360壳分析

https://www.52pojie.cn/thread-679354-1-1.html

以上是针对Oncreate脱壳的文章

为了学习壳这一概念，先是学习了安卓一代壳以及安卓二代壳，在简单的了解到安卓java层防护后，转向学习了自定义linker加载，期间学习到了很多，比如elf文件格式，so加载流程等等，这里为了知识落地，分析分析360壳，后期会逐步了解vmp虚拟化技术，dex2c 等等高级的防护以及混淆技术

https://bbs.kanxue.com/thread-280609.htm

先是判断了系统架构

这点从assets目录下获取so，然后加载都很经典，直接看是哪个so吧

是libjiagu.so，直接分析arm64的libjiagu_a64.so

用ida打开发现符号表被去完了，导入和导出函数也没有

但是我看了这个so，没有看到init，start程序入口函数的逻辑也很密，函数表被去了，看着想是没有经过重定位的半成品，那他该如何加载呢，可能是在加载的时候有其他so在解密这个？为此用了去找so退出和so加载链的frida代码

function hook() {
  var addr = null;
  var module = Process.getModuleByName("libc.so");
  if(module) {
    addr = module.getExportByName("dlopen");

    console.log("dlopen:", addr);
    Interceptor.attach(addr, {
      onEnter: function (args) {
        var loadName = args[0].readCString();
        console.log("dlopen: ", loadName);
      },
      onLeave: function (retval) {}
    });


    var android_dlopen_ext = module.getExportByName("android_dlopen_ext");
    console.log("android_dlopen_ext:", android_dlopen_ext);
    Interceptor.attach(android_dlopen_ext, {
      onEnter: function (args) {
        this.call_hook = false;
        var so_name = ptr(args[0]).readCString();
        console.log("android_dlopen_ext:", so_name);
      },
      onLeave: function (retval) { }
    });
  }else{
    setTimeout(hook, 100);
  }
}
hook();

[Pixel 6::com.oacia.apk_protect ]-> android_dlopen_ext: libstats_jni.so
android_dlopen_ext: /data/app/~~nwpXrmiNn9bLdr0QD3h_zg==/com.oacia.apk_protect-wzNJ_ZP-HATGg6hfimwwnA==/oat/arm64/base.odex
android_dlopen_ext: libframework-connectivity-jni.so
android_dlopen_ext: /data/data/com.oacia.apk_protect/.jiagu/libjiagu_64.so
dlopen:  liblog.so
dlopen:  libz.so
dlopen:  libc.so
dlopen:  libm.so
dlopen:  libstdc++.so
dlopen:  libdl.so
dlopen:  libjiagu_64.so
dlopen:  libjiagu_64.so
dlopen:  libart.so
dlopen:  libjiagu_64.so
dlopen:  libjiagu_64.so
Process terminated

说明这个就是第一个加载的so，那应该是单纯导入表和导出表还没有被链接好，这个时候就直接试着去内存dump下来，然后sofixer

内存dump so


function my_hook_dlopen(soName = '') {
    try {
        var dlopen_addr = Module.findExportByName(null, "android_dlopen_ext");
        if (!dlopen_addr) {
            console.log("[ERROR] android_dlopen_ext not found");
            return;
        }
        
        console.log("[+] Found android_dlopen_ext at:", dlopen_addr);
        
        Interceptor.attach(dlopen_addr, {
            onEnter: function (args) {
                try {
                    var pathptr = args[0];
                    if (pathptr !== undefined && pathptr != null) {
                        var path = ptr(pathptr).readCString();
                        console.log("[dlopen] Loading:", path);
                        if (path && path.indexOf(soName) >= 0) {
                            this.is_can_hook = true;
                            console.log("[+] Target SO found:", path);
                        }
                    }
                } catch (e) {
                    console.log("[ERROR] onEnter: " + e.message);
                }
            },
            onLeave: function (retval) {
                try {
                    if (this.is_can_hook) {
                        console.log("[+] Attempting to dump SO...");
                        dump_so(soName);
                    }
                } catch (e) {
                    console.log("[ERROR] onLeave: " + e.message);
                }
            }
        });
    } catch (e) {
        console.log("[ERROR] my_hook_dlopen failed: " + e.message);
    }
}
function dump_so(so_name) {
    try {
        var libso = Process.getModuleByName(so_name);
        if (!libso) {
            console.log("[ERROR] Module not found: " + so_name);
            return;
        }
        
        console.log("[name]:", libso.name);
        console.log("[base]:", libso.base);
        console.log("[size]:", ptr(libso.size));
        console.log("[path]:", libso.path);
        
        // 使用应用私有目录，避免权限问题
        var file_path = "/data/data/com.oacia.apk_protect/" + libso.name + "_" + libso.base + "_" + ptr(libso.size) + ".so";
        
        var file_handle = new File(file_path, "wb");
        if (file_handle && file_handle != null) {
            Memory.protect(ptr(libso.base), libso.size, 'rwx');
            var libso_buffer = ptr(libso.base).readByteArray(libso.size);
            file_handle.write(libso_buffer);
            file_handle.flush();
            file_handle.close();
            console.log("[dump]:", file_path);
        }
    } catch (e) {
        console.log("[ERROR] dump_so failed: " + e.message);
    }
}
setImmediate(my_hook_dlopen("libjiagu_64.so"));

https://github.com/F8LEFT/SoFixer

D:\Android\soshell>"SoFixer-Windows-64 (1).exe" -s "D:\Android\JS\libjiagu_64.so_0x78500a6000_0x274000.so" -o "D:\Android\JS\libjiagu_64.so_0x78500a6000_0x274000.so" -m 0x78500a6000 -d
[main_loop:37]Use debug mode
[main_loop:87]start to rebuild elf file
[Load:69]dynamic segment have been found in loadable segment, argument baseso will be ignored.
[RebuildPhdr:25]=============LoadDynamicSectionFromBaseSource==========RebuildPhdr=========================
[RebuildPhdr:37]=====================RebuildPhdr End======================
[ReadSoInfo:549]=======================ReadSoInfo=========================
[ReadSoInfo:696]soname
[ReadSoInfo:629] constructors (DT_INIT_ARRAY) found at 2d760
[ReadSoInfo:633] constructors (DT_INIT_ARRAYSZ) 2
[ReadSoInfo:637] destructors (DT_FINI_ARRAY) found at 2d770
[ReadSoInfo:641] destructors (DT_FINI_ARRAYSZ) 2
[ReadSoInfo:580]string table found at fb0
[ReadSoInfo:584]symbol table found at 4e8
[ReadSoInfo:595] plt_rel_count (DT_PLTRELSZ) 114
[ReadSoInfo:591] plt_rel (DT_JMPREL) found at 2220
[ReadSoInfo:699]Unused DT entry: type 0x00000009 arg 0x00000018
[ReadSoInfo:699]Unused DT entry: type 0x6ffffffb arg 0x00000001
[ReadSoInfo:699]Unused DT entry: type 0x6ffffff9 arg 0x00000061
[ReadSoInfo:703]=======================ReadSoInfo End=========================
[RebuildShdr:42]=======================RebuildShdr=========================
[RebuildShdr:536]=====================RebuildShdr End======================
[RebuildRelocs:783]=======================RebuildRelocs=========================
[RebuildRelocs:809]=======================RebuildRelocs End=======================
[RebuildFin:709]=======================try to finish file rebuild =========================
[RebuildFin:733]=======================End=========================
[main:123]Done!!!

https://bbs.kanxue.com/thread-191649.htm

sofixer：这个是因为编译好的so中函数调用，全局变量访问一般是符号索引或相对偏移，sofixer模拟linker去修复了这个符号和变量地址，然后再把PLT表和GOT里面的占位地址修复成真正加载的地址。

给我的感觉就是，sofixer很像linker的重定位部分

回顾

dynamic在linker的时候，会告诉linker要加载的库，符号和字符串表信息，重定位表

sofixer之后，发现了我们导入表和函数表这些信息也就恢复了，这个时候我们再去分析一下init_array里面的东西

看到大量字符串解密的函数，dump解密一下

#include <stdio.h>
#include <string.h>
int main(){
    unsigned char unk_18457[17] = {
        0x8A, 0xD5, 0xD7, 0xCA, 0xC6, 0x8A, 0x80, 0xC1, 0x8A, 0xC6, 0xC8, 0xC1, 0xC9, 0xCC, 0xCB, 0xC0, 
        0xA5
        };
    unsigned char unk_2E0F0[8] = {
        0xC6, 0xCA, 0xC8, 0x8B, 0xC4, 0xD0, 0xD1, 0xCA
        };
    unsigned char a[] = {
        0xC6, 0xCA, 0xC8, 0x8B, 0xC4, 0xD0, 0xD1, 0xCA, 0xC6, 0xCA, 0xCB, 0xCB, 0xC0, 0xC6, 0xD1, 0xD2, 
        0xCC, 0xC3, 0xCC, 0x8B, 0xC4, 0xD5, 0xD5, 0xA5, 0xC6, 0xCA, 0xC8, 0x8B, 0xD5, 0xCD, 0xCA, 0xCB, 
        0xC0, 0xC8, 0xC4, 0xCB, 0xC4, 0xC2, 0xC0, 0xD7, 0x97, 0x96, 0x91, 0x90, 0x8B, 0xDF, 0xCD, 0xD0, 
        0xD6, 0xCD, 0xCA, 0xD0, 0xA5, 0xC6, 0xCA, 0xC8, 0x8B, 0xC0, 0xC1, 0xD2, 0xC4, 0xD7, 0xC1, 0xCE, 
        0xCC, 0xC8, 0x8B, 0xC4, 0xCB, 0xC1, 0xD7, 0xCA, 0xCC, 0xC1, 0x8B, 0xD6, 0xC6, 0xD7, 0xC0, 0xC0, 
        0xCB, 0xD6, 0xCD, 0xCA, 0xD1, 0xCC, 0xD1, 0xC3, 0xD0, 0xC9, 0xC9, 0xCB, 0xCA, 0xD7, 0xCA, 0xCA, 
        0xD1, 0xA5, 0xC6, 0xCA, 0xC8, 0x8B, 0xC8, 0xC4, 0xD7, 0xCE, 0xC0, 0xD1, 0x97, 0x96, 0x91, 0x90, 
        0xA5, 0xC6, 0xCA, 0xC8, 0x8B, 0xC2, 0xCA, 0xCA, 0xC6, 0xCA, 0xCC, 0xCB, 0x8B, 0xC6, 0xC9, 0xCC, 
        0xC0, 0xCB, 0xD1, 0x8B, 0xC4, 0xCB, 0xC1, 0xD7, 0xCA, 0xCC, 0xC1, 0xA5, 0xC6, 0xCA, 0xC8, 0x8B, 
        0xD4, 0xCC, 0xCD, 0xCA, 0xCA, 0x8B, 0xD5, 0xC0, 0xD7, 0xC8, 0xC8, 0xC2, 0xD7, 0xA5, 0xC6, 0xCA, 
        0xC8, 0x8B, 0xD4, 0xCC, 0xCD, 0xCA, 0xCA, 0x8B, 0xC4,0xD5, 0xD5, 0xD6, 0x01, 0xCA, 0xD7, 0xC0
        };
    for(int i=0;i<173;i++){
        a[i]^=0xa5;
        if(a[i]!=0){
            printf("%c",a[i]);
        }
    }
}
/*
*/

com.autoconnectwifi.appcom.phonemanager2345.zhushoucom.edwardkim.android.screenshotitfullnorootcom.market2345com.goocoin.client.androidcom.qihoo.permmgrcom.qihoo.apps�com.autoconnectwifi.appcom.phonemanager2345.zhushoucom.edwardkim.android.screenshotitfullnorootcom.market2345com.goocoin.client.androidcom.qihoo.permmgrcom.qihoo.apps

检测了大量apk的包名，具体作用不详，猜测是在检测？

检测分析

这里看看反frida检测在哪，先用stackplz去trace一下系统调用，

8197|8197|cia.apk_protect] openat(dirfd=-100, *pathname=0x7853b42775(/proc/self/maps), flags=0x0, mode=0o000) LR:0x7b6adf434c PC:0x7b6ae40878 SP:0x7ff945baa0

[8197|8197|cia.apk_protect] openat(dirfd=-100, *pathname=0x7853b42775, flags=0x0, mode=0o000, ret=77)

[8197|8197|cia.apk_protect] openat(dirfd=-100, *pathname=0xb40000790abc12d0(/data/data/com.oacia.apk_protect/.jiagu), flags=0x84000(O_CLOEXEC|O_DIRECTORY), mode=0o000) LR:0x7b6adf4460 PC:0x7b6ae40878 SP:0x7ff945c090

[8197|8197|cia.apk_protect] openat(dirfd=-100, *pathname=0xb40000790abc12d0, flags=0x84000(O_CLOEXEC|O_DIRECTORY), mode=0o000, ret=77)

[8197|8197|cia.apk_protect] openat(dirfd=-100, *pathname=0x7853b42775(/proc/self/maps), flags=0x0, mode=0o000) LR:0x7b6adf434c PC:0x7b6ae40878 SP:0x7ff945ba10

[8197|8197|cia.apk_protect] openat(dirfd=-100, *pathname=0x7853b42775, flags=0x0, mode=0o000, ret=77)

[8197|8197|cia.apk_protect] openat(dirfd=-100, *pathname=0x7853b42775(/proc/self/maps), flags=0x0, mode=0o000) LR:0x7b6adf434c PC:0x7b6ae40878 SP:0x7ff945b9e0

[8197|8197|cia.apk_protect] openat(dirfd=-100, *pathname=0x7853b42775, flags=0x0, mode=0o000, ret=77)

hook open

按照CTF的习惯，为了方便以后的分析，选择先分析寻找一下壳的反调试代码

这里我们可以hook经典的几种，端口检测，内存区域检测，字符串检测，线程检测

如果是内存区域检测的话，肯定是open或者openat了


function hook_open(){
    var pth = Module.findExportByName(null,"open");
  Interceptor.attach(ptr(pth),{
      onEnter:function(args){
          this.filename = args[0];
          console.log("",this.filename.readCString())
      },onLeave:function(retval){
      }
  })
}
function main(){
	function hook_dlopen(addr,soName,callback){
		Interceptor.attach(addr,{
			onEnter:function(args){
				var sopath=args[0].readCString();
				if(sopath.indexOf(soName)!=-1) hook_init();
			},onLeave:function(retval){

			}
		});
	}
	var dlopen=Module.findExportByName("libdl.so","dlopen");
	console.log(dlopen);
	var android_dlopen_ext=Module.findExportByName("libdl.so","android_dlopen_ext");
	console.log(android_dlopen_ext);
	hook_dlopen(dlopen,myso,hook_init);
	hook_dlopen(android_dlopen_ext,myso,hook_init);
	var isHooked=false;
	function hook_init(){
		console.log("hook_init()");
		var symbols=Process.getModuleByName("linker64").enumerateSymbols();
		var call_constructors_adr=null;
		for(let i=0;i<symbols.length;i++){
			var symbol=symbols[i];
			if(symbol.name.indexOf("_dl__ZN6soinfo17call_constructorsEv")!=-1){
				call_constructors_adr=symbol.address;
			}
		}
		console.log("call_sonstructors_adrress",call_constructors_adr);
		Interceptor.attach(call_constructors_adr,{
			onEnter:function(args){
				if(!isHooked) {
					hook_open();

					isHooked = true;

				}
			},onLeave:function(retval){}

		});

	}
}
var myso="libjiagu_64.so";
setImmediate(main);
function hook_open(){
    var pth = Module.findExportByName(null,"open");
  Interceptor.attach(ptr(pth),{
      onEnter:function(args){
          this.filename = args[0];
          console.log("",this.filename.readCString())
      },onLeave:function(retval){
      }
  })
}
function main(){
	function hook_dlopen(addr,soName,callback){
		Interceptor.attach(addr,{
			onEnter:function(args){
				var sopath=args[0].readCString();
				if(sopath.indexOf(soName)!=-1) hook_init();
			},onLeave:function(retval){

			}
		});
	}
	var dlopen=Module.findExportByName("libdl.so","dlopen");
	console.log(dlopen);
	var android_dlopen_ext=Module.findExportByName("libdl.so","android_dlopen_ext");
	console.log(android_dlopen_ext);
	hook_dlopen(dlopen,myso,hook_init);
	hook_dlopen(android_dlopen_ext,myso,hook_init);
	var isHooked=false;
	function hook_init(){
		console.log("hook_init()");
		var symbols=Process.getModuleByName("linker64").enumerateSymbols();
		var call_constructors_adr=null;
		for(let i=0;i<symbols.length;i++){
			var symbol=symbols[i];
			if(symbol.name.indexOf("_dl__ZN6soinfo17call_constructorsEv")!=-1){
				call_constructors_adr=symbol.address;
			}
		}
		console.log("call_sonstructors_adrress",call_constructors_adr);
		Interceptor.attach(call_constructors_adr,{
			onEnter:function(args){
				if(!isHooked) {
					hook_open();

					isHooked = true;

				}
			},onLeave:function(retval){}

		});

	}
	
}
var myso="libjiagu_64.so";
setImmediate(main);

[Pixel 6::com.oacia.apk_protect ]-> hook_init()
call_sonstructors_adrress 0x79c15fade0
 /proc/self/status
hook_init()
call_sonstructors_adrress 0x79c15fade0
 /proc/self/maps
 /proc/self/maps
 /proc/self/maps
hook_init()
call_sonstructors_adrress 0x79c15fade0
 /proc/self/maps
 /proc/self/maps
hook_init()
call_sonstructors_adrress 0x79c15fade0
hook_init()

看得出来应该是去检测了maps文件，然后去寻找frida字符串的特征

这个/proc/self/status描述了当前进程的运行时状态信息，如进程id，内存使用，线程数等

当进程未被调试的时候，TracerPid值为零，调试的时候，这个调试器的进程ID为非零状态,这个TracerPid就是自己有没有被附加

我不去调试的话，那调试检测可以先不管

这里看作者去绕过的方法是直接去重定向maps文件

其实原本是想打印出函数的地址，然后去ida看，然后找到这个反调试nop掉或者frida绕过的，但是打印了

堆栈发现全是一些内存的，

function hook_open(){
    var pth = Module.findExportByName(null,"open");
    var bbase= Process.findModuleByName(myso);
    Interceptor.attach(ptr(pth),{
      onEnter:function(args){
          this.filename = args[0];
          console.log("duizhan",Thread.backtrace(this.context, Backtracer.ACCURATE)
          .map(addr => addr.sub(bbase.base).toString())
          .join('\n'));
          console.log("",this.filename.readCString())
      },onLeave:function(retval){
      }
  })
}

可是发现输出如下

duizhan 0x33a9aab44
0x33a9aab44
0x117d24
0x117d24
 /proc/self/maps

把这些偏移去ida里面搜索，发现全是0？

可以说明是还没有被填充，难道还有被加密的数据，在运行的时候被填充回去？

那看来只能参考作者的方法去重定向map？

重定向map文件绕过

这里为了防止maps里面的frida字符串等检测，可以直接将maps文件替换成一个不存在的文件，让检测访问不到文件直接，也可以绕过检测，

这里比较神奇了，我用了两个方法去hook，但是两个结果不一样，第一个能hook到另外一个文件status，另外一个可以hook到释放dex的过程？？？。不知道原因目前

// function hook_proc_self_maps() {
//     const openPtr = Module.getExportByName(null, 'open');
//     const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
//     var fakePath = "/data/data/com.oacia.apk_protect/maps";
//     Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
//         var pathname = Memory.readUtf8String(pathnameptr);
//         console.log("open",pathname);
//         if (pathname.indexOf("maps") >= 0) {
//             console.log("find",pathname,",redirect to",fakePath);
//             var filename = Memory.allocUtf8String(fakePath);
//             return open(filename, flag);
//         }
//         var fd = open(pathnameptr, flag);
//         return fd;
//     }, 'int', ['pointer', 'int']));
// }
// function main(){
// 	function hook_dlopen(addr,soName,callback){
// 		Interceptor.attach(addr,{
// 			onEnter:function(args){
// 				var sopath=args[0].readCString();
// 				if(sopath.indexOf(soName)!=-1) hook_init();
// 			},onLeave:function(retval){

// 			}
// 		});
// 	}
// 	var dlopen=Module.findExportByName("libdl.so","dlopen");
// 	console.log(dlopen);
// 	var android_dlopen_ext=Module.findExportByName("libdl.so","android_dlopen_ext");
// 	console.log(android_dlopen_ext);
// 	hook_dlopen(dlopen,myso,hook_init);
// 	hook_dlopen(android_dlopen_ext,myso,hook_init);
// 	var isHooked=false;
// 	function hook_init(){
// 		console.log("hook_init()");
// 		var symbols=Process.getModuleByName("linker64").enumerateSymbols();
// 		var call_constructors_adr=null;
// 		for(let i=0;i<symbols.length;i++){
// 			var symbol=symbols[i];
// 			if(symbol.name.indexOf("_dl__ZN6soinfo17call_constructorsEv")!=-1){
// 				call_constructors_adr=symbol.address;
// 			}
// 		}
// 		console.log("call_sonstructors_adrress",call_constructors_adr);
// 		Interceptor.attach(call_constructors_adr,{
// 			onEnter:function(args){
// 				if(!isHooked) {
// 					hook_proc_self_maps();

// 					isHooked = true;

// 				}
// 			},onLeave:function(retval){}

// 		});

// 	}
	
// }
// var myso="libjiagu_64.so";
// setImmediate(main);
function my_hook_dlopen(soName = '') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    if (path.indexOf(soName) >= 0) {
                        this.is_can_hook = true;
                    }
                }
            },
            onLeave: function (retval) {
                if (this.is_can_hook) {
                    hook_proc_self_maps();
                }
            }
        }
    );
}
 
function hook_proc_self_maps() {
    const openPtr = Module.getExportByName(null, 'open');
    const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
    var fakePath = "/data/data/com.oacia.apk_protect/maps";
    Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
        var pathname = Memory.readUtf8String(pathnameptr);
        console.log("open",pathname);
        if (pathname.indexOf("maps") >= 0) {
            console.log("find",pathname,",redirect to",fakePath);
            var filename = Memory.allocUtf8String(fakePath);
            return open(filename, flag);
        }
        var fd = open(pathnameptr, flag);
        return fd;
    }, 'int', ['pointer', 'int']));
}
 
 
setImmediate(my_hook_dlopen,"libjiagu");

[Pixel 6::com.oacia.apk_protect ]-> hook_init()
call_sonstructors_adrress 0x7d251a5de0
open /proc/self/status
hook_init()
call_sonstructors_adrress 0x7d251a5de0
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
hook_init()
call_sonstructors_adrress 0x7d251a5de0
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/6869/maps
find /proc/6869/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
hook_init()
call_sonstructors_adrress 0x7d251a5de0
Process terminated
[Pixel 6::com.oacia.apk_protect ]->

Thank you for using Frida!
PS D:\Android\JS>  frida -U -f "com.oacia.apk_protect" -l aa.js
     ____
    / _  |   Frida 16.6.6 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Pixel 6 (id=1C091FDF600GB4)
Spawned `com.oacia.apk_protect`. Resuming main thread!
[Pixel 6::com.oacia.apk_protect ]-> open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/10816/maps
find /proc/10816/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /data/data/com.oacia.apk_protect/.jiagu/classes.dex
open /data/data/com.oacia.apk_protect/.jiagu/classes2.dex
open /data/data/com.oacia.apk_protect/.jiagu/classes3.dex
Process terminated
[Pixel 6::com.oacia.apk_protect ]->

Thank you for using Frida!
PS D:\Android\JS>

猜测是因为这个释放dex的过程是在一个自写linker后释放的，不然不应该hook不到dex的调用，因为我是hook的call_construter，按理说调用链是在android_dlopen的leave之前，可是如果是自写linker，需要android_dlopen？

移动到call_constructor之前就可以hook到open dex的过程。。。算了，先埋个种子，后面再来看

总之。这个内存检测的frida检测算是被我们找到了解决方案，继续先试试其他检测，后面再来分析一下这个dex的释放和dex的东西

hook 比较字符串

var bbase;
function my_hook_dlopen(soName = '') {
	Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
		{
			onEnter: function (args) {
				var pathptr = args[0];
				if (pathptr !== undefined && pathptr != null) {
					var path = ptr(pathptr).readCString();
					if (path.indexOf(soName) >= 0) {
						//console.log("soname"+path.split('/').pop());
						this.is_can_hook = true;
					}
				}
			},
			onLeave: function (retval) {
				if (this.is_can_hook) {
					replace_str();
				}
			}
		}
	);
}
setImmediate(my_hook_dlopen,"libjiagu_64.so");
function replace_str() {
	var pt_strstr = Module.findExportByName("libc.so", 'strstr');
	var pt_strcmp = Module.findExportByName("libc.so", 'strcmp');

	Interceptor.attach(pt_strstr, {
		onEnter: function (args) {
			var str1 = args[0].readCString();
			var str2 = args[1].readCString();
			if (
				str2.indexOf("REJECT") !== -1 ||
				str2.indexOf("tmp") !== -1 ||
				str2.indexOf("frida") !== -1 ||
				str2.indexOf("gum-js-loop") !== -1 ||
				str2.indexOf("gmain") !== -1 ||
				str2.indexOf("linjector") !== -1
			) {
				console.log("strstr-->", str1, str2);
				this.hook = true;
			}
		}, onLeave: function (retval) {
			if (this.hook) {
				retval.replace(0);
			}
		}
	});

	Interceptor.attach(pt_strcmp, {
		onEnter: function (args) {
			var str1 = args[0].readCString();
			var str2 = args[1].readCString();
			if (
				str2.indexOf("REJECT") !== -1 ||
				str2.indexOf("tmp") !== -1 ||
				str2.indexOf("frida") !== -1 ||
				str2.indexOf("gum-js-loop") !== -1 ||
				str2.indexOf("gmain") !== -1 ||
				str2.indexOf("linjector") !== -1
			) {
				console.log("strcmp-->", str1, str2);
				this.hook = true;
			}
		}, onLeave: function (retval) {
			if (this.hook) {
				retval.replace(0);
			}
		}
	})

}

replace_str();

啥也没找到

hook D-bus

Frida使用的D-Bus协议通信的，可以遍历/proc/net/tcp文件或者从0到65535，向每个开放的端口发送D-Bus认证信息，哪个端口回复了REJECT，哪个就是frida-server

var bbase;
function my_hook_dlopen(soName = '') {
	Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
		{
			onEnter: function (args) {
				var pathptr = args[0];
				if (pathptr !== undefined && pathptr != null) {
					var path = ptr(pathptr).readCString();
					if (path.indexOf(soName) >= 0) {
						//console.log("soname"+path.split('/').pop());
						this.is_can_hook = true;
					}
				}
			},
			onLeave: function (retval) {
				if (this.is_can_hook) {
					replace_str();
				}
			}
		}
	);
}
setImmediate(my_hook_dlopen,"libjiagu_64.so");

function replace_str() {
	var pt_strstr = Module.findExportByName("libc.so", 'strstr');
	var pt_strcmp = Module.findExportByName("libc.so", 'strcmp');

	Interceptor.attach(pt_strstr, {
		onEnter: function (args) {
			var str1 = args[0].readCString();
			var str2 = args[1].readCString();
			if (str2.indexOf("REJECT") !== -1) {
				//console.log("strcmp-->", str1, str2);
				this.hook = true;
			}
		}, onLeave: function (retval) {
			if (this.hook) {
				retval.replace(0);
			}
		}
	});

	Interceptor.attach(pt_strcmp, {
		onEnter: function (args) {
			var str1 = args[0].readCString();
			var str2 = args[1].readCString();
			if (str2.indexOf("REJECT") !== -1) {
				//console.log("strcmp-->", str1, str2);
				this.hook = true;
			}
		}, onLeave: function (retval) {
			if (this.hook) {
				retval.replace(0);
			}
		}
	})

}

replace_str();

依然没找到

hook 线程创建


function check_pthread_create() {
  var pthread_create_addr = Module.findExportByName(null, 'pthread_create');

  var pthread_create = new NativeFunction(pthread_create_addr, "int", ["pointer", "pointer", "pointer", "pointer"]);
  Interceptor.replace(pthread_create_addr, new NativeCallback(function (parg0, parg1, parg2, parg3) {
    var so_name = Process.findModuleByAddress(parg2).name;
    var so_path = Process.findModuleByAddress(parg2).path;
    var so_base = Module.getBaseAddress(so_name);
    var offset = parg2 - so_base;
    var PC = 0;
    if ((so_name.indexOf("jiagu") > -1)) {
      console.log("======")
      console.log("find thread func offset", so_name, offset.toString(16));
      Thread.backtrace(this.context, Backtracer.ACCURATE).map(addr_in_so);

      var check_list = []
      if (check_list.indexOf(offset)!==-1) {
        console.log("check bypass")
      } else {
        PC = pthread_create(parg0, parg1, parg2, parg3);
      }
    } else {
      PC = pthread_create(parg0, parg1, parg2, parg3);
    }
    return PC;
  }, "int", ["pointer", "pointer", "pointer", "pointer"]))
}

function addr_in_so(addr){
  var process_Obj_Module_Arr = Process.enumerateModules();
  for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
    if(addr>process_Obj_Module_Arr[i].base && addr<process_Obj_Module_Arr[i].base.add(process_Obj_Module_Arr[i].size)){
      console.log(addr.toString(16),"is in",process_Obj_Module_Arr[i].name,"offset: 0x"+(addr-process_Obj_Module_Arr[i].base).toString(16));
    }
  }
}

check_pthread_create();

Pixel 6::com.oacia.apk_protect ]-> ======
find thread func offset libjiagu_64.so 1ac1f0
6de07e71bc is in libjiagu_64.so offset: 0x1ac1bc
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1b0944
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1ae778
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1afe2c
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1afe4c
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1b29b8
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1b26b4
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1a6d4c
6de07e2ad4 is in libjiagu_64.so offset: 0x1a7ad4
Process terminated
[Pixel 6::com.oacia.apk_protect ]->
======
find thread func offset libjiagu_64.so 1b26b4
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1a6d4c
6de07e2ad4 is in libjiagu_64.so offset: 0x1a7ad4
Process terminated
======
find thread func offset libjiagu_64.so 1b26b4
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1a6d4c
6de07e2ad4 is in libjiagu_64.so offset: 0x1a7ad4
======
find thread func offset libjiagu_64.so 1b26b4
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1a6d4c
======
find thread func offset libjiagu_64.so 1b26b4
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
======
find thread func offset libjiagu_64.so 1b26b4
6de0652710 is in libjiagu_64.so offset: 0x17710
======
find thread func offset libjiagu_64.so 1b26b4
======
find thread func offset libjiagu_64.so 1b26b4
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1b26b4
6de0652710 is in libjiagu_64.so offset: 0x17710
======
======
find thread func offset libjiagu_64.so 1b26b4
6de0652710 is in libjiagu_64.so offset: 0x17710
6de0651cb4 is in libjiagu_64.so offset: 0x16cb4
======
find thread func offset libjiagu_64.so 1a6d4c
6de07e2ad4 is in libjiagu_64.so offset: 0x1a7ad4
Process terminated
[Pixel 6::com.oacia.apk_protect ]->

Thank you for using Frida!
PS D:\Android\JS>

目前已知的是开了一个线程去frida检测以及有一个maps检测，但是当我们去ida准备分析绕过的时候，发现都是0这些数据，除了线程创建那里有点问题，不急，一点点分析一下

释放dex

前面我们在hook open的时候有看到dex的痕迹，这个时候我们去看一下这个dex

不过文件好像被加密了，可以尝试去定位到解密代码然后手动解密，或者直接内存dump下来

定位关键代码手动解密

想要手动解密就得去定位到这个dex的位置，我们可以通过前面的dex的位置去堆栈回溯

function hook_proc_self_maps() {
    const openPtr = Module.getExportByName(null, 'open');
    const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
    var fakePath = "/data/data/com.oacia.apk_protect/maps_nonexistent";
    Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
        var pathname = Memory.readUtf8String(pathnameptr);
        console.log("open",pathname);//,Process.getCurrentThreadId()
		    var bbase=Process.findModuleByName("libjiagu_64.so");
        if (pathname.indexOf("maps") >= 0) {
            console.log("find",pathname+", redirect to",fakePath);
            var filename = Memory.allocUtf8String(fakePath);
            return open(filename, flag);
        }
        if (pathname.indexOf("dex") >= 0) {
            console.log("duizhan",Thread.backtrace(this.context, Backtracer.ACCURATE)
           .map(addr => addr.sub(bbase.base).toString()))
        }
        var fd = open(pathnameptr, flag);
        return fd;
    }, 'int', ['pointer', 'int']));
}
 
function my_hook_dlopen(soName='') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    //console.log(path);
                    if (path.indexOf(soName) >= 0) {
                        this.is_can_hook = true;
                    }
                }
            },
            onLeave: function (retval) {
                if (this.is_can_hook) {
                    hook_proc_self_maps();
                }
            }
        }
    );
}
setImmediate(my_hook_dlopen,'libjiagu');

又全是0？？

那这个手动解密的方法算是失败了，还有一种方法就是去内存dump下来

内存dump

作者是在执行到opendex的时候去dump下来，这里我也试试


function dump_so(so_name) {
    try {
        var libso = Process.getModuleByName(so_name);
        if (!libso) {
            console.log("[ERROR] Module not found: " + so_name);
            return;
        }
        
        console.log("[name]:", libso.name);
        console.log("[base]:", libso.base);
        console.log("[size]:", ptr(libso.size));
        console.log("[path]:", libso.path);
        
    
        var file_path = "/data/data/com.oacia.apk_protect/" + libso.name + "_" + libso.base + "_" + ptr(libso.size) +"dex"+ ".so";
        
        var file_handle = new File(file_path, "wb");
        if (file_handle && file_handle != null) {
            Memory.protect(ptr(libso.base), libso.size, 'rwx');
            var libso_buffer = ptr(libso.base).readByteArray(libso.size);
            file_handle.write(libso_buffer);
            file_handle.flush();
            file_handle.close();
            console.log("[dump]:", file_path);
        }
    } catch (e) {
        console.log("[ERROR] dump_so failed: " + e.message);
    }
}
function hook_proc_self_maps() {
    const openPtr = Module.getExportByName(null, 'open');
    const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
    var fakePath = "/data/data/com.oacia.apk_protect/maps_nonexistent";
    Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
        var pathname = Memory.readUtf8String(pathnameptr);
        console.log("open",pathname);//,Process.getCurrentThreadId()
		var bbase=Process.findModuleByName("libjiagu_64.so");
        if (pathname.indexOf("maps") >= 0) {
			dump_so("libjiagu_64.so");
            console.log("find",pathname+", redirect to",fakePath);
            var filename = Memory.allocUtf8String(fakePath);
            return open(filename, flag);
        }
        if (pathname.indexOf("dex") >= 0) {
			
            console.log("duizhan",Thread.backtrace(this.context, Backtracer.ACCURATE)
           .map(addr => addr.sub(bbase.base).toString()))
        }
        var fd = open(pathnameptr, flag);
        return fd;
    }, 'int', ['pointer', 'int']));
}
 
function my_hook_dlopen(soName='') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    //console.log(path);
                    if (path.indexOf(soName) >= 0) {
                        this.is_can_hook = true;
                    }
                }
            },
            onLeave: function (retval) {
                if (this.is_can_hook) {
                    hook_proc_self_maps();
                }
            }
        }
    );
}
setImmediate(my_hook_dlopen("libjiagu_64.so"));


D:\Android\soshell>sofixer -s "D:\Android\soshell\jiagu\dex\dex.so" -o "D:\Android\soshell\jiagu\dex\dex_fix.so" -m 0x7ba188e000 -d
[main_loop:37]Use debug mode
[main_loop:87]start to rebuild elf file
[Load:69]dynamic segment have been found in loadable segment, argument baseso will be ignored.
[RebuildPhdr:25]=============LoadDynamicSectionFromBaseSource==========RebuildPhdr=========================
[RebuildPhdr:37]=====================RebuildPhdr End======================
[ReadSoInfo:549]=======================ReadSoInfo=========================
[ReadSoInfo:696]soname
[ReadSoInfo:629] constructors (DT_INIT_ARRAY) found at 2d760
[ReadSoInfo:633] constructors (DT_INIT_ARRAYSZ) 2
[ReadSoInfo:637] destructors (DT_FINI_ARRAY) found at 2d770
[ReadSoInfo:641] destructors (DT_FINI_ARRAYSZ) 2
[ReadSoInfo:580]string table found at fb0
[ReadSoInfo:584]symbol table found at 4e8
[ReadSoInfo:595] plt_rel_count (DT_PLTRELSZ) 114
[ReadSoInfo:591] plt_rel (DT_JMPREL) found at 2220
[ReadSoInfo:699]Unused DT entry: type 0x00000009 arg 0x00000018
[ReadSoInfo:699]Unused DT entry: type 0x6ffffffb arg 0x00000001
[ReadSoInfo:699]Unused DT entry: type 0x6ffffff9 arg 0x00000061
[ReadSoInfo:703]=======================ReadSoInfo End=========================
[RebuildShdr:42]=======================RebuildShdr=========================
[RebuildShdr:536]=====================RebuildShdr End======================
[RebuildRelocs:783]=======================RebuildRelocs=========================
[RebuildRelocs:809]=======================RebuildRelocs End=======================
[RebuildFin:709]=======================try to finish file rebuild =========================
[RebuildFin:733]=======================End=========================
[main:123]Done!!!

此时有数据了

但此时其实是不明白的，打印了堆栈按理说应该是去定位的是函数段的，可是为什么会是这些数据呢，难道是类似smc的那种把代码段加密，可是打印了dex，此时去参考作者的做法，用WinMerge去对比一下，哪里的数据是不一样的。、

发现了不同之处，左边全是数据，右边都是0

这个时候往上看

记录下起始地址，可以把这个elfdump下来，然后分析，感觉类似于一代壳，把elf给加载到主so里面，然后运行时候解密，至于这些数据哪来的，后面再分析

with open(r"D:\Android\soshell\jiagu\dex\dex_fix.so",'rb') as f:
    s=f.read()
with open(r"D:\Android\soshell\jiagu\dex\extract.so",'wb') as f:
    f.write(s[0xe7000::])

提取出来，ida反编译失败了，好像是段的数据被加密了应该。

如果是加密，而且数据都在so里面，那可能是自写linker，分析一下可疑的函数

0x03C94 有点像预链接的操作

008000

000008C74 执行JNI初始化？

分析link/elf解密

前面分析了0x03C94 有点像预链接的操作，这里直接修复一下结构体把

点VIew->open view insert插入一个结构体

//IMPORTANT
//ELF64启用该宏
#define __LP64__  1
//ELF32启用该宏
//#define __work_around_b_24465209__  1
 
/*
//https://android.googlesource.com/platform/bionic/+/master/linker/Android.bp
架构为32位 定义__work_around_b_24465209__宏
arch: {
        arm: {cflags: ["-D__work_around_b_24465209__"],},
        x86: {cflags: ["-D__work_around_b_24465209__"],},
    }
*/
 
//android-platform\bionic\libc\include\link.h
#if defined(__LP64__)
#define ElfW(type) Elf64_ ## type
#else
#define ElfW(type) Elf32_ ## type
#endif
 
//android-platform\bionic\linker\linker_common_types.h
// Android uses RELA for LP64.
#if defined(__LP64__)
#define USE_RELA 1
#endif
 
//android-platform\bionic\libc\kernel\uapi\asm-generic\int-ll64.h
//__signed__-->signed
typedef signed char __s8;
typedef unsigned char __u8;
typedef signed short __s16;
typedef unsigned short __u16;
typedef signed int __s32;
typedef unsigned int __u32;
typedef signed long long __s64;
typedef unsigned long long __u64;
 
//A12-src\msm-google\include\uapi\linux\elf.h
/* 32-bit ELF base types. */
typedef __u32   Elf32_Addr;
typedef __u16   Elf32_Half;
typedef __u32   Elf32_Off;
typedef __s32   Elf32_Sword;
typedef __u32   Elf32_Word;
 
/* 64-bit ELF base types. */
typedef __u64   Elf64_Addr;
typedef __u16   Elf64_Half;
typedef __s16   Elf64_SHalf;
typedef __u64   Elf64_Off;
typedef __s32   Elf64_Sword;
typedef __u32   Elf64_Word;
typedef __u64   Elf64_Xword;
typedef __s64   Elf64_Sxword;
 
typedef struct dynamic{
  Elf32_Sword d_tag;
  union{
    Elf32_Sword d_val;
    Elf32_Addr  d_ptr;
  } d_un;
} Elf32_Dyn;
 
typedef struct {
  Elf64_Sxword d_tag;       /* entry tag value */
  union {
    Elf64_Xword d_val;
    Elf64_Addr d_ptr;
  } d_un;
} Elf64_Dyn;
 
typedef struct elf32_rel {
  Elf32_Addr    r_offset;
  Elf32_Word    r_info;
} Elf32_Rel;
 
typedef struct elf64_rel {
  Elf64_Addr r_offset;  /* Location at which to apply the action */
  Elf64_Xword r_info;   /* index and type of relocation */
} Elf64_Rel;
 
typedef struct elf32_rela{
  Elf32_Addr    r_offset;
  Elf32_Word    r_info;
  Elf32_Sword   r_addend;
} Elf32_Rela;
 
typedef struct elf64_rela {
  Elf64_Addr r_offset;  /* Location at which to apply the action */
  Elf64_Xword r_info;   /* index and type of relocation */
  Elf64_Sxword r_addend;    /* Constant addend used to compute value */
} Elf64_Rela;
 
typedef struct elf32_sym{
  Elf32_Word    st_name;
  Elf32_Addr    st_value;
  Elf32_Word    st_size;
  unsigned char st_info;
  unsigned char st_other;
  Elf32_Half    st_shndx;
} Elf32_Sym;
 
typedef struct elf64_sym {
  Elf64_Word st_name;       /* Symbol name, index in string tbl */
  unsigned char st_info;    /* Type and binding attributes */
  unsigned char st_other;   /* No defined meaning, 0 */
  Elf64_Half st_shndx;      /* Associated section index */
  Elf64_Addr st_value;      /* Value of the symbol */
  Elf64_Xword st_size;      /* Associated symbol size */
} Elf64_Sym;
 
 
#define EI_NIDENT   16
 
typedef struct elf32_hdr{
  unsigned char e_ident[EI_NIDENT];
  Elf32_Half    e_type;
  Elf32_Half    e_machine;
  Elf32_Word    e_version;
  Elf32_Addr    e_entry;  /* Entry point */
  Elf32_Off e_phoff;
  Elf32_Off e_shoff;
  Elf32_Word    e_flags;
  Elf32_Half    e_ehsize;
  Elf32_Half    e_phentsize;
  Elf32_Half    e_phnum;
  Elf32_Half    e_shentsize;
  Elf32_Half    e_shnum;
  Elf32_Half    e_shstrndx;
} Elf32_Ehdr;
 
typedef struct elf64_hdr {
  unsigned char e_ident[EI_NIDENT]; /* ELF "magic number" */
  Elf64_Half e_type;
  Elf64_Half e_machine;
  Elf64_Word e_version;
  Elf64_Addr e_entry;       /* Entry point virtual address */
  Elf64_Off e_phoff;        /* Program header table file offset */
  Elf64_Off e_shoff;        /* Section header table file offset */
  Elf64_Word e_flags;
  Elf64_Half e_ehsize;
  Elf64_Half e_phentsize;
  Elf64_Half e_phnum;
  Elf64_Half e_shentsize;
  Elf64_Half e_shnum;
  Elf64_Half e_shstrndx;
} Elf64_Ehdr;
 
/* These constants define the permissions on sections in the program
   header, p_flags. */
#define PF_R        0x4
#define PF_W        0x2
#define PF_X        0x1
 
typedef struct elf32_phdr{
  Elf32_Word    p_type;
  Elf32_Off p_offset;
  Elf32_Addr    p_vaddr;
  Elf32_Addr    p_paddr;
  Elf32_Word    p_filesz;
  Elf32_Word    p_memsz;
  Elf32_Word    p_flags;
  Elf32_Word    p_align;
} Elf32_Phdr;
 
typedef struct elf64_phdr {
  Elf64_Word p_type;
  Elf64_Word p_flags;
  Elf64_Off p_offset;       /* Segment file offset */
  Elf64_Addr p_vaddr;       /* Segment virtual address */
  Elf64_Addr p_paddr;       /* Segment physical address */
  Elf64_Xword p_filesz;     /* Segment size in file */
  Elf64_Xword p_memsz;      /* Segment size in memory */
  Elf64_Xword p_align;      /* Segment alignment, file & memory */
} Elf64_Phdr;
 
typedef struct elf32_shdr {
  Elf32_Word    sh_name;
  Elf32_Word    sh_type;
  Elf32_Word    sh_flags;
  Elf32_Addr    sh_addr;
  Elf32_Off sh_offset;
  Elf32_Word    sh_size;
  Elf32_Word    sh_link;
  Elf32_Word    sh_info;
  Elf32_Word    sh_addralign;
  Elf32_Word    sh_entsize;
} Elf32_Shdr;
 
typedef struct elf64_shdr {
  Elf64_Word sh_name;       /* Section name, index in string tbl */
  Elf64_Word sh_type;       /* Type of section */
  Elf64_Xword sh_flags;     /* Miscellaneous section attributes */
  Elf64_Addr sh_addr;       /* Section virtual addr at execution */
  Elf64_Off sh_offset;      /* Section file offset */
  Elf64_Xword sh_size;      /* Size of section in bytes */
  Elf64_Word sh_link;       /* Index of another section */
  Elf64_Word sh_info;       /* Additional section information */
  Elf64_Xword sh_addralign; /* Section alignment */
  Elf64_Xword sh_entsize;   /* Entry size if section holds table */
} Elf64_Shdr;
 
 
//android-platform\bionic\linker\linker_soinfo.h
typedef void (*linker_dtor_function_t)();
typedef void (*linker_ctor_function_t)(int, char**, char**);
 
#if defined(__work_around_b_24465209__)
#define SOINFO_NAME_LEN 128
#endif
 
struct soinfo {
#if defined(__work_around_b_24465209__)
  char old_name_[SOINFO_NAME_LEN];
#endif
  const ElfW(Phdr)* phdr;
  size_t phnum;
#if defined(__work_around_b_24465209__)
  ElfW(Addr) unused0; // DO NOT USE, maintained for compatibility.
#endif
  ElfW(Addr) base;
  size_t size;
 
#if defined(__work_around_b_24465209__)
  uint32_t unused1;  // DO NOT USE, maintained for compatibility.
#endif
 
  ElfW(Dyn)* dynamic;
 
#if defined(__work_around_b_24465209__)
  uint32_t unused2; // DO NOT USE, maintained for compatibility
  uint32_t unused3; // DO NOT USE, maintained for compatibility
#endif
 
  soinfo* next;
  uint32_t flags_;
 
  const char* strtab_;
  ElfW(Sym)* symtab_;
 
  size_t nbucket_;
  size_t nchain_;
  uint32_t* bucket_;
  uint32_t* chain_;
 
#if !defined(__LP64__)
  ElfW(Addr)** unused4; // DO NOT USE, maintained for compatibility
#endif
 
#if defined(USE_RELA)
  ElfW(Rela)* plt_rela_;
  size_t plt_rela_count_;
 
  ElfW(Rela)* rela_;
  size_t rela_count_;
#else
  ElfW(Rel)* plt_rel_;
  size_t plt_rel_count_;
 
  ElfW(Rel)* rel_;
  size_t rel_count_;
#endif
 
  linker_ctor_function_t* preinit_array_;
  size_t preinit_array_count_;
 
  linker_ctor_function_t* init_array_;
  size_t init_array_count_;
  linker_dtor_function_t* fini_array_;
  size_t fini_array_count_;
 
  linker_ctor_function_t init_func_;
  linker_dtor_function_t fini_func_;
 
/*
#if defined(__arm__)
  // ARM EABI section used for stack unwinding.
  uint32_t* ARM_exidx;
  size_t ARM_exidx_count;
#endif
  size_t ref_count_;
//怎么找不到link_map这个类型的声明...
  link_map link_map_head;
 
  bool constructors_called;
 
  // When you read a virtual address from the ELF file, add this
  // value to get the corresponding address in the process' address space.
  ElfW(Addr) load_bias;
 
#if !defined(__LP64__)
  bool has_text_relocations;
#endif
  bool has_DT_SYMBOLIC;
*/
};

回想起前面的分析的自写linker，这里反编译编特别明显

前面一堆循环case就很明显的是再预链接，这里的循环去遍历函数表，就肯定是在加载导入函数的库，

那我们如果想要dump下来这个加了密的so文件，我觉得只需要在这个预链接之后就行，因为这个时候的so肯定都是解密了的，那我们的首先目标就是拿到soinfo的base就行，然后直接dump吧

然后这里有一个问题，全程没有看到base的身影，而且看这些不知名的偏移是可以看出soinfo结构体是被魔改了的，这个时候就需要去恢复这个soinfo结构体

作者采用的手段是通过这里开始分析

这里看传入了一个dynamic段，一个flags，一个phdr（假设的是不魔改的soinfo结构体）

但是我们看看这个函数内部

可以看到这里循环加56，然后不断的open？

一个标准的elf头的PHT的大小是56的长度，所以这里是在遍历PHT表，所以会出现这个循环加56的操作

解密pht表

但是反正是为了分析嘛，我准备去检测内存读写，然后去找到加密，自己解密一下

0E7040

找到加密的phdr

采用监控内存读写的方式

function hook_map(){
  var bbase=Process.findModuleByName("libjiagu_64.so");
  console.log("base",bbase);
  if(bbase){
    console.log("found base");
    var addr=bbase.base.add(0x0E7040);
    console.log(hexdump(addr, {
      offset: 0,
      length: 64,
      header: true,
      ansi: true,
    }));
    Thread.backtrace(this.context, Backtracer.ACCURATE).map(addr_in_so);
  }else{
    setTimeout(hook_map,100);
  }
}

虽然能打印出那段数据，不过是加密了的，而且context还报错了，只能回调onEnter的时候使用，不能这种使用

回到这个函数，既然是自定义linker，既然这里的步长跟我们的pht表长度一样，那么我们可以推断，第一个参数应该是pht表的起始长度，

既然的起始地址，但是phdr是在soinfo结构体的第一个位置，所以这里猜测应该是在soinfo结构体的前面填充了些数据，这里我们重新修改一下soinfo结构体

应该不是base，这里这个东西我猜测是phdr的多少

既然通过蹬这个linker已经找到了phdr表，那我们直接hook这个，当然可以直接得到解密后的phdr表

function addr_in_so(addr){
    var process_Obj_Module_Arr = Process.enumerateModules();
    for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
        if(addr>process_Obj_Module_Arr[i].base && addr<process_Obj_Module_Arr[i].base.add(process_Obj_Module_Arr[i].size)){
            console.log(addr.toString(16),"is in",process_Obj_Module_Arr[i].name,"offset: 0x"+(addr-process_Obj_Module_Arr[i].base).toString(16));
        }
    }
}


function check_pthread_create() {
    var pthread_create_addr = Module.findExportByName(null, 'pthread_create');

    var pthread_create = new NativeFunction(pthread_create_addr, "int", ["pointer", "pointer", "pointer", "pointer"]);
    Interceptor.replace(pthread_create_addr, new NativeCallback(function (parg0, parg1, parg2, parg3) {
        var so_name = Process.findModuleByAddress(parg2).name;
        var so_path = Process.findModuleByAddress(parg2).path;
        var so_base = Module.getBaseAddress(so_name);
        var offset = parg2 - so_base;
        var PC = 0;
        if ((so_name.indexOf("jiagu") > -1)) {
            console.log("======")
            console.log("find thread func offset", so_name, offset.toString(16));
            Thread.backtrace(this.context, Backtracer.ACCURATE).map(addr_in_so);

            var check_list = []
            if (check_list.indexOf(offset)!==-1) {
                console.log("check bypass")
            } else {
                PC = pthread_create(parg0, parg1, parg2, parg3);
            }
        } else {
            PC = pthread_create(parg0, parg1, parg2, parg3);
        }
        return PC;
    }, "int", ["pointer", "pointer", "pointer", "pointer"]))
}

function hook_map(){
    var bbase=Process.findModuleByName("libjiagu_64.so");
    console.log("base",bbase);
    if(bbase){
        console.log("found base");
        var func =bbase.base.add(0x005E6C);
        Interceptor.attach(func,{
            onEnter:function(args){
                console.log(hexdump(args[0], {
                    offset: 0,
                    length: 0x38*6+0x20,
                    header: true,
                    ansi: true,
                }));
            },onLeave:function(cb){

            }
        });


    }else{
        setTimeout(hook_map,100);
    }
}
function hook_proc_self_maps() {
    const openPtr = Module.getExportByName(null, 'open');
    const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
    var fakePath = "/data/data/com.oacia.apk_protect/maps_nonexistent";
    Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
        var pathname = Memory.readUtf8String(pathnameptr);
        console.log("open",pathname);//,Process.getCurrentThreadId()
        var bbase=Process.findModuleByName("libjiagu_64.so");
        if (pathname.indexOf("maps") >= 0) {
            console.log("find",pathname+", redirect to",fakePath);
            var filename = Memory.allocUtf8String(fakePath);
            return open(filename, flag);
        }
        if (pathname.indexOf("dex") >= 0) {
            console.log("duizhan",Thread.backtrace(this.context, Backtracer.ACCURATE)
              .map(addr => addr.sub(bbase.base).toString()))
        }
        var fd = open(pathnameptr, flag);
        return fd;
    }, 'int', ['pointer', 'int']));
}




function my_hook_dlopen(soName='') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    if (path.indexOf(soName) >= 0) {
                        this.is_can_hook = true;
                        hook_map();
                    }
                }
            },
            onLeave: function (retval) {
                if (this.is_can_hook) {
                    check_pthread_create();
                    hook_proc_self_maps();
                    hook_map();

                }
            }
        }
    );
}
setImmediate(my_hook_dlopen("libjiagu_64.so"));

然后去填充回去，写一个python脚本

with open(r"D:\Android\soshell\jiagu\dex\extract.so",'rb') as f:
    s=f.read()
content=bytearray(s[0x40:])
a=[0x01,0x00,0x00,0x00,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xe8,0xb8,0x16,0x00,0x00,0x00,0x00,0x00,0xe8,0xb8,0x16,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x06,0x00,0x00,0x00,0xf0,0xc3,0x16,0x00,0x00,0x00,0x00,0x00,0xf0,0xc3,0x17,0x00,0x00,0x00,0x00,0x00,0xf0,0xc3,0x17,0x00,0x00,0x00,0x00,0x00,0x80,0xd9,0x00,0x00,0x00,0x00,0x00,0x00,0xc8,0xeb,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x06,0x00,0x00,0x00,0xc0,0xe3,0x16,0x00,0x00,0x00,0x00,0x00,0xc0,0xe3,0x17,0x00,0x00,0x00,0x00,0x00,0xc0,0xe3,0x17,0x00,0x00,0x00,0x00,0x00,0xf0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xf0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0xe5,0x74,0x64,0x04,0x00,0x00,0x00,0x84,0x20,0x15,0x00,0x00,0x00,0x00,0x00,0x84,0x20,0x15,0x00,0x00,0x00,0x00,0x00,0x84,0x20,0x15,0x00,0x00,0x00,0x00,0x00,0x44,0x3e,0x00,0x00,0x00,0x00,0x00,0x00,0x44,0x3e,0x00,0x00,0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x51,0xe5,0x74,0x64,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x52,0xe5,0x74,0x64,0x04,0x00,0x00,0x00,0xf0,0xc3,0x16,0x00,0x00,0x00,0x00,0x00,0xf0,0xc3,0x17,0x00,0x00,0x00,0x00,0x00,0xf0,0xc3,0x17,0x00,0x00,0x00,0x00,0x00,0x10,0x2c,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x2c,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0c,0x01,0x12,0x00,0x00,0x00,0xf0,0xb9,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x00,0x5b,0x00,0x30,0x00,0x2d,0x00,0x39,0x00,0x61,0x00]
for i in range(len(a)):
    print("old",hex(content[i]))
    content[i]=a[i]
    print("new",hex(content[i]))
all=s[:0x40]+content

with open(r"D:\Android\soshell\jiagu\dex\extract_new.so",'wb') as f:
    f.write(all)

这里填充回去之后，ida可以正常分析了，不过导入和导出表并没有修复。。。。

那我们再试试去完整解密一下吧

主so解密流程分析

那如果尝试自己去寻找elf加载时候的分析，然后去找到解密过程呢，前面尝试过如果去直接内存读写，不过好像不写，那就分析执行流吧

本来想用nativeTrace的，不过好像出现了一点bug

那就用作者的stack_trace吧

用法感觉跟native trace差不多，就是去使用一下插件生成脚本。然后去修改一下soname，注入就行

trace执行流

[Pixel 6::com.oacia.apk_protect ]-> start Stalker!
Stalker end!
call1:JNI_OnLoad
call2:j_interpreter_wrap_int64_t
call3:interpreter_wrap_int64_t
call4:getenv
call5:sub_13908
call6:inotify_add_watch
call7:sub_11220
call8:fopen
call9:sub_9DD8
call10:sub_E3E0
call11:strtol
call12:feof
call13:raise
call14:memset
call15:sub_C918
call16:sub_9988
call17:sub_9964
call18:sub_9AC4
call19:j_ffi_prep_cif
call20:ffi_prep_cif
call21:j_ffi_prep_cif_machdep
call22:ffi_prep_cif_machdep
call23:j_ffi_call
call24:ffi_call
call25:sub_1674C
call26:j_ffi_call_SYSV
call27:ffi_call_SYSV
call28:sub_167BC
call29:sub_1647C
call30:sub_163DC
call31:sub_9900
call32:sub_94BC
call33:inotify_init
call34:fmod
call35:strncpy
call36:_Z9__arm_a_1P7_JavaVMP7_JNIEnvPvRi
call37:sub_9E58
call38:sub_999C
call39:sub_10964
call40:j_lseek_1
call41:lseek
call42:sub_96E0
call43:sub_8000
call44:dlopen
call45:sub_60E0
call46:sub_6544
call47:sub_4B54
call48:sub_6128
call49:_ZN9__arm_c_19__arm_c_0Ev
call50:sub_A3EC
call51:sub_99CC
call52:sub_9944
call53:sub_6484
call54:sub_6590
call55:prctl
call56:sub_6698
call57:sub_9FFC
call58:j_lseek_3
call59:j_lseek_2
call60:j_lseek_0
call61:sub_9A90
call62:sub_5F20
call63:sub_6044
call64:sub_3574
call65:uncompress
call66:sub_49F0
call67:sub_5400
call68:sub_5478
call69:sub_5B08
call70:sub_5650
call71:sub_580C
call72:open
call73:atoi
call74:Link
call75:strncmp
call76:sub_4918
call77:sub_4000
call78:sub_41B4
call79:sub_35AC
call80:sigaction
call81:sub_5E6C
call82:sub_5444
call83:sub_633C
call84:sub_8130
call85:sub_4C70
call86:sub_825C
call87:sub_8B50
call88:sub_8ED4
call89:sub_8430
call90:interpreter_wrap_int64_t_bridge
call91:sub_9D60
call92:sub_166C4
call93:memcpy
call94:_Z9__arm_a_2PcmS_Rii
call95:j_ffi_prep_cif_var
call96:ffi_prep_cif_var
Process terminated

