From 223728a3b6668a32c66cc5a0970452622f1c7b4e Mon Sep 17 00:00:00 2001 From: gmh5225 <2315157@qq.com> Date: Sun, 3 Jul 2022 20:53:09 +0800 Subject: [PATCH] Update --- .clang-format | 101 ++++++++++++++ LICENSE | 20 ++- README.md | 13 +- detect.h | 5 + detect.poc.pooltag.cpp | 40 ++++++ images/1.png | Bin 0 -> 38594 bytes main.cpp | 18 +++ poc.sln | 51 +++++++ poc.vcxproj | 295 +++++++++++++++++++++++++++++++++++++++++ poc.vcxproj.filters | 28 ++++ util.cpp | 59 +++++++++ util.h | 246 ++++++++++++++++++++++++++++++++++ 12 files changed, 870 insertions(+), 6 deletions(-) create mode 100644 .clang-format create mode 100644 detect.h create mode 100644 detect.poc.pooltag.cpp create mode 100644 images/1.png create mode 100644 main.cpp create mode 100644 poc.sln create mode 100644 poc.vcxproj create mode 100644 poc.vcxproj.filters create mode 100644 util.cpp create mode 100644 util.h diff --git a/.clang-format b/.clang-format new file mode 100644 index 0000000..4096055 --- /dev/null +++ b/.clang-format @@ -0,0 +1,101 @@ +AccessModifierOffset: -4 +AlignAfterOpenBracket: AlwaysBreak +AlignConsecutiveAssignments: false +AlignConsecutiveDeclarations: false +AlignEscapedNewlines: DontAlign +AlignOperands: true +AllowAllParametersOfDeclarationOnNextLine: false +AllowShortBlocksOnASingleLine: false +AllowShortCaseLabelsOnASingleLine: false +AllowShortFunctionsOnASingleLine: Inline +AllowShortIfStatementsOnASingleLine: false +AllowShortLoopsOnASingleLine: false +AlwaysBreakAfterReturnType: TopLevel +AlwaysBreakBeforeMultilineStrings: false +AlwaysBreakTemplateDeclarations: true +BinPackArguments: false +BinPackParameters: false +BraceWrapping: + AfterClass: true + AfterControlStatement: true + AfterEnum: true + AfterFunction: true + AfterNamespace: false + AfterStruct: true + AfterUnion: true + AfterExternBlock: false + BeforeCatch: true + BeforeElse: true +BreakBeforeBraces: Custom +BreakBeforeBinaryOperators: None +BreakBeforeTernaryOperators: true +BreakConstructorInitializers: AfterColon +BreakStringLiterals: false +ColumnLimit: 120 +CommentPragmas: '^begin_wpp|^end_wpp|^FUNC |^USESUFFIX |^USESUFFIX ' +ConstructorInitializerAllOnOneLineOrOnePerLine: true +ConstructorInitializerIndentWidth: 4 +ContinuationIndentWidth: 4 +Cpp11BracedListStyle: true +DerivePointerAlignment: false +ExperimentalAutoDetectBinPacking: false +IndentCaseLabels: false +IndentPPDirectives: AfterHash +IndentWidth: 4 +KeepEmptyLinesAtTheStartOfBlocks: false +Language: Cpp +MacroBlockBegin: '^BEGIN_MODULE$|^BEGIN_TEST_CLASS$|^BEGIN_TEST_METHOD$' +MacroBlockEnd: '^END_MODULE$|^END_TEST_CLASS$|^END_TEST_METHOD$' +MaxEmptyLinesToKeep: 1 +NamespaceIndentation: None +PointerAlignment: Right +ReflowComments: true +SortIncludes: false +SpaceAfterCStyleCast: false +SpaceBeforeAssignmentOperators: true +SpaceBeforeCtorInitializerColon: true +SpaceBeforeCtorInitializerColon: true +SpaceBeforeParens: ControlStatements +SpaceBeforeRangeBasedForLoopColon: true +SpaceInEmptyParentheses: false +SpacesInAngles: false +SpacesInCStyleCastParentheses: false +SpacesInParentheses: false +SpacesInSquareBrackets: false +Standard: Cpp11 +StatementMacros: [ + 'EXTERN_C', + 'PAGED', + 'PAGEDX', + 'NONPAGED', + 'PNPCODE', + 'INITCODE', + '_At_', + '_When_', + '_Success_', + '_Check_return_', + '_Must_inspect_result_', + '_IRQL_requires_', + '_IRQL_requires_max_', + '_IRQL_requires_min_', + '_IRQL_saves_', + '_IRQL_restores_', + '_IRQL_saves_global_', + '_IRQL_restores_global_', + '_IRQL_raises_', + '_IRQL_lowers_', + '_Acquires_lock_', + '_Releases_lock_', + '_Acquires_exclusive_lock_', + '_Releases_exclusive_lock_', + '_Acquires_shared_lock_', + '_Releases_shared_lock_', + '_Requires_lock_held_', + '_Use_decl_annotations_', + '_Guarded_by_', + '__drv_preferredFunction', + '__drv_allocatesMem', + '__drv_freesMem', + ] +TabWidth: '4' +UseTab: Never diff --git a/LICENSE b/LICENSE index 2071b23..8acf865 100644 --- a/LICENSE +++ b/LICENSE @@ -1,9 +1,21 @@ MIT License -Copyright (c) +Copyright (c) 2022 gmh -Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: -The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index ce1bab7..6b7c5c3 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,12 @@ -# AntiKernelDebug-POC +# AntiKernelDebug-poc -POC about how to detect windows kernel debug by pool tag. \ No newline at end of file +## What's this? +A POC about how to detect windows kernel debug by pool tag. + +## How does this poc actually work? +Query system pool tag information matches TagUlong == 'oIdK'. + +Tested in Win10 1809 + + +![image](https://github.com/gmh5225/AntiKernelDebug-poc/blob/main/images/1.png) diff --git a/detect.h b/detect.h new file mode 100644 index 0000000..cbc496e --- /dev/null +++ b/detect.h @@ -0,0 +1,5 @@ +#pragma once +#include + +bool +AntiKernelDbgByPoolTag(); diff --git a/detect.poc.pooltag.cpp b/detect.poc.pooltag.cpp new file mode 100644 index 0000000..7ae394a --- /dev/null +++ b/detect.poc.pooltag.cpp @@ -0,0 +1,40 @@ +#include "detect.h" +#include "util.h" + +bool +AntiKernelDbgByPoolTag() +{ + bool bKdbg = false; + PSYSTEM_POOLTAG_INFORMATION pPoolTagTable = NULL; + + do + { + NTSTATUS lStatus = EnumPoolTagTable(&pPoolTagTable); + if (!NT_SUCCESS(lStatus)) + { + break; + } + + ULONG uCount = pPoolTagTable->Count; + for (ULONG i = 0; i < uCount; ++i) + { + auto pPoolTagInfo = pPoolTagTable->TagInfo[i]; + if (pPoolTagInfo.TagUlong == 'oIdK' && pPoolTagInfo.PagedAllocs == 0 && pPoolTagInfo.PagedFrees == 0 && + pPoolTagInfo.PagedUsed == 0 && pPoolTagInfo.NonPagedUsed >= PAGE_SIZE && + pPoolTagInfo.NonPagedUsed < 10 * PAGE_SIZE && pPoolTagInfo.NonPagedAllocs > 0x30 && + pPoolTagInfo.NonPagedFrees > 0x30) + { + bKdbg = true; + break; + } + } + + } while (0); + + if (pPoolTagTable) + { + ExFreePoolWithTag(pPoolTagTable, 'haha'); + } + + return bKdbg; +} diff --git a/images/1.png b/images/1.png new file mode 100644 index 0000000000000000000000000000000000000000..29c516cc46cffa0e71a2df9bad579c5e192ee26d GIT binary patch literal 38594 zcmYgXWmHvN*98Ot3F+?c4(aah?(UFokdTn>4(V=*OG;c?I;6Y1>$~XVJH8)`!8v#D zeb&yk=3H}!E6PhCe8Bkt1_p*8B`K;51_t2=1_nM40|9!YOX#cx21W!XB`T!q0e%GV z|7tt#O6i6!