From 8404b66d392ab9265990dd6ff0f14c1027c335b1 Mon Sep 17 00:00:00 2001 From: xerox Date: Sun, 19 Apr 2020 18:19:53 -0700 Subject: [PATCH] V1.1 added support to zero driver's pe header. --- demo/physmeme.exe | Bin 100352 -> 100864 bytes physmeme/kernel_ctx/kernel_ctx.cpp | 20 ++++++++++++++++++++ physmeme/kernel_ctx/kernel_ctx.h | 2 ++ physmeme/main.cpp | 16 ++++++++++++++-- physmeme/physmeme/physmeme.hpp | 4 ++-- physmeme/util/nt.hpp | 2 +- 6 files changed, 39 insertions(+), 5 deletions(-) diff --git a/demo/physmeme.exe b/demo/physmeme.exe index 924a32b6c8b8f282b30e2cb105fc6129ca919f39..35419a7309113f27ead3c429b56e18259baa6d1e 100644 GIT binary patch delta 33086 zcmeIbcUV-%_Xm9M2#SR!EYewEL2R%JDvD)Q)KyV8R$|41Vn;=T(YPoU5K-coteS?Y zwkV0lmWI(pOpGD1CecXxjT%F~ny5*1-_Myli>tqUpZ9s*f8Kw-`*`+q=FFKhXZqZk zyI4?GzhGnivfDAyx1SxS$WN^jqcmnd!AetAQI_aJ4?iBNHdkwSPqkZ{i&?5-L7Y;l zDm8@Vs&XbsrY5LH7*Nn#RdSz<4v4(nM^zFasD;3b61YBQRjKrRGCH(rVqSKB9;C_s zi1q{1ls96L9ojtt7D~zxV32!CMX}&t;^YZ=6A)!-g0C{f*9YeCaV*qFI0VO(V2Eb( zRV<2s%0l`3%%>sTQy8R0d(W|sYGjG3Xrr4cinY{xBk@VS1)u5%e&k)=%A;NM95b{% zryBxU*!w__&@w@kC@0c zU`uqBYs8P&Rko4J>VJ?|^2mLZ)fPlPkkw(T6d2w_sls#%Yl;7@mylSLdM2q$`CZR=@TU5ytnv>&u6}#N6UZ+4n6)_FWVV*1 zn`}sa&&0RY?;2o4jF6OMATIf&7XJsoT|Zhi@z4f?@I9?TJ2i?w+aNwD7MjIgq-?ep zR)VQ=8g@tV3k}T3tD#pqOS;Jidv!&i)XT#5+~A*ib!$e6$g2&I8OT9mc;iiWD znC}ffr(sX;o&BLxnqe|(ud6D5uVJbh&2KgAj_;0*64jCVaMcOEsNu_Ks28@^`#@ zslRUUX`|YCqR&|M2w&?nk~M6^fAmRKC-V^B0csJ?_Dxa0=UaTcsOR{3-%czrYHw4& z$!f&82)(pcZPy*tNU7mc50~Kl9nSrSsPp(w{vDc|8&HW*#e2c6g zc~hlQTb+iqX1rI^(d@l&Ufwjq_p@+OfK24zG<;y-C!6+CyK=vP2sMZ&2Fz!t!}v=9 zv229Ks{&HgTz)qoB(a01qGXh=HC3Sd!M3U-e<5-mWYBX>uof;cB`6Eppk_kDd3sR$kxr^`N4x&hwph+@F8`^OUpx4^>JPpnx}g1y&ZZ(RsH$3@cC-#-mHi_s`?Ti z6*X8Lx_3vEs;!}TXc%LhR=^4SC2PP_nwLF%+yHkYii%r>nEqPjEaFO zq_O37;iVBKmA&=z-psg@YE0&LG}JOo3EDm4P;etvmQl%LSDQEu{V>Y

Bs4)cf8 zF#aA-N*J$>+q*vD3zc2{dheu`cT|?}4asuOeAJ|D|#hHsiKXGpnNx)vZxhl zM7(u}Kbh1j%1_tw*6L9?zPLrP)s*T2e9->GzfOutY~>{BT2lduhLEA+6{aEtdZPoC z8p@HBQYe&9uW;VV+#-HkxXfIb=}c){8nX~3JlJ)EKW=XC`>RV;_<5PXXCC0kACRpK z=OJyo`1O52*eQH(c3X?udiC#QZiVR}{2{+830--873y9GC;8{?y0;0J394j*YWDKKc_tSbIwa!{jB zMb%#ZkD~A%jUw6DVE%b>gny6?wWhBo7~G!gM{{R#bk~z&i5+H2AfraD6v3;FXkIsK zDtO=h6eWV~M6eS5rMD}dk4>?Lk35dd3y)=vA9qwAY0Iu{qY{>Q_8!cSq{REa!jSRt zBj{rVPDAZ={%1;T*iMqk7Dm^&t|%De`B(w^oa8C(ll{g%5I^-gf2{q`1|K|%)wDE) zf8IWZP5X%d(Y{^ahrcRH1?JVYrZUPCb#U}Up4MULsP8gWWhor>{t}F~1U?pa{S>To zff+*cUFz@ikQm)500GfIMp3xfGXU8@r<@Xg{}DumU7g^SJR{2VXC~J=j2o2*fiNFO zTF0PO*fj*KZhq50Wd86qVSX_J!u*RAF82I>q%eOCptaJ?e+FJR|ItWZ-f`xm`49;6 zb4csnhh%;dSl#@0f0Ox}SB3fK{*vY|Qn=W&J=EZR2TGWYgz!EZypmVnX$Tp~vr}7p zm5B7&SNCpCZKX0VfBsRY?u|$Kk?yfnG$XI*6sT_Fah)ydEk31lPmesr@h**G*+5_Z zdFOOUgVJJx)7zr2XOz;CP^vE&Lxv&K=eRA+Knc@~SVUK+nS6d93h_U*N}z!^@*wMbcSC`HK=Wju;)KEi!E}5wfYRAjE#Q1J$q$oY8sWDl2 zzjccr>C&Op zn84=O=b!ZWSpAtl-7}H(_?UmxGm?3E?)|A}pvoGb;Q#cBRKMV1>F={vRs3Rlr1~HJ zce>5q23y9Z-Ozj{FxvZ=KnuGDgLN)wp-=4jzrmYQ?_~h(WsMd=&$InRcm5ARYl9T% z&PTv2c@Y_Cq||gw8y0JcVK=EkVAjU8L!&U-Xowy6$qcOi#tbxWF#ou>KWovAU+Nvx z?^oyxSAHPFjfE>0z}C6aT6d*Axl;SHaHR$1QR@9BrC4-8xMJwXt$n(+I%m~$&lS0o zA2ynb#=k{M$8zYwM1C@ObnljvpM<{1y$Fn!1Y3n&mw>IyJr@%qvRVYt0`=U_QXZw= zBPhjl`?38)E*9Duq0<-+Qlu#UeiUC6o$u*0t663j$RBuuzzBT%JWuW$!yDi2wu@$6HUr&B^!5c9 z7T#y!zSD5|57*`z&5`iKqWPS5IuB!5 zpv-7yZT)=(jBk?s`UMRExtX$P_xRv`Exm5MAxfXge~*le{FF4rHj1iBdru^&CP$6h zBgy>TehIDCcd9F20^~L={(Gc>eXBMGMJb{^m`ME18Sd9Vl68B7oBM~G6Wo&N&o8Lf zk~2=H?|zZScfU-SKt=se1z*ztcHr%5a#(C(O8m%bsy3V#4QL+mE=An;bGOiwetyeO z4rrs+<9`k4#}2jSy)#~D7>uf*iB#dgW=xKa?NC<&3%Qa-mJ(>$7M>?)TiWuxfkt-w z5`TJNwBeO^#2%FNs9faUi?8#O1N*4`dBC8AVE+r40rVF1)f=tE%W3%fJRdq}B>Unl z-!;h0GSBmG2DR}BIgdr5a!@#XtY+;`s=1&ez_S|+7x$tjScjFCgliBZA z_$*tekW=mIJT=#~Y=Y)I!QZz%$-;N=A&;c7J#F~d0DBTS=u*Mdac#xj-egme|tl( za9bL@-3-77;daf_GU zKD=VQXV?LmO3W2#GdVgFw59R9di*0ThSIr$J{^gr&Zcz|{gLd|)qq*cJIwoMr6yk4 zE}EK#<>j{pE4HasS~Ln)CVMA_5jEC(TX;oQ9xHl}$4_{IUD&brl?i7V+YqyN$>gid z>yOW9BKrBgy>q56VX?&_bzX?l=4-$0(@Sfl>dMt>_Hm!-;XQ|#^!m%vQs1m=N%R=% zXC3f>L0ca*K{X}H(E>$nr<-ypC^`^(lFyvpdBBx2n4v+bKa=NWA2!ppMh&C=wMTD| ze9Z_KDN4vY1|32Nw{yxbAW;AEZ<9L@Dou}MuR#zCImZeSJt2>LC z8jVG@H!)7n&!$yX)D=X`vqtTsFufpXEm4q6?PXDHaSR|Ucf)#qaYh^V{hPe;%xK?A zREAVGYDXh^+RRoheC~UJ@~<@&poH4*R5(#^m*nyuzJ8`n_2xA*!