挨个分析一下吧

跟着我们的link向前分析，然后去挨个分析调用链

找到了类似rc4的算法

然后再跟着调用链去看

这就是rc4加密的主要地方，

加密完之后就是一个解密函数，uncompress

接着往后看就是link的主要函数了

那其实这里的流程就很明显了，就是一个把主要elf进行rc4解密，然后解压缩算法。

至于这些数据，回到

难道是这个？

rc4解密

算了，我们先frida hook一下rc4的密钥和加密对象，就知道了数据来源了，就可以自己尝试手动解密



function hook_rc4(){
  var bbase=Process.findModuleByName("libjiagu_64.so");
  if(bbase){
    var funcc=bbase.base.add(0x005F20);
    Interceptor.attach(funcc,{
      onEnter:function(args){
        console.log("args[0]",hexdump(args[0], {
          offset: 0,
          length: 0x60,
          header: true,
          ansi: true,
        }));
        console.log("args[1]",args[1]
                   );
      },onLeave:function(cb){

      }
    })
  }else{
    setTimeout(hook_rc4,100);
  }
}

得到密钥vUV4#.#SVt. 长度0xa 密钥：vUV4#\x91#SVt

对的上

打印出主要elf数据来源

function rc4(){
    var bbase=Process.findModuleByName("libjiagu_64.so");
    if(bbase){
        var funcc=bbase.base.add(0x06044);
        Interceptor.attach(funcc,{
            onEnter:function(args){
                var ptt=ptr(args[0]);
                console.log("place",ptr(bbase.base));
                console.log("args[0]",hexdump(args[0], {
                    offset: 0,
                    length: 0x60,
                    header: true,
                    ansi: true,
                }));

            },onLeave:function(cb){

            }
        })
    }else{
        setTimeout(rc4,100);
    }
}

01 18 25

找到了数据来源，那不直接dump然后手动解密了吗

解压缩算法

忽略了一个解压缩算法

#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <zlib.h>

int main(int argc, char* argv[])
{
    char text[] = "zlib compress and uncompress test\nturingo@163.com\n2012-11-05\n";
    uLong tlen = strlen(text) + 1;	/* 需要把字符串的结束符'\0'也一并处理 */
    char* buf = NULL;
    uLong blen;

    /* 计算缓冲区大小，并为其分配内存 */
    blen = compressBound(tlen);	/* 压缩后的长度是不会超过blen的 */
    if((buf = (char*)malloc(sizeof(char) * blen)) == NULL)
    {
        printf("no enough memory!\n");
        return -1;
    }

    /* 压缩 */
    if(compress(buf, &blen, text, tlen) != Z_OK)
    {
        printf("compress failed!\n");
        return -1;
    }

    /* 解压缩 */
    if(uncompress(text, &tlen, buf, blen) != Z_OK)
    {
        printf("uncompress failed!\n");
        return -1;
    }

    /* 打印结果，并释放内存 */
    printf("%s", text);
    if(buf != NULL)
    {
        free(buf);
        buf = NULL;
    }

    return 0;
}

上面是找的一个解压缩算法使用的样例

不管了，先hook一下uncompress的参数看看调用的是啥

function uncompress1(){
    var module = Process.findModuleByName("libjiagu_64.so");
    if(module){
        Interceptor.attach(Module.findExportByName(null, "uncompress"),{
            onEnter:function(args){
                console.log("args[2]",hexdump(args[2], {
                    offset: 0,
                    length: 0x30,
                    header: true,
                    ansi: true,
                }));
                console.log("args[1]",args[1]);

            },onLeave:function(cb){

            }
        })
    }else{
        setTimeout(uncompress1,100);
    }
}

这里突然意识到我们没有去hook一下rc4的解密函数，可以看到解密后的内容以及密文大小

这里补充一下

var ptt;
function rc4(){
  var bbase=Process.findModuleByName("libjiagu_64.so");
  if(bbase){
    var funcc=bbase.base.add(0x06044);
    Interceptor.attach(funcc,{
      onEnter:function(args){
        ptt=ptr(args[0]);
        console.log("place",ptr(bbase.base));
        console.log("args[0]",hexdump(args[0], {
          offset: 0,
          length: 0x60,
          header: true,
          ansi: true,
        }));
        console.log("args[1]",args[1]);

      },onLeave:function(cb){
        console.log("args[0] return ",hexdump(ptt, {
          offset: 0,
          length: 0x60,
          header: true,
          ansi: true,
        }));
      }
    })
  }else{
    setTimeout(rc4,100);
  }
}

可以看到解压缩算法的时候是没有解压缩前面4个字节的，而且数据大小是0xb8010

那么这里我们就可以写一个rc4脚本了

总解密脚本

import base64
import zlib


def KSA(key):
    """ Key-Scheduling Algorithm (KSA) """
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
    return S


def PRGA(S):
    """ Pseudo-Random Generation Algorithm (PRGA) """
    i, j = 0, 0
    while True:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        K = S[(S[i] + S[j]) % 256]
        yield K


def RC4(key, text):
    S = KSA(key)
    keystream = PRGA(S)
    res = []
    for char in text:
        res.append(char ^ next(keystream))
    return bytes(res)

with open(r"D:\Android\soshell\jiagu\dex\decrypt\dex_fix.so","rb") as f:
    content=f.read()

a=content[0x2E270:0xe6280]

encrypted_message = RC4(b"vUV4#\x91#SVt", bytearray(a))
print("enen", [hex(i) for i in encrypted_message[:4]])


decompressed_data = zlib.decompress(bytes(encrypted_message[4::]))

with open(r"D:\Android\soshell\jiagu\dex\decrypt\dex_fix.so","wb") as f:
    f.write(decompressed_data)

上面一大堆看不懂的数据，还有，下面不就是我们提取的so吗，而且为什么phdr段还没有被解密？

我以为解密出来的应该就是主so了

异或

后知后觉觉得是因为前面我们dump下来的so，就已经是这个so了，dump的时机就已经解密好了的，所以这个就是类似安卓一代壳，把加密后的数据放到自己的代码里，运行的时候解密，然后又放在数据区里，等待着加载。

但是疑惑点来了，那phdr段是什么时候被解密的呢？

解密phdr段

我们拿着这个函数调用流重新看一下。

挨个看

sub_5B08

发现这个函数比较可疑

这里的0x38不就是步长嘛，然后这个strtol的第二个参数就是6，那不就是phdr段的个数6个嘛

var ptt;
function rc4(){
  var bbase=Process.findModuleByName("libjiagu_64.so");
  if(bbase){
    var funcc=bbase.base.add(0x00005BEC);
    Interceptor.attach(funcc,{
      onEnter:function(args){
        ptt=this.context["x10"];
        console.log("x10",ptt);
        console.log("eor x26",this.context["x26"]);
      },onLeave:function(cb){

      }
    })
  }else{
    setTimeout(rc4,100);
  }
}

这里hook下来看到的是

x10 0xc3
eor x26 0xd3
x10 0xff
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd2
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3
x10 0xd3
eor x26 0xd3

嗯？，我发现并不是紧跟着数据开始的，而是

这开始的，异或对象是0xd3

hook了这个n0x20

hook得到的是 x2 0x150

开始是不走这里的

hook发现每次减少32，异或的都是d3，至于150，应该是从这获取的

hook下面的时候明显次数不一样，发现是1650

找到数据

之后就可以知道，程序是读取了第一个是异或对象，第二个（int）是异或的大小，一直这样循环

这里是每次读取的大小，一直相加，推测是加到

但是这里很奇怪，为什么前面穿插这么一大段数据，到底有什么用呢

我们回到这里，发现这些长度好像都是来自于a1，那我们去试试

a1[9]=phdrnum

a1[11]=phdr_size

a1[10]=part1

这里就相当于四个部分在解密，那就直接创建一个结构体进行修复就好了

直接用作者的方法去直接去找到对应的指针然后修复就行

struct deal_extra
{
  char blank[72];
  int phnum;
  int *extra_part1;
  int phdr_size;
  char blank2[36];
  int *extra_part2;
  int *extra_part3;
  int *extra_part4;
  int *main_elf;
};

这里我们突然发现

这里如果设置成前面的soinfo指针，确实能够很好的理解前面的遍历phdr表的操作。不过，对于传进去的主函数就不行了，解析出了错

这里我才意识到他是在进行四个东西分别解密

修复结构体之后进了前面我们说的linker阶段sub_49F0

这里发现这里的参数有个赋值，

我们在相应的位置继续修改

struct deal_extra_B
{
  char blank[232];
  int *extra_part1;
  char blank1[8];
  int phnum;
  int *extra_part4;
  char blank2[24];
  int *extra_part2;
  char blank3[8];
  int *extra_part3;
};

那这里的第四部分就是dynamic了，因为这里是预链接

识别异或部分

我们继续往后看

发现这里有很多switch，而且是1020几

但是我们看重定位类型会进行修复

结合linker去修复，可以发现

先是进行了基址重定位，然后符号重定位，这是一个顺序

基址重定位是.rela.dyn 符号重定位是rela.plt

之后的部分一就不用说了，很明显的去加载phdr表

之后就是把这四个部分分开，然后生成四个文件

唉。逆到这里了，已经懒得写脚本了，前面写反汇编引擎恢复cfg已经累死了，这里直接copy作者的把

import copy
import zlib

def RC4(data, key):
    S = list(range(256))
    j = 0
    out = []

    # KSA Phase
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]

    # PRGA Phase
    i = j = 0
    for ch in data:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        out.append(ch ^ S[(S[i] + S[j]) % 256])

    return out


def RC4decrypt(ciphertext, key):
    return RC4(ciphertext, key)


wrap_elf_start = 0x2e270
wrap_elf_size = 0xb8010
key = b"vUV4#\x91#SVt"
with open("D:\\Android\\soshell\\jiagu\\assets\\libjiagu_64.so_0x78500a6000_0x274000.so", 'rb') as f:
    wrap_elf = f.read()

# 对密文进行解密
dec_compress_elf = RC4decrypt(wrap_elf[wrap_elf_start:wrap_elf_start + wrap_elf_size], key)
dec_elf = zlib.decompress(bytes(dec_compress_elf[4::]))
with open('wrap_elf', 'wb') as f:
    f.write(dec_elf)


class part:
    def __init__(self):
        self.name = ""
        self.value = b''
        self.offset = 0
        self.size = 0


index = 1
extra_part = [part() for _ in range(7)]

seg = ["phdr", ".rela.plt", ".rela.dyn", ".dynamic"]
v_xor = dec_elf[0]

for i in range(4):
    size = int.from_bytes(dec_elf[index:index + 4], 'little')
    index += 4
    extra_part[i + 1].name = seg[i]
    extra_part[i + 1].value = bytes(map(lambda x: x ^ v_xor, dec_elf[index:index + size]))
    extra_part[i + 1].size = size
    index += size

for p in extra_part:
    if p.value!=b'':
        filename = f"libjiagu.so_{hex(p.size)}_{p.name}"
        print(f"[{p.name}] get {filename}, size: {hex(p.size)}")
        with open(filename,'wb') as f:
            f.write(p.value)

修复完整ELF

https://docs.oracle.com/cd/E24847_01/html/E22196/chapter2-90421.html#scrolltoc

既然已经修复完了这四个部分，那我们就把这个和前面的部分恢复出来不就可以看到完整代码了

先是把主要的ELF给它提取出来，方便我们后面替换

with open("D:\\Android\\soshell\\jiagu\\dex\\decrypt\\dex_fix.so", 'rb') as f:
    wrap_elf = f.read()
ELF_magic = bytes([0x7F, 0x45, 0x4C, 0x46])
for i in range(len(wrap_elf) - len(ELF_magic) + 1):
    if wrap_elf[i:i + len(ELF_magic)] == ELF_magic:
        with open("D:\\Android\\soshell\\jiagu\\dex\\decrypt\\last.so", 'wb') as f:
            f.write(wrap_elf[i::])
        break

直接CTRL+shift+C/v

DT_* 是 ELF 动态段（.dynamic）中条目的类型（dynamic tags），用于描述运行时链接器需要的信息。常见的与你替换 reloc 相关的有：

DT_RELA（或 DT_REL）：指向 .rela.dyn（或 .rel.dyn）的 VA（虚拟地址），这是对数据/非PLT符号的重定位表。

DT_RELASZ / DT_RELSZ：上面表的字节大小（size）。

DT_RELAENT / DT_RELENT：单条重定位条目的大小（entry size）。

DT_JMPREL：指向 PLT 用的重定位表（通常是 .rela.plt 或 .rel.plt）的 VA（用于函数调用的 GOT/PLT 重定位）。

DT_PLTRELSZ：PLT 重定位表的大小（字节）。

DT_PLTREL：指示 PLT 重定位使用 REL 还是 RELA（值为 DT_RELA 或 DT_REL）。

DT_SYMTAB / DT_STRTAB：符号表和字符串表 VA，重定位使用的符号索引需要在这些表中查找。

DT_PLTGOT：GOT/PLT 表地址，有时会用来判断目标。

你的图片就是这些 #define 的名字和数值（宏定义），它们是动态表 tag 的常量。

Size of procedure linkage table

DT_PLTREL address

Relocation (RELA) table address

Relocation (RELA) table total size (bytes)

Relocation (RELA) table size (bytes)

PLT的地址是0002caeo，大小是00 1650

.rela.dyn的地址的0x7958 大小是0x025188

注意tag是这个，不是tags[xx]的xx

修复回去就好了

符号啥的都有了

这就是我们壳so去自定义linker加载的主要ELF

解密DEX

这里修复一下dex，前面我们去hook open的时候会有dex的加载过程

var bbase;
function my_hook_dlopen(soName = '') {
	Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
		{
			onEnter: function (args) {
				var pathptr = args[0];
				if (pathptr !== undefined && pathptr != null) {
					var path = ptr(pathptr).readCString();
					if (path.indexOf(soName) >= 0) {
						//console.log("soname"+path.split('/').pop());
						this.is_can_hook = true;
					}
				}
			},
			onLeave: function (retval) {
				if (this.is_can_hook) {
					hook_proc_self_maps();
				}
			}
		}
	);
}
function showStacks(){
	console.log(
		Java.use("android.util.Log")
			.getStackTraceString(//这两句相当于Log.getStackTraceString
				Java.use("java.lang.Throwable").$new()//Java.use("java.lang.Throwable").$new()相当于new Throwable()
			)
	)
}
function hook_proc_self_maps() {

	const openPtr = Module.getExportByName(null, 'open');
	const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
	var fakePath = "/data/data/com.oacia.apk_protect/maps";
	bbase=Process.findModuleByName("libjiagu_64.so");

	Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
		var pathname = Memory.readUtf8String(pathnameptr);
		console.log("open",pathname);
		if (pathname.indexOf("maps") >= 0) {
			console.log("find",pathname,",redirect to",fakePath);
			var filename = Memory.allocUtf8String(fakePath);
			return open(filename, flag);
		}
		if (pathname.indexOf("dex") >= 0) {
			console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
				.map(addr => addr.sub(bbase.base).toString()));
		}
		var fd = open(pathnameptr, flag);
		return fd;
	}, 'int', ['pointer', 'int']));
}


setImmediate(my_hook_dlopen,"libjiagu_64.so");

这里是把maps内存区域检测重定向后hook得到了dex文件

、

这个偏移我是找不到任何逻辑的，在壳elf里面，这里的0的，这里一直很异或，难道我们hook的这里不是调用链的一部分？

那这里肯定有dex文件，我们去hook看能不能得到偏移

如果静态看的话sub_4AE20，怀疑主要ELF的位置是sub_4AE20这个函数在解密dex

这里其实我尝试去直接hook当前elf的so，一直有问题，而且我是吧这个so文件当成原本的名字去hook的，难道是这个不是解密dex的位置，还是我的so名字根本不是这个，也有可能是反调试在这个函数前面，杀死了我的frida

这里直接采用作者的方式把

发现当前Dex的大小远超一般dex的大小，拖入010

从文件结构就可以看出，这里的大小和文件结构是不正常的

这个时候才意识到，前面的open dex根本不是去解密dex的操作，而是去读取这个open然后依次加载主要DEX的操作（猜测）

使用traceNative依旧出错

Failed while executing plugin_t.run():

Traceback (most recent call last):

File “D:/IDA Professional 9.0/plugins/traceNatives.py”, line 49, in run

ea, ed = getSegAddr()

File “D:/IDA Professional 9.0/plugins/traceNatives.py”, line 33, in getSegAddr

return min(textStart), max(textEnd)

ValueError: min() arg is an empty sequence

….

还是用作者的trace吧，感觉不错

趁机看了一下作者的这个trace，看得出来是基于frida stalker。

这里我尝试去hook so的话，必须去获得so的基地址嘛，也就是映射的基地址，但我尝试去查找mmap映射函数的时候，发现没有找到，后面发现，还有几种方式去映射函数

open + read + malloc + memcpy + mprotect

loader 先 open 文件或从网络/内存读取加密 ELF 内容，malloc 一块内存、memcpy 写入，然后 mprotect(addr, len, PROT_EXEC|PROT_READ) 使其可执行。这个过程不会出现 mmap。

但是我去寻找mprotect也没有看到逻辑

…..疑惑了

trace_native_so分析

小插曲，想分析一下作者的这个实现是基于什么的

发现也特别简单，就是去基于stalker，遍历每一条指令，然后去解析指令的地址，看看是不是函数名那个地址，如果是的话，就插入回调，然后DebugSymbol.fromAddress去解析符号，实现了打印函数调用链，打印每个函数名字的效果

疑惑

作者采用的是去加载壳elf和主要elf的方式是，用的依然是壳elf的基地址，hook的话，偏移还是elf在壳elf的下面位置，这种很神奇了，证明这两个elf加载到内存后，他们的内存空间基地址是连续的….（就跟磁盘空间的相对关系一样）可是我记得mmap函数的地址不是连续的？

结合代码的话，我们前面没有看到mmap函数，难到用的本身就不是mmap，而是就是复制加修改内存属性

这种的话就是匿名内存，然后枚举模块的时候，是枚举不到的

下面是gpt的回答

因为在某些打包/壳（packers）里，主 ELF 的代码最终是放在壳映射里的某个偏移位置（情况 3A 或 4）。磁盘上壳与主“连在一起”且运行时 loader 没把主单独映射，而是直接在壳映射范围内引用主代码——这使得以壳基址 + 固定偏移计算出的地址与实际执行地址一致，因此可以 hook 成功。