^}c(~hdsTSYH|}UnfD?JFGC1U7$Nd_!mel0s1w|E%?ND?PMrc6rA3Jm z$ysgElRsjbBI;(#mT;sQl!RK_E}&gwPj4>A>IDpg#|?6ch4&({l1{cd?qJ#Tpg?gBYi z{2s-Ao#E<6NdVfMUbmEyv-K1nA1^nyXU_J&rze$uG{|1E5apxOH6QDedSsO#k^Qt< zVD-8sw%^InpsT1Dr4ee>yCA&{sRiNZN0C(RFSCIkm;dsb4=EZVQB7ro9$SK&e6S`? zya7v)_nl0^9H^nn$|B{UP|S)+Vyh%D;~bJV`;*oH`Qf9Qv~Z4S-4@V%12tJJ&cgfi z$8$*6wk;Y0NpJ{3FqlMSkLT;#q=fX7)fv&;sM$c$%LiBKb{{`hvMDYnH;wC{(CiYv z3?EMx{%pizQ~yZe+k_O#=M69Jba@FHnZcEs(pLdbZn9xZ4<-|ff{!jvMZBX{7gyFy z1p9PlvIdSoRoV|pz*&ubVcBQ{=PlU+EyQq!x;FO1=|(x ztq4mE0fwBGNo$(ibXVEE1WAsN#23nvrSSM%`xIRi_-2sFV1f2X9umV^4uz`O>gTo- z3o9Rh0P-5BJ}He@FXzg05Bvl2qnm5w@(r+B*-ve z;BW19*%Q?S^xm(|BberrgMR;Gkem=$k-LgDgfkfUpEA)zU{h_R=m_kAZ%qgqsvrgI z>(xC&qMH=#o^yM-dK1=YC~8Q+-Mh0<<*3L|x%98Tr51m=2LCRU}04zNvf&#O)m=6?h= zCF#W#Hz^|CQ+cj1*q^AGBj?+GiPV8-uLiu%wH;BJv@+@BTE&Vbf&rO!8_?BuV*l#k z8fz-Q{v}eyn|}k@jOix4a@NvEX#$Ajf`;sG`;+cXf!P;|mmze3&Ej(o88#2K zZq+!24`k@P5X<=kT}8c3`p$j^r3Om72$JxN{W)0qjG!&`mF?eon)SrF$F zbWAd4>I)=jW|YgA-(}@qXCjVl0o$?FCkh9N6ZP|Rj!;pTk-zDCjjYD$U@(MdCwLV1 z&0PJGY{BJ4rU#%MGArNKcFJhf;jmljR?rayyLI({#S;+dJWiRGC8L!?uf)Bk#^)7- z!r?N~G5y4}8)>bSNu=KN363>AQVQ!GqSc>uVGDUN=T)juWMzAyD9)@NW23>daMAI7 zDm(ltz|P@bVm$JmUczy$JY&~Yy*;ye>9KpwvHFL1A>uxFTXF!h??cx3jTMWmv@-M< zZM*H^U99DcXL)s^XtaDj;p)+~C9kl+P?r)(s+7Oa94@x?g=WT<-)fHO>2;`SciQ3w zkwSO4bg5# zFT{k`QUV5Y@7d#zoNCd#W#>H%ql6~Q}G20^vXXzjW4yXP;$9OPz5q3J3q5K?IY0>Y9PipQ73;KYq zd-ZXr-olGajF=5ARM|&(RMWYE1m69Nomg=NB(isz4yRb@*&!u`G=>Ti_}lhXhS^Hj z*UkqVX3ZY0Z<~!T<}|jW1yMEtrdz04G1A~7m*ID*wy4-T>+-75iFWhOiZ(L2OaUW5 zlcRh+;j|JsI!QbQbClQIsF=R8WKDc~05QM&dExRfKpmirT_RnDpbF~p`O&elTBRgs& zXc~biHDBr0Q%aoR-VP?s_kq8)7*o1g*#NUzH1QhiRD#~XUwf!d{)ciJ3u-#qn-QEE z^xrPXN7>ub-bakL;?p|8mXoWb)3xzRA$Hv z3&6-Kq)jLP!Em$*YjONCoohW!HX5|Sx}pVVqC=EVt=h=#Vf}D|%*AxaniY|+QiWeb zS($&6Vrz`t7x-nC*O{Lwct;7vY_!|Yb?WicM~xkyCX0V$r!P0DJ33fYEdq7h8b=B+ zUWF>Dq@ie=I+a@Wr$cDd7Lu=2uTg~umFLRRkQlc%uBZ#WbFt)#+MV>nNtU{=c=w2kM*i+?3AiByx*_iBiCAP@C*iAXsHkaI3~_djVhOqZ@iYJ;u&_%& zSG4e7PqP;I_WZ6?vIP8X!oVOtVg+&#V)7Yc<>I`J+ne`vC3ZY5O6hF1yZu$kFW6#M zfq2YPWK!Owc*b2=Hr}K=8WY{|G~RjTE}%YRi zX#8wr^Yrse|M>HSjqv5Mzom^B(9(9e?+LM;5AXa9Yjpy8 z0jBpmDX)*KufXBX*A{^~bT>xh+zC4&BKKLD_Zoh9?mHdDb}pe1Kx2N*WsL7qW0mOb z`29Tj=1^!XN&?Rhr#|8<2{{iNuPvN+3T7v=6qkfAg9gtS#h(upo_yJTWyuowFhmA) z$0+>oYf4yFYDTI6W;nzkj%AL@D!c+roETTl)ax0kbvY#pldV?Kr=y$?NjFGM!5wy_g0s zAOrEzN0MYTd1r9tY5|$&geJosC(hfnnl3URN*UEijZcYY7kdGV`*p2gFeU-!mkKiUoi$7972XJ#u_I9ANsj_IPg8Hs zE>ehl+AfuyVJD6X=PwWZJSD(1g5P3dlpXTA`Z~Az3RvxUCN=xkasRmbG@Rp?1&J{pdsLSAKrNm+@Ljxp?p0leo0U`dIg?7HM8_SJz&11RQqle`|k}1 zs6QD9%nMy;@QLhi!6i|x0&=#9dmpL&`(@ZFY|^Gl(82mXUsJxW3cM5w5DvAkdhd*G zT%-M#x$oL766l6v8y~f+B~R&r7B|R_DDJjcM_w|OehfQ(G{^xwCTvunLBivP6e@7h zN@|y`8a&^=oD6hK0$6k5IZvALK<8Jr(p03tPbsu$2`KeKOMxAv-!7Uno4Z~k_-Q;c zo#TP}hYGkwsIPki-4D{8mcbhMw|XgMJ3woBalFCz??0v*$>t~v-6S6?P|H?)C>ah+ z9vmvoQKDq{5r$5kggiK#d}83C`Vx73I;(ej%z7iy72UVI4=*v~@o@eeKw;3fTCKlz@GHqMHTWIlcLAN` z<7a&R@GS5WeoEVLbwJ%MP22t&4CTE^$v+SYFgMbbE9JYQYn$W0x!e*ivU*+EI{8L; z|Iu_bm2Y;dZ`L6^owA&Z)rsh_I1^e9bVM|4ritDI3&`N?W`_5(OV5F@nd7Uk<1NO3ahMY;@bDCA@W_EXwYYT)#Go)2cKb@-n14c)Mi*uq z-HPXP+By5lQYrt{gN*65z8PRK)DF zXCiTMlQ{BrZd^eYKP*0$=CzRbJif3}74P_)+{XCp-B@ySu=U`>8uFm)CtL$^1^Hq; zJ|X;o)1a^{fR_W zU~QheFRSLO+<+eveoQo70c(mYq&v{Irt}SplfeT&0SrRmhyGdaOVO9Ft$nwz60g10 z0{4NpB|$Gw{;x-!0uQV4A@QRg$4mZ2fKL9IW)YbUfihjx1OTU>WE=nXelu^5T}bB0 zqQjZrcfVKn{e#_Nhi8OE((5+S{(AoG0pAGc1caCDd%{@e$L38SA-yFBm)C{bhA^v{ z@qKe&__7pBcu(&a#`-O~BZ1e++qqNoi2Ee2&%-%s*O*Y)C!M7%2}GS&z6Kpn_xo47 zy#Nb(4@z3DzAuzO>o!~!kKqq9@D&fuh511i-{gdO?*+QP6t)(joc$b?CyBN3LimL8 zae(e7{pW?hN%6Bw-GT_Baj`9j)_RAxG;lnoxc9s-(tLBzd0Q{eLA3%g=@X6tS{C|* zQmQ7qkbxADPJdYYU>M^-y~xLR$`e9$y9g6`+BE)4cdT7s17=>=Y#KVxQJB zeS1;&KIfZ%xij!DEg^*Z`GbO%OPsFCc#-MmzGE5*{h?d{sZb@{YUVH_xO5F?)&mj} zCQvu59$Y3fjFFPN=!ewx%UrNRVR+R+ljr`g;hq#cil)79>dl_%^wGD&h}$%t4WBbp zL~hv*EfR(RQS5~;upA@10b>V3)1uG z-XDWB7y>2Kw%#&Xd+b-N+imTCnk6Q0i%DwmGnvGut@qRNcTila zQBPISMtCMSPKnlil9Wp$$*aI}kH;%nBZG~X;k0qese`&6+Ge>-mf1`?sx8yS$$_r! z%h0YuDupb|mD~oIfWekY+p-4;`vD1o@pj0=#mjsySTro!+WOYlthR2V*0p$V>-O2v z(o7L^mdnSssGl67d}a1T!KK_h#v$nS9HMKB-9}4BOw?gIj#MY%!+iSuO1X3qS&54FBeP z2<>%ixHa}W1uQ)J2xf{S{uou~L{$fYj_;L54XzJM{w$Br0?V&9u+mAoWj^#$)Q#{3 zwg!)1h9oo^q1M;sNdnGbd9;ofq%RjcFt0gz2w@06K-el05y^4l|-&mjEYU{%l%;qArySS85+ zf>rP^LAWVzH@=SCAF$g7ZKjLNxQ}k`Nx&;HW$2)0lR9Z%l=i%xi%M1{AnZ?#w5UZ< zyZqv7V88L?Pg{Ww)DT5xUO*A!Wm zZ_6v1ARVT6E*OpS=_!#6%vh{Z8}AL_r9<;7HppBL^SszojM^-J(G6og&viW+7$0frh_+}m^#bO!A#o8aF_y=mZgn-F9Xh;Tq{D(Z~APv3h4Iz;KJy(HfvEvU?XW)N;2?!*;RltxX zg81)w0v&=0phpbL|At$@L2IfGRADp-R`lOAO@&{7E>V1zh@1Y zt}C|?vb#UEL4asbI5%X!P=w87y}UjG{C|cVOXT9pq?&nAe^;QZy1X%gLHGlnK%X%s zo+u+jL90K$>Hp{_SzwG<=x8>NcWN0@}{@N0~%J15W2fRND@@;D+$;XZU|KPzfn>L4eM!HER?}N z+m%2S3TlY{M`@P5(Ua(P|C>6Z2+%yBVUYc6Q1fjb%7rm}{(?*}7*S+PBd@k_WvnFQ zW>jd*&Hcn)ma6T6Lh|8!R_Wp?eE4BqxFPK_s1Q?9!EY|%6zR`R^cu2F97MmlAzN#M zwTe=3)~z?LofQb%#V+*85PD~4egWX3PBvG{!60nGA+WscgvjjzzUpcB{62$K-Py~f z@|wCo^6^+ehe@H_+}u9{@q$WpI!Z zrk7NWClr-ogYz-Su4n9=V3T{Bq&mfab5IpQC7n=a6#x{81RA zite*mVsYPaoBnCQ5Dun@aQ8(WRFNR;B))6xQTRsS1~F}XssuqJdhb`9X9t;Upq(+1 z)Os^|aUo-bnJ^y8x7l;V)LpnS_z#!PB^2iNChckG1*Lu|K^bTSwdN(P{KZPFoS)xu z>b0@}Lcb&GG&R1jpSD~7TtotmS*+gEaWeW977*0?ywHO3 zRK+>Daw*C(VEBFYu7A+%l@LD3=SsGlv|YhFWMhiuS>H$Jb5P zBx{#f{2F{W*&*FXDriS%30~%OygN1w^?R93wqKgb+{IKQwy!_RqBpR%x$yf}3H)}@ zKXQ{l7Rot9X<9;m%;8E?u3KRX9+pdyhze4}hAth82fWwI((0j`lBrC1xGRw0)^}*_ zG=R~#;9kYMs;>4NdX$y(oO#k%jrGjGeRMP&HTR=VD5hLY#00UZ_bUaY8FTaWDf0Mp zqnd{l?}Bzn^r|iH5Z{OO9Z6$Kt9Y4sZvZJYwmRdg*H&C#nQ0Z;Z+93eSvGf74YFXu z(#cG+GcVYGP8WWCt{|`d=y0_LeAIC+fTy6oGM} z=yTbR?{qQ{P^LCNCG7a1e<%mc)HTsB8Rd{x*NFCTkb;g=+jYkdUS#)?53#7#tmC^; zSz9d0S>utJEIhyTZKNF&WK4QKWFLn!GC0uN6PxR}w?%|Q>YuS4pelXd2HtO;OLG0>>og=u zqr`JV2qIH#yx(xszw)qk+>eo4oHfrys`vRx4cnb||Fj)R6w~TdCD~E!AjtMT%5qiR zktMvCR4E5x?CR$cPU>p^R^->;6jGr9%0cP6pY;#EO=~N*Z?g)C%6Xoaohs-Y7xcLI zkPW4wpvnmkmgj!|LFAi(yw{J?!~~#)jQl38)XuUTnz*HZ8MIoMZ{jPsN9oaBfTt`wUS$_sPiNm2#|ZwWKp(S*8$-s#9<$*=iV!Sn^ma?thIk~o*=xv z9d$-PNcMo$JT)XT2y9MN(G257kU2DfQSi~{ExH{TJqWTmp!gO}ely)*<+F~XF6=#4 zqQR$(0 z4)Y<;r^(f8)QBHh|KQmH{RF_i#*&uR_ZH+(dpOeiQ3|PPA^mFwWF9|iGqea zNN=g-Msyce{4u-6c~~#4bGP&haoWulmr@>g^eU4JiZgqTJv-#s3)iH38i&ZO&=Ntz zFywi~uuH@_NoCh@9V)iQv3;_Xu$!)1v^x8t+sBCp*}dNAkJ>w4^WOio0LnYbHAVF9 zutKpQ7$L|5x#nmehFS72RJj8oilc%+n}4xS##gXeFV0$ZBGkWu7q1~G7$S7s7H0oj zVqO$dJ9Wh#0@8s5CW8pomrNzXaGZKdIbE`hV4{9+N>0)I(bO@O0hvDCjj!*(rqGg( z;gi%7QsVbC)Y{{t7mq$r*X&({SxwOOi6}%6zI~`S4k(AqW~o z0_2TyRWMsNa1_!k2Rvq`b!a_w4EIEnnDOTxdI&UUlfm}_yXs(EtYGV98S&SI&7${M zLswkN`Av~a3ARb z&&uQ*CpGT^jPN^3F5qDW*SbjrPv7@f@3(%H z#%*b&1p8?2xO0V4Z2W4;B4ixTG&efOu#b$I3<;O^%OLG112;28jH?F;UeU#4U`Q<5x;`a7^-LDfN({$*WHNdvymcE9BFZ{FjEc zVCV&i{O@0P^``?gsczU3O4#^4sTsTy^~tsGlRh_uO7Z^iQq57lyT#!ui{Yj4JCv5O z{L=SXB@f#osZfrYmRR-UZ%3sS!Gz^QHHpU^sO%I zEDQFbrkbP_tQaLO)%^W%@-lh8T4(h{z?INbnev@G zDa`E%w`6Rh^>nlI40EmMNl>U*-_a0c|Jj)fSyK4`uK{I-@piSDG1*6Aw$f~V)h`^H zyaP1aWJF037p744`E!z%<#M9yhQCS)KN63YBs4O2r*8lo*N^1#vLA|65t&t2y)2_1 zf`jPNzOc*C7wQ$T7j6h3Awjk_1k>Y#0Ynqu$Zd_hni1XgYmRH(hYq1X zCn|QYTBjtAU{KXg`sHSl&i&d#6VsCviAf$Hmp8Lz98Xop7vp2-CMmTNT@3Z-B!zHB z{k1YLthJgf>r#LC^fVU@lpzJ=bxWRleTRx<1&J?lgN&lh5{E&94Mv|qx}H{02OA;y00 zO33o#>-x%yw#>1?gwGEmhXz8!