`R$Nes^Xk)*+Io z&RWv!;BH;nM(t|EQh~Op(qi~0v%=V_2(HcQ-E6&ZOn(rhg5^-dw=Cu9vy)O5ph15zM6SfZVc=C7LT6Of;D}MXUu8E ze%!|w&3S??-N$dw8P1Ns#RummN3Fryj^)8bQ@sgH98I}#!Y!xa*SGlA+#J^UE#7!; z97}(Tx0^eYE!@Y;=XPP{eZ1{c!CvST=#pjo_`SKg?58()?z}WMcQ1c^UNT!-#J`)@ zAE&x)=JyB-!miPGzi1kZ)1V+kd4PTHOqb0&5)qW=ub}CFH(XIy;eMGYv*_HW_j_AF2{&Hq33~E-Z!r&OWVs! z@}ikv0N>al)mdmfx`X8S(i{qy@qeE%M)|F}a}x71B^XqK8C ze0P37bvVDBKf-7C5jZARF4_h1)<3pr(eYDPRg`*v|E@5z{aKpvxYv%~H2bVS?8Fd6*CpqhGA^_x@69)&iwMrq=nsg4uc;e!*dR(2<~B!p@BzVZ}xu zL5uu$!;<)hQ9SF>o-P~v~x`Bn3Gmo#Ua z*6#gj$yk-0c!Bp`ni{nJ1@e^|NFM_9jJx;+&X=au`>3AEKVNEQC8v2k`xw^dSw6vT z3Ur9!a(`r5v>%K4W_xp%@jU;)9?wkA^DFj@@OawDi#D&@6roGddIr5A1(Voo=lFqw zR_YG^eL+HCv07IY^b{Jvb3W%$%Q~=*TlmOjrogSQ!5SPCtth(MZ>#zGWu}lvpQR-P z&&Ra)M+Vi@0=Zhx^ZewpSoZp}{P$&T)#*HTd8>MT6qP@+yp8I^?aRlqicS2R*#c4G_QS=fgyKF4nq#;JKc zWJRmUs?Ai+>O=H!pbe1LjARWH!e%~k#ZWeKGe58*jvc(qzge+_wOhc)tbBp_Z{l}X zrVk!U$1(aIB!LoHv_p=%=F_cggFr-4ql&GQQQIhGR$YdKVmRF8Wvh}|C(b`ymBTJS z&68H!*{Nl`Vs&hjFR52SFIU^c`Q_Ev9G}@6U4(w%vw;^BCna2ZlH#khKX5Q6x`GzA z7!p(smS&n4QLhQwt&RMAaeJ1viTkYS-l)4wbAa=aYo78bfK%Krp_$inn7Nz=-!0s? zB#vbs=N(Ei*qRM|MaeMr0ROV2v$~uIu1!+6^YpbF*n5BQ3u~V+AODc@7hPD~AT^&Q zJN(I$MZ-*3H|f+I*J)G+vsPTjSC*!Qp1CP&Z-qEAu$IVE*nOq^tJ1xJ_Vs!RtQ0{9 zCEBd@eCxUhc4{rJTz7yOX7EMp&CMpQbITf=Q_&2A*73^qi(5a6V@uIK@?;f;YN@3= zmFT81U&uUPE9FzmHb*zXq)^vW5i2SaeOjiQwT4GO`I>r+pLo*TEMP5VjPeLInen|6 z?zf>68&Jy!Z0OkVFWRoHtXztnz=jz1SsCAhxQ%7}$_As~^24+ZEnREcMjn|C^H83~ zx|i{hd^jt5lJDlpy#_q_-}VKWxOYP&+BXFwCxynAHt@L938o7*xY${C(fS|fALd5$ z-Wy}t$ud5DV*qWLdR8CbXV8=ejeX?uXGVujctP-Wo=1oeJWdz7a<-EK(# z$q2z*DlI&zO5QwDDW_7eU9DHQXkxLMcw9BUNC@nu_DHyK~3cU7x4ypSK-(uaA^;_5RoVcRjp(CDd!H7Yg+zWNO` z@-t(a>Gn)q*k-JG{~kYwFMZ}%V&_@1OsD`nyy;iMn(1MwD4WkLp8ISdD_X`^J-aq> z`pkbzIqYGnNZD>=HC40YE>3k#oLxAGv`PAg%`@$tdA(92J`IlMNM}< zt{2y6O|yDo*VpYyUR&Odty#uRTT2oyEuz>etv%Ho+S{mwP0}m(fw^)CKfkqSvl}#x zQjNF|@^2P%^NWN0*U2eXv`LO;U(DCP7|gO4^X)Ib&t86#~L&7Z`>UhQN!_*k7Gu?4nzX|FuSr@b1-)_uy$UcJuN zE#w8Sg$B-BNM+aSh^%I5Squ5@*Lufn$MB+>6M5xmjYy9wQdjzW0Tz;PZyR{aZ7KfU zq^j`JroFI$&)GIKzCTp-83AP$qdZkgL@kI>9>0KV+s3e}Jl<#fX8$&MdJ17DM~lqk zwcGo!bMtxXjxKD|eAIO)FWZsC2F~Y4cBHa^`TXx4Ic)npp1recaJ#i=X=+5R@==&U zkH+rI`(_D0yt8?e*w^#{WYm5g%inF-+UF%Voz*40`L4UHY$1<-eK5PVh(GpvIy8|+m0$qU=wNM-rlvL8Q_F7XaOlq5(>ams7jb`%b zJr?yUpSY(hdv_||x~IUHmMk8zq+>XCK((wDF4Js1us`on(L88lEQzU(JS&6-?prN+ zd}&2A`{Q%IwW4j;o{x$3!n|yW$?Sn=hy_C)x=lPWSKPtbdK^MDimR9ru1-GTG&tsR z-!~$dwvZ>j5y^7r@SZw6^`3OcavH3Dh1v*B z>@@t4Lp5Od@p1A6?Q@dC#h%a6)KKdEDkU6_gt&7m2Cw9KI}OXuaL>cJ9?fxH#6!}e zI_BX_>A_3T9jB4(Q^cc*X^rn`m#kT9PTS8yx)9>))56oZvb=z@(K7SQKQuvOk9H2gtfrL@M5QQ8!vH z9oNAwwwHz<_Jc2hQ%=KH#2v)TUCv*EJTd#}TM|q%G)HwEM>)$t`B=Dr&@E{ORMsmEBmWd*66v^wPeg7k*Ql}Gi4qM3#bvanj&cm{`bcO!*0z5=Pr3JWX z(JsI*ed;I~M)QYEW&d^{%pOjamTY8cov^glBmxtb>Sn*BdAa0va^)c~%8ebA)rJ2f zlUA<{k{3{7IuLdm%1x{h6*nuNY04Q~@n)&0d;h2eQA z#-4w)6z9~HU>WkF^jUOngfE0Xb;f_mJmuS}HY!N*@lw6y5=w zLZy^-J{}E;#5J^zmU!Pmlr~c)u7ozCF5xJf3P3@uLzEa*h6Y({dQ{~9+#|xod%B4O zWTK@sQKg%BMw+0Y(=gmU|MCpo)4F+(y3)=O{Kk8+{X`FFyOOL+Z}UhSZRI*yL=kI5 z7BW6XS_`JSb0vz(;N#y9vI}c09uY`Yt2=gsb_FHgXR?uLUp(MYl%_{*n@L%%6+x$A zgLo8MVY*F`SZ76g#8TL4cy^L*l@=q^*c0M#9xfs1G<1Y<_+r<`+Xutz4*x|J3a{FT zG8$It-t;AJ4!^E@gEKxd*-DzEAPzmrn^MC3)$%6cnBF+@mAJ->}~IKMGJ39d+{R41+p`2OSv~RW%iIoG_;@ z6o>X^?bZ~Rz*GBVGUrFyvVuzf(GjE12(h`Www7j?qP2ef=8$u6?kaz3AXGj|L|eImCmwcrX#WoCIwpMEa#_5IJVEmJ}6;)>|@(zj?Hnsgrou zV}sbCcX{ct3|2Cce|@aX@Z~#Hc=7hH*g;#IhM&gsf)5{y@SZ@g?JWqS)xk&xEp-O3 zWbwd{)`lM&i&w^Q`;HDn*#ER{4kM_3#WaNEt|i>-zD2RQEkf?v)eWSI zY`F16DBoBW#U35a->MqRI*;RlCswe1WBHa7*{t_Lu72DsA!9Tg#zSo%vP#|DY3M{E zxSw-h^wFc-@^KJ5^(fE$IEHN~<4ZnH!+HC`k0V)!GJfIX#Mq!QVy{a_7gpzjDDBVn zqD3$<>u=0xZx!$spLAx2>^%FEHf)WZZ~SC3yEu~n^+{j$^-|vJWNzw&Q8*udhf-{( zf`rx=Cdbs7Xo%Gr1sn6rN~&d-;pCd77*DzF40GV5xRcD7XHJ-JS0qaHW;YQQhg z-$m`Xk}g@wCw|(p{lR@Or?)y<6%TN@mKdp5OBWe_i^8rZMSSlO{K%&PtZXDd_i3yl zK+g~(TplSIHNR5sb85<{+7ZHz?+RS}qGO0fYw~d2mUt}0B6gB=5M{QeRn31)%U&zI zM>igZGkOdFlQt0|y)So?Ha3mmr%uHMws1w{MahU}!+C?x;-fF)cmheHJ^$h>#l1t=;s>{5Zezm7Gb9gx4^;vu0R&)SZhy!^V$r#H=W(OqncoXhY zZRv-F+8u17kd=*g68dCH57sx<@K)7v3A=_u8Qp6v^`#orfzz;=L`aZzU-bM?o?qRZ zJvWqZtxjOQ*6>fNhpLG@>hoZBwwQPN+`*a*;a_|{+vnskq{R%9nb$z8EaHQ{Xw5bh z@g-k`x7_!Yt0>;spOYWRBI9a9ZFG@vj|N`GRZlIWh=1_Ku!iS`z>t`|e*2<%#BNup z?qUW*SAY6lJc&;_-Hq+E@s~~~vYnIo>C@v`e;ZFZ(~`ZnkY}A~&wifB9cLb6r?zpw zv%%hhDYOHlmevj};qA{prrP-HXNR!Tm0Ug7hP}6vo6m)_f`NE{qdWU7ov%MPp6wsV zYtKy%(t4q`;Wj#kxLTqo@yUE|~Fb(2x(pTqFH2J;r}u#E>^h_U}P7#Uv0%p&gx zY@}i&m0YbQZF|J#mzwXv<7KB|$pBOW^zfF@kz8xqk-S6^avCPpMHDZiIYo*myNSz$ z7{2niF5uL(KmY1NJiFGPvoF)w)c(Btm+`Fc06z80$e@nt@ImBK+yhezvU3^&`txVL zG_jT2_>nKItll!