这样想的话，好像一切说得通了呢

trace主要执行流

注意，后面是以及去除了frida检测后的分析，frida检测去除可以直接看后面

那我们就把主要的elf去把基地址设置成壳偏移的位置试试吧

edit-segement-rebase

改成0xe7000

下面是我为了打印更多信息，所以这里重定向了内存检测


var func_addr_Main = [0x115130, 0x115150, 0x115160, 0x115170, 0x115180, 0x115190, 0x1151a0, 0x1151b0, 0x1151c0, 0x1151d0, 0x1151e0, 0x1151f0, 0x115200, 0x115210, 0x115220, 0x115230, 0x115240, 0x115250, 0x115260, 0x115270, 0x115280, 0x115290, 0x1152a0, 0x1152b0, 0x1152c0, 0x1152d0, 0x1152e0, 0x1152f0, 0x115300, 0x115310, 0x115320, 0x115330, 0x115340, 0x115350, 0x115360, 0x115370, 0x115380, 0x115390, 0x1153a0, 0x1153b0, 0x1153c0, 0x1153d0, 0x1153e0, 0x1153f0, 0x115400, 0x115410, 0x115420, 0x115430, 0x115440, 0x115450, 0x115460, 0x115470, 0x115480, 0x115490, 0x1154a0, 0x1154b0, 0x1154c0, 0x1154d0, 0x1154e0, 0x1154f0, 0x115500, 0x115510, 0x115520, 0x115530, 0x115540, 0x115550, 0x115560, 0x115570, 0x115580, 0x115590, 0x1155a0, 0x1155b0, 0x1155c0, 0x1155d0, 0x1155e0, 0x1155f0, 0x115600, 0x115610, 0x115620, 0x115630, 0x115640, 0x115650, 0x115660, 0x115670, 0x115680, 0x115690, 0x1156a0, 0x1156b0, 0x1156c0, 0x1156d0, 0x1156e0, 0x1156f0, 0x115700, 0x115710, 0x115720, 0x115730, 0x115740, 0x115750, 0x115760, 0x115770, 0x115780, 0x115790, 0x1157a0, 0x1157b0, 0x1157c0, 0x1157d0, 0x1157e0, 0x1157f0, 0x115800, 0x115810, 0x115820, 0x115830, 0x115840, 0x115850, 0x115860, 0x115870, 0x115880, 0x115890, 0x1158a0, 0x1158b0, 0x1158c0, 0x1158d0, 0x1158e0, 0x1158f0, 0x115900, 0x115910, 0x115920, 0x115930, 0x115940, 0x115950, 0x115960, 0x115970, 0x115980, 0x115990, 0x1159a0, 0x1159b0, 0x1159c0, 0x1159d0, 0x1159e0, 0x1159f0, 0x115a00, 0x115a10, 0x115a20, 0x115a30, 0x115a40, 0x115a50, 0x115a60, 0x115a70, 0x115a80, 0x115a90, 0x115aa0, 0x115ab0, 0x115ac0, 0x115ad0, 0x115ae0, 0x115af0, 0x115b00, 0x115b10, 0x115b20, 0x115b30, 0x115b40, 0x115b50, 0x115b60, 0x115b70, 0x115b80, 0x115b90, 0x115ba0, 0x115bb0, 0x115bc0, 0x115bd0, 0x115be0, 0x115bf0, 0x115c00, 0x115c10, 0x115c20, 0x115c30, 0x115c40, 0x115c50, 0x115c60, 0x115c70, 0x115c80, 0x115c90, 0x115ca0, 0x115cb0, 0x115cc0, 0x115cd0, 0x115ce0, 0x115cf0, 0x115d00, 0x115d10, 0x115d20, 0x115d30, 0x115d40, 0x115d50, 0x115d60, 0x115d70, 0x115d80, 0x115d90, 0x115da0, 0x115db0, 0x115dc0, 0x115dd0, 0x115de0, 0x115df0, 0x115e00, 0x115e10, 0x115e20, 0x115e30, 0x115e40, 0x115e50, 0x115e60, 0x115e70, 0x115e80, 0x115e90, 0x115ea0, 0x115eb0, 0x115ec0, 0x115ed0, 0x115ee0, 0x115ef0, 0x115f00, 0x115f10, 0x115f20, 0x115f30, 0x115f40, 0x115f50, 0x115f60, 0x115f70, 0x115f80, 0x115f90, 0x115fa0, 0x115fb0, 0x115fc0, 0x115fd0, 0x115fe0, 0x115ff0, 0x116000, 0x116010, 0x116020, 0x116030, 0x11603c, 0x1160b4, 0x1160c4, 0x11615c, 0x1161fc, 0x1164ac, 0x1164d8, 0x116528, 0x1165c8, 0x1166fc, 0x116728, 0x116750, 0x116830, 0x1168f0, 0x116a80, 0x116ad8, 0x116af4, 0x116b10, 0x116b2c, 0x116b84, 0x116ba0, 0x1178e8, 0x1178fc, 0x117b68, 0x117be0, 0x117ca0, 0x117e90, 0x1180cc, 0x1182d8, 0x11859c, 0x1186b8, 0x118748, 0x118ae4, 0x118c8c, 0x118d24, 0x118fb4, 0x119270, 0x11959c, 0x119634, 0x11bc1c, 0x11bd78, 0x11bd9c, 0x11bda8, 0x11be58, 0x11c1ac, 0x11c1b4, 0x11c210, 0x11c268, 0x11c300, 0x11c394, 0x11caa4, 0x11cc18, 0x11cf8c, 0x11d134, 0x11d4c4, 0x11d694, 0x11d738, 0x11d73c, 0x11e0d8, 0x11e834, 0x11f130, 0x11f1c8, 0x11f260, 0x11f3a4, 0x11f56c, 0x11f604, 0x11f69c, 0x11f768, 0x11f884, 0x11fa18, 0x11fb14, 0x1200c8, 0x120194, 0x1202d4, 0x12036c, 0x1203c8, 0x120404, 0x120440, 0x12047c, 0x1205a0, 0x120664, 0x120674, 0x120678, 0x120c30, 0x121b78, 0x121be0, 0x121c40, 0x121cd8, 0x122180, 0x1222d0, 0x1222e8, 0x122ae0, 0x122b54, 0x122b5c, 0x122c7c, 0x122d14, 0x123324, 0x1236b8, 0x123720, 0x123970, 0x123bc0, 0x123ce8, 0x124510, 0x124710, 0x124900, 0x124c68, 0x124f7c, 0x124fa0, 0x1253b8, 0x125650, 0x125854, 0x125d2c, 0x125dc4, 0x126888, 0x126920, 0x126ed8, 0x126f84, 0x12743c, 0x127dcc, 0x127ea8, 0x1281e4, 0x1281ec, 0x1288dc, 0x128a2c, 0x128d44, 0x128d64, 0x128d70, 0x128db8, 0x128e60, 0x128e88, 0x128f5c, 0x129468, 0x129758, 0x129a04, 0x12a568, 0x12ac10, 0x12ad6c, 0x12aeb0, 0x12b9fc, 0x12bb18, 0x12bb80, 0x12bf4c, 0x12c08c, 0x12c5d4, 0x12cc6c, 0x12d2f8, 0x12d470, 0x12d478, 0x12d480, 0x12d48c, 0x12d4a4, 0x12d4ac, 0x12d4d8, 0x12d518, 0x12d560, 0x12d84c, 0x12d9fc, 0x12db60, 0x12dfe4, 0x12f9f8, 0x12fa34, 0x12fa6c, 0x12fb00, 0x12fb18, 0x1317a4, 0x131958, 0x131d58, 0x131e20, 0x132088, 0x132518, 0x132da8, 0x1332b8, 0x136d68, 0x136db0, 0x136ff8, 0x137164, 0x137408, 0x137630, 0x137820, 0x137978, 0x1395a8, 0x1395c4, 0x1395ec, 0x139604, 0x139628, 0x139664, 0x139678, 0x139698, 0x1396a0, 0x1396b4, 0x1396d0, 0x1396fc, 0x13970c, 0x139728, 0x139770, 0x139824, 0x139828, 0x13982c, 0x1398f0, 0x1399d8, 0x139adc, 0x139bac, 0x139bb8, 0x139ce4, 0x139cfc, 0x139d18, 0x139d40, 0x139d4c, 0x139d50, 0x139d6c, 0x139d8c, 0x139dac, 0x139df4, 0x139e0c, 0x139e40, 0x139e7c, 0x13a4d4, 0x13a4e4, 0x13a4fc, 0x13a53c, 0x13a55c, 0x13a588, 0x13a5a8, 0x13a5d4, 0x13a5e4, 0x13a600, 0x13a61c, 0x13a664, 0x13a670, 0x13a684, 0x13a6b4, 0x13a6d0, 0x13a79c, 0x13a7ac, 0x13a7e0, 0x13a7e8, 0x13a808, 0x13a810, 0x13a82c, 0x13a870, 0x13a894, 0x13a8ac, 0x13a8dc, 0x13a920, 0x13a95c, 0x13a9a4, 0x13a9b4, 0x13a9d0, 0x13aa00, 0x13aa0c, 0x13aa50, 0x13aa74, 0x13ab40, 0x13b1cc, 0x13b1d8, 0x13bc98, 0x13bcb0, 0x13bd80, 0x13be14, 0x13be2c, 0x13be4c, 0x13be64, 0x13be80, 0x13bea0, 0x13beb8, 0x13bf30, 0x13bf50, 0x13bf70, 0x13bf90, 0x13bfb0, 0x13bfd0, 0x13bff0, 0x13c064, 0x13c07c, 0x13c09c, 0x13c12c, 0x13c13c, 0x13c1e4, 0x13c238, 0x13c2a8, 0x13c2f0, 0x13c31c, 0x13c384, 0x13c3cc, 0x13c4ec, 0x13c4f0, 0x13c544, 0x13d114, 0x13d288, 0x13d2ec, 0x13d30c, 0x13d310, 0x13d328, 0x13d344, 0x13d38c, 0x13d394, 0x13d39c, 0x13d3a4, 0x13d460, 0x13d480, 0x13d484, 0x13d49c, 0x13d4a4, 0x13d4ac, 0x13d4c8, 0x13d538, 0x13d5d8, 0x13d5e4, 0x13d70c, 0x13db7c, 0x13dea8, 0x13df34, 0x13e0ec, 0x13e0f8, 0x13e510, 0x13e654, 0x13e784, 0x13e9ac, 0x13eae0, 0x13ec30, 0x13ee08, 0x13ef2c, 0x13f888, 0x13f920, 0x14027c, 0x140a3c, 0x1411fc, 0x1412c0, 0x1415f0, 0x141924, 0x1427e8, 0x14283c, 0x14285c, 0x142894, 0x1428bc, 0x14292c, 0x142954, 0x1429b8, 0x1429c0, 0x1429cc, 0x142a10, 0x142aa4, 0x142abc, 0x142ea0, 0x142fe0, 0x143008, 0x143088, 0x14316c, 0x143184, 0x143568, 0x143848, 0x143964, 0x1439fc, 0x143a38, 0x143b48, 0x143c54, 0x143d24, 0x143d3c, 0x143ebc, 0x1440cc, 0x14423c, 0x144360, 0x1444b8, 0x144508, 0x14453c, 0x144774, 0x14495c, 0x144afc, 0x144ef0, 0x144f4c, 0x14500c, 0x145018, 0x145024, 0x145030, 0x14503c, 0x145040, 0x145078, 0x1450a4, 0x145148, 0x145154, 0x14516c, 0x145184, 0x14519c, 0x1451b4, 0x1451cc, 0x1451e4, 0x1451fc, 0x145214, 0x145228, 0x145268, 0x145280, 0x145298, 0x1452b0, 0x1452c8, 0x1452e0, 0x1452f8, 0x145310, 0x14aa44, 0x14aa50, 0x14aa88, 0x14aaac, 0x14aacc, 0x14aaf0, 0x14ab14, 0x14ab34, 0x14ab68, 0x14ab78, 0x14abb0, 0x14abc0, 0x14abcc, 0x14abf4, 0x14ac1c, 0x14ac28, 0x14ac60, 0x14ac90, 0x14ad28, 0x14adb8, 0x14ae70, 0x14ae7c, 0x14ae88, 0x14aec4, 0x14aeec, 0x14b01c, 0x14b028, 0x14b054, 0x14b090, 0x14b09c, 0x14b0bc, 0x14b104, 0x14b164, 0x14b198, 0x14b1bc, 0x14b1dc, 0x14b204, 0x14b240, 0x14b250, 0x14b278, 0x14b2a8, 0x14b2e0, 0x14b304, 0x14b324, 0x14b36c, 0x14b3cc, 0x14b408, 0x14b430, 0x14b46c, 0x14b4a8, 0x14b4b4, 0x14b4ec, 0x14b4fc, 0x14b57c, 0x14b5c4, 0x14b5d0, 0x14b638, 0x14b65c, 0x14b67c, 0x14b6f4, 0x14b740, 0x14b7a8, 0x14b7d8, 0x14b808, 0x14b814, 0x14b820, 0x14b82c, 0x14b854, 0x14b868, 0x14b8d8, 0x14b908, 0x14b920, 0x14b998, 0x14b9d0, 0x14b9e0, 0x14ba00, 0x14ba0c, 0x14ba58, 0x14ba98, 0x14bae0, 0x14bb40, 0x14bb64, 0x14bb84, 0x14bb90, 0x14bc44, 0x14bc78, 0x14bd10, 0x14bd1c, 0x14bd28, 0x14bd4c, 0x14bd68, 0x14bd6c, 0x14bd90, 0x14bda0, 0x14bf9c, 0x14c18c, 0x14c198, 0x14c1a8, 0x14c1f4, 0x14c200, 0x14c24c, 0x14c25c, 0x14c2a8, 0x14c2b4, 0x14c4b0, 0x14c75c, 0x14c7c8, 0x14c844, 0x14c848, 0x14c84c, 0x14c898, 0x14c960, 0x14c978, 0x14c984, 0x14c990, 0x14c9dc, 0x14c9e8, 0x14ca30, 0x14cb2c, 0x14cd80, 0x14cdcc, 0x14cdf4, 0x14ce04, 0x14ce50, 0x14ce5c, 0x14ce68, 0x14cf64, 0x14d17c, 0x14d1e8, 0x14d200, 0x14d214, 0x14d234, 0x14d26c, 0x14d27c, 0x14d2c8, 0x14d390, 0x14d3bc, 0x14d3e4, 0x14d3f8, 0x14d418, 0x14d440, 0x14d458, 0x14d474, 0x14d570, 0x14d7e8, 0x14d810, 0x14d820, 0x14d86c, 0x14d87c, 0x14d8a0, 0x14d8b0, 0x14d8f8, 0x14d9f4, 0x14da04, 0x14da08, 0x14da54, 0x14da60, 0x14dc5c, 0x14ddc4, 0x14de34, 0x14dea8, 0x14deb8, 0x14dedc, 0x14deec, 0x14df3c, 0x14dfac, 0x14e000, 0x14e004, 0x14e008, 0x14e030, 0x14e0fc, 0x14e114, 0x14e128, 0x14e148, 0x14e158, 0x14e17c, 0x14e18c, 0x14e1b0, 0x14e1bc, 0x14e208, 0x14e214, 0x14e238, 0x14e258, 0x14e280, 0x14e34c, 0x14e364, 0x14e460, 0x14e470, 0x14e494, 0x14e4a4, 0x14e4c8, 0x14e4d0, 0x14e4dc, 0x14e5dc, 0x14e718, 0x14e728, 0x14e74c, 0x14e75c, 0x14e780, 0x14e854, 0x14e8ac, 0x14e8d4, 0x14e8ec, 0x14e8f8, 0x14e904, 0x14e94c, 0x14e958, 0x14ea54, 0x14ec90, 0x14ec9c, 0x14ecc0, 0x14ecd0, 0x14eecc, 0x14eed8, 0x14efd4, 0x14f228, 0x14f234, 0x14f258, 0x14f268, 0x14f274, 0x14f280, 0x14f2a4, 0x14f2ac, 0x14f2b8, 0x14f304, 0x14f3d4, 0x14f448, 0x14f458, 0x14f47c, 0x14f480, 0x14f484, 0x14f4a8, 0x14f6a4, 0x14f7d4, 0x14f840, 0x14f86c, 0x14f894, 0x14f8a8, 0x14f8c8, 0x14f8d8, 0x14f8fc, 0x14f90c, 0x14f918, 0x14f964, 0x14fa2c, 0x14fa44, 0x14fa58, 0x14fa78, 0x14fa88, 0x14fab4, 0x14fad4, 0x14fad8, 0x14fb24, 0x14fbec, 0x14fc28, 0x14fc3c, 0x14fc5c, 0x14fc84, 0x14fc88, 0x14fc8c, 0x14fcb0, 0x14fcfc, 0x14fd64, 0x14fd90, 0x14fdb8, 0x14fdcc, 0x14fdec, 0x14fe3c, 0x14fe60, 0x14fe70, 0x14fe7c, 0x14fe88, 0x14fed4, 0x14fedc, 0x14fef4, 0x14ff18, 0x14ff28, 0x14ff4c, 0x14ff50, 0x14ff54, 0x14ff78, 0x14ff9c, 0x150008, 0x15006c, 0x150094, 0x1500ac, 0x1500b8, 0x1500c4, 0x1500e8, 0x1501b4, 0x1501cc, 0x1501e0, 0x150200, 0x150250, 0x15025c, 0x1502ac, 0x1502b8, 0x1502bc, 0x1502e4, 0x1502ec, 0x1502f0, 0x150340, 0x150580, 0x15058c, 0x150808, 0x150814, 0x150930, 0x150940, 0x15094c, 0x150a6c, 0x150b94, 0x150c64, 0x150ca0, 0x150cb4, 0x150cd8, 0x150ce8, 0x150d0c, 0x150d38, 0x150d44, 0x150f84, 0x1510dc, 0x1510ec, 0x1510fc, 0x151338, 0x151488, 0x1514f4, 0x151570, 0x151598, 0x1515a8, 0x1516c8, 0x151968, 0x1519d4, 0x1519fc, 0x151a54, 0x151a64, 0x151ca0, 0x151f10, 0x151f5c, 0x151fc4, 0x151fec, 0x15210c, 0x15224c, 0x1522b8, 0x1522e4, 0x15230c, 0x152320, 0x152340, 0x152368, 0x152378, 0x1523e4, 0x15240c, 0x152434, 0x15244c, 0x152450, 0x152474, 0x152480, 0x15248c, 0x15249c, 0x1524a8, 0x152574, 0x15259c, 0x1525c4, 0x1525e8, 0x1525f8, 0x15261c, 0x15262c, 0x152648, 0x152658, 0x1526c0, 0x1526e8, 0x1527b4, 0x1527dc, 0x1527f8, 0x15284c, 0x152858, 0x152860, 0x152880, 0x152890, 0x1528dc, 0x1528e4, 0x152904, 0x15292c, 0x15293c, 0x152960, 0x15297c, 0x1529a0, 0x1529a4, 0x1529a8, 0x1529cc, 0x1529e8, 0x152a04, 0x152a2c, 0x152a34, 0x152a58, 0x152a90, 0x152b0c, 0x152b34, 0x152b44, 0x152b80, 0x152bbc, 0x152bd0, 0x152bf0, 0x152bf4, 0x152bf8, 0x152c1c, 0x152c20, 0x152c5c, 0x152c98, 0x152cac, 0x152ccc, 0x152ce4, 0x152d00, 0x152d10, 0x152d34, 0x152d5c, 0x152e2c, 0x152e84, 0x152eac, 0x152ee0, 0x153014, 0x15303c, 0x153074, 0x1530dc, 0x1530f4, 0x1530fc, 0x15311c, 0x15312c, 0x153150, 0x153160, 0x1531a0, 0x1531c4, 0x1531cc, 0x153218, 0x153280, 0x153298, 0x1532ac, 0x1532cc, 0x1532d0, 0x1532d4, 0x1532f8, 0x153308, 0x153354, 0x153370, 0x153398, 0x1533bc, 0x1534a8, 0x1534dc, 0x1535b0, 0x153608, 0x153630, 0x153634, 0x153640, 0x153680, 0x1536ac, 0x153720, 0x153730, 0x153754, 0x153784, 0x1537c0, 0x1537e8, 0x153804, 0x153840, 0x153868, 0x1538ac, 0x1538cc, 0x1538f0, 0x1539bc, 0x1539d4, 0x1539e8, 0x153a08, 0x153a0c, 0x153a10, 0x153a34, 0x153a44, 0x153a78, 0x153ab8, 0x153adc, 0x153af4, 0x153afc, 0x153b1c, 0x153b54, 0x153b64, 0x153ba8, 0x153dc0, 0x153dcc, 0x153e18, 0x153e44, 0x153e74, 0x153ea0, 0x153ec4, 0x153ef0, 0x153f00, 0x153f44, 0x153f60, 0x153f68, 0x153f84, 0x153f9c, 0x153fa4, 0x153fb4, 0x153fc8, 0x153fe8, 0x15400c, 0x154040, 0x154058, 0x154088, 0x15409c, 0x1540a8, 0x1540d0, 0x1540f0, 0x154110, 0x154138, 0x1541f0, 0x154238, 0x154244, 0x15426c, 0x154278, 0x1544b8, 0x1544e8, 0x15455c, 0x15458c, 0x1545b8, 0x1545dc, 0x154610, 0x154640, 0x15464c, 0x154670, 0x154698, 0x154760, 0x154778, 0x154780, 0x1547a0, 0x1547b8, 0x1547d4, 0x15481c, 0x154898, 0x154fd0, 0x155010, 0x155048, 0x155058, 0x1550c0, 0x1550e8, 0x155128, 0x155194, 0x1551d0, 0x1551e4, 0x155204, 0x155220, 0x155240, 0x155250, 0x155294, 0x1553f0, 0x155458, 0x155470, 0x155484, 0x1554a4, 0x1554cc, 0x1554f8, 0x155644, 0x1556b0, 0x1556ec, 0x155700, 0x155720, 0x155748, 0x155788, 0x1557b0, 0x1557e8, 0x155828, 0x15584c, 0x155888, 0x15589c, 0x1558bc, 0x1558d4, 0x1558f0, 0x155918, 0x15597c, 0x1559bc, 0x1559f4, 0x155a20, 0x155a94, 0x155abc, 0x155ae8, 0x155f04, 0x155f90, 0x156888, 0x1568c8, 0x1569fc, 0x156a1c, 0x156a44, 0x156a6c, 0x156a94, 0x156ab0, 0x156ac0, 0x156b0c, 0x156bd8, 0x156bf0, 0x156c04, 0x156c24, 0x156c28, 0x156c2c, 0x156c50, 0x156c80, 0x156cc0, 0x156ce4, 0x156cf8, 0x156d1c, 0x156d2c, 0x156d6c, 0x156ddc, 0x156e34, 0x156e5c, 0x156e6c, 0x156eac, 0x156f44, 0x156f50, 0x15704c, 0x1572a0, 0x1572ec, 0x1572f8, 0x157414, 0x157560, 0x157578, 0x15758c, 0x1575ac, 0x1575b0, 0x1575b4, 0x1575d8, 0x157608, 0x15762c, 0x157690, 0x1576b8, 0x1576d8, 0x157704, 0x157728, 0x15777c, 0x15784c, 0x1578bc, 0x1578d8, 0x1578f8, 0x157900, 0x15790c, 0x15793c, 0x157978, 0x15798c, 0x1579ac, 0x1579bc, 0x1579e0, 0x1579f0, 0x157a2c, 0x157be4, 0x157c20, 0x157c34, 0x157c54, 0x157c6c, 0x157ccc, 0x157d3c, 0x157d6c, 0x157d98, 0x157dbc, 0x157de8, 0x157df8, 0x157e38, 0x157fc4, 0x15801c, 0x15802c, 0x158050, 0x158060, 0x1580a0, 0x158168, 0x158180, 0x158188, 0x1581a8, 0x1581c0, 0x1581dc, 0x1581f8, 0x158228, 0x158380, 0x1583bc, 0x1583d4, 0x1583e8, 0x158408, 0x158430, 0x158448, 0x158480, 0x1584e8, 0x158564, 0x158568, 0x15856c, 0x158590, 0x158594, 0x158598, 0x1585d8, 0x158640, 0x158658, 0x15866c, 0x15868c, 0x158690, 0x158694, 0x1586b8, 0x1586bc, 0x1586c0, 0x158700, 0x15872c, 0x158784, 0x1587f0, 0x158858, 0x158894, 0x1588a8, 0x1588c8, 0x1588cc, 0x1588d0, 0x158934, 0x158a9c, 0x158adc, 0x158ae4, 0x158b08, 0x158b30, 0x158b58, 0x158bbc, 0x158c78, 0x158d44, 0x158d6c, 0x158dac, 0x158f0c, 0x158f48, 0x158f70, 0x158fb0, 0x158fdc, 0x159004, 0x159018, 0x159038, 0x159048, 0x1590b0, 0x1590dc, 0x15910c, 0x159138, 0x15915c, 0x159164, 0x159168, 0x15918c, 0x1591a4, 0x1591d8, 0x159364, 0x1593cc, 0x1593e4, 0x1593ec, 0x15940c, 0x159410, 0x159414, 0x159478, 0x1594a0, 0x1594bc, 0x159520, 0x159730, 0x159754, 0x1597b8, 0x1597bc, 0x1597c0, 0x1597e4, 0x1597fc, 0x159838, 0x159868, 0x159894, 0x1598b8, 0x1598cc, 0x1598f4, 0x159908, 0x15994c, 0x1599b4, 0x1599cc, 0x1599e0, 0x159a00, 0x159a28, 0x159a40, 0x159a78, 0x159ae0, 0x159b5c, 0x159b60, 0x159b64, 0x159b88, 0x159b98, 0x159bdc, 0x159c4c, 0x159ca0, 0x159cb8, 0x159cd8, 0x159cf4, 0x159d2c, 0x159d7c, 0x159da0, 0x159dc8, 0x159dfc, 0x159f14, 0x159f50, 0x159f7c, 0x159fa4, 0x159fac, 0x15a018, 0x15a040, 0x15a068, 0x15a08c, 0x15a0a4, 0x15a0dc, 0x15a104, 0x15a114, 0x15a138, 0x15a200, 0x15a228, 0x15a25c, 0x15a424, 0x15a460, 0x15a49c, 0x15a4b0, 0x15a4d0, 0x15a4d4, 0x15a4d8, 0x15a4fc, 0x15a500, 0x15a504, 0x15a540, 0x15a57c, 0x15a590, 0x15a5b0, 0x15a5c0, 0x15a5e4, 0x15a5f4, 0x15a618, 0x15a630, 0x15a664, 0x15a698, 0x15a6d8, 0x15a6f8, 0x15a724, 0x15a75c, 0x15a7a0, 0x15a7c0, 0x15a7ec, 0x15a7fc, 0x15a818, 0x15a860, 0x15a8bc, 0x15a904, 0x15a960, 0x15a9a8, 0x15aa4c, 0x15aa94, 0x15abb0, 0x15acd8, 0x15ace4, 0x15acfc, 0x15ad40, 0x15ade4, 0x15ae88, 0x15ae94, 0x15aeac, 0x15aed8, 0x15af10, 0x15b124, 0x15b130, 0x15b148, 0x15b190, 0x15b1ec, 0x15b220, 0x15b22c, 0x15b244, 0x15b2e8, 0x15b348, 0x15b390, 0x15b3ec, 0x15b450, 0x15b524, 0x15b604, 0x15b64c, 0x15b6a8, 0x15b758, 0x15b83c, 0x15b92c, 0x15b974, 0x15b9d0, 0x15b9e8, 0x15ba2c, 0x15ba88, 0x15bab0, 0x15bae4, 0x15bb24, 0x15bb3c, 0x15bb60, 0x15bb88, 0x15bb94, 0x15bbb0, 0x15bbc8, 0x15bbec, 0x15bc40, 0x15bd74, 0x15beb4, 0x15befc, 0x15bf54, 0x15bff4, 0x15c220, 0x15c22c, 0x15c244, 0x15c280, 0x15c4ec, 0x15c590, 0x15c59c, 0x15c5b4, 0x15c6bc, 0x15c7d0, 0x15c8b4, 0x15c9a4, 0x15caa8, 0x15cbb8, 0x15cc00, 0x15cc5c, 0x15cec8, 0x15cf10, 0x15cf6c, 0x15cfb4, 0x15d010, 0x15d01c, 0x15d034, 0x15d07c, 0x15d0d8, 0x15d138, 0x15d3b4, 0x15d3d8, 0x15d47c, 0x15d494, 0x15d4b8, 0x15d68c, 0x15d6b0, 0x15d794, 0x15d884, 0x15d928, 0x15d9b0, 0x15dbec, 0x15dc90, 0x15dc9c, 0x15dcb4, 0x15dcf0, 0x15dd38, 0x15dd94, 0x15ddb8, 0x15de00, 0x15de5c, 0x15de80, 0x15deb0, 0x15def8, 0x15df54, 0x15dfa0, 0x15e044, 0x15e050, 0x15e068, 0x15e088, 0x15e0b4, 0x15e0d8, 0x15e17c, 0x15e188, 0x15e1a0, 0x15e1ec, 0x15e290, 0x15e2d8, 0x15e334, 0x15e340, 0x15e358, 0x15e364, 0x15e37c, 0x15e388, 0x15e3a0, 0x15e3e8, 0x15e444, 0x15e450, 0x15e468, 0x15e488, 0x15e4b4, 0x15e4d8, 0x15e4e4, 0x15e4fc, 0x15e544, 0x15e5a0, 0x15e5ec, 0x15e60c, 0x15e638, 0x15e680, 0x15e6dc, 0x15e780, 0x15e78c, 0x15e7a4, 0x15e7ec, 0x15e848, 0x15e894, 0x15e8b8, 0x15e95c, 0x15e968, 0x15e980, 0x15ea24, 0x15ea78, 0x15ea84, 0x15ea9c, 0x15eae4, 0x15eb40, 0x15ebe4, 0x15ebf0, 0x15ec08, 0x15ec14, 0x15ec2c, 0x15ec38, 0x15ec50, 0x15ec78, 0x15ecac, 0x15ed48, 0x15ede4, 0x15ee08, 0x15ee50, 0x15eeac, 0x15ef48, 0x15efec, 0x15f088, 0x15f134, 0x15f140, 0x15f158, 0x15f1ac, 0x15f20c, 0x15f2a8, 0x15f344, 0x15f398, 0x15f3f8, 0x15f44c, 0x15f470, 0x15f4b8, 0x15f514, 0x15f588, 0x15f604, 0x15f680, 0x15f704, 0x15f74c, 0x15f7a8, 0x15f83c, 0x15f858, 0x15f938, 0x15fa54, 0x15fb7c, 0x15fb88, 0x15fba0, 0x15fbc0, 0x15fbf4, 0x15fc14, 0x15fc34, 0x15fca8, 0x15fd08, 0x15fd24, 0x15fd44, 0x15fd64, 0x15fd84, 0x15fda4, 0x15fdc4, 0x15fde4, 0x15fe04, 0x15fe24, 0x160108, 0x160128, 0x160148, 0x160168, 0x160188, 0x1601a8, 0x1601c8, 0x160228, 0x1602c4, 0x1602fc, 0x16031c, 0x16033c, 0x16035c, 0x16037c, 0x16039c, 0x1603bc, 0x1603dc, 0x1603fc, 0x16041c, 0x16043c, 0x16045c, 0x16047c, 0x16049c, 0x1604bc, 0x1604dc, 0x1604fc, 0x16051c, 0x16053c, 0x16055c, 0x16057c, 0x16059c, 0x1605bc, 0x1605dc, 0x1605fc, 0x16061c, 0x16063c, 0x16065c, 0x16067c, 0x16069c, 0x1606bc, 0x1606dc, 0x1606fc, 0x16071c, 0x16073c, 0x16075c, 0x16077c, 0x16079c, 0x1607bc, 0x1607dc, 0x1607fc, 0x16081c, 0x16083c, 0x16085c, 0x16087c, 0x16089c, 0x1608bc, 0x1608dc, 0x1608fc, 0x16091c, 0x16093c, 0x16095c, 0x16097c, 0x16099c, 0x1609bc, 0x160d7c, 0x1635e4, 0x163624, 0x163664, 0x1636a4, 0x1636e4, 0x1638e0, 0x163adc, 0x163ce4, 0x163ee8, 0x165e60, 0x165eec, 0x165f38, 0x165fa8, 0x165fdc, 0x165ffc, 0x16601c, 0x16603c, 0x1660d4, 0x1660f4, 0x166114, 0x166134, 0x1661cc, 0x166200, 0x166234, 0x166278, 0x166298, 0x1662b8, 0x1662d8, 0x166dd4, 0x1679dc, 0x1679e0, 0x167a00, 0x167a7c, 0x167b14, 0x167b30, 0x167bc8, 0x167bfc, 0x167c3c, 0x167ca4, 0x167e68, 0x167e88, 0x167e98, 0x167f30, 0x167f54, 0x167f98, 0x167fb8, 0x167fd8, 0x167ff8, 0x168018, 0x168038, 0x168058, 0x168078, 0x168098, 0x1680b8, 0x1680d8, 0x1680f8, 0x168118, 0x168138, 0x168158, 0x168178, 0x168198, 0x1681b8, 0x1681d8, 0x1681f8, 0x168218, 0x168238, 0x168258, 0x168278, 0x168298, 0x1682b8, 0x1682d8, 0x1682f8, 0x168318, 0x168338, 0x168358, 0x168378, 0x168398, 0x1683b8, 0x1683d8, 0x1683f8, 0x168418, 0x168438, 0x168458, 0x168478, 0x168510, 0x1685a8, 0x168640, 0x1686d8, 0x168770, 0x168808, 0x1688a0, 0x168a48, 0x168aa8, 0x168af8, 0x168b20, 0x168ba8, 0x168bf4, 0x168ca0, 0x168d54, 0x168ea0, 0x168f60, 0x168fe8, 0x16909c, 0x169124, 0x169168, 0x1691b4, 0x1691d4, 0x1691f4, 0x169214, 0x169234, 0x169254, 0x169274, 0x169294, 0x1692b4, 0x169380, 0x1694b0, 0x1696a0, 0x1696c4, 0x169714, 0x16973c, 0x169798, 0x1697d8, 0x169824, 0x16984c, 0x16988c, 0x1698b4, 0x1698f0, 0x1698f8, 0x169abc, 0x169c34, 0x16ad88, 0x16afc0, 0x16b6a4, 0x16b8f0, 0x16b92c, 0x16b98c, 0x16bb2c, 0x16bc20, 0x16bd74, 0x16c170, 0x16c2d0, 0x16c430, 0x16c90c, 0x16c918, 0x16ccf0, 0x16cdc8, 0x16cfb0, 0x16d084, 0x16d0d0, 0x16d1d4, 0x16d288, 0x16d2e0, 0x16d3bc, 0x16d3c0, 0x16d3c4, 0x16d3e4, 0x16d4dc, 0x16d58c, 0x16d5a0, 0x16d684, 0x16d908, 0x16db1c, 0x16e478, 0x16e98c, 0x16e9f8, 0x16eb34, 0x16ec74, 0x16ee9c, 0x16f89c, 0x16fa30, 0x16fd18, 0x16ff10, 0x170268, 0x17038c, 0x1705fc, 0x170668, 0x17074c, 0x170760, 0x170974, 0x170bb8, 0x170c30, 0x170fcc, 0x17107c, 0x171134, 0x171be8, 0x1721a4, 0x1724f4, 0x172508, 0x172660, 0x172968, 0x172aa4, 0x172d30, 0x172d78, 0x172dc0, 0x172e08, 0x172e50, 0x172e98, 0x173124, 0x17314c, 0x173174, 0x17365c, 0x173690, 0x173774, 0x17392c, 0x173fbc, 0x1742c8, 0x174618, 0x174648, 0x174730, 0x174b58, 0x174fe8, 0x1752bc, 0x175878, 0x175c68, 0x176390, 0x176410, 0x1764b4, 0x1764f8, 0x176d14, 0x177174, 0x1772f4, 0x177488, 0x178488, 0x179314, 0x179754, 0x179bec, 0x179d20, 0x179e78, 0x179fd0, 0x17a128, 0x17a280, 0x17a3d8, 0x17a530, 0x17a688, 0x17a7e0, 0x17a938, 0x17aa90, 0x17abe8, 0x17ace8, 0x17ae74, 0x17af14, 0x17b4f4, 0x17bf70, 0x17c514, 0x17cd74, 0x17ce08, 0x17d040, 0x17d994, 0x17db3c, 0x17dec0, 0x17e12c, 0x17e6b0, 0x17ea9c, 0x17f5f8, 0x17fb5c, 0x17fc80, 0x180060, 0x18006c, 0x180070, 0x1800a4, 0x1800c4, 0x18019c, 0x180218, 0x180290, 0x180298, 0x1802a0, 0x1802a8, 0x1802b0, 0x1802b8, 0x1802c0, 0x180348, 0x180384, 0x1803c8, 0x180424, 0x180460, 0x180650, 0x1806ec, 0x18078c, 0x180824, 0x1808b8, 0x180944, 0x180980, 0x181438, 0x1815c0, 0x181658, 0x1816b0, 0x182944, 0x18298c, 0x182abc, 0x182bf4, 0x182c98, 0x182cec, 0x182d88, 0x183094, 0x1832e4, 0x1833e4, 0x1834dc, 0x183558, 0x1837e0, 0x1837fc, 0x183890, 0x183988, 0x183a64, 0x183bd4, 0x183bf4, 0x183c38, 0x183d90, 0x183d98, 0x183f14, 0x183f4c, 0x183f9c, 0x183fd4, 0x184078, 0x184400, 0x184b74, 0x184e48, 0x18511c, 0x185520, 0x1863f4, 0x186488, 0x18658c, 0x186598, 0x1865a8, 0x1865b8, 0x1865dc, 0x186600, 0x186658, 0x186688, 0x186774, 0x1867f8, 0x186830, 0x186874, 0x186898, 0x1868bc, 0x186df4, 0x186e48, 0x186e50, 0x186e7c, 0x186fdc, 0x18716c, 0x187184, 0x18725c, 0x18735c, 0x1874a8, 0x187858, 0x187a14, 0x187aac, 0x187df8, 0x187fd4, 0x188144, 0x1882a8, 0x18840c, 0x188570, 0x1886d4, 0x1888f0, 0x188b0c, 0x188ba4, 0x188cc0, 0x188d24, 0x188f1c, 0x188f44, 0x188f84, 0x188f94, 0x18912c, 0x1892e0, 0x1893c8, 0x1893d8, 0x189654, 0x189658, 0x18965c, 0x189660, 0x1898b0, 0x189918, 0x18993c, 0x189a64, 0x189b10, 0x189c18, 0x189cb0, 0x189d80, 0x189e28, 0x189fa4, 0x189fa8, 0x189fdc, 0x189ffc, 0x18a020, 0x18a058, 0x18a07c, 0x18a0b4, 0x18a0d8, 0x18a110, 0x18a134, 0x18a16c, 0x18a190, 0x18a1c8, 0x18a1ec, 0x18a224, 0x18a248, 0x18a280, 0x18a2a4, 0x18a2b0, 0x18a2b8, 0x18a304, 0x18a30c, 0x18a358, 0x18a35c, 0x18a390, 0x18a3b0, 0x18a480, 0x18a598, 0x18a634, 0x18a6bc, 0x18a74c, 0x18a7ec, 0x18a8cc, 0x18a9ac, 0x18aab0, 0x18ab7c, 0x18abb0, 0x18ad00, 0x18ae24, 0x18af4c, 0x18b028, 0x18b074, 0x18bad4, 0x18bbf8, 0x18bd04, 0x18c024, 0x18c620, 0x18ce34, 0x18d070, 0x18d8c4, 0x18d93c, 0x18da00, 0x18da48, 0x18dae8, 0x18db88, 0x18dc28, 0x18dc4c, 0x18dcc0, 0x18dd8c, 0x18dd90, 0x18dd94, 0x18dda8, 0x18ddb8, 0x18e244, 0x18e8d0, 0x18f6ac, 0x18f8b0, 0x18f8d8, 0x18fb64, 0x18fbb0, 0x18fc9c, 0x18fe18, 0x18fea8, 0x1926f0, 0x192c54, 0x192cd4, 0x192d54, 0x192da0, 0x192e3c, 0x192e78, 0x192f10, 0x192f4c, 0x192fe8, 0x193034, 0x19307c, 0x193274, 0x1932ac, 0x1932e4, 0x19331c, 0x1933fc, 0x1934cc, 0x1935bc, 0x1937ac, 0x19384c, 0x193a2c, 0x193bf4, 0x193cec, 0x193ddc, 0x194114, 0x1942d0, 0x194514, 0x194758, 0x194948, 0x194b30, 0x194e44, 0x195008, 0x1952e8, 0x1953d8, 0x1954d0, 0x19570c, 0x195cac, 0x195e6c, 0x195ffc, 0x196010, 0x196160, 0x196164, 0x196168, 0x1962b8, 0x1962bc, 0x196430, 0x196434, 0x196598, 0x19659c, 0x196640, 0x196644, 0x196b24, 0x196c9c, 0x196cc0, 0x196ce0, 0x196e58, 0x196e94, 0x196f08, 0x19709c, 0x1970b8, 0x1970bc, 0x1970c0, 0x197144, 0x197424, 0x197478, 0x197488, 0x197498, 0x1974d4, 0x1974e4, 0x1974f4, 0x19766c, 0x197898, 0x197940, 0x197960, 0x19796c, 0x197984, 0x197994, 0x197a7c, 0x197d5c, 0x197e44, 0x197f48, 0x197f50, 0x197f54, 0x197f5c, 0x197fb0, 0x198070, 0x1982bc, 0x1982c8, 0x1982d0, 0x1982d8, 0x198300, 0x19830c, 0x1983e8, 0x198408, 0x198420, 0x198708, 0x198774, 0x19885c, 0x198b3c, 0x198c24, 0x198d28, 0x198d30, 0x198d3c, 0x198d40, 0x198d48, 0x198d9c, 0x198e5c, 0x19955c, 0x199568, 0x199570, 0x199578, 0x199688, 0x199794, 0x1997b4, 0x1997c0, 0x1997d8, 0x1997e8, 0x1998d0, 0x199bb0, 0x199c98, 0x199d9c, 0x199da4, 0x199da8, 0x199db0, 0x199e04, 0x199ec4, 0x19a110, 0x19a11c, 0x19a124, 0x19a12c, 0x19a14c, 0x19a158, 0x19a170, 0x19a3e0, 0x19a44c, 0x19a534, 0x19a814, 0x19a8fc, 0x19aa00, 0x19aa08, 0x19aa0c, 0x19aa14, 0x19aa68, 0x19ab0c, 0x19b568, 0x19b574, 0x19b57c, 0x19b584, 0x19b640, 0x19b760, 0x19b7ec, 0x19b844, 0x19b870, 0x19bc9c, 0x19c6e0, 0x19c7ac, 0x19c920, 0x19ccd4, 0x19cd44, 0x19cd74, 0x19d238, 0x19d2cc, 0x19d360, 0x19d3e4, 0x19d56c, 0x19d750, 0x19d894, 0x19da08, 0x19db48, 0x19dca4, 0x19e088, 0x19e110, 0x19e508, 0x19ea48, 0x19ed64, 0x19f0a0, 0x19f358, 0x19f500, 0x19f608, 0x19f67c, 0x19f68c, 0x19f6dc, 0x19f70c, 0x19f7c4, 0x19f7ec, 0x19f984, 0x19fdd8, 0x19ff98, 0x1a0330, 0x1a0418, 0x1a0760, 0x1a0c34, 0x1a0c88, 0x1a0e00, 0x1a0f58, 0x1a1110, 0x1a1114, 0x1a11a0, 0x1a12ec, 0x1a16a4, 0x1a171c, 0x1a181c, 0x1a1908, 0x1a19ec, 0x1a1a70, 0x1a1ae8, 0x1a1b64, 0x1a1b74, 0x1a1b78, 0x1a1b7c, 0x1a1c78, 0x1a1c88, 0x1a1c8c, 0x1a1c90, 0x1a1d84, 0x1a1e74, 0x1a1ef0, 0x1a2034, 0x1a2108, 0x1a2160, 0x1a2378, 0x1a2380, 0x1a23cc, 0x1a24c4, 0x1a25e0, 0x1a2718, 0x1a2830, 0x1a2938, 0x1a2984, 0x1a2a94, 0x1a2ba0, 0x1a2cac, 0x1a2ddc, 0x1a3150, 0x1a3204, 0x1a3228, 0x1a325c, 0x1a3260, 0x1a327c, 0x1a32c0, 0x1a3434, 0x1a3438, 0x1a3450, 0x1a46b8, 0x1a62e4, 0x1a648c, 0x1a6d4c, 0x1a6f40, 0x1a7de0, 0x1a7f58, 0x1a8150, 0x1a8168, 0x1a8300, 0x1a8308, 0x1a847c, 0x1a8728, 0x1a88a4, 0x1a898c, 0x1a8ad4, 0x1a8aec, 0x1a8c24, 0x1a8c84, 0x1a8e60, 0x1a8f58, 0x1a9074, 0x1a9190, 0x1a9248, 0x1a92c0, 0x1a9484, 0x1a94a8, 0x1a94b0, 0x1a94b8, 0x1a94ec, 0x1a9558, 0x1a9650, 0x1a9670, 0x1a96a0, 0x1a9f9c, 0x1a9fbc, 0x1a9fd4, 0x1aa7c4, 0x1aa7f4, 0x1aacfc, 0x1aada8, 0x1aadc8, 0x1aadd4, 0x1aae90, 0x1aaf48, 0x1aaf54, 0x1aaf5c, 0x1aaff4, 0x1ab088, 0x1ab0fc, 0x1ab16c, 0x1ab220, 0x1ab228, 0x1ab230, 0x1ab244, 0x1ab24c, 0x1ab2e4, 0x1ab378, 0x1ab410, 0x1ab4a4, 0x1ab518, 0x1ab588, 0x1ab5fc, 0x1ab66c, 0x1ab704, 0x1ab798, 0x1ab80c, 0x1ab87c, 0x1ab8dc, 0x1ab950, 0x1ab9c0, 0x1aba34, 0x1abaa4, 0x1abadc, 0x1abb10, 0x1abb84, 0x1abbf4, 0x1abc5c, 0x1abcc0, 0x1abcc4, 0x1abcd4, 0x1abdb4, 0x1abe90, 0x1abeb0, 0x1abf0c, 0x1ac0d4, 0x1ac108, 0x1ac170, 0x1ac1f0, 0x1ac210, 0x1ae394, 0x1ae4c4, 0x1ae4dc, 0x1ae4e4, 0x1ae4f8, 0x1ae528, 0x1ae540, 0x1ae5b4, 0x1ae624, 0x1ae65c, 0x1ae690, 0x1ae6c8, 0x1ae6fc, 0x1ae714, 0x1ae72c, 0x1ae778, 0x1ae790, 0x1af394, 0x1afc80, 0x1afe2c, 0x1afe4c, 0x1afe6c, 0x1afe8c, 0x1afe90, 0x1aff58, 0x1b0108, 0x1b0120, 0x1b01dc, 0x1b0294, 0x1b02b4, 0x1b03ac, 0x1b04a0, 0x1b04f0, 0x1b053c, 0x1b058c, 0x1b05d8, 0x1b06b8, 0x1b0794, 0x1b0868, 0x1b0938, 0x1b0944, 0x1b095c, 0x1b0974, 0x1b098c, 0x1b0b58, 0x1b0fe4, 0x1b1010, 0x1b18f0, 0x1b19bc, 0x1b1ce8, 0x1b26b4, 0x1b26d4, 0x1b26f4, 0x1b27c8, 0x1b2898, 0x1b2918, 0x1b2994, 0x1b29a8, 0x1b29b8, 0x1b29d0, 0x1b29f0, 0x1b2a64, 0x1b2ad4, 0x1b2d70, 0x1b2d90, 0x1b2d98, 0x1b2da8, 0x1b2dc8, 0x1b2de0, 0x1b2e04, 0x1b2e78, 0x1b2f20, 0x1b2f58, 0x1b2f8c, 0x1b3070, 0x1b3080, 0x1b309c, 0x1b311c, 0x1b3198, 0x1b3218, 0x1b3294, 0x1b32f0, 0x1b3348, 0x1b3368, 0x1b3384, 0x1b3440, 0x1b34f8, 0x1b3524, 0x1b354c, 0x1b36f4, 0x1b3714, 0x1b3758, 0x1b3798, 0x1b37dc, 0x1b381c, 0x1b38e8, 0x1b3960, 0x1b3b00, 0x1b3f0c, 0x1b3f74, 0x1b4040, 0x1b4100, 0x1b41dc, 0x1b53a8, 0x1b5500, 0x1b56f8, 0x1b578c, 0x1b586c, 0x1b5b50, 0x1b5d04, 0x1b5de4, 0x1b5e54, 0x1b5ec4, 0x1b6080, 0x1b60e8, 0x1b6180, 0x1b6270, 0x1b6448, 0x1b6470, 0x1b6498, 0x1b64c0, 0x1b6528, 0x1b6540, 0x1b6578, 0x1b6678, 0x1b6680, 0x1b6694, 0x1b6698, 0x1b66a8, 0x1b66d0, 0x1b670c, 0x1b6710, 0x1b6800, 0x1b6810, 0x1b6814, 0x1b6818, 0x1b682c, 0x1b6874, 0x1b6898, 0x1b68a4, 0x1b6974, 0x1b69cc, 0x1b69d8, 0x1b6aa8, 0x1b6b58, 0x1b6bac, 0x1b6bc4, 0x1b6c94, 0x1b6cb0, 0x1b6dac, 0x1b6de0, 0x1b6de4, 0x1b6e08, 0x1b6e94, 0x1b6ea8, 0x1b6eac, 0x1b6eb0, 0x1b6eb4, 0x1b6f00, 0x1b6f14, 0x1b6f5c, 0x1b7068, 0x1b706c, 0x1b7084, 0x1b7088, 0x1b71b4, 0x1b71b8, 0x1b71f8, 0x1b71fc, 0x1b7340, 0x1b7348, 0x1b7350, 0x1b73e8, 0x1b74c4, 0x1b74c8, 0x1b7510, 0x1b7518, 0x1b7580, 0x1b7664, 0x1b7680, 0x1b770c, 0x1b7710, 0x1b782c, 0x1b7890, 0x1b7898, 0x1b78c8, 0x1b78cc, 0x1b7960, 0x1b79a0, 0x1b79d4, 0x1b7a08, 0x1b7abc, 0x1b7b38, 0x1b7bac, 0x1b7bc4, 0x1b7bdc, 0x1b7bfc, 0x1b7c14, 0x1b7c30, 0x1b7c40, 0x1b7c50, 0x1b7c54, 0x1b7cb0, 0x1b7ccc, 0x1b7ce4, 0x1b7d50, 0x1b7d64, 0x1b7d74, 0x1b7d78, 0x1b7d7c, 0x1b7d90, 0x1b7da0, 0x1b7da4, 0x1b7db0, 0x1b7db4, 0x1b7db8, 0x1b7dbc, 0x1b7dd0, 0x1b7dd4, 0x1b7df8, 0x1b7e04, 0x1b7e18, 0x1b7e3c, 0x1b7e48, 0x1b86cc, 0x1b86f8, 0x1b8a68, 0x1b8ae4, 0x1b8c38, 0x1b8c4c, 0x1b8c50, 0x1b8c54, 0x1b8c60, 0x1b8c64, 0x1b8c70, 0x1b8c74, 0x1b8c98, 0x1b8c9c, 0x1b8ca0, 0x1b8cc4, 0x1b8ce8, 0x1b8d0c, 0x1b8d30, 0x1b8d54, 0x1b8d78, 0x1b8d9c, 0x1b8dc0, 0x1b8de4, 0x1b8e08, 0x1b8e14, 0x1b8e1c, 0x1b8e24, 0x1b8e30, 0x1b8ef4, 0x1b8f5c, 0x1b8fd4, 0x1b9120, 0x1b9140, 0x1b92e4, 0x1b9410, 0x1b975c, 0x1b989c, 0x1b9940, 0x1b9b30, 0x1b9be4, 0x1b9c84, 0x1b9cd8, 0x1b9d34, 0x1b9d3c, 0x1b9d90, 0x1b9dec, 0x1b9df4, 0x1b9e50, 0x1b9eac, 0x1b9f08, 0x1b9f64, 0x1b9fc0, 0x1ba01c, 0x1ba078, 0x1ba07c, 0x1ba080, 0x1ba094, 0x1ba098, 0x1ba0bc, 0x1ba0c8, 0x1ba0dc, 0x1ba0e0, 0x1ba104, 0x1ba110, 0x1ba124, 0x1ba128, 0x1ba13c, 0x1ba140, 0x1ba17c, 0x1ba1f8, 0x1ba20c, 0x1ba278, 0x1ba28c, 0x1ba2bc, 0x1ba31c, 0x1ba398, 0x1ba3ac, 0x1ba418, 0x1ba42c, 0x1ba45c, 0x1ba4bc, 0x1ba538, 0x1ba5a8, 0x1ba5bc, 0x1ba628, 0x1ba63c, 0x1ba654, 0x1ba658, 0x1ba730, 0x1ba7a0, 0x1ba7fc, 0x1ba848, 0x1ba85c, 0x1ba944, 0x1ba98c, 0x1baa1c, 0x1bab44, 0x1bab60, 0x1bab88, 0x1babb0, 0x1baf90, 0x1bb014, 0x1bb3c4, 0x1bb40c, 0x1bb4e0, 0x1bb614, 0x1bb6c8, 0x1bc5ac, 0x1bc614, 0x1bc628, 0x1bc634, 0x1bc650, 0x1bc6b0, 0x1c4580, 0x1c4624, 0x1c9634, 0x1c97d8, 0x1c97dc, 0x1c9800, 0x1ca790, 0x1ca794, 0x1ca7b4, 0x1cb65c, 0x1cb660, 0x1cb670, 0x1cbde8, 0x1cbdec, 0x1cbdf0, 0x1cc090, 0x1cc178, 0x1cc17c, 0x1cc198, 0x1ce3a8, 0x1ce3ac, 0x1ce3bc, 0x1ce3cc, 0x1ce3dc, 0x1ce3f4, 0x1ce410, 0x1ce434, 0x1cfda4, 0x1cff68, 0x1cff9c, 0x1d5a90, 0x1d5a94, 0x1d5aa4, 0x1d5ae0, 0x1d5c08, 0x1d5ce8, 0x1d5cec, 0x1d5d08, 0x1d7744, 0x1d77f8, 0x1d8228, 0x1d822c, 0x1d8240, 0x1d874c, 0x1d880c, 0x1d8ad0, 0x1d8b18, 0x1d9650, 0x1d96a8, 0x1d96b8, 0x1d96c8, 0x1d96f0, 0x1d9718, 0x1d9740, 0x1d9a7c, 0x1d9aa4, 0x1da2e4, 0x1da2e8, 0x1da2f4, 0x1da458, 0x1da470, 0x1db90c, 0x1db910, 0x1db930, 0x1e36e4, 0x1e384c, 0x1e394c, 0x1e3fe4, 0x1e4094, 0x1e4788, 0x1e478c, 0x1e47a4, 0x1e487c, 0x1e49c4, 0x1e4ac0, 0x1e4ae8, 0x1e4c10, 0x1e4db0, 0x1e4eb4, 0x1e4ec0, 0x1e501c, 0x1e5090, 0x1e50f8, 0x1e5114, 0x1e5118, 0x1e513c, 0x1e5150, 0x1e5190, 0x1e5230, 0x1e5244, 0x1e5290, 0x1e52e4, 0x1e5308, 0x1e530c, 0x1e5330, 0x1e533c, 0x1e5340, 0x1e5344, 0x1e5388, 0x1e538c, 0x1e5394, 0x1e54bc, 0x1e54c0, 0x1e54c4, 0x1e54c8, 0x1e54d0, 0x1e54d4, 0x1e551c, 0x1e5520, 0x1e5528, 0x1e555c, 0x1e5580, 0x1e559c, 0x1e55d4, 0x1e5614, 0x1e5628, 0x1e563c, 0x1e567c, 0x1e84b0, 0x1e90d0, 0x1e926c, 0x1e9384, 0x1e99ec, 0x1e9a00, 0x1e9cc8, 0x1e9ccc, 0x1e9cd0, 0x1e9d20, 0x1e9d50, 0x1e9d58, 0x1e9dbc, 0x1e9de8, 0x1e9e28, 0x1ea074, 0x1ea110, 0x1ea73c, 0x1ea750, 0x1ea7a0, 0x1ea7a4, 0x1ea830, 0x1ea8d4, 0x1eaaf8, 0x1eac10, 0x1ead78, 0x1eae04, 0x1eae90, 0x1eaec0, 0x1eaefc, 0x1eaf34, 0x1eaf64, 0x1eaf70, 0x1eaf80, 0x1eafb8, 0x1eb1c4, 0x1eb1c8, 0x1eb254, 0x1eb2bc, 0x1eb310, 0x1eb31c, 0x1eb350, 0x1eb364, 0x1eb3a8, 0x1eb3e8, 0x1eb3f4, 0x1eb460, 0x1eb468, 0x1eb470, 0x1eb4fc, 0x1eb508, 0x1eb514, 0x1eb54c, 0x1eb584, 0x1eb5ac, 0x1ebbc0, 0x1ebcfc, 0x1ebdb0, 0x1ebee0, 0x1ebee4, 0x1ebef4, 0x1ebefc, 0x1ebf04, 0x1ebf0c, 0x1ebf20, 0x1ec02c, 0x1ec174, 0x1ec23c, 0x1ec248, 0x1ec268, 0x1ec274, 0x1ec298, 0x1ec2a8, 0x1ec2b0, 0x1ec2b8, 0x1ec2c0, 0x1ec38c, 0x1ec3b8, 0x1ec660, 0x1ec668, 0x1ec670, 0x1ec678, 0x1ec680, 0x1ec684, 0x1ec688, 0x1ec69c, 0x1ec6e0, 0x1ec730, 0x1ec754, 0x1ec790, 0x1ec814, 0x1ec838, 0x1ec844, 0x1ec850, 0x1ec8ac, 0x1ec908, 0x1eca3c, 0x1eca44, 0x1eca4c, 0x1eca60, 0x1ecae8, 0x1ecb24, 0x1eccd8, 0x1ed2e4, 0x1ed2f4, 0x1ed4b0, 0x1ed544, 0x1ed764, 0x1ed92c, 0x1eddc0, 0x1ee384, 0x1ee78c, 0x1ef318, 0x1ef574, 0x1ef628, 0x1ef814, 0x1ef8bc, 0x1efac8, 0x1efcc0, 0x1f059c, 0x1f09f8, 0x1f0a00, 0x1f0db4, 0x1f13fc, 0x1f1404, 0x1f1734, 0x1f1954, 0x1f2098, 0x1f209c, 0x1f20a0, 0x1f2274, 0x1f228c, 0x1f22b0, 0x1f22ec, 0x1f2330, 0x1f2764, 0x1f2788, 0x1f27c4, 0x1f2b10, 0x1f2b7c, 0x1f2c7c, 0x1f2ddc, 0x1f32c8, 0x1f36cc, 0x1f36d4, 0x1f36d8, 0x1f36dc, 0x1f36e0, 0x1f36e4, 0x1f36e8, 0x1f36ec, 0x1f36f0, 0x1f36f4, 0x1f4360, 0x1f4508, 0x1f450c, 0x1f4510, 0x1f4514, 0x1f4518, 0x1f451c, 0x1f4520, 0x1f4524, 0x1f4528, 0x1f48e0, 0x1f4d94, 0x1f4f68, 0x1f513c, 0x1f58c8, 0x1f8584, 0x1f8f4c, 0x1f90f4, 0x1f92c8, 0x1fbf60, 0x1fc37c, 0x1fc550, 0x1fefd8, 0x1ff0f4, 0x1ff424, 0x1ff8e8, 0x1ffba0, 0x1ffc10, 0x1ffcbc, 0x1ffcc0, 0x1ffcf4, 0x1ffd14, 0x1ffe18, 0x1ffec0, 0x1ffec4, 0x1ffef8, 0x1fff18, 0x1fffe8, 0x2001a0, 0x200394, 0x200650, 0x2006c4, 0x200738, 0x200960, 0x200ac0, 0x200d54, 0x200d90, 0x200f90, 0x2010b4, 0x201238, 0x201440, 0x201b20, 0x201b28, 0x201c24, 0x201d9c, 0x20245c, 0x202554, 0x2025f0, 0x202718, 0x202c98, 0x203038, 0x2038c0, 0x203ed0, 0x204678, 0x204bc4, 0x204cc0, 0x204dd4, 0x204f7c, 0x20510c, 0x205ad8, 0x20691c, 0x2069dc, 0x206ce8, 0x206d94, 0x2071c0, 0x2071ec, 0x2075ac, 0x2075c8, 0x2076b8, 0x207908, 0x20795c, 0x207960, 0x207964, 0x207a08, 0x207a78, 0x207af0, 0x207b54, 0x208050, 0x208068, 0x2080cc, 0x208198, 0x2082a0, 0x208310, 0x208370, 0x2083d8, 0x2084c4, 0x208558, 0x2087a8, 0x20895c, 0x208a70, 0x208bc8, 0x208d14, 0x208d84, 0x208ee8, 0x209010, 0x2090b4, 0x20916c, 0x2091dc, 0x20924c, 0x20940c, 0x209674, 0x209cbc, 0x209d88, 0x20a5d0, 0x20a7d0, 0x20a86c, 0x20ad24, 0x20ad60, 0x20ae04, 0x20af0c, 0x20b4e0, 0x20b4f4, 0x20b570, 0x20b8f4, 0x20b900, 0x20b904, 0x20b938, 0x20b958, 0x20b98c, 0x20ba5c, 0x20bb74, 0x20bd54, 0x20be40, 0x20bf2c, 0x20c0dc, 0x20c3b8, 0x20d070, 0x20d0ec, 0x20d138, 0x20d2d0, 0x20d36c, 0x20d4b8, 0x20def4, 0x20e010, 0x20e0cc, 0x20e21c, 0x20e35c, 0x20e4d8, 0x20e7c0, 0x20e824, 0x20e91c, 0x20eaa4, 0x20ec48, 0x20ecbc, 0x20ed30, 0x20f5ac, 0x20f768, 0x20fa70, 0x210574, 0x2108c8, 0x210ac0, 0x212ee8, 0x2133b8, 0x2142ac, 0x21587c, 0x215a24, 0x215bd8, 0x216198, 0x2161a4, 0x2161ac, 0x2161f0, 0x216230, 0x216274, 0x2162b4, 0x2162d4, 0x2163ac, 0x216504, 0x217188, 0x217444, 0x217510, 0x2175e0, 0x217600, 0x217618, 0x217620, 0x217640, 0x217660, 0x217680, 0x217698, 0x2178bc, 0x217adc, 0x217b20, 0x217c3c, 0x217db8, 0x217ffc, 0x218cb0, 0x218f34, 0x2191f0, 0x219294, 0x219350, 0x21944c, 0x2195d0, 0x2196c4, 0x219720, 0x219728, 0x21972c, 0x219910, 0x219a58, 0x219bec, 0x219c14, 0x219c54, 0x219d44, 0x219e58, 0x219e94, 0x219eec, 0x219ff8, 0x21a000, 0x21a058, 0x21a060, 0x21a074, 0x21a07c, 0x21a084, 0x21a08c, 0x21a0b4, 0x21a0bc, 0x21a0c4, 0x21a13c, 0x21a634, 0x21aa50, 0x21afe8, 0x21b20c, 0x21b2d8, 0x21b324, 0x21b3e4, 0x21b4d0, 0x21b5c4, 0x21b5c8, 0x21b750, 0x21b844, 0x21b940, 0x21ba3c, 0x21ba60, 0x21bb30, 0x21bb58, 0x21bb98, 0x21bbb4, 0x21bc74, 0x21bd28, 0x21bd88, 0x21bde8, 0x21be48, 0x21bf38, 0x21bfc8, 0x21c0c4, 0x21c224, 0x21c234, 0x21c648, 0x21c6e4, 0x21c844, 0x21c978, 0x21cef0, 0x21cf74, 0x21cf80, 0x21cfc0, 0x21d030, 0x21d03c, 0x21d068, 0x21d158, 0x21d15c, 0x21d180, 0x271fc0, 0x271fc8, 0x271fd0, 0x271fd8, 0x271fe0, 0x271fe8, 0x271ff0, 0x271ff8, 0x272000, 0x272008, 0x272010, 0x272018, 0x272020, 0x272028, 0x272030, 0x272038, 0x272040, 0x272048, 0x272050, 0x272058, 0x272060, 0x272068, 0x272070, 0x272078, 0x272080, 0x272088, 0x272090, 0x272098, 0x2720a0, 0x2720a8, 0x2720b0, 0x2720b8, 0x2720c0, 0x2720c8, 0x2720d0, 0x2720d8, 0x2720e0, 0x2720e8, 0x2720f0, 0x2720f8, 0x272100, 0x272108, 0x272110, 0x272118, 0x272120, 0x272128, 0x272130, 0x272138, 0x272140, 0x272148, 0x272150, 0x272158, 0x272160, 0x272168, 0x272170, 0x272178, 0x272180, 0x272188, 0x272190, 0x272198, 0x2721a0, 0x2721a8, 0x2721b0, 0x2721b8, 0x2721c0, 0x2721c8, 0x2721d0, 0x2721d8, 0x2721e0, 0x2721e8, 0x2721f0, 0x2721f8, 0x272200, 0x272208, 0x272210, 0x272218, 0x272220, 0x272228, 0x272230, 0x272238, 0x272240, 0x272248, 0x272250, 0x272258, 0x272260, 0x272268, 0x272270, 0x272278, 0x272280, 0x272288, 0x272290, 0x272298, 0x2722a0, 0x2722a8, 0x2722b0, 0x2722b8, 0x2722d0, 0x2722d8, 0x2722e0, 0x2722e8, 0x2722f8, 0x272300, 0x272308, 0x272310, 0x272318, 0x272320, 0x272328, 0x272330, 0x272338, 0x272340, 0x272348, 0x272350, 0x272358, 0x272360, 0x272368, 0x272370, 0x272378, 0x272380, 0x272388, 0x272390, 0x272398, 0x2723a0, 0x2723a8, 0x2723b0, 0x2723b8, 0x2723c0, 0x2723c8, 0x2723d0, 0x2723d8, 0x2723e0, 0x2723e8, 0x2723f0, 0x2723f8, 0x272400, 0x272408, 0x272410, 0x272418, 0x272420, 0x272428, 0x272430, 0x272438, 0x272440, 0x272448, 0x272450, 0x272458, 0x272460, 0x272468, 0x272470, 0x272478, 0x272480, 0x272488, 0x272490, 0x272498, 0x2724a0, 0x2724a8, 0x2724b0, 0x2724b8, 0x2724c0, 0x2724c8, 0x2724d0, 0x2724d8, 0x2724e0, 0x2724e8, 0x2724f0, 0x2724f8, 0x272500, 0x272508, 0x272510, 0x272518];
var func_name_Main = ["sub_115130", "opendir", "j__ZNSt16invalid_argumentD2Ev", "execve", "fdopen", "j__ZNSt3__120__throw_system_errorEiPKc", "j__ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendIPcEENS_9enable_ifIXsrNS_21__is_forward_iteratorIT_EE5valueERS5_E4typeESA_SA_", "memcmp", "listen", "ioctl", "__errno", "flock", "remove", "j__Unwind_GetDataRelBase", "deflateEnd", "abort", "j__Unwind_Find_FDE", "realloc", "connect", "write", "j___cxa_get_globals_fast", "dup2", "pthread_self", "_exit", "j___cxa_throw", "srandom", "sscanf", "j__ZNSt3__115system_categoryEv", "fsync", "gettimeofday", "j_interpreter_wrap_int64_t", "srand", "getpagesize", "inflate", "pipe", "pthread_cond_broadcast", "epoll_create", "access", "j___cxa_end_catch", "snprintf", "j___deregister_frame_info", "j__Unwind_SetGR", "j__ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_", "signal", "lseek", "j__ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm", "getpid", "j_strcmp", "readdir", "j__ZNSt3__112future_errorC2ENS_10error_codeE", "creat", "time", "j___self_kill", "inflateInit2_", "memset", "unlink", "strlcpy", "j__Znwm", "j_log_internal_impl", "dladdr", "fmodf", "malloc", "j__Unwind_GetLanguageSpecificData", "getcwd", "fork", "fmod", "random", "dlopen", "memmove", "gethostbyname", "strcat", "pthread_join", "rand", "fflush", "strncmp", "pthread_exit", "recv", "isxdigit", "strcpy", "j__Unwind_DeleteException", "strrchr", "fstat", "__cxa_atexit", "pthread_key_delete", "lstat", "j__ZNSt3__16vectorIiNS_9allocatorIiEEE21__push_back_slow_pathIRKiEEvOT_", "closedir", "pthread_create", "fclose", "setenv", "j_DobbyHook", "strdup", "inet_addr", "sleep", "open", "j__ZNSt11logic_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE", "pow", "strlcat", "strstr", "__assert2", "epoll_wait", "vfprintf", "kill", "deflateInit_", "munmap", "pthread_cond_wait", "pthread_setspecific", "deflate", "strchr", "chmod", "j___deregister_frame_info_bases", "pthread_mutex_destroy", "gettid", "bind", "getppid", "adler32", "popen", "j__ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_", "pthread_cond_destroy", "fnmatch", "dl_iterate_phdr", "j__ZNSt9exceptionD2Ev", "waitpid", "fwrite", "j___cxa_rethrow_primary_exception", "j__ZNSt9type_infoD2Ev", "j__ZSt15get_new_handlerv", "llabs", "deflateBound", "readlink", "strncpy", "__cxa_finalize", "j___register_frame_info", "j___read_self", "exit", "raise", "dlclose", "vprintf", "j___cxa_uncaught_exception", "send", "atoll", "fgets", "lseek64", "j___cxa_get_globals", "inflateEnd", "pthread_mutex_init", "__android_log_vprint", "j___register_frame_info_table", "strtoul", "socket", "close", "j__ZNSt3__119__thread_local_dataEv", "epoll_ctl", "sysconf", "j___cxa_demangle", "j__Unwind_RaiseException", "calloc", "j__Unwind_SetIP", "execl", "getsockopt", "j__ZdaPv", "j__ZNSt11logic_errorC2EPKc", "read", "j___cxa_allocate_exception", "j___register_frame_info_bases", "j__Unwind_GetRegionStart", "fputc", "prctl", "j__ZdlPv", "j__Unwind_GetTextRelBase", "j__ZSt9terminatev", "j__Znam", "j__ZSt17rethrow_exceptionSt13exception_ptr", "strtoull", "j__Unwind_GetCFA", "setsockopt", "mkdir", "j___cxa_begin_catch", "pthread_mutex_unlock", "fcntl", "j__ZNSt3__16vectorIiNS_9allocatorIiEEE21__push_back_slow_pathIiEEvOT_", "j___cxa_free_exception", "vsnprintf", "setpgid", "j___cxa_decrement_exception_refcount", "ftruncate", "pthread_mutex_lock", "tolower", "j___dynamic_cast", "nanosleep", "syscall", "mprotect", "isupper", "j__ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev", "free", "toupper", "j__ZNSt9exceptionD2Ev_0", "dlsym", "pclose", "atoi", "stat", "accept", "j___cxa_rethrow", "j___cxa_increment_exception_refcount", "memchr", "j___cxa_current_primary_exception", "vsyslog", "inet_ntoa", "strerror", "fopen", "j__Unwind_Resume", "j__ZNSt15underflow_errorD2Ev", "isspace", "j___self_lseek", "pthread_detach", "strtok", "j_CodePatch", "pwrite", "fileno", "atol", "j__ZSt13get_terminatev", "j__ZNSt13runtime_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE", "pthread_getspecific", "sprintf", "getenv", "pread", "memcpy", "j__ZSt14get_unexpectedv", "pthread_once", "j__Unwind_GetIP", "strlen", "pthread_key_create", "strtol", "j___register_frame_info_table_bases", "__stack_chk_fail", "mmap", "ptrace", "strcasecmp", "getuid", "start", "sub_11603C", "sub_1160B4", "sub_1160C4", "sub_11615C", "sub_1161FC", "sub_1164AC", "sub_1164D8", "sub_116528", "sub_1165C8", "sub_1166FC", "sub_116728", "sub_116750", "sub_116830", "sub_1168F0", "sub_116A80", "sub_116AD8", "sub_116AF4", "sub_116B10", "sub_116B2C", "sub_116B84", "sub_116BA0", "sub_1178E8", "sub_1178FC", "sub_117B68", "sub_117BE0", "sub_117CA0", "sub_117E90", "sub_1180CC", "sub_1182D8", "sub_11859C", "sub_1186B8", "sub_118748", "sub_118AE4", "sub_118C8C", "sub_118D24", "sub_118FB4", "sub_119270", "sub_11959C", "sub_119634", "sub_11BC1C", "JNI_OnLoad", "sub_11BD9C", "sub_11BDA8", "sub_11BE58", "sub_11C1AC", "sub_11C1B4", "sub_11C210", "sub_11C268", "sub_11C300", "sub_11C394", "sub_11CAA4", "sub_11CC18", "sub_11CF8C", "sub_11D134", "sub_11D4C4", "sub_11D694", "nullsub_8", "sub_11D73C", "sub_11E0D8", "sub_11E834", "sub_11F130", "sub_11F1C8", "sub_11F260", "sub_11F3A4", "sub_11F56C", "sub_11F604", "sub_11F69C", "sub_11F768", "sub_11F884", "sub_11FA18", "sub_11FB14", "sub_1200C8", "sub_120194", "sub_1202D4", "sub_12036C", "sub_1203C8", "sub_120404", "sub_120440", "sub_12047C", "sub_1205A0", "sub_120664", "nullsub_9", "sub_120678", "sub_120C30", "sub_121B78", "sub_121BE0", "sub_121C40", "sub_121CD8", "sub_122180", "sub_1222D0", "sub_1222E8", "sub_122AE0", "sub_122B54", "sub_122B5C", "sub_122C7C", "sub_122D14", "sub_123324", "sub_1236B8", "sub_123720", "sub_123970", "sub_123BC0", "sub_123CE8", "sub_124510", "sub_124710", "sub_124900", "sub_124C68", "sub_124F7C", "sub_124FA0", "sub_1253B8", "sub_125650", "sub_125854", "sub_125D2C", "sub_125DC4", "sub_126888", "sub_126920", "sub_126ED8", "sub_126F84", "sub_12743C", "sub_127DCC", "sub_127EA8", "sub_1281E4", "sub_1281EC", "sub_1288DC", "sub_128A2C", "sub_128D44", "sub_128D64", "sub_128D70", "sub_128DB8", "sub_128E60", "sub_128E88", "sub_128F5C", "sub_129468", "sub_129758", "sub_129A04", "sub_12A568", "sub_12AC10", "sub_12AD6C", "sub_12AEB0", "sub_12B9FC", "sub_12BB18", "sub_12BB80", "sub_12BF4C", "sub_12C08C", "sub_12C5D4", "sub_12CC6C", "sub_12D2F8", "sub_12D470", "sub_12D478", "sub_12D480", "sub_12D48C", "sub_12D4A4", "sub_12D4AC", "sub_12D4D8", "sub_12D518", "sub_12D560", "sub_12D84C", "sub_12D9FC", "sub_12DB60", "sub_12DFE4", "sub_12F9F8", "sub_12FA34", "sub_12FA6C", "sub_12FB00", "sub_12FB18", "sub_1317A4", "sub_131958", "sub_131D58", "sub_131E20", "sub_132088", "sub_132518", "sub_132DA8", "sub_1332B8", "sub_136D68", "sub_136DB0", "sub_136FF8", "sub_137164", "sub_137408", "sub_137630", "sub_137820", "sub_137978", "sub_1395A8", "sub_1395C4", "sub_1395EC", "sub_139604", "sub_139628", "sub_139664", "sub_139678", "sub_139698", "sub_1396A0", "sub_1396B4", "sub_1396D0", "sub_1396FC", "sub_13970C", "sub_139728", "sub_139770", "sub_139824", "sub_139828", "sub_13982C", "sub_1398F0", "sub_1399D8", "sub_139ADC", "sub_139BAC", "sub_139BB8", "sub_139CE4", "sub_139CFC", "sub_139D18", "sub_139D40", "sub_139D4C", "sub_139D50", "sub_139D6C", "sub_139D8C", "sub_139DAC", "sub_139DF4", "sub_139E0C", "sub_139E40", "sub_139E7C", "sub_13A4D4", "sub_13A4E4", "sub_13A4FC", "sub_13A53C", "sub_13A55C", "sub_13A588", "sub_13A5A8", "sub_13A5D4", "sub_13A5E4", "sub_13A600", "sub_13A61C", "sub_13A664", "sub_13A670", "sub_13A684", "sub_13A6B4", "sub_13A6D0", "sub_13A79C", "sub_13A7AC", "sub_13A7E0", "sub_13A7E8", "sub_13A808", "sub_13A810", "sub_13A82C", "sub_13A870", "sub_13A894", "sub_13A8AC", "sub_13A8DC", "sub_13A920", "sub_13A95C", "sub_13A9A4", "sub_13A9B4", "sub_13A9D0", "sub_13AA00", "sub_13AA0C", "sub_13AA50", "sub_13AA74", "sub_13AB40", "sub_13B1CC", "sub_13B1D8", "sub_13BC98", "sub_13BCB0", "sub_13BD80", "sub_13BE14", "sub_13BE2C", "sub_13BE4C", "sub_13BE64", "sub_13BE80", "sub_13BEA0", "sub_13BEB8", "sub_13BF30", "sub_13BF50", "sub_13BF70", "sub_13BF90", "sub_13BFB0", "sub_13BFD0", "sub_13BFF0", "sub_13C064", "sub_13C07C", "sub_13C09C", "sub_13C12C", "sub_13C13C", "sub_13C1E4", "sub_13C238", "sub_13C2A8", "sub_13C2F0", "strcmp", "sub_13C384", "sub_13C3CC", "sub_13C4EC", "sub_13C4F0", "sub_13C544", "sub_13D114", "sub_13D288", "sub_13D2EC", "sub_13D30C", "sub_13D310", "sub_13D328", "sub_13D344", "sub_13D38C", "sub_13D394", "sub_13D39C", "sub_13D3A4", "sub_13D460", "sub_13D480", "sub_13D484", "sub_13D49C", "sub_13D4A4", "sub_13D4AC", "sub_13D4C8", "sub_13D538", "sub_13D5D8", "sub_13D5E4", "sub_13D70C", "sub_13DB7C", "sub_13DEA8", "sub_13DF34", "sub_13E0EC", "sub_13E0F8", "sub_13E510", "sub_13E654", "sub_13E784", "sub_13E9AC", "sub_13EAE0", "sub_13EC30", "sub_13EE08", "sub_13EF2C", "sub_13F888", "sub_13F920", "sub_14027C", "sub_140A3C", "sub_1411FC", "sub_1412C0", "sub_1415F0", "sub_141924", "sub_1427E8", "sub_14283C", "sub_14285C", "sub_142894", "sub_1428BC", "sub_14292C", "sub_142954", "sub_1429B8", "sub_1429C0", "sub_1429CC", "sub_142A10", "sub_142AA4", "sub_142ABC", "sub_142EA0", "sub_142FE0", "sub_143008", "sub_143088", "sub_14316C", "sub_143184", "sub_143568", "sub_143848", "sub_143964", "sub_1439FC", "sub_143A38", "sub_143B48", "sub_143C54", "sub_143D24", "sub_143D3C", "sub_143EBC", "sub_1440CC", "sub_14423C", "sub_144360", "sub_1444B8", "sub_144508", "sub_14453C", "sub_144774", "sub_14495C", "sub_144AFC", "sub_144EF0", "sub_144F4C", "sub_14500C", "sub_145018", "sub_145024", "sub_145030", "sub_14503C", "sub_145040", "sub_145078", "sub_1450A4", "sub_145148", "sub_145154", "sub_14516C", "sub_145184", "sub_14519C", "sub_1451B4", "sub_1451CC", "sub_1451E4", "sub_1451FC", "sub_145214", "sub_145228", "sub_145268", "sub_145280", "sub_145298", "sub_1452B0", "sub_1452C8", "sub_1452E0", "sub_1452F8", "sub_145310", "sub_14AA44", "sub_14AA50", "sub_14AA88", "sub_14AAAC", "sub_14AACC", "sub_14AAF0", "sub_14AB14", "sub_14AB34", "sub_14AB68", "sub_14AB78", "sub_14ABB0", "sub_14ABC0", "sub_14ABCC", "sub_14ABF4", "sub_14AC1C", "sub_14AC28", "sub_14AC60", "sub_14AC90", "sub_14AD28", "sub_14ADB8", "sub_14AE70", "sub_14AE7C", "sub_14AE88", "sub_14AEC4", "sub_14AEEC", "sub_14B01C", "sub_14B028", "sub_14B054", "sub_14B090", "sub_14B09C", "sub_14B0BC", "sub_14B104", "sub_14B164", "sub_14B198", "sub_14B1BC", "sub_14B1DC", "sub_14B204", "sub_14B240", "sub_14B250", "sub_14B278", "sub_14B2A8", "sub_14B2E0", "sub_14B304", "sub_14B324", "sub_14B36C", "sub_14B3CC", "sub_14B408", "sub_14B430", "sub_14B46C", "sub_14B4A8", "sub_14B4B4", "sub_14B4EC", "sub_14B4FC", "sub_14B57C", "sub_14B5C4", "sub_14B5D0", "sub_14B638", "sub_14B65C", "sub_14B67C", "sub_14B6F4", "sub_14B740", "sub_14B7A8", "sub_14B7D8", "sub_14B808", "sub_14B814", "sub_14B820", "sub_14B82C", "sub_14B854", "sub_14B868", "sub_14B8D8", "sub_14B908", "sub_14B920", "sub_14B998", "sub_14B9D0", "sub_14B9E0", "sub_14BA00", "sub_14BA0C", "sub_14BA58", "sub_14BA98", "sub_14BAE0", "sub_14BB40", "sub_14BB64", "sub_14BB84", "sub_14BB90", "sub_14BC44", "sub_14BC78", "sub_14BD10", "sub_14BD1C", "sub_14BD28", "sub_14BD4C", "sub_14BD68", "sub_14BD6C", "sub_14BD90", "sub_14BDA0", "sub_14BF9C", "sub_14C18C", "sub_14C198", "sub_14C1A8", "sub_14C1F4", "sub_14C200", "sub_14C24C", "sub_14C25C", "sub_14C2A8", "sub_14C2B4", "sub_14C4B0", "sub_14C75C", "sub_14C7C8", "sub_14C844", "sub_14C848", "sub_14C84C", "sub_14C898", "sub_14C960", "sub_14C978", "sub_14C984", "sub_14C990", "sub_14C9DC", "sub_14C9E8", "sub_14CA30", "sub_14CB2C", "sub_14CD80", "sub_14CDCC", "sub_14CDF4", "sub_14CE04", "sub_14CE50", "sub_14CE5C", "sub_14CE68", "sub_14CF64", "sub_14D17C", "sub_14D1E8", "sub_14D200", "sub_14D214", "sub_14D234", "sub_14D26C", "sub_14D27C", "sub_14D2C8", "sub_14D390", "sub_14D3BC", "sub_14D3E4", "sub_14D3F8", "sub_14D418", "sub_14D440", "sub_14D458", "sub_14D474", "sub_14D570", "sub_14D7E8", "sub_14D810", "sub_14D820", "sub_14D86C", "sub_14D87C", "sub_14D8A0", "sub_14D8B0", "sub_14D8F8", "sub_14D9F4", "sub_14DA04", "sub_14DA08", "sub_14DA54", "sub_14DA60", "sub_14DC5C", "sub_14DDC4", "sub_14DE34", "sub_14DEA8", "sub_14DEB8", "sub_14DEDC", "sub_14DEEC", "sub_14DF3C", "sub_14DFAC", "sub_14E000", "sub_14E004", "sub_14E008", "sub_14E030", "sub_14E0FC", "sub_14E114", "sub_14E128", "sub_14E148", "sub_14E158", "sub_14E17C", "sub_14E18C", "sub_14E1B0", "sub_14E1BC", "sub_14E208", "sub_14E214", "sub_14E238", "sub_14E258", "sub_14E280", "sub_14E34C", "sub_14E364", "sub_14E460", "sub_14E470", "sub_14E494", "sub_14E4A4", "sub_14E4C8", "sub_14E4D0", "sub_14E4DC", "sub_14E5DC", "sub_14E718", "sub_14E728", "sub_14E74C", "sub_14E75C", "sub_14E780", "sub_14E854", "sub_14E8AC", "sub_14E8D4", "sub_14E8EC", "sub_14E8F8", "sub_14E904", "sub_14E94C", "sub_14E958", "sub_14EA54", "sub_14EC90", "sub_14EC9C", "sub_14ECC0", "sub_14ECD0", "sub_14EECC", "sub_14EED8", "sub_14EFD4", "sub_14F228", "sub_14F234", "sub_14F258", "sub_14F268", "sub_14F274", "sub_14F280", "sub_14F2A4", "sub_14F2AC", "sub_14F2B8", "sub_14F304", "sub_14F3D4", "sub_14F448", "sub_14F458", "sub_14F47C", "sub_14F480", "sub_14F484", "sub_14F4A8", "sub_14F6A4", "sub_14F7D4", "sub_14F840", "sub_14F86C", "sub_14F894", "sub_14F8A8", "sub_14F8C8", "sub_14F8D8", "sub_14F8FC", "sub_14F90C", "sub_14F918", "sub_14F964", "sub_14FA2C", "sub_14FA44", "sub_14FA58", "sub_14FA78", "sub_14FA88", "sub_14FAB4", "sub_14FAD4", "sub_14FAD8", "sub_14FB24", "sub_14FBEC", "sub_14FC28", "sub_14FC3C", "sub_14FC5C", "sub_14FC84", "sub_14FC88", "sub_14FC8C", "sub_14FCB0", "sub_14FCFC", "sub_14FD64", "sub_14FD90", "sub_14FDB8", "sub_14FDCC", "sub_14FDEC", "sub_14FE3C", "sub_14FE60", "sub_14FE70", "sub_14FE7C", "sub_14FE88", "sub_14FED4", "sub_14FEDC", "sub_14FEF4", "sub_14FF18", "sub_14FF28", "sub_14FF4C", "sub_14FF50", "sub_14FF54", "sub_14FF78", "sub_14FF9C", "sub_150008", "sub_15006C", "sub_150094", "sub_1500AC", "sub_1500B8", "sub_1500C4", "sub_1500E8", "sub_1501B4", "sub_1501CC", "sub_1501E0", "sub_150200", "sub_150250", "sub_15025C", "sub_1502AC", "sub_1502B8", "sub_1502BC", "sub_1502E4", "sub_1502EC", "sub_1502F0", "sub_150340", "sub_150580", "sub_15058C", "sub_150808", "sub_150814", "sub_150930", "sub_150940", "sub_15094C", "sub_150A6C", "sub_150B94", "sub_150C64", "sub_150CA0", "sub_150CB4", "sub_150CD8", "sub_150CE8", "sub_150D0C", "sub_150D38", "sub_150D44", "sub_150F84", "sub_1510DC", "sub_1510EC", "sub_1510FC", "sub_151338", "sub_151488", "sub_1514F4", "sub_151570", "sub_151598", "sub_1515A8", "sub_1516C8", "sub_151968", "sub_1519D4", "sub_1519FC", "sub_151A54", "sub_151A64", "sub_151CA0", "sub_151F10", "sub_151F5C", "sub_151FC4", "sub_151FEC", "sub_15210C", "sub_15224C", "sub_1522B8", "sub_1522E4", "sub_15230C", "sub_152320", "sub_152340", "sub_152368", "sub_152378", "sub_1523E4", "sub_15240C", "sub_152434", "sub_15244C", "sub_152450", "sub_152474", "sub_152480", "sub_15248C", "sub_15249C", "sub_1524A8", "sub_152574", "sub_15259C", "sub_1525C4", "sub_1525E8", "sub_1525F8", "sub_15261C", "sub_15262C", "sub_152648", "sub_152658", "sub_1526C0", "sub_1526E8", "sub_1527B4", "sub_1527DC", "sub_1527F8", "sub_15284C", "sub_152858", "sub_152860", "sub_152880", "sub_152890", "sub_1528DC", "sub_1528E4", "sub_152904", "sub_15292C", "sub_15293C", "sub_152960", "sub_15297C", "sub_1529A0", "sub_1529A4", "sub_1529A8", "sub_1529CC", "sub_1529E8", "sub_152A04", "sub_152A2C", "sub_152A34", "sub_152A58", "sub_152A90", "sub_152B0C", "sub_152B34", "sub_152B44", "sub_152B80", "sub_152BBC", "sub_152BD0", "sub_152BF0", "sub_152BF4", "sub_152BF8", "sub_152C1C", "sub_152C20", "sub_152C5C", "sub_152C98", "sub_152CAC", "sub_152CCC", "sub_152CE4", "sub_152D00", "sub_152D10", "sub_152D34", "sub_152D5C", "sub_152E2C", "sub_152E84", "sub_152EAC", "sub_152EE0", "sub_153014", "sub_15303C", "sub_153074", "sub_1530DC", "sub_1530F4", "sub_1530FC", "sub_15311C", "sub_15312C", "sub_153150", "sub_153160", "sub_1531A0", "sub_1531C4", "sub_1531CC", "sub_153218", "sub_153280", "sub_153298", "sub_1532AC", "sub_1532CC", "sub_1532D0", "sub_1532D4", "sub_1532F8", "sub_153308", "sub_153354", "sub_153370", "sub_153398", "sub_1533BC", "sub_1534A8", "sub_1534DC", "sub_1535B0", "sub_153608", "sub_153630", "sub_153634", "sub_153640", "sub_153680", "sub_1536AC", "sub_153720", "sub_153730", "sub_153754", "sub_153784", "sub_1537C0", "sub_1537E8", "sub_153804", "sub_153840", "sub_153868", "sub_1538AC", "sub_1538CC", "sub_1538F0", "sub_1539BC", "sub_1539D4", "sub_1539E8", "sub_153A08", "sub_153A0C", "sub_153A10", "sub_153A34", "sub_153A44", "sub_153A78", "sub_153AB8", "sub_153ADC", "sub_153AF4", "sub_153AFC", "sub_153B1C", "sub_153B54", "sub_153B64", "sub_153BA8", "sub_153DC0", "sub_153DCC", "sub_153E18", "sub_153E44", "sub_153E74", "sub_153EA0", "sub_153EC4", "sub_153EF0", "sub_153F00", "sub_153F44", "sub_153F60", "sub_153F68", "sub_153F84", "sub_153F9C", "sub_153FA4", "sub_153FB4", "sub_153FC8", "sub_153FE8", "sub_15400C", "sub_154040", "sub_154058", "sub_154088", "sub_15409C", "sub_1540A8", "sub_1540D0", "sub_1540F0", "sub_154110", "sub_154138", "sub_1541F0", "sub_154238", "sub_154244", "sub_15426C", "sub_154278", "sub_1544B8", "sub_1544E8", "sub_15455C", "sub_15458C", "sub_1545B8", "sub_1545DC", "sub_154610", "sub_154640", "sub_15464C", "sub_154670", "sub_154698", "sub_154760", "sub_154778", "sub_154780", "sub_1547A0", "sub_1547B8", "sub_1547D4", "sub_15481C", "sub_154898", "sub_154FD0", "sub_155010", "sub_155048", "sub_155058", "sub_1550C0", "sub_1550E8", "sub_155128", "sub_155194", "sub_1551D0", "sub_1551E4", "sub_155204", "sub_155220", "sub_155240", "sub_155250", "sub_155294", "sub_1553F0", "sub_155458", "sub_155470", "sub_155484", "sub_1554A4", "sub_1554CC", "sub_1554F8", "sub_155644", "sub_1556B0", "sub_1556EC", "sub_155700", "sub_155720", "sub_155748", "sub_155788", "sub_1557B0", "sub_1557E8", "sub_155828", "sub_15584C", "sub_155888", "sub_15589C", "sub_1558BC", "sub_1558D4", "sub_1558F0", "sub_155918", "sub_15597C", "sub_1559BC", "sub_1559F4", "sub_155A20", "sub_155A94", "sub_155ABC", "sub_155AE8", "sub_155F04", "sub_155F90", "sub_156888", "sub_1568C8", "sub_1569FC", "sub_156A1C", "sub_156A44", "sub_156A6C", "sub_156A94", "sub_156AB0", "sub_156AC0", "sub_156B0C", "sub_156BD8", "sub_156BF0", "sub_156C04", "sub_156C24", "sub_156C28", "sub_156C2C", "sub_156C50", "sub_156C80", "sub_156CC0", "sub_156CE4", "sub_156CF8", "sub_156D1C", "sub_156D2C", "sub_156D6C", "sub_156DDC", "sub_156E34", "sub_156E5C", "sub_156E6C", "sub_156EAC", "sub_156F44", "sub_156F50", "sub_15704C", "sub_1572A0", "sub_1572EC", "sub_1572F8", "sub_157414", "sub_157560", "sub_157578", "sub_15758C", "sub_1575AC", "sub_1575B0", "sub_1575B4", "sub_1575D8", "sub_157608", "sub_15762C", "sub_157690", "sub_1576B8", "sub_1576D8", "sub_157704", "sub_157728", "sub_15777C", "sub_15784C", "sub_1578BC", "sub_1578D8", "sub_1578F8", "sub_157900", "sub_15790C", "sub_15793C", "sub_157978", "sub_15798C", "sub_1579AC", "sub_1579BC", "sub_1579E0", "sub_1579F0", "sub_157A2C", "sub_157BE4", "sub_157C20", "sub_157C34", "sub_157C54", "sub_157C6C", "sub_157CCC", "sub_157D3C", "sub_157D6C", "sub_157D98", "sub_157DBC", "sub_157DE8", "sub_157DF8", "sub_157E38", "sub_157FC4", "sub_15801C", "sub_15802C", "sub_158050", "sub_158060", "sub_1580A0", "sub_158168", "sub_158180", "sub_158188", "sub_1581A8", "sub_1581C0", "sub_1581DC", "sub_1581F8", "sub_158228", "sub_158380", "sub_1583BC", "sub_1583D4", "sub_1583E8", "sub_158408", "sub_158430", "sub_158448", "sub_158480", "sub_1584E8", "sub_158564", "sub_158568", "sub_15856C", "sub_158590", "sub_158594", "sub_158598", "sub_1585D8", "sub_158640", "sub_158658", "sub_15866C", "sub_15868C", "sub_158690", "sub_158694", "sub_1586B8", "sub_1586BC", "sub_1586C0", "sub_158700", "sub_15872C", "sub_158784", "sub_1587F0", "sub_158858", "sub_158894", "sub_1588A8", "sub_1588C8", "sub_1588CC", "sub_1588D0", "sub_158934", "sub_158A9C", "sub_158ADC", "sub_158AE4", "sub_158B08", "sub_158B30", "sub_158B58", "sub_158BBC", "sub_158C78", "sub_158D44", "sub_158D6C", "sub_158DAC", "sub_158F0C", "sub_158F48", "sub_158F70", "sub_158FB0", "sub_158FDC", "sub_159004", "sub_159018", "sub_159038", "sub_159048", "sub_1590B0", "sub_1590DC", "sub_15910C", "sub_159138", "sub_15915C", "sub_159164", "sub_159168", "sub_15918C", "sub_1591A4", "sub_1591D8", "sub_159364", "sub_1593CC", "sub_1593E4", "sub_1593EC", "sub_15940C", "sub_159410", "sub_159414", "sub_159478", "sub_1594A0", "sub_1594BC", "sub_159520", "sub_159730", "sub_159754", "sub_1597B8", "sub_1597BC", "sub_1597C0", "sub_1597E4", "sub_1597FC", "sub_159838", "sub_159868", "sub_159894", "sub_1598B8", "sub_1598CC", "sub_1598F4", "sub_159908", "sub_15994C", "sub_1599B4", "sub_1599CC", "sub_1599E0", "sub_159A00", "sub_159A28", "sub_159A40", "sub_159A78", "sub_159AE0", "sub_159B5C", "sub_159B60", "sub_159B64", "sub_159B88", "sub_159B98", "sub_159BDC", "sub_159C4C", "sub_159CA0", "sub_159CB8", "sub_159CD8", "sub_159CF4", "sub_159D2C", "sub_159D7C", "sub_159DA0", "sub_159DC8", "sub_159DFC", "sub_159F14", "sub_159F50", "sub_159F7C", "sub_159FA4", "sub_159FAC", "sub_15A018", "sub_15A040", "sub_15A068", "sub_15A08C", "sub_15A0A4", "sub_15A0DC", "sub_15A104", "sub_15A114", "sub_15A138", "sub_15A200", "sub_15A228", "sub_15A25C", "sub_15A424", "sub_15A460", "sub_15A49C", "sub_15A4B0", "sub_15A4D0", "sub_15A4D4", "sub_15A4D8", "sub_15A4FC", "sub_15A500", "sub_15A504", "sub_15A540", "sub_15A57C", "sub_15A590", "sub_15A5B0", "sub_15A5C0", "sub_15A5E4", "sub_15A5F4", "sub_15A618", "sub_15A630", "sub_15A664", "sub_15A698", "sub_15A6D8", "sub_15A6F8", "sub_15A724", "sub_15A75C", "sub_15A7A0", "sub_15A7C0", "sub_15A7EC", "sub_15A7FC", "sub_15A818", "sub_15A860", "sub_15A8BC", "sub_15A904", "sub_15A960", "sub_15A9A8", "sub_15AA4C", "sub_15AA94", "sub_15ABB0", "sub_15ACD8", "sub_15ACE4", "sub_15ACFC", "sub_15AD40", "sub_15ADE4", "sub_15AE88", "sub_15AE94", "sub_15AEAC", "sub_15AED8", "sub_15AF10", "sub_15B124", "sub_15B130", "sub_15B148", "sub_15B190", "sub_15B1EC", "sub_15B220", "sub_15B22C", "sub_15B244", "sub_15B2E8", "sub_15B348", "sub_15B390", "sub_15B3EC", "sub_15B450", "sub_15B524", "sub_15B604", "sub_15B64C", "sub_15B6A8", "sub_15B758", "sub_15B83C", "sub_15B92C", "sub_15B974", "sub_15B9D0", "sub_15B9E8", "sub_15BA2C", "sub_15BA88", "sub_15BAB0", "sub_15BAE4", "sub_15BB24", "sub_15BB3C", "sub_15BB60", "sub_15BB88", "sub_15BB94", "sub_15BBB0", "sub_15BBC8", "sub_15BBEC", "sub_15BC40", "sub_15BD74", "sub_15BEB4", "sub_15BEFC", "sub_15BF54", "sub_15BFF4", "sub_15C220", "sub_15C22C", "sub_15C244", "sub_15C280", "sub_15C4EC", "sub_15C590", "sub_15C59C", "sub_15C5B4", "sub_15C6BC", "sub_15C7D0", "sub_15C8B4", "sub_15C9A4", "sub_15CAA8", "sub_15CBB8", "sub_15CC00", "sub_15CC5C", "sub_15CEC8", "sub_15CF10", "sub_15CF6C", "sub_15CFB4", "sub_15D010", "sub_15D01C", "sub_15D034", "sub_15D07C", "sub_15D0D8", "sub_15D138", "sub_15D3B4", "sub_15D3D8", "sub_15D47C", "sub_15D494", "sub_15D4B8", "sub_15D68C", "sub_15D6B0", "sub_15D794", "sub_15D884", "sub_15D928", "sub_15D9B0", "sub_15DBEC", "sub_15DC90", "sub_15DC9C", "sub_15DCB4", "sub_15DCF0", "sub_15DD38", "sub_15DD94", "sub_15DDB8", "sub_15DE00", "sub_15DE5C", "sub_15DE80", "sub_15DEB0", "sub_15DEF8", "sub_15DF54", "sub_15DFA0", "sub_15E044", "sub_15E050", "sub_15E068", "sub_15E088", "sub_15E0B4", "sub_15E0D8", "sub_15E17C", "sub_15E188", "sub_15E1A0", "sub_15E1EC", "sub_15E290", "sub_15E2D8", "sub_15E334", "sub_15E340", "sub_15E358", "sub_15E364", "sub_15E37C", "sub_15E388", "sub_15E3A0", "sub_15E3E8", "sub_15E444", "sub_15E450", "sub_15E468", "sub_15E488", "sub_15E4B4", "sub_15E4D8", "sub_15E4E4", "sub_15E4FC", "sub_15E544", "sub_15E5A0", "sub_15E5EC", "sub_15E60C", "sub_15E638", "sub_15E680", "sub_15E6DC", "sub_15E780", "sub_15E78C", "sub_15E7A4", "sub_15E7EC", "sub_15E848", "sub_15E894", "sub_15E8B8", "sub_15E95C", "sub_15E968", "sub_15E980", "sub_15EA24", "sub_15EA78", "sub_15EA84", "sub_15EA9C", "sub_15EAE4", "sub_15EB40", "sub_15EBE4", "sub_15EBF0", "sub_15EC08", "sub_15EC14", "sub_15EC2C", "sub_15EC38", "sub_15EC50", "sub_15EC78", "sub_15ECAC", "sub_15ED48", "sub_15EDE4", "sub_15EE08", "sub_15EE50", "sub_15EEAC", "sub_15EF48", "sub_15EFEC", "sub_15F088", "sub_15F134", "sub_15F140", "sub_15F158", "sub_15F1AC", "sub_15F20C", "sub_15F2A8", "sub_15F344", "sub_15F398", "sub_15F3F8", "sub_15F44C", "sub_15F470", "sub_15F4B8", "sub_15F514", "sub_15F588", "sub_15F604", "sub_15F680", "sub_15F704", "sub_15F74C", "sub_15F7A8", "sub_15F83C", "sub_15F858", "sub_15F938", "sub_15FA54", "sub_15FB7C", "sub_15FB88", "sub_15FBA0", "sub_15FBC0", "sub_15FBF4", "sub_15FC14", "sub_15FC34", "sub_15FCA8", "sub_15FD08", "sub_15FD24", "sub_15FD44", "sub_15FD64", "sub_15FD84", "sub_15FDA4", "sub_15FDC4", "sub_15FDE4", "sub_15FE04", "sub_15FE24", "sub_160108", "sub_160128", "sub_160148", "sub_160168", "sub_160188", "sub_1601A8", "sub_1601C8", "sub_160228", "sub_1602C4", "sub_1602FC", "sub_16031C", "sub_16033C", "sub_16035C", "sub_16037C", "sub_16039C", "sub_1603BC", "sub_1603DC", "sub_1603FC", "sub_16041C", "sub_16043C", "sub_16045C", "sub_16047C", "sub_16049C", "sub_1604BC", "sub_1604DC", "sub_1604FC", "sub_16051C", "sub_16053C", "sub_16055C", "sub_16057C", "sub_16059C", "sub_1605BC", "sub_1605DC", "sub_1605FC", "sub_16061C", "sub_16063C", "sub_16065C", "sub_16067C", "sub_16069C", "sub_1606BC", "sub_1606DC", "sub_1606FC", "sub_16071C", "sub_16073C", "sub_16075C", "sub_16077C", "sub_16079C", "sub_1607BC", "sub_1607DC", "sub_1607FC", "sub_16081C", "sub_16083C", "sub_16085C", "sub_16087C", "sub_16089C", "sub_1608BC", "sub_1608DC", "sub_1608FC", "sub_16091C", "sub_16093C", "sub_16095C", "sub_16097C", "sub_16099C", "sub_1609BC", "sub_160D7C", "sub_1635E4", "sub_163624", "sub_163664", "sub_1636A4", "sub_1636E4", "sub_1638E0", "sub_163ADC", "sub_163CE4", "sub_163EE8", "sub_165E60", "sub_165EEC", "sub_165F38", "sub_165FA8", "sub_165FDC", "sub_165FFC", "sub_16601C", "sub_16603C", "sub_1660D4", "sub_1660F4", "sub_166114", "sub_166134", "sub_1661CC", "sub_166200", "sub_166234", "sub_166278", "sub_166298", "sub_1662B8", "sub_1662D8", "sub_166DD4", "sub_1679DC", "sub_1679E0", "sub_167A00", "sub_167A7C", "sub_167B14", "sub_167B30", "sub_167BC8", "sub_167BFC", "sub_167C3C", "sub_167CA4", "sub_167E68", "sub_167E88", "sub_167E98", "sub_167F30", "sub_167F54", "sub_167F98", "sub_167FB8", "sub_167FD8", "sub_167FF8", "sub_168018", "sub_168038", "sub_168058", "sub_168078", "sub_168098", "sub_1680B8", "sub_1680D8", "sub_1680F8", "sub_168118", "sub_168138", "sub_168158", "sub_168178", "sub_168198", "sub_1681B8", "sub_1681D8", "sub_1681F8", "sub_168218", "sub_168238", "sub_168258", "sub_168278", "sub_168298", "sub_1682B8", "sub_1682D8", "sub_1682F8", "sub_168318", "sub_168338", "sub_168358", "sub_168378", "sub_168398", "sub_1683B8", "sub_1683D8", "sub_1683F8", "sub_168418", "sub_168438", "sub_168458", "sub_168478", "sub_168510", "sub_1685A8", "sub_168640", "sub_1686D8", "sub_168770", "sub_168808", "sub_1688A0", "sub_168A48", "sub_168AA8", "sub_168AF8", "sub_168B20", "sub_168BA8", "sub_168BF4", "sub_168CA0", "sub_168D54", "sub_168EA0", "sub_168F60", "sub_168FE8", "sub_16909C", "sub_169124", "sub_169168", "sub_1691B4", "sub_1691D4", "sub_1691F4", "sub_169214", "sub_169234", "sub_169254", "sub_169274", "sub_169294", "sub_1692B4", "sub_169380", "sub_1694B0", "sub_1696A0", "sub_1696C4", "sub_169714", "sub_16973C", "sub_169798", "sub_1697D8", "sub_169824", "sub_16984C", "sub_16988C", "sub_1698B4", "sub_1698F0", "sub_1698F8", "sub_169ABC", "sub_169C34", "sub_16AD88", "sub_16AFC0", "sub_16B6A4", "sub_16B8F0", "sub_16B92C", "sub_16B98C", "sub_16BB2C", "sub_16BC20", "sub_16BD74", "sub_16C170", "sub_16C2D0", "sub_16C430", "sub_16C90C", "sub_16C918", "sub_16CCF0", "sub_16CDC8", "sub_16CFB0", "sub_16D084", "sub_16D0D0", "sub_16D1D4", "sub_16D288", "sub_16D2E0", "nullsub_10", "j_j__ZdlPv_4", "sub_16D3C4", "sub_16D3E4", "sub_16D4DC", "sub_16D58C", "sub_16D5A0", "sub_16D684", "sub_16D908", "sub_16DB1C", "sub_16E478", "sub_16E98C", "sub_16E9F8", "sub_16EB34", "sub_16EC74", "sub_16EE9C", "sub_16F89C", "sub_16FA30", "sub_16FD18", "sub_16FF10", "sub_170268", "sub_17038C", "sub_1705FC", "sub_170668", "sub_17074C", "sub_170760", "sub_170974", "sub_170BB8", "sub_170C30", "sub_170FCC", "sub_17107C", "sub_171134", "sub_171BE8", "sub_1721A4", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev", "sub_172508", "sub_172660", "sub_172968", "sub_172AA4", "sub_172D30", "sub_172D78", "sub_172DC0", "sub_172E08", "sub_172E50", "sub_172E98", "sub_173124", "sub_17314C", "sub_173174", "sub_17365C", "sub_173690", "sub_173774", "sub_17392C", "sub_173FBC", "sub_1742C8", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_", "sub_174648", "sub_174730", "sub_174B58", "sub_174FE8", "sub_1752BC", "sub_175878", "sub_175C68", "_ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm", "sub_176410", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_", "sub_1764F8", "sub_176D14", "sub_177174", "sub_1772F4", "sub_177488", "sub_178488", "sub_179314", "sub_179754", "sub_179BEC", "sub_179D20", "sub_179E78", "sub_179FD0", "sub_17A128", "sub_17A280", "sub_17A3D8", "sub_17A530", "sub_17A688", "sub_17A7E0", "sub_17A938", "sub_17AA90", "sub_17ABE8", "sub_17ACE8", "_ZNSt3__16vectorINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEENS4_IS6_EEE26__swap_out_circular_bufferERNS_14__split_bufferIS6_RS7_EE", "sub_17AF14", "sub_17B4F4", "sub_17BF70", "sub_17C514", "sub_17CD74", "sub_17CE08", "sub_17D040", "sub_17D994", "sub_17DB3C", "sub_17DEC0", "sub_17E12C", "sub_17E6B0", "sub_17EA9C", "sub_17F5F8", "sub_17FB5C", "sub_17FC80", "sub_180060", "sub_18006C", "sub_180070", "sub_1800A4", "sub_1800C4", "sub_18019C", "sub_180218", "sub_180290", "sub_180298", "sub_1802A0", "sub_1802A8", "sub_1802B0", "sub_1802B8", "sub_1802C0", "sub_180348", "sub_180384", "sub_1803C8", "sub_180424", "sub_180460", "sub_180650", "sub_1806EC", "sub_18078C", "sub_180824", "sub_1808B8", "sub_180944", "sub_180980", "sub_181438", "sub_1815C0", "sub_181658", "sub_1816B0", "sub_182944", "sub_18298C", "sub_182ABC", "sub_182BF4", "sub_182C98", "sub_182CEC", "sub_182D88", "sub_183094", "sub_1832E4", "sub_1833E4", "sub_1834DC", "sub_183558", "sub_1837E0", "sub_1837FC", "sub_183890", "sub_183988", "sub_183A64", "sub_183BD4", "sub_183BF4", "sub_183C38", "sub_183D90", "sub_183D98", "sub_183F14", "sub_183F4C", "sub_183F9C", "sub_183FD4", "sub_184078", "sub_184400", "sub_184B74", "sub_184E48", "sub_18511C", "sub_185520", "sub_1863F4", "sub_186488", "sub_18658C", "sub_186598", "sub_1865A8", "sub_1865B8", "sub_1865DC", "sub_186600", "sub_186658", "sub_186688", "sub_186774", "sub_1867F8", "sub_186830", "sub_186874", "sub_186898", "sub_1868BC", "sub_186DF4", "sub_186E48", "sub_186E50", "sub_186E7C", "sub_186FDC", "sub_18716C", "sub_187184", "sub_18725C", "sub_18735C", "sub_1874A8", "sub_187858", "sub_187A14", "sub_187AAC", "sub_187DF8", "sub_187FD4", "sub_188144", "sub_1882A8", "sub_18840C", "sub_188570", "sub_1886D4", "sub_1888F0", "sub_188B0C", "sub_188BA4", "sub_188CC0", "sub_188D24", "sub_188F1C", "sub_188F44", "sub_188F84", "sub_188F94", "sub_18912C", "sub_1892E0", "sub_1893C8", "sub_1893D8", "sub_189654", "sub_189658", "sub_18965C", "sub_189660", "sub_1898B0", "sub_189918", "sub_18993C", "sub_189A64", "sub_189B10", "sub_189C18", "sub_189CB0", "sub_189D80", "sub_189E28", "sub_189FA4", "sub_189FA8", "sub_189FDC", "sub_189FFC", "sub_18A020", "sub_18A058", "sub_18A07C", "sub_18A0B4", "sub_18A0D8", "sub_18A110", "sub_18A134", "sub_18A16C", "sub_18A190", "sub_18A1C8", "sub_18A1EC", "sub_18A224", "sub_18A248", "sub_18A280", "sub_18A2A4", "sub_18A2B0", "sub_18A2B8", "sub_18A304", "sub_18A30C", "sub_18A358", "sub_18A35C", "sub_18A390", "sub_18A3B0", "sub_18A480", "sub_18A598", "sub_18A634", "sub_18A6BC", "sub_18A74C", "sub_18A7EC", "sub_18A8CC", "sub_18A9AC", "sub_18AAB0", "sub_18AB7C", "sub_18ABB0", "sub_18AD00", "sub_18AE24", "sub_18AF4C", "sub_18B028", "sub_18B074", "sub_18BAD4", "sub_18BBF8", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendIPcEENS_9enable_ifIXsrNS_21__is_forward_iteratorIT_EE5valueERS5_E4typeESA_SA_", "sub_18C024", "sub_18C620", "sub_18CE34", "sub_18D070", "sub_18D8C4", "sub_18D93C", "sub_18DA00", "interpreter_wrap_int64_t", "interpreter_wrap_float", "interpreter_wrap_double", "sub_18DC28", "sub_18DC4C", "sub_18DCC0", "nullsub_11", "j_j__ZdlPv_5", "sub_18DD94", "sub_18DDA8", "sub_18DDB8", "sub_18E244", "sub_18E8D0", "sub_18F6AC", "sub_18F8B0", "sub_18F8D8", "sub_18FB64", "sub_18FBB0", "sub_18FC9C", "sub_18FE18", "sub_18FEA8", "sub_1926F0", "sub_192C54", "sub_192CD4", "sub_192D54", "sub_192DA0", "sub_192E3C", "sub_192E78", "sub_192F10", "sub_192F4C", "sub_192FE8", "sub_193034", "sub_19307C", "sub_193274", "sub_1932AC", "sub_1932E4", "sub_19331C", "sub_1933FC", "sub_1934CC", "sub_1935BC", "sub_1937AC", "sub_19384C", "sub_193A2C", "sub_193BF4", "sub_193CEC", "sub_193DDC", "sub_194114", "sub_1942D0", "sub_194514", "sub_194758", "sub_194948", "sub_194B30", "sub_194E44", "sub_195008", "sub_1952E8", "sub_1953D8", "sub_1954D0", "sub_19570C", "sub_195CAC", "sub_195E6C", "sub_195FFC", "sub_196010", "nullsub_12", "j_j__ZdlPv_6", "sub_196168", "j_j__ZdlPv_7", "sub_1962BC", "j_j__ZdlPv_8", "sub_196434", "j_j__ZdlPv_9", "sub_19659C", "j_j__ZdlPv_10", "sub_196644", "sub_196B24", "sub_196C9C", "sub_196CC0", "sub_196CE0", "sub_196E58", "sub_196E94", "sub_196F08", "sub_19709C", "nullsub_13", "j_j__ZdlPv_11", "sub_1970C0", "sub_197144", "sub_197424", "sub_197478", "sub_197488", "sub_197498", "sub_1974D4", "sub_1974E4", "sub_1974F4", "sub_19766C", "sub_197898", "sub_197940", "sub_197960", "sub_19796C", "sub_197984", "sub_197994", "sub_197A7C", "sub_197D5C", "sub_197E44", "sub_197F48", "nullsub_14", "sub_197F54", "sub_197F5C", "sub_197FB0", "sub_198070", "sub_1982BC", "sub_1982C8", "sub_1982D0", "sub_1982D8", "sub_198300", "sub_19830C", "sub_1983E8", "sub_198408", "sub_198420", "sub_198708", "sub_198774", "sub_19885C", "sub_198B3C", "sub_198C24", "sub_198D28", "sub_198D30", "nullsub_15", "sub_198D40", "sub_198D48", "sub_198D9C", "sub_198E5C", "sub_19955C", "sub_199568", "sub_199570", "sub_199578", "sub_199688", "sub_199794", "sub_1997B4", "sub_1997C0", "sub_1997D8", "sub_1997E8", "sub_1998D0", "sub_199BB0", "sub_199C98", "sub_199D9C", "nullsub_16", "sub_199DA8", "sub_199DB0", "sub_199E04", "sub_199EC4", "sub_19A110", "sub_19A11C", "sub_19A124", "sub_19A12C", "sub_19A14C", "sub_19A158", "sub_19A170", "sub_19A3E0", "sub_19A44C", "sub_19A534", "sub_19A814", "sub_19A8FC", "sub_19AA00", "nullsub_17", "sub_19AA0C", "sub_19AA14", "sub_19AA68", "sub_19AB0C", "sub_19B568", "sub_19B574", "sub_19B57C", "sub_19B584", "sub_19B640", "sub_19B760", "sub_19B7EC", "sub_19B844", "sub_19B870", "sub_19BC9C", "sub_19C6E0", "sub_19C7AC", "sub_19C920", "sub_19CCD4", "sub_19CD44", "sub_19CD74", "sub_19D238", "sub_19D2CC", "sub_19D360", "sub_19D3E4", "sub_19D56C", "sub_19D750", "sub_19D894", "sub_19DA08", "sub_19DB48", "sub_19DCA4", "sub_19E088", "sub_19E110", "sub_19E508", "sub_19EA48", "sub_19ED64", "sub_19F0A0", "sub_19F358", "sub_19F500", "sub_19F608", "sub_19F67C", "sub_19F68C", "sub_19F6DC", "sub_19F70C", "sub_19F7C4", "sub_19F7EC", "sub_19F984", "sub_19FDD8", "sub_19FF98", "sub_1A0330", "sub_1A0418", "sub_1A0760", "sub_1A0C34", "sub_1A0C88", "sub_1A0E00", "sub_1A0F58", "nullsub_7", "sub_1A1114", "sub_1A11A0", "sub_1A12EC", "sub_1A16A4", "sub_1A171C", "sub_1A181C", "sub_1A1908", "sub_1A19EC", "sub_1A1A70", "sub_1A1AE8", "sub_1A1B64", "nullsub_18", "j_j__ZdlPv_12", "sub_1A1B7C", "sub_1A1C78", "nullsub_19", "j_j__ZdlPv_13", "sub_1A1C90", "sub_1A1D84", "sub_1A1E74", "sub_1A1EF0", "sub_1A2034", "sub_1A2108", "sub_1A2160", "sub_1A2378", "sub_1A2380", "sub_1A23CC", "sub_1A24C4", "sub_1A25E0", "sub_1A2718", "sub_1A2830", "sub_1A2938", "sub_1A2984", "sub_1A2A94", "sub_1A2BA0", "sub_1A2CAC", "sub_1A2DDC", "sub_1A3150", "sub_1A3204", "sub_1A3228", "sub_1A325C", "sub_1A3260", "sub_1A327C", "sub_1A32C0", "sub_1A3434", "sub_1A3438", "sub_1A3450", "sub_1A46B8", "sub_1A62E4", "sub_1A648C", "sub_1A6D4C", "sub_1A6F40", "sub_1A7DE0", "sub_1A7F58", "sub_1A8150", "sub_1A8168", "sub_1A8300", "sub_1A8308", "sub_1A847C", "sub_1A8728", "sub_1A88A4", "sub_1A898C", "sub_1A8AD4", "sub_1A8AEC", "sub_1A8C24", "sub_1A8C84", "sub_1A8E60", "sub_1A8F58", "sub_1A9074", "sub_1A9190", "sub_1A9248", "sub_1A92C0", "sub_1A9484", "sub_1A94A8", "sub_1A94B0", "sub_1A94B8", "sub_1A94EC", "sub_1A9558", "sub_1A9650", "sub_1A9670", "sub_1A96A0", "sub_1A9F9C", "sub_1A9FBC", "sub_1A9FD4", "sub_1AA7C4", "sub_1AA7F4", "sub_1AACFC", "sub_1AADA8", "sub_1AADC8", "sub_1AADD4", "sub_1AAE90", "sub_1AAF48", "sub_1AAF54", "sub_1AAF5C", "sub_1AAFF4", "sub_1AB088", "sub_1AB0FC", "sub_1AB16C", "sub_1AB220", "sub_1AB228", "sub_1AB230", "sub_1AB244", "sub_1AB24C", "sub_1AB2E4", "sub_1AB378", "sub_1AB410", "sub_1AB4A4", "sub_1AB518", "sub_1AB588", "sub_1AB5FC", "sub_1AB66C", "sub_1AB704", "sub_1AB798", "sub_1AB80C", "sub_1AB87C", "sub_1AB8DC", "sub_1AB950", "sub_1AB9C0", "sub_1ABA34", "sub_1ABAA4", "sub_1ABADC", "sub_1ABB10", "sub_1ABB84", "sub_1ABBF4", "sub_1ABC5C", "sub_1ABCC0", "sub_1ABCC4", "sub_1ABCD4", "sub_1ABDB4", "sub_1ABE90", "sub_1ABEB0", "sub_1ABF0C", "sub_1AC0D4", "sub_1AC108", "sub_1AC170", "sub_1AC1F0", "sub_1AC210", "sub_1AE394", "sub_1AE4C4", "sub_1AE4DC", "sub_1AE4E4", "sub_1AE4F8", "sub_1AE528", "sub_1AE540", "sub_1AE5B4", "sub_1AE624", "sub_1AE65C", "sub_1AE690", "sub_1AE6C8", "sub_1AE6FC", "sub_1AE714", "sub_1AE72C", "sub_1AE778", "sub_1AE790", "sub_1AF394", "sub_1AFC80", "sub_1AFE2C", "sub_1AFE4C", "sub_1AFE6C", "sub_1AFE8C", "sub_1AFE90", "sub_1AFF58", "sub_1B0108", "sub_1B0120", "sub_1B01DC", "sub_1B0294", "sub_1B02B4", "sub_1B03AC", "sub_1B04A0", "sub_1B04F0", "sub_1B053C", "sub_1B058C", "sub_1B05D8", "sub_1B06B8", "sub_1B0794", "sub_1B0868", "sub_1B0938", "sub_1B0944", "sub_1B095C", "sub_1B0974", "sub_1B098C", "sub_1B0B58", "sub_1B0FE4", "sub_1B1010", "sub_1B18F0", "sub_1B19BC", "sub_1B1CE8", "sub_1B26B4", "sub_1B26D4", "sub_1B26F4", "sub_1B27C8", "sub_1B2898", "sub_1B2918", "sub_1B2994", "sub_1B29A8", "sub_1B29B8", "sub_1B29D0", "sub_1B29F0", "sub_1B2A64", "sub_1B2AD4", "sub_1B2D70", "sub_1B2D90", "sub_1B2D98", "sub_1B2DA8", "sub_1B2DC8", "sub_1B2DE0", "sub_1B2E04", "sub_1B2E78", "sub_1B2F20", "sub_1B2F58", "sub_1B2F8C", "sub_1B3070", "sub_1B3080", "sub_1B309C", "sub_1B311C", "sub_1B3198", "sub_1B3218", "sub_1B3294", "sub_1B32F0", "sub_1B3348", "sub_1B3368", "sub_1B3384", "sub_1B3440", "sub_1B34F8", "sub_1B3524", "sub_1B354C", "sub_1B36F4", "sub_1B3714", "sub_1B3758", "sub_1B3798", "sub_1B37DC", "sub_1B381C", "sub_1B38E8", "sub_1B3960", "sub_1B3B00", "sub_1B3F0C", "sub_1B3F74", "sub_1B4040", "sub_1B4100", "sub_1B41DC", "sub_1B53A8", "sub_1B5500", "sub_1B56F8", "sub_1B578C", "sub_1B586C", "sub_1B5B50", "sub_1B5D04", "sub_1B5DE4", "sub_1B5E54", "sub_1B5EC4", "sub_1B6080", "sub_1B60E8", "sub_1B6180", "sub_1B6270", "sub_1B6448", "sub_1B6470", "sub_1B6498", "sub_1B64C0", "sub_1B6528", "sub_1B6540", "sub_1B6578", "sub_1B6678", "sub_1B6680", "sub_1B6694", "sub_1B6698", "sub_1B66A8", "sub_1B66D0", "sub_1B670C", "_ZNSt3__111__call_onceERVmPvPFvS2_E", "sub_1B6800", "sub_1B6810", "j_j__ZdlPv_2", "sub_1B6818", "sub_1B682C", "sub_1B6874", "sub_1B6898", "sub_1B68A4", "_ZNSt3__116generic_categoryEv", "sub_1B69CC", "sub_1B69D8", "sub_1B6AA8", "_ZNSt3__115system_categoryEv", "sub_1B6BAC", "sub_1B6BC4", "sub_1B6C94", "sub_1B6CB0", "sub_1B6DAC", "j_j__ZNSt15underflow_errorD2Ev", "sub_1B6DE4", "_ZNSt3__120__throw_system_errorEiPKc", "sub_1B6E94", "nullsub_1", "j_j__ZdlPv", "j_j__ZdlPv_0", "sub_1B6EB4", "sub_1B6F00", "__cxa_allocate_exception", "sub_1B6F5C", "sub_1B7068", "__cxa_free_exception", "sub_1B7084", "__cxa_free_dependent_exception_0", "sub_1B71B4", "__cxa_allocate_dependent_exception", "__cxa_free_dependent_exception", "__cxa_throw", "sub_1B7340", "__cxa_get_exception_ptr", "__cxa_begin_catch", "__cxa_end_catch", "sub_1B74C4", "__cxa_decrement_exception_refcount", "sub_1B7510", "__cxa_current_exception_type", "__cxa_rethrow", "__cxa_increment_exception_refcount", "__cxa_current_primary_exception", "sub_1B770C", "__cxa_rethrow_primary_exception", "sub_1B782C", "sub_1B7890", "__cxa_uncaught_exception", "sub_1B78C8", "__cxa_get_globals", "__cxa_get_globals_fast", "sub_1B79A0", "sub_1B79D4", "sub_1B7A08", "sub_1B7ABC", "sub_1B7B38", "_ZSt14get_unexpectedv", "sub_1B7BC4", "_ZSt10unexpectedv", "_ZSt13get_terminatev", "sub_1B7C14", "sub_1B7C30", "sub_1B7C40", "sub_1B7C50", "_ZSt9terminatev", "_ZSt15set_new_handlerPFvvE", "_ZSt15get_new_handlerv", "_Znwm", "_ZnwmRKSt9nothrow_t", "sub_1B7D64", "sub_1B7D74", "_Znam", "_ZnamRKSt9nothrow_t", "sub_1B7D90", "sub_1B7DA0", "_ZdlPv", "_ZdlPvRKSt9nothrow_t", "_ZdaPv", "_ZdaPvRKSt9nothrow_t", "_ZNSt9bad_allocC2Ev", "_ZNSt9bad_allocD2Ev", "_ZNSt9bad_allocD0Ev", "_ZNKSt9bad_alloc4whatEv", "_ZNSt20bad_array_new_lengthC2Ev", "_ZNSt20bad_array_new_lengthD0Ev", "_ZNKSt20bad_array_new_length4whatEv", "sub_1B7E48", "sub_1B86CC", "sub_1B86F8", "sub_1B8A68", "sub_1B8AE4", "sub_1B8C38", "_ZNSt9exceptionD2Ev", "_ZNSt9exceptionD0Ev", "_ZNKSt9exception4whatEv", "_ZNSt13bad_exceptionD0Ev", "_ZNKSt13bad_exception4whatEv", "j_j__ZNSt9type_infoD2Ev", "sub_1B8C74", "nullsub_2", "nullsub_3", "sub_1B8CA0", "sub_1B8CC4", "sub_1B8CE8", "sub_1B8D0C", "sub_1B8D30", "sub_1B8D54", "sub_1B8D78", "sub_1B8D9C", "sub_1B8DC0", "sub_1B8DE4", "sub_1B8E08", "sub_1B8E14", "sub_1B8E1C", "sub_1B8E24", "sub_1B8E30", "sub_1B8EF4", "sub_1B8F5C", "sub_1B8FD4", "sub_1B9120", "sub_1B9140", "__dynamic_cast", "sub_1B9410", "sub_1B975C", "sub_1B989C", "sub_1B9940", "sub_1B9B30", "sub_1B9BE4", "_ZNSt16invalid_argumentD2Ev", "_ZNSt11logic_errorD0Ev", "_ZNKSt11logic_error4whatEv", "_ZNSt15underflow_errorD2Ev", "_ZNSt13runtime_errorD0Ev", "_ZNKSt13runtime_error4whatEv", "_ZNSt12domain_errorD0Ev", "_ZNSt16invalid_argumentD0Ev", "_ZNSt12length_errorD0Ev", "_ZNSt12out_of_rangeD0Ev", "_ZNSt11range_errorD0Ev", "_ZNSt14overflow_errorD0Ev", "_ZNSt15underflow_errorD0Ev", "_ZNSt9type_infoD2Ev", "_ZNSt9type_infoD0Ev", "_ZNSt8bad_castC2Ev", "_ZNSt8bad_castD2Ev", "_ZNSt8bad_castD0Ev", "_ZNKSt8bad_cast4whatEv", "_ZNSt10bad_typeidC2Ev", "_ZNSt10bad_typeidD2Ev", "_ZNSt10bad_typeidD0Ev", "_ZNKSt10bad_typeid4whatEv", "sub_1BA110", "sub_1BA124", "sub_1BA128", "sub_1BA13C", "_ZNSt3__125notify_all_at_thread_exitERNS_18condition_variableENS_11unique_lockINS_5mutexEEE", "_ZNSt11logic_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE", "sub_1BA1F8", "_ZNSt11logic_errorC2EPKc", "sub_1BA278", "_ZNSt11logic_errorC2ERKS_", "_ZNSt11logic_erroraSERKS_", "_ZNSt13runtime_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE", "sub_1BA398", "_ZNSt13runtime_errorC2EPKc", "sub_1BA418", "_ZNSt13runtime_errorC2ERKS_", "_ZNSt13runtime_erroraSERKS_", "_ZNSt3__111this_thread9sleep_forERKNS_6chrono8durationIxNS_5ratioILl1ELl1000000000EEEEE", "_ZNSt3__119__thread_local_dataEv", "sub_1BA5A8", "sub_1BA5BC", "sub_1BA628", "sub_1BA63C", "sub_1BA654", "sub_1BA658", "sub_1BA730", "sub_1BA7A0", "sub_1BA7FC", "sub_1BA848", "sub_1BA85C", "sub_1BA944", "sub_1BA98C", "sub_1BAA1C", "sub_1BAB44", "_ZSt14set_unexpectedPFvvE", "_ZSt13set_terminatePFvvE", "__cxa_demangle", "sub_1BAF90", "sub_1BB014", "sub_1BB3C4", "sub_1BB40C", "sub_1BB4E0", "sub_1BB614", "sub_1BB6C8", "sub_1BC5AC", "sub_1BC614", "sub_1BC628", "sub_1BC634", "sub_1BC650", "sub_1BC6B0", "sub_1C4580", "sub_1C4624", "sub_1C9634", "sub_1C97D8", "sub_1C97DC", "sub_1C9800", "sub_1CA790", "sub_1CA794", "sub_1CA7B4", "sub_1CB65C", "sub_1CB660", "sub_1CB670", "sub_1CBDE8", "sub_1CBDEC", "sub_1CBDF0", "sub_1CC090", "sub_1CC178", "sub_1CC17C", "sub_1CC198", "sub_1CE3A8", "sub_1CE3AC", "sub_1CE3BC", "sub_1CE3CC", "sub_1CE3DC", "sub_1CE3F4", "sub_1CE410", "sub_1CE434", "sub_1CFDA4", "sub_1CFF68", "sub_1CFF9C", "sub_1D5A90", "sub_1D5A94", "sub_1D5AA4", "sub_1D5AE0", "sub_1D5C08", "sub_1D5CE8", "sub_1D5CEC", "sub_1D5D08", "sub_1D7744", "sub_1D77F8", "sub_1D8228", "sub_1D822C", "sub_1D8240", "sub_1D874C", "sub_1D880C", "sub_1D8AD0", "sub_1D8B18", "sub_1D9650", "sub_1D96A8", "sub_1D96B8", "sub_1D96C8", "sub_1D96F0", "sub_1D9718", "sub_1D9740", "sub_1D9A7C", "sub_1D9AA4", "sub_1DA2E4", "sub_1DA2E8", "sub_1DA2F4", "sub_1DA458", "sub_1DA470", "sub_1DB90C", "sub_1DB910", "sub_1DB930", "sub_1E36E4", "sub_1E384C", "sub_1E394C", "sub_1E3FE4", "sub_1E4094", "sub_1E4788", "sub_1E478C", "sub_1E47A4", "sub_1E487C", "sub_1E49C4", "sub_1E4AC0", "sub_1E4AE8", "sub_1E4C10", "sub_1E4DB0", "sub_1E4EB4", "sub_1E4EC0", "_ZNSt3__115future_categoryEv", "_ZNSt3__112future_errorC2ENS_10error_codeE", "sub_1E50F8", "_ZNSt3__112future_errorD2Ev", "_ZNSt3__112future_errorD0Ev", "sub_1E513C", "sub_1E5150", "sub_1E5190", "sub_1E5230", "sub_1E5244", "sub_1E5290", "sub_1E52E4", "_ZNSt3__112bad_weak_ptrD2Ev", "_ZNSt3__112bad_weak_ptrD0Ev", "_ZNKSt3__112bad_weak_ptr4whatEv", "nullsub_6", "j_j__ZdlPv_1", "sub_1E5344", "j_j__ZdlPv_3", "sub_1E538C", "_ZNSt3__112__get_sp_mutEPKv", "_ZNSt3__117declare_reachableEPv", "_ZNSt3__119declare_no_pointersEPcm", "_ZNSt3__121undeclare_no_pointersEPcm", "_ZNSt3__118get_pointer_safetyEv", "_ZNSt3__121__undeclare_reachableEPv", "_ZNSt3__15alignEmmRPvRm", "_ZSt18uncaught_exceptionv", "sub_1E5520", "_ZNSt16nested_exceptionC2Ev", "_ZSt17current_exceptionv", "_ZNSt16nested_exceptionD2Ev", "_ZNSt16nested_exceptionD0Ev", "_ZNKSt16nested_exception14rethrow_nestedEv", "sub_1E5614", "_ZSt17rethrow_exceptionSt13exception_ptr", "sub_1E563C", "sub_1E567C", "sub_1E84B0", "sub_1E90D0", "sub_1E926C", "sub_1E9384", "sub_1E99EC", "sub_1E9A00", "j_j__ZdlPv_14", "nullsub_20", "sub_1E9CD0", "sub_1E9D20", "sub_1E9D50", "sub_1E9D58", "sub_1E9DBC", "sub_1E9DE8", "sub_1E9E28", "sub_1EA074", "sub_1EA110", "sub_1EA73C", "sub_1EA750", "j_j__ZdlPv_15", "sub_1EA7A4", "sub_1EA830", "sub_1EA8D4", "sub_1EAAF8", "DobbyHook", "sub_1EAD78", "sub_1EAE04", "sub_1EAE90", "sub_1EAEC0", "sub_1EAEFC", "sub_1EAF34", "log_set_level", "log_switch_to_syslog", "log_switch_to_file", "log_internal_impl", "nullsub_4", "sub_1EB1C8", "sub_1EB254", "sub_1EB2BC", "sub_1EB310", "sub_1EB31C", "sub_1EB350", "sub_1EB364", "sub_1EB3A8", "sub_1EB3E8", "sub_1EB3F4", "sub_1EB460", "sub_1EB468", "sub_1EB470", "sub_1EB4FC", "sub_1EB508", "sub_1EB514", "sub_1EB54C", "sub_1EB584", "sub_1EB5AC", "sub_1EBBC0", "sub_1EBCFC", "sub_1EBDB0", "sub_1EBEE0", "sub_1EBEE4", "sub_1EBEF4", "sub_1EBEFC", "sub_1EBF04", "sub_1EBF0C", "sub_1EBF20", "sub_1EC02C", "CodePatch", "sub_1EC23C", "sub_1EC248", "sub_1EC268", "sub_1EC274", "sub_1EC298", "sub_1EC2A8", "sub_1EC2B0", "sub_1EC2B8", "sub_1EC2C0", "sub_1EC38C", "sub_1EC3B8", "sub_1EC660", "sub_1EC668", "sub_1EC670", "sub_1EC678", "j_free", "nullsub_21", "sub_1EC688", "sub_1EC69C", "sub_1EC6E0", "sub_1EC730", "sub_1EC754", "sub_1EC790", "sub_1EC814", "sub_1EC838", "sub_1EC844", "sub_1EC850", "sub_1EC8AC", "sub_1EC908", "sub_1ECA3C", "sub_1ECA44", "sub_1ECA4C", "sub_1ECA60", "sub_1ECAE8", "sub_1ECB24", "sub_1ECCD8", "sub_1ED2E4", "sub_1ED2F4", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcmm", "sub_1ED544", "sub_1ED764", "sub_1ED92C", "sub_1EDDC0", "sub_1EE384", "sub_1EE78C", "sub_1EF318", "sub_1EF574", "sub_1EF628", "sub_1EF814", "sub_1EF8BC", "sub_1EFAC8", "sub_1EFCC0", "sub_1F059C", "sub_1F09F8", "sub_1F0A00", "sub_1F0DB4", "sub_1F13FC", "sub_1F1404", "sub_1F1734", "sub_1F1954", "nullsub_23", "j_j__ZdlPv_24", "sub_1F20A0", "sub_1F2274", "sub_1F228C", "sub_1F22B0", "sub_1F22EC", "sub_1F2330", "sub_1F2764", "sub_1F2788", "sub_1F27C4", "sub_1F2B10", "sub_1F2B7C", "sub_1F2C7C", "sub_1F2DDC", "sub_1F32C8", "sub_1F36CC", "j_j__ZdlPv_16", "j_j__ZdlPv_17", "j_j__ZdlPv_18", "j_j__ZdlPv_19", "j_j__ZdlPv_20", "j_j__ZdlPv_21", "j_j__ZdlPv_22", "j_j__ZdlPv_23", "sub_1F36F4", "sub_1F4360", "nullsub_24", "nullsub_25", "nullsub_26", "nullsub_27", "nullsub_28", "nullsub_29", "nullsub_30", "nullsub_31", "sub_1F4528", "sub_1F48E0", "sub_1F4D94", "sub_1F4F68", "sub_1F513C", "sub_1F58C8", "sub_1F8584", "sub_1F8F4C", "sub_1F90F4", "sub_1F92C8", "sub_1FBF60", "sub_1FC37C", "sub_1FC550", "sub_1FEFD8", "sub_1FF0F4", "sub_1FF424", "sub_1FF8E8", "sub_1FFBA0", "sub_1FFC10", "sub_1FFCBC", "sub_1FFCC0", "sub_1FFCF4", "sub_1FFD14", "sub_1FFE18", "sub_1FFEC0", "sub_1FFEC4", "sub_1FFEF8", "sub_1FFF18", "sub_1FFFE8", "sub_2001A0", "sub_200394", "sub_200650", "sub_2006C4", "sub_200738", "sub_200960", "sub_200AC0", "sub_200D54", "sub_200D90", "sub_200F90", "sub_2010B4", "sub_201238", "sub_201440", "sub_201B20", "sub_201B28", "sub_201C24", "sub_201D9C", "sub_20245C", "sub_202554", "sub_2025F0", "sub_202718", "sub_202C98", "sub_203038", "sub_2038C0", "sub_203ED0", "sub_204678", "sub_204BC4", "sub_204CC0", "sub_204DD4", "sub_204F7C", "sub_20510C", "sub_205AD8", "sub_20691C", "sub_2069DC", "sub_206CE8", "sub_206D94", "sub_2071C0", "sub_2071EC", "sub_2075AC", "sub_2075C8", "sub_2076B8", "sub_207908", "nullsub_22", "sub_207960", "sub_207964", "sub_207A08", "sub_207A78", "sub_207AF0", "sub_207B54", "sub_208050", "sub_208068", "sub_2080CC", "sub_208198", "sub_2082A0", "sub_208310", "sub_208370", "sub_2083D8", "sub_2084C4", "sub_208558", "sub_2087A8", "sub_20895C", "sub_208A70", "sub_208BC8", "sub_208D14", "sub_208D84", "sub_208EE8", "sub_209010", "sub_2090B4", "sub_20916C", "sub_2091DC", "sub_20924C", "sub_20940C", "sub_209674", "sub_209CBC", "sub_209D88", "sub_20A5D0", "sub_20A7D0", "sub_20A86C", "sub_20AD24", "sub_20AD60", "sub_20AE04", "sub_20AF0C", "sub_20B4E0", "sub_20B4F4", "sub_20B570", "sub_20B8F4", "sub_20B900", "sub_20B904", "sub_20B938", "sub_20B958", "sub_20B98C", "sub_20BA5C", "sub_20BB74", "_ZNSt3__16vectorIiNS_9allocatorIiEEE21__push_back_slow_pathIiEEvOT_", "_ZNSt3__16vectorIiNS_9allocatorIiEEE21__push_back_slow_pathIRKiEEvOT_", "sub_20BF2C", "sub_20C0DC", "sub_20C3B8", "sub_20D070", "sub_20D0EC", "sub_20D138", "sub_20D2D0", "sub_20D36C", "sub_20D4B8", "sub_20DEF4", "sub_20E010", "sub_20E0CC", "sub_20E21C", "sub_20E35C", "sub_20E4D8", "sub_20E7C0", "sub_20E824", "sub_20E91C", "sub_20EAA4", "sub_20EC48", "sub_20ECBC", "sub_20ED30", "sub_20F5AC", "sub_20F768", "sub_20FA70", "sub_210574", "sub_2108C8", "sub_210AC0", "sub_212EE8", "sub_2133B8", "sub_2142AC", "sub_21587C", "sub_215A24", "sub_215BD8", "sub_216198", "sub_2161A4", "sub_2161AC", "sub_2161F0", "sub_216230", "sub_216274", "sub_2162B4", "sub_2162D4", "sub_2163AC", "sub_216504", "sub_217188", "sub_217444", "sub_217510", "sub_2175E0", "sub_217600", "j_j___read_self", "__read_self", "__self_kill", "__self_prctl", "__self_lseek", "sub_217698", "sub_2178BC", "sub_217ADC", "sub_217B20", "sub_217C3C", "sub_217DB8", "sub_217FFC", "sub_218CB0", "sub_218F34", "sub_2191F0", "sub_219294", "sub_219350", "sub_21944C", "sub_2195D0", "sub_2196C4", "sub_219720", "sub_219728", "sub_21972C", "sub_219910", "sub_219A58", "sub_219BEC", "sub_219C14", "sub_219C54", "sub_219D44", "sub_219E58", "_Unwind_GetGR", "sub_219EEC", "_Unwind_GetCFA", "_Unwind_SetGR", "_Unwind_GetIP", "_Unwind_GetIPInfo", "_Unwind_SetIP", "_Unwind_GetLanguageSpecificData", "_Unwind_GetRegionStart", "_Unwind_FindEnclosingFunction", "_Unwind_GetDataRelBase", "_Unwind_GetTextRelBase", "sub_21A0C4", "sub_21A13C", "sub_21A634", "sub_21AA50", "sub_21AFE8", "sub_21B20C", "sub_21B2D8", "sub_21B324", "sub_21B3E4", "__frame_state_for", "nullsub_5", "_Unwind_RaiseException", "_Unwind_ForcedUnwind", "_Unwind_Resume", "_Unwind_Resume_or_Rethrow", "_Unwind_DeleteException", "_Unwind_Backtrace", "sub_21BB30", "sub_21BB58", "sub_21BB98", "sub_21BBB4", "sub_21BC74", "sub_21BD28", "sub_21BD88", "sub_21BDE8", "sub_21BE48", "sub_21BF38", "sub_21BFC8", "sub_21C0C4", "sub_21C224", "sub_21C234", "sub_21C648", "sub_21C6E4", "sub_21C844", "sub_21C978", "__register_frame_info_bases", "__register_frame_info", "__register_frame", "__register_frame_info_table_bases", "__register_frame_info_table", "__register_frame_table", "__deregister_frame_info_bases", "__deregister_frame_info", "__deregister_frame", "_Unwind_Find_FDE", "__imp_opendir", "__imp_execve", "__imp_fdopen", "__imp_memcmp", "__imp_listen", "__imp_ioctl", "__imp___errno", "__imp_flock", "__imp_remove", "__imp_deflateEnd", "__imp_abort", "__imp_realloc", "__imp_connect", "__imp_write", "__imp_dup2", "__imp_pthread_self", "__imp__exit", "__imp_srandom", "__imp_sscanf", "__imp_fsync", "__imp_gettimeofday", "__imp_srand", "__imp_getpagesize", "__imp_inflate", "__imp_pipe", "__imp_pthread_cond_broadcast", "__imp_epoll_create", "__imp_access", "__imp_snprintf", "__imp_signal", "__imp_lseek", "__imp_getpid", "__imp_readdir", "__imp_creat", "__imp_time", "__imp_inflateInit2_", "__imp_memset", "__imp_unlink", "__imp_strlcpy", "__imp_dladdr", "__imp_fmodf", "__imp_malloc", "__imp_getcwd", "__imp_fork", "__imp_fmod", "__imp_random", "__imp_dlopen", "__imp_memmove", "__imp_gethostbyname", "__imp_strcat", "__imp_pthread_join", "__imp_rand", "__imp_fflush", "__imp_strncmp", "__imp_pthread_exit", "__imp_recv", "__imp_isxdigit", "__imp_strcpy", "__imp_strrchr", "__imp_fstat", "__imp___cxa_atexit", "__imp_pthread_key_delete", "__imp_lstat", "__imp_closedir", "__imp_pthread_create", "__imp_fclose", "__imp_setenv", "__imp_strdup", "__imp_inet_addr", "__imp_sleep", "__imp_open", "__imp_pow", "__imp_strlcat", "__imp_strstr", "__imp___assert2", "__imp_epoll_wait", "__imp_vfprintf", "__imp_kill", "__imp_deflateInit_", "__imp_munmap", "__imp_pthread_cond_wait", "__imp_pthread_setspecific", "__imp_deflate", "__imp_strchr", "__imp_chmod", "__imp_pthread_mutex_destroy", "__imp_gettid", "__imp_bind", "__imp_getppid", "__imp_adler32", "__imp_popen", "__imp_pthread_cond_destroy", "__imp_fnmatch", "__imp_dl_iterate_phdr", "__imp_waitpid", "__imp_fwrite", "__imp_llabs", "__imp_deflateBound", "__imp_readlink", "__imp_strncpy", "__imp___cxa_finalize", "__imp_exit", "__imp_raise", "__imp_dlclose", "__imp_vprintf", "__imp_send", "__imp_atoll", "__imp_fgets", "__imp_lseek64", "__imp_inflateEnd", "__imp_pthread_mutex_init", "__imp___android_log_vprint", "__imp_strtoul", "__imp_socket", "__imp_close", "__imp_epoll_ctl", "__imp_sysconf", "__imp_calloc", "__imp_execl", "__imp_getsockopt", "__imp_read", "__imp_fputc", "__imp_prctl", "__imp_strtoull", "__imp_setsockopt", "__imp_mkdir", "__imp_pthread_mutex_unlock", "__imp_fcntl", "__imp_vsnprintf", "__imp_setpgid", "__imp_ftruncate", "__imp_pthread_mutex_lock", "__imp_tolower", "__imp_nanosleep", "__imp_syscall", "__imp_mprotect", "__imp_isupper", "__imp_free", "__imp_toupper", "__imp_dlsym", "__imp_pclose", "__imp_atoi", "__imp_stat", "__imp_accept", "__imp_memchr", "__imp_vsyslog", "__imp_inet_ntoa", "__imp_strerror", "__imp_fopen", "__imp_isspace", "__imp_pthread_detach", "__imp_strtok", "__imp_pwrite", "__imp_fileno", "__imp_atol", "__imp_pthread_getspecific", "__imp_sprintf", "__imp_getenv", "__imp_pread", "__imp_memcpy", "__imp_pthread_once", "__imp_strlen", "__imp_pthread_key_create", "__imp_strtol", "__imp___stack_chk_fail", "__imp_mmap", "__imp_ptrace", "__imp_strcasecmp", "__imp_getuid"];

