````````````````````````````````````````````````````````````````.---..`````````````````````````````````````````````````````````````````````````````````..----
````````````````...-..````````````````````````````````````````````````````````````````````..--...````````````````````````````````````````````````````````````````````````````..----
````````````````...`````````````````````````````````````````````````````````````````````````..--....``````````````````````````````````````````````````````````````````````..----
9/30
SHELLCODE - What's a shellcode ?
•
Payload
•
Executable code
•
Open a shell
• Open a port (TCP, socket, ...)
• Copy a file (/etc/passwd, ...)
• Execute a program
• ...
execve(/bin/sh) - sajith (19 bytes)
31 C0 50 68 2F 2F 73 68 68 2F 62 69 6E 87 E3 B0 0B CD 80
9/30
SHELLCODE - What's a shellcode ?
•
Payload
•
Executable code
•
Open a shell
• Open a port (TCP, socket, ...)
• Copy a file (/etc/passwd, ...)
• Execute a program
• ...
execve(/bin/sh) - sajith (19 bytes)
31 C0 50 68 2F 2F 73 68 68 2F 62 69 6E 87 E3 B0 0B CD 80
10/30
SHELLCODE - Buffer Overflow + Shellcode = Profit!
Into the Stack
Buffer Overflow Shellcode
11/30
SHELLCODE - What do we want ?
•
Assembly coding
•
Shortest !
•
NULL free
•
Printable characters (0x20-0x7F)
•
Alphanumerical characters
•
...
12/30
SHELLCODE - How to make one ?
Starting instruction
Set the registereaxto 0
Instructions Hexadecimal Length (bytes) mov eax, 0x0 B8 00 00 00 00 5
Improvements
mov al, 0x0 B0 00 2
mov al, 0x1
B0 01 FE C8 4 dec al
xor eax, eax 31 C0 2
12/30
SHELLCODE - How to make one ?
Starting instruction
Set the registereaxto 0
Instructions Hexadecimal Length (bytes) mov eax, 0x0 B8 00 00 00 00 5
Improvements
mov al, 0x0 B0 00 2
mov al, 0x1
B0 01 FE C8 4 dec al
xor eax, eax 31 C0 2
12/30
SHELLCODE - How to make one ?
Starting instruction
Set the registereaxto 0
Instructions Hexadecimal Length (bytes) mov eax, 0x0 B8 00 00 00 00 5
Improvements
mov al, 0x0 B0 00 2
mov al, 0x1
B0 01 FE C8 4 dec al
xor eax, eax 31 C0 2
12/30
SHELLCODE - How to make one ?
Starting instruction
Set the registereaxto 0
Instructions Hexadecimal Length (bytes) mov eax, 0x0 B8 00 00 00 00 5
Improvements
mov al, 0x0 B0 00 2
mov al, 0x1
B0 01 FE C8 4 dec al
xor eax, eax 31 C0 2
13/30
SHELLCODE - Keep pushing !
Improve, adapt, overcome - Printable
Instructions Hexadecimal Length (bytes) Display and al, 0x24
24 24 24 40 4 $$$@
and al, 0x40
and eax, 0x25252525 25 25 25 25 25
25 40 40 40 40 10 %%%%%
%@@@@
and eax, 0x40404040
14/30
SHELLCODE - The future
Generators
Shellcode Obfuscated shellcode
Encoding
Decoder Encoded shellcode
14/30
SHELLCODE - The future
Generators
Shellcode Obfuscated shellcode
Encoding
Decoder Encoded shellcode
14/30
SHELLCODE - The future
Generators
Shellcode Obfuscated shellcode
Encoding
Decoder Encoded shellcode
15/30
DEFENSE - Introduction
16/30
DEFENSE - Language choice
17/30
DEFENSE - Buffer supervision
Classic C : strcopy - strcat A better way :
strncpy - strncat A better better way :
strlcpy - strlcat
(only when using OpenBSD)
18/30
DEFENSE - Canaries
19/30
DEFENSE - Canaries
Three types of canaries :
Terminator : filled with strings terminators Random : filled with randoms characters
XOR : filled with XOR-scrambled random characters
20/30
DEFENSE - Non executable stack
21/30
DEFENSE - Address space layout randomization
22/30
DEFENSE - Coverity static analysis
23/30
DEFENSE - Conclusion
24/30
REAL CASES - Morris Worm
25/30
REAL CASES - SQL Slammer
26/30
REAL CASES - Blaster worm
27/30
REAL CASES - AOL Instant Messenger
28/30
REAL CASES - Ghost
29/30
DEMO
30/30
References
44CON London -