-_^U9(PX(f-EYxRlI!i_TzJRBFHHtOp#~okIVqO`%{?`TUy;phB z*BR_WUw#hIc>p(E?8OH5<cbEO%&6V_}tw z>P6j9cP*^+qdB;tg?6DQ=rL2jjmL<*+nd%$p@lhjlEs7EMh7=M`zZhJ(lcyMA8!BV z1{<}Q=Utx2{(PKYxNKx81^lneQ7oW>$!-Z{5Hg+`64{z7{>*1=eL7dVh?WnE`|B^;H$n% zQakef-?jAJWs$y_@r?4@Q2yI@3)%TNKK1)vtZ8Sy>-!XTu@nF9`)llaDzE;b8{3`A z{eJA-qGOicx3ENde{Z94_+u9|tgE-7zl(;c=|Xp)EIx~G`Z3Di6N%h!I^%fNkF6S> z7*7par7h$C{Me59wCCoZTKCqTfi-;&&7^}EoP|3LSCIwk(KFyRJu3_LBfmlBG_>gE zmbsZS&(+@jkZ=8|L&w+2ufp5T1zy^gW7M^0Q%hLLRioS4^}2TCg}k$|X*fLoIo^=@ zD$=^NQB)d*>Ac_1QS4e8pZ;?mo3e%5mL~=$PDkQa^njMOLfp>J_te(lx{^P=JSA`* z7|P8`6BPAxt-77KM(d2OLJ_&5va}MTxJLUUg`d!3*ykzySFIb1ZqM8N(qGNy`M>mL z&Sd`nFFje~WM1!znH4AV_E%c4K}mbFu0*KndcO2(sz-+o$hGWhC_i&`G%Ib(w_2L9 zytcgmwRy2hTRl5ekLa{s+I6!o5hv_f+W16%`C40cF@-n%b*%rTE_$SBN~_k*%nN>v zVzZL?)?d5%&w4QOR1&X6f4xn+rAc~93=F!$m?MM2kWI@%(EWukqjoBV=U(r@ zIOlt>C$h%l`1jY7I(*T-u0=&p`XEJ2!6x`_LY>*PFK3A1E%s;_OLWn8ZU(phHilW- z^H+Zx?LC@Wv~JrtJ1scy={7EjK6RCPPJWtqu8s1aL=n^>bdQI%;nQmehwx4`^+F8K zsmI83_G_*A7quN(uTH%2?`=Fcaz#1H?^XumCr=}OPYyYn`mc$?Tk{ux@5tt-@~?j% z$4*b@Y5$q;|9nTcY;BseC4c`vW;QT^|NfsGpV;<@lG@WNU^{@AFa;)`lG zr9IzrBaz)~!9Ttc#?H6EixLss<7PkhSu!7dGlrF<@cB18vLPva*UbpFw=MtVX0J|( zfiQ$=F^lRgQ;VV?tl6}u67(F|k?J*VnT#m_EdB)99Gw zh2}i!&$zIBxAVmnyIDBpfuP%o)_P;gw6LSuc?r~#ObDGA-{^_Kirz=zfej=S@X52 zaeUCRB^xsb5=qo?@JF?^lKkKP#@m(o&EXhD7OGi8cz)Cx=&Fq-C# z-?jDrYbHxh_fUtEU37@YM=Gn2_bcE1a z@(F&6CsG>v>S3I)I1RBRTItL)(Dn*t=-Qc1?~6Ut09PaR6)pKhkJ3j}r=ekYQZDw? zO8D%*yY_yggz`E~&&DO*&mv%5d4hhb(2ule09uCP6541j`4Wz;5Xw`aTo_B<=ZWyD zcwYN=aO^M<=zz!)Pp?%-UFzKfq7p-Q+`2j|i#>0wtKO_Flyva3wyT+x`jm zy19m2I2Xrr|4Fb{VUq1}(1R+jB(SQ)GY{H5iaq>bZ9DYfl5w=v8TVEkYF)n__dG&! z6uc>P7U((&P+_gehW89%{W<6(Fz$XdCkrP}x{BvHA5kS=4k1Gk>3DMq=R2fa>K&`6 z5!vo(DMUtyoQ8I~&Bh2|$53+GX|R%{)LV5+aS6W#z1u3u3!(+r+f|Axtx&Jts>|AU zzvqo&JWrl@8_(;CZ~D<9&+m)*(Yu}4wqkzoZusC0h}B+bEFL+j8n#e)y$I(ewyV6F zjLzsemI_-~<-Fl*_nZI)H1Ko)1ql(H5BSKlYcZd8FTQE%jeE`o`PNC^m0(cRCvNbq z_nr)#j@~V5ShjjW*YQQXkF!-sXGCD^e7T^3HmDK$6y8lf4OdJ>d)GK^YV*Tr?!r5& z?+UzMijpkof86sWh^Rm?K2vm9@7~QFs;UMDiq2Z?HuH_5?uh>we(`oyBJef8>E+b-dy3h!qm1&M<6)v>BPH2 zlv#SQ_dj5L5C0tKTZmpqf}bIHyFU2hh?=F2{`J(>L*Im`u*&PW=T9H5m(=IFs77MVcrc2EN??UgXh_w_)j9uzDQBO6+ zeHMuV(-?gZjMGphf>nnbdMMQJq6fVb>1gVq#?BZC$F&{Eg6yTDeY&BP)>7hWsVeq7 z1qE!Env=NLb5o(NX#xMNDDyl>$nbH`nc%4O$2}KH&UIW&opE-dqufIcid{zs`o$R@ zMpq=xlD+4;git(da(wBbhKHYzp{(}O@m8|jU4XD)H;LF(%`1Ysocz!t(6$xTBGm8s7R`C}q<-*jn7%5APEq zgjd$v62D95O9vYD@WxQb5HGb;`XO8YSDRW(>d_p8DY!Dy5#Laawf~(aqHhA+qgPPxDm?0CO}jkr7i-BFdUQKx6u-h3 zYmqaqe>i$!oQL@S6ZPnf)5P~z;`^rfj*K9ArqCHBzW0f5U49$9-5K|$5G@hkOT~AA z_+Bo)hl%e$-Q-^heuem6CBCg9n>B)8E51*O?=tbt#P<)vp>9I6M(`VgQMr!3jnsQS z^gB&w++6WJI@B?=vDz)-nTF_OqFpS*^)|m^Eh(kWr4=-E>~5?krOff8HNRBs+=u#t zFYcY2QPLZ`hv7zR$-rD~P*bNf`HSQe+A#z%8t+_lQ@*cST8b%5 z(bBp*3jEbz$J^d&+t?s_94qxqr1v;P9ny+aSB<4GzRuz6qb8c118L9S+a{~bswLte zK~$Ol-+Gm;nd+F}qZ--hZo2(veD2#{w(7swPt^uFe)CbI*zPACe!eIJ(Cn*5+e^yb zQas>OX$@87PA^xyo4a}~o9W5sp$>ss#<8{LNvGluMah2A-_sREHSFtV6_qgCaoJam zvA&(=u7lGPyrEZDS=5jIY6OMi-d5BUj$}mVvTA>L%bH5S`8(D2=Z=1UYL`v{G;(P^ zxt~|bK%7Dx3C8cm|7)b5HplUvAL{w~7Do+G4REObY6KhP;V}9m=W|*utpiLa(v>iwu?=Imk+dMWE1J(Be!%9XFH5d)s)bQBB=KZn$WO5^j?f= z%#Cu)ZmNdXC*Bs%udmTrbChGZOY9f#IMq~*NXtVZOR&gTFwuS*NP#Mv*!->Z>nnB` zO^GFPA0p%{RG(<$e?}daL@0TV_yF}QdsYtVD2h#DocBNVhG>Nw*HYw0EN|4w`;wXu;C9aY9yu^bNPf7ei;ysC} z(!O3myyfutEIp(5B-Th&X6tgJM2o~Mi3Jk3NZc>+ibT^KJ^cuYOC_F^=#`6jdQ(}=U;UI}W%+T$;EHO)BjKp`Q>+xq~`kOhjGnl985kn;AN!%pyWr=S}{7Ygt zY4CB0MY5`?R_Sx`aoz4m5-TKblK7WhG6fQ+NK9C!Ck&JrDN#3z;VSi9;WroS`mS(| z4A(v+pSVQVn=R3P4}X4#K9NfwG@wbj%V7LN;cL>sUlKiJe2~O^DIX)l)iS(LhL`GS zSBj*E8)d|c5=Th+VHw^h4Q!F}i4t>U{014{S%xblx(eVW<5MNx6Y0_a!lmGXGXLtvtBT{bC^b$UhE7wuB=KW=|qlI~(KX8%LY-cP@cn`^&IVyYJ9GICiZ;|7}ICXVB z?!UGHO2Gn44|P$(}G7nGR~MCaZlN%bTmm?E~~y zEqCgzXp?A^=qIuAt{z`2F>9cnuKJ!XFOX=I=qK^vbio;VI`j8>I=k|%&Q#Y(yriS$ zqK@|(=n1mEmhtCxEI6y9?Tn7*(=z;pjuoHlXp~r6t%nav2g>#C>*(7;ZQ4v$LQQ== zuZa^T8z)VepZ8>R;0V_rrNgdP!A-Q%da$arZm&;~uDB+UV`rtTK-`Ll;=Ccxucs)R z5Vxr=&hb?Xbxyr9eb@yyscf%jTm__oXmD7jsD2yjP3>kLs>h^COn*iXXLisL*6}eb z?sK-S3_o`2t18C6WGmERYo&U&N7(hrb>m4!