var func_addr_KEKE = [0x2940, 0x2960, 0x2970, 0x2980, 0x2990, 0x29a0, 0x29b0, 0x29c0, 0x29d0, 0x29e0, 0x29f0, 0x2a00, 0x2a10, 0x2a20, 0x2a30, 0x2a40, 0x2a50, 0x2a60, 0x2a70, 0x2a80, 0x2a90, 0x2aa0, 0x2ab0, 0x2ac0, 0x2ad0, 0x2ae0, 0x2af0, 0x2b00, 0x2b10, 0x2b20, 0x2b30, 0x2b40, 0x2b50, 0x2b60, 0x2b70, 0x2b80, 0x2b90, 0x2ba0, 0x2bb0, 0x2bc0, 0x2bd0, 0x2be0, 0x2bf0, 0x2c00, 0x2c10, 0x2c20, 0x2c30, 0x2c40, 0x2c50, 0x2c60, 0x2c70, 0x2c80, 0x2c90, 0x2ca0, 0x2cb0, 0x2cc0, 0x2cd0, 0x2ce0, 0x2cf0, 0x2d00, 0x2d10, 0x2d20, 0x2d30, 0x2d40, 0x2d50, 0x2d60, 0x2d70, 0x2d80, 0x2d90, 0x2da0, 0x2db0, 0x2dc0, 0x2dd0, 0x2de0, 0x2df0, 0x2e00, 0x2e10, 0x2e20, 0x2e2c, 0x2ed0, 0x2ee8, 0x2eec, 0x2f0c, 0x2f1c, 0x2f40, 0x2f54, 0x2f68, 0x2f6c, 0x2f8c, 0x2f98, 0x2fbc, 0x2fd0, 0x2fdc, 0x2fe4, 0x3034, 0x303c, 0x3060, 0x3080, 0x3090, 0x30a4, 0x30a8, 0x30ac, 0x30b0, 0x30e0, 0x30e4, 0x3190, 0x31ac, 0x31d0, 0x31ec, 0x3224, 0x3240, 0x3300, 0x3574, 0x35ac, 0x3604, 0x36c4, 0x36f8, 0x3768, 0x379c, 0x39dc, 0x3b1c, 0x3b58, 0x3bf4, 0x3c94, 0x4000, 0x41b4, 0x4918, 0x49f0, 0x4b54, 0x4c70, 0x4cd4, 0x4e84, 0x509c, 0x52bc, 0x5344, 0x5378, 0x53bc, 0x5400, 0x5444, 0x5478, 0x5650, 0x580c, 0x59bc, 0x5b08, 0x5df0, 0x5e6c, 0x5f20, 0x6044, 0x60e0, 0x6128, 0x6174, 0x61a8, 0x6208, 0x6268, 0x62a0, 0x633c, 0x6398, 0x63f8, 0x6424, 0x6430, 0x6484, 0x6544, 0x6590, 0x6698, 0x66e8, 0x67e0, 0x6814, 0x684c, 0x6884, 0x68c4, 0x68f8, 0x6930, 0x6968, 0x69d0, 0x6a04, 0x6a3c, 0x6a74, 0x6adc, 0x6b78, 0x6c14, 0x6c70, 0x6cd0, 0x6d08, 0x6d5c, 0x6dbc, 0x6ec0, 0x72d4, 0x7348, 0x73b4, 0x7470, 0x74bc, 0x75c8, 0x7724, 0x788c, 0x78c4, 0x78fc, 0x7b04, 0x7b4c, 0x7f44, 0x7fa0, 0x8000, 0x8130, 0x8224, 0x825c, 0x8430, 0x8ab0, 0x8afc, 0x8b50, 0x8c74, 0x8ed4, 0x900c, 0x9218, 0x92b0, 0x94bc, 0x96ac, 0x96e0, 0x9844, 0x98a0, 0x9900, 0x9940, 0x9944, 0x9964, 0x9988, 0x999c, 0x99cc, 0x99f4, 0x9a24, 0x9a4c, 0x9a50, 0x9a54, 0x9a58, 0x9a5c, 0x9a60, 0x9a64, 0x9a68, 0x9a6c, 0x9a70, 0x9a90, 0x9ac4, 0x9ba4, 0x9bd0, 0x9c20, 0x9c64, 0x9cc0, 0x9d04, 0x9d60, 0x9dd8, 0x9e58, 0x9ffc, 0xa070, 0xa3ec, 0xa52c, 0xb970, 0xc918, 0xe3e0, 0x10964, 0x11220, 0x13908, 0x154dc, 0x1561c, 0x1573c, 0x1585c, 0x15938, 0x159d4, 0x15a70, 0x162f8, 0x163dc, 0x1647c, 0x16598, 0x16654, 0x166c4, 0x1674c, 0x167bc, 0x16b08, 0x16bd8, 0x16e64, 0x16ef8, 0x1745c, 0x17664, 0x17680, 0x176a4, 0x176ac, 0x17748, 0x177d4, 0x177d8, 0x17854, 0x274000, 0x274008, 0x274010, 0x274018, 0x274020, 0x274028, 0x274030, 0x274038, 0x274040, 0x274048, 0x274050, 0x274058, 0x274060, 0x274068, 0x274070, 0x274078, 0x274080, 0x274088, 0x274090, 0x274098, 0x2740a0, 0x2740a8, 0x2740b0, 0x2740b8, 0x2740c0, 0x2740c8, 0x2740d0, 0x2740d8, 0x2740e0, 0x2740e8, 0x2740f0, 0x2740f8, 0x274100, 0x274108, 0x274110, 0x274118, 0x274120, 0x274128, 0x274130, 0x274138, 0x274140, 0x274148, 0x274150, 0x274158, 0x274160, 0x274168, 0x274170, 0x274178, 0x274180, 0x274188, 0x274190, 0x274198, 0x2741a0, 0x2741a8, 0x2741b0, 0x2741b8, 0x2741c0, 0x2741c8, 0x2741d0, 0x2741d8, 0x2741e0, 0x2741e8, 0x2741f0, 0x2741f8, 0x274200, 0x274208, 0x274210];
var func_name_KEKE = ["sub_2940", "strcpy", "uncompress", "fmodf", "j_ffi_call_SYSV", "pthread_create", "strerror", "snprintf", "syscall", "munmap", "__stack_chk_guard", "__errno", "getenv", "_Znwm", "getpid", "fgets", "prctl", "j_interpreter_wrap_int64_t", "j_ffi_prep_cif", "memcpy", "puts", "__cxa_finalize", "feof", "malloc", "j_ffi_prep_cif_var", "vsnprintf", "select", "readdir", "isspace", "inotify_init", "dladdr", "lseek", "_ZdlPv", "j___clear_cache", "mmap", "pthread_detach", "abort", "__stack_chk_fail", "strtol", "calloc", "kill", "j___aarch64_sync_cache_range", "dl_iterate_phdr", "fmod", "strstr", "__cxa_pure_virtual", "j_ffi_prep_closure_loc", "read", "strncmp", "dlopen", "strncpy", "j_ffi_prep_cif_machdep", "setenv", "strtok", "sscanf", "isalpha", "sigaction", "dlsym", "strdup", "j_ffi_call", "fopen", "memset", "_ZdaPv", "fclose", "time", "opendir", "strcmp", "inotify_add_watch", "_Znam", "atoi", "strlen", "j__Z10__arm_a_20v", "open", "mprotect", "closedir", "close", "raise", "start", "sub_2E2C", "sub_2ED0", "sub_2EE8", "sub_2EEC", "sub_2F0C", "sub_2F1C", "sub_2F40", "sub_2F54", "sub_2F68", "sub_2F6C", "sub_2F8C", "sub_2F98", "sub_2FBC", "sub_2FD0", "sub_2FDC", "sub_2FE4", "sub_3034", "sub_303C", "sub_3060", "sub_3080", "sub_3090", "sub_30A4", "sub_30A8", "sub_30AC", "sub_30B0", "j_abort", "sub_30E4", "sub_3190", "sub_31AC", "sub_31D0", "sub_31EC", "sub_3224", "sub_3240", "sub_3300", "sub_3574", "sub_35AC", "sub_3604", "sub_36C4", "sub_36F8", "sub_3768", "sub_379C", "sub_39DC", "sub_3B1C", "sub_3B58", "sub_3BF4", "Link", "sub_4000", "sub_41B4", "sub_4918", "sub_49F0", "sub_4B54", "sub_4C70", "sub_4CD4", "sub_4E84", "sub_509C", "sub_52BC", "sub_5344", "sub_5378", "sub_53BC", "sub_5400", "sub_5444", "sub_5478", "sub_5650", "sub_580C", "sub_59BC", "sub_5B08", "sub_5DF0", "sub_5E6C", "sub_5F20", "sub_6044", "sub_60E0", "sub_6128", "sub_6174", "sub_61A8", "sub_6208", "sub_6268", "sub_62A0", "sub_633C", "sub_6398", "sub_63F8", "sub_6424", "_ZN9__arm_c_19__arm_c_0Ev", "sub_6484", "sub_6544", "sub_6590", "sub_6698", "sub_66E8", "sub_67E0", "sub_6814", "sub_684C", "sub_6884", "sub_68C4", "sub_68F8", "sub_6930", "sub_6968", "sub_69D0", "sub_6A04", "sub_6A3C", "sub_6A74", "sub_6ADC", "sub_6B78", "sub_6C14", "sub_6C70", "sub_6CD0", "_ZN10DynCryptor9__arm_c_0Ev", "sub_6D5C", "sub_6DBC", "sub_6EC0", "sub_72D4", "sub_7348", "_Z10__arm_a_21v", "_Z10__arm_a_20v", "sub_74BC", "sub_75C8", "sub_7724", "sub_788C", "sub_78C4", "sub_78FC", "sub_7B04", "sub_7B4C", "sub_7F44", "_Z9__arm_a_2PcmS_Rii", "sub_8000", "sub_8130", "sub_8224", "sub_825C", "sub_8430", "sub_8AB0", "JNI_OnLoad", "sub_8B50", "sub_8C74", "sub_8ED4", "sub_900C", "sub_9218", "sub_92B0", "sub_94BC", "sub_96AC", "sub_96E0", "_Z9__arm_a_1P7_JavaVMP7_JNIEnvPvRi", "sub_98A0", "sub_9900", "nullsub_2", "sub_9944", "sub_9964", "sub_9988", "sub_999C", "sub_99CC", "sub_99F4", "sub_9A24", "nullsub_3", "nullsub_4", "nullsub_5", "nullsub_6", "j_lseek", "j_lseek_0", "j_lseek_1", "j_lseek_2", "j_lseek_3", "sub_9A70", "sub_9A90", "sub_9AC4", "sub_9BA4", "sub_9BD0", "sub_9C20", "sub_9C64", "sub_9CC0", "sub_9D04", "sub_9D60", "sub_9DD8", "sub_9E58", "sub_9FFC", "sub_A070", "sub_A3EC", "sub_A52C", "sub_B970", "sub_C918", "sub_E3E0", "sub_10964", "sub_11220", "sub_13908", "interpreter_wrap_int64_t", "interpreter_wrap_float", "interpreter_wrap_double", "interpreter_wrap_int64_t_bridge", "interpreter_wrap_float_bridge", "interpreter_wrap_double_bridge", "sub_15A70", "sub_162F8", "sub_163DC", "sub_1647C", "sub_16598", "sub_16654", "sub_166C4", "sub_1674C", "sub_167BC", "ffi_prep_cif_machdep", "ffi_call", "ffi_prep_closure_loc", "sub_16EF8", "sub_1745C", "ffi_prep_cif", "ffi_prep_cif_var", "ffi_prep_closure", "ffi_call_SYSV", "ffi_closure_SYSV", "__clear_cache", "__aarch64_sync_cache_range", "_Z9__arm_a_0v", "__imp_strcpy", "__imp_uncompress", "__imp_fmodf", "__imp_pthread_create", "__imp_strerror", "__imp_snprintf", "__imp_syscall", "__imp_munmap", "__imp___stack_chk_guard", "__imp___errno", "__imp_getenv", "__imp__Znwm", "__imp_getpid", "__imp_fgets", "__imp_prctl", "__imp_memcpy", "__imp_puts", "__imp___cxa_finalize", "__imp_feof", "__imp_malloc", "__imp_vsnprintf", "__imp_select", "__imp_readdir", "__imp_isspace", "__imp_inotify_init", "__imp_dladdr", "__imp_lseek", "__imp__ZdlPv", "__imp_mmap", "__imp_pthread_detach", "__imp_abort", "__imp___stack_chk_fail", "__imp_strtol", "__imp_calloc", "__imp_kill", "__imp_dl_iterate_phdr", "__imp_fmod", "__imp_strstr", "__imp___cxa_pure_virtual", "__imp_read", "__imp_strncmp", "__imp_dlopen", "__imp_strncpy", "__imp_setenv", "__imp_strtok", "__imp_sscanf", "__imp_isalpha", "__imp_sigaction", "__imp_dlsym", "__imp_strdup", "__imp_fopen", "__imp_memset", "__imp__ZdaPv", "__imp_fclose", "__imp_time", "__imp_opendir", "__imp_strcmp", "__imp_inotify_add_watch", "__imp__Znam", "__imp_atoi", "__imp_strlen", "__imp_open", "__imp_mprotect", "__imp_closedir", "__imp_close", "__imp_raise", "free"];
var func_addr=func_addr_KEKE.concat(func_addr_Main);
var func_name=func_name_KEKE.concat(func_name_Main);
var so_name = "libjiagu_64.so";