-~PIQ{&b*y;IsrKh9tj@X_A9h{Sl6_dLl7?28AKrl4Lo88u0-RR~H#Yz^9 zBW&?eADWQKJ?%nmcV!S3!p+ns;T5unKjq`$4YD|!6B;>#maQfvDEX@m*%*CUQ+VC+ z?jVup+|3}!We9sDARtVzG%t-q&V;J-Ic+Q1MzA$g8C!pU*kFjLf0dw_SH^K38xpC- zlBYbq2$@sH8?~T}G{Or6-QA+Wyn_IQ4hEaKIt{Mc!INQCt*QqG? zHu;*-S@__km@bHV{nVA?YBx(T$Uoe~ZCDpX(Jk?*V@GF%An+ge5Dy|?DDt}B{d2$N zf*=Csm_mA;CJ}7>J)~t;h06+S;m`4aWN7Dfb7~0@WRD8@1^wHUygD(-gK|6IjJQ%& zuX%)XH2O*clO4Nm9-ASc7skZ|w!Y)AP(8*2a6{I!$dR(BDvXrQ==#j~Ma21%{yUA3 znNyBRs1f3J=`9mIdQ$f}N?kt3{#i(t-Ho)2Ym5T##I-rm`>Ds);pH-J$2xQHlfgMh zvDJY|_mYaqWGEc_NCaP^C=Y<0&^zB|7)AdH5OR6C6AU?96K@pcI*NBezv%nfyo?}YDtBC-? zHkiAnbp0zqU4`Wb1bE0BS7bAL_^#77Q8;I=ta|&5=W{eNVShIJrAg`CUiTVLUvLTU zQZAJQIxfYQkGxv7*ECO#Ql{Z9dBS$qDu0`gD{E!8uv}q)?2(|3dYUk`8Q{=E3vR3Q&%azW9X zr*{Jv*EdI)9N+8Ryym~FUd=b~M-;_dp?my7T5% zwHN`(U+0!OUbd!rypJkJ9prIqU~A!;+8HTP3Em~{0!%&N@GBXUStVI*pG4F7CZ5tM zpHC$4S*kJXJSUt`Z7^r=AoVdD$KWt`p^OT1D`h+owL{dt^*6f?wa_Xkr_4VmrE*4# zm4}+T*yu49=5{)<7d&`OByTJ=DR!A$1Z-Y6fkA#3%!Psg5ltXmK4qJ3L!|Fujt^{U zHXWR=-S?!DW2vTjm@+jvqzb!s(n+8m81d$}Fc!Y&t7>G~#^YdwPvlBonZN6_8D9GV z-+xo~+11myawl>8$~JR+kAbiH6gt%8B`&5NqUTcPZu7Ob%yOL#dKBI)RS0N+0U>V-YRPrru+UETgi=XIIua1C{y}xixrFwlr3dMF>;{7|Ti?v#+7wc~ z@my_bMaW6Bz1_K6zkQz3*{@nhj?TvO<8252S!DG_VszulZlvy%;D>WBvowQ`saQ*r zSO!51EIUzP+R{Ujb2>x8Iz%;2Fs59Yobm^}fhVN;4n%3Tmo$tw5!Fq%TXebb_NFqw~fVQ-|n)SM>WUxX~x{_D;cv@tRnR4e{X`K)7HGhhU z3_CYlZ(wORO=~8u_>K(33s#wp!KQ?({W0p9<@<|p<{$7oO%jqUKO4>ytH=I_Kqzq@D)TPBlQb zeNWC)YVad8U!;iJp~)LfS4y4b5|t9FZR*?dg~-(V`#Sr1%$37sIeZ5kG{+j_%9tsB zf_3(CBndW8FZPMRSl}`L5+MUij)eqkOPZdpRwFQ_V%vn4b1sNL?(720j&IWdx1uDG zbcid9M8BHN4Z1n&FjTHjr%=g~@}@reE zonzL+la&;9ntRHxJ_W&MeX7F+v|FfX7hnG~d}-A0Ew|BLPnmyrJQ&_C?J%z!e7 ziU_Od94e;h4f~?5)|2^!cH!s39Q5C#9JMlGEgVY9;A;=2M+UPM>Y9Qs#30C#=AHgy zqq)Hjj`TrEqOAk3f!eT#|9EwiKXG#Obgqd@=?HQb{X|CVXB0Ph*OE3e2%q%6csiGx z5CzYpA`eGU0>h9Jd2bTMJWZc)J34ycR`bDtaDH5EaGLN8HXKBGeBWd9^%s3=L(EKCRIfMIFosHr0?U?1AR`XM%y$Z7>A= z3M~aWxV)_!0?6HSb<%bgZ#4vPXa+WYVDd^|{shDTyoYpbeDt=C+SgL^nDCrLYfUj^ zr71tRJ~3Y4IzP|d-9X-1B- zfEC64-u&qtr#$)cPZ~qR#NN(#b|h)sZqW*Z(`cdY{(F^XO%q{bKPbwO)z7pyDC{UO1tGpvU!t-v!Z@x-3}y9pMhtX^|ZeE z_=K|#3fsH)8IzPpzsgzAR`&7?x8?Q%?L~5u;j+i4fvP*5Ui_Y3#$&se%*eK+4{c6C zk}Ftk-9Z~PE$@5k25(mKY!eO`-ft&B@1K$DWa!&mFcd1=+p>L?v@2S=*bc`}`^28) zLorz+r@&sp?Rp0Prp+Vz%a5K=NE@N&no*vN#CcVL6q8NmL7#DJDR$;7hV-TKQq7Hi zbmntU(SCAUHX<*VIWt+RWV$M)tvQh{YG#m)RSt_m$n3n@;F@-_yr+W`j-i}Mj8GF~ zrW%ar%-L#_uy@VBGDfZC_Ctf)-H~Ib>-4GSK($-AUhXbryM!)aC(sxb_NOJh97d|I`bxM~kntXQc6HGO8n19rY zHBdM2unkfBkz3T=8{fwvf`uXYMJe1|gu{_M8D>j;gYSE6k{c|1(0Kukktm1IfekM&pwmO$<1BGo5xf$c6 zg598P#_se13N3+j>c_}hS0r&9b;V#d?W)n%CfjyKi#hWtgRb5-DRw&Iydv=&ac`S@ zeepl`h{626tw?$3vJ9TPK~f&qh#=6JF#T$roMxEEcCJ{SoCWEJAUu&h{!pyFQ6uZm zvfXpHNR1@*iGSxu)fO!PI|gXQpo_vRj|vp~YE(4Gj%rA)0;~CZ#QZWFHeP3Psua!S zh)eh55AFktM)Fw%6|d}wHsZj_tyCpyO@gr6zl92f*!v?yP;+ohBx;N_BZs@itc#Wk4m*(d7xSt|FXL6 ziO@;dRLu!EFB&YQ8(5$oVool9yC>2w6VLOB$4a8B(gFMw1W@JBnOtfDP{zK71CpSt zV$K8a&^Oygq#-gWN;)FNb(|u;jS88!3yyn_ zeQ|LgdhpO~2rKr_Zqv7&I-++tiUddYuY+!gfvy$TCwL`_SpO2x#W1Fo*KXP*see5f z7}C5Ih;MXneaPee%Rg2Sg8F-H5{>eoODjeW*k9g12)p>NJARMWa@}x1tz}jDQGI+HCNPLYiT~i%gPQ37^1-b_Z`p3w(0XpR zhlS&16Hqh*Et#Y1Rsi{<0v8}W|?lMN=D2HL=!7x3Jc+0r1B)DA#d#LRLW}F64K$o6iMDo^@zPw z@yiuWneM5Rf-b85-C zBpYGhZRbj8%3?jPZvmdU*13cQc^;iv>152Z1Kiu`@oE+tE)4JaEe03 zd|VJTAT5FeO6mXg3+i=rxP?q*$SBS5f%ThTHg-G>A(m_=vVqIPDUZ*Qfd*(=!NzWd z2&-HBGq!$Rvn|gt4+nrYjg*9xKH`OyqgB%j=Z*mivim8H;l-Wdgob5u*2KK=$ffrp zeRT~JluF1c<1n%aw`=+SOgVg;I0}lC*9v@VLy2YFJPbusZN{%oI5#MvptK~0d@nyF zd6BP1PzK7me=#yBT@2ciIEro zJMG$<(W{L;-tI_;M*V5XNR=lfl)xx8Th%-MD=ZQ|F*?a^Yv>oH8gfGMR0e=R&c{=* z#+_Adhd~TKA)n)TM%0#3Yo$m?_kAcamC`W}YP&iuuTR&XU5`HoNx5;&zsAv57DrER zk@vhjUp@%M#lMWWZi%CquqBssV5;vV#Rl-@M=aSds+#a zZ{&>Y^jdss|7%OajpvkqeJ)O~Pg+`v6=VZ-~E21utJ0A>9UHvh8VjWe2f8pRG0$Baz@@}_aJ{`72 zC@DvIh)4#v)tk17RtAk##@M(HfPJZdvY+%IR&|qqa9`16QavL<^A(FNa!x;oLAUW?|*|UD{>n$p&PGr88tAH)w?|4ISO$9#GOipt!>Yf((M2 zYSTFrUeblMG#6HiS7LwO?$D-qR(bg~-LUXO zE4iJ7X0e{Ckg%<1p=7JAE92Tpe@)qFIUNdcqNX1VVJaF z>t;?C(JsJ~-M099l-ZisvL%hCYvQcb!P7)0@tQOa|Kv!kgh;#oZFUat`*f@z9&z@n z{LoM~iZO!`F@I1Mm3QQb$mNl1YSl^5ErRU?4T<+AsENkY;0X=zna=AtOzM-XQ`};? zQpWz6r1>REZ<}tAN9GW?MaJ7=JN$D~0j{HWJ^SK!Jaint^ekNUw|EcP-{h{nmnq{T z7q!}7j%txB@B0VoKRTz?!Aq-rdcc~c179+A+wRCcjr=X_RmmwJLRcrNP}F-xDMx>8 zrGb20f<9=@mwfvD1jvoiTm_L{jYeb63Sn|sCbQj?i^mr+w`1sd;Gb`wF72h`TCbW5 z1_4KU7R|};bG3Zxx623mgBCdJUvhZFRma!~kNTfGf(o27@Hfy=TX(dN#M=9p5u;QH4YH6lTkl`%Ra^*c!Zw)S$c?s70l-hW-MzzAfZH#*TiwPuHK|JR$P zKN_oMRBXxrLXNllnuFSh%V^(;~^3b82DSgF7>w|P@91=`p<1YzPare z?%@A|ofV*7> zdJ=oO`#j40(Y~I&_`A^T-WjiLSm-y*uLQ%V!7N@kXCRfgjEVI zF_5WyB<~km=V}i|&C#OUR@f{=Auz~$LqQqEt^&~t z^Nz(Iy-S+Bg={!Kh}rGTU51*7ZEWlGys!M+OR1Pv@Fjmwj!WO65||0nWkm$F=KfkA zzFb#nz44QXxd91NjM8sC-ZAV49BE&l=!u4$0wQZgAi&P?%Z@6QuR-@Xsr2O{fWMY4 z{T}m$Zh*8Rh4t(cn@&*Rb%^)LHSs*MgDe2Qyn; zP6nfyu+cA-wU^y;nVnJa@F~VsDb>Zq0A~HdQQ*<`z}8-E7VW4V%5z^w!Nnj7In_c9`0l- z@XW5C9!XWk<<*Q88hz99RvV_IZXdj<4>(cv1QD0AcMeA6lFg#qsh)oB;v843U@ zh1zyx@$|h3i)K!ZT53PPdrS-2X^(AlXja0IeCxCWcc4*(OOw1Y5H5~3CMY#65bXD- zVOmVqij`1__NH-&&?tmG)^iS!CTXEboAP0Aw1N&Pg#ALR0sOw+sLH}q7Lg&T^qWpw z{*kDZDXZ4HaK$djj(P!@`7OyCzx{ytyzJDxv_jrKr7oCEsH)ds2gFcU*~z<5T{?Vr(+wZ~g1GOmGK!C6 zpj>vWf#btBhZ`@2=^(d3Q8@YPAetC`glkqeZd1!svUjzOuscD5g)53qJbRamjmn{t z`_B_2jbBz#w|$yUg*45CkN6HWyT!robEYXx{`lgsXyrx7qbL2B&(2l)q!yr)(N&c6zm^EU7h$(A-IEVD~tWFW)1?zSE>~ZRDneSvFx6Gc7@|hgnW3ua zB~s899o7$H`L1Dx? zjC7U-A#u6VE=c|9E+lC}-8r*rxV3s#A#ReNMz)M&AA#0f1E+G>f~~A}xkRmA7dZ){ z9lVb1iEriuDzGsqLzwnjotiDnu*R7&uZaDlEnvpdfb1bf)LA=y9+mWKv03?I)cIBe z+6MJQ`qjXZ7fG89&oG+0UjZ?>E~Q>?`)C1-IsJNrYZ1L9NFjC?y*LiK{9E5C>I}A*&xt>6j&q(Y97osAz~AAq z-uMktz5k|e+t+WhE*A=jnol=qx4ck?H+G02og^U-uf5B|*N$qzS{!cEUy%*EbMLi? zJUSlbAE{nBJw`4c^F(Lxv-e(WuW|nAS+|U2 zIB%*wwhfIwOB!x>_l$aDHf|>*xXw~c@wAlH;Flq4Mb?NEY+$uWgoK!;Yy`i`#KGSQ z7$QBzXdI-A*38$GvrGu1zk}`_+i`j`4V7uD)OxPy3PrDgd)#?#*Fu~nsVlCxD77mt zOD{go|Lrv|A(~1v$N&cLFyXH_Fs*PtVCOPvR67TmwS-g_Fjv3Ln@T3$_%X0sR31Q| z#glm>gIY({xcsviA`ALx8Ho~J!H+Rp1*AgW<>M#=);eac2+THKX~F(#Y=O$h9mW|f zX#qI{-Q0Xpna0$ro?_}`?=!=x$L~Vbvl;Ls6J`~riIT1w^`6SjP{|seCY$qkrUQ>- z7A$8?Y884q&w)F9u)C*-XZ%m9b@8<<4bZ1!JJa4Wjae*1cj}W1{+M>jHAfF7rG%ig zx0cAAIG=imqeoXj+EkX5HN-YIm2V(3uGn1Eo2$Yo$LPfP-79{_yA)56#z^!%HAE*) zdY@>~frKV%Xy+qT$Q$KFNs7##NfrQ6?$l0kwyMk+mi%~hJ9Q-u9_7|!@+p&=>t^Si z{}-W?mcyCKo8giED3<2(A*wpSnk*)Qi!4->m|Z6J#ke^po`SJdn?7}u=?Q93VDfbR zbxL;5?#ihbksM+e0d7T*pjnZDM7)}1g4ZWHfcJ~1W!