`mPUNk#iDn0a^Px*0fT?;t;*f3hy6E zMrxV;@YnSaXSGsRL5`YMs<$2b1(4VLi@vUVKRdEPpIoGIN!?u_JMN##|Kck7=lbBJ z7S;V<3@Q&9bU9wpTJ>aB)v>;nYG_1>NwHFtD%4R+k$qLiXKhqNfR|fVMp1Otk=s&@ z=%68$27&pZEXW;-qaH*b_ws43dTXP4u;6}di zC`QyQ%SpoQiy1J(~SX2I%?Ppie!N23BXPQu@0ySUpJh zfln=rY7cb=QYeRf+aNL)>ZpVDGgk*d?m}MDyQpo7EJ~#{#a@yCYZ!&^p{ah zxShr?FtGIb0Ta#UNmHg`zCf7DmDpP@(li0DNn4;163Gc+>-5n2m*exl8UCm8y2Guj@GQ!^=>H{P(A-kzHNsRM-oKosb}g zzi{j?>|KMY)I0e42h?~teDLyvY32czsRiXYxbLKPbeSF0371~vdJdv{q7oA3f>{Qt z@1umm^)UMC5b9XnN$o1?!z$~eiE2>b&$&)&Vkr6JF#=`t##b;1<)(D`p^nJTYG@>7 z&;?>zBNKXqu?d|r(%Bj67|~g6X(t;65GNGlYdwhhR3jdDl51IK%Ck94f1oI2YZs#N z0-}=e7MQn%Zmq7nPw4sws7e6pg>0TdbiyTk={Ehs;6n&(G+d7KKr`8nz&VzW6wnL> zf#UO`t{@5=ttw3?>S57M4d8>f4B;+81`Q1tK3&0Td?PtW5Yg4PSFW%qLg( zaU4?_)&`f8RMnzp$?5O(n#`e0W0~TwhUv|U^q)YMdI-!BP&KH&PZFXpClE#- z-U$It4UW`fR*xqdu}w&#I|#c}88@Le9kPVG7I5_*C9jllQFFzNwPA9+1PJfL5iQ0` z3t~tYgQYE@T3`%!M0QnU?BskV45}z?vx&$IHp0{Z(SM34^Oh9$7vX#gyY)X&`&8RV z=NkVi#m7KTwqRX9O!817)CeUg*N{cBYGK=>FD98VG0Bjyl7tB~;6p@d|ADV>Lzdcb zl&biHjG+2HxhSw+Yas}uFeTxR`rS|%S9cjrcH9P47SzO`ng(VLrSYlJEA1Obg%pMF zDVu(|?4D3d*o?0igg%_7?rCEU@#HMJh}1ji(mOJ$vs4j(%~uHtL2JBe$aVEO(f5%F zg|AVfKk)T8i1`>J9N%_RlZ5{%qtOExDzqz@ULfXU(ewU*4TlFIVfeG!ZVjS(U{0C{ zd2BuOwjoNRT)n3(LDDs3XC;^|ATOUR*hyTBuMtlZ_XfV2;xz}x`gpWvyXuG7>wB%M z|6@a3#)cTF>-vjEIEJ+IP)P}&f;kPs?1hwYS8(-x zvXCxu9ewSLbey)Rabk@M9t*8#d^HE5Ms(v5jG+qr-PS-0>Gi|cV4+tV>1f|WjS`br z9z{KYuR;;!7bW~NlLdWJL!qdW$`MW5l7#JG_JKTn%+O8jhcC<(8Eh`|SjZCenf*IG z%^9f8K$_HV!TbWc4Z_Gl5*j&;naA%CpjL{a9N+X%gW9=zslMLo^M`4itj)GyEFh}Q zPK0VfO_U?Pr`mbM6x0}&9c5}0Rrwv%(x{`#pk~7xD!%m<-^mRX-xM#!cSz%0(uW!4 z4a~^$AezUw`6(Cf`0H`#K?=)ZF?PP(tRVG;PY=$%vV%PvBe-yRRiZn8d)V|}Mnyz1=x ziXMycyq64RH(4-bnUE=NiQ|{zOe_U^mMQns_JPa{S&^Gw4rDpVqsGnN8ptYPuQog5 ze&PxUt0DAqGk6X%4Kkb`)>X-$kQtGQ*-aK?N8_c4r|SRR{QmFe_kTCP%KvVD|9A8I z|I5v9S4`CZ-*0{o93G&y4RzF;q7I6F;7$nV5Z!x>$Xk?~J$~BkDRV3qrK*Et-W06E z9UNP9_&|p%Q`C+SHp;;XYnQ3&O7NYhgTFXcZKKO68lo`A*c`Pr_%%7g4Bo!zt}BE( znoLs%f*&>gNnds0iOkxfiDMsE#O z7lSBm0dSL)mjjPccqkU-YB2TbZ9ypc0sBba2FwAGp&YOWF zL1ZTj_!{V0vIES2$X?&3q&QT1V$v|_?47^uY#xv zDu5m-dQJEN+k;5o0vrLN;hF`U+FnsiG>m~t2fZH<4gs|$9pF|F)m#P8eimP%ZGe#- zrFX!7ASziFa5pFyd<8HjRUhA3z?C2>aT)M$Pzo|oIw?vU5T!K(Pl2qE*8m&hG?4WD zfXO;RPgvH+t_R8x*bbthQUN>%5^W5;4H8cDRg`t0n@C&++yf$c z1+bn~uTnqY01&0M0q19+IdFnm0Q4V-2XOF4;AfJrwu89^q9#xVq4plZP=k^McnOpX zz6SWw5R?XdHE{e;lpcHma1)4}C4^3N?Zy25kwi+0t-i> z4?(94xDzCr2Kb5OYk)yGITJR4zk>=!V*Xdgzz~QgpITtbSlOX~jc{SH4MzQd!-+>` zS-{^w+4^uQ2c8E} z$!dTbrYOn)NFxKr{Kz*-QMp0LFX-Kd!m6b}7zVAxCri#(bP_%4Vh zu1a9eEG%4*mji1+8zCq3nvM3S5}R@RIR-=-X8{}Jp>rXDA21$7^MM)IV1b^oAMgjs z8yBLjK`GEL0LDIsS^;kc*2~9{CfNaUP(Ju_;4Kh2p)A7q|NC)_S41d_6=f2LB65Mx zB5o5U0R9LPr3dyd(5u%5+`0@Uf=&hSFOV?09JAyKMQMW5T{E!$O7su#e!wQH^y%3T z_%kToj)+DDQ)4xK;uitGj1`WK4I+6ia4+Z>oUQ~WY(yO?p}*a2#kGISpJ1BAqhetDDfC z)VV4UxCx>*RyLzKKs13^fOA3Qbpddfwu3R}c+98}J^e0+}h#z)=uYyBTPB z4vP}xM&MMCs0llmS3#6<1#rp>C>fM;fd@gPR0;g-C5&CjtAV>-#wvz`^$Or?uVDK| zJh1VrdbRrj=Yps?3V<(wsKn*K(;%7;YJg6Vog$RikSQnwhH8M3+w>|m0<%E*kP|*H z<>kPyK~%CDVAyt@w*Y5>#MBEMutT3@Y`~?GF93$^)aB-#82^F0^&V~mt_D$CmI2=e ziP8fvfXHYKFnW(n44exR`oQxb(ysxYsX%j3VSxT`=vy}ar<} zdjkVM(@SOn7E8Vi_;WRe84TeyQzi6sS#!WwLA3DTbyQ{G7kU%efNf60F7)x*sxsh= zqFf^<&e-AESzQV5w<;f;$CQhRYT($f(FC|6!F#Yu@E3z{Gs7ZzAxPt}+8eLn{|}RPxn8 z4Maw3fjxgf$3w<8;6f0|3xHQZqGJM!euNIzi!xx^PZ$xG5|WRz!*QYiN7u)BvM@)%SN6U=D~%oC|Dw9Xn{s7`O*y zLB z0nt)h3rxHz*9hRGKkzOB^mBn5Kw>ro=HEj5(<)bR3tM9lIZ+M#4J4`>m~mT9P{5Z! zG@L4cC+_H(RRbsdrB`(>F!FDmHv)@5G_{ujZ%bbJ2l;@gCJO9e_TR;*f_HdxTe$+F zw#QrFitjz$3B2L0%mrO5gFh;+(4(f&UmKvn8j9~U~H3}jXSybL0xYd}*2T<$<_^iq``pe*p| zzyc7-i-3D2kDpd3D{w#)uuCK2G5-_uk_f2E%fKH<2RxXsjp5 z0Imd)ya@QYl%D~P$F(3C%>v#A<$@;+$D1W2C+sbGD{#5wR{)=}q2O`QS+!;~= z{76KZ2_iY+O34=iJ^XNI1|7m65b1;i-}OhcKwb&F2_id$A2wA*r>+8a3P2wq`@kij zO{jG{G0)1tF5sVmsB+4{fO~WhWsn0r3Zg2#09+A-%S`awfJZ^3Q$yHH*CEW5JY7Ne z29b^x_!6kecoY~I8-n%^L;ydV!3$%!R|8M4T`dMRLE95PE%|cbU!Xu3qW7EV^(N9G z>>zo3V j&<$DTO2)Csgu;Q1Fx=9N2&i0Scf{w delta 32495 zcmeHwd017|_xCwluA(vu7a8RO7rah*6$cQ9tD;^F^*U2dIAcyX#UzJ7aUwv`tzB~{ zD=jTkl2X$KQd2A|vNW4fE01A@rDay$_p|od7twFu-}^l8Kkq-k`?Sty?X}lld+m9j zy^oZ)p?+RT{gPX;15&n*Q{=BkiB%dizfdJWRg}fL(Co*<)#hp?@1=HcbKIdSHpD5V zs!~N*qAH~!GBrWDs(c2>>!