/*
    @param print_stack: Whether printing stack info, default is false.
*/
var print_stack = false;

/*
    @param print_stack_mode
    - FUZZY: print as much stack info as possible
    - ACCURATE: print stack info as accurately as possible
    - MANUAL: if printing the stack info in an error and causes exit, use this option to manually print the address
*/
var print_stack_mode = "FUZZY";

function addr_in_so(addr){
    var process_Obj_Module_Arr = Process.enumerateModules();
    for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
        if(addr>process_Obj_Module_Arr[i].base && addr<process_Obj_Module_Arr[i].base.add(process_Obj_Module_Arr[i].size)){
            console.log(addr.toString(16),"is in",process_Obj_Module_Arr[i].name,"offset: 0x"+(addr-process_Obj_Module_Arr[i].base).toString(16));
        }
    }
}
function hook_dlopen() {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    //console.log(path);
                    if (path.indexOf(so_name) >= 0) {
                        this.is_can_hook = true;
                    }
                }
            },
            onLeave: function (retval) {
                if (this.is_can_hook) {
                    // note: you can do any thing before or after stalker trace so.

                    trace_so();
                }
            }
        }
    );
}

function trace_so(){
    var times = 1;
    var module = Process.getModuleByName(so_name);
    var pid = Process.getCurrentThreadId();
    console.log("start Stalker!");
    Stalker.exclude({
        "base": Process.getModuleByName("libc.so").base,
        "size": Process.getModuleByName("libc.so").size
    })
    Stalker.follow(pid,{
        events:{
            call:false,
            ret:false,
            exec:false,
            block:false,
            compile:false
        },
        onReceive:function(events){
        },
        transform: function (iterator) {
            var instruction = iterator.next();
            do{
                if (func_addr.indexOf(instruction.address - module.base) !== -1) {
                    if(func_addr.indexOf(instruction.address - module.base) < func_addr_KEKE.length){
                        console.log("callkeke" + times + ":" + func_name[func_addr.indexOf(instruction.address - module.base)]);
                    }else{
                        console.log("callmain" + times + ":" + func_name[func_addr.indexOf(instruction.address - module.base)]);
                    }

                    times = times + 1
                    if (print_stack) {
                        if (print_stack_mode === "FUZZY") {
                            iterator.putCallout((context) => {
                                console.log("backtrace:\n"+Thread.backtrace(context, Backtracer.FUZZY).map(DebugSymbol.fromAddress).join('\n'));
                                console.log('---------------------')
                            });
                        }
                        else if (print_stack_mode === "ACCURATE") {
                            iterator.putCallout((context) => {
                                console.log("backtrace:\n"+Thread.backtrace(context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
                                console.log('---------------------')
                            })
                        }

                        else if (print_stack_mode === "MANUAL") {
                            iterator.putCallout((context) => {
                                console.log("backtrace:")
                                Thread.backtrace(context, Backtracer.FUZZY).map(addr_in_so);
                                console.log('---------------------')
                            })
                        }
                    }
                }
                iterator.keep();
            } while ((instruction = iterator.next()) !== null);
        },

        onCallSummary:function(summary){

        }
    });
    console.log("Stalker end!");
}

setImmediate(hook_dlopen,0);


var bbase;
function my_hook_dlopen(soName = '') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
      {
          onEnter: function (args) {
              var pathptr = args[0];
              if (pathptr !== undefined && pathptr != null) {
                  var path = ptr(pathptr).readCString();
                  if (path.indexOf(soName) >= 0) {
                      //console.log("soname"+path.split('/').pop());
                      this.is_can_hook = true;
                  }
              }
          },
          onLeave: function (retval) {
              if (this.is_can_hook) {
                  hook_proc_self_maps();
                  findmmap();
              }
          }
      }
    );
}
function showStacks(){
    console.log(
      Java.use("android.util.Log")
        .getStackTraceString(//这两句相当于Log.getStackTraceString
          Java.use("java.lang.Throwable").$new()//Java.use("java.lang.Throwable").$new()相当于new Throwable()
        )
    )
}

function findmmap() {
    Interceptor.attach(Module.findExportByName('libc.so', 'mmap'), {
        onEnter (args) {
            this.addr = args[0];
            this.len = args[1].toInt32();
        },
        onLeave (retval) {
            console.log("mmap mapped at", retval);

        }
    });
}
function hook_proc_self_maps() {

    const openPtr = Module.getExportByName(null, 'open');
    const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
    var fakePath = "/data/data/com.oacia.apk_protect/maps";
    bbase=Process.findModuleByName("libjiagu_64.so");

    Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
        var pathname = Memory.readUtf8String(pathnameptr);
        console.log("open",pathname);
        if (pathname.indexOf("maps") >= 0) {
            console.log("find",pathname,",redirect to",fakePath);
            var filename = Memory.allocUtf8String(fakePath);
            return open(filename, flag);
        }
        if (pathname.indexOf("dex") >= 0) {
        	// console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
        	// 	.map(addr => addr.sub(bbase.base).toString()));

        }
        var fd = open(pathnameptr, flag);
        return fd;
    }, 'int', ['pointer', 'int']));
}


setImmediate(my_hook_dlopen,"libjiagu_64.so");

[Pixel 3 XL::com.oacia.apk_protect ]-> start Stalker!
Stalker end!
mmap mapped at 0x70a12ce000
mmap mapped at 0x709fc33000
mmap mapped at 0x7041645000
callkeke1:JNI_OnLoad
callkeke2:j_interpreter_wrap_int64_t
callkeke3:interpreter_wrap_int64_t
callkeke4:getenv
callkeke5:sub_13908
callkeke6:inotify_add_watch
callkeke7:sub_11220
callkeke8:fopen
callkeke9:sub_9DD8
callkeke10:sub_E3E0
callkeke11:strtol
callkeke12:feof
callkeke13:raise
callkeke14:memset
callkeke15:sub_C918
callkeke16:sub_9988
callkeke17:sub_9964
callkeke18:sub_9AC4
callkeke19:j_ffi_prep_cif
callkeke20:ffi_prep_cif
callkeke21:j_ffi_prep_cif_machdep
callkeke22:ffi_prep_cif_machdep
callkeke23:j_ffi_call
callkeke24:ffi_call
callkeke25:sub_1674C
callkeke26:j_ffi_call_SYSV
callkeke27:ffi_call_SYSV
callkeke28:sub_167BC
callkeke29:sub_1647C
callkeke30:sub_163DC
callkeke31:sub_9900
callkeke32:sub_94BC
callkeke33:inotify_init
callkeke34:fmod
callkeke35:strncpy
callkeke36:_Z9__arm_a_1P7_JavaVMP7_JNIEnvPvRi
callkeke37:sub_9E58
callkeke38:sub_999C
callkeke39:sub_10964
callkeke40:j_lseek_1
callkeke41:lseek
callkeke42:sub_96E0
callkeke43:sub_8000
callkeke44:dlopen
callkeke45:sub_60E0
callkeke46:sub_6544
callkeke47:sub_4B54
callkeke48:sub_6128
callkeke49:_ZN9__arm_c_19__arm_c_0Ev
callkeke50:sub_A3EC
callkeke51:sub_99CC
callkeke52:sub_9944
mmap mapped at 0x709faf9000
mmap mapped at 0x709fafa000
callkeke53:sub_6484
callkeke54:sub_6590
callkeke55:prctl
callkeke56:sub_6698
callkeke57:sub_9FFC
callkeke58:j_lseek_3
callkeke59:j_lseek_2
callkeke60:j_lseek_0
callkeke61:sub_9A90
callkeke62:sub_5F20
mmap mapped at 0x70a12be000
callkeke63:sub_6044
mmap mapped at 0x70414a2000
mmap mapped at 0x70414a3000
callkeke64:sub_3574
callkeke65:uncompress
mmap mapped at 0x709fff1000
callkeke66:sub_49F0
callkeke67:sub_5400
callkeke68:sub_5478
callkeke69:sub_5B08
mmap mapped at 0x709ffc9000
mmap mapped at 0x709ffca000
callkeke70:sub_5650
callkeke71:sub_580C
callkeke72:open
callkeke73:atoi
callkeke74:Link
callkeke75:strncmp
callkeke76:sub_4918
callkeke77:sub_4000
callkeke78:sub_41B4
callkeke79:sub_35AC
callkeke80:sigaction
callkeke81:sub_5E6C
callkeke82:sub_5444
callmain83:sub_11603C
callmain84:j__Znwm
callmain85:_Znwm
callmain86:malloc
callmain87:__cxa_atexit
callmain88:sub_1160B4
callmain89:sub_1160C4
callmain90:strlen
callmain91:memcpy
callmain92:sub_1161FC
callmain93:sub_1164AC
callmain94:sub_1164D8
callmain95:sub_116528
callmain96:sub_1165C8
callmain97:sub_1A32C0
callmain98:sub_1A3150
callmain99:sub_1A3204
callmain100:sub_1166FC
callmain101:sub_116728
callmain102:sub_116750
callmain103:sub_116830
callmain104:sub_116BA0
callkeke105:sub_633C
callkeke106:sub_8130
callkeke107:sub_4C70
callkeke108:sub_825C
callkeke109:sub_8B50
callkeke110:sub_8ED4
callkeke111:sub_8430
mmap mapped at 0x709ffb9000
callmain112:JNI_OnLoad
callmain113:j_interpreter_wrap_int64_t
callmain114:interpreter_wrap_int64_t
callkeke115:interpreter_wrap_int64_t_bridge
callkeke116:sub_9D60
callmain117:sub_1B3F0C
callmain118:gettimeofday
callmain119:sub_11BD9C
callmain120:sub_1182D8
callmain121:sub_123970
callmain122:sub_1B6448
callmain123:getenv
callmain124:sub_11F130
mmap mapped at 0x709ff99000
mmap mapped at 0x709fc13000
callmain125:sub_12047C
callmain126:j__ZdlPv
callmain127:_ZdlPv
callmain128:free
callmain129:sub_1427E8
callmain130:dlopen
callmain131:sub_11BDA8
callmain132:sub_11BE58
callmain133:sub_11F69C
callmain134:sub_117BE0
callmain135:sub_117CA0
callmain136:fopen
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
callmain137:sub_117E90
callmain138:sub_14285C
callmain139:sub_1429CC
callmain140:sub_11C1AC
callmain141:sub_11C1B4
callmain142:sub_11C210
mmap mapped at 0x70a8da8000
mmap mapped at 0x70a4597000
callkeke143:sub_166C4
callkeke144:memcpy
callmain145:sub_123324
callmain146:sub_1205A0
callmain147:sub_11F768
callmain148:memcmp
callmain149:opendir
callmain150:closedir
callmain151:sub_11859C
callmain152:sub_11C268
callmain153:sub_11C300
callmain154:sub_117B68
callmain155:sub_1186B8
callmain156:sub_143964
callmain157:sub_1B66A8
callmain158:pthread_mutex_lock
callmain159:sub_142EA0
callmain160:sub_143A38
callmain161:sub_11CF8C
callmain162:sub_131D58
callmain163:sub_1B66D0
callmain164:pthread_mutex_unlock
callmain165:sub_1178E8
callmain166:sub_13D70C
callmain167:sub_19F984
callmain168:sub_11F1C8
callmain169:atoi
callmain170:sub_12D2F8
callmain171:sub_17ABE8
callmain172:sub_172660
callmain173:sub_13BFF0
callmain174:sub_172AA4
callmain175:sub_13BD80
callmain176:sub_13BE2C
callmain177:sub_13BE4C
callmain178:memmove
callmain179:sub_13BE64
callmain180:sub_172D78
callmain181:sub_13E510
callmain182:sub_1926F0
callmain183:sub_13DB7C
callmain184:sub_1B7A08
callmain185:sub_1B7ABC
callmain186:pthread_cond_broadcast
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
callmain187:sub_12FA34
callmain188:sub_120664
callmain189:sub_1332B8
callmain190:sub_13E0F8
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
callmain191:sub_12743C
callmain192:sub_124C68
callmain193:sub_125DC4
callmain194:sub_124510
mmap mapped at 0x70a4567000
mmap mapped at 0x70a4537000
mmap mapped at 0x70a4517000
mmap mapped at 0x70a444a000
callmain195:sub_126888
callmain196:strdup
callmain197:sub_126920
callmain198:sub_122180
callmain199:sub_11BC1C
callmain200:sub_13DF34
callmain201:getpid
callmain202:memset
callmain203:snprintf
open /proc/21071/maps
find /proc/21071/maps ,redirect to /data/data/com.oacia.apk_protect/maps
callmain204:sub_124FA0
callmain205:sub_1B6498
callmain206:sub_1A0C88
callmain207:sub_217444
callmain208:sub_2175E0
callmain209:read
callmain210:strncmp
callmain211:close
callmain212:sub_1B578C
callmain213:j___self_lseek
callmain214:__self_lseek
callmain215:sub_1B586C
callmain216:j_j___read_self
callmain217:j___read_self
callmain218:__read_self
callmain219:sub_1B6528
callmain220:sub_1B6578
callmain221:mmap
mmap mapped at 0x7348095000
callmain222:sub_1B5B50
callmain223:calloc
callmain224:memchr
callmain225:sub_1B5D04
callmain226:sub_1B5EC4
mmap mapped at 0x70a4025000
mmap mapped at 0x70a4026000
callmain227:sub_1B6270
callmain228:sub_1B6180
mmap mapped at 0x70a3d80000
callmain229:sub_1B6678
callmain230:inflateInit2_
callmain231:inflate
callmain232:inflateEnd
callmain233:sub_1B6540
callmain234:munmap
callmain235:sub_1B56F8
callmain236:sub_19BC9C
callmain237:sub_19CCD4
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
callmain238:sub_12D470
callmain239:sub_142FE0
callmain240:sub_143008
callmain241:sub_142ABC
callmain242:sub_143848
callmain243:sub_143B48
callmain244:sub_143088
callmain245:sub_1222D0
callmain246:sub_14316C
callmain247:sub_142954
callkeke248:_Z9__arm_a_2PcmS_Rii
callmain249:sub_142894
callmain250:sub_1428BC
callmain251:sub_127DCC
callmain252:sub_14292C
callmain253:sub_121B78
callmain254:sub_121BE0
callmain255:sub_123CE8
callmain256:sub_123BC0
callmain257:sub_11959C
callmain258:sub_1AC170
callmain259:pthread_create
mmap mapped at 0x70a3f27000
mmap mapped at 0x734809b000
mmap mapped at 0x70a2f27000
callmain260:sub_1AC210
mmap mapped at 0x70a2e50000
mmap mapped at 0x7348095000
callmain261:sub_1B5DE4
callmain262:sub_1B60E8
callmain263:sub_19F7C4
callmain264:sub_1B2DC8
callmain265:sub_1B1CE8
open /proc/self/maps
find /proc/self/maps ,redirect to /data/data/com.oacia.apk_protect/maps
callmain266:sub_1B0974
mmap mapped at 0x70a3e29000
callmain267:sub_1AFE6C
mmap mapped at 0x734809b000
mmap mapped at 0x70a2e29000
callmain268:sub_126ED8
callmain269:sub_1AFE8C
callmain270:sub_1AFE90
callmain271:sub_1AB87C
mmap mapped at 0x70a2d2b000
mmap mapped at 0x70a2c2d000
mmap mapped at 0x70a2b2f000
mmap mapped at 0x7348092000
mmap mapped at 0x70a01fd000
callmain272:sub_1B26D4
callmain273:sub_1B26F4
callmain274:sub_1B27C8
mmap mapped at 0x7348089000
mmap mapped at 0x7348092000
mmap mapped at 0x70a01fd000
mmap mapped at 0x705499c000
callkeke275:j_ffi_prep_cif_var
callkeke276:ffi_prep_cif_var
callmain277:sub_1AAF48
callmain278:sub_1AAF54
callmain279:sub_2162D4
callmain280:sub_1B2898
callmain281:sub_1B2918
mmap mapped at 0xffffffffffffffff
mmap mapped at 0x70a2a01000
mmap mapped at 0x70a2903000
callmain282:sub_1ABE90
callmain283:sub_13E0EC
mmap mapped at 0x7346931000
mmap mapped at 0x70404a2000
mmap mapped at 0x7346849000
mmap mapped at 0x703f4a2000
callmain284:sub_124900
callmain285:sub_1A0C34
callmain286:sub_217188
callmain287:j_strcmp
callmain288:strcmp
callmain289:sub_194514
callmain290:sub_1A2380
callmain291:sub_1A23CC
callmain292:sub_1A2718
callmain293:sub_1A2A94
callmain294:sub_1A25E0
callmain295:sub_1A2984
callmain296:sub_11CAA4
callmain297:sub_11CC18

我下意识的去找到最后一个函数，因为在那里退出了

sub_11CC18不过这个函数我没有看到什么有用的

注意有几个压缩的函数

sub_1B6270里面

那导入一下压缩的头文件

file-loadfile-parse c

#  define z_const const
typedef unsigned char  Byte;  /* 8 bits */
typedef unsigned int   uInt;  /* 16 bits or more */
typedef unsigned long  uLong; /* 32 bits or more */
typedef struct z_stream_s {
    z_const Byte *next_in;     /* next input byte */
    uInt     avail_in;  /* number of bytes available at next_in */
    uLong    total_in;  /* total number of input bytes read so far */
 
    Byte    *next_out; /* next output byte will go here */
    uInt     avail_out; /* remaining free space at next_out */
    uLong    total_out; /* total number of bytes output so far */
} z_stream;

这里解压缩之后，应该就是解密的操作了，根据调用链往下追溯

追溯到这个函数

sub_1332B8

好大..