}0@P|Y%t^(|wA(jT9+6#m1K z%U0-4xN>WEim21~CY4#wSQVuC5+rzLc9t!afU@ITJ&h>Y9%Z&tbz z{AD#(fmxSILanQeOaiu=R9fdq=g#khp6Ws(b~SFg@g1PDSe8vV z3`?Lf#wI?b*p~=jb_W+DEx*HO4u;)12IZ_c^v)tXb32p*Ch;b$&TvOWK035MF7q+Q~jy7IDAv7M#~qA@wf;ibtoAoP6PiF6+fvGucHIqLXZXwmXw! zK~_5=AtjaY&0u$d5{ZSQOWRnSYi-KFkaND|nOm{fv#<#u+fc{E>JrjAbPC!@r#1Aa zy<-*i9kKJ-l~bomNjw^Nnw~tnFWRikj2E9*gU7k;P2D_{!&%Kz6-Rg^Q1ygiMgj12 zQb@=y(X0{;%AD?eU>7>cxYnM<3CjIfnX>!L?BuHOkC@$Qje_XXJU^SKhNf9Ox%sH2 z!xEj_aD(8!pbJoTUD`=%TFQT*Wxr?Wf!-1OHS$H)T~gIZ!Dpa1RM!FKtpL2C6jmX9 zYKMlR+{eyAdn6mPmkp(Rm3=;fV#mRQbETjX{c7ocZ!79;rVGCAkI+I-Oe#}dLSKyNvC-I&N3;4(e>kB6wGAU0zaPU4NSU5oY)KX+wMBkxG=NtZ z{~__KWbLKSqc;r^WPPE(1iL`I?xPh-{S*?5&ET?;5K?{ULd!@O!;Fi{Ptlm{A3%_m zbvO_PcBi0!J3K$E)U*3^JWTaCz|PTE`_O{Tex3Ou#)ruflG5H)iTQz~JWy@_qYX(Z zZ&_4{%a>2?68`8~=(-^^el_y_ZR=a7>_JHToz2hMerI`Rj9saoCZwcw&R^^ZUn{W< z@V7G93CSD-j|$1)ZB(R6dif%i z4U=dRH**5|W09AiPzg*9^>)nUOY#6RFBX#DNJt+de-tW0jh!T4eephO`!%2d&VC$Mj>Ur6OUbU5O5wVq-i?AM4Rn-<38bXe zdykoMcu90}Tstjg9@kO|!!$6c6)N|y^lv82;hC1@6}U<~iuI0otJ2Mh5>cGRDg;aS zf{93jtI+!s;l9^RX@n3HAs8!-3AO?*Vq(8u$BaNg<95+<#+1%2aWREQMV>F%f{gxL ze3O3;`4S?%E8tTg74YHMUS{q|{CqjOC3AjMn#hiSYw; zBcdCE^6|Q%#^rD=*Ohh+W5a$2F`*!&F4uV+0oh1rux($#Ge2KPbRLh2zCC~F+GdU_Uy7d(r^xRP}bCPaA zlvQ0NT%V_7*^0b^uMI4nd{GuOh`(B+m$qz8B?CzvF^9gffa!oF`nU3;Z#OOInI)EbvwIdY zm6F>2B;^WO)Lqjf;;Tf6<~#X)4oF=604{`ryA=Bga@~X>i)*}0Sh%nQm4*TT4{fJX zzOLM;^G?Yofn~!ob4H=8u;qKT?nnE=J7IohbWgHG7ePyK%k;>oJ5Fx><~8w)(0VL) z(VeZ(M^9n^fctG@43Vh!C?E5b^(3*<(1pcXtFkgrMU+JsQID<>(U8bi-60#mdp7h#S+^eYHzEBOmz*#vO{AN3UM>BWQVDk62$e zMsY->{kBA?8qLYHyNA79CENR5mkqpJIc<>+*hjROW7BMHVat3MtjtzgmAm-X`Qjb; z8oJD8?Ux$l-IQfb(ExmfCzr}-Qe2ypd(u4aY*XxKt|*ECn+RxKOyWEJ^{ZeWjQA7! z%@JupiQ?|*_f26iQ@(L;G_mrj0^bH*qqo?meAXom*BTj?9YXn3b3_Z~8o+V01upb7 z$Tu`cdK>ev=%`ne(V8EXyg)=5ge{4JNr&r>X08?+nMU^mzA?k~gOTgD=bioNQ4lIE zo61=4QNH~52b|@ zs&<;0nCo!q5fxleiBKST6$XgR@~Jo_2!;!u_h7;>B7%Zl>&t>>4d#z0#^wagcwG{7 zSR2ATUMI@+^7@-RV^6aAE7iCx4M;Im$}Do~gsy$vTuir6ndg&c4n)_{XDaztsJ2Ak z{SbbDltsGpp0Dr3TO%drxv7v_epu{Wvz2ZiYwI?zYjUiC8&ck}0R-)m>)$|~{|H2D zDh+eFA<6l!40YemFuvH@Iu+{qW6^$PSpRf8BASpU0t8UPM%xm<+}7jTaPD9KHasz+*UjhjWLG^S%XvGJ_;4jhxbX=6*p&uAln2(@;ubJ$=rbWU}VnMO^-7srj z=K1(rARU1(ib;Pu!p&BQ;b>scTu8mO*3f=EmOSTyH2rrKb;KYL2tVNQ-PPXW$=}Cde9%jzEmIKS42G%&IAJDz46=24<+V{(xJLjlt3^*$g7r z$zs-_@KR_c{5;KKI9CB31M)+pFUKXq5bBgk^^PN zf&T{D7;J&-imDs)t0{g$B6hYog}HL`y(AR=voE%UYJpvOPqLqI=7beF1EFIutd{_t zG;?2VeL&ClBsYMGk}Lg&&~`QPbD!uyY)rf%Da&%5sNi8!bU|$P$WO$vvUWA} z!@?c4C1yFoP>vw0g=PE2+t)tcUp=8F3esq0;Vo;}wA@N}if}moWk+LnLzJsT;y#4N zP)Y(LWQE9G+d{l^Uc??xv5XZu@96XSSH!3yp?Z?i0eoOy)gwp`ACEgn$9ffgiEWgA zo-#o^fEbb1Gn;L@N-x%wl-7+eC_a^UTT-$nNnZ27VAnK+Zo`R01X8y5I)LM&1;#n$iUFGyDRWF>aoI3QJQ8HU1otd~ z#uwxj!tGg#^|*`*BUofEP$2gu48cSnI(61;3rOSOwXq1y_&j9MeMF7;v$gmMR|8M2 z!9M$QI65PSPAZgM_6YLO9KX4|i&#Tg;Z8ROU`lnO_wLg!`c^`zyYg1k<@ku| zgl0VzF$@eHx{AOE@(#IU3n(8jKidh1Us+3n@&j0-kw+gMAVHSjMVX=!To+O+$kj%B zM79EGPmw@2V-SjAAT>&keTF4{>}2faaV?|Le7kTF?#_$-W?SK0tU|COnXG?K z^ii}U5cL2ba_t;5GxaDTbJ~-#vtEW$!{P)jmr(Z1NBcaE31 z;@XDW9_BuVqqQjdlQuXBqB>wvr3jtUF?+sAR%{RqIJ$Yl$(PcFPx*F?f1*tmrl1?p zsVfVSCPdSH)k#ge;RwUm!w@n@oq3Cq)zENDJIDDd+%6$f>ZBZ$=bs#=k-&5PBgcGN% z^+;P@*_0f4Srx{@nnFS%q5>|37XMCVVOpdbXI3i*K1LkRJo%-oI{G<@kDtGRaYwQu zIC{j_DVQO8v|LVJmdrx70ynco5HPf0&Doby=Q_6FxwVlbgEHkGR*e#~wogm;1abq$ zbj@3^wDe%V32HqgKj*$jXgg3Ad!?)m{$3AU%M5Ou`XFRcSQ{sNJ!YcfF;5JeyKs|({&$Vj z=l^hs2)@sb|G)_Yg35@xb!t9dpdq}6p1_ld-*E`3T_J|Q|AKtLpL_@S=c5Qd{&&RJ z@V#~$f_wKb%i;g06M!r`WI31>5_sBv6z|GQ4MT=>ANKYyilLgOmy|bR=YS#}Xei{I zQU(mO@=}_L>Sd%>xzxfjyNR@4=14;!fpx>Xia%+nrfo6}|2BmD#oz;3#cxqUN1B{6 zhUBlI5SReNKTQRuRGCbtE82lxD3ShTkxOk@6)T3IPB&<&|06!o222A`7M*6UGNu(> z20@N;{a9F`O+K=mUD2lnmTeD_XrEih53Q0Wpts`0Djmgc!ZNEU{~v7#ZakiJ@{a^P zQL3@3dlE^T=`O4bwt@D9;<_!n52v3#7QcDN4+(KXb7lkbc%av1XRKxSG3!jD&R@xR z#h6NgeVTHc)1yPanW1%k7fNW`sWUyUI3!%y!VZ%cweLb3VhUxWDSzC-O1S{acNsl6 z#t(7vn-b`f&6doPbzuSLCk8pVf&rs0WI1hZbo^-|(zQ;~>(nh@seT;n49B`wN}1)6 zYhg<=*);v>f^h;m>!D5}zu5iK>{r@Y%FzF(N<*27Ybxw8DBJ;Bz6z1Q_djd%@!sfu5*$7FpFL8C0dc}=D8g_5OilS6C-nQ& z`>)*u;4*Vo1B?FGCNCAxVbSOU*ZbGv2vCTih1&1k2l->rS?{P<*(NCczZMPO*(+## zyZ^{LlQ6zY$pDUfM>9g=Sr|bwf8(h+hQnRm`oXb0`jR5<=hozQSRoc`Ql^871`3ec zzdfl`2V1Yhc4tU?(fC%W7mBm=0jF4n+|Q-0h->aTO5zJgqxhN>Oi>}f5KId=cm-mB zqZ<=V0393>TNXXIXR&bkd83gE*a5WSC6ig7U^jJ;o!jLm(%*@Sfuc5bi}lclFD=?F z_jc2A*(Vjw5M|U{G)M=0CZ)}=BNTuf>gTdeX7`iHfE&4BTNbN&bCE@{MH{&!#R+^u ziM7CKtW&_8eebF-4j=x&b+On2P-t}QH4aCQ3TU=*aPMpbx*xvV=C34v9O!+2YL*MV z=^JNX-lBDlPAK=Bz@ZqoUir0#H->iiOwXpGRmt=7puY$;q9E>QdR%br<5umI?+19n zDecc3#vYz0<(L4b+gM$%lNJ@}q)Z|+GdFHgjUJ;(XaZ*rqa>mrD}D#=-C>(+tw{>`&q9o{^tcu`}-{&xa!&OB6ZOwoI_U45pJkNVPi42=kxEwWLtO|IjlvM+FftH+;S0B0eg^qx-K zM{D89&=>1?DMEW)eX-l(@-Kw2MD)~Lbe~bGWp2RLJ|}Zgt_xWkBq-6zu!RKB0x##{ ziZWK`B_I)WRn7MDRY(r~igc_i`NP>#2>Y|dobqI_p>&-o1{J}KWR5B`6hJ=BYNDJ* z^~Ed8ARdk4&r=GD;LSfI*~#LNJZuUd(*#XJZ?I2YSys~ZV#8lKo)`lHK5UF*fhk5y z*ZMy(lk|xQXTo~w**JL`>6zX+E8JUSJ%PwOR%O2!@r~J*)*4;$KiL84G(_&+x48|@ zjB}c#G8HC*-LYHEnMyOzU&zQTTvWTidHB7w%%T?tnL<;p>k z7pnTgwrXnR0{Xs^7LCB{u*XX#BRvb}@T3CcE8^+gEXao##UbLTJJQ!BwrTwA&NcwYObSPFu1HY+fKDd-PDg9Z;vOx6xzmxOv%7GE9(S zcXMFHMSuB_UAbYaX7GD)XS5xl-oj&+vJQ#0izY8YLthvl5{l(b5b^G=0J{PJQ#NuN zdY#Ma-gn?BNup&*aGqGAJTJZXF*a%ql}xXzYmGR3SK7!$ch@pIq@16q!AePAVlXzm zx*9YhoN-f1ix_n0x-g!lr!^xjUy$4(f*z?~1CQjyoeKWxBF%su2`NIivNw^Rzx1fX z#UW{Zs3&8KRC1#CT~@=L{*IkUg{6}56$gE(N*>v91O#MdTKV?%;rJvC$yFp{M@=(%Ci=_5oiPdkr;Oe z!+M-oU_cZxc*xc6B6k2zQgC5o!V(Hg`&cSt;G!c~^gxH~QDZ+ceR}uQH$v6iM)Nqp z#56hM_|)nVT^h`wYcs)PY0awXCk9&5xM?KVZNA0ST0A(`#E;<;hEuNwp0o)8+z(C# zd_J2+Ob(0EnYzuj4oOK936BpEmefYKO-4H;Pnp$scdFTnjID2|+lwgIW<{(ur?G!r za@Q@#nPRP3YCSM&6Ib2A#eolAAHvhTD1CJ^6C}R4=H>6l4wZMpK4$Q5-5T2)N^&xy zBA~fh2V}3Vb9rPL8rp)-o{yJ9MM8#c+2o}{#d4Gq`nij-?p%z?y7Tz)W0lZ+hjjk4 z6d;2-IoI#cr<^;U((hWI((#@Q1>-DiCt!Z303{K8?QjM zzCJ#g(58MnCK+DE89xS3Snz1eEd5;Jq7bWs{Z}v;cy1|zFA2^#RSfmHhdjnSd`r${ z=YMPnpU!23Madbe)b#89tvWtmzkmKv=||r&2et|U`~OizHUYr5RvY@F9QogO$_Xu~ zCHDAl?lN>4EL4G<1qcEkmyPt-Nysf%xHL|dMsXJqH4{NYw^~~qp`oKLIO$6V) zjMY}$wqLp zi6uL_H)N($vAnDWMr9YYW;p*ecm+^C`5=Fcm87zP7=^ddpOh-rZV8x(10q}r-Heq|{m z&PL}>`rk6aeiG3iK48s=Ry!CH`=$_Gf$#_LC^FO{bBW_92#Z*gFKLA$67%5<57EPk z9>aXlxWm@|sf~&5q%_Fjai1r@f=v;}Ont^6OGt;H3hHYSbcJL{9TV>sOfiA{h%)b) zNxHH?3dh}a`pdysoa||gYGB_(tornb)l;yg__JfH38s{ZUY}MhS&XYds4c4k(+6mM zIuGO_KytfEMfxU%S!7e2K|#mO_=+NcHADp@k!fk`Z`*yw%R%Yj` zD09Yl{cPU`O88`fcm}9er&c91L4N8+6Hc*0dE#0de4OfKs%JTgX&QxU5wt6kB+}*V zswr%XK^j>JF`y%&b^h|fYTNyUu^S$^&D{_In@sergqRSDH>`2vMRWltqo0@<88@`8 zX-_j~o+bvINqvV7xR?W0RRAKDPsI&MV^EV{kBKeFTp;SS;hb~OQ19@gPoQk-SioGE zl-7_M>$mm6oBA=_Lz#dkuN=yIrG6$JCPUAPXm6UA=Fsg|s*^x;Prn^@4bec>Z?rr+#p`21G7CEhVA6DE-bz2@8bxlmR|B z)`topLpYATrL`RDh4eR|xV+K-UCnF>%EF{|-Qs}{>is47_ub?2^}_88SupN@B(gjx zi*sP7ZXoRc`NMbLfgUyYhe*Bua(*g^ChJBw%jOlQlx&m#@!x%T@1S(%SGe;x|FxY3 z0d&+cZO;EEYIX-zI&tmwxUlYayuhPX(iQn~Y0VNnyFVcC??