>QubumHBZgo->3j{R~cvAw;&!j5lhIKLFO%k)G-8^T?MA+((DMW|ecR+gP(oz-TGR7Fc|swnni-wnj)rU^dT5B!3^_+MU0Caa>X zHcUsPJ^#3M{IS!gPuugaTC@d8&@3?IEaH!QMGHGGqcUJ8nC$%0TksXW;4k0iN4#R2 zEd)D5SGh|3K3!!Osl0fbxAJPA@y>qAYcpc+$?Gsx4J>b>WPce2UqpNl-9!eN=zJUU z{Noll2-UF=T``lW*l^)7zQWK?4dNdf+N!hpKZXSG=K9I3>Nh^Fen;ahWS4Z@UXW(C z+6&Xn4kW)5%y-rA78HOOAt_8pT+(T+?{EB8{TMZvhc_66=kx~cRe!#;;_*XvIyBh+<-Zu8}b^ft;_okGHENgw;ZnvJc*!O4? zZf@A0wY|>gH0km%(pj*^7luFKmn*jx{XH-{B)DvY7`F$ic;(I#GrX> zSY!TtP#k;oM_v)sLCxg<1cfDr7!)PFxX4^e!>i{ZRY^J{avfyQbG6v>7n?20{5CNB zgbz;(&R{h@{ORCmbufQB*v780^~TWHSi zjM|QmF-A-?Vn|bglBvNgg^mDwVUf8C`D=eQ)??6$i_OW({K%e%PKjY*RDDDSN0E=) z_!*-NNXI60-q&?r(RF46+{RMIzco75?tE}ai_jaSfE*p*} z2eC&la4qx=web1p!c=uLe?B~0jV}w0_)SHjeWK>6uaxCQ{i&iyEQ}tk&MSLAT2gd9d?(I~Q?d;U?g%5MHp zmJ@$kjm^18gDTx@(VATXha#G&T1-kdtM+jlr(ak2)aDnw`?wWUN$xd1*fL&yylkK4 zjLI5+U6$YSPnFrP^2b~EWffidiPptYZ(JeGuka+ZnJGQJ=Qn->T?E3XuW)CZ=)hMH zx1v0|@f$SXx{b51@a=6zvy{vHpEefO^fGUr*q&AQ;iD6~vDVdmb7C|r`+*-xj9`!d zz|SYfu~R?se-fLqAwTe_w)0|6M`4YzqyN!TpnVic`ED?0QjJsJKYNA0+O}16p04F< zMMJuczh0);N=kJeK4=s9Uu|O(tFMx@$ec%_qhzRHxp_4Leb7~kjoNRJAcaEtltu6d ztSu5kp(QdGW?rH+9*u7z$QnF2eTi?jcJv?XQ5Aj;=HFT$2&i|D>}CW{Y1cL2AQIj! z(C&z`742+l>lZJOx#i|V@Q3^=C-mesAiQppuKarY9&NhH1QjwtW!(hdh1E^)Nf;lS z6yD|adxS3{bY;(9ZgW^fT(mZFFB$ z6yCE@GxlLqemyBFuoJZ8x`APA*!KXB?hwSI1!uF80T|`A-tR z-Z7T#KF*Du+6Vve4ef8pQVHdWI;eM?kM1<=p*wa}c^r=V-UOq)2_N&jT>Ke6YIr1BCft-F%eC{NG;*^CO@J^CKzY&SS!SPw+~1eYY{CA77E&+WWU^a&N^~ zWp5<6Qdv#_|1qUUO@6k1uUFysyb?p+=LxWzi(N2IanW4Sij+b_g^>5TjQF>BSW3up#()fk0 zotxjl?BO={{hU;b%uX5w1wGNe#>OJG@7G^of_SDK@6pW>u%x4~`|FRST%mR6&vXl6 zJz4xQ!Rj^BdjbSy@jW(Y^WLF1}=7gBiOGpXDD(>$*>2Cpz$3-A4qjrTu}viqdAn*?^Dh zVQ;nf2g=BI8j7d2Y)cx;#nKKZBd*a}p|A9AWBfV(NskETeU4x25%PdV7?bl7Cg5^0 z7>mpmK)3NWw)|vBpM;F9k|>WN5p)|jo~t_&0c8yh}0mkYNy+wQ5bD0#NPUJI_4x(Ix07m|I{at^-tvg^oi|n@VN3f z5^4_!S8Bl4y0SrcWgEFtb6L33pYka7eVk~fI&x+B~Yl{ z;n=ih+}*#W_pwq@4H-Nzx>>Waq#^b;s3n^=NF=BvM@`xz?fI+$mR3Dl)|SsgRjD1I z{SfTiwZ$mPYT6iy#Iw)x@&V15Un#E|5NSQ%;%+ki^#Royan|kjKOoZhACL(xRMeyU zctIb{BfmPn9oDZ=-VlQhI;(g_Yk-f2QFs z5nrK|@NEMp$9xzwB$s|h_T1$oJ7VWT=n+KWL>Th}9K{3V=Z;6c|=~21Jy}5h% z;z51Y+x*xdOX#~8x+QuG`s~=3T+p3~u9f>Lg}r=io@D zp5Te+W4U{MqWPrm~M)^BzMlvCW6Ld049sW8WulQ6O|Lu>-Hr9y%lo;IJ3kLhWw6FqG@v2IaA8 zsUPzEVY?%CVZT+o0YOBjHv1ISeuefV?>D?t!ZZ8zDi_O%>`>E=sWz}ge7d(?y?aR&oZ_@rmXdpYUaHY3zOUE+E*5xwV1`F;B~WZ=g84= zU)M`(qQW~h=j;6Kha-E#FCku8ZHL;Y+dHu1C{K@(I`qAab0sO>a!76nBI zI_% zi4}gxkIiV#o-^~SGrCOO>s?zIp_ZxLDAS$AOf9BchqlbD=jYHeUac*Nm}gDek9doq zf}piTK{B-CqS)dsTvqPHHN0qM8#b?uADJ2B?|^-&Y|<`8@#>kaTD;w$)(ezhzD+Hq z!ij==By&o6k68|N8!wp^!PZ6bS7xQKkx^WmwYaH$pRVknb~RzCKwDI3`}v~T5$uIX zzG-%!ru&3r`rDbPb87h8h5W|swjCOxV6{#a?V*5vsuLhRpkDO7sBKY9i#BZ!A2p{9 za~Sx_In5ewlG$5%z$3Bj=bikMIW5@Ho&4`Pt=Pt$yoGZKOWetKIY+PsFL1XrDZ0xG zVtFvrRBy&Q5l>TYyl~5H-1Y(=@<W(OZTFNuv=#n;appep>Ec|9XeJWngC@Y#mr34|yQumhjx zDcSAEOjqvKeC-g*)E2%-RZwK!j%>7TGCGml1v zWRiU(LI)X64_c#72k|qHwl%fdt=r47&%iJXpg5DgUWL8zUFt)=yLrrlY0TV&Kd~T| zWj5h^7bJTnz#3okdxYA6*UuRpH4pm+w{iYfJqzpI1;uT2Zsm{X^jF{G6**Rxc8uT7 z=@-TKk@`lOqT!LPcA`VGlx*SS9_z3Ez;``1GN$`cI3`vu&(_Q{&7$HBhi)s}y)ZQ5 z=1$VOXI7<28=ZR#Z@(y^=@>ez)i-e&wSz1Ac|K>+=+L9j=|zXVI>V;*PQGqdIRAUm z9CZSpxwuQ{kI(9AC>afGIl3G>_}hzzL?zU?;sQR|rH1eu|hwP|0V%>TO4%HsncZ_X@h${u}utjbcJ!YYms)S+O@&X$v$7eVah^AZZQI7L=b3{Wh>>u&Bipq3g}lYm=IqU9 z_|T;ZY{N5r;nMWT`m}F`-ORgt5KMivd_eEw(n)O9=e*ytR_a51-ZD#Y*l)E(L3g3? zGWZPNx2zL;aSOk^%p4pjyRc}-OzO6|1w1<69Cm6O&DeNHq^&kGsH8SyRVLYjt9uUHkHX}*zPF5Jj!Ho4XWtKki{(dd7skUvut&yp+niK29NoAcn};W&zz zUfe}(&vz8JRUhP^6|ZN5F7vE4ORO)RAWNbHi`$aVXTl57-%qa|ZpI=-r&+i=q7qoO zKi6^N+SKsLbbvs0C*Pq9rP>_I(Y|D;hT3^|k!~9Eh0L?*TK>nnr(zbb z(IZ4ZMXYB6lTkFY0vX#?I5mh#IRMzGL)-hE?I@2`*? zYwy1-!WnL3_k2Y`>vq7n=>SaD+ElpRV7gLsi)~z2tz`wD|40l!yD^T9S;lW~w6OKd zxcSLR?8BwJ;K@#`cqta^W(hwp6{c)3WrKw@?Q1kA7(1Ctqn=~ezBs`RuJi`IbFm^; zE8OIY;g7kD?4vwh;))0h#A^$!j@xA|ixXYU@D2HKSNoy2C!re1NBsgLdoEQwscL_( z*6Uleu~@o)k`f2$&@MtdFC}7eSWS`>tI+{s`1DP~a&OVmom@O>_XiHG;c~IJ9*%hd z-aE8{TcWaw9fz%ucnwb zj7^Wp_rx4t#fLv-X69VJ@ToYpEr0r{771tPii|`xhWZJ2Hw?eNe;dPEyDT9{7p{NlmWU^MYln>p~gDqOY`Icl=<)^pwW>Ir^;MUeY zAEQ3Vj$M0iIq$!NFh^6&A{ z+;7|Q#P?^*GNA(Ss+6yn>$Ur(qHIskUjKA3yS0pmJYCf0_N;$P`2GD-k?o+z5qIniWjhw}hj*Sz{$io*E$Byb6MDiULj4t) z^Wc+K<`H2`U|rOnU&v>?P}cU^W4f0jyG-pn85A>WhE^$qaFqJ^yN~gKFAfTL1kw`u z+F;e{P2n%Um}0ctH6(VMc5lu282|IdcsBbZZrXK?-C4i`c83RFTtH>l>xisoYLyFk z_uYMB!