sub_19B760注意到这个函数

一看就是打开文件然后写，什么情况下会用，应该是解密dex然后写入解密后的数据吧

这里绕过反调试之后重新trace一下，因为解密dex后面肯定会有加载dex的操作，类似于一代壳的热加载


var func_addr_Main = [0x115130, 0x115150, 0x115160, 0x115170, 0x115180, 0x115190, 0x1151a0, 0x1151b0, 0x1151c0, 0x1151d0, 0x1151e0, 0x1151f0, 0x115200, 0x115210, 0x115220, 0x115230, 0x115240, 0x115250, 0x115260, 0x115270, 0x115280, 0x115290, 0x1152a0, 0x1152b0, 0x1152c0, 0x1152d0, 0x1152e0, 0x1152f0, 0x115300, 0x115310, 0x115320, 0x115330, 0x115340, 0x115350, 0x115360, 0x115370, 0x115380, 0x115390, 0x1153a0, 0x1153b0, 0x1153c0, 0x1153d0, 0x1153e0, 0x1153f0, 0x115400, 0x115410, 0x115420, 0x115430, 0x115440, 0x115450, 0x115460, 0x115470, 0x115480, 0x115490, 0x1154a0, 0x1154b0, 0x1154c0, 0x1154d0, 0x1154e0, 0x1154f0, 0x115500, 0x115510, 0x115520, 0x115530, 0x115540, 0x115550, 0x115560, 0x115570, 0x115580, 0x115590, 0x1155a0, 0x1155b0, 0x1155c0, 0x1155d0, 0x1155e0, 0x1155f0, 0x115600, 0x115610, 0x115620, 0x115630, 0x115640, 0x115650, 0x115660, 0x115670, 0x115680, 0x115690, 0x1156a0, 0x1156b0, 0x1156c0, 0x1156d0, 0x1156e0, 0x1156f0, 0x115700, 0x115710, 0x115720, 0x115730, 0x115740, 0x115750, 0x115760, 0x115770, 0x115780, 0x115790, 0x1157a0, 0x1157b0, 0x1157c0, 0x1157d0, 0x1157e0, 0x1157f0, 0x115800, 0x115810, 0x115820, 0x115830, 0x115840, 0x115850, 0x115860, 0x115870, 0x115880, 0x115890, 0x1158a0, 0x1158b0, 0x1158c0, 0x1158d0, 0x1158e0, 0x1158f0, 0x115900, 0x115910, 0x115920, 0x115930, 0x115940, 0x115950, 0x115960, 0x115970, 0x115980, 0x115990, 0x1159a0, 0x1159b0, 0x1159c0, 0x1159d0, 0x1159e0, 0x1159f0, 0x115a00, 0x115a10, 0x115a20, 0x115a30, 0x115a40, 0x115a50, 0x115a60, 0x115a70, 0x115a80, 0x115a90, 0x115aa0, 0x115ab0, 0x115ac0, 0x115ad0, 0x115ae0, 0x115af0, 0x115b00, 0x115b10, 0x115b20, 0x115b30, 0x115b40, 0x115b50, 0x115b60, 0x115b70, 0x115b80, 0x115b90, 0x115ba0, 0x115bb0, 0x115bc0, 0x115bd0, 0x115be0, 0x115bf0, 0x115c00, 0x115c10, 0x115c20, 0x115c30, 0x115c40, 0x115c50, 0x115c60, 0x115c70, 0x115c80, 0x115c90, 0x115ca0, 0x115cb0, 0x115cc0, 0x115cd0, 0x115ce0, 0x115cf0, 0x115d00, 0x115d10, 0x115d20, 0x115d30, 0x115d40, 0x115d50, 0x115d60, 0x115d70, 0x115d80, 0x115d90, 0x115da0, 0x115db0, 0x115dc0, 0x115dd0, 0x115de0, 0x115df0, 0x115e00, 0x115e10, 0x115e20, 0x115e30, 0x115e40, 0x115e50, 0x115e60, 0x115e70, 0x115e80, 0x115e90, 0x115ea0, 0x115eb0, 0x115ec0, 0x115ed0, 0x115ee0, 0x115ef0, 0x115f00, 0x115f10, 0x115f20, 0x115f30, 0x115f40, 0x115f50, 0x115f60, 0x115f70, 0x115f80, 0x115f90, 0x115fa0, 0x115fb0, 0x115fc0, 0x115fd0, 0x115fe0, 0x115ff0, 0x116000, 0x116010, 0x116020, 0x116030, 0x11603c, 0x1160b4, 0x1160c4, 0x11615c, 0x1161fc, 0x1164ac, 0x1164d8, 0x116528, 0x1165c8, 0x1166fc, 0x116728, 0x116750, 0x116830, 0x1168f0, 0x116a80, 0x116ad8, 0x116af4, 0x116b10, 0x116b2c, 0x116b84, 0x116ba0, 0x1178e8, 0x1178fc, 0x117b68, 0x117be0, 0x117ca0, 0x117e90, 0x1180cc, 0x1182d8, 0x11859c, 0x1186b8, 0x118748, 0x118ae4, 0x118c8c, 0x118d24, 0x118fb4, 0x119270, 0x11959c, 0x119634, 0x11bc1c, 0x11bd78, 0x11bd9c, 0x11bda8, 0x11be58, 0x11c1ac, 0x11c1b4, 0x11c210, 0x11c268, 0x11c300, 0x11c394, 0x11caa4, 0x11cc18, 0x11cf8c, 0x11d134, 0x11d4c4, 0x11d694, 0x11d738, 0x11d73c, 0x11e0d8, 0x11e834, 0x11f130, 0x11f1c8, 0x11f260, 0x11f3a4, 0x11f56c, 0x11f604, 0x11f69c, 0x11f768, 0x11f884, 0x11fa18, 0x11fb14, 0x1200c8, 0x120194, 0x1202d4, 0x12036c, 0x1203c8, 0x120404, 0x120440, 0x12047c, 0x1205a0, 0x120664, 0x120674, 0x120678, 0x120c30, 0x121b78, 0x121be0, 0x121c40, 0x121cd8, 0x122180, 0x1222d0, 0x1222e8, 0x122ae0, 0x122b54, 0x122b5c, 0x122c7c, 0x122d14, 0x123324, 0x1236b8, 0x123720, 0x123970, 0x123bc0, 0x123ce8, 0x124510, 0x124710, 0x124900, 0x124c68, 0x124f7c, 0x124fa0, 0x1253b8, 0x125650, 0x125854, 0x125d2c, 0x125dc4, 0x126888, 0x126920, 0x126ed8, 0x126f84, 0x12743c, 0x127dcc, 0x127ea8, 0x1281e4, 0x1281ec, 0x1288dc, 0x128a2c, 0x128d44, 0x128d64, 0x128d70, 0x128db8, 0x128e60, 0x128e88, 0x128f5c, 0x129468, 0x129758, 0x129a04, 0x12a568, 0x12ac10, 0x12ad6c, 0x12aeb0, 0x12b9fc, 0x12bb18, 0x12bb80, 0x12bf4c, 0x12c08c, 0x12c5d4, 0x12cc6c, 0x12d2f8, 0x12d470, 0x12d478, 0x12d480, 0x12d48c, 0x12d4a4, 0x12d4ac, 0x12d4d8, 0x12d518, 0x12d560, 0x12d84c, 0x12d9fc, 0x12db60, 0x12dfe4, 0x12f9f8, 0x12fa34, 0x12fa6c, 0x12fb00, 0x12fb18, 0x1317a4, 0x131958, 0x131d58, 0x131e20, 0x132088, 0x132518, 0x132da8, 0x1332b8, 0x136d68, 0x136db0, 0x136ff8, 0x137164, 0x137408, 0x137630, 0x137820, 0x137978, 0x1395a8, 0x1395c4, 0x1395ec, 0x139604, 0x139628, 0x139664, 0x139678, 0x139698, 0x1396a0, 0x1396b4, 0x1396d0, 0x1396fc, 0x13970c, 0x139728, 0x139770, 0x139824, 0x139828, 0x13982c, 0x1398f0, 0x1399d8, 0x139adc, 0x139bac, 0x139bb8, 0x139ce4, 0x139cfc, 0x139d18, 0x139d40, 0x139d4c, 0x139d50, 0x139d6c, 0x139d8c, 0x139dac, 0x139df4, 0x139e0c, 0x139e40, 0x139e7c, 0x13a4d4, 0x13a4e4, 0x13a4fc, 0x13a53c, 0x13a55c, 0x13a588, 0x13a5a8, 0x13a5d4, 0x13a5e4, 0x13a600, 0x13a61c, 0x13a664, 0x13a670, 0x13a684, 0x13a6b4, 0x13a6d0, 0x13a79c, 0x13a7ac, 0x13a7e0, 0x13a7e8, 0x13a808, 0x13a810, 0x13a82c, 0x13a870, 0x13a894, 0x13a8ac, 0x13a8dc, 0x13a920, 0x13a95c, 0x13a9a4, 0x13a9b4, 0x13a9d0, 0x13aa00, 0x13aa0c, 0x13aa50, 0x13aa74, 0x13ab40, 0x13b1cc, 0x13b1d8, 0x13bc98, 0x13bcb0, 0x13bd80, 0x13be14, 0x13be2c, 0x13be4c, 0x13be64, 0x13be80, 0x13bea0, 0x13beb8, 0x13bf30, 0x13bf50, 0x13bf70, 0x13bf90, 0x13bfb0, 0x13bfd0, 0x13bff0, 0x13c064, 0x13c07c, 0x13c09c, 0x13c12c, 0x13c13c, 0x13c1e4, 0x13c238, 0x13c2a8, 0x13c2f0, 0x13c31c, 0x13c384, 0x13c3cc, 0x13c4ec, 0x13c4f0, 0x13c544, 0x13d114, 0x13d288, 0x13d2ec, 0x13d30c, 0x13d310, 0x13d328, 0x13d344, 0x13d38c, 0x13d394, 0x13d39c, 0x13d3a4, 0x13d460, 0x13d480, 0x13d484, 0x13d49c, 0x13d4a4, 0x13d4ac, 0x13d4c8, 0x13d538, 0x13d5d8, 0x13d5e4, 0x13d70c, 0x13db7c, 0x13dea8, 0x13df34, 0x13e0ec, 0x13e0f8, 0x13e510, 0x13e654, 0x13e784, 0x13e9ac, 0x13eae0, 0x13ec30, 0x13ee08, 0x13ef2c, 0x13f888, 0x13f920, 0x14027c, 0x140a3c, 0x1411fc, 0x1412c0, 0x1415f0, 0x141924, 0x1427e8, 0x14283c, 0x14285c, 0x142894, 0x1428bc, 0x14292c, 0x142954, 0x1429b8, 0x1429c0, 0x1429cc, 0x142a10, 0x142aa4, 0x142abc, 0x142ea0, 0x142fe0, 0x143008, 0x143088, 0x14316c, 0x143184, 0x143568, 0x143848, 0x143964, 0x1439fc, 0x143a38, 0x143b48, 0x143c54, 0x143d24, 0x143d3c, 0x143ebc, 0x1440cc, 0x14423c, 0x144360, 0x1444b8, 0x144508, 0x14453c, 0x144774, 0x14495c, 0x144afc, 0x144ef0, 0x144f4c, 0x14500c, 0x145018, 0x145024, 0x145030, 0x14503c, 0x145040, 0x145078, 0x1450a4, 0x145148, 0x145154, 0x14516c, 0x145184, 0x14519c, 0x1451b4, 0x1451cc, 0x1451e4, 0x1451fc, 0x145214, 0x145228, 0x145268, 0x145280, 0x145298, 0x1452b0, 0x1452c8, 0x1452e0, 0x1452f8, 0x145310, 0x14aa44, 0x14aa50, 0x14aa88, 0x14aaac, 0x14aacc, 0x14aaf0, 0x14ab14, 0x14ab34, 0x14ab68, 0x14ab78, 0x14abb0, 0x14abc0, 0x14abcc, 0x14abf4, 0x14ac1c, 0x14ac28, 0x14ac60, 0x14ac90, 0x14ad28, 0x14adb8, 0x14ae70, 0x14ae7c, 0x14ae88, 0x14aec4, 0x14aeec, 0x14b01c, 0x14b028, 0x14b054, 0x14b090, 0x14b09c, 0x14b0bc, 0x14b104, 0x14b164, 0x14b198, 0x14b1bc, 0x14b1dc, 0x14b204, 0x14b240, 0x14b250, 0x14b278, 0x14b2a8, 0x14b2e0, 0x14b304, 0x14b324, 0x14b36c, 0x14b3cc, 0x14b408, 0x14b430, 0x14b46c, 0x14b4a8, 0x14b4b4, 0x14b4ec, 0x14b4fc, 0x14b57c, 0x14b5c4, 0x14b5d0, 0x14b638, 0x14b65c, 0x14b67c, 0x14b6f4, 0x14b740, 0x14b7a8, 0x14b7d8, 0x14b808, 0x14b814, 0x14b820, 0x14b82c, 0x14b854, 0x14b868, 0x14b8d8, 0x14b908, 0x14b920, 0x14b998, 0x14b9d0, 0x14b9e0, 0x14ba00, 0x14ba0c, 0x14ba58, 0x14ba98, 0x14bae0, 0x14bb40, 0x14bb64, 0x14bb84, 0x14bb90, 0x14bc44, 0x14bc78, 0x14bd10, 0x14bd1c, 0x14bd28, 0x14bd4c, 0x14bd68, 0x14bd6c, 0x14bd90, 0x14bda0, 0x14bf9c, 0x14c18c, 0x14c198, 0x14c1a8, 0x14c1f4, 0x14c200, 0x14c24c, 0x14c25c, 0x14c2a8, 0x14c2b4, 0x14c4b0, 0x14c75c, 0x14c7c8, 0x14c844, 0x14c848, 0x14c84c, 0x14c898, 0x14c960, 0x14c978, 0x14c984, 0x14c990, 0x14c9dc, 0x14c9e8, 0x14ca30, 0x14cb2c, 0x14cd80, 0x14cdcc, 0x14cdf4, 0x14ce04, 0x14ce50, 0x14ce5c, 0x14ce68, 0x14cf64, 0x14d17c, 0x14d1e8, 0x14d200, 0x14d214, 0x14d234, 0x14d26c, 0x14d27c, 0x14d2c8, 0x14d390, 0x14d3bc, 0x14d3e4, 0x14d3f8, 0x14d418, 0x14d440, 0x14d458, 0x14d474, 0x14d570, 0x14d7e8, 0x14d810, 0x14d820, 0x14d86c, 0x14d87c, 0x14d8a0, 0x14d8b0, 0x14d8f8, 0x14d9f4, 0x14da04, 0x14da08, 0x14da54, 0x14da60, 0x14dc5c, 0x14ddc4, 0x14de34, 0x14dea8, 0x14deb8, 0x14dedc, 0x14deec, 0x14df3c, 0x14dfac, 0x14e000, 0x14e004, 0x14e008, 0x14e030, 0x14e0fc, 0x14e114, 0x14e128, 0x14e148, 0x14e158, 0x14e17c, 0x14e18c, 0x14e1b0, 0x14e1bc, 0x14e208, 0x14e214, 0x14e238, 0x14e258, 0x14e280, 0x14e34c, 0x14e364, 0x14e460, 0x14e470, 0x14e494, 0x14e4a4, 0x14e4c8, 0x14e4d0, 0x14e4dc, 0x14e5dc, 0x14e718, 0x14e728, 0x14e74c, 0x14e75c, 0x14e780, 0x14e854, 0x14e8ac, 0x14e8d4, 0x14e8ec, 0x14e8f8, 0x14e904, 0x14e94c, 0x14e958, 0x14ea54, 0x14ec90, 0x14ec9c, 0x14ecc0, 0x14ecd0, 0x14eecc, 0x14eed8, 0x14efd4, 0x14f228, 0x14f234, 0x14f258, 0x14f268, 0x14f274, 0x14f280, 0x14f2a4, 0x14f2ac, 0x14f2b8, 0x14f304, 0x14f3d4, 0x14f448, 0x14f458, 0x14f47c, 0x14f480, 0x14f484, 0x14f4a8, 0x14f6a4, 0x14f7d4, 0x14f840, 0x14f86c, 0x14f894, 0x14f8a8, 0x14f8c8, 0x14f8d8, 0x14f8fc, 0x14f90c, 0x14f918, 0x14f964, 0x14fa2c, 0x14fa44, 0x14fa58, 0x14fa78, 0x14fa88, 0x14fab4, 0x14fad4, 0x14fad8, 0x14fb24, 0x14fbec, 0x14fc28, 0x14fc3c, 0x14fc5c, 0x14fc84, 0x14fc88, 0x14fc8c, 0x14fcb0, 0x14fcfc, 0x14fd64, 0x14fd90, 0x14fdb8, 0x14fdcc, 0x14fdec, 0x14fe3c, 0x14fe60, 0x14fe70, 0x14fe7c, 0x14fe88, 0x14fed4, 0x14fedc, 0x14fef4, 0x14ff18, 0x14ff28, 0x14ff4c, 0x14ff50, 0x14ff54, 0x14ff78, 0x14ff9c, 0x150008, 0x15006c, 0x150094, 0x1500ac, 0x1500b8, 0x1500c4, 0x1500e8, 0x1501b4, 0x1501cc, 0x1501e0, 0x150200, 0x150250, 0x15025c, 0x1502ac, 0x1502b8, 0x1502bc, 0x1502e4, 0x1502ec, 0x1502f0, 0x150340, 0x150580, 0x15058c, 0x150808, 0x150814, 0x150930, 0x150940, 0x15094c, 0x150a6c, 0x150b94, 0x150c64, 0x150ca0, 0x150cb4, 0x150cd8, 0x150ce8, 0x150d0c, 0x150d38, 0x150d44, 0x150f84, 0x1510dc, 0x1510ec, 0x1510fc, 0x151338, 0x151488, 0x1514f4, 0x151570, 0x151598, 0x1515a8, 0x1516c8, 0x151968, 0x1519d4, 0x1519fc, 0x151a54, 0x151a64, 0x151ca0, 0x151f10, 0x151f5c, 0x151fc4, 0x151fec, 0x15210c, 0x15224c, 0x1522b8, 0x1522e4, 0x15230c, 0x152320, 0x152340, 0x152368, 0x152378, 0x1523e4, 0x15240c, 0x152434, 0x15244c, 0x152450, 0x152474, 0x152480, 0x15248c, 0x15249c, 0x1524a8, 0x152574, 0x15259c, 0x1525c4, 0x1525e8, 0x1525f8, 0x15261c, 0x15262c, 0x152648, 0x152658, 0x1526c0, 0x1526e8, 0x1527b4, 0x1527dc, 0x1527f8, 0x15284c, 0x152858, 0x152860, 0x152880, 0x152890, 0x1528dc, 0x1528e4, 0x152904, 0x15292c, 0x15293c, 0x152960, 0x15297c, 0x1529a0, 0x1529a4, 0x1529a8, 0x1529cc, 0x1529e8, 0x152a04, 0x152a2c, 0x152a34, 0x152a58, 0x152a90, 0x152b0c, 0x152b34, 0x152b44, 0x152b80, 0x152bbc, 0x152bd0, 0x152bf0, 0x152bf4, 0x152bf8, 0x152c1c, 0x152c20, 0x152c5c, 0x152c98, 0x152cac, 0x152ccc, 0x152ce4, 0x152d00, 0x152d10, 0x152d34, 0x152d5c, 0x152e2c, 0x152e84, 0x152eac, 0x152ee0, 0x153014, 0x15303c, 0x153074, 0x1530dc, 0x1530f4, 0x1530fc, 0x15311c, 0x15312c, 0x153150, 0x153160, 0x1531a0, 0x1531c4, 0x1531cc, 0x153218, 0x153280, 0x153298, 0x1532ac, 0x1532cc, 0x1532d0, 0x1532d4, 0x1532f8, 0x153308, 0x153354, 0x153370, 0x153398, 0x1533bc, 0x1534a8, 0x1534dc, 0x1535b0, 0x153608, 0x153630, 0x153634, 0x153640, 0x153680, 0x1536ac, 0x153720, 0x153730, 0x153754, 0x153784, 0x1537c0, 0x1537e8, 0x153804, 0x153840, 0x153868, 0x1538ac, 0x1538cc, 0x1538f0, 0x1539bc, 0x1539d4, 0x1539e8, 0x153a08, 0x153a0c, 0x153a10, 0x153a34, 0x153a44, 0x153a78, 0x153ab8, 0x153adc, 0x153af4, 0x153afc, 0x153b1c, 0x153b54, 0x153b64, 0x153ba8, 0x153dc0, 0x153dcc, 0x153e18, 0x153e44, 0x153e74, 0x153ea0, 0x153ec4, 0x153ef0, 0x153f00, 0x153f44, 0x153f60, 0x153f68, 0x153f84, 0x153f9c, 0x153fa4, 0x153fb4, 0x153fc8, 0x153fe8, 0x15400c, 0x154040, 0x154058, 0x154088, 0x15409c, 0x1540a8, 0x1540d0, 0x1540f0, 0x154110, 0x154138, 0x1541f0, 0x154238, 0x154244, 0x15426c, 0x154278, 0x1544b8, 0x1544e8, 0x15455c, 0x15458c, 0x1545b8, 0x1545dc, 0x154610, 0x154640, 0x15464c, 0x154670, 0x154698, 0x154760, 0x154778, 0x154780, 0x1547a0, 0x1547b8, 0x1547d4, 0x15481c, 0x154898, 0x154fd0, 0x155010, 0x155048, 0x155058, 0x1550c0, 0x1550e8, 0x155128, 0x155194, 0x1551d0, 0x1551e4, 0x155204, 0x155220, 0x155240, 0x155250, 0x155294, 0x1553f0, 0x155458, 0x155470, 0x155484, 0x1554a4, 0x1554cc, 0x1554f8, 0x155644, 0x1556b0, 0x1556ec, 0x155700, 0x155720, 0x155748, 0x155788, 0x1557b0, 0x1557e8, 0x155828, 0x15584c, 0x155888, 0x15589c, 0x1558bc, 0x1558d4, 0x1558f0, 0x155918, 0x15597c, 0x1559bc, 0x1559f4, 0x155a20, 0x155a94, 0x155abc, 0x155ae8, 0x155f04, 0x155f90, 0x156888, 0x1568c8, 0x1569fc, 0x156a1c, 0x156a44, 0x156a6c, 0x156a94, 0x156ab0, 0x156ac0, 0x156b0c, 0x156bd8, 0x156bf0, 0x156c04, 0x156c24, 0x156c28, 0x156c2c, 0x156c50, 0x156c80, 0x156cc0, 0x156ce4, 0x156cf8, 0x156d1c, 0x156d2c, 0x156d6c, 0x156ddc, 0x156e34, 0x156e5c, 0x156e6c, 0x156eac, 0x156f44, 0x156f50, 0x15704c, 0x1572a0, 0x1572ec, 0x1572f8, 0x157414, 0x157560, 0x157578, 0x15758c, 0x1575ac, 0x1575b0, 0x1575b4, 0x1575d8, 0x157608, 0x15762c, 0x157690, 0x1576b8, 0x1576d8, 0x157704, 0x157728, 0x15777c, 0x15784c, 0x1578bc, 0x1578d8, 0x1578f8, 0x157900, 0x15790c, 0x15793c, 0x157978, 0x15798c, 0x1579ac, 0x1579bc, 0x1579e0, 0x1579f0, 0x157a2c, 0x157be4, 0x157c20, 0x157c34, 0x157c54, 0x157c6c, 0x157ccc, 0x157d3c, 0x157d6c, 0x157d98, 0x157dbc, 0x157de8, 0x157df8, 0x157e38, 0x157fc4, 0x15801c, 0x15802c, 0x158050, 0x158060, 0x1580a0, 0x158168, 0x158180, 0x158188, 0x1581a8, 0x1581c0, 0x1581dc, 0x1581f8, 0x158228, 0x158380, 0x1583bc, 0x1583d4, 0x1583e8, 0x158408, 0x158430, 0x158448, 0x158480, 0x1584e8, 0x158564, 0x158568, 0x15856c, 0x158590, 0x158594, 0x158598, 0x1585d8, 0x158640, 0x158658, 0x15866c, 0x15868c, 0x158690, 0x158694, 0x1586b8, 0x1586bc, 0x1586c0, 0x158700, 0x15872c, 0x158784, 0x1587f0, 0x158858, 0x158894, 0x1588a8, 0x1588c8, 0x1588cc, 0x1588d0, 0x158934, 0x158a9c, 0x158adc, 0x158ae4, 0x158b08, 0x158b30, 0x158b58, 0x158bbc, 0x158c78, 0x158d44, 0x158d6c, 0x158dac, 0x158f0c, 0x158f48, 0x158f70, 0x158fb0, 0x158fdc, 0x159004, 0x159018, 0x159038, 0x159048, 0x1590b0, 0x1590dc, 0x15910c, 0x159138, 0x15915c, 0x159164, 0x159168, 0x15918c, 0x1591a4, 0x1591d8, 0x159364, 0x1593cc, 0x1593e4, 0x1593ec, 0x15940c, 0x159410, 0x159414, 0x159478, 0x1594a0, 0x1594bc, 0x159520, 0x159730, 0x159754, 0x1597b8, 0x1597bc, 0x1597c0, 0x1597e4, 0x1597fc, 0x159838, 0x159868, 0x159894, 0x1598b8, 0x1598cc, 0x1598f4, 0x159908, 0x15994c, 0x1599b4, 0x1599cc, 0x1599e0, 0x159a00, 0x159a28, 0x159a40, 0x159a78, 0x159ae0, 0x159b5c, 0x159b60, 0x159b64, 0x159b88, 0x159b98, 0x159bdc, 0x159c4c, 0x159ca0, 0x159cb8, 0x159cd8, 0x159cf4, 0x159d2c, 0x159d7c, 0x159da0, 0x159dc8, 0x159dfc, 0x159f14, 0x159f50, 0x159f7c, 0x159fa4, 0x159fac, 0x15a018, 0x15a040, 0x15a068, 0x15a08c, 0x15a0a4, 0x15a0dc, 0x15a104, 0x15a114, 0x15a138, 0x15a200, 0x15a228, 0x15a25c, 0x15a424, 0x15a460, 0x15a49c, 0x15a4b0, 0x15a4d0, 0x15a4d4, 0x15a4d8, 0x15a4fc, 0x15a500, 0x15a504, 0x15a540, 0x15a57c, 0x15a590, 0x15a5b0, 0x15a5c0, 0x15a5e4, 0x15a5f4, 0x15a618, 0x15a630, 0x15a664, 0x15a698, 0x15a6d8, 0x15a6f8, 0x15a724, 0x15a75c, 0x15a7a0, 0x15a7c0, 0x15a7ec, 0x15a7fc, 0x15a818, 0x15a860, 0x15a8bc, 0x15a904, 0x15a960, 0x15a9a8, 0x15aa4c, 0x15aa94, 0x15abb0, 0x15acd8, 0x15ace4, 0x15acfc, 0x15ad40, 0x15ade4, 0x15ae88, 0x15ae94, 0x15aeac, 0x15aed8, 0x15af10, 0x15b124, 0x15b130, 0x15b148, 0x15b190, 0x15b1ec, 0x15b220, 0x15b22c, 0x15b244, 0x15b2e8, 0x15b348, 0x15b390, 0x15b3ec, 0x15b450, 0x15b524, 0x15b604, 0x15b64c, 0x15b6a8, 0x15b758, 0x15b83c, 0x15b92c, 0x15b974, 0x15b9d0, 0x15b9e8, 0x15ba2c, 0x15ba88, 0x15bab0, 0x15bae4, 0x15bb24, 0x15bb3c, 0x15bb60, 0x15bb88, 0x15bb94, 0x15bbb0, 0x15bbc8, 0x15bbec, 0x15bc40, 0x15bd74, 0x15beb4, 0x15befc, 0x15bf54, 0x15bff4, 0x15c220, 0x15c22c, 0x15c244, 0x15c280, 0x15c4ec, 0x15c590, 0x15c59c, 0x15c5b4, 0x15c6bc, 0x15c7d0, 0x15c8b4, 0x15c9a4, 0x15caa8, 0x15cbb8, 0x15cc00, 0x15cc5c, 0x15cec8, 0x15cf10, 0x15cf6c, 0x15cfb4, 0x15d010, 0x15d01c, 0x15d034, 0x15d07c, 0x15d0d8, 0x15d138, 0x15d3b4, 0x15d3d8, 0x15d47c, 0x15d494, 0x15d4b8, 0x15d68c, 0x15d6b0, 0x15d794, 0x15d884, 0x15d928, 0x15d9b0, 0x15dbec, 0x15dc90, 0x15dc9c, 0x15dcb4, 0x15dcf0, 0x15dd38, 0x15dd94, 0x15ddb8, 0x15de00, 0x15de5c, 0x15de80, 0x15deb0, 0x15def8, 0x15df54, 0x15dfa0, 0x15e044, 0x15e050, 0x15e068, 0x15e088, 0x15e0b4, 0x15e0d8, 0x15e17c, 0x15e188, 0x15e1a0, 0x15e1ec, 0x15e290, 0x15e2d8, 0x15e334, 0x15e340, 0x15e358, 0x15e364, 0x15e37c, 0x15e388, 0x15e3a0, 0x15e3e8, 0x15e444, 0x15e450, 0x15e468, 0x15e488, 0x15e4b4, 0x15e4d8, 0x15e4e4, 0x15e4fc, 0x15e544, 0x15e5a0, 0x15e5ec, 0x15e60c, 0x15e638, 0x15e680, 0x15e6dc, 0x15e780, 0x15e78c, 0x15e7a4, 0x15e7ec, 0x15e848, 0x15e894, 0x15e8b8, 0x15e95c, 0x15e968, 0x15e980, 0x15ea24, 0x15ea78, 0x15ea84, 0x15ea9c, 0x15eae4, 0x15eb40, 0x15ebe4, 0x15ebf0, 0x15ec08, 0x15ec14, 0x15ec2c, 0x15ec38, 0x15ec50, 0x15ec78, 0x15ecac, 0x15ed48, 0x15ede4, 0x15ee08, 0x15ee50, 0x15eeac, 0x15ef48, 0x15efec, 0x15f088, 0x15f134, 0x15f140, 0x15f158, 0x15f1ac, 0x15f20c, 0x15f2a8, 0x15f344, 0x15f398, 0x15f3f8, 0x15f44c, 0x15f470, 0x15f4b8, 0x15f514, 0x15f588, 0x15f604, 0x15f680, 0x15f704, 0x15f74c, 0x15f7a8, 0x15f83c, 0x15f858, 0x15f938, 0x15fa54, 0x15fb7c, 0x15fb88, 0x15fba0, 0x15fbc0, 0x15fbf4, 0x15fc14, 0x15fc34, 0x15fca8, 0x15fd08, 0x15fd24, 0x15fd44, 0x15fd64, 0x15fd84, 0x15fda4, 0x15fdc4, 0x15fde4, 0x15fe04, 0x15fe24, 0x160108, 0x160128, 0x160148, 0x160168, 0x160188, 0x1601a8, 0x1601c8, 0x160228, 0x1602c4, 0x1602fc, 0x16031c, 0x16033c, 0x16035c, 0x16037c, 0x16039c, 0x1603bc, 0x1603dc, 0x1603fc, 0x16041c, 0x16043c, 0x16045c, 0x16047c, 0x16049c, 0x1604bc, 0x1604dc, 0x1604fc, 0x16051c, 0x16053c, 0x16055c, 0x16057c, 0x16059c, 0x1605bc, 0x1605dc, 0x1605fc, 0x16061c, 0x16063c, 0x16065c, 0x16067c, 0x16069c, 0x1606bc, 0x1606dc, 0x1606fc, 0x16071c, 0x16073c, 0x16075c, 0x16077c, 0x16079c, 0x1607bc, 0x1607dc, 0x1607fc, 0x16081c, 0x16083c, 0x16085c, 0x16087c, 0x16089c, 0x1608bc, 0x1608dc, 0x1608fc, 0x16091c, 0x16093c, 0x16095c, 0x16097c, 0x16099c, 0x1609bc, 0x160d7c, 0x1635e4, 0x163624, 0x163664, 0x1636a4, 0x1636e4, 0x1638e0, 0x163adc, 0x163ce4, 0x163ee8, 0x165e60, 0x165eec, 0x165f38, 0x165fa8, 0x165fdc, 0x165ffc, 0x16601c, 0x16603c, 0x1660d4, 0x1660f4, 0x166114, 0x166134, 0x1661cc, 0x166200, 0x166234, 0x166278, 0x166298, 0x1662b8, 0x1662d8, 0x166dd4, 0x1679dc, 0x1679e0, 0x167a00, 0x167a7c, 0x167b14, 0x167b30, 0x167bc8, 0x167bfc, 0x167c3c, 0x167ca4, 0x167e68, 0x167e88, 0x167e98, 0x167f30, 0x167f54, 0x167f98, 0x167fb8, 0x167fd8, 0x167ff8, 0x168018, 0x168038, 0x168058, 0x168078, 0x168098, 0x1680b8, 0x1680d8, 0x1680f8, 0x168118, 0x168138, 0x168158, 0x168178, 0x168198, 0x1681b8, 0x1681d8, 0x1681f8, 0x168218, 0x168238, 0x168258, 0x168278, 0x168298, 0x1682b8, 0x1682d8, 0x1682f8, 0x168318, 0x168338, 0x168358, 0x168378, 0x168398, 0x1683b8, 0x1683d8, 0x1683f8, 0x168418, 0x168438, 0x168458, 0x168478, 0x168510, 0x1685a8, 0x168640, 0x1686d8, 0x168770, 0x168808, 0x1688a0, 0x168a48, 0x168aa8, 0x168af8, 0x168b20, 0x168ba8, 0x168bf4, 0x168ca0, 0x168d54, 0x168ea0, 0x168f60, 0x168fe8, 0x16909c, 0x169124, 0x169168, 0x1691b4, 0x1691d4, 0x1691f4, 0x169214, 0x169234, 0x169254, 0x169274, 0x169294, 0x1692b4, 0x169380, 0x1694b0, 0x1696a0, 0x1696c4, 0x169714, 0x16973c, 0x169798, 0x1697d8, 0x169824, 0x16984c, 0x16988c, 0x1698b4, 0x1698f0, 0x1698f8, 0x169abc, 0x169c34, 0x16ad88, 0x16afc0, 0x16b6a4, 0x16b8f0, 0x16b92c, 0x16b98c, 0x16bb2c, 0x16bc20, 0x16bd74, 0x16c170, 0x16c2d0, 0x16c430, 0x16c90c, 0x16c918, 0x16ccf0, 0x16cdc8, 0x16cfb0, 0x16d084, 0x16d0d0, 0x16d1d4, 0x16d288, 0x16d2e0, 0x16d3bc, 0x16d3c0, 0x16d3c4, 0x16d3e4, 0x16d4dc, 0x16d58c, 0x16d5a0, 0x16d684, 0x16d908, 0x16db1c, 0x16e478, 0x16e98c, 0x16e9f8, 0x16eb34, 0x16ec74, 0x16ee9c, 0x16f89c, 0x16fa30, 0x16fd18, 0x16ff10, 0x170268, 0x17038c, 0x1705fc, 0x170668, 0x17074c, 0x170760, 0x170974, 0x170bb8, 0x170c30, 0x170fcc, 0x17107c, 0x171134, 0x171be8, 0x1721a4, 0x1724f4, 0x172508, 0x172660, 0x172968, 0x172aa4, 0x172d30, 0x172d78, 0x172dc0, 0x172e08, 0x172e50, 0x172e98, 0x173124, 0x17314c, 0x173174, 0x17365c, 0x173690, 0x173774, 0x17392c, 0x173fbc, 0x1742c8, 0x174618, 0x174648, 0x174730, 0x174b58, 0x174fe8, 0x1752bc, 0x175878, 0x175c68, 0x176390, 0x176410, 0x1764b4, 0x1764f8, 0x176d14, 0x177174, 0x1772f4, 0x177488, 0x178488, 0x179314, 0x179754, 0x179bec, 0x179d20, 0x179e78, 0x179fd0, 0x17a128, 0x17a280, 0x17a3d8, 0x17a530, 0x17a688, 0x17a7e0, 0x17a938, 0x17aa90, 0x17abe8, 0x17ace8, 0x17ae74, 0x17af14, 0x17b4f4, 0x17bf70, 0x17c514, 0x17cd74, 0x17ce08, 0x17d040, 0x17d994, 0x17db3c, 0x17dec0, 0x17e12c, 0x17e6b0, 0x17ea9c, 0x17f5f8, 0x17fb5c, 0x17fc80, 0x180060, 0x18006c, 0x180070, 0x1800a4, 0x1800c4, 0x18019c, 0x180218, 0x180290, 0x180298, 0x1802a0, 0x1802a8, 0x1802b0, 0x1802b8, 0x1802c0, 0x180348, 0x180384, 0x1803c8, 0x180424, 0x180460, 0x180650, 0x1806ec, 0x18078c, 0x180824, 0x1808b8, 0x180944, 0x180980, 0x181438, 0x1815c0, 0x181658, 0x1816b0, 0x182944, 0x18298c, 0x182abc, 0x182bf4, 0x182c98, 0x182cec, 0x182d88, 0x183094, 0x1832e4, 0x1833e4, 0x1834dc, 0x183558, 0x1837e0, 0x1837fc, 0x183890, 0x183988, 0x183a64, 0x183bd4, 0x183bf4, 0x183c38, 0x183d90, 0x183d98, 0x183f14, 0x183f4c, 0x183f9c, 0x183fd4, 0x184078, 0x184400, 0x184b74, 0x184e48, 0x18511c, 0x185520, 0x1863f4, 0x186488, 0x18658c, 0x186598, 0x1865a8, 0x1865b8, 0x1865dc, 0x186600, 0x186658, 0x186688, 0x186774, 0x1867f8, 0x186830, 0x186874, 0x186898, 0x1868bc, 0x186df4, 0x186e48, 0x186e50, 0x186e7c, 0x186fdc, 0x18716c, 0x187184, 0x18725c, 0x18735c, 0x1874a8, 0x187858, 0x187a14, 0x187aac, 0x187df8, 0x187fd4, 0x188144, 0x1882a8, 0x18840c, 0x188570, 0x1886d4, 0x1888f0, 0x188b0c, 0x188ba4, 0x188cc0, 0x188d24, 0x188f1c, 0x188f44, 0x188f84, 0x188f94, 0x18912c, 0x1892e0, 0x1893c8, 0x1893d8, 0x189654, 0x189658, 0x18965c, 0x189660, 0x1898b0, 0x189918, 0x18993c, 0x189a64, 0x189b10, 0x189c18, 0x189cb0, 0x189d80, 0x189e28, 0x189fa4, 0x189fa8, 0x189fdc, 0x189ffc, 0x18a020, 0x18a058, 0x18a07c, 0x18a0b4, 0x18a0d8, 0x18a110, 0x18a134, 0x18a16c, 0x18a190, 0x18a1c8, 0x18a1ec, 0x18a224, 0x18a248, 0x18a280, 0x18a2a4, 0x18a2b0, 0x18a2b8, 0x18a304, 0x18a30c, 0x18a358, 0x18a35c, 0x18a390, 0x18a3b0, 0x18a480, 0x18a598, 0x18a634, 0x18a6bc, 0x18a74c, 0x18a7ec, 0x18a8cc, 0x18a9ac, 0x18aab0, 0x18ab7c, 0x18abb0, 0x18ad00, 0x18ae24, 0x18af4c, 0x18b028, 0x18b074, 0x18bad4, 0x18bbf8, 0x18bd04, 0x18c024, 0x18c620, 0x18ce34, 0x18d070, 0x18d8c4, 0x18d93c, 0x18da00, 0x18da48, 0x18dae8, 0x18db88, 0x18dc28, 0x18dc4c, 0x18dcc0, 0x18dd8c, 0x18dd90, 0x18dd94, 0x18dda8, 0x18ddb8, 0x18e244, 0x18e8d0, 0x18f6ac, 0x18f8b0, 0x18f8d8, 0x18fb64, 0x18fbb0, 0x18fc9c, 0x18fe18, 0x18fea8, 0x1926f0, 0x192c54, 0x192cd4, 0x192d54, 0x192da0, 0x192e3c, 0x192e78, 0x192f10, 0x192f4c, 0x192fe8, 0x193034, 0x19307c, 0x193274, 0x1932ac, 0x1932e4, 0x19331c, 0x1933fc, 0x1934cc, 0x1935bc, 0x1937ac, 0x19384c, 0x193a2c, 0x193bf4, 0x193cec, 0x193ddc, 0x194114, 0x1942d0, 0x194514, 0x194758, 0x194948, 0x194b30, 0x194e44, 0x195008, 0x1952e8, 0x1953d8, 0x1954d0, 0x19570c, 0x195cac, 0x195e6c, 0x195ffc, 0x196010, 0x196160, 0x196164, 0x196168, 0x1962b8, 0x1962bc, 0x196430, 0x196434, 0x196598, 0x19659c, 0x196640, 0x196644, 0x196b24, 0x196c9c, 0x196cc0, 0x196ce0, 0x196e58, 0x196e94, 0x196f08, 0x19709c, 0x1970b8, 0x1970bc, 0x1970c0, 0x197144, 0x197424, 0x197478, 0x197488, 0x197498, 0x1974d4, 0x1974e4, 0x1974f4, 0x19766c, 0x197898, 0x197940, 0x197960, 0x19796c, 0x197984, 0x197994, 0x197a7c, 0x197d5c, 0x197e44, 0x197f48, 0x197f50, 0x197f54, 0x197f5c, 0x197fb0, 0x198070, 0x1982bc, 0x1982c8, 0x1982d0, 0x1982d8, 0x198300, 0x19830c, 0x1983e8, 0x198408, 0x198420, 0x198708, 0x198774, 0x19885c, 0x198b3c, 0x198c24, 0x198d28, 0x198d30, 0x198d3c, 0x198d40, 0x198d48, 0x198d9c, 0x198e5c, 0x19955c, 0x199568, 0x199570, 0x199578, 0x199688, 0x199794, 0x1997b4, 0x1997c0, 0x1997d8, 0x1997e8, 0x1998d0, 0x199bb0, 0x199c98, 0x199d9c, 0x199da4, 0x199da8, 0x199db0, 0x199e04, 0x199ec4, 0x19a110, 0x19a11c, 0x19a124, 0x19a12c, 0x19a14c, 0x19a158, 0x19a170, 0x19a3e0, 0x19a44c, 0x19a534, 0x19a814, 0x19a8fc, 0x19aa00, 0x19aa08, 0x19aa0c, 0x19aa14, 0x19aa68, 0x19ab0c, 0x19b568, 0x19b574, 0x19b57c, 0x19b584, 0x19b640, 0x19b760, 0x19b7ec, 0x19b844, 0x19b870, 0x19bc9c, 0x19c6e0, 0x19c7ac, 0x19c920, 0x19ccd4, 0x19cd44, 0x19cd74, 0x19d238, 0x19d2cc, 0x19d360, 0x19d3e4, 0x19d56c, 0x19d750, 0x19d894, 0x19da08, 0x19db48, 0x19dca4, 0x19e088, 0x19e110, 0x19e508, 0x19ea48, 0x19ed64, 0x19f0a0, 0x19f358, 0x19f500, 0x19f608, 0x19f67c, 0x19f68c, 0x19f6dc, 0x19f70c, 0x19f7c4, 0x19f7ec, 0x19f984, 0x19fdd8, 0x19ff98, 0x1a0330, 0x1a0418, 0x1a0760, 0x1a0c34, 0x1a0c88, 0x1a0e00, 0x1a0f58, 0x1a1110, 0x1a1114, 0x1a11a0, 0x1a12ec, 0x1a16a4, 0x1a171c, 0x1a181c, 0x1a1908, 0x1a19ec, 0x1a1a70, 0x1a1ae8, 0x1a1b64, 0x1a1b74, 0x1a1b78, 0x1a1b7c, 0x1a1c78, 0x1a1c88, 0x1a1c8c, 0x1a1c90, 0x1a1d84, 0x1a1e74, 0x1a1ef0, 0x1a2034, 0x1a2108, 0x1a2160, 0x1a2378, 0x1a2380, 0x1a23cc, 0x1a24c4, 0x1a25e0, 0x1a2718, 0x1a2830, 0x1a2938, 0x1a2984, 0x1a2a94, 0x1a2ba0, 0x1a2cac, 0x1a2ddc, 0x1a3150, 0x1a3204, 0x1a3228, 0x1a325c, 0x1a3260, 0x1a327c, 0x1a32c0, 0x1a3434, 0x1a3438, 0x1a3450, 0x1a46b8, 0x1a62e4, 0x1a648c, 0x1a6d4c, 0x1a6f40, 0x1a7de0, 0x1a7f58, 0x1a8150, 0x1a8168, 0x1a8300, 0x1a8308, 0x1a847c, 0x1a8728, 0x1a88a4, 0x1a898c, 0x1a8ad4, 0x1a8aec, 0x1a8c24, 0x1a8c84, 0x1a8e60, 0x1a8f58, 0x1a9074, 0x1a9190, 0x1a9248, 0x1a92c0, 0x1a9484, 0x1a94a8, 0x1a94b0, 0x1a94b8, 0x1a94ec, 0x1a9558, 0x1a9650, 0x1a9670, 0x1a96a0, 0x1a9f9c, 0x1a9fbc, 0x1a9fd4, 0x1aa7c4, 0x1aa7f4, 0x1aacfc, 0x1aada8, 0x1aadc8, 0x1aadd4, 0x1aae90, 0x1aaf48, 0x1aaf54, 0x1aaf5c, 0x1aaff4, 0x1ab088, 0x1ab0fc, 0x1ab16c, 0x1ab220, 0x1ab228, 0x1ab230, 0x1ab244, 0x1ab24c, 0x1ab2e4, 0x1ab378, 0x1ab410, 0x1ab4a4, 0x1ab518, 0x1ab588, 0x1ab5fc, 0x1ab66c, 0x1ab704, 0x1ab798, 0x1ab80c, 0x1ab87c, 0x1ab8dc, 0x1ab950, 0x1ab9c0, 0x1aba34, 0x1abaa4, 0x1abadc, 0x1abb10, 0x1abb84, 0x1abbf4, 0x1abc5c, 0x1abcc0, 0x1abcc4, 0x1abcd4, 0x1abdb4, 0x1abe90, 0x1abeb0, 0x1abf0c, 0x1ac0d4, 0x1ac108, 0x1ac170, 0x1ac1f0, 0x1ac210, 0x1ae394, 0x1ae4c4, 0x1ae4dc, 0x1ae4e4, 0x1ae4f8, 0x1ae528, 0x1ae540, 0x1ae5b4, 0x1ae624, 0x1ae65c, 0x1ae690, 0x1ae6c8, 0x1ae6fc, 0x1ae714, 0x1ae72c, 0x1ae778, 0x1ae790, 0x1af394, 0x1afc80, 0x1afe2c, 0x1afe4c, 0x1afe6c, 0x1afe8c, 0x1afe90, 0x1aff58, 0x1b0108, 0x1b0120, 0x1b01dc, 0x1b0294, 0x1b02b4, 0x1b03ac, 0x1b04a0, 0x1b04f0, 0x1b053c, 0x1b058c, 0x1b05d8, 0x1b06b8, 0x1b0794, 0x1b0868, 0x1b0938, 0x1b0944, 0x1b095c, 0x1b0974, 0x1b098c, 0x1b0b58, 0x1b0fe4, 0x1b1010, 0x1b18f0, 0x1b19bc, 0x1b1ce8, 0x1b26b4, 0x1b26d4, 0x1b26f4, 0x1b27c8, 0x1b2898, 0x1b2918, 0x1b2994, 0x1b29a8, 0x1b29b8, 0x1b29d0, 0x1b29f0, 0x1b2a64, 0x1b2ad4, 0x1b2d70, 0x1b2d90, 0x1b2d98, 0x1b2da8, 0x1b2dc8, 0x1b2de0, 0x1b2e04, 0x1b2e78, 0x1b2f20, 0x1b2f58, 0x1b2f8c, 0x1b3070, 0x1b3080, 0x1b309c, 0x1b311c, 0x1b3198, 0x1b3218, 0x1b3294, 0x1b32f0, 0x1b3348, 0x1b3368, 0x1b3384, 0x1b3440, 0x1b34f8, 0x1b3524, 0x1b354c, 0x1b36f4, 0x1b3714, 0x1b3758, 0x1b3798, 0x1b37dc, 0x1b381c, 0x1b38e8, 0x1b3960, 0x1b3b00, 0x1b3f0c, 0x1b3f74, 0x1b4040, 0x1b4100, 0x1b41dc, 0x1b53a8, 0x1b5500, 0x1b56f8, 0x1b578c, 0x1b586c, 0x1b5b50, 0x1b5d04, 0x1b5de4, 0x1b5e54, 0x1b5ec4, 0x1b6080, 0x1b60e8, 0x1b6180, 0x1b6270, 0x1b6448, 0x1b6470, 0x1b6498, 0x1b64c0, 0x1b6528, 0x1b6540, 0x1b6578, 0x1b6678, 0x1b6680, 0x1b6694, 0x1b6698, 0x1b66a8, 0x1b66d0, 0x1b670c, 0x1b6710, 0x1b6800, 0x1b6810, 0x1b6814, 0x1b6818, 0x1b682c, 0x1b6874, 0x1b6898, 0x1b68a4, 0x1b6974, 0x1b69cc, 0x1b69d8, 0x1b6aa8, 0x1b6b58, 0x1b6bac, 0x1b6bc4, 0x1b6c94, 0x1b6cb0, 0x1b6dac, 0x1b6de0, 0x1b6de4, 0x1b6e08, 0x1b6e94, 0x1b6ea8, 0x1b6eac, 0x1b6eb0, 0x1b6eb4, 0x1b6f00, 0x1b6f14, 0x1b6f5c, 0x1b7068, 0x1b706c, 0x1b7084, 0x1b7088, 0x1b71b4, 0x1b71b8, 0x1b71f8, 0x1b71fc, 0x1b7340, 0x1b7348, 0x1b7350, 0x1b73e8, 0x1b74c4, 0x1b74c8, 0x1b7510, 0x1b7518, 0x1b7580, 0x1b7664, 0x1b7680, 0x1b770c, 0x1b7710, 0x1b782c, 0x1b7890, 0x1b7898, 0x1b78c8, 0x1b78cc, 0x1b7960, 0x1b79a0, 0x1b79d4, 0x1b7a08, 0x1b7abc, 0x1b7b38, 0x1b7bac, 0x1b7bc4, 0x1b7bdc, 0x1b7bfc, 0x1b7c14, 0x1b7c30, 0x1b7c40, 0x1b7c50, 0x1b7c54, 0x1b7cb0, 0x1b7ccc, 0x1b7ce4, 0x1b7d50, 0x1b7d64, 0x1b7d74, 0x1b7d78, 0x1b7d7c, 0x1b7d90, 0x1b7da0, 0x1b7da4, 0x1b7db0, 0x1b7db4, 0x1b7db8, 0x1b7dbc, 0x1b7dd0, 0x1b7dd4, 0x1b7df8, 0x1b7e04, 0x1b7e18, 0x1b7e3c, 0x1b7e48, 0x1b86cc, 0x1b86f8, 0x1b8a68, 0x1b8ae4, 0x1b8c38, 0x1b8c4c, 0x1b8c50, 0x1b8c54, 0x1b8c60, 0x1b8c64, 0x1b8c70, 0x1b8c74, 0x1b8c98, 0x1b8c9c, 0x1b8ca0, 0x1b8cc4, 0x1b8ce8, 0x1b8d0c, 0x1b8d30, 0x1b8d54, 0x1b8d78, 0x1b8d9c, 0x1b8dc0, 0x1b8de4, 0x1b8e08, 0x1b8e14, 0x1b8e1c, 0x1b8e24, 0x1b8e30, 0x1b8ef4, 0x1b8f5c, 0x1b8fd4, 0x1b9120, 0x1b9140, 0x1b92e4, 0x1b9410, 0x1b975c, 0x1b989c, 0x1b9940, 0x1b9b30, 0x1b9be4, 0x1b9c84, 0x1b9cd8, 0x1b9d34, 0x1b9d3c, 0x1b9d90, 0x1b9dec, 0x1b9df4, 0x1b9e50, 0x1b9eac, 0x1b9f08, 0x1b9f64, 0x1b9fc0, 0x1ba01c, 0x1ba078, 0x1ba07c, 0x1ba080, 0x1ba094, 0x1ba098, 0x1ba0bc, 0x1ba0c8, 0x1ba0dc, 0x1ba0e0, 0x1ba104, 0x1ba110, 0x1ba124, 0x1ba128, 0x1ba13c, 0x1ba140, 0x1ba17c, 0x1ba1f8, 0x1ba20c, 0x1ba278, 0x1ba28c, 0x1ba2bc, 0x1ba31c, 0x1ba398, 0x1ba3ac, 0x1ba418, 0x1ba42c, 0x1ba45c, 0x1ba4bc, 0x1ba538, 0x1ba5a8, 0x1ba5bc, 0x1ba628, 0x1ba63c, 0x1ba654, 0x1ba658, 0x1ba730, 0x1ba7a0, 0x1ba7fc, 0x1ba848, 0x1ba85c, 0x1ba944, 0x1ba98c, 0x1baa1c, 0x1bab44, 0x1bab60, 0x1bab88, 0x1babb0, 0x1baf90, 0x1bb014, 0x1bb3c4, 0x1bb40c, 0x1bb4e0, 0x1bb614, 0x1bb6c8, 0x1bc5ac, 0x1bc614, 0x1bc628, 0x1bc634, 0x1bc650, 0x1bc6b0, 0x1c4580, 0x1c4624, 0x1c9634, 0x1c97d8, 0x1c97dc, 0x1c9800, 0x1ca790, 0x1ca794, 0x1ca7b4, 0x1cb65c, 0x1cb660, 0x1cb670, 0x1cbde8, 0x1cbdec, 0x1cbdf0, 0x1cc090, 0x1cc178, 0x1cc17c, 0x1cc198, 0x1ce3a8, 0x1ce3ac, 0x1ce3bc, 0x1ce3cc, 0x1ce3dc, 0x1ce3f4, 0x1ce410, 0x1ce434, 0x1cfda4, 0x1cff68, 0x1cff9c, 0x1d5a90, 0x1d5a94, 0x1d5aa4, 0x1d5ae0, 0x1d5c08, 0x1d5ce8, 0x1d5cec, 0x1d5d08, 0x1d7744, 0x1d77f8, 0x1d8228, 0x1d822c, 0x1d8240, 0x1d874c, 0x1d880c, 0x1d8ad0, 0x1d8b18, 0x1d9650, 0x1d96a8, 0x1d96b8, 0x1d96c8, 0x1d96f0, 0x1d9718, 0x1d9740, 0x1d9a7c, 0x1d9aa4, 0x1da2e4, 0x1da2e8, 0x1da2f4, 0x1da458, 0x1da470, 0x1db90c, 0x1db910, 0x1db930, 0x1e36e4, 0x1e384c, 0x1e394c, 0x1e3fe4, 0x1e4094, 0x1e4788, 0x1e478c, 0x1e47a4, 0x1e487c, 0x1e49c4, 0x1e4ac0, 0x1e4ae8, 0x1e4c10, 0x1e4db0, 0x1e4eb4, 0x1e4ec0, 0x1e501c, 0x1e5090, 0x1e50f8, 0x1e5114, 0x1e5118, 0x1e513c, 0x1e5150, 0x1e5190, 0x1e5230, 0x1e5244, 0x1e5290, 0x1e52e4, 0x1e5308, 0x1e530c, 0x1e5330, 0x1e533c, 0x1e5340, 0x1e5344, 0x1e5388, 0x1e538c, 0x1e5394, 0x1e54bc, 0x1e54c0, 0x1e54c4, 0x1e54c8, 0x1e54d0, 0x1e54d4, 0x1e551c, 0x1e5520, 0x1e5528, 0x1e555c, 0x1e5580, 0x1e559c, 0x1e55d4, 0x1e5614, 0x1e5628, 0x1e563c, 0x1e567c, 0x1e84b0, 0x1e90d0, 0x1e926c, 0x1e9384, 0x1e99ec, 0x1e9a00, 0x1e9cc8, 0x1e9ccc, 0x1e9cd0, 0x1e9d20, 0x1e9d50, 0x1e9d58, 0x1e9dbc, 0x1e9de8, 0x1e9e28, 0x1ea074, 0x1ea110, 0x1ea73c, 0x1ea750, 0x1ea7a0, 0x1ea7a4, 0x1ea830, 0x1ea8d4, 0x1eaaf8, 0x1eac10, 0x1ead78, 0x1eae04, 0x1eae90, 0x1eaec0, 0x1eaefc, 0x1eaf34, 0x1eaf64, 0x1eaf70, 0x1eaf80, 0x1eafb8, 0x1eb1c4, 0x1eb1c8, 0x1eb254, 0x1eb2bc, 0x1eb310, 0x1eb31c, 0x1eb350, 0x1eb364, 0x1eb3a8, 0x1eb3e8, 0x1eb3f4, 0x1eb460, 0x1eb468, 0x1eb470, 0x1eb4fc, 0x1eb508, 0x1eb514, 0x1eb54c, 0x1eb584, 0x1eb5ac, 0x1ebbc0, 0x1ebcfc, 0x1ebdb0, 0x1ebee0, 0x1ebee4, 0x1ebef4, 0x1ebefc, 0x1ebf04, 0x1ebf0c, 0x1ebf20, 0x1ec02c, 0x1ec174, 0x1ec23c, 0x1ec248, 0x1ec268, 0x1ec274, 0x1ec298, 0x1ec2a8, 0x1ec2b0, 0x1ec2b8, 0x1ec2c0, 0x1ec38c, 0x1ec3b8, 0x1ec660, 0x1ec668, 0x1ec670, 0x1ec678, 0x1ec680, 0x1ec684, 0x1ec688, 0x1ec69c, 0x1ec6e0, 0x1ec730, 0x1ec754, 0x1ec790, 0x1ec814, 0x1ec838, 0x1ec844, 0x1ec850, 0x1ec8ac, 0x1ec908, 0x1eca3c, 0x1eca44, 0x1eca4c, 0x1eca60, 0x1ecae8, 0x1ecb24, 0x1eccd8, 0x1ed2e4, 0x1ed2f4, 0x1ed4b0, 0x1ed544, 0x1ed764, 0x1ed92c, 0x1eddc0, 0x1ee384, 0x1ee78c, 0x1ef318, 0x1ef574, 0x1ef628, 0x1ef814, 0x1ef8bc, 0x1efac8, 0x1efcc0, 0x1f059c, 0x1f09f8, 0x1f0a00, 0x1f0db4, 0x1f13fc, 0x1f1404, 0x1f1734, 0x1f1954, 0x1f2098, 0x1f209c, 0x1f20a0, 0x1f2274, 0x1f228c, 0x1f22b0, 0x1f22ec, 0x1f2330, 0x1f2764, 0x1f2788, 0x1f27c4, 0x1f2b10, 0x1f2b7c, 0x1f2c7c, 0x1f2ddc, 0x1f32c8, 0x1f36cc, 0x1f36d4, 0x1f36d8, 0x1f36dc, 0x1f36e0, 0x1f36e4, 0x1f36e8, 0x1f36ec, 0x1f36f0, 0x1f36f4, 0x1f4360, 0x1f4508, 0x1f450c, 0x1f4510, 0x1f4514, 0x1f4518, 0x1f451c, 0x1f4520, 0x1f4524, 0x1f4528, 0x1f48e0, 0x1f4d94, 0x1f4f68, 0x1f513c, 0x1f58c8, 0x1f8584, 0x1f8f4c, 0x1f90f4, 0x1f92c8, 0x1fbf60, 0x1fc37c, 0x1fc550, 0x1fefd8, 0x1ff0f4, 0x1ff424, 0x1ff8e8, 0x1ffba0, 0x1ffc10, 0x1ffcbc, 0x1ffcc0, 0x1ffcf4, 0x1ffd14, 0x1ffe18, 0x1ffec0, 0x1ffec4, 0x1ffef8, 0x1fff18, 0x1fffe8, 0x2001a0, 0x200394, 0x200650, 0x2006c4, 0x200738, 0x200960, 0x200ac0, 0x200d54, 0x200d90, 0x200f90, 0x2010b4, 0x201238, 0x201440, 0x201b20, 0x201b28, 0x201c24, 0x201d9c, 0x20245c, 0x202554, 0x2025f0, 0x202718, 0x202c98, 0x203038, 0x2038c0, 0x203ed0, 0x204678, 0x204bc4, 0x204cc0, 0x204dd4, 0x204f7c, 0x20510c, 0x205ad8, 0x20691c, 0x2069dc, 0x206ce8, 0x206d94, 0x2071c0, 0x2071ec, 0x2075ac, 0x2075c8, 0x2076b8, 0x207908, 0x20795c, 0x207960, 0x207964, 0x207a08, 0x207a78, 0x207af0, 0x207b54, 0x208050, 0x208068, 0x2080cc, 0x208198, 0x2082a0, 0x208310, 0x208370, 0x2083d8, 0x2084c4, 0x208558, 0x2087a8, 0x20895c, 0x208a70, 0x208bc8, 0x208d14, 0x208d84, 0x208ee8, 0x209010, 0x2090b4, 0x20916c, 0x2091dc, 0x20924c, 0x20940c, 0x209674, 0x209cbc, 0x209d88, 0x20a5d0, 0x20a7d0, 0x20a86c, 0x20ad24, 0x20ad60, 0x20ae04, 0x20af0c, 0x20b4e0, 0x20b4f4, 0x20b570, 0x20b8f4, 0x20b900, 0x20b904, 0x20b938, 0x20b958, 0x20b98c, 0x20ba5c, 0x20bb74, 0x20bd54, 0x20be40, 0x20bf2c, 0x20c0dc, 0x20c3b8, 0x20d070, 0x20d0ec, 0x20d138, 0x20d2d0, 0x20d36c, 0x20d4b8, 0x20def4, 0x20e010, 0x20e0cc, 0x20e21c, 0x20e35c, 0x20e4d8, 0x20e7c0, 0x20e824, 0x20e91c, 0x20eaa4, 0x20ec48, 0x20ecbc, 0x20ed30, 0x20f5ac, 0x20f768, 0x20fa70, 0x210574, 0x2108c8, 0x210ac0, 0x212ee8, 0x2133b8, 0x2142ac, 0x21587c, 0x215a24, 0x215bd8, 0x216198, 0x2161a4, 0x2161ac, 0x2161f0, 0x216230, 0x216274, 0x2162b4, 0x2162d4, 0x2163ac, 0x216504, 0x217188, 0x217444, 0x217510, 0x2175e0, 0x217600, 0x217618, 0x217620, 0x217640, 0x217660, 0x217680, 0x217698, 0x2178bc, 0x217adc, 0x217b20, 0x217c3c, 0x217db8, 0x217ffc, 0x218cb0, 0x218f34, 0x2191f0, 0x219294, 0x219350, 0x21944c, 0x2195d0, 0x2196c4, 0x219720, 0x219728, 0x21972c, 0x219910, 0x219a58, 0x219bec, 0x219c14, 0x219c54, 0x219d44, 0x219e58, 0x219e94, 0x219eec, 0x219ff8, 0x21a000, 0x21a058, 0x21a060, 0x21a074, 0x21a07c, 0x21a084, 0x21a08c, 0x21a0b4, 0x21a0bc, 0x21a0c4, 0x21a13c, 0x21a634, 0x21aa50, 0x21afe8, 0x21b20c, 0x21b2d8, 0x21b324, 0x21b3e4, 0x21b4d0, 0x21b5c4, 0x21b5c8, 0x21b750, 0x21b844, 0x21b940, 0x21ba3c, 0x21ba60, 0x21bb30, 0x21bb58, 0x21bb98, 0x21bbb4, 0x21bc74, 0x21bd28, 0x21bd88, 0x21bde8, 0x21be48, 0x21bf38, 0x21bfc8, 0x21c0c4, 0x21c224, 0x21c234, 0x21c648, 0x21c6e4, 0x21c844, 0x21c978, 0x21cef0, 0x21cf74, 0x21cf80, 0x21cfc0, 0x21d030, 0x21d03c, 0x21d068, 0x21d158, 0x21d15c, 0x21d180, 0x271fc0, 0x271fc8, 0x271fd0, 0x271fd8, 0x271fe0, 0x271fe8, 0x271ff0, 0x271ff8, 0x272000, 0x272008, 0x272010, 0x272018, 0x272020, 0x272028, 0x272030, 0x272038, 0x272040, 0x272048, 0x272050, 0x272058, 0x272060, 0x272068, 0x272070, 0x272078, 0x272080, 0x272088, 0x272090, 0x272098, 0x2720a0, 0x2720a8, 0x2720b0, 0x2720b8, 0x2720c0, 0x2720c8, 0x2720d0, 0x2720d8, 0x2720e0, 0x2720e8, 0x2720f0, 0x2720f8, 0x272100, 0x272108, 0x272110, 0x272118, 0x272120, 0x272128, 0x272130, 0x272138, 0x272140, 0x272148, 0x272150, 0x272158, 0x272160, 0x272168, 0x272170, 0x272178, 0x272180, 0x272188, 0x272190, 0x272198, 0x2721a0, 0x2721a8, 0x2721b0, 0x2721b8, 0x2721c0, 0x2721c8, 0x2721d0, 0x2721d8, 0x2721e0, 0x2721e8, 0x2721f0, 0x2721f8, 0x272200, 0x272208, 0x272210, 0x272218, 0x272220, 0x272228, 0x272230, 0x272238, 0x272240, 0x272248, 0x272250, 0x272258, 0x272260, 0x272268, 0x272270, 0x272278, 0x272280, 0x272288, 0x272290, 0x272298, 0x2722a0, 0x2722a8, 0x2722b0, 0x2722b8, 0x2722d0, 0x2722d8, 0x2722e0, 0x2722e8, 0x2722f8, 0x272300, 0x272308, 0x272310, 0x272318, 0x272320, 0x272328, 0x272330, 0x272338, 0x272340, 0x272348, 0x272350, 0x272358, 0x272360, 0x272368, 0x272370, 0x272378, 0x272380, 0x272388, 0x272390, 0x272398, 0x2723a0, 0x2723a8, 0x2723b0, 0x2723b8, 0x2723c0, 0x2723c8, 0x2723d0, 0x2723d8, 0x2723e0, 0x2723e8, 0x2723f0, 0x2723f8, 0x272400, 0x272408, 0x272410, 0x272418, 0x272420, 0x272428, 0x272430, 0x272438, 0x272440, 0x272448, 0x272450, 0x272458, 0x272460, 0x272468, 0x272470, 0x272478, 0x272480, 0x272488, 0x272490, 0x272498, 0x2724a0, 0x2724a8, 0x2724b0, 0x2724b8, 0x2724c0, 0x2724c8, 0x2724d0, 0x2724d8, 0x2724e0, 0x2724e8, 0x2724f0, 0x2724f8, 0x272500, 0x272508, 0x272510, 0x272518];
var func_name_Main = ["sub_115130", "opendir", "j__ZNSt16invalid_argumentD2Ev", "execve", "fdopen", "j__ZNSt3__120__throw_system_errorEiPKc", "j__ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendIPcEENS_9enable_ifIXsrNS_21__is_forward_iteratorIT_EE5valueERS5_E4typeESA_SA_", "memcmp", "listen", "ioctl", "__errno", "flock", "remove", "j__Unwind_GetDataRelBase", "deflateEnd", "abort", "j__Unwind_Find_FDE", "realloc", "connect", "write", "j___cxa_get_globals_fast", "dup2", "pthread_self", "_exit", "j___cxa_throw", "srandom", "sscanf", "j__ZNSt3__115system_categoryEv", "fsync", "gettimeofday", "j_interpreter_wrap_int64_t", "srand", "getpagesize", "inflate", "pipe", "pthread_cond_broadcast", "epoll_create", "access", "j___cxa_end_catch", "snprintf", "j___deregister_frame_info", "j__Unwind_SetGR", "j__ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_", "signal", "lseek", "j__ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm", "getpid", "j_strcmp", "readdir", "j__ZNSt3__112future_errorC2ENS_10error_codeE", "creat", "time", "j___self_kill", "inflateInit2_", "memset", "unlink", "strlcpy", "j__Znwm", "j_log_internal_impl", "dladdr", "fmodf", "malloc", "j__Unwind_GetLanguageSpecificData", "getcwd", "fork", "fmod", "random", "dlopen", "memmove", "gethostbyname", "strcat", "pthread_join", "rand", "fflush", "strncmp", "pthread_exit", "recv", "isxdigit", "strcpy", "j__Unwind_DeleteException", "strrchr", "fstat", "__cxa_atexit", "pthread_key_delete", "lstat", "j__ZNSt3__16vectorIiNS_9allocatorIiEEE21__push_back_slow_pathIRKiEEvOT_", "closedir", "pthread_create", "fclose", "setenv", "j_DobbyHook", "strdup", "inet_addr", "sleep", "open", "j__ZNSt11logic_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE", "pow", "strlcat", "strstr", "__assert2", "epoll_wait", "vfprintf", "kill", "deflateInit_", "munmap", "pthread_cond_wait", "pthread_setspecific", "deflate", "strchr", "chmod", "j___deregister_frame_info_bases", "pthread_mutex_destroy", "gettid", "bind", "getppid", "adler32", "popen", "j__ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_", "pthread_cond_destroy", "fnmatch", "dl_iterate_phdr", "j__ZNSt9exceptionD2Ev", "waitpid", "fwrite", "j___cxa_rethrow_primary_exception", "j__ZNSt9type_infoD2Ev", "j__ZSt15get_new_handlerv", "llabs", "deflateBound", "readlink", "strncpy", "__cxa_finalize", "j___register_frame_info", "j___read_self", "exit", "raise", "dlclose", "vprintf", "j___cxa_uncaught_exception", "send", "atoll", "fgets", "lseek64", "j___cxa_get_globals", "inflateEnd", "pthread_mutex_init", "__android_log_vprint", "j___register_frame_info_table", "strtoul", "socket", "close", "j__ZNSt3__119__thread_local_dataEv", "epoll_ctl", "sysconf", "j___cxa_demangle", "j__Unwind_RaiseException", "calloc", "j__Unwind_SetIP", "execl", "getsockopt", "j__ZdaPv", "j__ZNSt11logic_errorC2EPKc", "read", "j___cxa_allocate_exception", "j___register_frame_info_bases", "j__Unwind_GetRegionStart", "fputc", "prctl", "j__ZdlPv", "j__Unwind_GetTextRelBase", "j__ZSt9terminatev", "j__Znam", "j__ZSt17rethrow_exceptionSt13exception_ptr", "strtoull", "j__Unwind_GetCFA", "setsockopt", "mkdir", "j___cxa_begin_catch", "pthread_mutex_unlock", "fcntl", "j__ZNSt3__16vectorIiNS_9allocatorIiEEE21__push_back_slow_pathIiEEvOT_", "j___cxa_free_exception", "vsnprintf", "setpgid", "j___cxa_decrement_exception_refcount", "ftruncate", "pthread_mutex_lock", "tolower", "j___dynamic_cast", "nanosleep", "syscall", "mprotect", "isupper", "j__ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev", "free", "toupper", "j__ZNSt9exceptionD2Ev_0", "dlsym", "pclose", "atoi", "stat", "accept", "j___cxa_rethrow", "j___cxa_increment_exception_refcount", "memchr", "j___cxa_current_primary_exception", "vsyslog", "inet_ntoa", "strerror", "fopen", "j__Unwind_Resume", "j__ZNSt15underflow_errorD2Ev", "isspace", "j___self_lseek", "pthread_detach", "strtok", "j_CodePatch", "pwrite", "fileno", "atol", "j__ZSt13get_terminatev", "j__ZNSt13runtime_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE", "pthread_getspecific", "sprintf", "getenv", "pread", "memcpy", "j__ZSt14get_unexpectedv", "pthread_once", "j__Unwind_GetIP", "strlen", "pthread_key_create", "strtol", "j___register_frame_info_table_bases", "__stack_chk_fail", "mmap", "ptrace", "strcasecmp", "getuid", "start", "sub_11603C", "sub_1160B4", "sub_1160C4", "sub_11615C", "sub_1161FC", "sub_1164AC", "sub_1164D8", "sub_116528", "sub_1165C8", "sub_1166FC", "sub_116728", "sub_116750", "sub_116830", "sub_1168F0", "sub_116A80", "sub_116AD8", "sub_116AF4", "sub_116B10", "sub_116B2C", "sub_116B84", "sub_116BA0", "sub_1178E8", "sub_1178FC", "sub_117B68", "sub_117BE0", "sub_117CA0", "sub_117E90", "sub_1180CC", "sub_1182D8", "sub_11859C", "sub_1186B8", "sub_118748", "sub_118AE4", "sub_118C8C", "sub_118D24", "sub_118FB4", "sub_119270", "sub_11959C", "sub_119634", "sub_11BC1C", "JNI_OnLoad", "sub_11BD9C", "sub_11BDA8", "sub_11BE58", "sub_11C1AC", "sub_11C1B4", "sub_11C210", "sub_11C268", "sub_11C300", "sub_11C394", "sub_11CAA4", "sub_11CC18", "sub_11CF8C", "sub_11D134", "sub_11D4C4", "sub_11D694", "nullsub_8", "sub_11D73C", "sub_11E0D8", "sub_11E834", "sub_11F130", "sub_11F1C8", "sub_11F260", "sub_11F3A4", "sub_11F56C", "sub_11F604", "sub_11F69C", "sub_11F768", "sub_11F884", "sub_11FA18", "sub_11FB14", "sub_1200C8", "sub_120194", "sub_1202D4", "sub_12036C", "sub_1203C8", "sub_120404", "sub_120440", "sub_12047C", "sub_1205A0", "sub_120664", "nullsub_9", "sub_120678", "sub_120C30", "sub_121B78", "sub_121BE0", "sub_121C40", "sub_121CD8", "sub_122180", "sub_1222D0", "sub_1222E8", "sub_122AE0", "sub_122B54", "sub_122B5C", "sub_122C7C", "sub_122D14", "sub_123324", "sub_1236B8", "sub_123720", "sub_123970", "sub_123BC0", "sub_123CE8", "sub_124510", "sub_124710", "sub_124900", "sub_124C68", "sub_124F7C", "sub_124FA0", "sub_1253B8", "sub_125650", "sub_125854", "sub_125D2C", "sub_125DC4", "sub_126888", "sub_126920", "sub_126ED8", "sub_126F84", "sub_12743C", "sub_127DCC", "sub_127EA8", "sub_1281E4", "sub_1281EC", "sub_1288DC", "sub_128A2C", "sub_128D44", "sub_128D64", "sub_128D70", "sub_128DB8", "sub_128E60", "sub_128E88", "sub_128F5C", "sub_129468", "sub_129758", "sub_129A04", "sub_12A568", "sub_12AC10", "sub_12AD6C", "sub_12AEB0", "sub_12B9FC", "sub_12BB18", "sub_12BB80", "sub_12BF4C", "sub_12C08C", "sub_12C5D4", "sub_12CC6C", "sub_12D2F8", "sub_12D470", "sub_12D478", "sub_12D480", "sub_12D48C", "sub_12D4A4", "sub_12D4AC", "sub_12D4D8", "sub_12D518", "sub_12D560", "sub_12D84C", "sub_12D9FC", "sub_12DB60", "sub_12DFE4", "sub_12F9F8", "sub_12FA34", "sub_12FA6C", "sub_12FB00", "sub_12FB18", "sub_1317A4", "sub_131958", "sub_131D58", "sub_131E20", "sub_132088", "sub_132518", "sub_132DA8", "sub_1332B8", "sub_136D68", "sub_136DB0", "sub_136FF8", "sub_137164", "sub_137408", "sub_137630", "sub_137820", "sub_137978", "sub_1395A8", "sub_1395C4", "sub_1395EC", "sub_139604", "sub_139628", "sub_139664", "sub_139678", "sub_139698", "sub_1396A0", "sub_1396B4", "sub_1396D0", "sub_1396FC", "sub_13970C", "sub_139728", "sub_139770", "sub_139824", "sub_139828", "sub_13982C", "sub_1398F0", "sub_1399D8", "sub_139ADC", "sub_139BAC", "sub_139BB8", "sub_139CE4", "sub_139CFC", "sub_139D18", "sub_139D40", "sub_139D4C", "sub_139D50", "sub_139D6C", "sub_139D8C", "sub_139DAC", "sub_139DF4", "sub_139E0C", "sub_139E40", "sub_139E7C", "sub_13A4D4", "sub_13A4E4", "sub_13A4FC", "sub_13A53C", "sub_13A55C", "sub_13A588", "sub_13A5A8", "sub_13A5D4", "sub_13A5E4", "sub_13A600", "sub_13A61C", "sub_13A664", "sub_13A670", "sub_13A684", "sub_13A6B4", "sub_13A6D0", "sub_13A79C", "sub_13A7AC", "sub_13A7E0", "sub_13A7E8", "sub_13A808", "sub_13A810", "sub_13A82C", "sub_13A870", "sub_13A894", "sub_13A8AC", "sub_13A8DC", "sub_13A920", "sub_13A95C", "sub_13A9A4", "sub_13A9B4", "sub_13A9D0", "sub_13AA00", "sub_13AA0C", "sub_13AA50", "sub_13AA74", "sub_13AB40", "sub_13B1CC", "sub_13B1D8", "sub_13BC98", "sub_13BCB0", "sub_13BD80", "sub_13BE14", "sub_13BE2C", "sub_13BE4C", "sub_13BE64", "sub_13BE80", "sub_13BEA0", "sub_13BEB8", "sub_13BF30", "sub_13BF50", "sub_13BF70", "sub_13BF90", "sub_13BFB0", "sub_13BFD0", "sub_13BFF0", "sub_13C064", "sub_13C07C", "sub_13C09C", "sub_13C12C", "sub_13C13C", "sub_13C1E4", "sub_13C238", "sub_13C2A8", "sub_13C2F0", "strcmp", "sub_13C384", "sub_13C3CC", "sub_13C4EC", "sub_13C4F0", "sub_13C544", "sub_13D114", "sub_13D288", "sub_13D2EC", "sub_13D30C", "sub_13D310", "sub_13D328", "sub_13D344", "sub_13D38C", "sub_13D394", "sub_13D39C", "sub_13D3A4", "sub_13D460", "sub_13D480", "sub_13D484", "sub_13D49C", "sub_13D4A4", "sub_13D4AC", "sub_13D4C8", "sub_13D538", "sub_13D5D8", "sub_13D5E4", "sub_13D70C", "sub_13DB7C", "sub_13DEA8", "sub_13DF34", "sub_13E0EC", "sub_13E0F8", "sub_13E510", "sub_13E654", "sub_13E784", "sub_13E9AC", "sub_13EAE0", "sub_13EC30", "sub_13EE08", "sub_13EF2C", "sub_13F888", "sub_13F920", "sub_14027C", "sub_140A3C", "sub_1411FC", "sub_1412C0", "sub_1415F0", "sub_141924", "sub_1427E8", "sub_14283C", "sub_14285C", "sub_142894", "sub_1428BC", "sub_14292C", "sub_142954", "sub_1429B8", "sub_1429C0", "sub_1429CC", "sub_142A10", "sub_142AA4", "sub_142ABC", "sub_142EA0", "sub_142FE0", "sub_143008", "sub_143088", "sub_14316C", "sub_143184", "sub_143568", "sub_143848", "sub_143964", "sub_1439FC", "sub_143A38", "sub_143B48", "sub_143C54", "sub_143D24", "sub_143D3C", "sub_143EBC", "sub_1440CC", "sub_14423C", "sub_144360", "sub_1444B8", "sub_144508", "sub_14453C", "sub_144774", "sub_14495C", "sub_144AFC", "sub_144EF0", "sub_144F4C", "sub_14500C", "sub_145018", "sub_145024", "sub_145030", "sub_14503C", "sub_145040", "sub_145078", "sub_1450A4", "sub_145148", "sub_145154", "sub_14516C", "sub_145184", "sub_14519C", "sub_1451B4", "sub_1451CC", "sub_1451E4", "sub_1451FC", "sub_145214", "sub_145228", "sub_145268", "sub_145280", "sub_145298", "sub_1452B0", "sub_1452C8", "sub_1452E0", "sub_1452F8", "sub_145310", "sub_14AA44", "sub_14AA50", "sub_14AA88", "sub_14AAAC", "sub_14AACC", "sub_14AAF0", "sub_14AB14", "sub_14AB34", "sub_14AB68", "sub_14AB78", "sub_14ABB0", "sub_14ABC0", "sub_14ABCC", "sub_14ABF4", "sub_14AC1C", "sub_14AC28", "sub_14AC60", "sub_14AC90", "sub_14AD28", "sub_14ADB8", "sub_14AE70", "sub_14AE7C", "sub_14AE88", "sub_14AEC4", "sub_14AEEC", "sub_14B01C", "sub_14B028", "sub_14B054", "sub_14B090", "sub_14B09C", "sub_14B0BC", "sub_14B104", "sub_14B164", "sub_14B198", "sub_14B1BC", "sub_14B1DC", "sub_14B204", "sub_14B240", "sub_14B250", "sub_14B278", "sub_14B2A8", "sub_14B2E0", "sub_14B304", "sub_14B324", "sub_14B36C", "sub_14B3CC", "sub_14B408", "sub_14B430", "sub_14B46C", "sub_14B4A8", "sub_14B4B4", "sub_14B4EC", "sub_14B4FC", "sub_14B57C", "sub_14B5C4", "sub_14B5D0", "sub_14B638", "sub_14B65C", "sub_14B67C", "sub_14B6F4", "sub_14B740", "sub_14B7A8", "sub_14B7D8", "sub_14B808", "sub_14B814", "sub_14B820", "sub_14B82C", "sub_14B854", "sub_14B868", "sub_14B8D8", "sub_14B908", "sub_14B920", "sub_14B998", "sub_14B9D0", "sub_14B9E0", "sub_14BA00", "sub_14BA0C", "sub_14BA58", "sub_14BA98", "sub_14BAE0", "sub_14BB40", "sub_14BB64", "sub_14BB84", "sub_14BB90", "sub_14BC44", "sub_14BC78", "sub_14BD10", "sub_14BD1C", "sub_14BD28", "sub_14BD4C", "sub_14BD68", "sub_14BD6C", "sub_14BD90", "sub_14BDA0", "sub_14BF9C", "sub_14C18C", "sub_14C198", "sub_14C1A8", "sub_14C1F4", "sub_14C200", "sub_14C24C", "sub_14C25C", "sub_14C2A8", "sub_14C2B4", "sub_14C4B0", "sub_14C75C", "sub_14C7C8", "sub_14C844", "sub_14C848", "sub_14C84C", "sub_14C898", "sub_14C960", "sub_14C978", "sub_14C984", "sub_14C990", "sub_14C9DC", "sub_14C9E8", "sub_14CA30", "sub_14CB2C", "sub_14CD80", "sub_14CDCC", "sub_14CDF4", "sub_14CE04", "sub_14CE50", "sub_14CE5C", "sub_14CE68", "sub_14CF64", "sub_14D17C", "sub_14D1E8", "sub_14D200", "sub_14D214", "sub_14D234", "sub_14D26C", "sub_14D27C", "sub_14D2C8", "sub_14D390", "sub_14D3BC", "sub_14D3E4", "sub_14D3F8", "sub_14D418", "sub_14D440", "sub_14D458", "sub_14D474", "sub_14D570", "sub_14D7E8", "sub_14D810", "sub_14D820", "sub_14D86C", "sub_14D87C", "sub_14D8A0", "sub_14D8B0", "sub_14D8F8", "sub_14D9F4", "sub_14DA04", "sub_14DA08", "sub_14DA54", "sub_14DA60", "sub_14DC5C", "sub_14DDC4", "sub_14DE34", "sub_14DEA8", "sub_14DEB8", "sub_14DEDC", "sub_14DEEC", "sub_14DF3C", "sub_14DFAC", "sub_14E000", "sub_14E004", "sub_14E008", "sub_14E030", "sub_14E0FC", "sub_14E114", "sub_14E128", "sub_14E148", "sub_14E158", "sub_14E17C", "sub_14E18C", "sub_14E1B0", "sub_14E1BC", "sub_14E208", "sub_14E214", "sub_14E238", "sub_14E258", "sub_14E280", "sub_14E34C", "sub_14E364", "sub_14E460", "sub_14E470", "sub_14E494", "sub_14E4A4", "sub_14E4C8", "sub_14E4D0", "sub_14E4DC", "sub_14E5DC", "sub_14E718", "sub_14E728", "sub_14E74C", "sub_14E75C", "sub_14E780", "sub_14E854", "sub_14E8AC", "sub_14E8D4", "sub_14E8EC", "sub_14E8F8", "sub_14E904", "sub_14E94C", "sub_14E958", "sub_14EA54", "sub_14EC90", "sub_14EC9C", "sub_14ECC0", "sub_14ECD0", "sub_14EECC", "sub_14EED8", "sub_14EFD4", "sub_14F228", "sub_14F234", "sub_14F258", "sub_14F268", "sub_14F274", "sub_14F280", "sub_14F2A4", "sub_14F2AC", "sub_14F2B8", "sub_14F304", "sub_14F3D4", "sub_14F448", "sub_14F458", "sub_14F47C", "sub_14F480", "sub_14F484", "sub_14F4A8", "sub_14F6A4", "sub_14F7D4", "sub_14F840", "sub_14F86C", "sub_14F894", "sub_14F8A8", "sub_14F8C8", "sub_14F8D8", "sub_14F8FC", "sub_14F90C", "sub_14F918", "sub_14F964", "sub_14FA2C", "sub_14FA44", "sub_14FA58", "sub_14FA78", "sub_14FA88", "sub_14FAB4", "sub_14FAD4", "sub_14FAD8", "sub_14FB24", "sub_14FBEC", "sub_14FC28", "sub_14FC3C", "sub_14FC5C", "sub_14FC84", "sub_14FC88", "sub_14FC8C", "sub_14FCB0", "sub_14FCFC", "sub_14FD64", "sub_14FD90", "sub_14FDB8", "sub_14FDCC", "sub_14FDEC", "sub_14FE3C", "sub_14FE60", "sub_14FE70", "sub_14FE7C", "sub_14FE88", "sub_14FED4", "sub_14FEDC", "sub_14FEF4", "sub_14FF18", "sub_14FF28", "sub_14FF4C", "sub_14FF50", "sub_14FF54", "sub_14FF78", "sub_14FF9C", "sub_150008", "sub_15006C", "sub_150094", "sub_1500AC", "sub_1500B8", "sub_1500C4", "sub_1500E8", "sub_1501B4", "sub_1501CC", "sub_1501E0", "sub_150200", "sub_150250", "sub_15025C", "sub_1502AC", "sub_1502B8", "sub_1502BC", "sub_1502E4", "sub_1502EC", "sub_1502F0", "sub_150340", "sub_150580", "sub_15058C", "sub_150808", "sub_150814", "sub_150930", "sub_150940", "sub_15094C", "sub_150A6C", "sub_150B94", "sub_150C64", "sub_150CA0", "sub_150CB4", "sub_150CD8", "sub_150CE8", "sub_150D0C", "sub_150D38", "sub_150D44", "sub_150F84", "sub_1510DC", "sub_1510EC", "sub_1510FC", "sub_151338", "sub_151488", "sub_1514F4", "sub_151570", "sub_151598", "sub_1515A8", "sub_1516C8", "sub_151968", "sub_1519D4", "sub_1519FC", "sub_151A54", "sub_151A64", "sub_151CA0", "sub_151F10", "sub_151F5C", "sub_151FC4", "sub_151FEC", "sub_15210C", "sub_15224C", "sub_1522B8", "sub_1522E4", "sub_15230C", "sub_152320", "sub_152340", "sub_152368", "sub_152378", "sub_1523E4", "sub_15240C", "sub_152434", "sub_15244C", "sub_152450", "sub_152474", "sub_152480", "sub_15248C", "sub_15249C", "sub_1524A8", "sub_152574", "sub_15259C", "sub_1525C4", "sub_1525E8", "sub_1525F8", "sub_15261C", "sub_15262C", "sub_152648", "sub_152658", "sub_1526C0", "sub_1526E8", "sub_1527B4", "sub_1527DC", "sub_1527F8", "sub_15284C", "sub_152858", "sub_152860", "sub_152880", "sub_152890", "sub_1528DC", "sub_1528E4", "sub_152904", "sub_15292C", "sub_15293C", "sub_152960", "sub_15297C", "sub_1529A0", "sub_1529A4", "sub_1529A8", "sub_1529CC", "sub_1529E8", "sub_152A04", "sub_152A2C", "sub_152A34", "sub_152A58", "sub_152A90", "sub_152B0C", "sub_152B34", "sub_152B44", "sub_152B80", "sub_152BBC", "sub_152BD0", "sub_152BF0", "sub_152BF4", "sub_152BF8", "sub_152C1C", "sub_152C20", "sub_152C5C", "sub_152C98", "sub_152CAC", "sub_152CCC", "sub_152CE4", "sub_152D00", "sub_152D10", "sub_152D34", "sub_152D5C", "sub_152E2C", "sub_152E84", "sub_152EAC", "sub_152EE0", "sub_153014", "sub_15303C", "sub_153074", "sub_1530DC", "sub_1530F4", "sub_1530FC", "sub_15311C", "sub_15312C", "sub_153150", "sub_153160", "sub_1531A0", "sub_1531C4", "sub_1531CC", "sub_153218", "sub_153280", "sub_153298", "sub_1532AC", "sub_1532CC", "sub_1532D0", "sub_1532D4", "sub_1532F8", "sub_153308", "sub_153354", "sub_153370", "sub_153398", "sub_1533BC", "sub_1534A8", "sub_1534DC", "sub_1535B0", "sub_153608", "sub_153630", "sub_153634", "sub_153640", "sub_153680", "sub_1536AC", "sub_153720", "sub_153730", "sub_153754", "sub_153784", "sub_1537C0", "sub_1537E8", "sub_153804", "sub_153840", "sub_153868", "sub_1538AC", "sub_1538CC", "sub_1538F0", "sub_1539BC", "sub_1539D4", "sub_1539E8", "sub_153A08", "sub_153A0C", "sub_153A10", "sub_153A34", "sub_153A44", "sub_153A78", "sub_153AB8", "sub_153ADC", "sub_153AF4", "sub_153AFC", "sub_153B1C", "sub_153B54", "sub_153B64", "sub_153BA8", "sub_153DC0", "sub_153DCC", "sub_153E18", "sub_153E44", "sub_153E74", "sub_153EA0", "sub_153EC4", "sub_153EF0", "sub_153F00", "sub_153F44", "sub_153F60", "sub_153F68", "sub_153F84", "sub_153F9C", "sub_153FA4", "sub_153FB4", "sub_153FC8", "sub_153FE8", "sub_15400C", "sub_154040", "sub_154058", "sub_154088", "sub_15409C", "sub_1540A8", "sub_1540D0", "sub_1540F0", "sub_154110", "sub_154138", "sub_1541F0", "sub_154238", "sub_154244", "sub_15426C", "sub_154278", "sub_1544B8", "sub_1544E8", "sub_15455C", "sub_15458C", "sub_1545B8", "sub_1545DC", "sub_154610", "sub_154640", "sub_15464C", "sub_154670", "sub_154698", "sub_154760", "sub_154778", "sub_154780", "sub_1547A0", "sub_1547B8", "sub_1547D4", "sub_15481C", "sub_154898", "sub_154FD0", "sub_155010", "sub_155048", "sub_155058", "sub_1550C0", "sub_1550E8", "sub_155128", "sub_155194", "sub_1551D0", "sub_1551E4", "sub_155204", "sub_155220", "sub_155240", "sub_155250", "sub_155294", "sub_1553F0", "sub_155458", "sub_155470", "sub_155484", "sub_1554A4", "sub_1554CC", "sub_1554F8", "sub_155644", "sub_1556B0", "sub_1556EC", "sub_155700", "sub_155720", "sub_155748", "sub_155788", "sub_1557B0", "sub_1557E8", "sub_155828", "sub_15584C", "sub_155888", "sub_15589C", "sub_1558BC", "sub_1558D4", "sub_1558F0", "sub_155918", "sub_15597C", "sub_1559BC", "sub_1559F4", "sub_155A20", "sub_155A94", "sub_155ABC", "sub_155AE8", "sub_155F04", "sub_155F90", "sub_156888", "sub_1568C8", "sub_1569FC", "sub_156A1C", "sub_156A44", "sub_156A6C", "sub_156A94", "sub_156AB0", "sub_156AC0", "sub_156B0C", "sub_156BD8", "sub_156BF0", "sub_156C04", "sub_156C24", "sub_156C28", "sub_156C2C", "sub_156C50", "sub_156C80", "sub_156CC0", "sub_156CE4", "sub_156CF8", "sub_156D1C", "sub_156D2C", "sub_156D6C", "sub_156DDC", "sub_156E34", "sub_156E5C", "sub_156E6C", "sub_156EAC", "sub_156F44", "sub_156F50", "sub_15704C", "sub_1572A0", "sub_1572EC", "sub_1572F8", "sub_157414", "sub_157560", "sub_157578", "sub_15758C", "sub_1575AC", "sub_1575B0", "sub_1575B4", "sub_1575D8", "sub_157608", "sub_15762C", "sub_157690", "sub_1576B8", "sub_1576D8", "sub_157704", "sub_157728", "sub_15777C", "sub_15784C", "sub_1578BC", "sub_1578D8", "sub_1578F8", "sub_157900", "sub_15790C", "sub_15793C", "sub_157978", "sub_15798C", "sub_1579AC", "sub_1579BC", "sub_1579E0", "sub_1579F0", "sub_157A2C", "sub_157BE4", "sub_157C20", "sub_157C34", "sub_157C54", "sub_157C6C", "sub_157CCC", "sub_157D3C", "sub_157D6C", "sub_157D98", "sub_157DBC", "sub_157DE8", "sub_157DF8", "sub_157E38", "sub_157FC4", "sub_15801C", "sub_15802C", "sub_158050", "sub_158060", "sub_1580A0", "sub_158168", "sub_158180", "sub_158188", "sub_1581A8", "sub_1581C0", "sub_1581DC", "sub_1581F8", "sub_158228", "sub_158380", "sub_1583BC", "sub_1583D4", "sub_1583E8", "sub_158408", "sub_158430", "sub_158448", "sub_158480", "sub_1584E8", "sub_158564", "sub_158568", "sub_15856C", "sub_158590", "sub_158594", "sub_158598", "sub_1585D8", "sub_158640", "sub_158658", "sub_15866C", "sub_15868C", "sub_158690", "sub_158694", "sub_1586B8", "sub_1586BC", "sub_1586C0", "sub_158700", "sub_15872C", "sub_158784", "sub_1587F0", "sub_158858", "sub_158894", "sub_1588A8", "sub_1588C8", "sub_1588CC", "sub_1588D0", "sub_158934", "sub_158A9C", "sub_158ADC", "sub_158AE4", "sub_158B08", "sub_158B30", "sub_158B58", "sub_158BBC", "sub_158C78", "sub_158D44", "sub_158D6C", "sub_158DAC", "sub_158F0C", "sub_158F48", "sub_158F70", "sub_158FB0", "sub_158FDC", "sub_159004", "sub_159018", "sub_159038", "sub_159048", "sub_1590B0", "sub_1590DC", "sub_15910C", "sub_159138", "sub_15915C", "sub_159164", "sub_159168", "sub_15918C", "sub_1591A4", "sub_1591D8", "sub_159364", "sub_1593CC", "sub_1593E4", "sub_1593EC", "sub_15940C", "sub_159410", "sub_159414", "sub_159478", "sub_1594A0", "sub_1594BC", "sub_159520", "sub_159730", "sub_159754", "sub_1597B8", "sub_1597BC", "sub_1597C0", "sub_1597E4", "sub_1597FC", "sub_159838", "sub_159868", "sub_159894", "sub_1598B8", "sub_1598CC", "sub_1598F4", "sub_159908", "sub_15994C", "sub_1599B4", "sub_1599CC", "sub_1599E0", "sub_159A00", "sub_159A28", "sub_159A40", "sub_159A78", "sub_159AE0", "sub_159B5C", "sub_159B60", "sub_159B64", "sub_159B88", "sub_159B98", "sub_159BDC", "sub_159C4C", "sub_159CA0", "sub_159CB8", "sub_159CD8", "sub_159CF4", "sub_159D2C", "sub_159D7C", "sub_159DA0", "sub_159DC8", "sub_159DFC", "sub_159F14", "sub_159F50", "sub_159F7C", "sub_159FA4", "sub_159FAC", "sub_15A018", "sub_15A040", "sub_15A068", "sub_15A08C", "sub_15A0A4", "sub_15A0DC", "sub_15A104", "sub_15A114", "sub_15A138", "sub_15A200", "sub_15A228", "sub_15A25C", "sub_15A424", "sub_15A460", "sub_15A49C", "sub_15A4B0", "sub_15A4D0", "sub_15A4D4", "sub_15A4D8", "sub_15A4FC", "sub_15A500", "sub_15A504", "sub_15A540", "sub_15A57C", "sub_15A590", "sub_15A5B0", "sub_15A5C0", "sub_15A5E4", "sub_15A5F4", "sub_15A618", "sub_15A630", "sub_15A664", "sub_15A698", "sub_15A6D8", "sub_15A6F8", "sub_15A724", "sub_15A75C", "sub_15A7A0", "sub_15A7C0", "sub_15A7EC", "sub_15A7FC", "sub_15A818", "sub_15A860", "sub_15A8BC", "sub_15A904", "sub_15A960", "sub_15A9A8", "sub_15AA4C", "sub_15AA94", "sub_15ABB0", "sub_15ACD8", "sub_15ACE4", "sub_15ACFC", "sub_15AD40", "sub_15ADE4", "sub_15AE88", "sub_15AE94", "sub_15AEAC", "sub_15AED8", "sub_15AF10", "sub_15B124", "sub_15B130", "sub_15B148", "sub_15B190", "sub_15B1EC", "sub_15B220", "sub_15B22C", "sub_15B244", "sub_15B2E8", "sub_15B348", "sub_15B390", "sub_15B3EC", "sub_15B450", "sub_15B524", "sub_15B604", "sub_15B64C", "sub_15B6A8", "sub_15B758", "sub_15B83C", "sub_15B92C", "sub_15B974", "sub_15B9D0", "sub_15B9E8", "sub_15BA2C", "sub_15BA88", "sub_15BAB0", "sub_15BAE4", "sub_15BB24", "sub_15BB3C", "sub_15BB60", "sub_15BB88", "sub_15BB94", "sub_15BBB0", "sub_15BBC8", "sub_15BBEC", "sub_15BC40", "sub_15BD74", "sub_15BEB4", "sub_15BEFC", "sub_15BF54", "sub_15BFF4", "sub_15C220", "sub_15C22C", "sub_15C244", "sub_15C280", "sub_15C4EC", "sub_15C590", "sub_15C59C", "sub_15C5B4", "sub_15C6BC", "sub_15C7D0", "sub_15C8B4", "sub_15C9A4", "sub_15CAA8", "sub_15CBB8", "sub_15CC00", "sub_15CC5C", "sub_15CEC8", "sub_15CF10", "sub_15CF6C", "sub_15CFB4", "sub_15D010", "sub_15D01C", "sub_15D034", "sub_15D07C", "sub_15D0D8", "sub_15D138", "sub_15D3B4", "sub_15D3D8", "sub_15D47C", "sub_15D494", "sub_15D4B8", "sub_15D68C", "sub_15D6B0", "sub_15D794", "sub_15D884", "sub_15D928", "sub_15D9B0", "sub_15DBEC", "sub_15DC90", "sub_15DC9C", "sub_15DCB4", "sub_15DCF0", "sub_15DD38", "sub_15DD94", "sub_15DDB8", "sub_15DE00", "sub_15DE5C", "sub_15DE80", "sub_15DEB0", "sub_15DEF8", "sub_15DF54", "sub_15DFA0", "sub_15E044", "sub_15E050", "sub_15E068", "sub_15E088", "sub_15E0B4", "sub_15E0D8", "sub_15E17C", "sub_15E188", "sub_15E1A0", "sub_15E1EC", "sub_15E290", "sub_15E2D8", "sub_15E334", "sub_15E340", "sub_15E358", "sub_15E364", "sub_15E37C", "sub_15E388", "sub_15E3A0", "sub_15E3E8", "sub_15E444", "sub_15E450", "sub_15E468", "sub_15E488", "sub_15E4B4", "sub_15E4D8", "sub_15E4E4", "sub_15E4FC", "sub_15E544", "sub_15E5A0", "sub_15E5EC", "sub_15E60C", "sub_15E638", "sub_15E680", "sub_15E6DC", "sub_15E780", "sub_15E78C", "sub_15E7A4", "sub_15E7EC", "sub_15E848", "sub_15E894", "sub_15E8B8", "sub_15E95C", "sub_15E968", "sub_15E980", "sub_15EA24", "sub_15EA78", "sub_15EA84", "sub_15EA9C", "sub_15EAE4", "sub_15EB40", "sub_15EBE4", "sub_15EBF0", "sub_15EC08", "sub_15EC14", "sub_15EC2C", "sub_15EC38", "sub_15EC50", "sub_15EC78", "sub_15ECAC", "sub_15ED48", "sub_15EDE4", "sub_15EE08", "sub_15EE50", "sub_15EEAC", "sub_15EF48", "sub_15EFEC", "sub_15F088", "sub_15F134", "sub_15F140", "sub_15F158", "sub_15F1AC", "sub_15F20C", "sub_15F2A8", "sub_15F344", "sub_15F398", "sub_15F3F8", "sub_15F44C", "sub_15F470", "sub_15F4B8", "sub_15F514", "sub_15F588", "sub_15F604", "sub_15F680", "sub_15F704", "sub_15F74C", "sub_15F7A8", "sub_15F83C", "sub_15F858", "sub_15F938", "sub_15FA54", "sub_15FB7C", "sub_15FB88", "sub_15FBA0", "sub_15FBC0", "sub_15FBF4", "sub_15FC14", "sub_15FC34", "sub_15FCA8", "sub_15FD08", "sub_15FD24", "sub_15FD44", "sub_15FD64", "sub_15FD84", "sub_15FDA4", "sub_15FDC4", "sub_15FDE4", "sub_15FE04", "sub_15FE24", "sub_160108", "sub_160128", "sub_160148", "sub_160168", "sub_160188", "sub_1601A8", "sub_1601C8", "sub_160228", "sub_1602C4", "sub_1602FC", "sub_16031C", "sub_16033C", "sub_16035C", "sub_16037C", "sub_16039C", "sub_1603BC", "sub_1603DC", "sub_1603FC", "sub_16041C", "sub_16043C", "sub_16045C", "sub_16047C", "sub_16049C", "sub_1604BC", "sub_1604DC", "sub_1604FC", "sub_16051C", "sub_16053C", "sub_16055C", "sub_16057C", "sub_16059C", "sub_1605BC", "sub_1605DC", "sub_1605FC", "sub_16061C", "sub_16063C", "sub_16065C", "sub_16067C", "sub_16069C", "sub_1606BC", "sub_1606DC", "sub_1606FC", "sub_16071C", "sub_16073C", "sub_16075C", "sub_16077C", "sub_16079C", "sub_1607BC", "sub_1607DC", "sub_1607FC", "sub_16081C", "sub_16083C", "sub_16085C", "sub_16087C", "sub_16089C", "sub_1608BC", "sub_1608DC", "sub_1608FC", "sub_16091C", "sub_16093C", "sub_16095C", "sub_16097C", "sub_16099C", "sub_1609BC", "sub_160D7C", "sub_1635E4", "sub_163624", "sub_163664", "sub_1636A4", "sub_1636E4", "sub_1638E0", "sub_163ADC", "sub_163CE4", "sub_163EE8", "sub_165E60", "sub_165EEC", "sub_165F38", "sub_165FA8", "sub_165FDC", "sub_165FFC", "sub_16601C", "sub_16603C", "sub_1660D4", "sub_1660F4", "sub_166114", "sub_166134", "sub_1661CC", "sub_166200", "sub_166234", "sub_166278", "sub_166298", "sub_1662B8", "sub_1662D8", "sub_166DD4", "sub_1679DC", "sub_1679E0", "sub_167A00", "sub_167A7C", "sub_167B14", "sub_167B30", "sub_167BC8", "sub_167BFC", "sub_167C3C", "sub_167CA4", "sub_167E68", "sub_167E88", "sub_167E98", "sub_167F30", "sub_167F54", "sub_167F98", "sub_167FB8", "sub_167FD8", "sub_167FF8", "sub_168018", "sub_168038", "sub_168058", "sub_168078", "sub_168098", "sub_1680B8", "sub_1680D8", "sub_1680F8", "sub_168118", "sub_168138", "sub_168158", "sub_168178", "sub_168198", "sub_1681B8", "sub_1681D8", "sub_1681F8", "sub_168218", "sub_168238", "sub_168258", "sub_168278", "sub_168298", "sub_1682B8", "sub_1682D8", "sub_1682F8", "sub_168318", "sub_168338", "sub_168358", "sub_168378", "sub_168398", "sub_1683B8", "sub_1683D8", "sub_1683F8", "sub_168418", "sub_168438", "sub_168458", "sub_168478", "sub_168510", "sub_1685A8", "sub_168640", "sub_1686D8", "sub_168770", "sub_168808", "sub_1688A0", "sub_168A48", "sub_168AA8", "sub_168AF8", "sub_168B20", "sub_168BA8", "sub_168BF4", "sub_168CA0", "sub_168D54", "sub_168EA0", "sub_168F60", "sub_168FE8", "sub_16909C", "sub_169124", "sub_169168", "sub_1691B4", "sub_1691D4", "sub_1691F4", "sub_169214", "sub_169234", "sub_169254", "sub_169274", "sub_169294", "sub_1692B4", "sub_169380", "sub_1694B0", "sub_1696A0", "sub_1696C4", "sub_169714", "sub_16973C", "sub_169798", "sub_1697D8", "sub_169824", "sub_16984C", "sub_16988C", "sub_1698B4", "sub_1698F0", "sub_1698F8", "sub_169ABC", "sub_169C34", "sub_16AD88", "sub_16AFC0", "sub_16B6A4", "sub_16B8F0", "sub_16B92C", "sub_16B98C", "sub_16BB2C", "sub_16BC20", "sub_16BD74", "sub_16C170", "sub_16C2D0", "sub_16C430", "sub_16C90C", "sub_16C918", "sub_16CCF0", "sub_16CDC8", "sub_16CFB0", "sub_16D084", "sub_16D0D0", "sub_16D1D4", "sub_16D288", "sub_16D2E0", "nullsub_10", "j_j__ZdlPv_4", "sub_16D3C4", "sub_16D3E4", "sub_16D4DC", "sub_16D58C", "sub_16D5A0", "sub_16D684", "sub_16D908", "sub_16DB1C", "sub_16E478", "sub_16E98C", "sub_16E9F8", "sub_16EB34", "sub_16EC74", "sub_16EE9C", "sub_16F89C", "sub_16FA30", "sub_16FD18", "sub_16FF10", "sub_170268", "sub_17038C", "sub_1705FC", "sub_170668", "sub_17074C", "sub_170760", "sub_170974", "sub_170BB8", "sub_170C30", "sub_170FCC", "sub_17107C", "sub_171134", "sub_171BE8", "sub_1721A4", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev", "sub_172508", "sub_172660", "sub_172968", "sub_172AA4", "sub_172D30", "sub_172D78", "sub_172DC0", "sub_172E08", "sub_172E50", "sub_172E98", "sub_173124", "sub_17314C", "sub_173174", "sub_17365C", "sub_173690", "sub_173774", "sub_17392C", "sub_173FBC", "sub_1742C8", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_", "sub_174648", "sub_174730", "sub_174B58", "sub_174FE8", "sub_1752BC", "sub_175878", "sub_175C68", "_ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm", "sub_176410", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_", "sub_1764F8", "sub_176D14", "sub_177174", "sub_1772F4", "sub_177488", "sub_178488", "sub_179314", "sub_179754", "sub_179BEC", "sub_179D20", "sub_179E78", "sub_179FD0", "sub_17A128", "sub_17A280", "sub_17A3D8", "sub_17A530", "sub_17A688", "sub_17A7E0", "sub_17A938", "sub_17AA90", "sub_17ABE8", "sub_17ACE8", "_ZNSt3__16vectorINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEENS4_IS6_EEE26__swap_out_circular_bufferERNS_14__split_bufferIS6_RS7_EE", "sub_17AF14", "sub_17B4F4", "sub_17BF70", "sub_17C514", "sub_17CD74", "sub_17CE08", "sub_17D040", "sub_17D994", "sub_17DB3C", "sub_17DEC0", "sub_17E12C", "sub_17E6B0", "sub_17EA9C", "sub_17F5F8", "sub_17FB5C", "sub_17FC80", "sub_180060", "sub_18006C", "sub_180070", "sub_1800A4", "sub_1800C4", "sub_18019C", "sub_180218", "sub_180290", "sub_180298", "sub_1802A0", "sub_1802A8", "sub_1802B0", "sub_1802B8", "sub_1802C0", "sub_180348", "sub_180384", "sub_1803C8", "sub_180424", "sub_180460", "sub_180650", "sub_1806EC", "sub_18078C", "sub_180824", "sub_1808B8", "sub_180944", "sub_180980", "sub_181438", "sub_1815C0", "sub_181658", "sub_1816B0", "sub_182944", "sub_18298C", "sub_182ABC", "sub_182BF4", "sub_182C98", "sub_182CEC", "sub_182D88", "sub_183094", "sub_1832E4", "sub_1833E4", "sub_1834DC", "sub_183558", "sub_1837E0", "sub_1837FC", "sub_183890", "sub_183988", "sub_183A64", "sub_183BD4", "sub_183BF4", "sub_183C38", "sub_183D90", "sub_183D98", "sub_183F14", "sub_183F4C", "sub_183F9C", "sub_183FD4", "sub_184078", "sub_184400", "sub_184B74", "sub_184E48", "sub_18511C", "sub_185520", "sub_1863F4", "sub_186488", "sub_18658C", "sub_186598", "sub_1865A8", "sub_1865B8", "sub_1865DC", "sub_186600", "sub_186658", "sub_186688", "sub_186774", "sub_1867F8", "sub_186830", "sub_186874", "sub_186898", "sub_1868BC", "sub_186DF4", "sub_186E48", "sub_186E50", "sub_186E7C", "sub_186FDC", "sub_18716C", "sub_187184", "sub_18725C", "sub_18735C", "sub_1874A8", "sub_187858", "sub_187A14", "sub_187AAC", "sub_187DF8", "sub_187FD4", "sub_188144", "sub_1882A8", "sub_18840C", "sub_188570", "sub_1886D4", "sub_1888F0", "sub_188B0C", "sub_188BA4", "sub_188CC0", "sub_188D24", "sub_188F1C", "sub_188F44", "sub_188F84", "sub_188F94", "sub_18912C", "sub_1892E0", "sub_1893C8", "sub_1893D8", "sub_189654", "sub_189658", "sub_18965C", "sub_189660", "sub_1898B0", "sub_189918", "sub_18993C", "sub_189A64", "sub_189B10", "sub_189C18", "sub_189CB0", "sub_189D80", "sub_189E28", "sub_189FA4", "sub_189FA8", "sub_189FDC", "sub_189FFC", "sub_18A020", "sub_18A058", "sub_18A07C", "sub_18A0B4", "sub_18A0D8", "sub_18A110", "sub_18A134", "sub_18A16C", "sub_18A190", "sub_18A1C8", "sub_18A1EC", "sub_18A224", "sub_18A248", "sub_18A280", "sub_18A2A4", "sub_18A2B0", "sub_18A2B8", "sub_18A304", "sub_18A30C", "sub_18A358", "sub_18A35C", "sub_18A390", "sub_18A3B0", "sub_18A480", "sub_18A598", "sub_18A634", "sub_18A6BC", "sub_18A74C", "sub_18A7EC", "sub_18A8CC", "sub_18A9AC", "sub_18AAB0", "sub_18AB7C", "sub_18ABB0", "sub_18AD00", "sub_18AE24", "sub_18AF4C", "sub_18B028", "sub_18B074", "sub_18BAD4", "sub_18BBF8", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendIPcEENS_9enable_ifIXsrNS_21__is_forward_iteratorIT_EE5valueERS5_E4typeESA_SA_", "sub_18C024", "sub_18C620", "sub_18CE34", "sub_18D070", "sub_18D8C4", "sub_18D93C", "sub_18DA00", "interpreter_wrap_int64_t", "interpreter_wrap_float", "interpreter_wrap_double", "sub_18DC28", "sub_18DC4C", "sub_18DCC0", "nullsub_11", "j_j__ZdlPv_5", "sub_18DD94", "sub_18DDA8", "sub_18DDB8", "sub_18E244", "sub_18E8D0", "sub_18F6AC", "sub_18F8B0", "sub_18F8D8", "sub_18FB64", "sub_18FBB0", "sub_18FC9C", "sub_18FE18", "sub_18FEA8", "sub_1926F0", "sub_192C54", "sub_192CD4", "sub_192D54", "sub_192DA0", "sub_192E3C", "sub_192E78", "sub_192F10", "sub_192F4C", "sub_192FE8", "sub_193034", "sub_19307C", "sub_193274", "sub_1932AC", "sub_1932E4", "sub_19331C", "sub_1933FC", "sub_1934CC", "sub_1935BC", "sub_1937AC", "sub_19384C", "sub_193A2C", "sub_193BF4", "sub_193CEC", "sub_193DDC", "sub_194114", "sub_1942D0", "sub_194514", "sub_194758", "sub_194948", "sub_194B30", "sub_194E44", "sub_195008", "sub_1952E8", "sub_1953D8", "sub_1954D0", "sub_19570C", "sub_195CAC", "sub_195E6C", "sub_195FFC", "sub_196010", "nullsub_12", "j_j__ZdlPv_6", "sub_196168", "j_j__ZdlPv_7", "sub_1962BC", "j_j__ZdlPv_8", "sub_196434", "j_j__ZdlPv_9", "sub_19659C", "j_j__ZdlPv_10", "sub_196644", "sub_196B24", "sub_196C9C", "sub_196CC0", "sub_196CE0", "sub_196E58", "sub_196E94", "sub_196F08", "sub_19709C", "nullsub_13", "j_j__ZdlPv_11", "sub_1970C0", "sub_197144", "sub_197424", "sub_197478", "sub_197488", "sub_197498", "sub_1974D4", "sub_1974E4", "sub_1974F4", "sub_19766C", "sub_197898", "sub_197940", "sub_197960", "sub_19796C", "sub_197984", "sub_197994", "sub_197A7C", "sub_197D5C", "sub_197E44", "sub_197F48", "nullsub_14", "sub_197F54", "sub_197F5C", "sub_197FB0", "sub_198070", "sub_1982BC", "sub_1982C8", "sub_1982D0", "sub_1982D8", "sub_198300", "sub_19830C", "sub_1983E8", "sub_198408", "sub_198420", "sub_198708", "sub_198774", "sub_19885C", "sub_198B3C", "sub_198C24", "sub_198D28", "sub_198D30", "nullsub_15", "sub_198D40", "sub_198D48", "sub_198D9C", "sub_198E5C", "sub_19955C", "sub_199568", "sub_199570", "sub_199578", "sub_199688", "sub_199794", "sub_1997B4", "sub_1997C0", "sub_1997D8", "sub_1997E8", "sub_1998D0", "sub_199BB0", "sub_199C98", "sub_199D9C", "nullsub_16", "sub_199DA8", "sub_199DB0", "sub_199E04", "sub_199EC4", "sub_19A110", "sub_19A11C", "sub_19A124", "sub_19A12C", "sub_19A14C", "sub_19A158", "sub_19A170", "sub_19A3E0", "sub_19A44C", "sub_19A534", "sub_19A814", "sub_19A8FC", "sub_19AA00", "nullsub_17", "sub_19AA0C", "sub_19AA14", "sub_19AA68", "sub_19AB0C", "sub_19B568", "sub_19B574", "sub_19B57C", "sub_19B584", "sub_19B640", "sub_19B760", "sub_19B7EC", "sub_19B844", "sub_19B870", "sub_19BC9C", "sub_19C6E0", "sub_19C7AC", "sub_19C920", "sub_19CCD4", "sub_19CD44", "sub_19CD74", "sub_19D238", "sub_19D2CC", "sub_19D360", "sub_19D3E4", "sub_19D56C", "sub_19D750", "sub_19D894", "sub_19DA08", "sub_19DB48", "sub_19DCA4", "sub_19E088", "sub_19E110", "sub_19E508", "sub_19EA48", "sub_19ED64", "sub_19F0A0", "sub_19F358", "sub_19F500", "sub_19F608", "sub_19F67C", "sub_19F68C", "sub_19F6DC", "sub_19F70C", "sub_19F7C4", "sub_19F7EC", "sub_19F984", "sub_19FDD8", "sub_19FF98", "sub_1A0330", "sub_1A0418", "sub_1A0760", "sub_1A0C34", "sub_1A0C88", "sub_1A0E00", "sub_1A0F58", "nullsub_7", "sub_1A1114", "sub_1A11A0", "sub_1A12EC", "sub_1A16A4", "sub_1A171C", "sub_1A181C", "sub_1A1908", "sub_1A19EC", "sub_1A1A70", "sub_1A1AE8", "sub_1A1B64", "nullsub_18", "j_j__ZdlPv_12", "sub_1A1B7C", "sub_1A1C78", "nullsub_19", "j_j__ZdlPv_13", "sub_1A1C90", "sub_1A1D84", "sub_1A1E74", "sub_1A1EF0", "sub_1A2034", "sub_1A2108", "sub_1A2160", "sub_1A2378", "sub_1A2380", "sub_1A23CC", "sub_1A24C4", "sub_1A25E0", "sub_1A2718", "sub_1A2830", "sub_1A2938", "sub_1A2984", "sub_1A2A94", "sub_1A2BA0", "sub_1A2CAC", "sub_1A2DDC", "sub_1A3150", "sub_1A3204", "sub_1A3228", "sub_1A325C", "sub_1A3260", "sub_1A327C", "sub_1A32C0", "sub_1A3434", "sub_1A3438", "sub_1A3450", "sub_1A46B8", "sub_1A62E4", "sub_1A648C", "sub_1A6D4C", "sub_1A6F40", "sub_1A7DE0", "sub_1A7F58", "sub_1A8150", "sub_1A8168", "sub_1A8300", "sub_1A8308", "sub_1A847C", "sub_1A8728", "sub_1A88A4", "sub_1A898C", "sub_1A8AD4", "sub_1A8AEC", "sub_1A8C24", "sub_1A8C84", "sub_1A8E60", "sub_1A8F58", "sub_1A9074", "sub_1A9190", "sub_1A9248", "sub_1A92C0", "sub_1A9484", "sub_1A94A8", "sub_1A94B0", "sub_1A94B8", "sub_1A94EC", "sub_1A9558", "sub_1A9650", "sub_1A9670", "sub_1A96A0", "sub_1A9F9C", "sub_1A9FBC", "sub_1A9FD4", "sub_1AA7C4", "sub_1AA7F4", "sub_1AACFC", "sub_1AADA8", "sub_1AADC8", "sub_1AADD4", "sub_1AAE90", "sub_1AAF48", "sub_1AAF54", "sub_1AAF5C", "sub_1AAFF4", "sub_1AB088", "sub_1AB0FC", "sub_1AB16C", "sub_1AB220", "sub_1AB228", "sub_1AB230", "sub_1AB244", "sub_1AB24C", "sub_1AB2E4", "sub_1AB378", "sub_1AB410", "sub_1AB4A4", "sub_1AB518", "sub_1AB588", "sub_1AB5FC", "sub_1AB66C", "sub_1AB704", "sub_1AB798", "sub_1AB80C", "sub_1AB87C", "sub_1AB8DC", "sub_1AB950", "sub_1AB9C0", "sub_1ABA34", "sub_1ABAA4", "sub_1ABADC", "sub_1ABB10", "sub_1ABB84", "sub_1ABBF4", "sub_1ABC5C", "sub_1ABCC0", "sub_1ABCC4", "sub_1ABCD4", "sub_1ABDB4", "sub_1ABE90", "sub_1ABEB0", "sub_1ABF0C", "sub_1AC0D4", "sub_1AC108", "sub_1AC170", "sub_1AC1F0", "sub_1AC210", "sub_1AE394", "sub_1AE4C4", "sub_1AE4DC", "sub_1AE4E4", "sub_1AE4F8", "sub_1AE528", "sub_1AE540", "sub_1AE5B4", "sub_1AE624", "sub_1AE65C", "sub_1AE690", "sub_1AE6C8", "sub_1AE6FC", "sub_1AE714", "sub_1AE72C", "sub_1AE778", "sub_1AE790", "sub_1AF394", "sub_1AFC80", "sub_1AFE2C", "sub_1AFE4C", "sub_1AFE6C", "sub_1AFE8C", "sub_1AFE90", "sub_1AFF58", "sub_1B0108", "sub_1B0120", "sub_1B01DC", "sub_1B0294", "sub_1B02B4", "sub_1B03AC", "sub_1B04A0", "sub_1B04F0", "sub_1B053C", "sub_1B058C", "sub_1B05D8", "sub_1B06B8", "sub_1B0794", "sub_1B0868", "sub_1B0938", "sub_1B0944", "sub_1B095C", "sub_1B0974", "sub_1B098C", "sub_1B0B58", "sub_1B0FE4", "sub_1B1010", "sub_1B18F0", "sub_1B19BC", "sub_1B1CE8", "sub_1B26B4", "sub_1B26D4", "sub_1B26F4", "sub_1B27C8", "sub_1B2898", "sub_1B2918", "sub_1B2994", "sub_1B29A8", "sub_1B29B8", "sub_1B29D0", "sub_1B29F0", "sub_1B2A64", "sub_1B2AD4", "sub_1B2D70", "sub_1B2D90", "sub_1B2D98", "sub_1B2DA8", "sub_1B2DC8", "sub_1B2DE0", "sub_1B2E04", "sub_1B2E78", "sub_1B2F20", "sub_1B2F58", "sub_1B2F8C", "sub_1B3070", "sub_1B3080", "sub_1B309C", "sub_1B311C", "sub_1B3198", "sub_1B3218", "sub_1B3294", "sub_1B32F0", "sub_1B3348", "sub_1B3368", "sub_1B3384", "sub_1B3440", "sub_1B34F8", "sub_1B3524", "sub_1B354C", "sub_1B36F4", "sub_1B3714", "sub_1B3758", "sub_1B3798", "sub_1B37DC", "sub_1B381C", "sub_1B38E8", "sub_1B3960", "sub_1B3B00", "sub_1B3F0C", "sub_1B3F74", "sub_1B4040", "sub_1B4100", "sub_1B41DC", "sub_1B53A8", "sub_1B5500", "sub_1B56F8", "sub_1B578C", "sub_1B586C", "sub_1B5B50", "sub_1B5D04", "sub_1B5DE4", "sub_1B5E54", "sub_1B5EC4", "sub_1B6080", "sub_1B60E8", "sub_1B6180", "sub_1B6270", "sub_1B6448", "sub_1B6470", "sub_1B6498", "sub_1B64C0", "sub_1B6528", "sub_1B6540", "sub_1B6578", "sub_1B6678", "sub_1B6680", "sub_1B6694", "sub_1B6698", "sub_1B66A8", "sub_1B66D0", "sub_1B670C", "_ZNSt3__111__call_onceERVmPvPFvS2_E", "sub_1B6800", "sub_1B6810", "j_j__ZdlPv_2", "sub_1B6818", "sub_1B682C", "sub_1B6874", "sub_1B6898", "sub_1B68A4", "_ZNSt3__116generic_categoryEv", "sub_1B69CC", "sub_1B69D8", "sub_1B6AA8", "_ZNSt3__115system_categoryEv", "sub_1B6BAC", "sub_1B6BC4", "sub_1B6C94", "sub_1B6CB0", "sub_1B6DAC", "j_j__ZNSt15underflow_errorD2Ev", "sub_1B6DE4", "_ZNSt3__120__throw_system_errorEiPKc", "sub_1B6E94", "nullsub_1", "j_j__ZdlPv", "j_j__ZdlPv_0", "sub_1B6EB4", "sub_1B6F00", "__cxa_allocate_exception", "sub_1B6F5C", "sub_1B7068", "__cxa_free_exception", "sub_1B7084", "__cxa_free_dependent_exception_0", "sub_1B71B4", "__cxa_allocate_dependent_exception", "__cxa_free_dependent_exception", "__cxa_throw", "sub_1B7340", "__cxa_get_exception_ptr", "__cxa_begin_catch", "__cxa_end_catch", "sub_1B74C4", "__cxa_decrement_exception_refcount", "sub_1B7510", "__cxa_current_exception_type", "__cxa_rethrow", "__cxa_increment_exception_refcount", "__cxa_current_primary_exception", "sub_1B770C", "__cxa_rethrow_primary_exception", "sub_1B782C", "sub_1B7890", "__cxa_uncaught_exception", "sub_1B78C8", "__cxa_get_globals", "__cxa_get_globals_fast", "sub_1B79A0", "sub_1B79D4", "sub_1B7A08", "sub_1B7ABC", "sub_1B7B38", "_ZSt14get_unexpectedv", "sub_1B7BC4", "_ZSt10unexpectedv", "_ZSt13get_terminatev", "sub_1B7C14", "sub_1B7C30", "sub_1B7C40", "sub_1B7C50", "_ZSt9terminatev", "_ZSt15set_new_handlerPFvvE", "_ZSt15get_new_handlerv", "_Znwm", "_ZnwmRKSt9nothrow_t", "sub_1B7D64", "sub_1B7D74", "_Znam", "_ZnamRKSt9nothrow_t", "sub_1B7D90", "sub_1B7DA0", "_ZdlPv", "_ZdlPvRKSt9nothrow_t", "_ZdaPv", "_ZdaPvRKSt9nothrow_t", "_ZNSt9bad_allocC2Ev", "_ZNSt9bad_allocD2Ev", "_ZNSt9bad_allocD0Ev", "_ZNKSt9bad_alloc4whatEv", "_ZNSt20bad_array_new_lengthC2Ev", "_ZNSt20bad_array_new_lengthD0Ev", "_ZNKSt20bad_array_new_length4whatEv", "sub_1B7E48", "sub_1B86CC", "sub_1B86F8", "sub_1B8A68", "sub_1B8AE4", "sub_1B8C38", "_ZNSt9exceptionD2Ev", "_ZNSt9exceptionD0Ev", "_ZNKSt9exception4whatEv", "_ZNSt13bad_exceptionD0Ev", "_ZNKSt13bad_exception4whatEv", "j_j__ZNSt9type_infoD2Ev", "sub_1B8C74", "nullsub_2", "nullsub_3", "sub_1B8CA0", "sub_1B8CC4", "sub_1B8CE8", "sub_1B8D0C", "sub_1B8D30", "sub_1B8D54", "sub_1B8D78", "sub_1B8D9C", "sub_1B8DC0", "sub_1B8DE4", "sub_1B8E08", "sub_1B8E14", "sub_1B8E1C", "sub_1B8E24", "sub_1B8E30", "sub_1B8EF4", "sub_1B8F5C", "sub_1B8FD4", "sub_1B9120", "sub_1B9140", "__dynamic_cast", "sub_1B9410", "sub_1B975C", "sub_1B989C", "sub_1B9940", "sub_1B9B30", "sub_1B9BE4", "_ZNSt16invalid_argumentD2Ev", "_ZNSt11logic_errorD0Ev", "_ZNKSt11logic_error4whatEv", "_ZNSt15underflow_errorD2Ev", "_ZNSt13runtime_errorD0Ev", "_ZNKSt13runtime_error4whatEv", "_ZNSt12domain_errorD0Ev", "_ZNSt16invalid_argumentD0Ev", "_ZNSt12length_errorD0Ev", "_ZNSt12out_of_rangeD0Ev", "_ZNSt11range_errorD0Ev", "_ZNSt14overflow_errorD0Ev", "_ZNSt15underflow_errorD0Ev", "_ZNSt9type_infoD2Ev", "_ZNSt9type_infoD0Ev", "_ZNSt8bad_castC2Ev", "_ZNSt8bad_castD2Ev", "_ZNSt8bad_castD0Ev", "_ZNKSt8bad_cast4whatEv", "_ZNSt10bad_typeidC2Ev", "_ZNSt10bad_typeidD2Ev", "_ZNSt10bad_typeidD0Ev", "_ZNKSt10bad_typeid4whatEv", "sub_1BA110", "sub_1BA124", "sub_1BA128", "sub_1BA13C", "_ZNSt3__125notify_all_at_thread_exitERNS_18condition_variableENS_11unique_lockINS_5mutexEEE", "_ZNSt11logic_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE", "sub_1BA1F8", "_ZNSt11logic_errorC2EPKc", "sub_1BA278", "_ZNSt11logic_errorC2ERKS_", "_ZNSt11logic_erroraSERKS_", "_ZNSt13runtime_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE", "sub_1BA398", "_ZNSt13runtime_errorC2EPKc", "sub_1BA418", "_ZNSt13runtime_errorC2ERKS_", "_ZNSt13runtime_erroraSERKS_", "_ZNSt3__111this_thread9sleep_forERKNS_6chrono8durationIxNS_5ratioILl1ELl1000000000EEEEE", "_ZNSt3__119__thread_local_dataEv", "sub_1BA5A8", "sub_1BA5BC", "sub_1BA628", "sub_1BA63C", "sub_1BA654", "sub_1BA658", "sub_1BA730", "sub_1BA7A0", "sub_1BA7FC", "sub_1BA848", "sub_1BA85C", "sub_1BA944", "sub_1BA98C", "sub_1BAA1C", "sub_1BAB44", "_ZSt14set_unexpectedPFvvE", "_ZSt13set_terminatePFvvE", "__cxa_demangle", "sub_1BAF90", "sub_1BB014", "sub_1BB3C4", "sub_1BB40C", "sub_1BB4E0", "sub_1BB614", "sub_1BB6C8", "sub_1BC5AC", "sub_1BC614", "sub_1BC628", "sub_1BC634", "sub_1BC650", "sub_1BC6B0", "sub_1C4580", "sub_1C4624", "sub_1C9634", "sub_1C97D8", "sub_1C97DC", "sub_1C9800", "sub_1CA790", "sub_1CA794", "sub_1CA7B4", "sub_1CB65C", "sub_1CB660", "sub_1CB670", "sub_1CBDE8", "sub_1CBDEC", "sub_1CBDF0", "sub_1CC090", "sub_1CC178", "sub_1CC17C", "sub_1CC198", "sub_1CE3A8", "sub_1CE3AC", "sub_1CE3BC", "sub_1CE3CC", "sub_1CE3DC", "sub_1CE3F4", "sub_1CE410", "sub_1CE434", "sub_1CFDA4", "sub_1CFF68", "sub_1CFF9C", "sub_1D5A90", "sub_1D5A94", "sub_1D5AA4", "sub_1D5AE0", "sub_1D5C08", "sub_1D5CE8", "sub_1D5CEC", "sub_1D5D08", "sub_1D7744", "sub_1D77F8", "sub_1D8228", "sub_1D822C", "sub_1D8240", "sub_1D874C", "sub_1D880C", "sub_1D8AD0", "sub_1D8B18", "sub_1D9650", "sub_1D96A8", "sub_1D96B8", "sub_1D96C8", "sub_1D96F0", "sub_1D9718", "sub_1D9740", "sub_1D9A7C", "sub_1D9AA4", "sub_1DA2E4", "sub_1DA2E8", "sub_1DA2F4", "sub_1DA458", "sub_1DA470", "sub_1DB90C", "sub_1DB910", "sub_1DB930", "sub_1E36E4", "sub_1E384C", "sub_1E394C", "sub_1E3FE4", "sub_1E4094", "sub_1E4788", "sub_1E478C", "sub_1E47A4", "sub_1E487C", "sub_1E49C4", "sub_1E4AC0", "sub_1E4AE8", "sub_1E4C10", "sub_1E4DB0", "sub_1E4EB4", "sub_1E4EC0", "_ZNSt3__115future_categoryEv", "_ZNSt3__112future_errorC2ENS_10error_codeE", "sub_1E50F8", "_ZNSt3__112future_errorD2Ev", "_ZNSt3__112future_errorD0Ev", "sub_1E513C", "sub_1E5150", "sub_1E5190", "sub_1E5230", "sub_1E5244", "sub_1E5290", "sub_1E52E4", "_ZNSt3__112bad_weak_ptrD2Ev", "_ZNSt3__112bad_weak_ptrD0Ev", "_ZNKSt3__112bad_weak_ptr4whatEv", "nullsub_6", "j_j__ZdlPv_1", "sub_1E5344", "j_j__ZdlPv_3", "sub_1E538C", "_ZNSt3__112__get_sp_mutEPKv", "_ZNSt3__117declare_reachableEPv", "_ZNSt3__119declare_no_pointersEPcm", "_ZNSt3__121undeclare_no_pointersEPcm", "_ZNSt3__118get_pointer_safetyEv", "_ZNSt3__121__undeclare_reachableEPv", "_ZNSt3__15alignEmmRPvRm", "_ZSt18uncaught_exceptionv", "sub_1E5520", "_ZNSt16nested_exceptionC2Ev", "_ZSt17current_exceptionv", "_ZNSt16nested_exceptionD2Ev", "_ZNSt16nested_exceptionD0Ev", "_ZNKSt16nested_exception14rethrow_nestedEv", "sub_1E5614", "_ZSt17rethrow_exceptionSt13exception_ptr", "sub_1E563C", "sub_1E567C", "sub_1E84B0", "sub_1E90D0", "sub_1E926C", "sub_1E9384", "sub_1E99EC", "sub_1E9A00", "j_j__ZdlPv_14", "nullsub_20", "sub_1E9CD0", "sub_1E9D20", "sub_1E9D50", "sub_1E9D58", "sub_1E9DBC", "sub_1E9DE8", "sub_1E9E28", "sub_1EA074", "sub_1EA110", "sub_1EA73C", "sub_1EA750", "j_j__ZdlPv_15", "sub_1EA7A4", "sub_1EA830", "sub_1EA8D4", "sub_1EAAF8", "DobbyHook", "sub_1EAD78", "sub_1EAE04", "sub_1EAE90", "sub_1EAEC0", "sub_1EAEFC", "sub_1EAF34", "log_set_level", "log_switch_to_syslog", "log_switch_to_file", "log_internal_impl", "nullsub_4", "sub_1EB1C8", "sub_1EB254", "sub_1EB2BC", "sub_1EB310", "sub_1EB31C", "sub_1EB350", "sub_1EB364", "sub_1EB3A8", "sub_1EB3E8", "sub_1EB3F4", "sub_1EB460", "sub_1EB468", "sub_1EB470", "sub_1EB4FC", "sub_1EB508", "sub_1EB514", "sub_1EB54C", "sub_1EB584", "sub_1EB5AC", "sub_1EBBC0", "sub_1EBCFC", "sub_1EBDB0", "sub_1EBEE0", "sub_1EBEE4", "sub_1EBEF4", "sub_1EBEFC", "sub_1EBF04", "sub_1EBF0C", "sub_1EBF20", "sub_1EC02C", "CodePatch", "sub_1EC23C", "sub_1EC248", "sub_1EC268", "sub_1EC274", "sub_1EC298", "sub_1EC2A8", "sub_1EC2B0", "sub_1EC2B8", "sub_1EC2C0", "sub_1EC38C", "sub_1EC3B8", "sub_1EC660", "sub_1EC668", "sub_1EC670", "sub_1EC678", "j_free", "nullsub_21", "sub_1EC688", "sub_1EC69C", "sub_1EC6E0", "sub_1EC730", "sub_1EC754", "sub_1EC790", "sub_1EC814", "sub_1EC838", "sub_1EC844", "sub_1EC850", "sub_1EC8AC", "sub_1EC908", "sub_1ECA3C", "sub_1ECA44", "sub_1ECA4C", "sub_1ECA60", "sub_1ECAE8", "sub_1ECB24", "sub_1ECCD8", "sub_1ED2E4", "sub_1ED2F4", "_ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcmm", "sub_1ED544", "sub_1ED764", "sub_1ED92C", "sub_1EDDC0", "sub_1EE384", "sub_1EE78C", "sub_1EF318", "sub_1EF574", "sub_1EF628", "sub_1EF814", "sub_1EF8BC", "sub_1EFAC8", "sub_1EFCC0", "sub_1F059C", "sub_1F09F8", "sub_1F0A00", "sub_1F0DB4", "sub_1F13FC", "sub_1F1404", "sub_1F1734", "sub_1F1954", "nullsub_23", "j_j__ZdlPv_24", "sub_1F20A0", "sub_1F2274", "sub_1F228C", "sub_1F22B0", "sub_1F22EC", "sub_1F2330", "sub_1F2764", "sub_1F2788", "sub_1F27C4", "sub_1F2B10", "sub_1F2B7C", "sub_1F2C7C", "sub_1F2DDC", "sub_1F32C8", "sub_1F36CC", "j_j__ZdlPv_16", "j_j__ZdlPv_17", "j_j__ZdlPv_18", "j_j__ZdlPv_19", "j_j__ZdlPv_20", "j_j__ZdlPv_21", "j_j__ZdlPv_22", "j_j__ZdlPv_23", "sub_1F36F4", "sub_1F4360", "nullsub_24", "nullsub_25", "nullsub_26", "nullsub_27", "nullsub_28", "nullsub_29", "nullsub_30", "nullsub_31", "sub_1F4528", "sub_1F48E0", "sub_1F4D94", "sub_1F4F68", "sub_1F513C", "sub_1F58C8", "sub_1F8584", "sub_1F8F4C", "sub_1F90F4", "sub_1F92C8", "sub_1FBF60", "sub_1FC37C", "sub_1FC550", "sub_1FEFD8", "sub_1FF0F4", "sub_1FF424", "sub_1FF8E8", "sub_1FFBA0", "sub_1FFC10", "sub_1FFCBC", "sub_1FFCC0", "sub_1FFCF4", "sub_1FFD14", "sub_1FFE18", "sub_1FFEC0", "sub_1FFEC4", "sub_1FFEF8", "sub_1FFF18", "sub_1FFFE8", "sub_2001A0", "sub_200394", "sub_200650", "sub_2006C4", "sub_200738", "sub_200960", "sub_200AC0", "sub_200D54", "sub_200D90", "sub_200F90", "sub_2010B4", "sub_201238", "sub_201440", "sub_201B20", "sub_201B28", "sub_201C24", "sub_201D9C", "sub_20245C", "sub_202554", "sub_2025F0", "sub_202718", "sub_202C98", "sub_203038", "sub_2038C0", "sub_203ED0", "sub_204678", "sub_204BC4", "sub_204CC0", "sub_204DD4", "sub_204F7C", "sub_20510C", "sub_205AD8", "sub_20691C", "sub_2069DC", "sub_206CE8", "sub_206D94", "sub_2071C0", "sub_2071EC", "sub_2075AC", "sub_2075C8", "sub_2076B8", "sub_207908", "nullsub_22", "sub_207960", "sub_207964", "sub_207A08", "sub_207A78", "sub_207AF0", "sub_207B54", "sub_208050", "sub_208068", "sub_2080CC", "sub_208198", "sub_2082A0", "sub_208310", "sub_208370", "sub_2083D8", "sub_2084C4", "sub_208558", "sub_2087A8", "sub_20895C", "sub_208A70", "sub_208BC8", "sub_208D14", "sub_208D84", "sub_208EE8", "sub_209010", "sub_2090B4", "sub_20916C", "sub_2091DC", "sub_20924C", "sub_20940C", "sub_209674", "sub_209CBC", "sub_209D88", "sub_20A5D0", "sub_20A7D0", "sub_20A86C", "sub_20AD24", "sub_20AD60", "sub_20AE04", "sub_20AF0C", "sub_20B4E0", "sub_20B4F4", "sub_20B570", "sub_20B8F4", "sub_20B900", "sub_20B904", "sub_20B938", "sub_20B958", "sub_20B98C", "sub_20BA5C", "sub_20BB74", "_ZNSt3__16vectorIiNS_9allocatorIiEEE21__push_back_slow_pathIiEEvOT_", "_ZNSt3__16vectorIiNS_9allocatorIiEEE21__push_back_slow_pathIRKiEEvOT_", "sub_20BF2C", "sub_20C0DC", "sub_20C3B8", "sub_20D070", "sub_20D0EC", "sub_20D138", "sub_20D2D0", "sub_20D36C", "sub_20D4B8", "sub_20DEF4", "sub_20E010", "sub_20E0CC", "sub_20E21C", "sub_20E35C", "sub_20E4D8", "sub_20E7C0", "sub_20E824", "sub_20E91C", "sub_20EAA4", "sub_20EC48", "sub_20ECBC", "sub_20ED30", "sub_20F5AC", "sub_20F768", "sub_20FA70", "sub_210574", "sub_2108C8", "sub_210AC0", "sub_212EE8", "sub_2133B8", "sub_2142AC", "sub_21587C", "sub_215A24", "sub_215BD8", "sub_216198", "sub_2161A4", "sub_2161AC", "sub_2161F0", "sub_216230", "sub_216274", "sub_2162B4", "sub_2162D4", "sub_2163AC", "sub_216504", "sub_217188", "sub_217444", "sub_217510", "sub_2175E0", "sub_217600", "j_j___read_self", "__read_self", "__self_kill", "__self_prctl", "__self_lseek", "sub_217698", "sub_2178BC", "sub_217ADC", "sub_217B20", "sub_217C3C", "sub_217DB8", "sub_217FFC", "sub_218CB0", "sub_218F34", "sub_2191F0", "sub_219294", "sub_219350", "sub_21944C", "sub_2195D0", "sub_2196C4", "sub_219720", "sub_219728", "sub_21972C", "sub_219910", "sub_219A58", "sub_219BEC", "sub_219C14", "sub_219C54", "sub_219D44", "sub_219E58", "_Unwind_GetGR", "sub_219EEC", "_Unwind_GetCFA", "_Unwind_SetGR", "_Unwind_GetIP", "_Unwind_GetIPInfo", "_Unwind_SetIP", "_Unwind_GetLanguageSpecificData", "_Unwind_GetRegionStart", "_Unwind_FindEnclosingFunction", "_Unwind_GetDataRelBase", "_Unwind_GetTextRelBase", "sub_21A0C4", "sub_21A13C", "sub_21A634", "sub_21AA50", "sub_21AFE8", "sub_21B20C", "sub_21B2D8", "sub_21B324", "sub_21B3E4", "__frame_state_for", "nullsub_5", "_Unwind_RaiseException", "_Unwind_ForcedUnwind", "_Unwind_Resume", "_Unwind_Resume_or_Rethrow", "_Unwind_DeleteException", "_Unwind_Backtrace", "sub_21BB30", "sub_21BB58", "sub_21BB98", "sub_21BBB4", "sub_21BC74", "sub_21BD28", "sub_21BD88", "sub_21BDE8", "sub_21BE48", "sub_21BF38", "sub_21BFC8", "sub_21C0C4", "sub_21C224", "sub_21C234", "sub_21C648", "sub_21C6E4", "sub_21C844", "sub_21C978", "__register_frame_info_bases", "__register_frame_info", "__register_frame", "__register_frame_info_table_bases", "__register_frame_info_table", "__register_frame_table", "__deregister_frame_info_bases", "__deregister_frame_info", "__deregister_frame", "_Unwind_Find_FDE", "__imp_opendir", "__imp_execve", "__imp_fdopen", "__imp_memcmp", "__imp_listen", "__imp_ioctl", "__imp___errno", "__imp_flock", "__imp_remove", "__imp_deflateEnd", "__imp_abort", "__imp_realloc", "__imp_connect", "__imp_write", "__imp_dup2", "__imp_pthread_self", "__imp__exit", "__imp_srandom", "__imp_sscanf", "__imp_fsync", "__imp_gettimeofday", "__imp_srand", "__imp_getpagesize", "__imp_inflate", "__imp_pipe", "__imp_pthread_cond_broadcast", "__imp_epoll_create", "__imp_access", "__imp_snprintf", "__imp_signal", "__imp_lseek", "__imp_getpid", "__imp_readdir", "__imp_creat", "__imp_time", "__imp_inflateInit2_", "__imp_memset", "__imp_unlink", "__imp_strlcpy", "__imp_dladdr", "__imp_fmodf", "__imp_malloc", "__imp_getcwd", "__imp_fork", "__imp_fmod", "__imp_random", "__imp_dlopen", "__imp_memmove", "__imp_gethostbyname", "__imp_strcat", "__imp_pthread_join", "__imp_rand", "__imp_fflush", "__imp_strncmp", "__imp_pthread_exit", "__imp_recv", "__imp_isxdigit", "__imp_strcpy", "__imp_strrchr", "__imp_fstat", "__imp___cxa_atexit", "__imp_pthread_key_delete", "__imp_lstat", "__imp_closedir", "__imp_pthread_create", "__imp_fclose", "__imp_setenv", "__imp_strdup", "__imp_inet_addr", "__imp_sleep", "__imp_open", "__imp_pow", "__imp_strlcat", "__imp_strstr", "__imp___assert2", "__imp_epoll_wait", "__imp_vfprintf", "__imp_kill", "__imp_deflateInit_", "__imp_munmap", "__imp_pthread_cond_wait", "__imp_pthread_setspecific", "__imp_deflate", "__imp_strchr", "__imp_chmod", "__imp_pthread_mutex_destroy", "__imp_gettid", "__imp_bind", "__imp_getppid", "__imp_adler32", "__imp_popen", "__imp_pthread_cond_destroy", "__imp_fnmatch", "__imp_dl_iterate_phdr", "__imp_waitpid", "__imp_fwrite", "__imp_llabs", "__imp_deflateBound", "__imp_readlink", "__imp_strncpy", "__imp___cxa_finalize", "__imp_exit", "__imp_raise", "__imp_dlclose", "__imp_vprintf", "__imp_send", "__imp_atoll", "__imp_fgets", "__imp_lseek64", "__imp_inflateEnd", "__imp_pthread_mutex_init", "__imp___android_log_vprint", "__imp_strtoul", "__imp_socket", "__imp_close", "__imp_epoll_ctl", "__imp_sysconf", "__imp_calloc", "__imp_execl", "__imp_getsockopt", "__imp_read", "__imp_fputc", "__imp_prctl", "__imp_strtoull", "__imp_setsockopt", "__imp_mkdir", "__imp_pthread_mutex_unlock", "__imp_fcntl", "__imp_vsnprintf", "__imp_setpgid", "__imp_ftruncate", "__imp_pthread_mutex_lock", "__imp_tolower", "__imp_nanosleep", "__imp_syscall", "__imp_mprotect", "__imp_isupper", "__imp_free", "__imp_toupper", "__imp_dlsym", "__imp_pclose", "__imp_atoi", "__imp_stat", "__imp_accept", "__imp_memchr", "__imp_vsyslog", "__imp_inet_ntoa", "__imp_strerror", "__imp_fopen", "__imp_isspace", "__imp_pthread_detach", "__imp_strtok", "__imp_pwrite", "__imp_fileno", "__imp_atol", "__imp_pthread_getspecific", "__imp_sprintf", "__imp_getenv", "__imp_pread", "__imp_memcpy", "__imp_pthread_once", "__imp_strlen", "__imp_pthread_key_create", "__imp_strtol", "__imp___stack_chk_fail", "__imp_mmap", "__imp_ptrace", "__imp_strcasecmp", "__imp_getuid"];