$PSyzPgEGY|9Dua}XQ z?b1;Q|44TbL{Y|WODC`Ar)MvHn5fwpUr(MfFNEd(+q-GOQk>b)`wF~IMXbNw?Hh+_ zzm7$!^bwXk?+2}W9gk_>^WUgZ28T2=w6ngqu>unT-)={~-Cgk0yM|e?V%)G0`C46rqW>G98q{vmy1K9d{>Er(5<@Ed zxkutjdEJl9SK_5ny5U_``B7`{TjO;P^H9PwK>oyYIH&`9t8UHqS>2PGZC?iF0>HRP)n zd41+(31KTP9c|S%z`C42R;Qx{oCZL(@3q*OhQ*hS5rvVoa2e*y8PMMv*51FQ96S4g zvk+zxlKjo`=RUXmqX=gK&t>>TlaOvK?$cX9#TVSsAg}()f#7I}e|8K&bQ!?H<9Yn; z+;Now{PV|i**R^{Rt#A3JBMbvB5koW9(b;j-?H2*KKlM%>G7v0Yxw8m&R!E6PkotB zkR6wO*iNAg#`CE?r#z-!Cm-FtE?TFK=&U-n$hI*58Dc+v<+`PEiCk*h{I|!{%&FAU zLMV6T0khDLD*sv?!Jo8n>$oYircvlrzkIFHe%$@0A;Cuu_Fo&kKAp!E9dwNojjm8| z2cMbw{&>eA|9x*`EiT0e`#-ZL0!FUCMTO`p_LpuPJm@PuAkg*S=JR*-4iK~Q>Dzc} zzEV%i7gil=+Y=!#`}_cx{U-C7N@h(+?3zQK>mw+zBdzmPt3{6R@RIC*vJ7=oaurGG z@R`!oeeLaK@~NdwZvic94P4HBy9}yv<00#=*`+f-Dfkj8Qjvr@t;YF!Uoo5}Yf6mq%%bi)RI*+vqNlX!@X~DxMbh%wRh{7rX8YALBvG6D9LD}`n(5LOG@A3{dwq*_@#*-9#OY}E9J9;jX zGms16brdZO?X zrkrwR0J;*ghZ*=5Rb}chjs%f+VX3BrIl{Rk$P?oWlfYcvB0d;{)z143x|iDGB(Z#zS4R;aosM%eCKF9Y)SJQQ0r_4sCAZN3?0vUdk5JMs6O0F)`U@< zF_w@r{Y%J{+Ld}-ie1Om!g^wGEiP~|leYy%5pJV{Q3I~_$r9Xjz<@@wDbv`>G?O$YOw zQ4Yp@;b9a#h#l-5e4%n_RT~#O;%QQXQOQKnLk-~|vbFGW(!ZD7le-1rpc%9u`1!rMlrdE~ZYq6Yaq(;qKCry1wjt}`);i>mHPdAifLOfL?x38$)= zpEmNEyU%gWS65tWPzJR6DGtfdn&cZZ>j$2^wzw-fx)pYtSX7evFvYd~UY2C(iA$MX zX`z?)XSiHsB3SW@sawhy%f(cd&#W!PVN$=+OMR=a99$8eFlpxK2*(ztT4GQSt^EFi4uQ|PTK2}IN=kUI2U0|0>c+}FX#HF~8c+aM;oU9&$%LNU-ViLnHe(2S* z7H52;oEh0YZWAYQ5^Y~wR;A8ZE8vosy`}e(2iaT%XY4T8vO6!1-8=bc$)o)fKqdnK zYtqEINJR8v3flop=S&g6`^eX;9cbBGQl4ywv*eS`QCVw6_3H_h$)#HO+xAYTG+b6@ zkeJ23K&=A_ASORgjxjA;7R;2w=cz9f*IA|m4e742)Rbr&@)YguVD7l8H-F;NZKFuH zSzdrf!@Rq5<%e_pg@6%muTwSYV+WHgXMFDp!o*L zGO1h@2RE&xDqoWN@6n%_D_!>S3YYoqjmTU4{hAxf+Dh-ax}T6s0{ytA$?fK#OIz4T?#_;_$Vk-&B$=cY-b;>D zBk51%M+B#lU8ve7X_}W+taO_8WitihQj%X_?5F`eZI@^>ju?`I_ zfj!)?zS1A58nb&OaGW4dDM{ycUhH9jt{lSVlv;=f&r^RMb`cRD#Dp*F&)Z+hdYzC= z&{Qk0{#*Vy#jJ+Wd(YI#^N2y;{{++aS)`hSoYTp*lyYy7XDIv9Va&KD)n6c<0AWi0 zYO!@wx5<{>T_12veLFp9tNNwjXG+AprbJV{rMfk_j|WZtQu5DlDdvnO zh%hP%Jb9$7$P0%^aBjMC3)MyV5G>^xxe3K09h5Ywf~~qF*U@?F-%-w8$B-Tp7@=~$xS&-q0`4>2Ays3Hs zBpwALknBJY9R&f_ER+Q-jA+=i1ZDMNyn<&~1PeLSfDk@8H@xYMkm9vNHfTJ1T*|s! zqD40n8ypHyw^Q9b+9KfHLUy7Dob{9pO3eh5LS!SWgBc72H9UCCd=KQh^97;fX^MQU z1v80dOPwy~r z^Nf;D^tA6^UnoF4lWC+w%RZ zXBuWe1TnX*NoVp9Lu>#>P$cW>=!M%cWz*>$DvbS2o*s_2t8lMFcU#eCk>8Z#Pd>>djN+%4@fD&jKpxmeZDN<& zeY;kyjiVU2+i8xcB`vj$v~XSeQW$_3kL5tfY5sZ7A@K-ZoIURotR+mY%q95R2^T&X zsJRd@-F{@XfX$e-`*S|rrLCltlEV)K$Zv#XTQ*s#LADn$f&+qoRWr(rtM}y*s_+x8 z6ChK$&`8#BNR3bq&8Zbh zCU918M;T2_+k-)G_yD>OTR*$6zIeJt3#CmHP9-9TD}Pbd4zDV?42T<8Q3e($0yR4p zwziO<9D;cJ)#);y#Row8(Qfa5XmG?JUbwZXc9sF@d)`28BRkbPZ-kFyX$j%&X(qML zuGQ=;oabhQ0Bh>cw*dGHx0Yk`E@D+=6Rn_$ur;X@`V?faNe}>YRyG8sKW<7CZVe+qe!9$xNS$ zykFDwTA&pW#z>1x4T=G0Je3ZBi6H3&u=gGt;!jukq(df0OMHjg7nxQH==$)f_n1VL zBe5idA=we-7JpvSzT`>9N?vjH9;5CI32>vs&zE;$X63v|-E%&DwWw`H!}}y*;e0$f z37mTxmy1u_h0)oKC3r9dY|~Y}giDKGH|j!8PA)dJW`Y-vKlqK5iQo@xolqSHzzDSh z-m=u;iD&Mv^l}n`nogh)+c(WDh^9!6^o~-(XC%ACbepBw!EY5i=_a+d!Yru3JD@az zfR-T)Cfx+WDKcJd+Wx}bzDdykFv9vHI=EYtB6y*t{nyCF`xH)r%sYm&Os9e^Rxk8> zEeq5G6;z0V380}A5f=N-p-=h*Ti3-E3dMAK5h@xW@VOYEDz$`L0sauLXHcL}nUzGS zZC1>{#j+M`ZRrYZw@wMNYax_(rEa|rCa9YQ;={6vze^jI0u~kx)b@>)!wqjEET0ZK z&Nvn*ckh2I5z+?)dmKIsDI4@}7L>~dsDkOWiTe5Gzd&&Ym?d4S#q{O+Zz*>Ifj7@h z)YWvi>!n~ket#aeOY0UY$h3N#4`!G%$BZR?gfsz|sjtke4B4=QsvtL4y_J`0sl% z^s?$}F4J`5#NCN8%giBhJg4T2v{E8P9*g5^i=VPra`H?N{j%gg1?P=7p*WxqhEu

ZKmvk_Mc8wN;^9ZJ zISJP;pIu}2#Cp%G^BFP^wLjCsnxv_|X((8drs#&Jz+tco?duO00VA9|pQs$1nV63| z4^@}ouBeH{QU}b#CP*3N`E`9aw%_xb4_HJ2QF)j&^xtRz>o;zYvy&#DMXl(F!Z&)k z_Z}RN?a!l%=Pc&r$!~S)5ZSdpspLx3<|x@eQjFaQ)SVf3GQVqoVVJjh{CWgL`Zax~ zB-G?d9fJ>?eH%5NxIR`E&>G4}?EDks@Sp`}EKaJrFKr%S(+;93#Qc~&D6f~%4Lg7| zFuSh;rfof@u9jXWyOCp~`uAcIpJ;Dp^x=;&|(Y_}T{oDmd#z6%kPF`hx5u1(7OdBaK zBIkkxg?-=0Z)sv3DcqQfQXn`j4VHWK1;52O!PYevJ-v)l&^h8?jsV1|yS zjlnS=RlL!&I91w((%xrkz@}-;6re5T~V1~x$@fIivQ1F8xV#;VPY*rby1w+XIJRk+hJ{s^ROW(AKKmH@-YKO$s)0~Hmsd{%=~gG*;7FN4T=_0RVgGs=kl3*^qWanOP{w>X`b$}) zDO^nT7{^(Pxq>dbbuB$}5y17>Pq7fSPS~;}Q!C#NqumHac0NlxN z68$Q_1dal3vJQ2;iNo4XFvY=g8d#zMa_FrqWzuu;<-$h|S2+b1nmA>5qsuOIWy1WC z!!18 zS_RrNr-Qd;OdpB!fqdO;>*>nEpYUF%Q%)^Q6;$|1a~w;Sl7EytRZS#`uj~J7z5Wqm zxjE0p?cxaTR8SUZo|6v#*LF&D`Zo%B{4fZr+@S1m#@aA|SIXbLFM}GCaV5z=<57%Y znfS_L4$CN>N+aP~v3p! zhfk~h_RLri_O9dUSBzktI(gpa6278sHp$UbcE*DQ^7Wsj8e%Cj>yQOZX%67<~oHN-z;D$6DU6>Go5 z4|3bgNs2N~ADRM(DnAq#S)y>9W#r{Rw>Kl46Qb5*Bz7}lAD)_f|Hiyv)H+2uVJ#?C zE)EP$d;zMnbrzJtzTqWgMR`Y472+eLh}Npmp1F%=miY!hu2@iMpLRyVS-L5s0ATXk)9;1TR+c$g1S4kU3k*^_{$$$c)P(Tyi-8CYxXtFiFM-dX z5PT^=s}N4gm+#Uhh(B=f*7vWZ5Yg;b$v|80cWGA0 z_-MvouT?#y#f1IL^WssP=D<>+1%+9J`xBZp7=zLnau&nNmt**90bySZJrqc=1i?*X zU~0ePI**QK2y6+6q^KeSA|;egz4u)EITS> zlS=4NkMD;W358qNk;LbOH3$b=;u8QcUh#=F(ZyP^qKC1?PyO2}0$KHp?o(mAJ^QVL zPZJ_t~ysJ_@U5>j6-+!oZSG`|2@K~>A@>6RFx6f8ZQ zUe*`)J;4h=&ysIOe8Z#!!^%TNq%`QDwLoo9ZL%wyfw}fNSegMktb}Yp0lyOZkMmzY zj??!Wx=h*_=vVs@C#Aa8AgBM9m+S@iOhGktoY2H1BLY;Inek9EB#}$;QqUlIvQL?e znFv0Zfw?I-;#zB@ry^I}2}~tU4q5oyG@=E$v=x5<_g1h@#oN$}p8U*5(D(s#>^(Vo zIaJ~BS;s;*a-tFFSoa=F;hbZedRrh{PG+j&YYYo878w4dBg3Te&aj9WgKJGm#jUtI z{UsrKRLIzF>On|w`?!u_c|A^xYLG$+3<8O0zKHQ=eFEl(>2U0TLTw{KJmGU_O9Z{g zN}ZE@Q(jSlqFf*soySC6uWz^G2h0(~BRlkrqqvu78}a^&yQ_uInZ0qBkY>Q=JN(V$75*3ruw3D?n`NALF<1K|bi5^QJ~e z(@H!|rW8Lw=HIp5$49G0t0k+cG#O{;Mb8BJF@rc$_`F_(Gj(aIvon zHVI!NYzVaJ{IgE@2Nxvp$(^Nc7%p!vy<=7e7s5Q+Jcx8Y`rd*~rvPZg3?IIJtHZ9| zDPr3_uFE=HBBuRWS%$o9Tfi^|eR&pDu@DPCKi-8YyWT&vn$(k_ZW7ovnv=`6xqfJ z@j?;j@@9GhZ>+7(g9PBu(DCwYuwA*cnm@Qe6;;97NXFG5I2~??$?*o=G$_VqZg&4h zIuy}l`r>Cn0pGcVq(2-oWg;TFN_%Eng7@G?fk#d9-7>X18GATEaI&ILn|t+5ua5>?@>N^9gi;Oo)0w)g3aoyCEIX*5ptun)WN#uEMR;60UOD!NhAn_}#Yn=oFv33Tn{Hxr`;6jQb$-_ZG~rLPvh_J6 zFI^{P!>-tu?>zCF$H`cm=>~WhalRl>KAoKigF0@IMv@dL%%l-C$*(%rb|tj=J1ot_ zR6aF-``g2xMU}sBv3I$GDk9oEu|ERg*KRJ7*)P!&4euF{w%O56)4sf)d((cs?MpbW zv*_r=vy9B~dG)9>&xl~Rto@nSb+rq+BAg1 z_K~7D%0kHp7(Ng%UJ$TmVf<4~YY1?1`q7i*;rb?9w)Pln;VDG^L(UQQyxgf2o(Ejw z(3?DTvMb4C0aiGyawcgytX=-iTxyOt&L!2A_1_Z!w#G8|uXEw&G zC}vz`F|e`^EkpaRAb<(QCVY^|qzMneRXL zibusR05N1H)?_<0}vpfrhAb-Uv}|Gg;O>^(zNZEpr+1)zu}lVc6vOa#5w$fMR{J# zKygK%itwC6fN=m$P=om@Lgs>3zzci%jm;CA$NtXbuL(wF@EYf{=4bN%7`pEh3Jn{^ z<)5d|pJ?riUM;}r{W4PTLSNasx;olvgfN#^EGz&NU;YN?%s>B4(}xIXcnBcAxQM@~ zH&5hZyngH354smWg{g{u#i5KXIcw135~?YEQrl44qc9xipw=JtQbH0}8@UK;K&Q(D zAC_}*vACV*b~F1mzAsjuF^Nc`$4yJe1^Cj?<*ty7rh9tEc{Q1j?fu`gm(FsjNF=PI zDQaJ`fcWGP@MF;IU{V_!ty{^G<2QfQ`STHs1mV=DAz^OSP3rF!sQ1^DefQL;VB%G* z4>sSR*dgouIkvbLNFi_3imRJuc6a29_@b)c8g~EM%CH6dvnFkD!KRI92|tOI z*w@hM9nB{_N@ZGw*XTEa%+d1$6Q95l6N9odprfAMkWvKObCcRUZHXsuAFAri>Hq!( z_x`|QpbWmYT_62=^}1oyY`Y%XOJ|IvI!dd62Yx`GeUHBfJcaSg z4)clx+Su_pPkvSnCc5PXz7%Q0DVm8My!