>BKLhDnyTkn|9gj?F-jzkA!r5AW^}xHn&q6J9zr{{`H=dsxEZM|G*F1~J5U zNr|WhF~pyIl;^xOh9y7B&%N|i;I{d7>||+c=JULl`?9|CdBw|JnfH9ubvQTeY0KWq z=0o-*v;1scxF?H+W%HYRx`iHHf|f=BteRsq%%D4CZ|1vv2_NuEbKfnPbZGRLv~6SQ zmc5lNhyimO-=u1q@RHa4HcpV=S9a-K9)w8ggmH6uNwkwdz{F<&V&A={Z{AX!9yBUz;G7-)S3deSQu_$e}%#Y+<)U zJzPJg&p~QRgtuHpo8&^Gf!5{;6<~x1=b@-QM5#PF#fTDaEFMocuuXgsdDmGtS-4=e zH!1U25M|g&;?#CsnoPS#{2)SQtJ-x}TaOw`UjCPh*xMWHW^t9jdZpRa{o7S+E-X{?71dtFj^)lbqFMZ#eBB!f{wt_HJvX40 zqs0wqVVye0YwPIR8_>S}#0_Y-d*b_z7B`^ppFq{VRmz_|9LuKn6gQwdAG-er^q7q| zKGN<%Cv?Rf;xtP1bT7JX84XsyLp+SVuG^T6#JEn{NE=`3CSxdEV2FnrW}8GxXh1?- zx&(q(vVGmgh9~&OBTladIJV&_snMN>CbfF~Jv0|a1(gIwxX{!yo7)$DKnm=T!+(!n(?BQf-$p&AvJL7bRMc|WM z3gGob4E|e5!jV9d09gQ1=%{6-K{DbTPL4)fu`ttF{Dz$cxfvQo-=RNv+$MMyZR9f6`ik zoz6CNE7Ea7woc~Z#D^;xN{Fbd9LQgia$MD}%HZF<9oGA*$V;EApzz-7l6Ds_a6=k&0fG@~!7k0$=$~d~OYNv^Pf}hhpRF zS>(0v31qJol#=IiS}Hc)7DvWK;&TzVaWXmRX~|y(iNqy(;sQ#XE)$oF)-}E*6H^fD z5G6*Hp+Snw4~qQT3=<}1>n8eGVzG(kbP@rO}$^0!j{b>=}~F*Sqdm&f%N zJ>c1uWL@?UFVaR^c~0?=uu5bhMHjk$SpY6p3|Kq(>};-Nx1<^jKPq&=O^SUy~md2ijKcV3tQ<&Dd@ zVIKG%A*m=eAW$er*p8j5F;vuZY7-`~7 zLhMQ`+UpSM7mgw1mBU`RI#1O0m=S#adj;&ma2|DH5PNDLpLHUg%^1#)oG3BAv6sp( zK1>x`XPeu2VhGPXxghH2q4b^E{0N%OO=QqkYw-P{{KmRAJ$_K|L#;P zc5xv0c|W|v@1v-4#k7Is`nJYx)b3goo6*(CU5nU2s#t{9e-O^I-;ZV~1Np}H$Fgt- zzw!QZwqY<|_`wtw{}R9OK~qcXf$$e^pnb_G^-8xfj70E0>#pd92e|2U2;2JrPd**X zj;`ZlPN%9n`KHs&*wl6W(CNgu-;oGu=$ygso*%6xV5LA9^QiuXhxWr#-tfaN>`ET* z^I;oyIFDz4IGMfKpMUvbKh`*p$9?2X?wO9$+&3x3ZYoE3ePMD;t%(#YrYP5#D=Vmy zJ%%Uc@((`h*{KQx1d*B5Z8ZZ9rjYmKT9xB^+~n$@D^LG}%JC%KlgoR3+_K}Q7hq0r zbTlenxZK8_{q<_;D#IHo44a};AU@vCpZz$9Is5YiAIBMcuMruVsBd72rk5Jq8h-8L zsSj1!g&qIpxB)=F5Nk|YKi!s9hWC&TqOA7Rig^pPjo3>dC-masRDJ1Yv$h^0y(_24 zG&y#@w=zEXK~F?>w2b(pFTY%w5aX{KX#x-m@x)JhMW%l%?PhzU>N2X+ zs(VQ@oBQ#iPdfUKrsKMNIz1OZ{>YplOUw?qOSPqco};yZ4*Yf4i#N!*k6wi1ig@EQ z@s^@KP)7F}OMR&db>KEWMj|B0yeoRV56?K$oGt0Ym!7e(d4>GtGsD!!x%*5gGZgZ$ zPhIS4Z@&N2*?xQaA}uD6jO+$lO#x5*tTj7Yz{h+R+0yGPPf>iaou)|_S)^At)CvoP zdvwa3UTx487x3pk8{Y6h8Vre<>*LRwN3HRMFwxbXm+Eh;qet-GXS=h)UOfM7A}buh z%g&BxEqn3cb1m7m1>AP7BRe^qFF3b=HQUW=&V~Bk=tvtTYH97t5^nr_fx4X+e?FAG zwUS@>ybZgyk_ViRWSKqiX+saTwlAM^emr}!2d_LoIb>HK)Hd8k#~7|(_gXdcFh1am z4Iy{Z^eFVt;ds4*d7HKn)6N&Mxi1VshSm6DMxNz6NX0}dPVFabvrtUzRq0o!aOiE= zDR)C9Ko1|#yz8{5zMGvWLT+R4+K7UsG^I#!S{-qT5W`o#@yj^2rz=1FWdb|hm0$ca zmG$e&qrXaE&Aah_Uo{K)gGwcGDd>qQMdbWjDqr-KnN8WupZ&_tl9uu6uOf^g%S21r zsL$dom5La&j7NO^5WC!kFZg;E)4K5=zs_S%Z{k_sq_aaQ`~V=l8~6IQH*1r^`+sX@ zt8jbu?ILzNm0$gK9{cbCKH)oKdi`W9cxZo9euawaMcq($%`Xq2Dfm=R+BBXL9|={G zd)Nhj)0tLCp@k`TlFduVvBoZbfFJ#C3mcrw$5;Kvo>Uzo@e7V|?FOl%uJNwU|GAF@hb;*s;l^u-?#KH5=RN}%}TEnefY=U zKgtd^=ly=@&CaCqq8~c2t*QLz4_DdVF1+-|?re4!Uh`w07Skr^9SAF=@3CGq4&O^e z!+Ls~nAgxH$`f%Z8OlaZ;5nD013My-_+C+T#|mve-*vfF!#^{rK`XRR_}7=)vyVFQ z0IhYOiegyP=gQ zwY^dz&cidcXe)o`T06G26aV$v*uZVwb#>8}cI{3(p7~2OYtxP|{iSlgLuX^J6t_JMC{? z+oWQQKbIipU^9F-qt0+OFiVVYu}8ydLAPS{XK~B*G0f7Oue?6mH-ef}>=`jx@inQT z!6VyxB>LP{Y)D(p!+(tqjH3wZ5xU30ZTWy-2Zs$yrMVYkcurkLo{H~DR;O!vax$O#(zE@swVPIza@p`clp;uU$^1Qe(TJVy6_{vjbrs@@`xMr0>`D)$=0F0 z)0#hX!^(VH@=tDL`CaOSNcnBS!4Bfvf(k4Kd5 z-GcYH)zb8vMbAW7&CtG=LD@gfT6n>&)WA)3m26spg`d6EHZbE}X@3hh{@KA4R9Bjz zdEIO9W^+FMPg}&WAWtE8H@~Nlo163Fe@?`|Nvh*jj@G<6?|ge=+_8i@x|!N*6s+Ah zQx!dzfW!1Ke)e|ffLpjzvlrl!Gy@--8Gg#;k$;8zzPeCR4D$xOcV|v~Y7FoF*D&89 zkg$29r~1z^9x?If{~8+~9H}T`NxkPWb*g{#a!eO6n(B*x0T=)GOcrF~{O_dPk@yS& zpL~QNs@V67XbNx&6rRWKXuc6b9}@{5uN7wJV!de!p}p_}w=qPdG&a}6_QG3kV?7eB zaAzB7e}yu13#U&V3Jei|>Sp?qmUOCT@emc$Z8Rwt7%G0>)<2zwKhY;7hzzeR_59QW7q28Y@CKnDg<&Ha+++EA)u-c0%t}wWw z&@dd@Jqx@7V66apaLF{S2s;vgm{A=yYMU|GS)qm7x?SH`VDI!;#I)ayV#Xs%XYQwQb z{CRf@TfK;X>y8{e7qQwi_~&Qn9aIeqDZEyMvlH8wS0|w}8oEVMmKE;b{BsRGp@0S+ z0H7ctg2MnO3{i_V_E!^{%({8UJwL}j$#**#6m{&)jZ4*a!2{5{h2yf-^Sbp|=t@x4 zR$<|Y!QlB~egka~{^de7KHU8jzIZJ>_^_%v)aILW&?o*>{g>kdT$E-0fRl!Nh^R;~ zpDwzrZ+w{R0#ieSMRzUs-Gi>8o$^+clZHMyF5h};50(+?8dOj1r7m`@tEXOO^B!?6 z^isQoXpf>3V8@nLVE6`Xb%V4*!)K4W-uF`5wS5+XlZNk{dS+<_zF&j&KYTgZKYtx^ zhu|axN9uzwh$?rwS{l^W!`4HTU*UbyuoO%^iZbMa>-qaJQ+9HGh3TXr3qga3mPJ znqKswtpToI4Qkws&Tw3N30aW6WVBGT1yotY(_&R%*b4>hm>Q56|I&B9u4x0mSd@7v zBxLxcAsrl5^-04>$$1WVsXGpu@5-yMhQ!ULBlv=JFOw${r@y{KJVGeG9^!hVz8V>M zFqpC`y9J9$;*)u?+7y0-dzWC>_4;Z@HZs^{X`n{>W`&T+p5FKeSOY^`Lm*5C+VxZ!fo_cW-s1&9s?cKg&jA}5`$b#ywL|* z1-XWKt3%lzzOEO&)o9-XzN9J+PoDR6ed?