var func_addr_KEKE = [0x2940, 0x2960, 0x2970, 0x2980, 0x2990, 0x29a0, 0x29b0, 0x29c0, 0x29d0, 0x29e0, 0x29f0, 0x2a00, 0x2a10, 0x2a20, 0x2a30, 0x2a40, 0x2a50, 0x2a60, 0x2a70, 0x2a80, 0x2a90, 0x2aa0, 0x2ab0, 0x2ac0, 0x2ad0, 0x2ae0, 0x2af0, 0x2b00, 0x2b10, 0x2b20, 0x2b30, 0x2b40, 0x2b50, 0x2b60, 0x2b70, 0x2b80, 0x2b90, 0x2ba0, 0x2bb0, 0x2bc0, 0x2bd0, 0x2be0, 0x2bf0, 0x2c00, 0x2c10, 0x2c20, 0x2c30, 0x2c40, 0x2c50, 0x2c60, 0x2c70, 0x2c80, 0x2c90, 0x2ca0, 0x2cb0, 0x2cc0, 0x2cd0, 0x2ce0, 0x2cf0, 0x2d00, 0x2d10, 0x2d20, 0x2d30, 0x2d40, 0x2d50, 0x2d60, 0x2d70, 0x2d80, 0x2d90, 0x2da0, 0x2db0, 0x2dc0, 0x2dd0, 0x2de0, 0x2df0, 0x2e00, 0x2e10, 0x2e20, 0x2e2c, 0x2ed0, 0x2ee8, 0x2eec, 0x2f0c, 0x2f1c, 0x2f40, 0x2f54, 0x2f68, 0x2f6c, 0x2f8c, 0x2f98, 0x2fbc, 0x2fd0, 0x2fdc, 0x2fe4, 0x3034, 0x303c, 0x3060, 0x3080, 0x3090, 0x30a4, 0x30a8, 0x30ac, 0x30b0, 0x30e0, 0x30e4, 0x3190, 0x31ac, 0x31d0, 0x31ec, 0x3224, 0x3240, 0x3300, 0x3574, 0x35ac, 0x3604, 0x36c4, 0x36f8, 0x3768, 0x379c, 0x39dc, 0x3b1c, 0x3b58, 0x3bf4, 0x3c94, 0x4000, 0x41b4, 0x4918, 0x49f0, 0x4b54, 0x4c70, 0x4cd4, 0x4e84, 0x509c, 0x52bc, 0x5344, 0x5378, 0x53bc, 0x5400, 0x5444, 0x5478, 0x5650, 0x580c, 0x59bc, 0x5b08, 0x5df0, 0x5e6c, 0x5f20, 0x6044, 0x60e0, 0x6128, 0x6174, 0x61a8, 0x6208, 0x6268, 0x62a0, 0x633c, 0x6398, 0x63f8, 0x6424, 0x6430, 0x6484, 0x6544, 0x6590, 0x6698, 0x66e8, 0x67e0, 0x6814, 0x684c, 0x6884, 0x68c4, 0x68f8, 0x6930, 0x6968, 0x69d0, 0x6a04, 0x6a3c, 0x6a74, 0x6adc, 0x6b78, 0x6c14, 0x6c70, 0x6cd0, 0x6d08, 0x6d5c, 0x6dbc, 0x6ec0, 0x72d4, 0x7348, 0x73b4, 0x7470, 0x74bc, 0x75c8, 0x7724, 0x788c, 0x78c4, 0x78fc, 0x7b04, 0x7b4c, 0x7f44, 0x7fa0, 0x8000, 0x8130, 0x8224, 0x825c, 0x8430, 0x8ab0, 0x8afc, 0x8b50, 0x8c74, 0x8ed4, 0x900c, 0x9218, 0x92b0, 0x94bc, 0x96ac, 0x96e0, 0x9844, 0x98a0, 0x9900, 0x9940, 0x9944, 0x9964, 0x9988, 0x999c, 0x99cc, 0x99f4, 0x9a24, 0x9a4c, 0x9a50, 0x9a54, 0x9a58, 0x9a5c, 0x9a60, 0x9a64, 0x9a68, 0x9a6c, 0x9a70, 0x9a90, 0x9ac4, 0x9ba4, 0x9bd0, 0x9c20, 0x9c64, 0x9cc0, 0x9d04, 0x9d60, 0x9dd8, 0x9e58, 0x9ffc, 0xa070, 0xa3ec, 0xa52c, 0xb970, 0xc918, 0xe3e0, 0x10964, 0x11220, 0x13908, 0x154dc, 0x1561c, 0x1573c, 0x1585c, 0x15938, 0x159d4, 0x15a70, 0x162f8, 0x163dc, 0x1647c, 0x16598, 0x16654, 0x166c4, 0x1674c, 0x167bc, 0x16b08, 0x16bd8, 0x16e64, 0x16ef8, 0x1745c, 0x17664, 0x17680, 0x176a4, 0x176ac, 0x17748, 0x177d4, 0x177d8, 0x17854, 0x274000, 0x274008, 0x274010, 0x274018, 0x274020, 0x274028, 0x274030, 0x274038, 0x274040, 0x274048, 0x274050, 0x274058, 0x274060, 0x274068, 0x274070, 0x274078, 0x274080, 0x274088, 0x274090, 0x274098, 0x2740a0, 0x2740a8, 0x2740b0, 0x2740b8, 0x2740c0, 0x2740c8, 0x2740d0, 0x2740d8, 0x2740e0, 0x2740e8, 0x2740f0, 0x2740f8, 0x274100, 0x274108, 0x274110, 0x274118, 0x274120, 0x274128, 0x274130, 0x274138, 0x274140, 0x274148, 0x274150, 0x274158, 0x274160, 0x274168, 0x274170, 0x274178, 0x274180, 0x274188, 0x274190, 0x274198, 0x2741a0, 0x2741a8, 0x2741b0, 0x2741b8, 0x2741c0, 0x2741c8, 0x2741d0, 0x2741d8, 0x2741e0, 0x2741e8, 0x2741f0, 0x2741f8, 0x274200, 0x274208, 0x274210];
var func_name_KEKE = ["sub_2940", "strcpy", "uncompress", "fmodf", "j_ffi_call_SYSV", "pthread_create", "strerror", "snprintf", "syscall", "munmap", "__stack_chk_guard", "__errno", "getenv", "_Znwm", "getpid", "fgets", "prctl", "j_interpreter_wrap_int64_t", "j_ffi_prep_cif", "memcpy", "puts", "__cxa_finalize", "feof", "malloc", "j_ffi_prep_cif_var", "vsnprintf", "select", "readdir", "isspace", "inotify_init", "dladdr", "lseek", "_ZdlPv", "j___clear_cache", "mmap", "pthread_detach", "abort", "__stack_chk_fail", "strtol", "calloc", "kill", "j___aarch64_sync_cache_range", "dl_iterate_phdr", "fmod", "strstr", "__cxa_pure_virtual", "j_ffi_prep_closure_loc", "read", "strncmp", "dlopen", "strncpy", "j_ffi_prep_cif_machdep", "setenv", "strtok", "sscanf", "isalpha", "sigaction", "dlsym", "strdup", "j_ffi_call", "fopen", "memset", "_ZdaPv", "fclose", "time", "opendir", "strcmp", "inotify_add_watch", "_Znam", "atoi", "strlen", "j__Z10__arm_a_20v", "open", "mprotect", "closedir", "close", "raise", "start", "sub_2E2C", "sub_2ED0", "sub_2EE8", "sub_2EEC", "sub_2F0C", "sub_2F1C", "sub_2F40", "sub_2F54", "sub_2F68", "sub_2F6C", "sub_2F8C", "sub_2F98", "sub_2FBC", "sub_2FD0", "sub_2FDC", "sub_2FE4", "sub_3034", "sub_303C", "sub_3060", "sub_3080", "sub_3090", "sub_30A4", "sub_30A8", "sub_30AC", "sub_30B0", "j_abort", "sub_30E4", "sub_3190", "sub_31AC", "sub_31D0", "sub_31EC", "sub_3224", "sub_3240", "sub_3300", "sub_3574", "sub_35AC", "sub_3604", "sub_36C4", "sub_36F8", "sub_3768", "sub_379C", "sub_39DC", "sub_3B1C", "sub_3B58", "sub_3BF4", "Link", "sub_4000", "sub_41B4", "sub_4918", "sub_49F0", "sub_4B54", "sub_4C70", "sub_4CD4", "sub_4E84", "sub_509C", "sub_52BC", "sub_5344", "sub_5378", "sub_53BC", "sub_5400", "sub_5444", "sub_5478", "sub_5650", "sub_580C", "sub_59BC", "sub_5B08", "sub_5DF0", "sub_5E6C", "sub_5F20", "sub_6044", "sub_60E0", "sub_6128", "sub_6174", "sub_61A8", "sub_6208", "sub_6268", "sub_62A0", "sub_633C", "sub_6398", "sub_63F8", "sub_6424", "_ZN9__arm_c_19__arm_c_0Ev", "sub_6484", "sub_6544", "sub_6590", "sub_6698", "sub_66E8", "sub_67E0", "sub_6814", "sub_684C", "sub_6884", "sub_68C4", "sub_68F8", "sub_6930", "sub_6968", "sub_69D0", "sub_6A04", "sub_6A3C", "sub_6A74", "sub_6ADC", "sub_6B78", "sub_6C14", "sub_6C70", "sub_6CD0", "_ZN10DynCryptor9__arm_c_0Ev", "sub_6D5C", "sub_6DBC", "sub_6EC0", "sub_72D4", "sub_7348", "_Z10__arm_a_21v", "_Z10__arm_a_20v", "sub_74BC", "sub_75C8", "sub_7724", "sub_788C", "sub_78C4", "sub_78FC", "sub_7B04", "sub_7B4C", "sub_7F44", "_Z9__arm_a_2PcmS_Rii", "sub_8000", "sub_8130", "sub_8224", "sub_825C", "sub_8430", "sub_8AB0", "JNI_OnLoad", "sub_8B50", "sub_8C74", "sub_8ED4", "sub_900C", "sub_9218", "sub_92B0", "sub_94BC", "sub_96AC", "sub_96E0", "_Z9__arm_a_1P7_JavaVMP7_JNIEnvPvRi", "sub_98A0", "sub_9900", "nullsub_2", "sub_9944", "sub_9964", "sub_9988", "sub_999C", "sub_99CC", "sub_99F4", "sub_9A24", "nullsub_3", "nullsub_4", "nullsub_5", "nullsub_6", "j_lseek", "j_lseek_0", "j_lseek_1", "j_lseek_2", "j_lseek_3", "sub_9A70", "sub_9A90", "sub_9AC4", "sub_9BA4", "sub_9BD0", "sub_9C20", "sub_9C64", "sub_9CC0", "sub_9D04", "sub_9D60", "sub_9DD8", "sub_9E58", "sub_9FFC", "sub_A070", "sub_A3EC", "sub_A52C", "sub_B970", "sub_C918", "sub_E3E0", "sub_10964", "sub_11220", "sub_13908", "interpreter_wrap_int64_t", "interpreter_wrap_float", "interpreter_wrap_double", "interpreter_wrap_int64_t_bridge", "interpreter_wrap_float_bridge", "interpreter_wrap_double_bridge", "sub_15A70", "sub_162F8", "sub_163DC", "sub_1647C", "sub_16598", "sub_16654", "sub_166C4", "sub_1674C", "sub_167BC", "ffi_prep_cif_machdep", "ffi_call", "ffi_prep_closure_loc", "sub_16EF8", "sub_1745C", "ffi_prep_cif", "ffi_prep_cif_var", "ffi_prep_closure", "ffi_call_SYSV", "ffi_closure_SYSV", "__clear_cache", "__aarch64_sync_cache_range", "_Z9__arm_a_0v", "__imp_strcpy", "__imp_uncompress", "__imp_fmodf", "__imp_pthread_create", "__imp_strerror", "__imp_snprintf", "__imp_syscall", "__imp_munmap", "__imp___stack_chk_guard", "__imp___errno", "__imp_getenv", "__imp__Znwm", "__imp_getpid", "__imp_fgets", "__imp_prctl", "__imp_memcpy", "__imp_puts", "__imp___cxa_finalize", "__imp_feof", "__imp_malloc", "__imp_vsnprintf", "__imp_select", "__imp_readdir", "__imp_isspace", "__imp_inotify_init", "__imp_dladdr", "__imp_lseek", "__imp__ZdlPv", "__imp_mmap", "__imp_pthread_detach", "__imp_abort", "__imp___stack_chk_fail", "__imp_strtol", "__imp_calloc", "__imp_kill", "__imp_dl_iterate_phdr", "__imp_fmod", "__imp_strstr", "__imp___cxa_pure_virtual", "__imp_read", "__imp_strncmp", "__imp_dlopen", "__imp_strncpy", "__imp_setenv", "__imp_strtok", "__imp_sscanf", "__imp_isalpha", "__imp_sigaction", "__imp_dlsym", "__imp_strdup", "__imp_fopen", "__imp_memset", "__imp__ZdaPv", "__imp_fclose", "__imp_time", "__imp_opendir", "__imp_strcmp", "__imp_inotify_add_watch", "__imp__Znam", "__imp_atoi", "__imp_strlen", "__imp_open", "__imp_mprotect", "__imp_closedir", "__imp_close", "__imp_raise", "free"];
var func_addr=func_addr_KEKE.concat(func_addr_Main);
var func_name=func_name_KEKE.concat(func_name_Main);
var so_name = "libjiagu_64.so";