^HVVF@R7NWEr%v)CE3UAm{?Xr)hw#9sF4 zghCYMT#yhYw2nS<WVm+qh^SEytgTP5Oc1qC{Ev6>$v}WBuYBvK?Eo zOSEWWo~hl#)+%J;ZlkCe&hMywB%f3Ax#s1fzi(hJz&&i`u|`K_bk8}?86~c}am5bdDqZ5-tWb)mMstvNAGU`^0dWOOrLMK#^F*`XtIAC0puf64LtlbRU8I0c85$3X;* z6kXv*Q2ej*U>sL&IEsAB8f0@;Q57nWs3%I3)^W?VYkAu0)?OM98f7!D@*fYs_rlm- zlN%+L6^QHgvOj^|#SaUZT6?x7*9#Jxh@#dQY${nT?%*Fs&mdv|vTNXvkJmkuOO*s84 zAO)RKeq&Bhsf4w)tYBud7&8Rqi;ge_888o>2a3cBt~yY{ri^{FK!W7V6XRc|+*ik% z`H9`pd|&>u+oi!slL@-J-FS48j1liXBN~QHTu>Qm)2T&*54Sgef27T`pcbbeTIN&B zxq_!L-(@KAMMk};5E3}+(_o>{Y{>kvi*)+!>q*b`)Oi=pcXFJ_tOl9xZ(FE`7O|eq zO7T@vEHbCl>*6C%qFzn(CaSA6^K2f^j|@@*)*4|^Nd)XRU*;}zRD~D-^}*Q9q0vY@ zxdl~6hBb^M5!8mZ_&g{Nl|x?#WlPQ>`yB7^v=t!@c9qc@o1@^3>KR1f{A$r}{kQ42 z){^uhbHs%HpQf$?Dyppu%P>+RjC3O@2+}oxGNg1!D9s}tjFi%iNGmeMwf6~pL&HRvmQaT~@GhUWb}gw)Z}Si`(7~pVjy9z~aF^I{HR5j)v=bAD zf$ey?Q7=nEJ2=prqE*m8eOYWN8S#E`WG#`~`OMJ|C^cQapsjWdNdkKv4p^U*RoH3A z3r#0d(3gAErE4~9SklaEBSjb9={B5cH|~KzhAy(&d+CMWXu3y-Fi5hs#l6@C=w1@6 z*m{D10L0({=mqA$8$Pmh$Cp{kV z71b9G{m`jtC$x*}O39R)L_H(pi-wzjqFmP^m`C0JEYxGlO~c?S@-rgyd>tTYE|b(F z_I(b!c45rmSZ?mBgGg8h+eE7OzP)gI3P&+5`s0i?(#^p!&yD7<<%&fIm^eVRSGT*N ztm z?h)0HW2bHv)I*b=nRB;oztc*TQvYkciR8KGHrL($o zV9sIVDVHO&hQNEAP+f-xT5~V1#Bs0y571#&)cVH(=S&d7D`Jt1pB*Ik zB%L|@<^{zC$%FzJ(@fzVbt9Lo2ru9yyAze&@yUPh=^a*f`J;_+;*R>r?SKbl>v(lt z?2r;5vL~g$`@PD#5d8J3_puH81wP|9QGPzK^)r{ z$3x@T*_Q&H`>hhSl-ITH1#L4~@-PuB+k%wIE(P2mDdN5{o=rtlei7v^B#Pnz`t3Xk z|8-GGDfpFAHT6r0{#V4S)dx{rMgOg!Cg9n8&i}nGNRWD41nYGK#Qz_GIN_?Ukh@%A z?-&WICa}fnVt1ydzT;i%f`<@*UXY$1qeDF?$JakfBe;2B?C|2J7mjx$ESWRus{j+f z3{LzzOP|n>R2_$aSS{XFP5cs)C&UjWE}yX_{dJ@$Y(k)}rFR#$I2i2kp$m+oRn)mI zobMIB>I5JTz_rT8s8=TT&wkQ}!rH|rF0&5290JY}9_Gp9RUUW4cVFhy=iTEe>Jhpc4@L{UH9g7-~m)d{cK6!wT4f~|hG zmOZ|YeZ%&ResghM5{-XYL z>$69k6w%k}7tsbH$7r2>Np+`cO#Q(jSWK`x_&S+@*pQGU&2B`!AKE&&UpzYkC8?&1 zx+29QKwzu=f~+J$8A7LgrE0tV(__C9{!lDxZ_SnY{F}i&C4gm4NLc#BF`Dy$4 znXtm~PGX49{45OS&Z#-Vv3t-Yrbv3-Rrmmw1C!axeAUF)7hXYF2!<~bV(|5as|As3 zmH4jDd+=Z3;<>^-t}U`ch9Br#Z4;?~eICOF3TRpBXlh#cUBGf}B}hI9z%i~xb&iuh zH;b9EjXa%pKPzx-M$9-)#2EDn=5nq8~z8t7cSk0dP?1CjqQE>Lo z%I9>Lx1BZBS-st`I|vDecICRV;d~tyS|0XLT(@c;9QJHnOZWRk1+(6lEcyujKWlOg z^kRYc0;QYvjilBlBjyrWQYyS0i;Fna#gEyH**rIRFjI}IM3M^a<`pq!i>?c;AS2|T zygmlpIAT$++0iYq#DrGaCfN6z`*zHUZ(zH@XD;1yD>f&5lSLpvTODCjKwYylOlf$% zZh(CFwP>JA)E0hvDK&%m&#x#s@%WM<+R4b^_V&Y&;MJ3IziO3gt2`mNeCn=3RZLss ziDccxf#fDn-=-{_HOPz~#-x_j@N;k^yB}bg*;l7xcc&}Oa9}2LCj%1aMUCZ}X? z_t1*Wq6QO9LbvZ_+PY*?=hQwz)y$}nfTU0j?2um>txaXUHUFqtMR%3yGrMF&R%xY< zIKktGKSVSTht{reRN0`3CzaSibX7g&S9Ln2|I9+Cp_rbkcTHat;1qQ5Y@ zT6!ntI5}dc3O$QC?vCZN%+LerXJ*mdtFdSk5ZICjKi3^LuG#&3I@>a^Gzv?TMb$3= zKW~;T)EAo+*6|~j7Z;g_%!T{Xa{R{!ob5xJgSNa<*yv}LMsXEi2ODI@QU{z^T%m`p zVq6JLZb?Z9YN%GxEKlGk39Ri~ZbN^&03E&iumO8?ZlFcTR7OjE=J)sc#3W^&;+4Ze z2U|yUw%30JaQMs|Gq5+jNDHEhu7zqayj9aT|gnYi;T zIJE9~38M(8oT{J}ZJC(D9`}jk>V+)lY7Q*Kz@aquyjl=8W`Fm_HjTe$eFC?e3a}b^ zuoAHwLdcAVa{Q^wMcyU#zlBBl{q?=ehV~?l<*TJfUtsj8fkRU%(mTS>1BhDHD4Ae}{*(UvVI~MExh2K{(Fnj$Us{mCX3`ySdYWij=(uMD=?yo87sIH=?M2$MYppZ+9_T$~jX5(bBIyPdhI zesXv$Vk)7PJbkLyA0bodL$7JOYX<)tj`~(Kwt{`Uo7`U*`9+j*w-MTeAx1|^a0CuU z1Wj9Hw@63}Q&9B$o&d(H(sf8%-Pft!_%>M?VK^sXxYJ`6EX~LJ82rblcE=#|=dTnW z&>x*7J2r|4nMr@s1ZC~LJ(TWBGLPcR9KaR)fSdzpBjE>$W-l@{9_JR!%nDYdnmlN9 zA?Ur2(cYPHL|_f&m^B}9>PS3sl5P!>MU19e)+*f3`jG<9y=CrO0db0sbMO$%cHR3m z3=hCjG!~YYNqkVM1!rcAnxv6r^xq6QJK~cCK4;9Lz70)U?W{y_287pV#j#t+|K6lkoJ=TW^Up5j{bYAj9u+j4FSPwD=p?(5#q>wa&hIgVPi%yRhfMn?_Vt{2$ps2Zh;*y(%)?d zY5YVX_uAUc1ybyn=JN?I0waxXe*9$iM4knQ_vtV2*W;#_j!`Az7|ArInFv{ zcYz(Z-qm)#t#|&NH(2TD{hj`Qnti(B)raUUX}+y&Nk-?xKZe1+9|{EnZjZD(s4(sL z-9#*@U?u%jqu)TuOjgq0rtGr~c%E`AIv1fH8ywZ1_UTH*aZ`~qU3dimU_UArfC%_0 z1^Npcv=%TmJeA_?cj#(sQqJB$x_pmzhm;Zr!3Y9*W3{{f?Pr>Ot{ literal 0 HcmV?d00001 diff --git a/main.cpp b/main.cpp new file mode 100644 index 0000000..51a4aab --- /dev/null +++ b/main.cpp @@ -0,0 +1,18 @@ +#include "detect.h" + +#define dprintf(format, ...) DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_ERROR_LEVEL, (format), __VA_ARGS__) + +EXTERN_C +NTSTATUS +DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) +{ + dprintf("[Hello]: DriverEntry!\n"); + + bool bDetect = AntiKernelDbgByPoolTag(); + if (bDetect) + { + dprintf("[Detect]: By AntiKernelDbgByPoolTag!\n"); + } + + return STATUS_VIRUS_DELETED; +} diff --git a/poc.sln b/poc.sln new file mode 100644 index 0000000..dc533a5 --- /dev/null +++ b/poc.sln @@ -0,0 +1,51 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.31613.86 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "poc", "poc.vcxproj", "{5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM = Debug|ARM + Debug|ARM64 = Debug|ARM64 + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|ARM = Release|ARM + Release|ARM64 = Release|ARM64 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|ARM.ActiveCfg = Debug|ARM + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|ARM.Build.0 = Debug|ARM + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|ARM.Deploy.0 = Debug|ARM + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|ARM64.Build.0 = Debug|ARM64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|ARM64.Deploy.0 = Debug|ARM64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|x64.ActiveCfg = Debug|x64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|x64.Build.0 = Debug|x64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|x64.Deploy.0 = Debug|x64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|x86.ActiveCfg = Debug|Win32 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|x86.Build.0 = Debug|Win32 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Debug|x86.Deploy.0 = Debug|Win32 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|ARM.ActiveCfg = Release|ARM + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|ARM.Build.0 = Release|ARM + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|ARM.Deploy.0 = Release|ARM + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|ARM64.ActiveCfg = Release|ARM64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|ARM64.Build.0 = Release|ARM64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|ARM64.Deploy.0 = Release|ARM64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|x64.ActiveCfg = Release|x64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|x64.Build.0 = Release|x64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|x64.Deploy.0 = Release|x64 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|x86.ActiveCfg = Release|Win32 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|x86.Build.0 = Release|Win32 + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D}.Release|x86.Deploy.