{IuuNZT zQ_`LiC+=f#H1kI#Dts9Q(SBo(9a3!AGl+lWyp7t&9iIpjr%#uv$M6rI4NpOKjOHb6 z-`}o%jnuI2X-Mk70lpO*QqYowEd;_>?@_|h;wXRG=oWYL22?k(7uKU$2$S&k09XCS zYFzH6HX{0KK;7uc)VuPJdD~OJn|sAxIELQdj+?~45f_V*JHDkKdSU$cs6lu9Iq|Fz z&%@&RnRwn2I?3YMMLai%r!GGaKGz+;UWmqs=Q#1q6wis`*+D$d)sY_-{ABT*DxMa9 za^hjZ&lJzS;^`F6i^7%T;@M1SmJ5C^CY#f)=055jzrm z@!yh|C`n`NE$??#TFZ=fz3rzqW1Hr>z9rP=y6*U?k@X7)W@=B{TsD8m#tn95`m1rK zu%A6 zHLmXh)mVGuTFazE$K2+C+Uli#@}&=q6!fv9rf}*aYwE1OtSS4SdQDw-^>3nfO~KM} ze`6O8#6iQmp>E@m{~8&ft#!TK1ob>_i>nH#8eD3S8pRUpyG%g{)^qg?QbW`}u8bfx zL7nZ&4N}v*VU3#k1=j~bYWp~UczI7--tmX zVMmN>HaW`DSQsUDRU(zvGIV1&@600QMkQm^U4oK`Jaiqk#5?4yxF7bfG(-MD_ zXp(mI0^*%x;#fU{7bI3l)FgV3)8j1??Gm#jE|d7Q#4{3o#_Q?2OPnh4HHkHZ$Y1H2 zsVlCQ_>n}v3A%io#0?UaiMqU(#3v>GB(e1*J^uI@9rw%d4T;HHDEn5xGQmsle4oWy3+^!TX~w@Un0VrZ63FL7&@D)Lu;m4e{ux`I{W7>Op? z6gje!ZIg)Mr>tVVb1BO4hjqJqC2o?KC-GvgWU?d3spM1bfU2mks+#hG@g8H-XHBc$#9)o`Og+G%9E=s&A@s7kyiD@$3AsHSg!&7z4 zRh-hp#WLaviQT3AIT_w64J?!L0TLZDexZzymElbiJq4(d`X;IOqX?t_c}YRJR5&1U zkHj4kZ%b?A)KM-=jB0U}H&dVZpVcyBuzxCz{=cXNO`R}(=9I~%>^Y{nQ)bSYG$DIRjBATY zE%u)_;W3YB`kdJ@E_bXN?`qvlP5hs;wZy?YQ>?o1e^#rCQ~?n|J~5`c(t`U#`Q{bHK+dcd0kA3;%b$kKF20xyFN}(-*uHXSF;bcwx|ZxHKc`V zRXe+uwNOvyrs~aB{*T^FPKh>&R*6-A>G1)7>zLV1Pgf(u+a=m0S|#3}F0`wj&T&Dv zlWY1;XKKEc_?67yOC6h`^HFEb`$EQ_)p7f$Iy%qj==em2D|M{=SVx=00EvgB1Kaif z>FU=?ZPHX$f@09~nmA#yY0`vw+3RA0M|%G98NR7NM^%*8JyfN2l0FA|;_#xQ;6+?n zjkwkK#o^sZ$-%kBR>W3e=|{D`-K?44at zv{57C5xpx}RWPzC=AK_h3jTx};_S(kRfwyqjp~~V{XEF4{zYHc{ZBhir141Wxq`}`PJ1U|2)4$VmAF3gUWpdJ&u0Cf%U#D$Q_EK9z?&oeruk3YpZ&(&=l92wrbP(E_cgPldpS7jicC$#$wCu#O+z z;PrM3cUckF5kt%KGcEo1a?_vKsQb(5>Uy}H8qpEz6qS>DZ#1daph`T_xepIt3+xr^1P^>&5*QUcUUUt-5;N-SnQ~ z=!2O*)wQ?1+O#9uW;?RRR7h6u`IY~d`m;+j0ZFPMzD|jgk*%j=lOgI44v-~PW($4l zpfs+!P>r5PZDa8u-FtpDFsj|x7f4|{S6hK$r@b*n22Gn(EyX zY_4+tJ|Rh~?vbq;S6P6a@d4**a!72WphbJyO^ukl}Opbg$pN7M2jf7p}nQobF(Lz`}Y(X zo9>Z4Br>+tl?~VRtoO)tJ?vk^kV?#+Igc{#S|@Bq82cK%mJn}#=%HL;+zw$SuFVp2 z^iqWmR+T-fCv46kL-a>xTa!%hV7ULrj6DQ%Dp1OjNaj8Co{rdoWOVj46c=4muM^3X zJQWicrY_IljHO*sC1wK=HqTW|D`30Q2&MyUm21#JTh4PBL5Z z=a4XZN?mu7)s%HsFIVRjHLQs}L=~%L82&Mj|J=q-dx&ddiaNDD$*ELfExnXbHB1R~ z24o(GtOgZv7;?*>RBdS>KN@_ATbjCVr>HFxDV>GVHB^;`y-)`HHJCK0W%kDd)3T5+ z^T=I8yQp1aJvun9RDverHVS`A)Grpg%~3w+!l%7m)Mnjk^+F-

Jrgs6ccj~g(b ztoDIFpddo;0EX*!AFxc#D{ty*n5uT}QEQ@cJ*Dxo2G07KFk>MztrRMr6Y9OthL*>` z6oBgcnUGszDm_Mqy6|$+P1Kp4%7{AiQH|u^N2zM!P%`e*7v(qNVFICUDBUJJa1~L) zT6!fi%*bITFU1cTQudT-8dL{RrUSubh;*ft?gLzCc2!&ElHJu1Th`&>0x`cD#ACiI zVqM4&s;8sqfUxx%qK86ec?--jp&Jk;bYIhTk+7ktQ|uKeZ4~NShH3H=;peE%u_2&v zjM`LbGEo`LsWh6v}VfmO(HQ`i=jg}i7Og^?f6VJnK-KhaHXU+ajB5GAmYqAZ~& zaVp6u_Q?&LV8GG$b)my}Rc zC3$^OH6RP(B$T;0>~JcM#yVKP01d2lvSX z8*zk<{8S|pq=#J}rKz*)B@fnL^6THiUdZHdJ=8}HuU7)$cZsU8@h%AU2-VdiNeu}T zN|f)tKP}I7q7M#X^IX?-2&Oxx#_i802oH_8 zt9bQc?7rf#)2Sm^fat0lv#j@Lx|?+vswNhA6@{_F-J^CAgk=SeV)W zFy2FCLZ2DxK=2RE5HTYC))^xG`?aD7m+wrG9?|`vylkc?eayj2Gu3!C*W3pO69I}c z3-mR3CvXLb;@uz8*r|amjFKl(J4+9a0<504)A$EB?yNi;0gPK zoZuZnIQH9(Kn?<>!0$kL;Bj@VgyLRpHF#VnE2BXr;4^_+L7Twi8c+F3%Bz64K$KQ7 z;)_@i@iyQh5T(rnZj$otz~i9py>qdqgQ<_>0x}u^>??T(kiMNILr!3$ri!u)ycIYV zMEXwP3z9Dd2HJv&U+|q$40~>HLh%zVv z`n1;h0AObj*|7mvfp(A`V4pUMvIo4Q4UTDa^Rn!uOV03DassBWG(_uFdIQsg6+V6+AGTU zq?Dv6D?wDHCBW}NR1-BoV+UQ|1ndM7!x-4FBaV16EFHiq5cLnj_MOlVXt)BGf~e+7 zfVr>ZA=(Cb2PC}fjOGDR$!x$ipd9ceK$fhJZyRt5h?>s{{0h_+8B_s%Q}na}z`Y>c zKq=+GD;n;BnhWN05H&#+ zFl-2Ug`o(13zP%C9QeXelm>hyPy@P6Y{@z@9k6%A&l09q~;^Q5xod8<^!Fs;&~?Lu1i?P|5`E z1d+TH*khdTbtW)!ygrqhfU`kV8Yl2JXa~|NnHY+o9gsVK?I&Z?0l5wMGsq5`HNfV% zQ}mKqffqsLP^tm;o~kQ3fCHvs!GPQWtOQYF!aE=uqDq#c*g)ij1GoxA8PgwmISi^q z+Hzp{baZC$Cg55S6)d*|%yH0SB&Y=bC3!jmwSh>9@G%e>%>!NqnZefpXUstR!>AMJ zJ5#O~z(b&0kkwYjJ`Xr-0SmF#ZX> zPgsHDKqaW&OyC}p!+t67S`nsU$_vpghR813v*#vsM8calO+807rqS7BhjfHi%lm*PURLjrzPz zI21%HRVMIh(AP+?9e4pmiEDtyCuQk@Pk?C7F9Ci8Dj}zVH$hZ$iVJH5i29QWI2lBR zbOK*;p*?A$C`I4`h`g==MsCu16L2m_)C%ww5DmF<;OwW60Wxy}p9WF2ZwIc}0*4?k z0e%h=H31CSs@pLE&uzn=13Fc?U@TATN>*Tx=P+IoVFN}!kF6QbyG_8RJ8+6dJa7?+ zHWzuo3m|Ha8leA9y~F{)-k=@OaRBE?xf7W70%{j_9KbaoG5?ogDKqhb-h%(*|tOC6W9YXVAU2X*qd=nqM;HDzi0cHh=GAjX2d>bW0gcDeO zOy8E(09U++>cS8z0d_ors)vpZ_z{S9M3um}lX`7gfwNCzg(N$`jUaM*JMeuFHD4w0 z@6%|1%2@djnSw|u6S!OQrN9OsLk>guj8o}CJaq7Br*Z;BrN`%<%B)Jg37o)zpP>1m zkIzDt8E3HBASZxZKh<^c`KWU7EcSzt*PO-pU-AX27y*1|sto&5U(GUsKYfMv$N6s! z@au1}s1Of~{!aFM;9$u+fG>k+qfrV>th$7I9&tmbwS@ZIDmzql3YZTfVo5g zQUZEk)Ds5)CxYzA*a>`6%C`d>UDB&M0JsYzHj}{7--CyKCh!7?YPSa1_XnMK0G|U< zEtUdvr(Q<2PzJz*8io#5uySCpD|!YFV9`(L&CpS*v4sMOJsog0h)Rq08eq%o zI&TFw{8e9G1Av1-U&9FpF#k6=2mKP@eh`(iobaZ;$ZZE+2GLwn1N8qrS621!