/*
    @param print_stack: Whether printing stack info, default is false.
*/
var print_stack = false;

/*
    @param print_stack_mode
    - FUZZY: print as much stack info as possible
    - ACCURATE: print stack info as accurately as possible
    - MANUAL: if printing the stack info in an error and causes exit, use this option to manually print the address
*/
var print_stack_mode = "FUZZY";

function addr_in_so(addr){
    var process_Obj_Module_Arr = Process.enumerateModules();
    for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
        if(addr>process_Obj_Module_Arr[i].base && addr<process_Obj_Module_Arr[i].base.add(process_Obj_Module_Arr[i].size)){
            console.log(addr.toString(16),"is in",process_Obj_Module_Arr[i].name,"offset: 0x"+(addr-process_Obj_Module_Arr[i].base).toString(16));
        }
    }
}
function hook_dlopen() {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                var pathptr = args[0];
                if (pathptr !== undefined && pathptr != null) {
                    var path = ptr(pathptr).readCString();
                    //console.log(path);
                    if (path.indexOf(so_name) >= 0) {
                        this.is_can_hook = true;
                    }
                }
            },
            onLeave: function (retval) {
                if (this.is_can_hook) {
                    // note: you can do any thing before or after stalker trace so.

                    trace_so();
                }
            }
        }
    );
}

function trace_so(){
    var times = 1;
    var module = Process.getModuleByName(so_name);
    var pid = Process.getCurrentThreadId();
    console.log("start Stalker!");
    Stalker.exclude({
        "base": Process.getModuleByName("libc.so").base,
        "size": Process.getModuleByName("libc.so").size
    })
    Stalker.follow(pid,{
        events:{
            call:false,
            ret:false,
            exec:false,
            block:false,
            compile:false
        },
        onReceive:function(events){
        },
        transform: function (iterator) {
            var instruction = iterator.next();
            do{
                if (func_addr.indexOf(instruction.address - module.base) !== -1) {
                    if(func_addr.indexOf(instruction.address - module.base) < func_addr_KEKE.length){
                        console.log("callkeke" + times + ":" + func_name[func_addr.indexOf(instruction.address - module.base)]);
                    }else{
                        console.log("callmain" + times + ":" + func_name[func_addr.indexOf(instruction.address - module.base)]);
                    }

                    times = times + 1
                    if (print_stack) {
                        if (print_stack_mode === "FUZZY") {
                            iterator.putCallout((context) => {
                                console.log("backtrace:\n"+Thread.backtrace(context, Backtracer.FUZZY).map(DebugSymbol.fromAddress).join('\n'));
                                console.log('---------------------')
                            });
                        }
                        else if (print_stack_mode === "ACCURATE") {
                            iterator.putCallout((context) => {
                                console.log("backtrace:\n"+Thread.backtrace(context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n'));
                                console.log('---------------------')
                            })
                        }

                        else if (print_stack_mode === "MANUAL") {
                            iterator.putCallout((context) => {
                                console.log("backtrace:")
                                Thread.backtrace(context, Backtracer.FUZZY).map(addr_in_so);
                                console.log('---------------------')
                            })
                        }
                    }
                }
                iterator.keep();
            } while ((instruction = iterator.next()) !== null);
        },

        onCallSummary:function(summary){

        }
    });
    console.log("Stalker end!");
}

setImmediate(hook_dlopen,0);


var bbase;
function my_hook_dlopen(soName = '') {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
      {
          onEnter: function (args) {
              var pathptr = args[0];
              if (pathptr !== undefined && pathptr != null) {
                  var path = ptr(pathptr).readCString();
                  if (path.indexOf(soName) >= 0) {
                      //console.log("soname"+path.split('/').pop());
                      this.is_can_hook = true;
                  }
              }
          },
          onLeave: function (retval) {
              if (this.is_can_hook) {
                  hook_proc_self_maps();
                  findmmap();
                  hook_ffi();
              }
          }
      }
    );
}
function showStacks(){
    console.log(
      Java.use("android.util.Log")
        .getStackTraceString(//这两句相当于Log.getStackTraceString
          Java.use("java.lang.Throwable").$new()//Java.use("java.lang.Throwable").$new()相当于new Throwable()
        )
    )
}

function findmmap() {
    Interceptor.attach(Module.findExportByName('libc.so', 'mmap'), {
        onEnter (args) {
            this.addr = args[0];
            this.len = args[1].toInt32();
        },
        onLeave (retval) {
           // console.log("mmap mapped at", retval);

        }
    });
}
function hook_proc_self_maps() {

    const openPtr = Module.getExportByName(null, 'open');
    const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
    var fakePath = "/data/data/com.oacia.apk_protect/maps";
    bbase=Process.findModuleByName("libjiagu_64.so");

    Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
        var pathname = Memory.readUtf8String(pathnameptr);
       // console.log("open",pathname);
        if (pathname.indexOf("maps") >= 0) {
           // console.log("find",pathname,",redirect to",fakePath);
            var filename = Memory.allocUtf8String(fakePath);
            return open(filename, flag);
        }
        if (pathname.indexOf("dex") >= 0) {
        	// console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
        	// 	.map(addr => addr.sub(bbase.base).toString()));

        }
        var fd = open(pathnameptr, flag);
        return fd;
    }, 'int', ['pointer', 'int']));
}

function hook_ffi() {
    var module = Process.findModuleByName("libjiagu_64.so");
    Interceptor.attach(module.base.add(0x1770C), {
        onEnter: function (args) {
            try {
                var s = this.context.x6.readCString();
                if (s.indexOf('frida') !== -1 ||
                  s.indexOf('gum-js-loop') !== -1 ||
                  s.indexOf('gmain') !== -1 ||
                  s.indexOf('linjector') !== -1 ||
                  s.indexOf('/proc/') !== -1) {
                    //console.log(hexdump(this.context.x6,{length:200}));
                    // console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
                    // 	.map(addr => addr.sub(module.base).toString())
                    // 	.join('\n'));

                    Memory.protect(this.context.x0, Process.pointerSize, 'rwx');
                    var replace_str = ""
                    for (var i = 0; i < s.length; i++) {
                        replace_str += "0"
                    }
                    this.context.x0.writeUtf8String(replace_str);
                    var func=this.context.x24;
                    //console.log("fff->",func.sub(module.base).toString(16));

                }
            } catch (e) {

            }
        },
        onLeave: function (ret) {
        }
    });
}

setImmediate(my_hook_dlopen,"libjiagu_64.so");

注意到下面有一个函数sub_18FEA8

咋一堆加密后的内容捏

按理说这里dump下来就可以是解密的dex了，不过继续分析分析解密吧

a=bytearray(b"e`TQ9gxz7<GxzJk~LorkRugjkx:UvktKVQnsXQTYz9ee778hgyoieyzxotmOiTY9e77ingxezxgozyOiKKTY9e?grruigzuxOiKKKKpVQTYe76Ug")
for i in range(len(a)):
    a[i]-=6
print(a)

_ZNK3art16ArtDexFileLoader4OpenEPKhmRKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEjPKNS_10Oa

似乎是加载dex

后面的

这个v7hook发现是加密的主dex

去看看什么函数去解密了这个，作者这里采用的内存读写断点

var so_name = "libjiagu_64.so";
function hook_dex_dec_enter_in_main_elf(){
	var module = Process.findModuleByName("libjiagu_64.so");
	Interceptor.attach(module.base.add(0x1346B4), {
		onEnter: function (args) {
			//memory breakpoint
			MemoryAccessMonitor.enable(
				{
					base:this.context.x0.add(0x8),
					size:40
				},{
					onAccess: function (details) {
						console.log(details.operation)
						console.log(get_addr_in_so(details.from));
					}
				}
			)
		},
		onLeave: function (ret) {
		}
	});
}

var zlib_count=0
function hook_zlib(){
	Interceptor.attach(Module.findExportByName(null, "inflate"), {
		// fd, buff, len
		onEnter: function (args) {
			zlib_count+=1
			if(zlib_count===2){
				hook_dex_dec_enter_in_main_elf();
			}
		},
		onLeave: function (ret) {
		}
	});
}
function hook_18FEA8(){
	var module = Process.findModuleByName("libjiagu_64.so");
	Interceptor.attach(module.base.add(0x18FEA8), {
		onEnter: function (args) {
			console.log("123213");
			console.log(hexdump(args[1]));
		}
	});
}
function anti_frida_check(){
	var module = Process.findModuleByName("libjiagu_64.so");
	Interceptor.attach(module.base.add(0x1770C), {
		onEnter: function (args) {
			try{
				var s = this.context.x6.readCString();
				if (s.indexOf('frida')!==-1 ||
					s.indexOf('gum-js-loop')!==-1 ||
					s.indexOf('gmain')!==-1 ||
					s.indexOf('linjector')!==-1 ||
					s.indexOf('/proc/')!==-1){
					//console.log(s)
					Memory.protect(this.context.x0, Process.pointerSize, 'rwx');
					var replace_str=""
					for(var i=0;i<s.length;i++){
						replace_str+="0"
					}
					this.context.x0.writeUtf8String(replace_str);
				}
			}
			catch (e){

			}
		},
		onLeave: function (ret) {
		}
	});
}

function get_addr_in_so(addr){
	var process_Obj_Module_Arr = Process.enumerateModules();
	for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
		if(addr>process_Obj_Module_Arr[i].base && addr<process_Obj_Module_Arr[i].base.add(process_Obj_Module_Arr[i].size)){
			return addr.toString(16)+" is in "+process_Obj_Module_Arr[i].name+" offset: 0x"+(addr-process_Obj_Module_Arr[i].base).toString(16);
		}
	}
	return addr.toString(16);
}
function hook_dlopen() {
	//hook_call_constructors();
	Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
		{
			onEnter: function (args) {
				var pathptr = args[0];
				if (pathptr !== undefined && pathptr != null) {
					var path = ptr(pathptr).readCString();
					console.log("dlopen "+path);
					if (path.indexOf(so_name) >= 0) {
						this.is_can_hook = true;
					}
				}
			},
			onLeave: function (retval) {
				if (this.is_can_hook) {
					//you can do any thing before stalker trace so
					//trace_so();
					hook_zlib();
					anti_frida_check();
					//hook_C918();
					hook_18FEA8();
				}
			}
		}
	);
}

setImmediate(hook_dlopen);

发现0xd364函数有读写这段加密dex的痕迹

跳过去看不出来什么逻辑

看看调用链里面的这个函数

有貌似解密dex的痕迹

hook发现传入的就是主dex

md,我单独去hook是没有输出的，不知道原因

stalker里面去hook直接卡住了

感觉是frida的原因…

后面测试是发现他确实是读取的dex然后应该是解密，这里自己写一个解密试试

baseDex=0x3198
start=baseDex+12
with open(r"D:\Android\soshell\jiagu\classes.dex", 'rb') as f:
    s = f.read()
dexA = s[start:start + 0x41E]
dexA = bytearray(dexA)
for i in range(len(dexA)):
    dexA[i] = ((dexA[i] + 0x70) ^ 0x36)&0xff

with open(r"D:\Android\soshell\jiagu\112.dex",'wb') as f:
    f.write(dexA)

看不太懂，似乎是一些配置信息或者说是apk信息

之后的sub_142ABC函数的应该是通过配置信息去读取解密

之后又在另外一个函数发现了些许解密痕迹

sub_1A1D84

hook密钥得到b”\x68\x76\x99\x72\x96\x60\x9f\x63\x96\x2c\x98\x30\xc2\x36\x51\x42”

sub_1A1E74

hook这个发现数据的前几个部分都相同，都是f7 4f e8 0e

第一个3表示的是加密数据总段为3，中间表示总长度为0x3A5DDB，最后一部分表示加密数据段的前半部分需要被rc4解密的长度

# baseDex=0x3198
# start=baseDex+12
# with open(r"D:\Android\soshell\jiagu\classes.dex", 'rb') as f:
#     s = f.read()
# dexA = s[start:start + 0x41E]
# dexA = bytearray(dexA)
# for i in range(len(dexA)):
#     dexA[i] = ((dexA[i] + 0x70) ^ 0x36)&0xff
 
# with open(r"D:\Android\soshell\jiagu\112.dex",'wb') as f:
#     f.write(dexA)

def RC4(data, key):
    S = list(range(256))
    j = 0
    out = []
 
    # KSA Phase
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
    # PRGA Phase
    i = j = 0
    count = 1
    for ch in data:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        out.append(ch ^ S[(S[i] + S[j]) % 256])
 
    return out
 
 
def RC4decrypt(ciphertext, key):
    return RC4(ciphertext, key)
 
key = b"\x68\x76\x99\x72\x96\x60\x9f\x63\x96\x2c\x98\x30\xc2\x36\x51\x42"
with open(r"D:\Android\soshell\jiagu\classes.dex", 'rb') as f:
    enc_data = f.read()
 
start = 0x35C2
dexcount = int.from_bytes(enc_data[start:start+4],'little')
start+=4
for i in range(dexcount):
    total_data_len = int.from_bytes(enc_data[start:start+4],'little')
    start+=4
    rc4_data_len = int.from_bytes(enc_data[start:start+4],'little')
    start+=4
    enc_dex = enc_data[start:start+rc4_data_len]
    start+=rc4_data_len
    dec_dex = RC4decrypt(enc_dex,key)
    dec2_data_len = int.from_bytes(dec_dex[9:13],'little')
    with open(f'dex{i+1}.dex','wb') as f:
        f.write(bytes(dec_dex))
    extra = enc_data[start:start+total_data_len-rc4_data_len]
    extra_data_base = int.from_bytes(dec_dex[5:9], 'little')
    extra_data_len = len(extra)
    start+=total_data_len-rc4_data_len-4
 
    print(f"part{i + 1}: total_data_len: {hex(total_data_len)}, rc4_data_len: {hex(rc4_data_len)}")
    print(f"rc4_dec_part{i + 1}: extra_data_base: {hex(extra_data_base)},extra_data_len: {hex(extra_data_len)}, dec2_data_len: {hex(dec2_data_len)}")
 
    with open(f'D:\\Android\\soshell\\jiagu\\{i+1}_extra.dex','wb') as f:
        f.write(bytes(extra))

之后发现并不是dex格式

sub_18F6AC看这个函数

不管了，直接hook得了

var bbase;
function my_hook_dlopen(soName = '') {
  Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
                     {
                       onEnter: function (args) {
                         var pathptr = args[0];
                         if (pathptr !== undefined && pathptr != null) {
                           var path = ptr(pathptr).readCString();
                           if (path.indexOf(soName) >= 0) {
                             //console.log("soname"+path.split('/').pop());
                             this.is_can_hook = true;
                           }
                         }
                       },
                       onLeave: function (retval) {
                         if (this.is_can_hook) {
                           hook_18FEA8();
                           hook_dex();
                           hook_ffi();

                         }
                       }
                     }
                    );
}
function hook_18FEA8(){
  var module = Process.findModuleByName("libjiagu_64.so");
  try {
    Interceptor.attach(module.base.add(0x143008), {
      onEnter: function (args) {
        try {
          console.log("123213");
          console.log(hexdump(args[1]));
        }catch(e){
          console.log("e",e.toString());
        }
      }

    });
  }catch(e){
    console.log("Error: " + e);
  }
}
function hook_dex() {
  var moudle = Process.findModuleByName("libjiagu_64.so");
  if (moudle) {
    var func = moudle.base.add(0x13467C);
    if (func) {
      Interceptor.attach(func, {
        onEnter: function (args) {
          console.log("open");
          //console.log("open", this.context.x0.readCString());
          //console.log("data:", hexdump(this.context.x1, { length: 100 }));  // 打印数据
        },
        onLeave: function (retval) {
          console.log("close", retval);
        }
      });
    } else {
      console.log("Invalid function address");
    }
  } else {
    console.log("Module not found");
    setTimeout(hook_dex, 100);
  }
}


function hook_ffi() {
  var module = Process.findModuleByName("libjiagu_64.so");
  Interceptor.attach(module.base.add(0x1770C), {
    onEnter: function (args) {
      try {
        var s = this.context.x6.readCString();
        if (s.indexOf('frida') !== -1 ||
            s.indexOf('gum-js-loop') !== -1 ||
            s.indexOf('gmain') !== -1 ||
            s.indexOf('linjector') !== -1 ||
            s.indexOf('/proc/') !== -1) {
          //console.log(hexdump(this.context.x6,{length:200}));
          //
          hook_18FEA8();
          //console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
          // 	.map(addr => addr.sub(module.base).toString())
          // 	.join('\n'));

          Memory.protect(this.context.x0, Process.pointerSize, 'rwx');
          var replace_str = ""
          for (var i = 0; i < s.length; i++) {
            replace_str += "0";
          };
          this.context.x0.writeUtf8String(replace_str);
          var func=this.context.x24;
					//console.log("fff->",func.sub(module.base).toString(16));

				}
			} catch (e) {

			}
		},
		onLeave: function (ret) {
		}
	});
}
setImmediate(my_hook_dlopen,"libjiagu_64.so");

function get_self_process_name() {
	var openPtr = Module.getExportByName('libc.so', 'open');
	var open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);

	var readPtr = Module.getExportByName("libc.so", "read");
	var read = new NativeFunction(readPtr, "int", ["int", "pointer", "int"]);

	var closePtr = Module.getExportByName('libc.so', 'close');
	var close = new NativeFunction(closePtr, 'int', ['int']);

	var path = Memory.allocUtf8String("/proc/self/cmdline");
	var fd = open(path, 0);
	if (fd != -1) {
		var buffer = Memory.alloc(0x1000);

		var result = read(fd, buffer, 0x1000);
		close(fd);
		result = ptr(buffer).readCString();
		return result;
	}

	return "-1";
}

function dump_dex() {
	var libart = Process.findModuleByName("libart.so");
	var addr_DefineClass = null;
	var symbols = libart.enumerateSymbols();
	for (var index = 0; index < symbols.length; index++) {
		var symbol = symbols[index];
		var symbol_name = symbol.name;
		//这个DefineClass的函数签名是Android9的
		//_ZN3art11ClassLinker11DefineClassEPNS_6ThreadEPKcmNS_6HandleINS_6mirror11ClassLoaderEEERKNS_7DexFileERKNS9_8ClassDefE
		if (symbol_name.indexOf("ClassLinker") >= 0 &&
			symbol_name.indexOf("DefineClass") >= 0 &&
			symbol_name.indexOf("Thread") >= 0 &&
			symbol_name.indexOf("DexFile") >= 0 ) {
			console.log(symbol_name, symbol.address);
			addr_DefineClass = symbol.address;
		}
	}
	var dex_maps = {};

	console.log("[DefineClass:]", addr_DefineClass);
	if (addr_DefineClass) {
		Interceptor.attach(addr_DefineClass, {
			onEnter: function (args) {
				var dex_file = args[5];
				//ptr(dex_file).add(Process.pointerSize) is "const uint8_t* const begin_;"
				//ptr(dex_file).add(Process.pointerSize + Process.pointerSize) is "const size_t size_;"
				var base = ptr(dex_file).add(Process.pointerSize).readPointer();
				var size = ptr(dex_file).add(Process.pointerSize + Process.pointerSize).readUInt();

				if (dex_maps[base] == undefined) {
					dex_maps[base] = size;
					var magic = ptr(base).readCString();
					if (magic.indexOf("dex") == 0) {
						var process_name = get_self_process_name();
						if (process_name != "-1") {
							var dex_path = "/data/data/" + process_name + "/files/" + base.toString(16) + "_" + size.toString(16) + ".dex";
							console.log("[find dex]:", dex_path);
							var fd = new File(dex_path, "wb");
							if (fd && fd != null) {
								var dex_buffer = ptr(base).readByteArray(size);
								fd.write(dex_buffer);
								fd.flush();
								fd.close();
								console.log("[dump dex]:", dex_path);

							}
						}
					}
				}
			}, onLeave: function (retval) {
			}
		});
	}
}

var is_hook_libart = false;

function hook_dlopen() {
	Interceptor.attach(Module.findExportByName(null, "dlopen"), {
		onEnter: function (args) {
			var pathptr = args[0];
			if (pathptr !== undefined && pathptr != null) {
				var path = ptr(pathptr).readCString();
				//console.log("dlopen:", path);
				if (path.indexOf("libart.so") >= 0) {
					this.can_hook_libart = true;
					console.log("[dlopen:]", path);
				}
			}
		},
		onLeave: function (retval) {
			if (this.can_hook_libart && !is_hook_libart) {
				dump_dex();
				is_hook_libart = true;
			}
		}
	})

	Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"), {
		onEnter: function (args) {
			var pathptr = args[0];
			if (pathptr !== undefined && pathptr != null) {
				var path = ptr(pathptr).readCString();
				//console.log("android_dlopen_ext:", path);
				if (path.indexOf("libart.so") >= 0) {
					this.can_hook_libart = true;
					console.log("[android_dlopen_ext:]", path);
				}
			}
		},
		onLeave: function (retval) {
			if (this.can_hook_libart && !is_hook_libart) {
				dump_dex();
				is_hook_libart = true;
			}
		}
	});
}


setImmediate(hook_dlopen);

完成

这里的oncreate应该是用了dex2c。。。。。。

嗯，差不多就这也吧，累了

检测去除以及分析

这里我的程序一直在退出，搞得心态很崩，不能正常的运行，我决定回到前面的线程创建的可疑之处。


function check_pthread_create() {
  var pthread_create_addr = Module.findExportByName(null, 'pthread_create');

  var pthread_create = new NativeFunction(pthread_create_addr, "int", ["pointer", "pointer", "pointer", "pointer"]);
  Interceptor.replace(pthread_create_addr, new NativeCallback(function (parg0, parg1, parg2, parg3) {
    var so_name = Process.findModuleByAddress(parg2).name;
    var so_path = Process.findModuleByAddress(parg2).path;
    var so_base = Module.getBaseAddress(so_name);
    var offset = parg2 - so_base;
    var PC = 0;
    if ((so_name.indexOf("jiagu") > -1)) {
      console.log("======")
      console.log("find thread func offset", so_name, offset.toString(16));
      Thread.backtrace(this.context, Backtracer.ACCURATE).map(addr_in_so);

      var check_list = []
      if (check_list.indexOf(offset)!==-1) {
        console.log("check bypass")
      } else {
        PC = pthread_create(parg0, parg1, parg2, parg3);
      }
    } else {
      PC = pthread_create(parg0, parg1, parg2, parg3);
    }
    return PC;
  }, "int", ["pointer", "pointer", "pointer", "pointer"]))
}

function addr_in_so(addr){
  var process_Obj_Module_Arr = Process.enumerateModules();
  for(var i = 0; i < process_Obj_Module_Arr.length; i++) {
    if(addr>process_Obj_Module_Arr[i].base && addr<process_Obj_Module_Arr[i].base.add(process_Obj_Module_Arr[i].size)){
      console.log(addr.toString(16),"is in",process_Obj_Module_Arr[i].name,"offset: 0x"+(addr-process_Obj_Module_Arr[i].base).toString(16));
    }
  }
}

check_pthread_create();

其实对这个API是很疑惑的

这里有两个函数

https://github.com/libffi/libffi/blob/master/src/aarch64/sysv.S

这里涉及到一个知识点就是libffi动态调用

libffi = Foreign Function Interface。让你在运行时，不写固定函数签名，也能用函数指针去动态调用 C 函数（包括传参、拿返回值），还可以把你写的回调“做成”函数指针给别人调用（closure）。

既然线程创建在这里有所创建，那我们可以hook一下


function hook_ffi(){
	var base=Module.findBaseAddress("libjiagu_64.so");
	if(base) {
		var func = base.add(0x0001770C);
		Interceptor.attach(func, {
			onEnter: function (args) {
				var ctx = this.context;
				console.log("x0->", ctx['x0']);
				console.log("x1->", ctx['x1']);
				console.log("x2->", ctx['x2']);
				console.log("x3->", ctx['x3']);
				console.log("x4->", ctx['x4']);
			}, onLeave: function (re) {

			}
		})
	}else{
		setTimeout(hook_ffi,100);
	}
}

有些是指针，有些则是数，这也充分的反应了ffi对应不同函数签名

换成hexdump，打印的东西有点多啊


function hook_ffi(){
	var base=Module.findBaseAddress("libjiagu_64.so");
	if(base) {
		var func = base.add(0x0001770C);
		Interceptor.attach(func, {
			onEnter: function (args) {
				var ctx = this.context;
				console.log("x0->", ctx['x0'].readCString());
				// console.log("x1->", ctx['x1']);
				// console.log("x2->", ctx['x2']);
				// console.log("x3->", ctx['x3']);
				// console.log("x4->", ctx['x4']);
			}, onLeave: function (re) {

			}
		})
	}else{
		setTimeout(hook_ffi,100);
	}
}

发现打印了很多内存空间的属性和区域？

翻了翻发现有很多系统的东西好像

function hook_ffi(){
			var base=Module.findBaseAddress("libjiagu_64.so");
			if(base) {
				var func = base.add(0x0001770C);
				Interceptor.attach(func, {
					onEnter: function (args) {
						try {
							var ctx = this.context;
							//console.log("x0->", ctx['x0'].readCString());
							var s=ctx['x0'].readCString();
							if (s.indexOf('frida')!==-1 ||
								s.indexOf('gum-js-loop')!==-1 ||
								s.indexOf('gmain')!==-1 ||
								s.indexOf('linjector')!==-1 ||
								s.indexOf('/proc/')!==-1){
								console.log(s)
							}
						}catch (e) {

						}
						// console.log("x1->", ctx['x1']);
						// console.log("x2->", ctx['x2']);
						// console.log("x3->", ctx['x3']);
						// console.log("x4->", ctx['x4']);
					}, onLeave: function (re) {

					}
				})
			}else{
				setTimeout(hook_ffi,100);
			}
		}

发现是打开了maps内存区域，去检测注入的是不是有frida的库

然后去替换一下这个字符串，但是替换了一个x0还是会退出，我就依次打印x0-x7所有寄存器，然后依次过滤

function hook_ffi(){
		var base=Module.findBaseAddress("libjiagu_64.so");
		if(base) {
			var func = base.add(0x0001770C);
			Interceptor.attach(func, {
				onEnter: function (args) {
					try {
						var ctx = this.context;
						//console.log("x0->", ctx['x0'].readCString());
						var s=ctx['x0'].readCString();
						if (s.indexOf('frida')!==-1 ||
							s.indexOf('gum-js-loop')!==-1 ||
							s.indexOf('gmain')!==-1 ||
							s.indexOf('linjector')!==-1 ||
							s.indexOf('/proc/')!==-1) {
							console.log(s)
							Memory.protect(this.context.x0, Process.pointerSize, 'rwx');
							var replace = '';
							for (let i = 0; i < s.length; i++) {
								replace += '0';
							}
							this.context.x0.writeUtf8String(replace);
							var s = ctx['x6'].readCString();
							if (s.indexOf('frida') !== -1 ||
								s.indexOf('gum-js-loop') !== -1 ||
								s.indexOf('gmain') !== -1 ||
								s.indexOf('linjector') !== -1 ||
								s.indexOf('/proc/') !== -1) {
								console.log(s)
								Memory.protect(this.context.x6, Process.pointerSize, 'rwx');
								var replace = '';
								for (let i = 0; i < s.length; i++) {
									replace += '0';
								}
								this.context.x6.writeUtf8String(replace);
							}
						}
					}catch (e) {

					}
					// console.log("x1->", ctx['x1']);
					// console.log("x2->", ctx['x2']);
					// console.log("x3->", ctx['x3']);
					// console.log("x4->", ctx['x4']);
				}, onLeave: function (re) {

				}
			})
		}else{
			setTimeout(hook_ffi,100);
		}
	}

发现还是会退出

这里我十分的疑惑，前面hook了open重定向map会导致退出？？可是我记得那个是一个监测点来着

var bbase;
function my_hook_dlopen(soName = '') {
	Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
		{
			onEnter: function (args) {
				var pathptr = args[0];
				if (pathptr !== undefined && pathptr != null) {
					var path = ptr(pathptr).readCString();
					if (path.indexOf(soName) >= 0) {
						//console.log("soname"+path.split('/').pop());
						this.is_can_hook = true;
					}
				}
			},
			onLeave: function (retval) {
				if (this.is_can_hook) {
					//hook_proc_self_maps();
					hook_ffi();
				}
			}
		}
	);
}
function showStacks(){
	console.log(
		Java.use("android.util.Log")
			.getStackTraceString(//这两句相当于Log.getStackTraceString
				Java.use("java.lang.Throwable").$new()//Java.use("java.lang.Throwable").$new()相当于new Throwable()
			)
	)
}
function hook_proc_self_maps() {

	const openPtr = Module.getExportByName(null, 'open');
	const open = new NativeFunction(openPtr, 'int', ['pointer', 'int']);
	var fakePath = "/data/data/com.oacia.apk_protect/maps";
	bbase=Process.findModuleByName("libjiagu_64.so");

	Interceptor.replace(openPtr, new NativeCallback(function (pathnameptr, flag) {
		var pathname = Memory.readUtf8String(pathnameptr);
		//console.log("open",pathname);
		if (pathname.indexOf("maps") >= 0) {
			console.log("find",pathname,",redirect to",fakePath);
			var filename = Memory.allocUtf8String(fakePath);
			return open(filename, flag);
		}
		// if (pathname.indexOf("dex") >= 0) {
		// 	// console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
		// 	// 	.map(addr => addr.sub(bbase.base).toString()));
		//
		// }
		var fd = open(pathnameptr, flag);
		return fd;
	}, 'int', ['pointer', 'int']));
}
		//
		// function hook_ffi(){
		// 	var base=Module.findBaseAddress("libjiagu_64.so");
		// 	if(base) {
		// 		var func = base.add(0x0001770C);
		// 		Interceptor.attach(func, {
		// 			onEnter: function (args) {
		// 				try {
		// 					var ctx = this.context;
		// 					//console.log("x0->", ctx['x0'].readCString());
		// 					var s=ctx['x0'].readCString();
		// 					if (s.indexOf('frida')!==-1 ||
		// 						s.indexOf('gum-js-loop')!==-1 ||
		// 						s.indexOf('gmain')!==-1 ||
		// 						s.indexOf('linjector')!==-1 ||
		// 						s.indexOf('/proc/')!==-1) {
		// 						console.log(s)
		// 						Memory.protect(this.context.x0, Process.pointerSize, 'rwx');
		// 						var replace = '';
		// 						for (let i = 0; i < s.length; i++) {
		// 							replace += '0';
		// 						}
		// 						this.context.x0.writeUtf8String(replace);
		// 						var s = ctx['x6'].readCString();
		// 						if (s.indexOf('frida') !== -1 ||
		// 							s.indexOf('gum-js-loop') !== -1 ||
		// 							s.indexOf('gmain') !== -1 ||
		// 							s.indexOf('linjector') !== -1 ||
		// 							s.indexOf('/proc/') !== -1) {
		// 							console.log(s)
		// 							Memory.protect(this.context.x6, Process.pointerSize, 'rwx');
		// 							var replace = '';
		// 							for (let i = 0; i < s.length; i++) {
		// 								replace += '0';
		// 							}
		// 							this.context.x6.writeUtf8String(replace);
		//
		//
		//
		// 						}
		// 					}
		// 				}catch (e) {
		//
		// 				}
		//
		// 			}, onLeave: function (re) {
		//
		// 			}
		// 		})
		// 	}else{
		// 		setTimeout(hook_ffi,100);
		// 	}
		// }
//
function hook_ffi() {
	var module = Process.findModuleByName("libjiagu_64.so");
	Interceptor.attach(module.base.add(0x1770C), {
		onEnter: function (args) {
			try {
				var s = this.context.x6.readCString();
				if (s.indexOf('frida') !== -1 ||
					s.indexOf('gum-js-loop') !== -1 ||
					s.indexOf('gmain') !== -1 ||
					s.indexOf('linjector') !== -1 ||
					s.indexOf('/proc/') !== -1) {
					//console.log(s)
					Memory.protect(this.context.x0, Process.pointerSize, 'rwx');
					var replace_str = ""
					for (var i = 0; i < s.length; i++) {
						replace_str += "0"
					}
					this.context.x0.writeUtf8String(replace_str);
				}
			} catch (e) {

			}
		},
		onLeave: function (ret) {
		}
	});
}
setImmediate(my_hook_dlopen,"libjiagu_64.so");

这样写，反而可以正常运行，笑了，可能因为hook的open本身也是用ffi这样调用的？

这里想看看调用的是什么函数，所以就打印了函数偏移

如果s是x0的话就打印的217444，如果是x6的话就打印的333017c70（搜不到）应该是外部调用

发现是系统调用，这里联想到ebpf的项目，可以尝试去hook所有系统调用，那就比较好说得通了，这些检测说不定都是通过ffi外部调用，调用的是系统调用的方式来进行一个检测点

发现在这个代码周围还要lseek，__NR_prctl，__NR_kill，__NR_read，__NR_openat

就这几个系统调用，很轻松的就可以猜到这个是用系统调用来打开一些文件然后检测

现在重心就可以去放到监控系统调用上了

这里其实有多种方案，比如我一来的stackplz（基于ebpf的追踪工具）或者https://github.com/LLeavesG/Frida-Sigaction-Seccomp/blob/main/sigaction.js

注入编写了seccomp规则的来进行系统调用拦截并且打印

这里我都想试一试

stackplz trace syscall

./stackplz -n com.oacia.apk_protect -s read openat prctl –stack

有大量的系统调用，过滤一下

./stackplz -n com.oacia.apk_protect -l libjiagu_64.so -s read openat prctl kill –stack -o 360.log

有意思的是，我根本找不到什么可疑的字符表，不过我发现基本上所有的系统调用都走的这个偏移

所以我们的猜测是正确的，所有的系统调用调用或者说函数执行都是经过了这个函数ffi进行调用的

可是这里发现，好像我的这个stackplz不能很好的去拦截系统调用，只能trace？
不过也能带给我重大发现，就是这个是一个循环结构，线程的创建以及函数的分配都是在这个ffi调用的，而且基本上走的底层函数都是通过syscall

seccomp

感觉stackplz更适合追踪，我没有看到替换寄存器啥的功能，可能是因为我没看仔细，不管了，直接看Seccomp如何绕过，顺便多学习一下

https://github.com/LLeavesG/Frida-Sigaction-Seccomp/blob/main/sigaction.js

我需要去拦截这个系统调用，这里看到一篇文章

https://bbs.kanxue.com/thread-268086.htm

https://github.com/AeonLucid/frida-syscall-interceptor

这个是通过frida的替换指令实现的一个inlineHook来完成的，不过这里的系统调用有几个，而且感觉这个不太方便

由于前面的反调试是跟读取字符串有关的，而且就那几个系统调用，这里我就去关注read系统调用

添加一个BPF规则

发现读取了frida-agent.so

let install_signalhandle = null;

const prctl_ptr = Module.findExportByName(null, 'prctl')
const sigfillset_ptr = Module.findExportByName(null, 'sigfillset')
const sigaction_ptr = Module.findExportByName(null, 'sigaction')
const __android_log_print_ptr = Module.findExportByName(null, '__android_log_print')
const syscall_ptr = Module.findExportByName(null, 'syscall')
const android_dlopen_ext = Module.findExportByName(null, "android_dlopen_ext");

function init(){
	install_signalhandle = new NativeFunction(cm.install_signalhandle, "void", [])
	install_signalhandle();
}

function hook_dlopen(){
	var path = null;
	Interceptor.attach(android_dlopen_ext, {
		onEnter: function(args) {
			if (install_signalhandle == null) {
				init()
			}
		},onLeave(ret){

		}
	});
}

// CModule模块编写
const cm = new CModule(`
#include <stdio.h>
#include <gum/gumprocess.h>

// define the target_nr
#define target_nr 63
#define _NR_read 63

// syscall again with args[SECMAGIC_POS] SEC_MAGIC avoid infinite loop
#define SECMAGIC 0xdeadbeef
#define SECMAGIC_POS 3

// test syscall no
#define __NR_openat 56
#define __NR_mincore 232

#define BPF_STMT(code,k) { (unsigned short) (code), 0, 0, k }
#define BPF_JUMP(code,k,jt,jf) { (unsigned short) (code), jt, jf, k }
#define BPF_LD 0x00
#define BPF_W 0x00
#define BPF_ABS 0x20
#define BPF_JEQ 0x10
#define BPF_JMP 0x05
#define BPF_K 0x00
#define BPF_RET 0x06

#define PR_SET_SECCOMP	22
#define PR_SET_NO_NEW_PRIVS	38
#define SECCOMP_MODE_FILTER	2
#define SECCOMP_RET_TRAP 0x00030000U
#define SECCOMP_RET_ALLOW 0x7fff0000U

#define SIGSYS 31
#define SIG_UNBLOCK     2
#define __user
#define SI_MAX_SIZE 128
#define SA_SIGINFO 0x00000004

typedef unsigned char __u8;
typedef unsigned short __u16;
typedef unsigned int __u32;
typedef unsigned long long __u64;
typedef unsigned long sigset_t;
typedef sigset_t sigset64_t;
typedef unsigned long __kernel_size_t;

extern int __android_log_print(int prio, const char* tag, const char* fmt, ...);
extern void *malloc(size_t __byte_count);
extern long syscall(long __number, ...);
extern void on_message(const gchar *message);
extern int prctl(int __option, ...);
extern int sigfillset(sigset_t* __set);
extern int sigaction(int __signal, const struct sigaction* __new_action, struct sigaction* __old_action);
int install_filter();
#define log(...) __android_log_print(3, "native", __VA_ARGS__)

// seccomp filter
struct seccomp_data {
    int nr;
    __u32 arch;
    __u64 instruction_pointer;
    __u64 args[6];
};

struct sock_filter {
    __u16 code;
    __u8 jt;
    __u8 jf;
    __u32 k;
};

struct sock_fprog {
    unsigned short len;
    struct sock_filter * filter;
};

// sigaction
union __sifields {
    struct {
        void __user * _call_addr;
        int _syscall;
        unsigned int _arch;
    } _sigsys;
};

#define __SIGINFO struct { int si_signo; int si_errno; int si_code; union __sifields _sifields; }

typedef struct siginfo {
    union {
      __SIGINFO;
      int _si_pad[SI_MAX_SIZE / sizeof(int)];
    };
} siginfo_t;

typedef void (*sighandler_t)(int);

struct sigaction { 
    int sa_flags;
    union {
      sighandler_t sa_handler;
      void (*sa_sigaction)(int, struct siginfo*, void*);
    };
    sigset_t sa_mask;
    void (*sa_restorer)(void);
};

typedef struct sigaltstack {
    void * ss_sp;
    int ss_flags;
    __kernel_size_t ss_size;
} stack_t;


struct sigcontext {
	__u64 fault_address;
	__u64 regs[31];
	__u64 sp;
	__u64 pc;
	__u64 pstate;
	__u8 __reserved[4096] __attribute__((__aligned__(16)));
};

typedef struct sigcontext mcontext_t;

typedef struct ucontext {
    unsigned long uc_flags;
    struct ucontext *uc_link;
    stack_t uc_stack;
    union {
      sigset_t uc_sigmask;
      sigset64_t uc_sigmask64;
    };
    /* The kernel adds extra padding after uc_sigmask to match glibc sigset_t on ARM64. */
    char __padding[128 - sizeof(sigset_t)];
    mcontext_t uc_mcontext;
} ucontext_t;

char* find(const char* haystack, const char* needle) {
    while (*haystack) {
        const char *h = haystack;
        const char *n = needle;
        while (*n && *h && (*h == *n)) {
            h++;
            n++;
        }
        if (*n == '\\0') {  
            return (char*)haystack;
        }
        haystack++;
    }
    return NULL;
}

void memse1t(void *ptr, unsigned char value, size_t num) {
    unsigned char *byte_ptr = (unsigned char*)ptr;
    while (num--) {
        *byte_ptr++ = value;
    }
}



void sig_handler(int signo, siginfo_t *info, void *data) {
    int my_signo = info->si_signo;
    // log("my_signo: %d", my_signo);
    unsigned long sysno = ((ucontext_t *) data)->uc_mcontext.regs[8];
    unsigned long arg0 = ((ucontext_t *) data)->uc_mcontext.regs[0];
    unsigned long arg1 = ((ucontext_t *) data)->uc_mcontext.regs[1];
    unsigned long arg2 = ((ucontext_t *) data)->uc_mcontext.regs[2];

    int fd, mincore_ret;

    switch (sysno) {
        log("sysno: %d", sysno);
        case __NR_openat:
            // syscall with args[3] SEC_MAGIC avoid infinite loop
            fd = syscall(__NR_openat, arg0, arg1, arg2, SECMAGIC);
            log("[Openat 56] filename: %s", (char *) arg1);
            ((ucontext_t *) data)->uc_mcontext.regs[0] = fd;
            log("[Openat 56] ret fd: %d", fd);
            break;
        case __NR_mincore:
            mincore_ret = syscall(__NR_mincore, arg0, arg1, arg2, SECMAGIC);
            log("[mincore 232] args: %lx %d %lx", arg0, arg1, arg2);
            log("[mincore 232] orig args[2] : %lld", *(char *)arg2);
            *((int *)arg2 + 0) = 0x0;
            ((ucontext_t *) data)->uc_mcontext.regs[0] = mincore_ret;
            log("[mincore 232] changed args[2] : %d", *(int *)arg2);
            break;
						
						
			 	case _NR_read:
					 fd = syscall(_NR_read, arg0, arg1, arg2, SECMAGIC);
						if (find((char*)arg1, "frida")) {
                log("[READ 63] sensitive string found in buf: %s", (char *) arg1);
								memse1t((void*)arg1, '1', arg2);  
               	log("[READ 63] buf: %s", (char *) arg1);
							((ucontext_t *) data)->uc_mcontext.regs[0] = fd;
							((ucontext_t *) data)->uc_mcontext.regs[1]=arg1;
							log("[READ 63] ret fd: %d", fd);
            }else{
          	log("[READ 63] buf: %s", (char *) arg1);
            ((ucontext_t *) data)->uc_mcontext.regs[0] = fd;
            log("[READ 63] ret fd: %d", fd); 
            }
						break;
        default:
            break;
    }
}

void install_signalhandle(){
    struct sigaction sa;
    sigset_t sigset;

    sigfillset(&sigset);

    sa.sa_sigaction = sig_handler;
    sa.sa_mask = sigset;
    sa.sa_flags = SA_SIGINFO;
    install_filter();
    if (sigaction(SIGSYS, &sa, NULL) == -1) {
        log("sigaction init failed.\n");
        return ;
    }

    log("sigaction init success.\n");
}

int install_filter() {
    struct sock_filter filter[] = {
        BPF_STMT(BPF_LD | BPF_W | BPF_ABS, 0),
        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, target_nr, 0, 2),
        BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, args[SECMAGIC_POS])),
        BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SECMAGIC, 0, 1),
        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
        BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP)
    };
    struct sock_fprog prog = {
            .len = (unsigned short) (sizeof(filter) / sizeof(filter[0])),
            .filter = filter,
    };
    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
        on_message("prctl(NO_NEW_PRIVS)");
        return 1;
    }
    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
        on_message("prctl(PR_SET_SECCOMP)");
        return 1;
    }
    return 0;
}

`, {
	prctl: prctl_ptr,
	__android_log_print: __android_log_print_ptr,
	syscall: syscall_ptr,
	sigfillset: sigfillset_ptr,
	sigaction: sigaction_ptr,
	on_message: new NativeCallback(messagePtr => {
		const message = messagePtr.readUtf8String();
		console.log(message)
	}, 'void', ['pointer'])
});

setImmediate(hook_dlopen)

这也写能正常hook，不过还是退出了？？？我看日志也没有发现其他的frida 了啊,哦好像没有绕过去完全

1.全部直接填充1，导致解析失败退出

2.时机问题

3.可能还有其他frida检测.

算了，不管了。。

~~直接改我以前的程序最小样本，写一个系统调用read然后退出试试能不能（放在init_array开线程里面）~~

（太懒了）

这里具体了解了运行seccomp的沙盒机制后，在看雪翻翻找找，找到了

https://bbs.kanxue.com/thread-271815.htm

两者似乎原理是一样的

demo测试


volatile int running = 1;
volatile int found = 0;
static int detect(){
    int fd = syscall(SYS_openat, 0, "/proc/self/maps", O_RDONLY, 0);
    if (fd == -1) return 0;

    char buff[1024];
    ssize_t bytes_read;

    while ((bytes_read = syscall(SYS_read, fd, buff, sizeof(buff)-1)) > 0) {
        buff[bytes_read] = '\0';  // 确保字符串终止

        char *line = buff;
        char *end;
        while ((end = strchr(line, '\n')) != NULL) {
            *end = '\0';

            if (strstr(line, "frida") || strstr(line, "gum-js") || strstr(line, "gmain")) {
                syscall(SYS_close, fd);
                return 1;
            }

            line = end + 1;
        }
    }

    syscall(SYS_close, fd);
    return 0;
}

void* monitor_loop(void* arg) {
    while (running) {
        if(detect()) {
            found = 1;

        }else{
            found=0;
        }
        usleep(3000 * 1000);
    }
    return NULL;

}

这个就是死循环，循环检测读取，看有没有frida 特征，这里一直读取，我发现用上面的脚本是可以绕过去。

成功注入，并且绕过了frida检测

发现我们的这个脚本是正确的

那说明这里肯定有存在其他的检测咯，我们只过掉了其中之一

这里有意思的是，我的demo在启动frida-server。程序是不会退出的，因为没有注入frida的特征

而360是正常打不开的如果我开了frida-server的话，所以这里我们转向。server启动后的特征是什么去思考这里的frida检测是什么，以及只要注入了frida，就打不开360加固的app了（除非重启）–-对可执行段使用了checksum

server一启动就会hook zygote启动，然后fork（libc函数），需要知道什么时候去fork，获得加载代码，所以肯定会hook fork，所以libc或者libart，会出现内存分段·

1.端口(端口转发了)

data/local/tmp （名字是fsarm64）
/proc/*/cmdline sub_144AFC？ 000270500？ 00270230？（没有调试）

ro.dalvik.vm.native.bridgezygote？？？

4.https://bbs.kanxue.com/thread-269862.htm

60用的是一个开源项目的检测libc的crc方法，这套hunter也在用

5.为什么替换掉x0寄存器就可以绕过？

6.代码段权限检测，因为如果我hook的话。（inlineHook）肯定是需要去改写代码段的权限的，导致代码段由原来的一段被分为了几个段，并且有可读可写可执行的权限（一般无可读权限）

挨个慢慢分析吧

都不行，尝试zygisk-frida绕过？（一直显示Failed to spawn: connection closed

）

sub_1B1010

sub_1B0B58

frida检测总结

通过常规的frida监测点去寻找hook分析，我发现这个360最大的难点不在于svc 的read，而是内存段权限，checksum的检测，这个的话，我目前是不知道如何去手动单独绕过的，虽然说按照作者的方法，直接去hook ffi调用那里确实可以绕过，但是这种感觉是可以过，但如果单纯从分析的角度来说不是特别全面

这里整理了一下它的frida检测逻辑

1.死循环一直svc读取字符串特征检测

这点的话，用我的那个方法，改一下seccomp脚本（基于bpf程序的过滤系统调用的原理）绕过去的话，是可以绕的应该

2.对内存段checksum，为什么这样认为，因为我单纯启动了frida-server（换了端口），就单纯打开程序，不对程序做任何hook，是打不开这个app的，这点的话通过查阅资料可以发现是因为frida-server启动的话，frida会去hook libc的fork函数，因为安卓的进程都是由zygote fork出来的，fork是libc函数，这就导致libc的text段，肯定不是连续的可执行权限，肯定被分开了，中间有了可读可执行可写的权限，因为要hook嘛，前提就是修改可执行段权限（inlinehook），所以这样的话，我去检测libc的权限或者说crc去尝试的话，是有痕迹的。