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {FB967A48-09F4-457F-A4C4-D809908CA7CE} + EndGlobalSection +EndGlobal diff --git a/poc.vcxproj b/poc.vcxproj new file mode 100644 index 0000000..0f319b0 --- /dev/null +++ b/poc.vcxproj @@ -0,0 +1,295 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + Debug + ARM + + + Release + ARM + + + Debug + ARM64 + + + Release + ARM64 + + + + {5DEEDF67-26CB-4AF6-A8B6-96BF7F1F898D} + {1bc93793-694f-48fe-9372-81e2b05556fd} + v4.5 + 12.0 + Debug + Win32 + poc + $(LatestTargetPlatformVersion) + + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + + + false + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + + + false + + + Windows10 + true + LLVM-MSVC_v142_KernelMode + Driver + KMDF + + + false + + + Windows10 + false + LLVM-MSVC_v142_KernelMode + Driver + KMDF + + + false + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + + + false + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + + + false + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + + + false + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + + + false + + + + + + + + + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + + Level3 + + + + + false + false + false + + + DriverEntry + + + + + Level3 + + + + + false + false + false + + + DriverEntry + + + + + Level3 + + + + + false + false + false + + + DriverEntry + + + + + Level3 + + + + + false + false + false + + + DriverEntry + + + + + Level3 + + + + + false + false + false + + + DriverEntry + + + + + Level3 + + + + + false + false + false + + + DriverEntry + + + + + Level3 + + + + + false + false + false + + + DriverEntry + + + + + Level3 + + + + + false + false + false + + + DriverEntry + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/poc.vcxproj.filters b/poc.vcxproj.filters new file mode 100644 index 0000000..84a2e20 --- /dev/null +++ b/poc.vcxproj.filters @@ -0,0 +1,28 @@ + + + + + {b893d0be-56c7-46a4-99c3-c8ddaf42d898} + + + {1e45d67b-b380-45b9-abc5-3c0a2803c1cb} + + + + + detect + + + util + + + + + + detect + + + util + + + \ No newline at end of file diff --git a/util.cpp b/util.cpp new file mode 100644 index 0000000..b5da659 --- /dev/null +++ b/util.cpp @@ -0,0 +1,59 @@ +#include "util.h" +///////////////////////////////////////////////////////////////////////////// +// NTAPI +EXTERN_C +NTSTATUS +NTAPI +ZwQuerySystemInformation( + IN SYSTEM_INFORMATION_CLASS SystemInformationClass, + OUT PVOID SystemInformation, + IN ULONG Length, + OUT PULONG ReturnLength); + +///////////////////////////////////////////////////////////////////////////// +// FUNCTION +NTSTATUS +EnumPoolTagTable(OUT PSYSTEM_POOLTAG_INFORMATION *Buffer) +{ + NTSTATUS lStatus; + PVOID pBuffer; + ULONG uBufferSize; + ULONG uAttempts; + + uBufferSize = 0x100; + pBuffer = ExAllocatePoolWithTag(NonPagedPoolNx, uBufferSize, 'haha'); + if (!pBuffer) + { + return STATUS_MEMORY_NOT_ALLOCATED; + } + + lStatus = ZwQuerySystemInformation(SystemPoolTagInformation, pBuffer, uBufferSize, &uBufferSize); + uAttempts = 0; + + while (lStatus == STATUS_INFO_LENGTH_MISMATCH && uAttempts < 8) + { + if (pBuffer) + { + ExFreePoolWithTag(pBuffer, 'haha'); + } + + pBuffer = ExAllocatePoolWithTag(NonPagedPoolNx, uBufferSize, 'haha'); + + lStatus = ZwQuerySystemInformation(SystemPoolTagInformation, pBuffer, uBufferSize, &uBufferSize); + uAttempts++; + } + + if (NT_SUCCESS(lStatus)) + { + *Buffer = (PSYSTEM_POOLTAG_INFORMATION)pBuffer; + } + else + { + if (pBuffer) + { + ExFreePoolWithTag(pBuffer, 'haha'); + } + } + + return lStatus; +} diff --git a/util.h b/util.h new file mode 100644 index 0000000..ca3fa44 --- /dev/null +++ b/util.h @@ -0,0 +1,246 @@ +#pragma once +#include + +///////////////////////////////////////////////////////////////////////////// +// STRUCT +#ifndef _SYSTEM_INFORMATION_CLASS +typedef enum _SYSTEM_INFORMATION_CLASS +{ + SystemBasicInformation = 0, + SystemProcessorInformation = 1, + SystemPerformanceInformation = 2, + SystemTimeOfDayInformation = 3, + SystemPathInformation = 4, + SystemProcessInformation = 5, + SystemCallCountInformation = 6, + SystemDeviceInformation = 7, + SystemProcessorPerformanceInformation = 8, + SystemFlagsInformation = 9, + SystemCallTimeInformation = 10, + SystemModuleInformation = 11, + SystemLocksInformation = 12, + SystemStackTraceInformation = 13, + SystemPagedPoolInformation = 14, + SystemNonPagedPoolInformation = 15, + SystemHandleInformation = 16, + SystemObjectInformation = 17, + SystemPageFileInformation = 18, + SystemVdmInstemulInformation = 19, + SystemVdmBopInformation = 20, + SystemFileCacheInformation = 21, + SystemPoolTagInformation = 22, + SystemInterruptInformation = 23, + SystemDpcBehaviorInformation = 24, + SystemFullMemoryInformation = 25, + SystemLoadGdiDriverInformation = 26, + SystemUnloadGdiDriverInformation = 27, + SystemTimeAdjustmentInformation = 28, + SystemSummaryMemoryInformation = 29, + SystemMirrorMemoryInformation = 30, + SystemPerformanceTraceInformation = 31, + SystemObsolete0 = 32, + SystemExceptionInformation = 33, + SystemCrashDumpStateInformation = 34, + SystemKernelDebuggerInformation = 35, + SystemContextSwitchInformation = 36, + SystemRegistryQuotaInformation = 37, + SystemExtendServiceTableInformation = 38, + SystemPrioritySeperation = 39, + SystemVerifierAddDriverInformation = 40, + SystemVerifierRemoveDriverInformation = 41, + SystemProcessorIdleInformation = 42, + SystemLegacyDriverInformation = 43, + SystemCurrentTimeZoneInformation = 44, + SystemLookasideInformation = 45, + SystemTimeSlipNotification = 46, + SystemSessionCreate = 47, + SystemSessionDetach = 48, + SystemSessionInformation = 49, + SystemRangeStartInformation = 50, + SystemVerifierInformation = 51, + SystemVerifierThunkExtend = 52, + SystemSessionProcessInformation = 53, + SystemLoadGdiDriverInSystemSpace = 54, + SystemNumaProcessorMap = 55, + SystemPrefetcherInformation = 56, + SystemExtendedProcessInformation = 57, + SystemRecommendedSharedDataAlignment = 58, + SystemComPlusPackage = 59, + SystemNumaAvailableMemory = 60, + SystemProcessorPowerInformation = 61, + SystemEmulationBasicInformation = 62, + SystemEmulationProcessorInformation = 63, + SystemExtendedHandleInformation = 64, + SystemLostDelayedWriteInformation = 65, + SystemBigPoolInformation = 66, + SystemSessionPoolTagInformation = 67, + SystemSessionMappedViewInformation = 68, + SystemHotpatchInformation = 69, + SystemObjectSecurityMode = 70, + SystemWatchdogTimerHandler = 71, + SystemWatchdogTimerInformation = 72, + SystemLogicalProcessorInformation = 