=uDtU zL^y%RKr|mz00Tt1rlQ&78SUqDx>^uRX%=tl8%wlW(;CBqln$~z#^!B^bM zKOk~KxuYmiAhKx!_5zW<16Tqg9l}abE@ei{4~nY%O_>2dRdEePRRnCsa2JRKR^SZD zJAtP_q*DnDsE6i)4xvNxgu6kcQwsF*!q4o-pBS1<%23-4sY>2Sc zSCt7MJNU`K?I4ox0)8ra{M!U&M*~$!hn(;>LJSd_FxKr}G2>mc2!6;!T5b1OUe&dhZFvzQb!2!AHG_E+L>a6GUII~--U9BxZSVKsD}a|kq@x(&2#9nD zb0kl9##2C~lLb5mx&a-!x9!~&O#vSN>_nLhssT@5Gi_;#_78^FV3Y$O;>&^IxOk3) zA^IkWJ_#Z@;Yi67J|cPg^oPFuAss^cq=$II4Lxh@7J< z{9L-irwGEAB~N%#@^po-NxlZy5clN55M7{4o-X0(4xZ$M6C_WU>~ybAa>BD9%D4(h z*WuuY35M>wbI>UW>6=nYKsX;n9V!pFQS#e?uS>ohcvkY~fl1LcB3w&bs|(iGyW;X& qsiu0Bs>%|&cnvz3xl(;rRZT9o8i(LkSFhFTBsK5g3#-+K)c*t6=QEE0 diff --git a/physmeme/kernel_ctx/kernel_ctx.cpp b/physmeme/kernel_ctx/kernel_ctx.cpp index 008d375..1ff6a03 100644 --- a/physmeme/kernel_ctx/kernel_ctx.cpp +++ b/physmeme/kernel_ctx/kernel_ctx.cpp @@ -190,4 +190,24 @@ namespace physmeme &amount_copied ); } + + /* + Author: xerox + Date: 4/19/2020 + + zero driver header + */ + void kernel_ctx::zero_kernel_memory(std::uintptr_t addr, std::size_t size) + { + static const auto rtl_zero_memory = + util::get_module_export( + "ntoskrnl.exe", + "RtlZeroMemory" + ); + syscall( + rtl_zero_memory, + reinterpret_cast(addr), + size + ); + } } \ No newline at end of file diff --git a/physmeme/kernel_ctx/kernel_ctx.h b/physmeme/kernel_ctx/kernel_ctx.h index 16ee891..5396459 100644 --- a/physmeme/kernel_ctx/kernel_ctx.h +++ b/physmeme/kernel_ctx/kernel_ctx.h @@ -33,6 +33,8 @@ namespace physmeme void read_kernel(std::uintptr_t addr, void* buffer, std::size_t size); void write_kernel(std::uintptr_t addr, void* buffer, std::size_t size); + void zero_kernel_memory(std::uintptr_t addr, std::size_t size); + template T read_kernel(std::uintptr_t addr) { diff --git a/physmeme/main.cpp b/physmeme/main.cpp index fa1dde4..e984925 100644 --- a/physmeme/main.cpp +++ b/physmeme/main.cpp @@ -59,15 +59,27 @@ int __cdecl main(int argc, char** argv) ctx.write_kernel(pool_base, image.data(), image.size()); // - // call driver entry and pass in base address and size of the driver. + // driver entry params // auto entry_point = pool_base + image.entry_point(); auto size = image.size(); + // + // call driver entry + // auto result = ctx.syscall(reinterpret_cast(entry_point), pool_base, image.size()); std::cout << "[+] driver entry returned: " << std::hex << result << std::endl; - physmeme::unload_drv(); + // + // zero header of driver + // + ctx.zero_kernel_memory(pool_base, image.header_size()); + std::cout << "[+] zero'ed driver's pe header" << std::endl; + + // + // close and unload vuln drivers + // std::cout << "[=] press enter to close" << std::endl; + physmeme::unload_drv(); std::cin.get(); } \ No newline at end of file diff --git a/physmeme/physmeme/physmeme.hpp b/physmeme/physmeme/physmeme.hpp index 9b80ce4..31f284a 100644 --- a/physmeme/physmeme/physmeme.hpp +++ b/physmeme/physmeme/physmeme.hpp @@ -21,7 +21,7 @@ namespace physmeme // Author: Remy Lebeau // taken from here: https://stackoverflow.com/questions/48485364/read-reg-resource-list-memory-values-incorrect-value static const auto init_ranges = ([&]() -> bool - { + { HKEY h_key; DWORD type, size; LPBYTE data; @@ -39,7 +39,7 @@ namespace physmeme delete[] data; RegCloseKey(h_key); return true; - })(); + })(); /* please code this function depending on your method of physical read/write. diff --git a/physmeme/util/nt.hpp b/physmeme/util/nt.hpp index f671e6a..4e8012a 100644 --- a/physmeme/util/nt.hpp +++ b/physmeme/util/nt.hpp @@ -89,5 +89,5 @@ typedef struct _MM_COPY_ADDRESS { using ExAllocatePool = PVOID(__stdcall*) (POOL_TYPE, SIZE_T); using ExAllocatePoolWithTag = PVOID(__stdcall*)(POOL_TYPE, SIZE_T, ULONG); -using MmCopyMemory = NTSTATUS (__fastcall*)(PVOID, MM_COPY_ADDRESS,SIZE_T,ULONG,PSIZE_T); +using MmCopyMemory = NTSTATUS (__stdcall*)(PVOID, MM_COPY_ADDRESS,SIZE_T,ULONG,PSIZE_T); using DRIVER_INITIALIZE = NTSTATUS(__stdcall*)(std::uintptr_t, std::size_t); \ No newline at end of file