73, + SystemWow64SharedInformationObsolete = 74, + SystemRegisterFirmwareTableInformationHandler = 75, + SystemFirmwareTableInformation = 76, + SystemModuleInformationEx = 77, + SystemVerifierTriageInformation = 78, + SystemSuperfetchInformation = 79, + SystemMemoryListInformation = 80, + SystemFileCacheInformationEx = 81, + SystemThreadPriorityClientIdInformation = 82, + SystemProcessorIdleCycleTimeInformation = 83, + SystemVerifierCancellationInformation = 84, + SystemProcessorPowerInformationEx = 85, + SystemRefTraceInformation = 86, + SystemSpecialPoolInformation = 87, + SystemProcessIdInformation = 88, + SystemErrorPortInformation = 89, + SystemBootEnvironmentInformation = 90, + SystemHypervisorInformation = 91, + SystemVerifierInformationEx = 92, + SystemTimeZoneInformation = 93, + SystemImageFileExecutionOptionsInformation = 94, + SystemCoverageInformation = 95, + SystemPrefetchPatchInformation = 96, + SystemVerifierFaultsInformation = 97, + SystemSystemPartitionInformation = 98, + SystemSystemDiskInformation = 99, + SystemProcessorPerformanceDistribution = 100, + SystemNumaProximityNodeInformation = 101, + SystemDynamicTimeZoneInformation = 102, + SystemCodeIntegrityInformation = 103, + SystemProcessorMicrocodeUpdateInformation = 104, + SystemProcessorBrandString = 105, + SystemVirtualAddressInformation = 106, + SystemLogicalProcessorAndGroupInformation = 107, + SystemProcessorCycleTimeInformation = 108, + SystemStoreInformation = 109, + SystemRegistryAppendString = 110, + SystemAitSamplingValue = 111, + SystemVhdBootInformation = 112, + SystemCpuQuotaInformation = 113, + SystemNativeBasicInformation = 114, + SystemErrorPortTimeouts = 115, + SystemLowPriorityIoInformation = 116, + SystemBootEntropyInformation = 117, + SystemVerifierCountersInformation = 118, + SystemPagedPoolInformationEx = 119, + SystemSystemPtesInformationEx = 120, + SystemNodeDistanceInformation = 121, + SystemAcpiAuditInformation = 122, + SystemBasicPerformanceInformation = 123, + SystemQueryPerformanceCounterInformation = 124, + SystemSessionBigPoolInformation = 125, + SystemBootGraphicsInformation = 126, + SystemScrubPhysicalMemoryInformation = 127, + SystemBadPageInformation = 128, + SystemProcessorProfileControlArea = 129, + SystemCombinePhysicalMemoryInformation = 130, + SystemEntropyInterruptTimingInformation = 131, + SystemConsoleInformation = 132, + SystemPlatformBinaryInformation = 133, + SystemPolicyInformation = 134, + SystemHypervisorProcessorCountInformation = 135, + SystemDeviceDataInformation = 136, + SystemDeviceDataEnumerationInformation = 137, + SystemMemoryTopologyInformation = 138, + SystemMemoryChannelInformation = 139, + SystemBootLogoInformation = 140, + SystemProcessorPerformanceInformationEx = 141, + SystemSpare0 = 142, + SystemSecureBootPolicyInformation = 143, + SystemPageFileInformationEx = 144, + SystemSecureBootInformation = 145, + SystemEntropyInterruptTimingRawInformation = 146, + SystemPortableWorkspaceEfiLauncherInformation = 147, + SystemFullProcessInformation = 148, + SystemKernelDebuggerInformationEx = 149, + SystemBootMetadataInformation = 150, + SystemSoftRebootInformation = 151, + SystemElamCertificateInformation = 152, + SystemOfflineDumpConfigInformation = 153, + SystemProcessorFeaturesInformation = 154, + SystemRegistryReconciliationInformation = 155, + SystemEdidInformation = 156, + SystemManufacturingInformation = 157, + SystemEnergyEstimationConfigInformation = 158, + SystemHypervisorDetailInformation = 159, + SystemProcessorCycleStatsInformation = 160, + SystemVmGenerationCountInformation = 161, + SystemTrustedPlatformModuleInformation = 162, + SystemKernelDebuggerFlags = 163, + SystemCodeIntegrityPolicyInformation = 164, + SystemIsolatedUserModeInformation = 165, + SystemHardwareSecurityTestInterfaceResultsInformation = 166, + SystemSingleModuleInformation = 167, + SystemAllowedCpuSetsInformation = 168, + SystemVsmProtectionInformation = 169, + SystemInterruptCpuSetsInformation = 170, + SystemSecureBootPolicyFullInformation = 171, + SystemCodeIntegrityPolicyFullInformation = 172, + SystemAffinitizedInterruptProcessorInformation = 173, + SystemRootSiloInformation = 174, + SystemCpuSetInformation = 175, + SystemCpuSetTagInformation = 176, + SystemWin32WerStartCallout = 177, + SystemSecureKernelProfileInformation = 178, + SystemCodeIntegrityPlatformManifestInformation = 179, + SystemInterruptSteeringInformation = 180, + SystemSupportedProcessorArchitectures = 181, + SystemMemoryUsageInformation = 182, + SystemCodeIntegrityCertificateInformation = 183, + SystemPhysicalMemoryInformation = 184, + SystemControlFlowTransition = 185, + SystemKernelDebuggingAllowed = 186, + SystemActivityModerationExeState = 187, + SystemActivityModerationUserSettings = 188, + SystemCodeIntegrityPoliciesFullInformation = 189, + SystemCodeIntegrityUnlockInformation = 190, + SystemIntegrityQuotaInformation = 191, + SystemFlushInformation = 192, + SystemProcessorIdleMaskInformation = 193, + SystemSecureDumpEncryptionInformation = 194, + SystemWriteConstraintInformation = 195, + SystemKernelVaShadowInformation = 196, + SystemHypervisorSharedPageInformation = 197, + SystemFirmwareBootPerformanceInformation = 198, + SystemCodeIntegrityVerificationInformation = 199, + SystemFirmwarePartitionInformation = 200, + SystemSpeculationControlInformation = 201, + SystemDmaGuardPolicyInformation = 202, + SystemEnclaveLaunchControlInformation = 203, + SystemWorkloadAllowedCpuSetsInformation = 204, + SystemCodeIntegrityUnlockModeInformation = 205, + SystemLeapSecondInformation = 206, + SystemFlags2Information = 207, + MaxSystemInfoClass = 208, +} SYSTEM_INFORMATION_CLASS, + *PSYSTEM_INFORMATION_CLASS; +#endif + +typedef struct _SYSTEM_POOLTAG +{ // x86 = 28, x64 = 40 + union + { + UCHAR Tag[4]; // 0x000 0x000 + ULONG TagUlong; // 0x000 0x000 + } DUMMYUNIONNAME; + ULONG PagedAllocs; // 0x004 0x004 + ULONG PagedFrees; // 0x008 0x008 + SIZE_T PagedUsed; // 0x00c 0x010 + ULONG NonPagedAllocs; // 0x010 0x018 + ULONG NonPagedFrees; // 0x014 0x01c + SIZE_T NonPagedUsed; // 0x018 0x020 +} SYSTEM_POOLTAG, *PSYSTEM_POOLTAG; + +typedef struct _SYSTEM_POOLTAG_INFORMATION +{ // x86 = 32, x64 = 48 + ULONG Count; // 0x000 0x000 + SYSTEM_POOLTAG TagInfo[1]; // 0x004 0x008 +} SYSTEM_POOLTAG_INFORMATION, *PSYSTEM_POOLTAG_INFORMATION; + +///////////////////////////////////////////////////////////////////////////// +// FUNCTION +NTSTATUS +EnumPoolTagTable(OUT PSYSTEM_POOLTAG_INFORMATION *Buffer);